Exercise: Enumeration and privilege escalation on Resolute
We introduced this machine previously when we looked at rpcclient and RIDs and SIDs. We will go through it again bearing in mind that we have covered the first step previously.
Resolute is a Windows Active Directory Domain Controller and the initial access is obtained after trying a default password that is found through enumeration of AD domain users using RPCClient. Through this discover that the password works for user Melanie and once on the box, we use winPEAS to discover a hidden directory that has been used to audit PowerShell script use. There is another password in this file for the user Ryan. Getting onto the box as Ryan, we again enumerate and discover that this user is part of the DNS Admin group. This can be exploited to load a reverse shell DLL using DNSCMD to get an elevated shell.
An nmap scan of the box reveals that it is likely an AD domain controller with DNS, Kerberos, LDAP, SMB and RPC services exposed. The domain name is megabank.local and the computer name is resolute.
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP
(Domain: megabank.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393
microsoft-ds (workgroup: MEGABANK)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP
(Domain: megabank.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49671/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49683/tcp open msrpc Microsoft Windows RPC
49712/tcp open tcpwrapped
Service Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 2h49m41s, deviation: 4h37m09s, median: 9m39s
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Resolute
| NetBIOS computer name: RESOLUTE\x00
| Domain name: megabank.local
| Forest name: megabank.local
| FQDN: Resolute.megabank.local
|_ System time: 2021-01-07T04:37:05-08:00
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2021-01-07T12:37:03
|_ start_date: 2021-01-07T12:31:38Looking at SMB we don't find any shares exposed:
Using rpcclient with null session (user blank and no password), we do get in:
Taking the users and putting it into a file rids.txt and then using cut to extract just the usernames we can create a file of those:
Back to rpcclient, we can use querydispinfo to get more information about the users we found:
That gives us a password that was used when accounts were created of Welcome123! We can try this with crackmapexec to test it with all of the usernames we have already discovered:
This gives us a login with the user melanie that we can then use evil-winrm to logon with and get the user.txt file:
We can now upload winPEAS.exe using evil-winrm's built in feature of uploading files:
When we run winPEAS, you should notice that in the PowerShell description, it mentions a directory for transcripts:
If we change directory to c:\PSTranscripts and do a dir, we won't see anything and we have to look for hidden directories and files to be able to do that. Eventually we find a file in the path c:\PSTranscripts\20191203
We can download this file using the download command and look at it on our box. In the file, we notice a command that uses the user ryan with a password of Serv3r4Admin4cc123!
We can then use evil-winrm to login as user ryan. In the c:\Users\ryan\Desktop directory there is a file called note.txt. After downloading it for our audit purposes, the contents reveal that any changes that are made to the system will be reverted after 1 minute. Running winPEAS again for the user ryan does not show any specific vulnerabilities apart from the fact that he is part of the DnsAdmins group. We could have also seen this by using the whoami /all command. We can get more information about this using Get-ADGroupMember:
DnsAdmins have the ability to install plugins to DNS that is running on the machine. A plugin is a library that adds functionality to DNS and it is a Dynamic Link Library (DLL). The easy way to do this is to create a reverse shell DLL using msfvenom, configure DNS to use it, then stop and restart the DNS server (https://medium.com/techzap/dns-admin-privesc-in-active-directory-ad-windows-ecc7ed5a21a2). The problem with this is that it will cause the DNS server to hang and become unresponsive. On Hack The Box, that is sort of ok because the system gets reset every minute, however, in a real assignment, you would not want to cause a major part of an organization's infrastructure to become inoperable. IppSec (https://www.youtube.com/watch?v=8KJebvmd1Fk&t=2130) shows a way of writing a custom DLL that uses threads to avoid this issue and so is a better approach but more complicated as the code is in C++ and you need the environment to build it. You can find the code for this approach on GitHub (https://github.com/oztechmuse/Code4HackTheBox/tree/master/Machines/Resolute/revshell-dns-dll/dns-plugindll-vcpp).
The first thing to do is create a DLL with msfvenom. For the time being, this can't be a meterpreter shell because of constraints on the DLL.
We can then start an SMB server using Impacket's smbserver.py to make the DLL accessible to the machine:
You will see a hit on the SMB server and then a reverse shell contacting your netcat listener:
Last updated
Was this helpful?