Exercise: Enumerating and exploiting AD on Active
We will have a look at another Active Directory case study. Active involves enumeration of SMB and getting a password from a Group Policy Preferences file Groups.xml. With this, we can enumerate users in Active Directory and using Bloodhound again, identify a user that is Kerberoastable. With that, we get an administrative access on the box.
Running nmap, we find a likely domain controller running Windows Server 2008 R2 SP1.
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos
(server time: 2021-01-14 02:58:30Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP
(Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP
(Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5607/tcp filtered unknown
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49162/tcp open msrpc Microsoft Windows RPC
49166/tcp open msrpc Microsoft Windows RPC
49168/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows;
CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 2m44s
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2021-01-14T02:59:29
|_ start_date: 2021-01-14T02:21:56Running smbmap to explore SMB, we get the following shares:
We can use smbmap to recursively list all directories and files using the -R flag. We can do this on the Replication share.
The interesting file here is Groups.xml which is a file that stores Group Policy Preferences which we can retrieve with smbmap:
Before we go on, we should talk about Group Policy in an Active Directory environment. Group Policy is a management technology that allows centralized control over user and computer security settings. A Group Policy Object is a logical container that consists of a Group Policy container and a Group Policy template. Templates are stored on the System Volume (SYSVOL) of each domain controller. Containers are stored in the domain partition of Active Directory. In terms of synchronizing Group Policy Objects to other domain controllers, Active Directory replication is responsible for replicating the containers and File Replication Services (FRS) or Distributed File System Replication (DFSR) is responsible for replicating the SYSVOL.
Group policy is applied to computers and users by the Group Policy client-side extensions. Group Policy Preferences are client side preferences that are saved for a user and as such are extensions of Group Policy. They determine things like environment variables, drive mappings, folder settings, configured printers, start menu, etc. Passwords used to be able to be stored in Group Policy Preference files and these were encrypted using a key that has subsequently become widely available after Microsoft publicly disclosed it (https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be).
Looking at the Groups.xml file, we see
The file contains a password hash (cpassword) for the user SVC_TGS. You can decrypt this using a utility gpp-decrypt.py (https://github.com/t0thkr1s/gpp-decrypt/blob/master/gpp-decrypt.py) or by using cryptii.com as shown below.
Decrypting the cpasssword from Groups.xml. The text is base64 decoded and then decrypted using AES-256 using the published key.
This gives us the password for svc_tgs of GPPstillStandingStrong2k18 (a commentary on the vulnerability that still existed in 2018). We now have read access to the Users directory and can get the user flag in c:\Users\SVC_TGS\Desktop\users.txt by using smbclient.
We can see from the home directories that there are likely at least 2 users: SVC_TGS and Administrator. We can enumerate the AD users using ldapsearch:
Both of these approaches show that we have the three manin users we are interested in SVC_TGS, Administrator and krbtgt, the Kerberos user. We can again explore AD using BloodHound. This time, we will do it from Windows. The instructions for installation on Windows are on the BloodHound documents site (https://bloodhound.readthedocs.io/en/latest/installation/windows.html). To collect the data, we will use SharpHound.exe and we can run that from a command prompt that has authenticated with the domain. We can add active.htb as a hosts entry in the hosts file at c:\Windows\System32\drivers\etc\hosts.
From a command prompt, run a cmd.exe using the command:
Enter the password for the user when prompted. This will open a separate window with the title saying that cmd,exe (running as active.htb\svc_tgs). You can verify that this is running correctly by listing the Users directory. If all has worke correctly, you will not be prompted for a username or password:
From this cmd prompt, we can run SharpHound to get a set of JSON files that are in a ZIP file.
Once this is done, we can launch BloodHound, upload the zip file and then run queries to explore the domain. If we run the query, List all Kerberoastable Accounts, we find that Administrator is kerberoastable. This means that the account has an associated SPN (Service Principle Name).
Another way of doing this is to run the Impacket tool GetUserSPNs. This will do an LDAP query to retrieve the SPNs for any active user accounts and once it has obtained them, will request a service ticket from the TGS for the SPN.
As Administrator had an SPN which was "active/CIFS:445" we got a service ticket that we can now try and crack with John The Ripper:
That gives us a password Ticketmaster1968 which we can use with psexec.py to get remote command shell on the box.
You can find users with SPNs using an ldapsearch:
The interesting thing about the query is the use of the userAccountControl attribute which is a bit mask that has multiple values (http://www.selfadsi.org/ads-attributes/user-userAccountControl.htm). In this case, the query is checking that the account is not disabled (2) and that it is a normal account (512). The userAccountControl attribute can also be queried to check whether the account does not require preauth (4194304).
Last updated
Was this helpful?