Timelapse

nmap findings

nmap -p53,88,139,135,389,445,464,593,636,3268,3269,5986,9389,49667,49673,49674,49696,58232 -sV -sC -T4 -Pn -oA 10.10.11.152 10.10.11.152

Starting Nmap 7.93 ( https://nmap.org ) at 2023-08-03 07:03 +08
Nmap scan report for timelapse.htb (10.10.11.152)
Host is up (0.017s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-08-03 07:03:17Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_ssl-date: 2023-08-03T07:04:46+00:00; +7h59m59s from scanner time.
|_http-server-header: Microsoft-HTTPAPI/2.0
| tls-alpn: 
|_  http/1.1
|_http-title: Not Found
| ssl-cert: Subject: commonName=dc01.timelapse.htb
| Not valid before: 2021-10-25T14:05:29
|_Not valid after:  2022-10-25T14:25:29
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
58232/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

SMB enum

smbclient

Using crackmap with 'fake user' and '' empty password

Accessing Shares

Zip cracking

fcrackzip

pfx2john

john

Use the passphrase to exrtract key and cert

decrypt the key using password set just now

dump the cert

Priv Esc

evil-winrm to get shell

  • -S - Enable SSL, because I’m connecting to 5986;

  • -c legacyy_dev_auth.crt - provide the public key certificate

  • -k legacyy_dev_auth.key - provide the private key

  • -i timelapse.htb - host to connect to

Find powershell history (.bash_history in linux)

Reading its content contain password for svc_deploy

Reconnect using svc_deploy

found interesting group in whoami /all

LAPS_Readers seems to imply svc_deploy has access to read from LAPS.

With LAPS, the DC manages the local administrator passwords for computers on the domain. It is common to create a group of users and give them permissions to read these passwords, allowing the trusted administrators access to all the local admin passwords.

Read Password

To read the LAPS password, I just need to use Get-ADComputer and specifically request the ms-mcs-admpwd property:

login as administrator

finding and reading flags

PreviousForestNextSauna

Last updated