Windows

Overview Windows Server 2022 (build 10.0.20348). Stack: Apache XAMPP + PHP 8.1. Stage Technique Result Recon nmap: 22 (SSH), 80 (HTTP), 3389 (RDP) Windows, a video upload form Foothold .wax/.asx playlist leaks Net-NTLMv2 via Responder hash for MEDIA\enox Crack hashcat -m 5600 + rockyou enox:1234virus@ Access SSH (WinRM/5985 is closed) shell as enox Lateral NTFS junction from Uploads\<md5> to C:\xampp\htdocs write a webshell as Apache Shell webshell + reverse shell nt authority\local service PrivEsc FullPowers (recover SeImpersonate) then GodPotato nt authority\system Two official paths to SYSTEM: ...

Overview Windows Server 2019 (Build 10.0.17763). Attacker IP (tun0): 10.10.14.x. Key techniques: LFI/RFI, PHP session poisoning, blacklist bypass, PSCredential lateral movement, malicious CHM, Net-NTLMv2 capture and crack. 1 2 3 4 5 6 7 8 9 10 11 12 nmap -> IIS + PHP +- LFI in ?lang= (blog) +- read the PHP session file (C:\Windows\TEMP\sess_<PHPSESSID>) +- PHP session poisoning: PHP code in the "username" field +- RCE as NT AUTHORITY\IUSR +- download nc64.exe -> reverse shell (IUSR) +- db.php -> MySQL password 36mEAhz/B8xQ~2VM +- password reuse -> PSCredential -> shell as SNIPER\chris (user flag) +- malicious .chm in C:\Docs (opened by the admin) +- Responder captures the admin Net-NTLMv2 +- hashcat -m 5600 -> butterfly!#1 +- PSCredential -> shell as Administrator (root flag) Reconnaissance 1 2 3 4 5 # 1) fast sweep of all ports ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.x | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) # 2) service/script scan on open ports only nmap -p$ports -sC -sV 10.10.10.x Result: Windows, IIS, a PHP server. The “Sniper Co.” site has a login page and a blog. ...

Overview Windows Server Domain Controller. Domain: tombwatcher.htb. DC: DC01.tombwatcher.htb (10.10.10.x). A chain of AD ACL/ACE abuses ending in ADCS ESC15 (CVE-2024-49019). 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 henry (starting credentials) | WriteSPN v alfred -- targeted Kerberoast -> hashcat -> password "basketball" | AddSelf v INFRASTRUCTURE -- group with ReadGMSAPassword | ReadGMSAPassword v ansible_dev$ -- gMSA, read msDS-ManagedPassword -> NTLM hash | ForceChangePassword v sam -- password reset | WriteOwner -> set owner -> add GenericAll -> reset password v john -- member of Remote Management Users -> WinRM -> user flag | GenericAll over OU=ADCS v === ADCS / ESC15 === 1. Certipy find -> the WebServer template has an orphaned SID in Enrollment Rights 2. AD Recycle Bin -> 3x cert_admin; SID ...-1111 = GUID 938182c3... 3. Restore-ADObject -> cert_admin returns to OU=ADCS and regains the template right 4. dacledit (inheritance) -> john gets FullControl over cert_admin -> password reset 5. ESC15: request with an injected "Enrollment Agent" Application Policy 6. request on-behalf-of Administrator -> administrator.pfx 7. certipy auth -> Administrator NT hash -> PtH -> root flag Each step is one ACE/permission in AD that lets you take over the next object. The final stage combines AD Recycle Bin with an ADCS misconfiguration. ...

Overview Machine author: xct. Windows Server Domain Controller. Domain: cicada.vl. Host: DC-JPQ225. Kill chain: a password on a sticky note in an image from an open NFS share, Kerberos authentication (NTLM disabled), ADCS vulnerable to ESC8, a Kerberos relay (bypassing the self-relay block) plus PetitPotam coercion, a certificate as the DC machine account, DCSync, the Administrator hash, a shell. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 [NFS 2049] share /profiles (everyone) | exfil vacation.png + marketing.png v [OSINT/image] password on a sticky note: Rosie.Powell : Cicada123 | auth ONLY via Kerberos (NTLM disabled) v [ADCS] certipy find -> CA vulnerable to ESC8 (Web Enrollment over HTTP) | NTLM self-relay blocked + NTLM disabled -> need a Kerberos relay v [DNS + coercion] bloodyAD: a DNS record with a serialized empty CREDENTIAL_TARGET_INFORMATION | PetitPotam forces the DC to auth to us v [certipy relay] Kerberos relay -> /certsrv/certfnsh.asp -> cert for DC-JPQ225$ v [certipy auth] PKINIT -> TGT + machine-account NT hash v [secretsdump] DCSync -> Administrator hash v [wmiexec] shell as cicada\administrator -> user.txt + root.txt The key lesson: how to perform ESC8 in an environment where NTLM is fully disabled, so the classic NTLM relay does not work. The solution is a Kerberos relay using a crafted DNS record containing a serialized (empty) CREDENTIAL_TARGET_INFORMATION structure, which bypasses the self-relay restriction. ...