Escape

Overview

A Windows machine created by Geiseric features techniques including:

  • Active Directory

  • MSSQL Server UNC Path Injection

  • Credentials Harvest

  • Misconfigured Certificate Templates

  • Silver Ticket Attack

Reconnaissance

Services Discovery

The port scanning result suggests that the target is a domain controller and we got an MSSQL server running on it.

Also, we may access the target remotely later via WinRM.

$ sudo nmap -n -p- -Pn -v -sS -T4 --min-rate 1000 10.129.140.112 -oN ports.nmap
...
PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
1433/tcp open  ms-sql-s
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
...

RootDSE

We can use ldapsearch to get the domain name sequel.htb.

We can check the target's hostname dc.sequel.htb with dig.

SMB

It seems that the SMB null session authentication is enabled on the target.

LogoSMB and Null Sessions: Why Your Pen Test is Probably Wrong | Microsoft Community HubTECHCOMMUNITY.MICROSOFT.COM

We can further enumerate the share Public using smbclient and found a PDF file SQL Server Procedures.pdf.

SQL Server Procedures.pdf

We can learn a lot of information from the PDF file:

  • Domain name sequel.htb.

  • The target company cloned the DC mockup to a dedicated mock SQL instance for the test.

  • Users can authenticate to the MSSQL server using Windows authentication on a domain-joined machine.

  • Users on a non-domain-joined machine need to use cmdkey before authenticate to the MSSQL.

  • We can authenticate the MSSQL server with credential PublicUser:GuestUserCantWrite1 using SQL Server Authentication.

  • Some user names and emails including Ryan, Tom, Brandon, and brandon.brown@sequel.htb.

MSSQL

We can use Impacket-mssqlclient, which uses SQL server authentication by default, to login to the MSSQL server now.

The instance we are connecting to is DC\SQLMOCK.

Initial Access

UNC Path Injection

We can use the stored procedure xp_dirtree to force the MSSQL server to authenticate to a SMB share we control.

We force the MSSQL server to authenticate with our SMB server.

We can then crack it using hashcat with mode 5600 now and we get a credential SQL_SVC:REGGIE1234ronnie.

WinRM

We can access the target using evil-winrm now.

Discovery

LDAP Search

We can't use ldapsearch directly because LDAP signing is enabled.

User Ryan.Cooper

We found an MSSQL log file C:\SQLServer\Logs\ERRORLOG.BAK.

We see the user Ryan.Cooper type his password incorrectly and we can try to login to the target using this password now.

Group

We see that the user Ryan is a member of the group Certificate Service DCOM Access member of which can connect to certification authorities in the enterprise.

It seems that we may abuse the AD CS to achieve domain escalation.

LogoAD CS Domain Escalation - HackTricksbook.hacktricks.xyz

Privilege Escalation

Certified Pre-Owned

Offensive techniques including certificate stealing, persistence, and escalation techniques are outlined in the Certified Pre-Owned - Abusing Active Directory Certificate Services whitepaper.

See Certified Pre-Owned.

Technique ESC1

Users obtain certificates from CA through the certificate enrollment process. Some misconfiguration may result in domain escalation.

LogoRedTeaming_CheatSheet/windows-ad/Domain-Privilege-Escalation.md at main · 0xJs/RedTeaming_CheatSheetGitHub

We can use the tool Certify.exe to enumerate misconfigured certificate templates.

LogoGitHub - GhostPack/Certify: Active Directory certificate abuse.GitHub

Or, we can use the Python package certipy to enumerate from Linux.

LogoGitHub - ly4k/Certipy: Tool for Active Directory Certificate Services enumeration and abuseGitHub

And, we can find a vulnerable certificate template named UserAuthentication:

Certificate Signing Request

We can now use certipy to request the certificate for the user administrator now.

Authentication

We can request the TGT ticket for the user administrator using certificate now.

And, we can login to the target using evil-winrm now.

Miscellaneous

Silver Ticket Attack

Since we got the password of the service account SQL_SVC, we can mint a service-granting ticket for a non-existing SPN using the password hash as in a silver ticket attack.

First, we need the domain SID, in our case S-1-5-21-4078382237-1492182817-2568127209:

We also need the NT-hash 1443ec19da4dac4ffc953bca1b57b4cf:

We can mint the TGS for the user Administrator using Impacket's ticketer with a non-existing SPN without touching the DC now.

We can now login the MSSQL service using the account administrator now.

PreviousForestNextTimelapse

Last updated