We use nmap to figure out what services are running on the target.
$ nmap -Pn -n -sS -p- -T4 --min-rate 1000 <IP>
...
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49667/tcp open unknown
49689/tcp open unknown
49690/tcp open unknown
49702/tcp open unknown
50008/tcp open unknown
64429/tcp open unknown
...
The results reveal the following information.
port 88 tells us that this should be a domain controller
port 389 allows us to fetch information about target AD domain via LDAP
port 5985 may allow us access the target using WinRM later
By querying the RootDSE information, we see that the target domain name is htb.local.
$ ldapsearch -H ldap://<IP> -x -b '' -s base
Initial Access
Alfresco
From the information gathered through anonymous LDAP query, we found a service account named svc-alfresco.
To expand our knowledge of the technology used by our client, the next thing to do is to find what third-party service, which shall be AD-integrated, related this account.
From the configuration, we see that the account related to this service has been configured with Kerberos pre-authentication disable.
This allows us to get the TGT for this account svc-alfresco, and conduct the AS-REP Roasting attack to retrieve the account password from the requested TGT.
AS-REP Roasting
We use the Impacket-GetNPUsers to get the TGT ticket for the account svc-alfresco:
