search
WINDOWS & ADABOUT ME
HackTheBoxActiveDirectoryWindowsVulnLabs

Baby

Another easy AD machine on HTB (from VulnLabs)

hashtag
1. Reconnaissance and Enumeration

We begin by scanning the target IP 10.129.234.71 with Nmap. The scan reveals a standard Active Directory Domain Controller configuration with DNS, Kerberos, RPC, SMB, LDAP, and WinRM open.

Knowing LDAP is available, we perform an anonymous bind to dump the directory data. In the output, we uncover a hardcoded password within the description attribute of a user named Teresa Bell.

hashtag
2. Initial Access

With a potential set of credentials (Teresa.Bell:BabyStart123!), we attempt to authenticate via SMB and WinRM, but the login fails.

Suspecting that this might be a default initial password used across the IT or Dev departments, we extract a list of users from our previous LDAP dump and spray the password across the domain using netexec.

For Caroline.Robinson it returned STATUS_PASSWORD_MUST_CHANGE. This confirms the password is valid but requires a reset upon first login. We use smbpasswd to update the password to Test123!.(It seems the password is default for every new user, but requires to change upon login)

We verify the newly set credentials (Test123!) with netexec over WinRM, confirming a successful connection and Pwn3d! status.

With remote access verified, we drop into a WinRM shell and secure the user flag.

hashtag
3. Privilege Escalation

To find a path to Domain Admin, we run the Python ingestor for BloodHound.

and in bloodhound it revealed that our user Caroline.Robinson is a part of BACKUP [email protected]. By default, members of the Backup Operators group are granted two extremely powerful Local Security Authority (LSA) user rights:

  • SeBackupPrivilege (Back up files and directories): This privilege allows the user to completely bypass NTFS file read permissions. If a file exists on the Domain Controller, a Backup Operator can read it and copy it, even if the file's ACL explicitly denies them access.

  • SeRestorePrivilege (Restore files and directories): This allows the user to bypass NTFS file write permissions. A Backup Operator can overwrite or modify any file on the system, including critical system binaries or configuration files.

So now the attack path for root flag is clear:

  1. Leverage the SeBackupPrivilege to create a shadow copy or use API calls that trigger the "backup intent" flag.

  2. Copy the NTDS.dit file and the SYSTEM registry hive to a temporary folder or export them over the network.

  3. Take those files offline and use a tool like Impacket's secretsdump.py to decrypt the database and dump every NTLM hash in the domain.

  4. Perform a Pass-the-Hash attack using the Domain Admin's hash to take full control.

We execute these steps using diskshadow natively via our WinRM session. We script the shadow copy creation to avoid interactive prompts.

With the shadow volume mounted as Z:\, we use robocopy with the /b flag (backup mode) to pull down the AD database and SYSTEM hive into our temp directory.

then, download both NTDS.dit, and SYSTEM locally to our Kali machine.

hashtag
4. Dumping Hashes & Root Access

Now that we have the target files locally, we use Impacket to decrypt the database. This allows us to retrieve the NTLM hashes for every account in the baby.vl domain.

With the NT hash for the built-in Administrator account successfully extracted, we use Evil-WinRM to execute a Pass-the-Hash (PtH) attack. This grants us a direct, elevated shell as the Domain Admin, allowing us to read the final root flag.

PreviousSupportNextResolute

Last updated