search
githubEdit

Module 26: Assembling the Pieces

hashtag
Enumerating the Public Network

hashtag
MAILSRV1

# Setting up a basic directory structure for the assessment
kali@kali:~$ mkdir beyond

kali@kali:~$ cd beyond

kali@kali:~/beyond$ mkdir mailsrv1

kali@kali:~/beyond$ mkdir websrv1

kali@kali:~/beyond$ touch creds.txt
circle-exclamation

Documenting our findings is a crucial process for every penetration test. For this Module, we'll store results in the basic work environment we just set up. However, Markdown editors, such as Obsidian, have become quite popular for documenting findings and data in real assessments as they are application-independent and contain functions that will simplify report writing and collaboration.

Beginning with a port scan:

# We'll use -sV to enable service and version detection as well as -sC to use Nmap's default scripts. In addition, we'll enter -oN to create an output file containing the scan results.
kali@kali:~/beyond$ sudo nmap -sC -sV -oN mailsrv1/nmap 192.168.50.242
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-29 08:53 EDT
Nmap scan report for 192.168.50.242
Host is up (0.11s latency).
Not shown: 992 closed tcp ports (reset)
PORT    STATE SERVICE       VERSION
25/tcp  open  smtp          hMailServer smtpd
| smtp-commands: MAILSRV1, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp  open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
110/tcp open  pop3          hMailServer pop3d
|_pop3-capabilities: UIDL USER TOP
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
143/tcp open  imap          hMailServer imapd
|_imap-capabilities: IMAP4 CHILDREN OK ACL IMAP4rev1 completed CAPABILITY NAMESPACE IDLE RIGHTS=texkA0001 SORT QUOTA
445/tcp open  microsoft-ds?
587/tcp open  smtp          hMailServer smtpd
| smtp-commands: MAILSRV1, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
Service Info: Host: MAILSRV1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2022-09-29T12:54:00
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
|_clock-skew: 21s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.95 seconds
circle-exclamation

In a real penetration test, we would also use passive information gathering techniques such as Google Dorks and leaked password databases to obtain additional information. This would potentially provide us with usernames, passwords, and sensitive information.

Even if we had found a vulnerability with a matching exploit providing the code execution, we should not skip the remaining enumeration steps. While we may get access to the target system, we could potentially miss out on vital data or information for other services and systems.

Trying to bust some directories:

circle-exclamation

Not every enumeration technique needs to provide actionable results. In the initial information gathering phase, it is important to perform a variety of enumeration methods to get a complete picture of a system.

hashtag
WEBSRV1

circle-info

In a real penetration test, we could scan MAILSRV1 and WEBSRV1 in a parallel fashion. Meaning, that we could perform the scans at the same time to save valuable time for the client. If we do so, it's vital to perform the scans in a structured way to not mix up results or miss findings.

Nmap scanning new target:

Using whatweb to determine the technology stack of the webpage:

Using wpscan to enumerate wordpress vulnerabilities:

Using searchsploit to search for vulnerabilities in plugins discovered, staring with the outdated duplicator plugin:

hashtag
Attacking a Public Machine

hashtag
Initial Foothold

Examining an exploit found via searchsploit:

Using the exploit to get daniela's private ssh key:

Making the private key usable and finding it has a passphrase:

Cracking the passphrase on the private key:

Using the private key with the cracked passphrase:

hashtag
A Link to the Past

  1. Host linpeas.sh via python3 -m http.server 80

  2. Transfer to websrv1

  3. Run linpeas.sh

  4. Decide on path of attack. In our case we abuse being able to execute git with sudo, without a password.

  5. Check out the git history via git log then display the differences with git show to avoid disrupting the client's web server.

hashtag
Gaining Access to the Internal Network

hashtag
Domain Credentials

Using crackmapexec with the credentials we've discovered so far:

This shows that john has valid credentials to MAILSRV1, we've identified the domain name as beyond.com and reviewing nmap shows there likely aren't any services we can utilize our validated credentials on.

This leave us with two options: 1. Further enumerate SMB on MAILSRV1, checking for sensitive data on accessible shares. 2. Prepare a malicious attachment and send a phishing email as john to daniela and marcus.

Using crackmapexec to list SMB shares:

No dice, time to do some phishing.

hashtag
Phishing for Access

Prepping the WebDAV share:

Creating our malicious attachment:

Now let's make a shortcut to execute a reverse shell:

Copying powercat to our current directory, hosting it via python as well as starting a netcat listener:

Using swaks to send the email:

Waiting a few moments...

hashtag
Enumerating the Internal Network

hashtag
Situational Awareness

Grabbing and running winPEAS:

WinPEAS is not always correct, validate information when you can:

Using the network information and known hosts to update our computers.txt:

No privilege escalation vector found, moving on to enumerating the AD environment and its objects.

Starting with SharpHound:

Listing files to locate the zip archive with our enumeration results:

Starting an SMB server on our kali device to transfer the file:

Copying the .zip over:

Upload Zip Archive to BloodHound
Raw Query to show all Computer objects in the BEYOND.COM domain

Clicking on each object shown will display information about the object:

A new host was discovered, let's use nslookup to find its IP address:

circle-exclamation

We could have also used PowerView or LDAP queries to obtain all of this information. However, in most penetration tests, we want to use BloodHound first as the output of the other methods can be quite overwhelming. It's an effective and powerful tool to gain a deeper understanding of the Active Directory environment in a short amount of time. We can also use raw or pre-built queries to identify highly complex attack vectors and display them in an interactive graphical view.

hashtag
Services and Sessions

Cypher is a querynig language, so we can build a relationship query with the following syntax (NODES) - [:RELATIONSHIP] -> (NODES).

In our example, we'll query for active sessions on computers by users:

Display all active sessions in the BEYOND.COM domain

We see Beccy, a domain admin, has an active session on MAILSRV1. We may be able to extract their NTLM hash if we get privileged access on MAILSRV1. BloodHound uses SIDs to represent local accounts, in this case the RID 500 implies there is an active session of the local Administrator on INTERNALSRV1.

Now we'll identify all kerberoastable users in the domain with the List all Kerberoastable Accounts pre-built query in BloodHound.

circle-info

The krbtgt user account acts as service account for the Key Distribution Center (KDC) and is responsible for encrypting and signing Kerberos tickets. When a domain is set up, a password is randomly generated for this user account, making a password attack unfeasible. Therefore, we can often safely skip krbtgt in the context of Kerberoasting.

Even though we've found the SPN for daniela indicating a web server is running on INTERNALSRV1, we should collect all information, prioritize it, and then perform potential attacks.

Creating a staged meterpreter TCP reverse shell as an executable:

Starting a multi/handler listener with corresponding settings with ExitOnSession set to false so we don't need to restart the listener every time:

Downloading met.exe on CLIENTWK1 so we get our session:

Catching our session and using multi/manage/autoroute and auxiliary/server/socks_proxy to create a SOCKS5 proxy toa ccess the internal network from our Kali box:

Update our /etc/proxychains4.conf to use the correct settings:

Using crackmapexec's SMB module to gather shares information using john's credentials:

circle-exclamation

CrackMapExec version 5.4.0 may throw the error The NETBIOS connection with the remote host is timed out for DCSRV1 or doesn't provide any output at all. Version 5.4.1 contains a fix to address this issue.

Because MAILSRV1 and INTERNALSRV1 have SMB signing set to False, we may be able to perform relay attacks if we can force an authentication request.

Performing an nmap scan on the targets. We must specify -sT to perform a TCP scan, otherwise Nmap will not work over Proxychains:

triangle-exclamation

Use chisel v1.7.7 (go1.17.6). Future versions have weird issues.

Using chisel to tunnel our traffic through CLIENTWK1 to INTERNALSRV1:

circle-info

I ran into several issues with chisel here. In my case, I just stopped using it and resorted to proxychains firefox & and went directly to http://172.16.6.241

With chisel connected, we can now browse to port 80 on 172.16.6.241 via port 80 on our Kali machine (127.0.0.1) by using Firefox:

WordPress page on INTERNALSRV1 (172.16.6.241)

Attempting to browse to http://127.0.0.1/wordpress/wp-admin results in an Unable to connect error due to name resolution for the internal server. Adding it to our hosts file will help here:

Now we can properly get to the Administrator login page of Wordpress on INTERNALSRV1. Trying our current collection of credentials fails to get us in as well as common passwords like admin:admin.

hashtag
Attacking an Internal Web Application

hashtag
Speak Kerberoast and Enter

Moving onto kerberoasting using our one set of valid credentials:

circle-exclamation

More troubles, if connection is refused immediately, try commenting out the proxy_dns setting in /etc/proxychains4.conf

Storing the hash and using hashcat to try and crack it:

With the cracked password, let's try and login to WordPress at /wp-admin via our forwarded port:

πŸŽ‰ We're in! πŸŽ‰

hashtag
Abuse a WordPress Plugin for a Relay Attack

First let's gather information in WordPress, starting with configured users:

Daniela is the only WordPress user
General WordPress settings
Installed WordPress Plugins

Checking out the only enabled plugin:

Backup Migration plugin settings

Potential attack vectors:

  1. Attempt to upload a malicious WordPress plugin. Web shell or reverse shell.

  2. Attempt to force an authentication via the Backup directory path for a relay attack due to SMB signing being disabled.

Because the second vector results in code execution and provides a potential vector to achieve a goal of the penetration test, we'll attempt this one first.

Setting up impacket-ntlmrelayx. We'll use --no-http-server and -smb2support to disable the HTTP server and enable SMB2 support. We'll specify the external address for MAILSRV1, 192.168.50.242, as target for the relay attack. By entering the external address, we don't have to proxy our relay attack via Proxychains. Finally, we'll base64-encode a PowerShell reverse shell onelinerarrow-up-right that will connect back to our Kali machine on port 9999 and provide it as a command to -c:

Setting up our reverse shell listener:

Modifying the Backup directory path

Save the modified directory path by scrolling down and clicking on Save. This should cause the WordPress plugin to authenticate to our ntlmrelay.

We now see the reverse shell connection:

hashtag
Gaining Access to the Domain Controller

hashtag
Cached Credentials

Downloading our previous meterpreter reverse shell:

Interacting with the session and spawning a new powershell command line shell:

Transferring mimikatz and dumping credentials:

We got beccy's (a domain admin) password! Time to get over to the DC.

hashtag
Lateral Movement

Because we have the clear text password and NTLM hash for beccy, we can use impacket-psexec to get an interactive shell on DCSRV1. We could use either of these, in this example we use the hash:

Penetration test complete! Time to write a report!

file-pdf
3MB
Module 25 - Assembling the Pieces.pdf
PDF
arrow-up-right-from-squareOpen
PreviousModule 25: Attacking AWS Cloud InfrastructureNextModule 27: Trying Harder: The Challenge Labs

Last updated