Module 26: Assembling the Pieces
Enumerating the Public Network
MAILSRV1
# Setting up a basic directory structure for the assessment
kali@kali:~$ mkdir beyond
kali@kali:~$ cd beyond
kali@kali:~/beyond$ mkdir mailsrv1
kali@kali:~/beyond$ mkdir websrv1
kali@kali:~/beyond$ touch creds.txtDocumenting our findings is a crucial process for every penetration test. For this Module, we'll store results in the basic work environment we just set up. However, Markdown editors, such as Obsidian, have become quite popular for documenting findings and data in real assessments as they are application-independent and contain functions that will simplify report writing and collaboration.
Beginning with a port scan:
# We'll use -sV to enable service and version detection as well as -sC to use Nmap's default scripts. In addition, we'll enter -oN to create an output file containing the scan results.
kali@kali:~/beyond$ sudo nmap -sC -sV -oN mailsrv1/nmap 192.168.50.242
Starting Nmap 7.92 ( https://nmap.org ) at 2022-09-29 08:53 EDT
Nmap scan report for 192.168.50.242
Host is up (0.11s latency).
Not shown: 992 closed tcp ports (reset)
PORT STATE SERVICE VERSION
25/tcp open smtp hMailServer smtpd
| smtp-commands: MAILSRV1, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
110/tcp open pop3 hMailServer pop3d
|_pop3-capabilities: UIDL USER TOP
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
143/tcp open imap hMailServer imapd
|_imap-capabilities: IMAP4 CHILDREN OK ACL IMAP4rev1 completed CAPABILITY NAMESPACE IDLE RIGHTS=texkA0001 SORT QUOTA
445/tcp open microsoft-ds?
587/tcp open smtp hMailServer smtpd
| smtp-commands: MAILSRV1, SIZE 20480000, AUTH LOGIN, HELP
|_ 211 DATA HELO EHLO MAIL NOOP QUIT RCPT RSET SAML TURN VRFY
Service Info: Host: MAILSRV1; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2022-09-29T12:54:00
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
|_clock-skew: 21s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.95 secondsIn a real penetration test, we would also use passive information gathering techniques such as Google Dorks and leaked password databases to obtain additional information. This would potentially provide us with usernames, passwords, and sensitive information.
Even if we had found a vulnerability with a matching exploit providing the code execution, we should not skip the remaining enumeration steps. While we may get access to the target system, we could potentially miss out on vital data or information for other services and systems.
Trying to bust some directories:
Not every enumeration technique needs to provide actionable results. In the initial information gathering phase, it is important to perform a variety of enumeration methods to get a complete picture of a system.
WEBSRV1
Nmap scanning new target:
Using whatweb to determine the technology stack of the webpage:
Using wpscan to enumerate wordpress vulnerabilities:
Using searchsploit to search for vulnerabilities in plugins discovered, staring with the outdated duplicator plugin:
Attacking a Public Machine
Initial Foothold
Examining an exploit found via searchsploit:
Using the exploit to get daniela's private ssh key:
Making the private key usable and finding it has a passphrase:
Cracking the passphrase on the private key:
Using the private key with the cracked passphrase:
A Link to the Past
Host linpeas.sh via
python3 -m http.server 80Transfer to websrv1
Run linpeas.sh
Decide on path of attack. In our case we abuse being able to execute
gitwith sudo, without a password.Check out the git history via
git logthen display the differences withgit showto avoid disrupting the client's web server.
Gaining Access to the Internal Network
Domain Credentials
Using crackmapexec with the credentials we've discovered so far:
This shows that john has valid credentials to MAILSRV1, we've identified the domain name as beyond.com and reviewing nmap shows there likely aren't any services we can utilize our validated credentials on.
This leave us with two options: 1. Further enumerate SMB on MAILSRV1, checking for sensitive data on accessible shares. 2. Prepare a malicious attachment and send a phishing email as john to daniela and marcus.
Using crackmapexec to list SMB shares:
No dice, time to do some phishing.
Phishing for Access
Prepping the WebDAV share:
Creating our malicious attachment:
Now let's make a shortcut to execute a reverse shell:
Copying powercat to our current directory, hosting it via python as well as starting a netcat listener:
Using swaks to send the email:
Waiting a few moments...
Enumerating the Internal Network
Situational Awareness
Grabbing and running winPEAS:
WinPEAS is not always correct, validate information when you can:
Using the network information and known hosts to update our computers.txt:
No privilege escalation vector found, moving on to enumerating the AD environment and its objects.
Starting with SharpHound:
Listing files to locate the zip archive with our enumeration results:
Starting an SMB server on our kali device to transfer the file:
Copying the .zip over:
Clicking on each object shown will display information about the object:
A new host was discovered, let's use nslookup to find its IP address:
We could have also used PowerView or LDAP queries to obtain all of this information. However, in most penetration tests, we want to use BloodHound first as the output of the other methods can be quite overwhelming. It's an effective and powerful tool to gain a deeper understanding of the Active Directory environment in a short amount of time. We can also use raw or pre-built queries to identify highly complex attack vectors and display them in an interactive graphical view.
Services and Sessions
Cypher is a querynig language, so we can build a relationship query with the following syntax (NODES) - [:RELATIONSHIP] -> (NODES).
In our example, we'll query for active sessions on computers by users:
We see Beccy, a domain admin, has an active session on MAILSRV1. We may be able to extract their NTLM hash if we get privileged access on MAILSRV1. BloodHound uses SIDs to represent local accounts, in this case the RID 500 implies there is an active session of the local Administrator on INTERNALSRV1.
Now we'll identify all kerberoastable users in the domain with the List all Kerberoastable Accounts pre-built query in BloodHound.
Even though we've found the SPN for daniela indicating a web server is running on INTERNALSRV1, we should collect all information, prioritize it, and then perform potential attacks.
Creating a staged meterpreter TCP reverse shell as an executable:
Starting a multi/handler listener with corresponding settings with ExitOnSession set to false so we don't need to restart the listener every time:
Downloading met.exe on CLIENTWK1 so we get our session:
Catching our session and using multi/manage/autoroute and auxiliary/server/socks_proxy to create a SOCKS5 proxy toa ccess the internal network from our Kali box:
Update our /etc/proxychains4.conf to use the correct settings:
Using crackmapexec's SMB module to gather shares information using john's credentials:
CrackMapExec version 5.4.0 may throw the error The NETBIOS connection with the remote host is timed out for DCSRV1 or doesn't provide any output at all. Version 5.4.1 contains a fix to address this issue.
Because MAILSRV1 and INTERNALSRV1 have SMB signing set to False, we may be able to perform relay attacks if we can force an authentication request.
Performing an nmap scan on the targets. We must specify -sT to perform a TCP scan, otherwise Nmap will not work over Proxychains:
Use chisel v1.7.7 (go1.17.6). Future versions have weird issues.
Using chisel to tunnel our traffic through CLIENTWK1 to INTERNALSRV1:
With chisel connected, we can now browse to port 80 on 172.16.6.241 via port 80 on our Kali machine (127.0.0.1) by using Firefox:
Attempting to browse to http://127.0.0.1/wordpress/wp-admin results in an Unable to connect error due to name resolution for the internal server. Adding it to our hosts file will help here:
Now we can properly get to the Administrator login page of Wordpress on INTERNALSRV1. Trying our current collection of credentials fails to get us in as well as common passwords like admin:admin.
Attacking an Internal Web Application
Speak Kerberoast and Enter
Moving onto kerberoasting using our one set of valid credentials:
More troubles, if connection is refused immediately, try commenting out the proxy_dns setting in /etc/proxychains4.conf
Storing the hash and using hashcat to try and crack it:
With the cracked password, let's try and login to WordPress at /wp-admin via our forwarded port:
π We're in! π
Abuse a WordPress Plugin for a Relay Attack
First let's gather information in WordPress, starting with configured users:
Checking out the only enabled plugin:
Potential attack vectors:
Attempt to upload a malicious WordPress plugin. Web shell or reverse shell.
Attempt to force an authentication via the Backup directory path for a relay attack due to SMB signing being disabled.
Because the second vector results in code execution and provides a potential vector to achieve a goal of the penetration test, we'll attempt this one first.
Setting up impacket-ntlmrelayx. We'll use --no-http-server and -smb2support to disable the HTTP server and enable SMB2 support. We'll specify the external address for MAILSRV1, 192.168.50.242, as target for the relay attack. By entering the external address, we don't have to proxy our relay attack via Proxychains. Finally, we'll base64-encode a PowerShell reverse shell oneliner that will connect back to our Kali machine on port 9999 and provide it as a command to -c:
Setting up our reverse shell listener:
Save the modified directory path by scrolling down and clicking on Save. This should cause the WordPress plugin to authenticate to our ntlmrelay.
We now see the reverse shell connection:
Gaining Access to the Domain Controller
Cached Credentials
Downloading our previous meterpreter reverse shell:
Interacting with the session and spawning a new powershell command line shell:
Transferring mimikatz and dumping credentials:
We got beccy's (a domain admin) password! Time to get over to the DC.
Lateral Movement
Because we have the clear text password and NTLM hash for beccy, we can use impacket-psexec to get an interactive shell on DCSRV1. We could use either of these, in this example we use the hash:
Penetration test complete! Time to write a report!
Last updated