Once i got the output of Nmap, i found that’s an Active Directory environment and there’s SMB Share.
Press enter or click to view image in full size
So i checked the permissions of user “alex.turner” on this SMB share, And i found that i have READ permission on some shares and got nothing from them.
Press enter or click to view image in full size
Press enter or click to view image in full size
And for discovering the environment, I enumerated the users of this Active Directory environment, I found some users and only one service account “svc_deploy” and three administrators’ accounts.
Press enter or click to view image in full size
I checked the permissions of “alex.turner” on Active Directory Groups, … , And i found that i have “DACL: WRITE” permission on “CN=Deleted Objects” and “Permission: WRITE” on deleted object “Mark Davies” (that’s our target account).
Press enter or click to view image in full size
Once i have these permissions i can restore the deleted user and use his permission on the environment.
Press enter or click to view image in full size
Now i have Active Directory users and deleted users, so i tried “Password Spraying” attack on these users with password of “alex.turner” and i found that it matches with restored user “Mark”.
Press enter or click to view image in full size
Stage2: Finding The First Foothold
Once i got another account’s credentials “Victim Mark:Checkpoint2024!”, I checked his permission on SMB Shares and I’ve got that i have READ, WRITE permission on “DevDrop” share which’s holds VSCode vsix extension.
I’ve successfully got a shell with “ryan.brooks” user, and I’ve got User Flag.
I’ve got data collection via sharphound and map the Active Directory environment.
Stage3: Environment Analysis
I’ve got data collection via SharpHound.exe for mapping Active Directory Environment.
After that i checked “BadSuccessor” (one of the most popular vulnerabilites on windows server recently) and i got two users can perform this attack.
Press enter or click to view image in full size
Press enter or click to view image in full size
Get The Mercury’s stories in your inbox
Join Medium for free to get updates from this writer.
From “BloodHound” map, there’s relationship with “ryan.brooks” and “svc_deploy” account and that’s a user responsible for backups (Maybe have and access on ‘VMBackups’ SMB share) and “ryan.brooks” have needed permission on OU=DMSAHolder
So i’ll perform “BadSuccessor” attack with “ryan.brooks” user.
NOTE: you need to search about dMSA and BadSuccessor, How it works to understand this part.
I got TGT of “ryan.brooks” by Rubeus.exe
Rubeus.exe tgtdeleg /nowrap
Press enter or click to view image in full size
2. I took this base64 encoded TGT and decrypted it then converted to ccache ticket, Now i have “ryan.brooks” credentials i can authenticate with to perform “BadSuccessor” attack.
Press enter or click to view image in full size
Press enter or click to view image in full size
3. Then i created malicious dMSA account using ‘badSuccessor’ module in bloodyAD and i got NT Hash of that account.
Press enter or click to view image in full size
4. I took NT Hash and authenticate with “svc_deploy” username and evil-winrm.
Press enter or click to view image in full size
5. I’ve successfully got “svc_deploy” shell and i have READ permission on “VMBackups” SMB share.
Press enter or click to view image in full size
Stage4: Privilege Escalation
After discovering ‘VMBackups’ SMB share, I found vmware memory snapshot of the windows machine, That’s very interesting cause it may have plaintext credentials and NT Hashes.
I uploaded vmkatz.exe on windows machine to analyze the snapshot, And i’ve successfully got Administrator’s NT Hash.
