text: What's going on YouTube? This is IPSC and we'll be doing administrator from hack the box which is an assumed breach active directory machine meaning we start out with the main credentials and from end mapap we can see just active directory and FTP is running however we cannot connect to FTP because a user doesn't have permissions but we can run blunthound with our credentials that shows we have generic all over one user and force password change over another.

title: HackTheBox - Administrator


text: So we can change both users password and on the second user hop it gives us access to a user in the share moderators group which grants us FTP access and that FTP server host a password safe database which cracking it gives us access to another user. This user has generic right over a user with DC sync privileges. And generic right doesn't let us change the password. But we can use a targeted curb roast attack to assign a SPN that service principle name and then obtain a hash to crack. And with that password, we can run secrets dump to get administrator. So with that being said, let's jump in. As always, we're going to start off with an end map. So - sc for default scripts, sv enumerate versions vv for double verose. This gives us things like the ttl oa output on formats. open the end mapap

title: HackTheBox - Administrator


text: directory and call it administrator and then the IP address of 1010.11.42. This can take some time to run, so I've already ran it. Looking at the results, we have 12 ports open. The first one is FTP on port 21. And the banner just tells us it's Microsoft FTPD. Then we have DNS on port 53. That simple DNS plus. And again, whenever I see DNS, I scroll down. We also see LDAP. So, we know this is most likely going to be a domain controller. Now, we don't have any web ports. We just have really FTP, DNS, um, LDAP, SMB. Those are pretty much the key ports we have. So, before we begin, I'm going to add the host name to my host file. So, we'll do a, uh, pseudo vets host. And then we can add 10 10 11. It was 42 administrator.htb. And this give us the box name. I don't see the box name anywhere. We just have administrator.htb. Uh scrolling down

title: HackTheBox - Administrator


text: there is a clock skew. So if we do anything kerros related, we'll have to sync the time. But I don't have anything else. So what I'm going to do is a net exec. So we can do net exec SMB 1010 1142. And this should connect. And then SMB will tell us the host name, which is just DC. So, I'm going to go ahead and add that to my host file. So, we'll do DC.administrator.htb. We'll save all of this. And then one thing unique about this box, I think it was the second box, hack, the box has done this, but it's an assumed breach scenario. So, they give us the credentials of Olivia and uh whatever that word is, it badich or something, but let's just go ahead v credentials.txt. I'm going to put Olivia and that. So, we can go back to our net exact command and we can also do like a dash u Olivia-P put this password in and make sure we can log in. And it looks like that

title: HackTheBox - Administrator


text: works. We can also go to FTP and see if we have FTP access and we get a 530 user cannot log in home directory inaccessible. If we tried other things of net exec like winrm, we'll actually see this lets us in. However, there's not much we can do with this. Um, when I was doing this box, the first thing I did with this winrm connection was see if I could figure out the FTP um like configuration, right? So, I would do like evil winrm i 1010 1142 u Olivia Olivia uh -p that's no longer the password. Let's just delete all this.

title: HackTheBox - Administrator


text: Uh, where is the password? Right here. Copy. Paste. And this should get us a shell on the box. We'll see. Okay. So, the error message with FTP was home directory inaccessible. We're in a home directory. So, we know the home directory is not set to C col back/ users. Now, when I first did this, I was like thinking it's VSFTTP because that's so common. And I was going to like program data looking at this looking for like where the FTP servers installed. Uh we went to like program files. I think this is x86. Um program one. That should work, right?

title: HackTheBox - Administrator


text: Program files is not x86. We can do program 2. Switch them. And I didn't find anything. And that's when I looked back at the banner. I actually went back to um Netcat and we did NC1010 11142 port 21 and that's when I saw oh it's the Microsoft FTP service. So it's probably part of um I don't want to say I but just exactly how um Windows installs all the web services. Maybe it is part of IAS and we have this inet pub directory. So I went in inpub and then we do a diir and there's an FTP route. So I try to go in FTP route and we can but we get permission denied afterwards. So my next thought was like get ACL on FTP root and maybe this could tell me the owner of the directory because if I can tell the owner then I know kind of who I need to get to, right? And I don't know why this is hanging. I thought this would be

title: HackTheBox - Administrator


text: pretty instantaneous. Um unauthorized operation. So we can't do get ACL. We could try like I cackles on FTP route and see what happens here. We can't do anything. My next thought was um maybe we can look at the permissions for C inet pub the directory we're in. And we see system users trusted installer. And then it's actually giving me the SID of a user. And I'm guessing this just means the user is deleted because it can no longer um identify who the owner is to this. If it is part of the domain, it would automatically translate the SID to a username. So, whoever created this FTP server um is no longer on this box, right? We could do net user and list all the users, but at this point, I'm kind of confused about um this winrm connection. So, I'm going to go ahead and run blood hound. I think I have bloodhound in cdop. Where is it?

title: HackTheBox - Administrator


text: blood hound injesters, right? And then there's a bloodhound.py. We could run sharp hound.exe, but I really like just running bloodhound.py. And if you look at my git log, you can see um I should have done git branch, I am on the blood hound community edition branch. So if you want to follow along and you're using the community edition like me, make sure your jester is using that branch. So now let's go ahead and do blood hound. So we're going to run bloodhound.py. I'm going to do all collections. Uh the domain is going to be administrator.htb and then we'll do um user Olivia and the password uh let's go ahead and grab that again. I will never remember how to type that password. And then the last thing I like setting is name server. So do 10 10 1142 and Python 3 that is oh bloodhound.py is a

title: HackTheBox - Administrator


text: directory we actually want the script blood hound.py not camelcased. Okay there we go and we see it is starting to work. It's contacting that LDAP server. We have uh kerros fail us but it fell back to NLM authentication which is just fine. Uh, while that goes, let's go into opt bloodhound server and I'm going to start Blood Hound. So, I'm going to do blood hound_port 888 doc compose up. Um, we don't have to do that. Blood hound's default port is 8080, but since there's no web server, I'm not running burpuite.

title: HackTheBox - Administrator


text: So, like my ports aren't conflicting. Um, it's just my habit to always just start Blood Hound on port 8088. And when this is up, we can then upload all of our um files to it. So, waiting on the server graph DB to start. And then when it starts, I should be able to go to http 127001 8088. Uh we can't yet. Hopefully any minute now because it is started. There we go. And I'm going to do admin. And then my password is please subscribe with the ex uh please subscribe. One bang. and let me log in. We can close this tab out and let's go ahead and upload our data. So, let's do upload files. And then we want to go to HTB. This is administrator. And I did not do the zip flag. So, we have them all in JSON, which is still fine. And we can upload these files. And it is going to start ingesting. It's going to take probably a

title: HackTheBox - Administrator


text: minute or two to ingest. So, while it ingest, um, one thing I like doing is just poking at the Blood Hound files manually, and it's a bit of a pain. So, if I do I know we're going to need to do groups. We've done other files before. If you don't know, like go to um, ipsack.ro, I should have like a special Blood Hound video on this, like mainly Purse Blood Hound data. I look at that. um probably have like jQ with other things. So you can go to look at those videos. But I know I want to um enumerate who has access to that FTP directory, right? And when I do that, I normally look at the groups. And to look at um what groups there are, we could just do a quick filter. So let's go um let's see. It's going to be let's do a less we need to go in data properties and then name. So we can do a jq dot and then say

title: HackTheBox - Administrator


text: um data like that right then properties.name name and we can get a list of all the groups and it's quite a bit right. What I would normally do, my first bet is to look for all non-default Windows groups and the easiest way to do that is looking at the SID. Um, we've talked about SID with like that one user SID that didn't exist anymore. It ended in like 1106. Um, it was on this pane. Let's see. Right here. Right. We're going to look at all the group SIDs because all the default accounts stop at around 1,000. So, if we look at all the SIDs above a th00and, that's going to be the non-default ones or mostly the non-default ones. So, that's what I want to look at. Um, let's go back to less. And we have to go into this domain SID. And we just want to grab this one. And this is going to be where the actual query um gets a little messy. And I'm going to put this

title: HackTheBox - Administrator


text: in a bash file just because I think it will be easier for people to read. So we'll go and call this a new groups orsh I guess.

title: HackTheBox - Administrator


text: Bensh. And we can cat that. and we'll do a jQ data. And then what we want to do is a select. We're going to do object identifier because that's where the SID actually was. It was under this object identifier. Then we're going to split it upon a dash or a hyphen. Then we're going to get the last. And then I'm going to say to number. And I wonder if I just close this out. Um, what's going to happen? Uh, cat anume group. Um, bash a new group. Okay, because I only did a select. So, I'm going to say this two number and we can say is greater than 1,00.

title: HackTheBox - Administrator


text: run it. And this should be much less lines. Let's see.

title: HackTheBox - Administrator


text: Um, grap. Let's see. What is it? Was it just name? That's right. Name. Uh, where's my big JQ? Uh, lowercase name.

title: HackTheBox - Administrator


text: So we can see, oh that's annoying. There we go. Um, now we only have three items.

title: HackTheBox - Administrator


text: So this is a very quick way just to enumerate. And we can see there is a custom group share moderators. Um, the DNS update proxy and DNS admin. These are default built by Windows. I don't know why they always take above a 10,00 um, SID. Maybe it's because it didn't come at install time. But if we wanted to, we could fix this query up a little bit better. So, right now, we're just querying to um let's see to get the number. We can also add a pipe and then just filter on the um object identifier, not filter, but extract the fields. So we're going to extract object identifier. And then we're also going to extract properties.name like that. Save that. Then let's run it. And there we go. We just have um the three things. We could also do um when created if we wanted to because that was another property in there. So if you didn't want to go based upon um the SID, you could also do a filter

title: HackTheBox - Administrator


text: like properties when created like that. And then it'll also put the um timestamp of when this group was created. But the main thing we want to point out is the custom group here is going to be share moderators. So let's hop back over into Blood Hound. This should be done ingesting. Now if we go to explorer, we can set um Olivia to owned because this is the user we have. So let's go add to owned. And then what I always do is just kind of trace this outbound object control first just to see what they can do. We can see Olivia has generic all to Michael. And this will allow us to um set Michael's password. So we can take over this account. If we had like ADCS installed, that's certificate services. We could use pi whisker to set a certificate for him to log in as but I don't think ads ADCS was installed here. So um we can't

title: HackTheBox - Administrator


text: use that. So we can see Michael I set him to own. And if we look at Michael, Michael also has an outbound object control and that's going to be over to um Benjamin. So we have a path here from um Olivia to Benjamin. So if we set that as the ending node, we can easily um show it here. So Olivia has generic all to Michael who can force password change to Benjamin. And we're going to use the password change for both of these. Generic all includes forced password change. So it lets us do that. The one thing we don't know though is what we can do as Benjamin, right?

title: HackTheBox - Administrator


text: And when I was first solving this box, I completely missed this one step. Right? I looked at member of saw six and everything else member of six member of six and if you look at the groups um were member of everyone all users domain user pre-wind 2000 wrote management and users so we go back to the search uh path finding I guess this to here Benjamin is a member of share moderators, but this was really easy to miss. That's why I like showing the manual way to enumerate that with just um looking at the JQ. And you could also just go search. We can look at share moderators and we're just assuming the share moderators is what can access the um FTP directory, right?

title: HackTheBox - Administrator


text: But we can look at that. There is one member and that is Benjamin. So, let's get over to Benjamin. I'm gonna set the starting node back to Olivia and then we're going to do the password reset change to get over to Ben. So, if I click on generic all, it's definitely a little picky, but there we go. Go over to Linux abuse. We can do targeted kerarost. So this is going to assign a SPN a service principle name to the account which then lets us curb roast it and get the hash.

title: HackTheBox - Administrator


text: We'll do that later on in this video so don't worry. And then we can use net RPC here to set the password. The shadow credential that we're seeing there that's what I was talking about but we can't use that one because there's no certificate services. So um let's use this net RPC command to change the password over on Michael. So let's go net RPC target user. This is Michael.

title: HackTheBox - Administrator


text: Uh, password, I'm just going to do password one so it's easy to type. Domain is going to be administrator.htb. This is Olivia. And this password is going to be and credentials.ext. So, I can just exit this PowerShell session. Cat credentials. Let's go ahead and grab this. Um, I'm going to make sure I don't have that space in there because that can be annoying. Okay, put that in. And then dash s the domain controller. We'll just do 10 10 1142. And before we run Oh, there we go.

title: HackTheBox - Administrator


text: Before we run this, I'm going to set up a net exec to prove we are changing the password. So, I'm going to do nxc SMB 1010142- Michael-P password one exclamation point. There we go. If we run this login failure, run it again. We don't get any output. But now we have success. So let's go ahead and update um is it Benjamin? How do we spell that? Benjamin.

title: HackTheBox - Administrator


text: Benjamin. And now we're going to use Michael and password one exclamation point. There we go. Same thing. I'm going to do it over here. We can say Benjamin password should not work. Then we can also go over to FTP because that's what we want to do is get FTP. User cannot log in. We're going to set Benjamin's password and then rerun this nxc. And there we go. We get logged in.

title: HackTheBox - Administrator


text: So, let's do FTP uh 1010 1142 Benjamin password one. Do a diir. And we get this file backup.ps3. I'm going to run a get against it. And it's giving me a warning. It says we transferred in ASKI mode and it's most likely a binary file. So I'm going to do mode bin. I think bin. There we go. This is going to set us to binary mode. So we can download it. Um it's still it saved it. But when you download binary files in ASI, some weird um encoding issues can happen. So I'm just going to name that. We will now download it again. We can see no more warning. we entered um the binary mode to transfer that. And if I do MD5 sum on both of these files, we should see they're different.

title: HackTheBox - Administrator


text: Uh we don't. So I guess that did not matter. It's just one of my paranoia things because if that causes your issue, it's very easy to waste a lot of time uh trying to figure out what the issue was. So always make sure when you have file copy errors, uh you do what you can to um eliminate the error. in this case doesn't matter. So now let's go ahead and copy this backup file to the Kraken. And that's just where I'm going to run hashcat. Um you can use hash on your host machine. Uh I just wouldn't recommend doing hashcat in a VM because it is definitely pretty slow when you do it in a VM because hashing is very CPU and GPU intensive. But I'm just going to move this backup.p file over into um hashcat hashes. And hashcat's weird about this. This is one of the file formats or files that we can just give it the database and hashcow

title: HackTheBox - Administrator


text: crack. We don't have to run like John 2 hashcat or whatever um or psafe to John or whatever the program would be but we can just do hashcat um op word list rocku.ext is it I'm actually blanking. Is it word list first and then the file? I think it's word list and then the hash. We'll do hashes slash uh we called it backup.psafe. Let's see. It's going to start in autodetect mode. And that's not it. So, it's the file then the word list. I don't know why I just suddenly forgot that. But hashes backup psafe. And if you're curious how I knew that from the output, um I was looking for this. I didn't expect to see all of this, but we have a format password safe v3. If we do an xxd against the file. So hashes um where is it? Backup p safe. Let's do head-1. We can see pws3. This is most likely going to be the magic bytes for password safe 3. I wonder if

title: HackTheBox - Administrator


text: um this will detect it. Oh, it does. So if even if we run a file command that examines these headers u this is a known magic bite for password safe v3. So let's go ahead and set the mode over to that which is mode 5200. So we're going to go here. We can specify mode 520. I hope it's 5200 not 52,000. Looks like um it is. So now we can do a d-shell. Uh we want to get rid of the word list when we do that. Did it not crack? Recovered one out of one. I'm surprised the show command is not working, but we have the password here. Um maybe show is not working because we didn't convert this into the correct um hashcat format. I'm honestly not sure what happened there, but hey, we got the password. Uh, I'm just going to do credentials. I'm going to say pw safe that um, we can do pseudoapp install password

title: HackTheBox - Administrator


text: safe. I think that's the app. And I already have it installed. We can run it with pw safe. And then we're going to open the database. So, let's go into um, HTB. Then, what is it?

title: HackTheBox - Administrator


text: administrator backup psafe. Put in this password. We can show what I'm putting in if we wanted to. And we have three users, Alexandra, Emily, and Emma. So, let's go ahead and uh v users uh Alexandra was it? Yep. And then Emily and Emma. And I'm doing it this way because I'm going to use net exec to spray the passwords. So we need it in two files. Um let's go ahead. I'm going to do copy password to clipboard. There's that password. Let's get this one. There's that. And then Emma. Okay. So now let's do net exec. So we can do net exec SMB 10 10 1142 and let's see what is the option. It's like no brute right dash no brute force. Okay that's the field we want. So we can do dashu users p passwords. I probably should put text for the extensions there but that's fine. And then we use no brute force. It's going to take the

title: HackTheBox - Administrator


text: first line of users, first line of passwords, try it, and then first line of the next one and try it and just so on. Uh, we should probably do continue on success. So, we try them all. So, we see um Emily's password is valid. So, we can now own Emily. So, let's look at what Emily has. So, if we go over to Emily, I'm going to set Emily to owned. If we look at the groups, let's see remote management. So, Emily can winrm into this machine if we need to. If we go to outbound object control, we can see Emily has generic right over Ethan.

title: HackTheBox - Administrator


text: And if we look at what Ethan can do, outbound object control, Ethan uh can DC sync the domain. So once we get Ethan, we can just dcync and get um full domain admin. So let's look at the path of this. So again, going back here, go generic, right? If I can click that. There we go. Linux abuse and it wants us to run this targeted kerros command and it gives us the link here. So I'm going to go to this repo and let's pull this down. So we can do get clone targeted kerarost. I'm just going to run this to see if we have all the needed files. It looks like we do. And does this give us an example of what we need? It looks like it does.

title: HackTheBox - Administrator


text: So let's do this. Python 3 targeted Kerarost D. This is going to be administrator.htb. Uh the user is what is it? Emily, right? And the password is going to be uh we got to have Psafe. We can just copy this uh copy password to clipboard.

title: HackTheBox - Administrator


text: paste and then see something went wrong. I think I pasted the wrong thing. There we go. See generic, right? Come on. Linux abuse. So we do du. That's it.

title: HackTheBox - Administrator


text: run this starting curb roast attack and we get a clock skew to grade error. So I'm going to do pseudo NTP date 10 10 11:42 and this should sync my time to the domain controller. We're going to run this command again and it's going to um add the SPN to um Ethan and then uh Kerros the account. So we can go back into the Kraken CD hashes or CD hashcat and then we can do cd hashes v ethan kob I guess. Paste this in. That is longer than I expected. I wonder if this is an assh. Um doesn't really matter. Let's do hashcat uh up hashes ethan op word list rocku.ext and it looks like it may have cracked already. I'm going to do the d-show. And there we go. Uh we see Ethan's password is limp biscuit. So we could go back here and do the net exec. So if we did NXC SMB 10 10 1142 Ethan Limp Biscuit, we do get um the all success. So what we can do

title: HackTheBox - Administrator


text: now is just a secret stump. So we'll do secret stump.py. Uh let's do administrator.htb htb ethan I want to say it's percent like that at 1010 1142 see I thought that's how we'd specify the password I can just copy this and we'll do it manually put that in and we start dumping the um secrets, right? So now we can go in administrator and we should be able to just do evil winrm i 1010 10 1142 u administrator I think capital H for hash and we get logged in and that's pretty much the box. So we can do C users administrator and then desktop root.ext text. Now, whenever I do secret stump, um I normally don't just run it with no flags. I always like getting the let's see, uh user status flag, the history flag and pwd last set, I want to say those are the ones I will normally run with.

title: HackTheBox - Administrator


text: Um limp biscuit. Is that how he typed it? Did I type it right? Sweet. I did. Um, it's not going to do really anything different I think because maybe they didn't change passwords, but we get extra fields. So, we can see the password set here. You get the password history as well. So, we see Emily has um changed passwords and I like doing this because I mean we changed Emily's password, right? So if I was an adversary and I use this force password change to change someone's password, use their account then DC sync, I would then run secrets dump with the history flag, get their old password and then set it back. That way if they go try login again, they don't get a password fail and then um you get caught that way, right? So I always like getting password history. Additionally, um sometimes you won't crack their most recent password, but you crack their

title: HackTheBox - Administrator


text: older passwords and then we place it against rule sets like best 64, um inside pro passwords, whatever rule set, like all the hashcat rule sets. Then you'll start cracking other passwords just because you crack the older passwords. So, I love getting the password history. Um I also like password last set so you can get an idea. And um also like seeing the account status if they're enabled or disabled because whenever I do password audits, I always crack a ton of accounts. I get super excited and then um I don't realize they're disabled until I try to use them, right? So I always like having that also in my output. But with that being said, that's going to be the video. Hope you guys enjoyed it. Take care and I'll see you all next

title: HackTheBox - Administrator