Timelapse machine is a vulnerable machine with Windows operating system among retired machines and it is expected to obtain user and root flags using these vulnerabilities.
We perform a network scan with nmap to recognize the target machine.
Classic Scan

Full port scan

At the end of the port scan, we understand that it is an AD machine and there is smb sharing and we detect the “timelapse.htb” domain, we add this domain to the /etc/hosts file and provide smb enumeration.
Crackmapexec smb

We detect Crackmapexec DC01 and add it to our etc/hosts file.
Then we add
crackmapexec smb
crackmapexec smb –users
crackmapexec smb –shares –users
crackmapexec smb -u ” –shares –users
crackmapexec smb -u ‘.’ –shares –users
crackmapexec smb -u ” -p ” –shares –users
commands, but we did not get any information

We didn’t get much information from the enum4linux tool, let’s use smbclient

With smbclient we saw the shares, it is always best for us to use different tools here.
Then we connected to the /Shares share area and looked at the files in it. We downloaded the remarkable winrm_backup.zip file to our local machine to examine it.

The zip file we want to examine is password protected and we are trying to crack it with john

We decrypted the zip file supremelegacy. We unzipped this file and found a pfx file.
(pfx files are encrypted files used for authentication processes including digital certificates. You can access a network, device, user or specific files).
We tried to extract the keys using the legacyy_dev_auth.pfx file, but it asked us for a password and gave us an error when it was empty. Let’s break the password of this file with john

We found the password for the pfx file as thuglegacy
Now we extract this pfx file.
openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out legacyy_dev_auth.key-enc
openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out legacyy_dev_auth.crt

Then we connect with evil-winrm
evil-winrm -i -S -k legacyy_dev_auth.key-enc -c legacyy_dev_auth.crt

Here we have obtained our user flag but we could not access it when using adminsitrator Here we got permissiondenied error so we provide local enumeration.

We’re looking at the Powershell histoyry file

Here we detected svc_deploy and the password ‘E3R$Q62^12p7PLlC%KWaxuaV’

Let’s connect with evil-winrm using this credential

Here we are connected but still cannot log in to the administrator user
We continue to local enumeration

Here *LAPS_Readers is remarkable

LAPS provides management of local account passwords for computers joined in the active directory. Passwords are stored in Active Directory.
Let’s understand how to do privilege escalation here
Let’s dump the passwords in LAPS with crackmapexec as shown in
crackmapexec ldap -u svc_deploy -p ‘E3R$Q62^12p7PLlC%KWaxuaV’ –kdcHost -M lap

](Qr9{{$2Vkn,8,t@i[g7+Rs password dump.
Here we are connected from the administrator user
We did not see root.txt under Administrator folders, we detected root flags under C:\Users\TRX\desktop directory.

Here we got the root flag.

Bir cevap yazın

E-posta hesabınız yayımlanmayacak. Gerekli alanlar * ile işaretlenmişlerdir