search

Manager Write-Up - HTB

hashtag
Recon

hashtag
Initial Port Scan

sudo nmap -sS -Pn -n -p- 10.10.11.236 -oN all_syn.txt

Open Ports:

PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
1433/tcp  open  ms-sql-s
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49689/tcp open  unknown
49690/tcp open  unknown
49693/tcp open  unknown
49724/tcp open  unknown
49795/tcp open  unknown
50983/tcp open  unknown

hashtag
Service Enumeration

hashtag
Service Details

DNS (53/tcp):

  • Simple DNS Plus

HTTP (80/tcp):

  • Microsoft IIS httpd 10.0

  • Potentially risky methods: TRACE

  • Title: Manager

Kerberos (88/tcp):

  • Microsoft Windows Kerberos

LDAP (389/tcp):

  • Microsoft Windows Active Directory LDAP

  • Domain: manager.htb

  • Site: Default-First-Site-Name

  • SSL Certificate:

    • Subject Alternative Name: DNS:dc01.manager.htb

    • Valid from: 2024-08-30T17:08:51

    • Valid until: 2122-07-27T10:31:04

MSSQL (1433/tcp):

  • Microsoft SQL Server 2019 RTM (15.00.2000.00)

  • Target_Name: MANAGER

  • NetBIOS_Domain_Name: MANAGER

  • NetBIOS_Computer_Name: DC01

  • DNS_Domain_Name: manager.htb

  • DNS_Computer_Name: dc01.manager.htb

  • DNS_Tree_Name: manager.htb

  • Product_Version: 10.0.17763

WinRM (5985/tcp):

  • Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

Host Information:

  • Host: DC01

  • OS: Windows

  • SMB message signing: enabled and required

  • Clock skew: mean: 7h00m02s

hashtag
LDAP Enumeration

Results:

  • domainFunctionality: 7

  • forestFunctionality: 7

  • domainControllerFunctionality: 7

  • rootDomainNamingContext: DC=manager,DC=htb

  • ldapServiceName: manager.htb:dc01$@MANAGER.HTB

  • isGlobalCatalogReady: TRUE

  • namingContexts:

    • DC=manager,DC=htb

    • CN=Configuration,DC=manager,DC=htb

    • CN=Schema,CN=Configuration,DC=manager,DC=htb

    • DC=DomainDnsZones,DC=manager,DC=htb

    • DC=ForestDnsZones,DC=manager,DC=htb

  • dnsHostName: dc01.manager.htb

hashtag
Web Enumeration

hashtag
Directory Scan

Findings:

  • Standard web content directories:

    • /images/

    • /css/

    • /js/

  • Main pages:

    • index.html

    • about.html

    • contact.html

    • service.html

  • No admin pages or login portals discovered

hashtag
Virtual Host Fuzzing

Results:

  • No additional vhosts discovered

hashtag
User Enumeration

kerbrute:

Valid Users:

  • ryan/Ryan

  • guest/Guest

  • cheng/Cheng

  • raven/Raven

  • administrator/Administrator

  • operator

  • jinwoo

hashtag
Domain Information

Domain SID: S-1-5-21-4078382237-1492182817-2568127209

impacket-looksupid:

It seems that operator uses weak password:

hashtag
Foothold

It seems this works:

Responder caught:

no use though.

Enumerated the file system with xp_dirtree:

Downloaded the backup

raven:R4v3nBe5tD3veloP3r!123

hashtag
PrivEsc

Enumerated the system, but remember that this is related to ADCS based on our nmaps:

After some googling, let's do the chain:

Retrieve it now:

Tried to get the TGT, but clock skews are too great:

I am syncing it:

Trying again:

Got in:

PreviousMailing Write-Up - HTBNextBroker Write-Up - HTB

Last updated