Administrator

Administrator currently holds the top spot for the easiest HTB box I’ve rooted, despite being rated Medium in difficulty. Maybe CPTS just did a great job of teaching me the basics of Active Directory penetration testing, but I did breeze through this machine, and the community rating seems to agree. Now I know what you’re thinking: I said I wouldn’t write about a box if I didn’t learn anything. So what are we doing here?

I thought about it for a while. The main goal of these honest write-ups is that they can be relatable for others who are also fresh in the field of offensive security. And even though the box itself was easy, there is still a story here that I hope can help. At the risk of putting you to sleep, I’ll have to give a bit of context on my background.

You see, I’m a Linux kind of guy. I’m a software engineer by training, and from the start I have been a command-line, C program, Linux kind of guy. My career ended up blowing me to those places with its winds of irony, but I went “ew” every time I’ve had to do work on any kind of GUI, avoided web development as much as I could, and all that time ago when I first got hooked on “wargames”, they were all about Linux and networking, Linux privilege escalation, overflows… (some of the ones now at OverTheWire are what I started with, in fact, back then hosted at dievo.org)

Now here I am, wanting to turn my career fully into offensive security, and having to accept that web applications and Active Directory will be a large chunk of my reality, at least for a while. Getting out of your comfort zone is never easy, and I did look at Active Directory in fear. Words are important to me, and I do think “fear” is ultimately the right word in these situations - we are afraid of getting hurt in some way by stepping out.

The thing is, like one of my favourite drummers once said, “you become really old when you stop being willing to feel stupid for a bit”. And boy did I feel stupid. I remember at some point asking what the difference was between a local user and a domain user. Hey, I’m no AD master now either, as a few upcoming write-ups will show. But at least I got to breeze through a box like this one. That’s something. So this write-up is my way of telling you, if you find yourself doubting it, that it’s definitely worth it to feel stupid for a bit.

Well, if you’re still here, let’s get back to the box. The exploitation chain is a series of ACL abuses, so BloodHound did all the work really:

This made the Mission: Impossible theme feel a bit out of place, but still, let’s go through it with the right soundtrack.

Limp Bizkit’s “Take a Look Around” on

This box features an “assumed breach” scenario, and we start off with valid credentials. So uh… [hacker voice] we’re in. Still, we need to know what to connect to, and we start the way we always start:

Just a regular, everyday, normal Domain Controller. Except that FTP port, which is the first thing I tried the credentials on. Alas:

I tried to login anonymously as well (and failed), so I decided to just take my trusty BloodHound around for a sniff:

After loading the data on the BloodHound UI, and checking Olivia’s outbound object control, we see that she has GenericAll rights over another user, Michael. Checking transitive object control, we see that Michael has rights to ForceChangePassword on Benjamin, who in turn is a member of the Share Moderators group. Maybe he will be able to connect to FTP, so this seems to be our path forward. Good dog.

Before we move on, we look to get a bit more awareness on each of these users. Olivia and Michael are members of the Remote Management Users group, so we should be able to connect with WinRM and gather more info if needed. Finally, checking for the shortest paths to Domain Admin, we see that Ethan (Hunt!) has DCSync rights over the domain. Our mission, should we choose to accept it, is probably to get our hands on his account.

How do we do this? Honestly, even if you knew very little about AD, you could just ask the dog. Right-clicking edges on BloodHound gives you more information, including how to carry out the relevant attacks if applicable. With GenericAll we have several options, but since I play these machines in shared instances I went for a targeted Kerberoast, adding a temporary SPN and requesting a TGS ticket, and hoping for the password to be crackable. This is all very easy to do with, well, targetedKerberoast. We just have to deal with any clock skew between our machine and the target, using faketime for example, and we’re good to go:

Unleashing hashcat on it revealed the password:

Note: as I wrote this, I wondered if another player had made the password crackable. I tried this again, and sure enough, I cracked a different password. I requested a reset for the machine, and right after the reset, hashcat was not able to crack the newly requested ticket’s hash. So the intended path is to change the password after all, and the next player just has to do the same. So much for trying to be nice.

After connecting to WinRM and FTP for good measure (and finding nothing), it’s time to force a change of password on Benjamin. Once again BloodHound tells us how to do this. My first attempt failed due to the password policy in place, which was easy to check with netexec. The only requirement was on length:

As predicted, Benjamin can connect to FTP and download a password database:

I had seen this .psafe3 format before, and all we need to do is feed the file directly to hashcat to attack the master password for the database. Some other formats require a prior step of extracting the hash from the file, but that’s not the case here. hashcat ate it for breakfast:

Opening this database with Password Safe shows us the credentials for Alexander, Emma and Emily. Checking BloodHound, Emily has GenericWrite rights over Ethan, so we focus on her. She also happens to be a member of Remote Management Users, so we quickly check her desktop to find our user flag:

Mission: Impossible to Fail

With GenericWrite we can again perform a targeted Kerberoast and hope that the password is weak. So we do just that:

hashcat was having a great day:

I had seen at the start that Ethan had DCSync rights, but I wondered if that was the work of another player and if I was about to cheese the box. I asked for a reset before running the following, and it still ran, so… it’s up there with the easiest root flags ever. We use the Impacket toolkit to dump the Administrator’s NTLM hash, and pass that hash to log in with evil-winrm:

Roll the credits

• It’s definitely worth it to feel stupid for a bit. Push through. These wins will feel earned.
• As always, for reading this far, you’re a champ.