EscapeTwo

I think someone made a mistake. EscapeTwo was an easy-rated box, while Administrator was deemed medium, and to me they were clearly the other way around. That aside, this was an example of a box where I needed to act with practically no knowledge of the issue at hand. Some subjects are so narrow that they can mostly be learned then and there, but that was not the case here. Luckily, a cool little tool took my hand.

I’m making myself nervous teasing the content without saying anything concrete, so let’s just dive in. A summary of today’s hostilities:

Electric Light Orchestra “Mr Blue Sky” on

This is another “assumed breach” scenario, so [hacker voice] we’re in. We asked Nmap where we’re in, and found out we’re in a regular everyday normal Active Directory domain controller, with the exception of an open MSSQL port.

Before moving further I let my trusty BloodHound sniff around, after he’d practically solved the Administrator box on its own.

Aside from the fact that we’re apparently hacking into The Office, looking at the usernames, my trusty hound doesn’t tell me much this time. Only that Ryan will probably be causing trouble later on, with WriteOwner rights over a service account.

Checking the database, only the default system databases seem to exist, and Rose cannot execute system commands or even trigger an authentication request to a fake SMB server:

I tried a spray of Rose’s password on the other users, with no effect. Two service accounts have SPNs so I tried to Kerberoast them, but hashcat was not able to crack the hashes. So I turned my attention to shares, and Rose has access to a few:

The Accounting Department share has a couple of files we can check for sensitive data:

Where’s Dwight?

LibreOffice was somehow not able to open the files properly, and with file telling me they were essentially ZIP files, I unpacked them. This generates a mess of XML files… After some manual checking looked like a waste of time, I started grepping for interesting things. If that hadn’t worked I would have spent time figuring out why LibreOffice wasn’t reading these, but that’s not how I like to spend my time on these boxes. Luckily grep did find something. The snippet below is heavily edited, because I assume you don’t want to read a ton of useless XML:

More Dunder Mifflin employees! I ran some quick checks to see if Oscar gave us something new, but didn’t spend too much time there because the sa user would probably give us command execution on the machine:

In this situation, I usually go to revshells.com for a base64-encoded PowerShell reverse shell:

Now, [hacker voice] we’re really in:

Sadly this is not giving us our user flag yet, but indeed Ryan might be the one:

Enumeration started, first with things like privileges and groups which didn’t give us much, and then with a credential hunt, which found a needle in a haystack:

This looked useful in case we found a way to connect to the machine without going through the xp_cmdshell dance again, but I left it there, ignoring one of the earliest lessons I had learned… I kept looking for stuff in the database, in the files, looking for connected databases, powershell history, scheduled tasks, installed software, even winpeas… and it was only when I stumbled upon that SQL configuration file again that I wondered… ughh, is Ryan the database admin, is he reusing the password?

Ryan started the fire!

Looking at BloodHound again, after a restart to make sure I was not being cheesed by other players, Ryan indeed has WriteOwner rights over the ca_svc account. This will allow us to gain full control of the account, after assigning one of our controlled users to be the owner. The name of the account, and its membership in the Cert Publishers group, indicated that it is involved in Certificate Authority shenanigans. I didn’t know much about this, so I tried to read up on it before going further, to try to have a clear path in my mind.

It turns out that the attack surface is vast, so I still don’t know much about this and ended up just scratching the surface. I found great articles (like this one, this two-part series, and especially the seminal work on the subject), but I was clearly not going to be able to skim for a solution to the task at hand, since I don’t even know what I don’t know. At this point I might as well spend time properly building the knowledge, like following the Academy’s module on ADCS attacks.

However, a tool called certipy kept coming up during research, and from what I could tell it would be able to find the specific vulnerabilities I would need to understand to solve this box. So I decided to let it guide me into this new world.

Note: there are several tools with this name (and apt suggests the wrong one), so certipy-ad in the Python Package Index is the one we need:

Another note: after a couple of years of inactivity, the project just released (at the time of writing) a new version 5. I had solved the box and documented it with the then-latest version 4.8.2, and have not re-tested the commands for this write-up, so your mileage may vary.

Notes aside, let’s get back into it. Using certipy with Ryan’s account didn’t give us anything unfortunately:

I assumed this was due to that E_ACCESSDENIED error, so let’s own that ca_svc account first. There seems to be a clean-up script in place here, so these steps all the way through generating certificates need to be done relatively quickly. Command-line history to the rescue. I can’t imagine playing this during its first week, it must have been chaos with players stepping on each other’s toes. Anyway, following BloodHound’s instructions we’ll use Impacket to take ownership of the user account and give ourselves full rights over it:

With full rights, we can change the account’s password, and confirm it for good measure:

Now certipy does tell us a bit more, despite that E_ACCESSDENIED error still popping up, so that’s not really what that was but it doesn’t seem to matter. A certificate template is now found, and has vulnerable permissions that may allow for domain privilege escalation:

The security researchers who reported these coined each escalation method with ESC followed by a number, and we can read more about them in the “Certify Pre-owned” article I had already linked above. certipy is reporting that this template is vulnerable to ESC4, which essentially means that we can write to the certificate template. With this, we can change the template to be vulnerable to other domain escalation methods, like ESC1.

certipy’s default behaviour, when using the template option without specifying a specific configuration to write with the -configuration flag, is precisely to make the template vulnerable to ESC1, so we do that:

Now we can abuse ESC1. This is when a certificate allows client authentication, and allows the requester to set an arbitrary Subject Alternative Name. In other words, if the certificate allows it, we can request a certificate for authentication, and we can request to authenticate as any given user. Like, I don’t know, a domain admin for example. So we do just that, with the req option to request a certificate, and the -upn flag specifying the admin account we’re interested in:

Note that attempting this with -target sequel.htb failed with a CERTSRV_E_SUBJECT_DNS_REQUIRED error, but using the IP worked, regardless of what this note on HackTricks says. ¯\(ツ)/¯.

Now we can authenticate using certipy’s auth option and the generated PFX file, which provides us with the Administrator’s hash. We promptly pass that hash to complete the box:

Roll the credits

• Can’t believe I’m writing this as a lesson learned, but I can’t underestimate credential reuse.
• This was my first venture into abusing ADCS, but I shortcut the learning to solve the box. That Academy module is on the list.
• This episode didn’t feature Dwight, and yet it was highly entertaining.
• As always, for reading this far, you’re a champ.