HackTheBox Writeup: Resolute

Resolute was a medium rated Windows machine in which LDAP was queried for a list of users and an initial account password. This password was sprayed across the found usernames for a shell. Enumerating the system yielded a password for another user who was a member of the DnsAdmins group. These privileges were combined with a DLL injection attack to gain a system shell. All in all, a fun box. Let's get started.

Enumeration

nmap:

This is a pretty typical port list for a domain controller. I checked SMB first but couldn't list any shares so it was time to check LDAP. A piece of key information from this is that the domain is listed as 'megabank.local'. Let's see if we can get a list of users first:

With some bash-fu, I cleaned this up and saved the sAMAccountName fields to 'users.txt'. Next, I dumped everything LDAP would give me into a file 'ldap.txt':

Initial Foothold

This was a ton of info to sift through in the LDAP dump but eventually I found a password in the description field for Marlo Novak:

Does this happen in real life? Yes it does - some admins incorrectly assume that only someone with administrative privileges can read the 'description' field. Anyway, this password didn't work for Marko so I used CrackMapExec to try the password on my list of users:

The nmap scan showed that port 5985 is open. It's the default port for WinRM so I gave that a shot and got a shell:

User flag:

User Pivot

I enumerated the system for quite a while and turned up nothing before remembering that PowerShell needs a flag to view hidden files (on Linux, I do ls -al reflexively without thinking about it). I found an interesting folder 'PSTranscripts' in the root of the drive:

Inside it we find a text file:

In the text file we find creds for Ryan:

I try those creds and they work, giving us a new WinRM shell as Ryan:

Privilege Escalation

On Ryan's desktop there's an interesting note:

I think it's basically to clean up after HTB players who don't clean up after themselves and to avoid spoiling the machine when multiple people are hacking at it - nothing helpful with privilege escalation. Anyway, with Windows machines when I pivot to another user, one of the things I always check is group membership:

The DnsAdmins group caught my eye. A bit of googling around and I found this article which detailed how to escalate to SYSTEM from DnsAdmins.  Basically you create a malicious DLL, run dnscmd to load said DLL, then restart the DNS service.

The DLL

My first thought was to use msfvenom to create a DLL but I ran into allllll kinds of headaches with Windows Defender detecting and killing my attempts. After quite some time, I eventually found this script which uses C for the reverse shell. It required some tweaking as it downloads nc.exe from github.com by default. I edited it to download it from me instead:

I ran the script to generate the DLL with a nc.exe reverse shell payload:

Injecting the DLL

I hosted the DLL in a Samba share and ran dnscmd to inject the DLL:

Restarting the DNS service = pwned

First I started a Python simple HTTP server to host nc.exe for Resolute to download from. The final step was to restart the DNS service:

I saw nc.exe being downloaded from my HTTP server and with a netcat listener, I caught a shell as SYSTEM:

The root flag: