This lab will show you how to enumerate and exploit.
HACK THE BOXES retired windows vm active the object of activities to access flags which require varying
levels of permissions please know in order to continue you'll need to be connected to hack the boxes
VPN
this active VM is available for free during the time of this recording however this status may change
in this case you can either purchase VIP which costs ten dollars per month or one hundred dollars per
year the time of this recording or do a different VM that is available for free subscribers.
In order to see if the hack the box VM is available for free click the button all the way to the right
of a VM to show status
status check right here
green checkbox means that it is available red X means that it isn't.
Also you can scan the IP range of the hacky box v MS and see which ones are accessible.
As I covered earlier if you're having issues accessing the VM in any way you have the option to reset
it.
Here's the button to reset it right here and here's the IP address of the VM.
Let's go to a terminal
first scanner within.
After looking at the results of the IMAP scan.
I see a bunch of open ports here but the most interesting and likely to be exploited here is SMB which
is running on port for four or five.
Now let's run a noob for Linux to get more information about our targets.
SMB if possible so new for Linux.
I think capital S IP address of active
we see under share enumeration a disk named replication.
Let's try to access this directly with SMB client
So type in SMB client 4D slash forward slash IP address of active force slash replication
for password just leave it blank.
Senator
as you can see we're able to access the share anonymously using no password for route let's go through
these directories to see if there's anything useful for us.
This group's dot excel file looks interesting.
Let's download it and take a look.
Take a look at the contents of that file.
OK.
So there's a user for the active dot h t b domain which is s v c underscore T G S and there is also
a C password value which is a group policy preferences or GBP encrypted string.
There is a well-known tool named GP hyphen decrypt that we can use to obtain the plain text of this
password.
Let's use that
so type in GBP hyphen decrypt it let's just take this C password value pasted here hit enter.
All right so in barely any time we've gotten the plain text of the password let's try using SMB client
to log in to that user
so type an S&P client for its life force slash IP address of active force like users.
That's the directory we're going natural to access hyper new user name is s V.S. underscore Tiki s and
we have the password right here
okay.
Good.
That worked.
Now let's take a look at what's in these directories
OK.
We found our first flag user dot text in the desktop of user s V.S. underscore TADS however we still
have no interactive shell and still need to escalate our privileges to system
let's switch our focus to another service that was discovered with n map which is curb cross over port
88 we need to see if there are any service principal names which are used by Kerber rose to associate
service instances with service log in accounts what we want is the password for administrator so we
can get ourselves an interactive system level shell
now let's add the windows domain active dot HDB to our local Kelly Etsy hosts file so I'll go ahead
and type V.I. ports like Etsy forward slash hosts
enter the IP address of active and active dot HDB save that.
Now we're going to need to get a python script to assist with getting the admin SPF on.
This is called get user SPF and IP why.
Let's go over to Firefox and get the python code
here's the Github page.
We're just going to copy all that text.
Go back to terminal.
Now I'm going to create a new file name and get user as peons got P Y pace of text we just copied save
that file.
Now let's make sure that impact is up to date.
So apt get install Python hyphen impact.
Now let's run the script
as you see here we needed the domain the user name and password.
Very good.
Looks like we have the administrators SBN.
Now we need to decrypt it for this will be using hash cat so just copy the entire result.
I'm creating a new file hashed out text
paste the result save.
Now let's run hash CAD to brute force the password with a dictionary attack
All right we've decrypted the password it is Ticketmaster 1968 with this new information we should be
able to use Metis voice windows for Slash SMB Ford slash P.S. exact exploit to get a shell with system
privileges.
Now let's run MSF console
type and use exploit port slash windows 4 slash SMB or slash.
P.S. music
said our host IP address of active
set S and B user to administrator said SMB pass to the password that we just group did Ticketmaster
in 1968.
Now run
good we have them interpreter show.
Now let's check our privileges of Spanish shell.
There we go.
We've confirmed that we have system privileges.
Now let's check out.
Administrators desktop because that's where the flag was for the user earlier.
We are now finished the active VM as you can see here.
Route dot text is the last flag required to win
please try out the other hack the box VMS on your own is these are great practice.