search
Page cover

smogHaze

A hard active directory windows machine

hashtag
Enumeration

  1. This is the nmap result below :-


β”Œβ”€β”€(krrishγ‰Ώkrrish)-[~/hackthebox/haze]
└─$ nmapAutomator -H 10.129.232.50 -t All

Running all scans on 10.129.232.50

Host is likely running Windows


---------------------Starting Port Scan-----------------------



PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
5985/tcp open  wsman
8000/tcp open  http-alt
8088/tcp open  radan-http
8089/tcp open  unknown



---------------------Starting Script Scan-----------------------



PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-12-31 03:08:23Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: haze.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Not valid before: 2025-03-05T07:12:20
|_Not valid after:  2026-03-05T07:12:20
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: haze.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Not valid before: 2025-03-05T07:12:20
|_Not valid after:  2026-03-05T07:12:20
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: haze.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Not valid before: 2025-03-05T07:12:20
|_Not valid after:  2026-03-05T07:12:20
|_ssl-date: TLS randomness does not represent time
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: haze.htb, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc01.haze.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc01.haze.htb
| Not valid before: 2025-03-05T07:12:20
|_Not valid after:  2026-03-05T07:12:20
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8000/tcp open  http          Splunkd httpd
|_http-server-header: Splunkd
| http-robots.txt: 1 disallowed entry
|_/
| http-title: Site doesn't have a title (text/html; charset=UTF-8).
|_Requested resource was http://10.129.232.50:8000/en-US/account/login?return_to=%2Fen-US%2F
8088/tcp open  ssl/http      Splunkd httpd
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Splunkd
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Not valid before: 2025-03-05T07:29:08
|_Not valid after:  2028-03-04T07:29:08
|_http-title: 404 Not Found
|_ssl-date: TLS randomness does not represent time
8089/tcp open  ssl/http      Splunkd httpd
|_http-server-header: Splunkd
|_ssl-date: TLS randomness does not represent time
| http-robots.txt: 1 disallowed entry
|_/
|_http-title: splunkd
| ssl-cert: Subject: commonName=SplunkServerDefaultCert/organizationName=SplunkUser
| Not valid before: 2025-03-05T07:29:08
|_Not valid after:  2028-03-04T07:29:08
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-12-31T03:09:08
|_  start_date: N/A
|_clock-skew: 8h00m07s
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required




---------------------Starting Full Scan------------------------



PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
8000/tcp  open  http-alt
8088/tcp  open  radan-http
8089/tcp  open  unknown
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49669/tcp open  unknown
49674/tcp open  unknown
64855/tcp open  unknown
64857/tcp open  unknown
64860/tcp open  unknown
64872/tcp open  unknown
64885/tcp open  unknown
64904/tcp open  unknown

  1. Tried doing guest login in smb with the help of nxc but it didn't work

  1. Then in the nmap result I saw the port 8000 and it had splunk running on this link http://dc01.haze.htb:8000/en-US/account/login?return_to=%2Fen-US%2F

  1. Another thing we see that is port 8089 and so I go onto the website but it does not work in http , so we switch to https , https://haze.htb:8089/ but unfortunately my website is not loading in the browser , so let's try with curl

  • so the splunk version is 9.2.1 , so let's find CVE for that , the reason i switched for cve as I didn't get valid credentials through bruteforcing and default credentials

  • found this CVE-2024-36991 and this was a path traversal vulnerability , can read more about that in this blog

https://www.vicarius.io/vsociety/posts/exploiting-path-traversal-in-splunk-cve-2024-36991

https://github.com/bigb0x/CVE-2024-36991arrow-up-right

  • this exploit on github allows us to read the /etc/passwd

  • but these hashes didn't cracked

hashtag
Foothold & user.txt

  1. We need to find some another way to get some creds , so let's start by reading how does authentication works in the splunk where are sensitive files are stored

  • so there is a splunk.secret file that is used to encrypt / decrypt passwords in the .conf (configuration) files . To know more about this refer to sources below they are good to have some knowledge

https://community.splunk.com/t5/Knowledge-Management/What-is-the-splunk-secret-file-and-is-it-possible-to-change-it/m-p/331207#M6092

https://help.splunk.com/en/data-management/splunk-enterprise-admin-manual/9.1/configuration-file-reference/9.1.5-configuration-file-reference/authentication.conf

https://help.splunk.com/en/splunk-enterprise/get-started/install-and-upgrade/9.2/install-splunk-enterprise-on-windows/install-on-windows

  • To get these lets look at the initial payload that is being used to read /etc/passwd which is /en-US/modules/messaging/C:../C:../C:../C:../C:../etc/passwd

  • This was the payload with the curl command to get /etc/passwd

  • Just change the path in the /etc/ , you can get the proper path from the above sources

  1. Now the main task is to crack the hashes and I haven't seen this $7$ hash format , so let's google and try to decrypt that

  • Here we can use this tool splunksecrets to decrypt this , the installation guide is inside the repo

  1. Then we can just enumerate the domain with --rid-brute and --shares

  1. Ok lets go on for more enumeration with the usernames we have

  • with this we can see that user mark.adams has the same password as the paul.taylor

  1. Let's take the bloodhound dump and see what we can get from there & remember to do sudo ntpdate haze.htb , and use mark.adams as user to take dump and below is the reason for that

  1. In bloodhound I saw that mark.adams is a member of GMSA_MANAGERS but nothing after that also mark.adams does not have any Outbound Object Control

  • With the help of bloodyAD I tried to get more onto the writable by the mark.adams and found this

  • This attribute msDS-GroupMSAMembership tells us that if a requestor has permission to retrieve the password for a group MSA and we can write

  • more enumeration on from on that attribute msDS-GroupMSAMembership

  • To update write that to our user we can use the below command & the SID is of the our user mark.adams

  1. When I saw in bloodhound for this user Haze-IT-Backup$ Outbound Object Control there was one and nothing after the group owning so decided to take the bloodhound dump again with the Haze-IT-Backup$ hash

  • To exploit this the commands are below :-

  • So what are we doing is making the user Haze-IT-Backup$ owner of Support_Services group then giving the right to add members (WriteMembers) , then adding Haze-IT-Backup$ to Support_Services group then performing shadowCredentials attack

  1. Let's grab the user.txt from edward.martin

hashtag
For root

  1. In bloodhound we can see that the user edward.martin is a member of BACKUP_REVIEWERS group

  1. Further we can see that there is backup folder in C:\ directory , so let's download that and find something juicy

  1. Investigating the backup I found two things that is splunk.secret and a custom authentication.conf

  • let's use the same tool splunksecrets to decrypt the password

  • The passwords don't work for some reason on any user

  • Trying this password on the splunk website and it worked with username admin : Sp1unkadmin@2k24

  1. Exploring more in the splunk enterprise didn't gave nothing so looked for some reverse shell through it

https://github.com/0xjpuff/reverse_shell_splunk

  • Edit the run.ps1 , delete the run.py and edit the inputs.conf

  • upload the reverse_shell_splunk.spl here and wait for the reverse shell

  1. This way we can get a reverse shell from splunk and now just we have to abuse SeImpersonatePrivilege

  • used sweetpotato.exe to add mark.adams in the Administrators group

  1. Let's get the hashdump and access to administrator shell

  1. Shell of Administator

hashtag
Pwn3d the machine !!

NextRetro

Last updated