search
Page cover

🌌Retro

hashtag
Initial Enumeration

  1. First let's grab the nmap result :-

─(krrish㉿krrish)-[~/hackthebox/retro]
└─$ nmapAutomator -H 10.129.234.44 -t All

Running all scans on 10.129.234.44

Host is likely running Windows


---------------------Starting Port Scan-----------------------



PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
3389/tcp open  ms-wbt-server



---------------------Starting Script Scan-----------------------



PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-12-24 02:44:57Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: retro.vl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC.retro.vl
| Not valid before: 2024-10-02T10:33:09
|_Not valid after:  2025-10-02T10:33:09
|_ssl-date: 2025-12-24T02:46:18+00:00; +1s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: retro.vl, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC.retro.vl
| Not valid before: 2024-10-02T10:33:09
|_Not valid after:  2025-10-02T10:33:09
|_ssl-date: 2025-12-24T02:46:18+00:00; +2s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: retro.vl, Site: Default-First-Site-Name)
|_ssl-date: 2025-12-24T02:46:18+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC.retro.vl
| Not valid before: 2024-10-02T10:33:09
|_Not valid after:  2025-10-02T10:33:09
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: retro.vl, Site: Default-First-Site-Name)
|_ssl-date: 2025-12-24T02:46:18+00:00; +2s from scanner time.
| ssl-cert: Subject: commonName=DC.retro.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC.retro.vl
| Not valid before: 2024-10-02T10:33:09
|_Not valid after:  2025-10-02T10:33:09
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: RETRO
|   NetBIOS_Domain_Name: RETRO
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: retro.vl
|   DNS_Computer_Name: DC.retro.vl
|   DNS_Tree_Name: retro.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-12-24T02:45:38+00:00
|_ssl-date: 2025-12-24T02:46:18+00:00; +2s from scanner time.
| ssl-cert: Subject: commonName=DC.retro.vl
| Not valid before: 2025-12-23T02:43:05
|_Not valid after:  2026-06-24T02:43:05
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 1s, deviation: 0s, median: 1s
| smb2-time:
|   date: 2025-12-24T02:45:39
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required




---------------------Starting Full Scan------------------------



PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3389/tcp  open  ms-wbt-server
9389/tcp  open  adws
49664/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
61420/tcp open  unknown
61433/tcp open  unknown
61634/tcp open  unknown
61642/tcp open  unknown

  1. Let's enumerate the smb more with nxc and we can see that guest login is enabled so we can definitely get more info about the domain

  • So we can read two shares that is IPC$ & Trainees , so we can look into the Trainees share

  1. From the Trainees share we can see there is an Important.txt file so let's get that

hashtag
Getting the user.txt

  1. So this Important.txt tells us that there might be some of the weak passwords around in the domain , so I further gave a thought of using kerbrute to check weak passwords

  • Here we get a hit that trainee user has the same password as its SAM account name

  1. With the user trainee we got access to more shares and we can also further enumerate with the help of bloodhound

  1. Accessing the new share Notes get us user.txt and a ToDo.txt

  • There we get our user.txt and ToDo.txt

  • So this ToDo.txt tell us to get rid of ancient banking system and start by pre created computer account that is BANKING$

  • This older than me line points towards Pre-Windows 2000 computers

https://www.thehacker.recipes/ad/movement/builtins/pre-windows-2000-computers

  • Read more about Pre-Windows 2000 computers from the above link , for the password of the Pre-Windows 2000 computers its the computer name in lowercase without $

  1. So we try the password banking and we get an error message that is STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT

  • This error tells us that the computer account is not able to logon the domain as it doesn't have necessary trust relationship with the domain

https://www.hackingarticles.in/pre2k-active-directory-misconfigurations/

  1. To change the password we can use impacket-changepasswd.py or if you don't want to change password just make a tgt with BANKING$:banking

hashtag
For root

  1. The rights of BANKING$ is same as trainee for smb shares , so I tried certipy for ADCS exploitation and found it had ESC1

  • So this output tells us that only these 3 have enrollment rights RETRO.VL\Domain Admins , RETRO.VL\Enterprise Admins , RETRO.VL\Domain Computers and we have a domain computer BANKING$

  1. Exploitation steps for ESC1 below :-

  • First request a certificate :-

  • But doing this I get an error CERTSRV_E_KEY_LENGTH

  • searching more about this i see that we need to give a flag -key-size as by default is 2048 but in this certificate it is 4096

  • Adding the key flag i get administrator.pfx

  • Authenticate using the obtained certificate , but we will get an error :-

  • This error tells us that domain controller that does not support PKINIT authentication that is kerberos authentication with a certificate

  • But we can still authenticate in ldaps with -ldap-shell and add user trainee in Administrators group

  1. Then I did ntds dump

  1. Further we can read the flag using nxc

hashtag
Pwn3d the machine !!

PreviousHazeNextSweep

Last updated