# Check all open TCP sudo rustscan 10.10.11.174 -r 1-65535 --ulimit 5000 # Nmap scan with script on open TCP port sudo nmap 10.10.11.174 -sCV -Pn -sT -p 53,88,135,139,389,445,464,593,636,3269,3268,5985,9389,49664,49667,49678,49676,49701,49739 # Nmap scan vulnerability sudo nmap -sT -p 53,88,135,139,389,445,464,593,636,3269,3268,5985,9389,49664,49667,49678,49676,49701,49739 --script=vuln -O -Pn 10.10.11.174 # Nmap scan with UDP port sudo nmap -sU --top-ports 20 -Pn 10.10.11.174
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-05-20 14:18:36Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49678/tcp open msrpc Microsoft Windows RPC 49701/tcp open msrpc Microsoft Windows RPC 49739/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Update DNS
1 2
sudo nano /etc/hosts 10.10.11.174 support.htb
Service Enumeration
445/tcp - SMB
support-tools folder consist of few zip file and exe
Upon checking, think that UserInfo file is interesting. Extracted and trying to run however faced some issue in running the exe file.
Checked the exe file are executed under Mono/.Net assembly and we can download mono in Kali
1
sudo apt-get install mono-complete -y
After installed mono-complete, we can now execute the UserInfo.exe
When execute the command, it will reach out to the LDAP server based on WireShark. (Thanks to ippsec, this machine is not easy!!!)
By follow to the LDAP TCP stream, found there is a encrypted key
1
support\ldap nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
Validate the credentials with netexec
Initial User Foothold
Ldap
Since we had captured the credentials, lets explore the ldap using ldapsearch
bloodhound-python -u support -p 'Ironside47pleasure40Watchful' -ns 10.10.11.174 -d support.htb -c All --zip
Support user in the Shared Support Accounts group had the Generic All to the DC.
Initiate Root Foothold
RBCD
Here we can abuse the Resource-based Constrained Delegation to obtain DC. First, we will add a fake computer to the domain under support user control, Then we can act as the DC to request Kerberos tickets for the fake computer giving the ability to impersonate other accounts, like Administrator. For this to work, we will need an authenticated user who can add machines to the domain. This had configured in ms-ds-machineaccountquota attribute, which needs to be larger than 0. Then we will need to use support user write privileges over a domain joined computer (which GenericAll on the DC gets me)
