Baby2
This is not a writeup, just my notes about the machine.
Machine information
Operating System: Windows
Chain: False
Credentials
Carl.Moore
Carl.Moore
rid-bruteforce
domain user
office
office
rid-bruteforce
domain user
✅ Valid Usernames
🔑 Passwords list
Information Gathering
Service Enumeration
DNS
Not vulnerable to DNS Zone Transfer
SMB (enum4linux-ng)
Server allows null session
Server allows guest user access
Read,Write access
homesdirectory.
Username as password brute forcing revealed
Carl.Mooreandofficeas valid credentialsCan read and write in apps, docs, home
LDAP
Allows userenumeration via rid-bruteforcing
Not kerberoasting user
Not asreproasting user
Not information withing the users' description field
Initial enumeration
During the assessment, the tester discovered that the domain user carl.moore has read and write access to the following SMB shares:
\\DC\apps\\DC\docs\\DC\homes
In addition, the user has read-only access at the SMB share level to the NETLOGON and SYSVOL shares:
However, further enumeration revealed that the user has write access at the NTFS level to the following file:
This file is executed by domain users during the logon process (as confirmed via BloodHound enumeration or logon script analysis). This creates a high-impact attack vector where an unprivileged domain user can modify the login.vbs file to execute arbitrary code in the context of other domain users, potentially including privileged accounts such as domain administrators.
Reverse Shell via GPO Script
To exploit this misconfiguration, the tester appended the next lines to the script:
Finally, uploaded the file by rewriting original file and wait for the reverse shell.
Lateral movement from Amelia to gpoadmin
During post-compromise enumeration, the tester identified that the user Amelia.Griffiths had the ability to modify gpoadm via the following Active Directory permissions: WriteOwner WriteDACL These permissions allowed the tester to fully take over the gpoadm account and reset its password, thereby achieving lateral movement.
As a stealthier option, instead of resetting the password, the tester could have injected a custom msDS-KeyCredentialLink attribute using whisker.exe to retrieve the NT hash of the gpoadm account without altering the password. This method is particularly effective in environments using Windows Hello for Business.
Compromise Domain Controller
Finally the tester compromised an user with possess administration privilege over the GPO in the entire Domain controller that means Compromise domain.
The tester leveraged GPO capabilities to escalate privileges by adding a domain user to the Administrators group on the Domain Controller using pygpoabuse.py.
The tester authenticated as john (now Domain Admin) and confirmed full control:
Last updated