CRTP Lab 17
Task 1
Find a computer object in dcorp domain where we have Write permissions.
Use PowerView to enumerate Write permission for a user that we have compromised.
After trying from multiple users or using BloodHound (select ci-admin and select Outbound Object Control), we would know that the user ciadmin has Write permissions on the computer object of dcorp-mgmt:
C:\AD\Tools> Find-InterestingDomainACL | ?{$_.identityreferencename -match 'ciadmin'}
PS C:\Users\student372> Find-InterestingDomainACL | ?{$_.identityreferencename -match 'ciadmin'}Since we already had a reverse shell via Jenkins, we can fetch the same on netcat and then check run SBLoggingBypass and PowerView.
C:\AD\Tools\netcat-win32-1.12\nc64.exe -lvp 443
#Run SBLoggingBypass, PowerView.Task 2
Abuse the Write permissions to access that computer as Domain Admin.
Since we have GenericWrite on ciadmin and we have a shell as ci-admin, we can to set RBCD on dcorp-mgmt.
Here, first hop is student machine, and second hop is dcorp-mgmt.
Let's check if RBCD is correctly set:
The above output is read as: On dcorp-mgmt, there is a delegation setup that allows dcorp-std372. If we compromise dcorp-std machine, we would be able to access any service on dcorp-mgmt$ machine as any user including DA.
Now, after setting RBCD on dcorp-mgmt from ci-admin, we are allowing the machine account dcorp-std to access any service on the machine dcorp-mgmt as any user or Domain Admin.
Therefore, let's compromise the student machine and get the secrets.
Which AES key to use?
The one with S-1-5-18 SID since this is the SID for machine account that represents on the domain level.
From a normal cmd from student372, use this hash to abuse RBCD to access dcorp-mgmt as Domain Administrator by using O-PTH.
Here, as dcorp-std$ (first hop), we are accessing HTTP on dcorp-mgmt as the Administrator.
Since we injected the ticket, we can either use winRS or PSRemoting.
Last updated