> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/active-directory/pg-practice/heist.md).

# Heist

Writeup for Heist from offsec Proving Grounds

## Information Gathering

`sudo nmapAutomator.sh 192.168.220.165 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FgcSse00IwXdcqhfQDji9%2Fimage.png?alt=media\&token=1e3ba2cb-ad04-4abb-b778-9d7ca028f826)

### Service Enumeration

### SMB (Port 139/445)

Doesn't seem like we have access

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fk00bvaZA2OpA0Y1et3zl%2Fimage.png?alt=media\&token=3887eeb6-7d77-4dd4-8127-81be5784377a)

### HTTP (Port 8080)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F2BaD0BMJHvp4upxUC25p%2Fimage.png?alt=media\&token=1fd19488-7206-4bab-b0a9-3aeb2435b387)

We can try querying ourselves by supplying our own IP, we see a response on our listener.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FkISTkVlx3G1g1yAO2pzR%2Fimage.png?alt=media\&token=e0640df9-bb1a-4d9a-bada-db7191f9b000)

We can then make use of SSRF and try to steam a NTLMv2 hash using `responder`.

`sudo responder -I tun0 -v`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F988xqnV3mKF7Es9XK8uS%2Fimage.png?alt=media\&token=a51ffa48-d70c-4467-973a-8609e21be9b6)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FpV0h2dhqm14BRAXMkaFJ%2Fimage.png?alt=media\&token=7f26ab07-09dc-49b8-8947-e0244bf72fab)

## Exploit

`evil-winrm -i 192.168.220.165 -u enox -p california`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FnvGNid0YWqH2Jv3iEH6g%2Fimage.png?alt=media\&token=27729dc6-c883-41ca-9ee5-f8d40339b0ec)

## Privesc

Upon manual enumeration, we see that there is `svc_apache$` user.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FYLoYQ8JPYYFk1hLi1q71%2Fimage.png?alt=media\&token=ade02ae0-4ce8-47e5-8e4c-b327b252c0ff)

We can use the `Get-ADPrincipalGroupMembership` cmdlet to check what groups this user is in.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F9GiYxDLHjAl0rgi3ttLm%2Fimage.png?alt=media\&token=c9916293-30f7-4b82-97f2-71e817077b08)

Group Managed Service Accounts are managed domain accounts that administrators use to help secure services. These service accounts are hence given automatically generated passwords. If they are granted certain permissions, we can retrieve these password hashes from Active Directory. We can use the `Get-ADServiceAccount` cmdlet and look up the `PrincipalsAllowedToRetrieveManagedPassword` property on the account.

We see that the group `Web Admin` has such a privilege over the `svc_apache$` account.

We then try to see if we can retrieve the password hash.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FaBUU64SbMDe6ZuleXV8n%2Fimage.png?alt=media\&token=5af567fa-7e56-4882-9d18-5e6e81f1911e)

Looks like we have the `ReadGMSAPassword` privilege over the `svc_apache$` service account.

We upload [`GMSAPasswordReader.exe`](https://github.com/CsEnox/tools/raw/main/GMSAPasswordReader.exe) and execute it with the `svc_apache` account name.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F1Dshcit9etexGKwhXQ3z%2Fimage.png?alt=media\&token=a700d719-d47d-41b8-9bd8-968cec766987)

Now we can do a PTH attack and gain access as `svc_apache$` user.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FJg6HcgEv569h9f8VK7an%2Fimage.png?alt=media\&token=7c0fd88d-e57d-482e-895d-8cfb80922e3a)

Upon manual enumeration, we see that this account has the `SeRestorePrivilege` enabled.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FBLaCadgQNRMtja7iBUtE%2Fimage.png?alt=media\&token=14e3b915-c665-48a5-8588-bfbf4c07358a)

SeRestorePrivilege allows file content modification, even if the security descriptor on the file might not grant such access. This function can also be used to change the owner and protection.

We can make use of the [EnableSeRestorePrivilege.ps1](https://github.com/gtworek/PSBits/blob/master/Misc/EnableSeRestorePrivilege.ps1) script the enable this privilege.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4au3ihjw7KIb0iDdbeQE%2Fimage.png?alt=media\&token=e29b622a-faac-44f8-968c-19844844a7cc)

Utilman.exe is the utility program that is launched when the "Ease of Access" button on the login screen is clicked. This is vulnerable to being replaced by cmd.exe, allowing an attacker to simply reset any user password since the tool is executed with admin rights.

We can take advantage of the fact that we have write access to the system directory `System32` to replace `utilman.exe` with `cmd.exe`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F97OGX17GNvJfal8gzREy%2Fimage.png?alt=media\&token=b980b0b0-bbfe-47df-9429-9f5d7481907d)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FCch1uYHmspZvawqZg0KN%2Fimage.png?alt=media\&token=cedbd136-fe8c-40fa-9c99-42805af64230)