![[esc3 3.png]]
## Overview
[Escape Room Link](https://app.hackthebox.com/machines/531/information)
This is my writeup for the HackTheBox room called "Escape" which is the first Windows machine on TJ Null's OSCP PWK V3 list. In this room we will be dealing with a variety of enumeration and privilege escalation techniques utilizing a variety of protocols, tools, and techniques including SMB, password cracking, WinRM, Active Directory, and Active Directory Certificate Services.
I hope you enjoy the writeup and learn something like I did!
## Enumeration
Initial Nmap Scan.
```
$ nmap -T4 -n -sC -sV -Pn -p- 10.129.228.253
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-18 12:38 CST
Nmap scan report for 10.129.228.253
Host is up (0.078s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-19 02:40:22Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-19T02:41:52+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-19T02:41:52+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info:
| 10.129.228.253:1433:
| Target_Name: sequel
| NetBIOS_Domain_Name: sequel
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: sequel.htb
| DNS_Computer_Name: dc.sequel.htb
| DNS_Tree_Name: sequel.htb
|_ Product_Version: 10.0.17763
| ms-sql-info:
| 10.129.228.253:1433:
| Version:
| name: Microsoft SQL Server 2019 RTM
| number: 15.00.2000.00
| Product: Microsoft SQL Server 2019
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2024-11-19T02:41:52+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2024-11-19T02:34:40
|_Not valid after: 2054-11-19T02:34:40
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-19T02:41:52+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-19T02:41:52+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Not valid before: 2024-01-18T23:03:57
|_Not valid after: 2074-01-05T23:03:57
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49689/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49690/tcp open msrpc Microsoft Windows RPC
49710/tcp open msrpc Microsoft Windows RPC
49720/tcp open msrpc Microsoft Windows RPC
49741/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2024-11-19T02:41:13
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 8h00m00s, deviation: 0s, median: 7h59m59s
```
As we can see from the comprehensive Nmap scan, we are left with quite a lot of information to parse through. We see that the following ports are open: `53,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389,49667,49689,49690,49710,49720,49741`. We know that this a Domain Controller just from the results that we received from the Nmap scan as it is running LDAP and LDAP over SSL on ports `389`, `3268`, and `3269` - The DNS Subject Alternative Names also provide the domain names for `dc.sequel.htb`, `sequel.htb`, and `sequel` and the `Service Info: Host: DC` also indicates that it is a Domain Controller. I went ahead and added these to my hosts file in `/etc/hosts` as we normally do.
Although towards the bottom of the Nmap scan results we see that SMB Security 3.1.1 is enabled and message signing is enabled and required, I attempted to authenticate as a guest user anyways with `smbmap` but was only able to display the shares.
```
$ smbmap -H 10.129.228.253 -u 'guest' -p ''
[+] IP: 10.129.228.253:445 Name: sequel.htb
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON NO ACCESS Logon server share
Public READ ONLY
SYSVOL NO ACCESS Logon server share
```
My next goal was to attempt to run `enum4linux` to see if we could discover any other useful information on the target that might point us in the right direction.
```
$ enum4linux -A 10.129.228.253
ENUM4LINUX - next generation (v1.3.4)
===========================================
| RPC Session Check on 10.129.228.253 |
===========================================
[*] Check for null session
[+] Server allows session using username '', password ''
[*] Check for random user
[+] Server allows session using username 'linkvyma', password ''
[H] Rerunning enumeration with user 'linkvyma' might give more results
=====================================================
| Domain Information via RPC for 10.129.228.253 |
=====================================================
[+] Domain: sequel
[+] Domain SID: S-1-5-21-4078382237-1492182817-2568127209
[+] Membership: domain member
```
After running `enum4linux` I scrolled through the output and the two above entries caught my eye. We see that `enum4linux` found that the RPC sever allows for essentially an empty session with a random username. This may be our entry point on to the system. Let's try connecting to the RPC server using `rpcclient` and an empty username.
```
$ rpcclient -U '' 10.129.228.253
Password for [WORKGROUP\]:
rpcclient
gt; help
......
rpcclient gt; getusername
Account Name: Guest, Authority Name: sequel
```
Looks like we have established some access, let's run the help command and see what looks interesting from our list of options. Remember, we are looking for a file here according to the information provided to us on the machine page.
```
sequel S-1-5-21-4078382237-1492182817-2568127209 (Domain: 3)
rpcclient gt; lookupnames guest
guest S-1-5-21-4078382237-1492182817-2568127209-501 (User: 1)
rpcclient gt; lookupnames
```
After running through most of the commands I thought would help I kept repeatedly running into an `NT_STATUS_ACCESS_DENIED` message. From here I decided to run Impacket's `lookupsid.py` to see if we could discover any interesting users.
```
$ lookupsid.py