search

Learning Objetive 6

  • Student VM - Name of the Group Policy attribute that is modified

hashtag
Invishell

hashtag
GPO for DCORP-CI

It appartains to DevOps Policy, we can confirm it using Get-DomainGPO -Identity 'DevOps Policy' command.

hashtag
Abuse an overly permissive Group Policy to get admin access on dcorp-ci.

In Learning-Objective 1, we enumerated that there is a directory called 'AI' on the dcorp-ci machine where 'Everyone' has access. Looking at the directory (\\dcorp-ci\AI), we will find a log file.

LogoLearning Objetive 1 | Checklists | brain_fuckeldeim.gitbook.iochevron-right

So... enter to the fileshare AI -->

It turns out that the 'AI' folder is used for testing some automation that executes shortcuts (.lnk files) as the user 'devopsadmin'.

Recall that we enumerated a user 'devopsadmin' has 'WriteDACL' on DevOps Policy. Let's try to abuse this using GPOddity.

First, we will use ntlmrelayx tool from Ubuntu WSL instance on the student VM to relay the credentials of the devopsadmin user.

You can start a session on Ubuntu WSL by searching for wsl in the search bar or by using the Windows Terminal.

hashtag
Run Ubuntu WS

Run the following command in Ubuntu to execute ntlmrelayx. Keep in mind the following.

  1. Use WSLToTh3Rescue! as the sudo password.

  2. Remember to replace the IP with your own student VM.

  3. Make sure that Firewall is either turned off on the student VM or you have added exceptions.

Note: I obtain DC's IP pinging it ping DOLLARCORP.MONEYCORP.LOCAL -> 172.16.2.1

hashtag
Create a Shortcut

On the student VM, let's create a Shortcut that connects to the ntlmrelayx listener. Go to C:\AD\Tools -> Right Click -> New -> Shortcut. Copy the following command in the Shortcut location:

Save it with us username (student 113)

Name the shortcut as studentx.lnk. Copy the lnk file to 'dcopr-ci\AI'.

hashtag
Privileges Escalation to Disabled the Firewall

Note: For this, we need have privileges until, so... use the escalation on LO-5

LogoLearning Objetive 5 | Checklists | brain_fuckeldeim.gitbook.iochevron-right

hashtag
Enumerate Local Privilage Escalation

Let's use the abuse function for Invoke-ServiceAbuse and add our current domain user to the local Administrators group.

Remembder use the invishelll and POWEUP modules (not poweview)

We can see that the dcorp\studentx is a local administrator now. Just logoff and logon again and we have local administrator privileges!

hashtag
Execution All

Resume: We need the local admin to desactive the firewall to then, use wsl ubuntu with reay and .lnk in the share

WE HAVE VISIBILITY! So... now use nc to the next time it access, get us a shell -->

Remember leave the ntmlrelay running. And execute nc in another terminal WSL

hashtag
NC LDAP Terminal

Using this ldap shell, we will provide the studentx user, WriteDACL permissions over Devops Policy {0BF8D01C-1F62-4BDC-958C-57140B67D147}:

hashtag
Alternative

Alternatively, if we do not have access to any doman users, we can add a computer object and provide it the 'write_gpo_dacl' permissions on DevOps policy {0BF8D01C-1F62-4BDC-958C-57140B67D147}

Stop the ldap shell and ntlmrelayx using Ctrl + C.

Now, run the GPOddity command to create the new template.

hashtag
GPOddity commands

Note: Use the same shell of nc ubuntu

Note: Change stdx-gp to std113-gp

Leave GPOddity running and from another Ubuntu WSL session, create and share the stdx-gp directory:

Great, now open a new windows shell as administrator to create a share (std113-gp) ad assign privileges for everyone:

hashtag
Verify if the gPCfileSysPath

Note: Run the following PowerView command

The update for this policy is configured to be every 2 minutes in the lab. After waiting for 2 minutes, studentx should be added to the local administrators group on dcorp-ci:

PreviousLearning Objetive 5NextLearning Objtetive 7

Last updated