So we're going to walk through a box called active now active relates to Active Directory it's one of
my favorite machines on Hack the box.
Because of this so active lives.
At ten ten ten dot one hundred and I want you to go ahead and boot up your machine log in to hack the
box.
If you are going to follow along.
So this is going to be kind of a two part video.
The first part I'm going to show you how we scan and enumerate this machine.
What we're looking for when it comes to GBP and then the second part is just going to be a bonus.
We're going to actually have to print ask this machine and we're going to figure out how we're going
to prevent this machine based on an attack that we've already done in the past in this cause.
So once you're all loaded up here go ahead and go into your terminal and get scanning.
So this one lives at 10 dot ten.
That ten THAT ONE HUNDRED AND I'M JUST GOING TO MAKE THIS A quick scan and map and then will this do
I'm actually gonna do a t five on ten ten ten.
One hundred and this should pull back pretty fast on the ports what we're going to be after.
And so what we're going to do here is you can see that we are running a domain.
So when when we scan against a domain controller we expect to see something like fifty three open and
that could be a router as well.
But we also expect to see 88 open because 88 is curb gross and if running cobras on that ports that
kind of tells us along with all that and all that secure or all that SSL.
So now we kind of have an idea that this is probably a domain controller based on all the things that
we're seeing here.
So on top of this we have four forty five open.
So we want to enumerate for forty five on this machine and we're going to take a look at four forty
five for this attack.
Why are we looking at four forty five.
Because the attack involves utilizing SMB and in SMB when you connect to it there are six ball folders
right.
Let's take a look.
This will be easier.
So let's say SMB client and we'll do a dash L to list this out and I'll go ahead and just say 10 10
10 one hundred.
I'll take a quick look at this and we'll try anonymous connection here and you can see that there are
different folders.
There's the admin A C folder IPC net log on replication system all and users.
Now we can try to connect to each one of these but it's going to deny us access to all of these.
However there is this replication folder where we do have anonymous access as no user right.
So we're just gonna say replication enter this in and we have access to this machine and I'm kind of
speeding along here just so that we can get through this and we can actually work on the the machine
itself with the exploit itself as opposed to working on methodology and why we're doing this the exploit
is more related to SMB than it is enumerating.
So this isn't a walk through box more so than showing you the exploit.
So the way this file works is it's storing this groups dot excel file and in that groups the excel file
is where you find that c password and this is where that GP that group policy preferences came into
play.
And so let's go ahead and turn on my turn prompt off which is just going to like a type it which is
just going to tell us not to prompt when we tell it to download all of our files.
So what I'm going to say is I want rehearse on so recurs on means it's going to download all the files
that I tell it to.
So if the outlets here you can see there's a bunch of different folders and files in here and there's
actually you can see there's a groups that excel and this is kind of what we're gonna be interested
in.
So what we're gonna do is we're just going to say and get star like this and this is going to get all
the files and as we see these come across we can know if we're interested in anything we see this GP
to iron eye we see groups that X AML a registry policy GP t template.
So we're really interested in this groups that X AML.
And this is something to no take groups of X most the file you're looking for when it comes to GP.
Now you don't have to do this again.
There is the GP enumerate when it comes to interpreter or if you want to use power shell.
There are power shell scripts out there as well.
I believe one is called invoke GP and that will search through through the system fall for you as a
user and look for this exploit.
So in this situation I should note too that we had anonymous access to this replication folder.
That's not a realistic scenario.
This is most definitely a post exploit scenario where we have a user account once we have that user
account we'll be able to access that source file folder.
Ok.
So from here we see that we have this groups that excel.
So what I'm gonna do is I'm actually gonna go to files and we are here an active HDTV.
It should download to that and we can just kind of look where it went.
So I went policies 3 1 be ready to go to 3 1 b folder and then we're going to go to preferences or machine
preferences groups and there's the groups that excel.
So this is why I also did the M get star is so that we can see what came through and we don't have to
just sit there and C D and navigate around just to see if there's something in a folder or not in a
folder it's much easier to sit down with everything in it and look through what comes through.
So when we come into here and we open this up you can see now that we have our C password on top of
this.
We have active the HDTV which is the domain name and we have service ticket granting service.
T.J. yes that should ring a bell right ticket granting service.
So this is the TGA s account.
So what are we going to do.
We're going to copy this bad boy here and we can go right into.
Let's just go ahead and go to a new tab.
Make this bigger.
And we could just say something along lines of GBP decrypt paste that in just like that and look what
happens GBP still standing strong to K 18 so that's the password.
Look how long this password is.
It doesn't really matter right.
What matters here is that we are able to reverse or decrypt this GDP because we know the encryption
so here we now have a user name and a password.
We have active HDTV service.
Yes.
And the password of GP still standing strong to K 18.
So I'm going to pause the video here or I'm going to actually cut the video off.
This isn't to be considered part one part two is going to be a challenge to you.
We can now go log in with this account and you're going to find that when you log in with this account
you are actually a lower level user.
This account is not a high level user.
This is not a system.
OK.
So because this is not a system level user what is an attack that we can run on this to try to escalate
and you can use anything and everything that has been taught to you so far.
Once you think through it think if you find the answer.
Go ahead and attempt it.
If you're just watching and not following along with the hack of ok that's ok as well just go ahead
and meet me next video and we'll cover this.
So a brief review as well.
We are after the GP right the groups dot excel.
This is an older exploit.
We're targeting Windows 2012 server 2012 usually with these and you're going to see these in environments.
When you when you come across it it's going to look pretty much like what I showed you.
It's going to be something like this where you either get the username and the password right off the
bat with return fritter or you're going to run something along the lines of invoke GBP and you're going
to try to search for that as well the power shell module.
But this is what you're after.
And this is what you're decrypting here with that password.
So now you've got to use and password.
How are we going to abuse this.
I love this machine so I'll meet you over in the next video with the solution.