Scrambled — HTB Writeup | The Hack Sparrow

Executive summary — Scrambled is a Domain Controller that has disabled NTLM across the entire domain, forcing all authentication over Kerberos. A trivial initial credential (password equal to the username) grants read access to LDAP; from there, classic Kerberoasting cracks the password of the MSSQL service account, whose key is reused to forge a Silver Ticket impersonating the domain Administrator against SQL Server itself. From sysadmin, xp_cmdshell gives command execution as the service account, which turns out to hold SeImpersonatePrivilege — a direct path to NT AUTHORITY\SYSTEM via GodPotato.

Platform	Hack The Box
Operating system	Windows Server 2019 — Domain Controller
Difficulty	Medium
Status	Retired
Target IP	`10.129.82.24`
Domain	`scrm.local`
Domain Controller	`dc1.scrm.local` (`DC1`)
Starting point	`ksimpson : ksimpson` (weak credential)

Attack map

NTLM disabled domain-wide (everything over Kerberos)
   └─► ksimpson:ksimpson (password = username) → TGT
          └─► Kerberoasting → sqlsvc:Pegasus60 (weak password, SPN-registered service account)
                 └─► Silver Ticket (sqlsvc key) impersonating Administrator → MSSQL sysadmin
                        └─► xp_cmdshell → execution as scrm\sqlsvc
                               └─► SeImpersonatePrivilege → GodPotato → NT AUTHORITY\SYSTEM

1. Reconnaissance

1.1 Port scan

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.82.24 -oN nmap/allports.txt

53/tcp    domain          |  88/tcp    kerberos-sec
80/tcp    http (IIS 10)   |  135/139   msrpc/netbios
389/636   ldap/ldaps      |  445/tcp   microsoft-ds
1433/tcp  ms-sql-s        |  3268/3269 globalcat LDAP
4411/tcp  (custom)        |  5985/tcp  WinRM
9389/tcp  adws            |  (+ dynamic RPC ports)

The Kerberos (88) + LDAP (389) + DNS (53) + ADWS (9389) combination identifies a Domain Controller. Also notable: MSSQL (1433), IIS (80), and a non-standard port 4411.

An SMB scan gives the single most important fact on the whole box:

nxc smb 10.129.82.24

SMB  10.129.82.24  445  DC1  [*] x64 (name:DC1) (domain:scrm.local) (signing:True) (SMBv1:None) (NTLM:False)

NTLM:False — NTLM authentication is disabled across the whole domain. No NTLM hash passing, no classic relay: every tool from here on has to speak Kerberos explicitly (-k in Impacket/NetExec, tickets instead of bare passwords), which shapes the entire rest of the box.

1.2 Preparing the Kerberos environment

Kerberos is very sensitive to hostnames and clock time: a skew above 5 minutes against the KDC breaks any authentication with KRB_AP_ERR_SKEW. /etc/hosts and /etc/krb5.conf are configured, and the clock is synced with the DC:

echo '10.129.82.24 scrm.local dc1.scrm.local DC1' | sudo tee -a /etc/hosts
sudo ntpdate -u scrm.local            # sync the clock against the DC

[libdefaults]
    default_realm = SCRM.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    udp_preference_limit = 1
[realms]
    SCRM.LOCAL = { kdc = dc1.scrm.local }
[domain_realm]
    .scrm.local = SCRM.LOCAL
    scrm.local = SCRM.LOCAL

1.3 Web

The site on port 80 is the "Scramble Corp" intranet. Its support.html page confirms why NTLM is disabled:

"04/09/2021: Due to the security breach last month we have now disabled all NTLM authentication on our network."

Resumen ejecutivo — Scrambled es un Domain Controller que ha deshabilitado NTLM en todo el dominio, forzando toda la autenticación por Kerberos. Una credencial inicial trivial (contraseña igual al usuario) da acceso de lectura a LDAP; de ahí, un Kerberoasting clásico rompe la contraseña de la cuenta de servicio de MSSQL, cuya clave se reutiliza para forjar un Silver Ticket que suplanta al Administrador del dominio frente al propio SQL Server. Desde sysadmin, xp_cmdshell da ejecución de comandos como la cuenta de servicio, que resulta tener SeImpersonatePrivilege — la vía directa a NT AUTHORITY\SYSTEM vía GodPotato.

Plataforma	Hack The Box
Sistema operativo	Windows Server 2019 — Domain Controller
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.82.24`
Dominio	`scrm.local`
Domain Controller	`dc1.scrm.local` (`DC1`)
Punto de partida	`ksimpson : ksimpson` (credencial débil)

Mapa del ataque

NTLM deshabilitado (todo Kerberos)
   └─► ksimpson:ksimpson (contraseña = usuario) → TGT
          └─► Kerberoasting → sqlsvc:Pegasus60 (contraseña débil, cuenta de servicio con SPN)
                 └─► Silver Ticket (clave de sqlsvc) suplantando Administrator → MSSQL sysadmin
                        └─► xp_cmdshell → ejecución como scrm\sqlsvc
                               └─► SeImpersonatePrivilege → GodPotato → NT AUTHORITY\SYSTEM

1. Enumeración

1.1 Escaneo de puertos

sudo nmap -p- --min-rate 2000 -T4 -Pn 10.129.82.24 -oN nmap/allports.txt

53/tcp    domain          |  88/tcp    kerberos-sec
80/tcp    http (IIS 10)   |  135/139   msrpc/netbios
389/636   ldap/ldaps      |  445/tcp   microsoft-ds
1433/tcp  ms-sql-s        |  3268/3269 globalcat LDAP
4411/tcp  (custom)        |  5985/tcp  WinRM
9389/tcp  adws            |  (+ puertos RPC dinámicos)

El conjunto Kerberos (88) + LDAP (389) + DNS (53) + ADWS (9389) identifica un Domain Controller. Destacan además MSSQL (1433), IIS (80) y un puerto no estándar 4411.

Con un escaneo de SMB obtenemos el dato más importante de toda la máquina:

nxc smb 10.129.82.24

SMB  10.129.82.24  445  DC1  [*] x64 (name:DC1) (domain:scrm.local) (signing:True) (SMBv1:None) (NTLM:False)

NTLM:False — la autenticación NTLM está deshabilitada en todo el dominio. Nada de pasar hashes NTLM ni de relay clásico: cada herramienta a partir de aquí tiene que hablar Kerberos explícitamente (-k en Impacket/NetExec, tickets en vez de contraseñas sueltas), lo que condiciona todo el recorrido de la máquina.

1.2 Preparación del entorno Kerberos

Kerberos es muy sensible al nombre de host y a la hora: un skew de reloj superior a 5 minutos frente al KDC rompe cualquier autenticación con KRB_AP_ERR_SKEW. Se configuran /etc/hosts y /etc/krb5.conf, y se sincroniza el reloj con el DC:

echo '10.129.82.24 scrm.local dc1.scrm.local DC1' | sudo tee -a /etc/hosts
sudo ntpdate -u scrm.local            # sincroniza el reloj con el DC

[libdefaults]
    default_realm = SCRM.LOCAL
    dns_lookup_realm = false
    dns_lookup_kdc = false
    udp_preference_limit = 1
[realms]
    SCRM.LOCAL = { kdc = dc1.scrm.local }
[domain_realm]
    .scrm.local = SCRM.LOCAL
    scrm.local = SCRM.LOCAL

1.3 Web

El sitio del puerto 80 es la intranet "Scramble Corp". Su página support.html confirma por qué NTLM está desactivado:

"04/09/2021: Due to the security breach last month we have now disabled all NTLM authentication on our network."

🔒 Clearance required

Root Access unlocks the content you can't see — everything else on the site is already open.

See Root Access plans

No account? Create one free then upgrade from your console.