HTB - Support Writeup - no Metasploit
Summary There was a file readable by the guest account. Furthermore, it included UserInfo.exe , a binary that performs LDAP communication, and we were able to recover a plaintext password from it by analyzing the binary. The group that support (the account whose shell we obtained) belongs to had GenericAll rights over the DC. We exploited this via RBCD to obtain Administrator. #### Recommendation…
During a system assessment, a readable file named UserInfo.exe was discovered on the guest account. This binary performed LDAP communication and contained a plaintext password that could be recovered through binary analysis. The "support" user, with whom the shell was gained, belonged to a group that had GenericAll access over the Domain Controller (DC). Exploiting this vulnerability through Remote Bulletin Board (RBCD) led to obtaining Administrator privileges.
To enumerate open ports, nmap was employed. Open ports included 135 (RPC), 139 (NetBIOS/SMB), 445 (SMB), 53 (DNS), 389 (LDAP), and 88 (Kerberos), suggesting an Active Directory-enabled standalone Windows machine. The domain was identified as "support.htb".
The system was tested for anonymous and guest login capabilities on shared resources, which revealed the existence of a unique folder called "support-tools". By connecting to this folder via SMB and listing its contents, several interesting files were discovered, including the targeted UserInfo.exe.
Upon disassembling the binary, it was found to have a function capable of logging in to LDAP, with the encryption method documented within the code. Utilizing Python, the password extracted from the binary - nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz - was employed to authenticate with the LDAP server. Finally, the contents of the directory were retrieved using ldapsearch with the supplied password.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
