**Had to shutdown to IP changed to 10.129.74.218 for some later things
Findings
HTTP
Not a lot to the website, no logon forms or any hidden directories
Dirbuster/Gobuster
SMB
Directories are empty, C$ and ADMIN$ we don't have access by default.
BUT we were able to find the users with CrackMapExec and trying various passwords(username as pass but upper and lower), we find a valid user/password combination: Operator:operator
RPC
Not much found here but we did find the SID of the Administrator account
SQL
Impacket-mssqlclient
Were able to log in with Operator:operator
Using xp_dirtree to look around in various directories we eventually found:
User flag was found under user.txt on Ravens desktop: 5ba4881af698a98cbf340a8861580333
Priv Esc
Looked around at what permissions Raven had
WinPEAS
Nothing of super note was found with WinPeas unfortunately
certipy
We checked with Certipy due it being Active Directory and on a DC. So we want to enumerate certificates.
We see ESC7 is vulnerable - On the certipy github on ESC7. Upgrade Ravens account to have additional permissions. These had to be done in qucik succession as the machine does reset itself every few minutes.
We now have our administrator.pfx and we can use this.
We need to sync our clock with the DC. We we can use rdate(need to install it) to get the time of the DC Server
Then use faketime to sync the clock
Re-run our certipy command and get the hash of the administrator!
