Dragons-are-Us Penetration Test Report — GOAD-Light Active Directory Lab Simulation (CTF-Style)

Note: This blog post summarizes my final project for a Hacking Tools course, where I conducted a black box penetration test in a simulated GOAD Active Directory lab environment. The purpose was to apply real-world red teaming techniques and document key findings in a structured report.

A black box penetration test was conducted against a fictional Dragon-are-Us network infrastructure under an internally configured IP address.

Here is a list of the main vulnerabilities exploited in this penetration test:

1. Unrestricted File Upload (CWE-434): An IIS web server on the castelblack system was found. It allowed malicious files to be uploaded, enabling the execution of malicious ASPX files.

2. Buffer Overflow Vulnerability (CVE-2004–1561): The Icecast server running on port 8981 has a known buffer overflow vulnerability that enables remote code execution

3. Weak Password: Multiple accounts with administrative privileges contain the same password “Passw0rd!” that was easily cracked.

4. Misconfigured permissions for local services: This enabled me to gain the highest local privilege known as SYSTEM on Castelblack and Kingslanding

Phase 1: RECON

Step 1: Conduct an nmap scan on the target network

• 2 open ports were identified

Step 2: Look up the HTTP headers for more information

· We found that Microsoft IIS v10.0 and ASP.NET are running to power the applications

· The ability to curl the target with the open port suggests that there is a live web server actively listening to port 8980 that is responding to HTTP requests

Phase 2: ENUMERATION

Step 1: Gaining access to the IIS web shell through Default.aspx

· Browsed into http://<target IP>:8980/Default.aspx hosted in the IIS web server

· Identified an upload function that appeared to be a vulnerable access point

· Vulnerability found: Unrestricted File Upload (CWE-434)

Phase 3: EXPLOIT

Step 1: Upload cmdasp.aspx to create a web shell

· This aspx file acts as a command execution interface and allows remote users like me to run commands and navigate through directories to establish the initial foothold onto the server

Step 2: Retrieve Flag 1 under C:\inetpub\wwwroot\flag1.txt

· Browsed into the directories to retrieve the first flag

• I then browsed to http:<target IP>:8980/flag1.txt and successfully retrieved Flag 1

Step 3: Create an executable to gain access to the system

· Used msfvenom to establish a remote shell and craft an executable payload

· Payload used: windows/x64/meterpreter/reverse_tcp to open a reverse TCP connection back to my machine

· Set the LHOST as the attacker and a listening LPORT

· Uploaded the executable (hazmat.exe) in the web shell

· Browsed to the <target IP>:8980/upload/cmdasp.aspx directory to ensure my executable is uploaded and present in the C:\inetpub\wwwroot\upload directory

Note: This was done as a final exam where my classmates were all simultaneously gaining access alongside, hence why multiple executables are seen in this screenshot

Step 4: Set up multi/handler in Metasploit and run the exploit

· Launched msfconsole on the Kali machine and used multi/handler module to handle the reverse TCP connection from the target system

· Set the correct payloads, listening IP, and ports created in msfvenom

· This allows Metasploit to listen for an incoming reverse TCP connection from the compromised system to establish a meterpreter session

· Once everything is configured, I then proceeded to run the exploit by using the multi/handler module to listen to port 6500 for the reverse TCP connection from the target system

Step 5: Gaining a Meterpreter session

· I browsed into the folder where hazmat.exe resides and executed the executable from the command line

Step 6: Gathered information on the system

· Executed the command “sysinfo” to gather information on the system

· The output confirmed that I had successfully gained access to the Castleblack system

· Running the command “getuid” confirmed that the session is running as a low privilege service account which indicates that I will need to gain higher access through privilege escalation for further exploitation

Step 7: Escalating privilege to SYSTEM

· Executed the “getsystem” command to elevate privileges to the highest local privilege level

· By executing “getuid”, I can confirm that I have successfully gained SYSTEM privileges, which means that I now have full control over the castelblack host machine

· After gaining access, I then used the cat command to locate and read the contents of flag2.txt

PHASE 3: POST-EXPLOITATION

Step 1: Exploiting Icecast to gain a meterpreter shell

· During the enumeration phase, the second open port 8981/tcp revealed a service that is behaving like Icecast

· I launched Metasploit and searched for known exploits related to Icecast

· I used exploit/windows/http/icecast_header module, which targets the buffer overflow vulnerability in the Icecast server for versions before 2.0.1

· Vulnerability found: Icecast Header Overwrite Buffer Overflow RCE <2.0.1 (CVE-2004–1561)

· I configured the RHOSTS to point to the target IP and set RPORT to point to the port running the vulnerable icecast (8981)

· Ran show options to ensure that everything was correctly configured

· Ran the exploit and gained a meterpreter shell under the icecast vulnerability

Step 2: Retrieving flag4.txt

· Ran “sysinfo” which indicated that I had gained access to KINGSLANDING

· Ran “getsystem” command to attempt to elevate privilege

· Once NT AUTHORITY\SYSTEM privileges were obtained, I navigated to where the flag4.txt file was stored and used the cat command to read the contents of flag4.txt

PHASE 4: (Failed attempt to retrieve flag3.txt with evidence)

Step 1: Extracted credentials from the Icecast Meterpreter session

· Executed “hashdump” to extract NTLM hashes belonging to several accounts on the system

Step 2: Password cracking

· Exported the hashes into a text file and attempted to crack the passwords using hashcat against the rockyou.txt wordlist

· Found that the cracked password for accounts with admin privileges is “Passw0rd!”

Step 3: Attempted SMB authentication using psexec exploit module

· I set a background session for the current session and then used the windows/smb/psexec exploit

· I set the LPORT to match the listener (port 6500), the SMBUser as vagrant, the SMBPass as vagrant, and experienced a failed exploit

· I then set the SMBPass as the LM hash from the hashdump. However, this authentication method also failed

Step 4: I used socat to set up a port forwarding

· This step was intended to listen on port 445 to try to access the SMB service running

· This failed because there was already an address using port 445

· I then attempted to use the psexec module and try different port configurations, but the attempt was also unsuccessful

While I was unsuccessful in finding the 3rd flag, it did make me feel better that nobody else in my class was successful in that, either with the limited time frame we had.