Attacking Windows Credential Manager — HTB Module Walkthrough

Step-by-Step Walkthrough: Attacking Windows Credential Manager (HTB Module)

Disclamer

This content is intended for legal use only, on systems you have explicit permission to test. The target host is not under any EDR, so no evasion techniques have been used.

Module question

What is the password mcharles uses for OneDrive?

Access remote host, initial user and password are kindly offered by HTB teams ;)

Foothold

xfreerdp3 /v:<IP> /u:sadams /p:'totally2brow2harmon@'  /drive:MyDrive,/mnt/xfreerdp-share /f

/drive -> create a SMB share that can be discovered by the target host

I usually use the /drive option of xfreerdp, since I often need to upload “something”. It's probably not the stealthiest approach, but flying under the radar isn't the aim of this module anyway.

/f -> full screen

Enumeration

First thing I try is to start a cmd or powershell with Administrator access rights, and here we see the User Account Control (UAC) stopping us.

UAC Requiring Administrator access

Then we can check if we can easily use our share

Here we get informed that the Network Discovery is disabled, so let’s try to turn it on.

Microsofts porvied for you a nice short cut

Once again, UAC is preventing us from enabling Network Discovery. We’ll take care of it later.

Now, following the guidelines from the module, we can enumerate the credentials stored in the current user’s profile.

cmdkey /list

We can see thatDomain:interactive=SRV01\mcharles, is a domain credential associated with the user SRV01\mcharles. Therefore, it’s a credential we can try to leverage.

Privilege Escalation

Still following the module’s guidelines, we can impersonate SRV01\mcharles .

runas /savecred /user:SRV01\mcharles cmd

The above command will trigger a cmd shell owned by SRV01\mcharles eventually we can replace cmd with ps to spawn a powershell terminal.

Now, we can enumerate which credentials are stored by mcharles.

cmdkey /list

Seems that our target is just there, but how can we grab it? Using Mimikatz we can dump LSASS or Windows Credentials Vault, but how can we infiltrate our software?

What I usually do is set up a web server with Python, but in this case, I couldn’t reach my client from the target host. So, it’s not going to work, and I need to hit “Hint” button.

Bypassing UAC

Let’s run msconfig from mcharle’s terminal, but first we shall check which kind of privilege we already have.

whoami /groups

will show us in which groups we are.

I’d like to highlight how we are part of the NL AUTHORITY and BUILTIN\Administrators group, but only as “Group used for deny only”.

NT AUTHORITY\Local account and member of Administrators group Well-known group S-1-5-114    Group used for deny only
BUILTIN\Administrators                                        Alias            S-1-5-32-544 Group used for deny only
BUILTIN\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE

From here, we can start msconfig -> Tools -> Command Prompt -> Launch

This should start a third cmd shell that would inherit the same access token used by msconfig. We can check again with

whoami /groups

Now, we should have more rights and be able to bypass UAC.

Dump it!

Upload Mimikatz

Since the new rights are limited only to the latest terminal we spawned, and since I want to use the xfreerdp’s network share we have to enable Network Discovery via cmd shell.

Googling around, I found the following command:

netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes

Now we can comfortably browse to our share and copy Mimikatz to a more appropriate location, such as mcharles’ home directory.

Credential Dump

Still using our escalated shell, go to Mimikatz folder and start it.

We can use sekurlsa::credman to dump LSASS credentials

Conclusion & References

I enjoyed this module, and this post is more a collection of my notes taken while studying. I’m new to writing walkthroughs and writeups, so any comments, suggestions, or constructive criticism are very welcome.

I’d like to thank:

• HTB’s teams for the wonderful module materials
• Irfan Farooq for the article “Bypassing UAC through msconfig” https://medium.com/@irfanbhat3/bypassing-uac-by-gui-based-bypasses-a1a53e8ee8f2