Support
Support
Support 484
Support
RETIRED MACHINE

Support

Support - Windows Windows
Support - Easy Easy

4.5

MACHINE RATING

9021

USER OWNS

6169

SYSTEM OWNS

30/07/2022

RELEASED
Created by 0xdf

Machine Synopsis

Support is an Easy difficulty Windows machine that features an SMB share that allows anonymous authentication. After connecting to the share, an executable file is discovered that is used to query the machine's LDAP server for available users. Through reverse engineering, network analysis or emulation, the password that the binary uses to bind the LDAP server is identified and can be used to make further LDAP queries. A user called `support` is identified in the users list, and the `info` field is found to contain his password, thus allowing for a WinRM connection to the machine. Once on the machine, domain information can be gathered through `SharpHound`, and `BloodHound` reveals that the `Shared Support Accounts` group that the `support` user is a member of, has `GenericAll` privileges on the Domain Controller. A Resource Based Constrained Delegation attack is performed, and a shell as `NT Authority\System` is received.

Machine Matrix

Ready to start your
hacking journey?