Voleur
quickie
User
Setup /etc/krb5.conf for kerberos authentication with voleur.htb
[libdefaults]
default_realm = VOLEUR.HTB
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = true
[realms]
VOLEUR.HTB = {
kdc = 10.10.11.76
}
[domain_realm]
.voleur.htb = VOLEUR.HTB
voleur.htb = VOLEUR.HTB
Set your /etc/hosts file appropriately
We can now request for a TGT using kinit and authenticate with kerberos
We can enumerate shares which gives us a protected excel file that can be cracked with office2john
The excel file gives us the following credentials svc_ldap:M1XyC9pW7qT5Vn svc_iis: N5pXyW1VqM7CZ8 todd.wolfe: NightT1meP1dg3on14
svc_ldap has WriteSPN over svc_winrm, and since there is no ADCS in the domain, we can make use of targetedKerberoasting
We can get user flag from svc_winrm, using kinit to get a TGT for authentication with kerberos
Root
svc_ldap is in the Restore Users group, which is hinted to be able to restore deleted user Todd.wolfe Getting a shell with svc_ldap using sliver and runascs.exe
We can do the following to restore deleted objects
We can test with netexec to see if we now have access to Todd.Wolfe using the password in excel NightT1meP1dg3on14
We can access the IT share again to get access to a archived home directory of Todd.Wolfe We can extract dpapi protected data using impacket-dpapi The masterkey is at "C:\Users\todd.wolfe\AppData\Roaming\Microsoft\Credentials\S-1-5-21-3927696377-1337352550-2781715495-1110\08949382-134f-4c63-b93c-ce52efc0aa88 The credential blob is at C:\Users\todd.wolfe\AppData\Roaming\Credentials\772275FAD58525253490A9B0039791D3
Enumerate shares once again, getting access to svc_backup ssh key as hinted in the excel note previously. There is also WSL ssh access on Port 2222.
We can access the \mnt directory and accessing the IT share once again, we see copies of SECURITY, SYSTEM and NTDS.dit
We can now dump the domain and get access via evil-winrm
Use impacket-getTGT as we do not have the password of Administrator
Last updated