Forest
easy level AD machine on HTB
First nmap scan revealed the following ports to be open
53,88,135,139,389,445,464,593,636,3268,3269
Now with this nmap scan we'll get more service and version info
nmap 10.129.95.210 -p53,88,135,139,389,445,464,593,636,3268,3269 -sCVAnd the output was
Trying to get anonymous access using SMB failed, but worked on ldap, using
Now we'll enumerate users using LDAP anonymous and put them in a list using, this command,
and now check for accounts without kerberos pre-auth using
now this will give us the AS-rep hash of svc-alfresco, and we will crack it using hashcat, using
The cracked password will be s3rvice. Now there doesnt seem much in the nmap to get a shell, since there is nothing interesting in the smb as well, so i'll try WinRM using
now get the user flag.
Now setup a python server on the attacker machine to get PowerView.ps1, and in WinRM transfer it using
There wasn't much interesting stuff found using PowerView, so transferring sharphound.exe to ingest data for bloodhound
then run SharpHound
Now in bloodhound we see that "Exchange Windows Permissions" have the right to WrtieDACL on domain, so we'll create an account and add it in that group using
Now all the requirements are done to execute writeDACL, so using impacket-secretsdump, we'll exploit it
this will give the ntlm hash of administrator, which we will use to get shell as Administrator using impacket-psexec
Last updated