[A-17]

evil-winrm -i administrator.htb -u administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e

[hollb_geek]

Could someone provide a step by step details please ?
I've looked into Olivia's privs but they don't lead anywhere :

Privilege Name Description State
============================= ============================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[maggi]

After compromise michael, whats next? Cant find a way to go to emily

Try looking in FTP as Benjamin with his creds

[hollb_geek]

Could someone provide a step by step details please ?
I've looked into Olivia's privs but they don't lead anywhere :

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege    Add workstations to domain    Enabled
SeChangeNotifyPrivilege      Bypass traverse checking      Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

We have an AD environment. Use bloodhound (for instance).

I started with bloodhound but i found no path from olivia

Edit: Nvm, i found genericall on Michael

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[maggi]

Could someone provide a step by step details please ?
I've looked into Olivia's privs but they don't lead anywhere :

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege    Add workstations to domain    Enabled
SeChangeNotifyPrivilege      Bypass traverse checking      Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

We have an AD environment. Use bloodhound (for instance).

I started with bloodhound but i found no path from olivia

I was not sure so I just kept moving around where I could until I saw one user had free root

[Unbutton8074]

use this to get ethan from emily
https://github.com/ShutdownRepo/targetedKerberoast

[maggi]

use this to get ethan from emily
https://github.com/ShutdownRepo/targetedKerberoast

powerview for SPN jacking works too

[jahman]

Starter credential :  Olivia / ichliebedich

Hello,

How did you find olivia's password? by bruteforcing?

Thanks.

[darknesst]

Starter credential :  Olivia / ichliebedich

Hello,

How did you find olivia's password? by bruteforcing?

Thanks.

Its given when starting the box.

Also the PSafe3 file can be brute forced, research on google.

[muyix]

Stucked in michael, any hints?