Posts: 23
Threads: 2
Joined: Oct 2023
(Jun 30, 2024, 09:52 AM)ritualist Wrote: (Jun 30, 2024, 09:24 AM)jeff1998 Wrote: i am at Remote_Support_Administrators user now. any nudge for root?
I'm in the same place. You can abuse WriteSPN to get the hash of RSA_4810 and crack it. Check Bloodhound for details.
I have noticed RSA_4810 can write to
C:\Windows\SYSVOL\domain\scripts\A32FF3AEAA23
C:\Windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23
No idea if that's useful.
How did you get NU_1055 password? NTLMv2-SSP Hash isn't crackable
Posts: 57
Threads: 1
Joined: Apr 2024
(Jun 30, 2024, 12:14 PM)pwns4k3 Wrote: (Jun 30, 2024, 09:52 AM)ritualist Wrote: (Jun 30, 2024, 09:24 AM)jeff1998 Wrote: i am at Remote_Support_Administrators user now. any nudge for root?
I'm in the same place. You can abuse WriteSPN to get the hash of RSA_4810 and crack it. Check Bloodhound for details.
I have noticed RSA_4810 can write to
C:\Windows\SYSVOL\domain\scripts\A32FF3AEAA23
C:\Windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23
No idea if that's useful.
How did you get NU_1055 password? NTLMv2-SSP Hash isn't crackable
You don't need it.
Set-DomainObject -Identity RSA_4810 -SET @{serviceprincipalname='nonexistent/BLAHBLAH'}
Get-DomainSPNTicket -SPN nonexistent/BLAHBLAH
Posts: 55
Threads: 4
Joined: Apr 2024
(Jun 30, 2024, 12:14 PM)pwns4k3 Wrote: (Jun 30, 2024, 09:52 AM)ritualist Wrote: (Jun 30, 2024, 09:24 AM)jeff1998 Wrote: i am at Remote_Support_Administrators user now. any nudge for root?
I'm in the same place. You can abuse WriteSPN to get the hash of RSA_4810 and crack it. Check Bloodhound for details.
I have noticed RSA_4810 can write to
C:\Windows\SYSVOL\domain\scripts\A32FF3AEAA23
C:\Windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23
No idea if that's useful.
How did you get NU_1055 password? NTLMv2-SSP Hash isn't crackable
rsa_4810 pass is crackable
setspn -> kerberoast -> hash -> crack
Posts: 96
Threads: 2
Joined: Feb 2024
Anyone care to share where to exercise the SQLi? I tried a lot of fields in new post, but it just gets reflected...
Posts: 55
Threads: 4
Joined: Apr 2024
(Jun 30, 2024, 12:20 PM)a44857437 Wrote: Anyone care to share where to exercise the SQLi? I tried a lot of fields in new post, but it just gets reflected...
in admin panel
Get duplicated category names
Posts: 30
Threads: 3
Joined: Aug 2023
(Jun 30, 2024, 12:20 PM)a44857437 Wrote: Anyone care to share where to exercise the SQLi? I tried a lot of fields in new post, but it just gets reflected...
Here : http://admin.blazorized.htb/check-duplicate-post-title
Posts: 1
Threads: 0
Joined: Jun 2024
Jun 30, 2024, 12:28 PM
(This post was last modified: Jun 30, 2024, 12:38 PM by acutedz.)
Not sure whats wrong, I'm using cyberchef and grabbing the updated timestamps from the checkupdates token. Put jwt=<jwttoken> in local storage for admin.blazorized.htb and not getting the dashboard.
HS512 algo
Payload :
{
"http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "superadmin@blazorized.htb",
"http://schemas.microsoft.com/ws/2008/06/identity/claims/role": [
"Super_Admin"
],
"exp": <updated timestamp>,
"iss": "http://api.blazorized.htb",
"aud": "http://admin.blazorized.htb"
}
Got in, didn't copy key correctly
Posts: 96
Threads: 2
Joined: Feb 2024
Jun 30, 2024, 12:52 PM
(This post was last modified: Jun 30, 2024, 12:53 PM by a44857437.)
(Jun 30, 2024, 12:27 PM)Th3B4h0z Wrote: (Jun 30, 2024, 12:20 PM)a44857437 Wrote: Anyone care to share where to exercise the SQLi? I tried a lot of fields in new post, but it just gets reflected...
in admin panel
Get duplicated category names
thanks!
(Jun 30, 2024, 12:28 PM)DeDeLaPouille Wrote: (Jun 30, 2024, 12:20 PM)a44857437 Wrote: Anyone care to share where to exercise the SQLi? I tried a lot of fields in new post, but it just gets reflected...
Here : http://admin.blazorized.htb/check-duplicate-post-title
thanks!
Posts: 57
Threads: 1
Joined: Apr 2024
I was able to crack one of the DPAPI masterkeys for RSA_4810
SharpDPAPI.exe masterkeys /hashes
Then hashcat -m 15310 ...
SharpDPAPI.exe credentials /password:'zx...
Unfortunately it doesn't work for any users and I didn't find any useful credentials.
Did anyone make some progress on root?
Posts: 14
Threads: 0
Joined: Apr 2024
https://imgur.com/0TiJvP5
what's wrong guys?
local storage -> jwt:ey...
|
