[alialaa]

Manager has been Pwned !

Remember to be Fast with certipy-ad

---

Hi, i managed to obtain the administrator.pfx file, now what should i do?

i tried pfx2john and that john but nothing works

you don't need pfx2john login with the hash using evil-winrm

[mqldmls]

User: 
1. Use Crackmapexec to get a list of users via RID bruteforcing

crackmapexec smb manager.htb -u 'anonymous' -p '' --rid-brute

2. You should have the following users:

• Zhong
  
• Cheng
  
• Ryan
  
• Raven
  
• JinWoo
  
• ChinHae
  
• Operator
  

The "Operator" account looks interesting. Try to guess the password.
Hint:

#!/usr/bin/python3

f = open('users-plain.txt', 'r')
users = ''.join(f)

print(users.lower())

f.close()

3. "Operator" can login to the MSSQL server. Use this syntax:

impacket-mssqlclient -p 1433 -windows-auth -dc-ip 10.10.11.236 "manager.htb/Operator:<password>"@10.10.11.236

4. There is a special stored procedure that lets you traverse the filesystem via MSSQL. Use that to explore an attack surface you thought wasn't exploitable. 

5. Download that interesting archive and see where it takes you 

how to download the archive from this utility "]impacket-mssqlclient" ?

you can't download it via mssql, but you can use xp_dirtree to traverse the filesystem. What you want is in the root of the website.

man i'm feeling dumb, thanks

[mrwowxox]

getting error after "Got CA configuration" anyone any idea

[alialaa]

getting error after "Got CA configuration" anyone any idea

certipy-ad ca -ca 'manager-DC01-CA' -add-officer raven -username raven@manager.htb -password 'ravenpassword'

[spider2023]

User: 
1. Use Crackmapexec to get a list of users via RID bruteforcing

crackmapexec smb manager.htb -u 'anonymous' -p '' --rid-brute

2. You should have the following users:

• Zhong
  
• Cheng
  
• Ryan
  
• Raven
  
• JinWoo
  
• ChinHae
  
• Operator
  

The "Operator" account looks interesting. Try to guess the password.
Hint:

#!/usr/bin/python3

f = open('users-plain.txt', 'r')
users = ''.join(f)

print(users.lower())

f.close()

3. "Operator" can login to the MSSQL server. Use this syntax:

impacket-mssqlclient -p 1433 -windows-auth -dc-ip 10.10.11.236 "manager.htb/Operator:<password>"@10.10.11.236

4. There is a special stored procedure that lets you traverse the filesystem via MSSQL. Use that to explore an attack surface you thought wasn't exploitable. 

5. Download that interesting archive and see where it takes you 

could you tell more about 4 point? what attack you're talking about? im stuck on that

impacket-mssqlclient  i can't get anything  xp_dirtree "c:\inetpub\wwwroot" ,1,1

[mrwowxox]

https://ibb.co/GMVLNLm
This is the error I'm getting

[alialaa]

https://ibb.co/GMVLNLm
This is the error I'm getting

be faster with the first 3 commands or copy the commands and execute them once

[juicemon]

I was able to get a pfx file, but I also did sync through ntpdate, but I'm constantly getting an error saying "KRB_AP_ERR_SKEW(Clock skew too great)" during the authentication process.

Can someone help me?

[godzilla]

certipy-ad auth -pfx cheng.pfx -domain manager.htb
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: cheng@manager.htb
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

any one help me why its...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Scraping | Contact us via https://breachforums.rs/misc.php?action=help&hid=27 if you feel this is incorrect.

[Kachun_QLJG]

certipy-ad auth -pfx cheng.pfx -domain manager.htb
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*]Using principal: cheng@manager.htb
[*]Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)

any one help me why its...

Just pwned the machine right now. I had the same problem as you guys, but I found this link: Kerberoast - HackTricks . The link says that time synchronization caused the problem, just synchronize the time by sudo rdate -n manager.htb.