[maggi]

There's a 7z file in Recycle Bin that contains the password for M.Schoolbus. The user has WriteGPLInk perms over Class_FRIZZ and DOMAIN CONTROLLERS. Haven't looked into exploitation yet

I just got something out there I think next steop is paswword spray?
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("STRING"))

[cavour13]

got problems with the gssapi too .. i m trying to cofigure krbr5.conf

[realms]
FRIZZ.HTB = {
kdc = frizzdc.frizz.htb
admin_server = frizzdc.frizz.htb
default_domain = frizz.htb
}

[potato_moose]

got problems with the gssapi too .. i m trying to cofigure krbr5.conf

[realms]
  FRIZZ.HTB = {
    kdc = frizzdc.frizz.htb
    admin_server = frizzdc.frizz.htb
    default_domain = frizz.htb
  }

take this:

[libdefaults]
    default_realm = FRIZZ.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = false

[realms]
    FRIZZ.HTB = {
        kdc = frizzdc.frizz.htb
        admin_server = frizzdc.frizz.htb
    }

[domain_realm]
    .frizz.htb = FRIZZ.HTB
    frizz.htb = FRIZZ.HTB

[cavour13]

exactly what i did before with no luck.. i m sure to got the ccache and command is evil-winrm -i ip -r frizz.htb -k ccache
that's couse i omissed all the other parts

[potato_moose]

exactly what i did before with no luck.. i m sure to got the ccache and command is evil-winrm -i ip -r frizz.htb -k ccache
that's couse i omissed all the other parts

R U using release arena?
I didn't cope with public machines (tried several of them), then switched to RA. Works well.

[cavour13]

Yeah i m on release arena 10.129 ones

[nguyenhobbes2002]

krb5.conf

[libdefaults]
default_realm = FRIZZ.HTB
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
proxiable = true

[realms]
FRIZZ.HTB = {
kdc = frizzdc.frizz.htb
admin_server = frizzdc.frizz.htb
default_domain = frizz.htb
}

[domain_realm]
.frizz.htb = FRIZZ.HTB
frizz.htb = FRIZZ.HTB

sudo ntpdate 10.10.11.60

getTGT.py frizz.htb/f.frizzle

export KRB5CCNAME=f.frizzle.ccache

ssh f.frizzle@10.10.11.60

This work for me

[potato_moose]

I did:

faketime "$(ntpdate -q frizz.htb | awk '{print $1" "$2}')" zsh

impacket-getTGT frizz.htb/m.schoolbus:'PASSWORD' -dc-ip frizzdc.frizz.htb

export KRB5CCNAME=m.schoolbus.ccache

evil-winrm -i frizzdc.frizz.htb -r frizz.htb -k m.schoolbus.ccache

[cavour13]

in my case no i tried also you exact command LOL
i generated week f.frizzle.ccache

exported then ssh says about gssapi permission denied and also with winrm

i will reboot the istacen i m 100% certain it's a server fault

[0xbeef]

in my case no i tried also you exact command LOL
i generated week f.frizzle.ccache

exported then ssh says about gssapi permission denied and also with winrm

i will reboot the istacen i m 100% certain it's a server fault

Did you uodate your time to match the server ? 

sudo ntpdate -s SERVER_IP

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.