HTB-Certified
Box Info OS Windows Difficulty Medium As is common in Windows pentests, you will start the Certified box with credentials for the following account: Username: judith.mader Password: judith09 Nmap ┌──(root㉿kali)-[/home/kali/Certified] └─# nmap -sSCV -Pn -p- Certified.htb Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-12-06 20:00 CST Stats: 0:02:15 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan SYN Stealth Scan Timing: About 90.13% done; ETC: 20:02 (0:00:15 remaining) Stats: 0:03:16 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 61.90% done; ETC: 20:04 (0:00:25 remaining) Stats: 0:03:16 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 61.90% done; ETC: 20:04 (0:00:25 remaining) Nmap scan report for Certified.htb (10.10.11.41) Host is up (0.083s latency). Not shown: 65514 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2024-12-06 18:49:00Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.certified.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.certified.htb | Not valid before: 2024-05-13T15:49:36 |_Not valid after: 2025-05-13T15:49:36 |_ssl-date: 2024-12-06T18:50:32+00:00; +6h45m59s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.certified.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.certified.htb | Not valid before: 2024-05-13T15:49:36 |_Not valid after: 2025-05-13T15:49:36 |_ssl-date: 2024-12-06T18:50:32+00:00; +6h45m59s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name) |_ssl-date: 2024-12-06T18:50:32+00:00; +6h45m59s from scanner time. | ssl-cert: Subject: commonName=DC01.certified.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.certified.htb | Not valid before: 2024-05-13T15:49:36 |_Not valid after: 2025-05-13T15:49:36 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: certified.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.certified.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC01.certified.htb | Not valid before: 2024-05-13T15:49:36 |_Not valid after: 2025-05-13T15:49:36 |_ssl-date: 2024-12-06T18:50:32+00:00; +6h45m59s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49666/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49674/tcp open msrpc Microsoft Windows RPC 49683/tcp open msrpc Microsoft Windows RPC 49715/tcp open msrpc Microsoft Windows RPC 49737/tcp open msrpc Microsoft Windows RPC 49772/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2024-12-06T18:49:56 |_ start_date: N/A |_clock-skew: mean: 6h45m58s, deviation: 0s, median: 6h45m58s | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 254.91 seconds GetAllUserName ┌──(root㉿kali)-[~kali/Certified] └─# crackmapexec smb certified.htb -u "judith.mader" -p "judith09" --rid-brute | grep SidTypeUser SMB Certified.htb 445 DC01 500: CERTIFIED\Administrator (SidTypeUser) SMB Certified.htb 445 DC01 501: CERTIFIED\Guest (SidTypeUser) SMB Certified.htb 445 DC01 502: CERTIFIED\krbtgt (SidTypeUser) SMB Certified.htb 445 DC01 1000: CERTIFIED\DC01$ (SidTypeUser) SMB Certified.htb 445 DC01 1103: CERTIFIED\judith.mader (SidTypeUser) SMB Certified.htb 445 DC01 1105: CERTIFIED\management_svc(SidTypeUser) SMB Certified.htb 445 DC01 1106: CERTIFIED\ca_operator (SidTypeUser) SMB Certified.htb 445 DC01 1601: CERTIFIED\alexander.huges (SidTypeUser) SMB Certified.htb 445 DC01 1602: CERTIFIED\harry.wilson (SidTypeUser) SMB Certified.htb 445 DC01 1603: CERTIFIED\gregory.cameron (SidTypeUser) Bloodhound ┌──(root㉿kali)-[~kali/Certified] └─# bloodhound-python -u judith.mader -p 'judith09' -c All -d certified.htb -ns 10.10.11.41 INFO: Found AD domain: certified.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) INFO: Connecting to LDAP server: dc01.certified.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc01.certified.htb INFO: Found 10 users INFO: Found 53 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: DC01.certified.htb INFO: Done in 00M 17S 导入到bloodhoundGUI里面进行分析 ...