# Check all open TCP sudo rustscan 10.10.11.42 -r 1-65535 --ulimit 5000 # Nmap scan with script on open TCP port sudo nmap 10.10.11.42 -sCV -Pn -sT -p 21,53,88,135,139,389,445,464,593,636,5985,9389,47001,49470,49665,49664,49666,49667,49668,64855,64860,64867,64880,64912 # Nmap scan vulnerability sudo nmap -sT -p 21,53,88,135,139,389,445,464,593,636,5985,9389,47001,49470,49665,49664,49666,49667,49668,64855,64860,64867,64880,64912 --script=vuln -O -Pn 10.10.11.42 # Nmap scan with UDP port sudo nmap -sU --top-ports 20 -Pn 10.10.11.42
PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-03-19 21:17:07Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49470/tcp open msrpc Microsoft Windows RPC 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 64855/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 64860/tcp open msrpc Microsoft Windows RPC 64867/tcp open msrpc Microsoft Windows RPC 64880/tcp open msrpc Microsoft Windows RPC 64912/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Upon checking the AD info, found some interesting user. Olivia user Outbound Object Control - First Degree Object Control
Outbound Object Control - Transitive Object Control show more info
Olivia user has the GenericAll permission to Michael user. Michael user able to ForceChangePassword to Benjamin user.
Upon checking “Find all the Edges that any UNPRIVILEGED user (based on the admincount:False) has against all the nodes” which exposed Emily user has the GenericWrite permission to Ethan
For the First Degree Object Control of Ethan shows that he had the DCSync to DC
OLIVIA to BENJAMIN
Lets abuse the GenericAll to obtained Michael user using BloodyAD
Upon understanding of the Share Moderators, it is the FTP service groups. Here I will use the benjamin credentials to access
1 2
ftp benjamin@10.10.11.42 Password: ichliebedich
Inside FTP folder, there is a Backup.psafe3 file, Lets download and check how we can work on it.
1 2 3
ftp> binary ftp> passive ftp> get Backup.psafe3
Crack the psafe3 master with John
Upon OSINT, found ‘Different programs may use files with the PSAFE3 file extension for different purposes, so unless you are sure which format your PSAFE3 file is, you may need to try a few different programs.’
From the bloodhound, we know that Emily user had the GenericWrite permission to the Ethan user. Here we can try the Targeted Kerberoast tools to obtian a crackable hash
