PrivEsc
We can open the .ldb file
tdbdump ./var/lib/sss/db/cache_windcorp.htb.ldb
We get the hash for user Ray.Duncan.
We get our first pair of credentials for the AD. ray.duncan:pantera
We can check the current creds stored for the AD.
With ray.duncan users password, we can request it.
Now, we can run the command ksu to check if we can use his ticket to be root on the linux VM.
The reason why it works and we can ssh back in is because this file permits the user ray.duncan:
I still don't know the IP of the DC but we can see the FQDN from /etc/krb5.conf and it is hope.windcorp.htb.
So 192.168.0.2 is our DC.
Pivoting and Tunneling
Anyways, I want to use this linux VM as our pivot host to the 192.168.0.0/24 network. Simple steps:
On pivot host:
Our host:
Back on our machine we need to add the route:
Failed. For some reason it wont work. First, I need to create persistence. I added the public key into .ssh/authorized_key.
I'll try the old proxychains way with ssh -D. So while in SSH session we do ~C to drop into ssh> and then type -D1080.
We do have the credentials to request TGT. Lets create the tunnel and use kinit again to request a ticket to our attack machine. But first we need to configure the /etc/krb5.conf file on our machine. I updated it to:
Last updated