[spamdegratis5]

How did you manage to get the ntlmrelay to work ? The requests are made with SVC_ACC but how to steal his hash ?

I tried ntlmrelayx DCIP but as SVC_ACC is not admin it is not working ?

Maybe ntlmrelayx is not the way ?

Yep, it may be a rabbit hole. A user from discord told me that he didn't get svc_acc, only victor.r is required, something similar to mist box. I'm still thinking on how to approach it.

[nothing0112358]

How did you manage to get the ntlmrelay to work ? The requests are made with SVC_ACC but how to steal his hash ?

I tried ntlmrelayx DCIP but as SVC_ACC is not admin it is not working ?

Maybe ntlmrelayx is not the way ?

Yep, it may be a rabbit hole. A user from discord told me that he didn't get svc_acc, only victor.r is required, something similar to mist box. I'm still thinking on how to approach it.

user.txt is on the web machine. We need to exploit the web at port 5000. But I don't know how... Tried some redirection with /status but epic fail

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[potato_moose]

BTW, we can log in to drip.htb with the user taylor.b.adm and do 'sudo su'

[nothing0112358]

BTW, we can log in to drip.htb with the user taylor.b.adm and do 'sudo su'

Did you root the box ? How did you get taylor.b.adm ? Did you do the relay to pass from victor.r to Web-01 ? something is weird as signing is False on web-01 but True on Dc-01 encoraging us to do relay ...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[spamdegratis5]

BTW, we can log in to drip.htb with the user taylor.b.adm and do 'sudo su'

Did you root the box ? How did you get taylor.b.adm ? Did you do the relay to pass from victor.r to Web-01 ? something is weird as signing is False on web-01 but True on Dc-01 encoraging us to do relay ...

They've got it by copypaste. Someone said it was by bruteforcing but who knows. I don't think that's the intended way.

[4yhg5y72jffg820j3f]

Faster way from the drip host:

./kerbrute_linux_amd64 bruteuser -d darkcorp.htb --dc 172.16.20.1 rockyou.txt taylor.b.adm

Upload binaries and rockyou using a python web server.

[jonklem]

I see people sharing the way to login via hash to get user and root pass. I was tracking all the way to getting elbeford's password.

I usually struggle with windows environments but this one was particularly heinous because it was my first time messing around with ligolo.

Is anyone going to release the steps they took? Was I right that it involved using the IIS server to get a hash and cracking that to get a foothold into the windows environment?

I see people charging credits for credentials but honestly the steps are more valuable.

[0xbeef]

I see people sharing the way to login via hash to get user and root pass.  I was tracking all the way to getting elbeford's password. 

I usually struggle with windows environments but this one was particularly heinous because it was my first time messing around with ligolo.

Is anyone going to release the steps they took?  Was I right that it involved using the IIS server to get a hash and cracking that to get a foothold into the windows environment?

I see people charging credits for credentials but honestly the steps are more valuable.

I think this is the intended path to play with the status, but I think I am not able to get a shell or don't understand the attack surface well

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[akorshikai]

I see people sharing the way to login via hash to get user and root pass.  I was tracking all the way to getting elbeford's password. 

I usually struggle with windows environments but this one was particularly heinous because it was my first time messing around with ligolo.

Is anyone going to release the steps they took?  Was I right that it involved using the IIS server to get a hash and cracking that to get a foothold into the windows environment?

I see people charging credits for credentials but honestly the steps are more valuable.

I usually prefer Ligolo, but in this case for whatever reason (likely user error) I ended up using sshuttle for the pivot. Little bit of a latency issue when running evil-winrm through the pivot - not sure if anyone else has experienced it. Good box, nonetheless.

[fr34cker]

*Evil-WinRM* PS C:\Users\taylor.b.adm\Desktop> ./SharpGPOAbuse.exe --AddUserTask --TaskName "New Task" --Author darkcorp.htb\Administrator --Command "cmd.exe" --Arguments "/c whoami > C:\task.txt" --GPOName "SecurityUpdates"
The term './SharpGPOAbuse.exe' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ ./SharpGPOAbuse.exe --AddUserTask --TaskName "New Task" --Author dark ...
+ ~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (./SharpGPOAbuse.exe:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException




any hint?