[chillywilly]

yea go through the posts and youll find the answer.

Any hint to get Brandon.Keywarp shell?

---

yea go through the posts and youll find the answer.

Any hint to get Brandon.Keywarp shell?

[KillerWhale]

So now what are you guys going to do next? I don't know if the brandon shell is the right path cause we have been stuck on this too long.

[DoesntMatter123456]

MS01$ hash. With this, you can get a TGT -> ST and then dump the hashes of MS01, get Admin hash, login to MS01 and get user flag.

after that what can we do

---

any hint ? for roooot privs

---

any idea to bypass av to download winpeas ??

Have you tried in C:\xampp\htdocs\docs directory ?

[asdfmonster]

Winpeas didnt help any as far as I can tell.

[KillerWhale]

Winpeas didnt help any as far as I can tell.

ok but i need to know how we specify which directory bypass AV

I downloaded winpeas.bat and it worked. But winpeas does not give anything useful.

[DoesntMatter123456]

MS01$ hash. With this, you can get a TGT -> ST and then dump the hashes of MS01, get Admin hash, login to MS01 and get user flag.

after that what can we do

---

any hint ? for roooot privs

---

any idea to bypass av to download winpeas ??

Have you tried in C:\xampp\htdocs\docs directory ?

great it worked .. how can we know the directory which bypass it ?

It was just a random observation that update.php file in docs directory never got cleaned/deleted. So tried it and it worked

[asdfmonster]

Yeah I just noticed my module getting removed so tried uploading shells a folder up, then another...

[jsvensson]

Instead of giving  $MS01 hash could someone give a hint how to get it from Brandon

[xawahi6033]

modified the GoRelayServer.dll, webdav_server.go file.

in my current version I loop prompting for
targetDN, key and value instead of the original

But basically:

modify := ldap.NewModifyRequest(c.TargetDN, nil)
modify.Replace("msDS-AllowedToActOnBehalfOfOtherIdentity", []string{string(c.RBCDSecurityDescriptor[:])})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)

I've tried hardcoded like:

modify := ldap.NewModifyRequest("CN=MS01,DC=mist,DC=htb", nil)
modify.Add("msDS-KeyCredentialLink", []string{"key credential string from pywhisker"})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)

but I'm getting insufficient access rights error.

1711994396[/url]']
Ok. Someone posted and deleted a comment this morning related to Webdav->LDAP relaying using DavRelayUp.
I've managed to modify that a bit, and now have it providing an interactive ldap session authenticated to DC as MS01$, where I can try to update keys. Seems to work, for example I can see that an update I made to msDS-AllowedToActOnBehalfOfOtherIdentity to MS01$ is reflected when I access it from impacket-rbcd -action read from linux.

Anyone have thoughts on an exploitation path from there?

or am I just wasting more of my time...

What modifications did you make? You should be able to add shadow credentials to ms01 

Some people seem to have had luck with Impacket-ntlmrelayx

try doing the same thing but with impacket-ntlmrelayx

[xawahi6033]

Fine, I got so many requests on what to do after getting admin on MS01. 

Look into all the folders of Sharon. 

U'll find a keepass file and an image which contains half of the password.

So for use keepass2john to get the hash of kbdx and then use the hashcat cmd , I have hidden there to crack the master pass to login into keepass to get the pass of sharon. 

If u guys directly want the admin hash, DM me. It won't be free


I can give it for 5$

which wordlist did you use to crack this hash?