search

AD Enumeration

From the nmap scan we see there are two DCs.

zsm.local DC = 192.168.210.10

internal.zsm.local DC = 192.168.210.16

I tried running credentials from previous domain but none worked.

Here is using marcus's credentials. marcus:!QAZ2wsx found from Zabbix host.

SMB         192.168.210.14  445    ZPH-SVRADFS1     [+] zsm.local\marcus:!QAZ2wsx 
SMB         192.168.210.16  445    ZPH-SVRCDC01     [-] internal.zsm.local\marcus:!QAZ2wsx STATUS_LOGON_FAILURE 
SMB         192.168.210.11  445    ZPH-SVRMGMT1     [+] zsm.local\marcus:!QAZ2wsx 
SMB         192.168.210.10  445    ZPH-SVRDC01      [+] zsm.local\marcus:!QAZ2wsx 
SMB         192.168.210.15  445    ZPH-SVRSQL01     [+] zsm.local\marcus:!QAZ2wsx 
SMB         192.168.210.12  445    ZPH-SVRCA01      [+] zsm.local\marcus:!QAZ2wsx

hashtag
.Conf FIle

cat /etc/krb5.conf
[libdefaults]
    default_realm = ZSM.LOCAL  # Change this to the main domain you are working with
    dns_lookup_realm = false
    dns_lookup_kdc = true

[realms]
    PAINTERS.HTB = {
        kdc = dc.painters.htb
        admin_server = dc.painters.htb
    }

    ZSM.LOCAL = {
        kdc = dc.zsm.local
        admin_server = dc.zsm.local
    }

    INTERNAL.ZSM.LOCAL = {
        kdc = dc.internal.zsm.local
        admin_server = dc.internal.zsm.local
    }

[domain_realm]
    .painters.htb = PAINTERS.HTB
    painters.htb = PAINTERS.HTB
    .zsm.local = ZSM.LOCAL
    zsm.local = ZSM.LOCAL
    .internal.zsm.local = INTERNAL.ZSM.LOCAL
    internal.zsm.local = INTERNAL.ZSM.LOCAL

hashtag
Bloodhound

Ippsec's videoarrow-up-right helped a lot!

Klist shows that we have it:

Recovering NT hash

Testing

Lets confirm if marcus was indeed added to the General Management group.

Indeed, memberOf: CN=General Management,CN=Builtin,DC=zsm,DC=local.

Now Marcus should be able to change password for the user jamie.

Lets confirm

Next

Confirm it

PreviousNmapNextZEPHYR-ZABBIX

Last updated