Shadowscript windows#

Port 135,589: - Windows RPC & RPC over HTTP 1.0Дomain name: BLACKFIELD.local Port 445 - SMB enumerationДЇirst, letвЂ™s use smbclient to enumerate available SMB shares:.Port 88: kerberos-sec - Active Directory authentication protocol.Nmap done: 1 IP address (1 host up ) scanned in 193.63 secondsД«ased on the scan results we found the following services running on respective ports: Service Info: Host: DC01 OS: Windows CPE: cpe:/o:microsoft:windows If you know the service/version, please submit the following fingerprint at : |_http-server-header: Microsoft-HTTPAPI/2.0ДЎ service unrecognized despite returning data. в†’ nmap -sC -sV -p135,593,445,53,3268,88,389,5985 10.10.10.192ДЁ8/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 16:09:49Z )ДЈ89/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name )ДҐ93/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0ДЈ268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local0., Site: Default-First-Site-Name )ДҐ985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP ) WeвЂ™ll begin with masscan & nmap to discover open ports and there consecutive services : For elevating privileges to Administrator weвЂ™ll abuse Backup privileges of a Backup Operator to grab a copy of NTDS.dit and SYSTEM hive and retrieve Administrator hash. Using the discovered hash we get an WinRM Shell on the box. Further with the newly owned account we get access to an SMB share containing data retrieved during audit and forensic investigation, where we find a memory capture of LSASS process and dump the hashes from it using pypykatz.

Shadowscript password#

With the new user creds weвЂ™ll use BloodHound to discover an special privilege where we can forcefully change password for another account over RPC.

Shadowscript crack#

Later we use AS-REP roasting technique to find and crack the hash of an account.

We validate them using kerbrute - a tool which send TGT requests with no pre-authentication property to validate user accounts. Blackfield was a exceptional Windows box centralized on Active Directory environment, initial SMB enumeration reveals potential usernames of Domain accounts.