[StingEm]

Hey all, I've managed to get foothold and user flag, but I'm stuck in the privesc part using the certipy-ad,

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*]Targeting user 'ca_svc'
[*]Generating certificate
[*]Certificate generated
[*]Generating Key Credential
[*]Key Credential generated with DeviceID '6ea78542-00b7-1ec4-54d0-7c757188d0e5'
[*]Adding Key Credential with device ID '6ea78542-00b7-1ec4-54d0-7c757188d0e5' to the Key Credentials for 'ca_svc'
[*]Successfully added Key Credential with device ID '6ea78542-00b7-1ec4-54d0-7c757188d0e5' to the Key Credentials for 'ca_svc'
[*]Authenticating as 'ca_svc' with the certificate
[*]Using principal: ca_svc@sequel.htb
[*]Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
[*]Restoring the old Key Credentials for 'ca_svc'
[*]Successfully restored the old Key Credentials for 'ca_svc'
[*]NT hash for 'ca_svc': None

I'm pretty sure the NT hash is not supposed to be None

I don't know what the hell to do anymore.

A little nudge peeps. howpaws:

[*]Can you paste the command you used? Judging by the error message, you likely have a clock skew error that can be corrected using faketime or rdate.

Agreed 100% - Please post command line - but it looks like it may be the issue.

*** Windows Domain Tip ****

When you know you are working against a Domain or DC 1st Thing run:

sudo rdate -n <Machine IP>

or

sudo ntpdate -u <Machine IP>

This will sync the time of the Victim Domain to your VM / Attack Machine - you will ALWAYS be glad you did - alot of tools will have issue if clock times are out of sync.

** I just saw KochiyaS post - which smarty reminded when done how to reset your system clock - Some people may go crazy if they dont - lol

[Aloha_SnackBar]

Hey all, I've managed to get foothold and user flag, but I'm stuck in the privesc part using the certipy-ad,

Certipy v4.8.2 - by Oliver Lyak (ly4k)

[*]Targeting user 'ca_svc'
[*]Generating certificate
[*]Certificate generated
[*]Generating Key Credential
[*]Key Credential generated with DeviceID '6ea78542-00b7-1ec4-54d0-7c757188d0e5'
[*]Adding Key Credential with device ID '6ea78542-00b7-1ec4-54d0-7c757188d0e5' to the Key Credentials for 'ca_svc'
[*]Successfully added Key Credential with device ID '6ea78542-00b7-1ec4-54d0-7c757188d0e5' to the Key Credentials for 'ca_svc'
[*]Authenticating as 'ca_svc' with the certificate
[*]Using principal: ca_svc@sequel.htb
[*]Trying to get TGT...
[-] Got error while trying to request TGT: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)
[*]Restoring the old Key Credentials for 'ca_svc'
[*]Successfully restored the old Key Credentials for 'ca_svc'
[*]NT hash for 'ca_svc': None

I'm pretty sure the NT hash is not supposed to be None

I don't know what the hell to do anymore.

A little nudge peeps. howpaws:

[*]Can you paste the command you used? Judging by the error message, you likely have a clock skew error that can be corrected using faketime or rdate.

Agreed 100% - Please post command line - but it looks like it may be the issue.

*** Windows Domain Tip ****

When you know you are working against a Domain or DC 1st Thing run:

sudo rdate -n <Machine IP>

or

sudo ntpdate -u <Machine IP>

This will sync the time of the Victim Domain to your VM / Attack Machine - you will ALWAYS be glad you did - alot of tools will have issue if clock times are out of sync.

** I just saw KochiyaS  post - which smarty reminded when done how to reset your system clock - Some people may go crazy if they dont - lol

Appreciate the help people, that did it. Thank you so much.