[defxsec]

[quote="cosa7" pid='524575' dateline='1711939597']
[quote="defxsec" pid='524198' dateline='1711924077']
Esto también podría ayudar a automatizar todo el proceso.
https://github.com/saoGITo/HTB_Mist
[/cita]

¿Lo probaste? ¿Se que se trata?
[/cita]

Si

[godzilla]

i have Brandon user shell can anyone confirm that which user have  user.txt flag and whats next step ?

[DwightSchrute]

stuck within Brandon shell as well...machine is a brainfu..

[KillerWhale]

winpeas does not give anything useful

[godzilla]

Any hint for shell as Brandon ?

Even then, from brandon, it's really faaar away from user, let along root.

only you  will help here  i have Brandon shell what next we do ?

[thing7]

Let me re-cap this box =
after getting the admin hash, log in to the machine
upload a zip with an exe and a webshell,
then run the exe through the webshell (very confusing to do this)
Then, after that, you make another payload to get another shell (Brandon), and then what?
which user is the user that has the flag.txt
Let me know if Im corrected with the steps

[xxxbfacc]

Ok. Someone posted and deleted a comment this morning related to Webdav->LDAP relaying using DavRelayUp.
I've managed to modify that a bit, and now have it providing an interactive ldap session authenticated to DC as MS01$, where I can try to update keys. Seems to work, for example I can see that an update I made to msDS-AllowedToActOnBehalfOfOtherIdentity to MS01$ is reflected when I access it from impacket-rbcd -action read from linux.

Anyone have thoughts on an exploitation path from there?

or am I just wasting more of my time...

[cavour13]

anyone tried to steal ntlm with mitm in samba service?

[Xavipolero]

1711994396[/url]']
Ok. Someone posted and deleted a comment this morning related to Webdav->LDAP relaying using DavRelayUp.
I've managed to modify that a bit, and now have it providing an interactive ldap session authenticated to DC as MS01$, where I can try to update keys. Seems to work, for example I can see that an update I made to msDS-AllowedToActOnBehalfOfOtherIdentity to MS01$ is reflected when I access it from impacket-rbcd -action read from linux.

Anyone have thoughts on an exploitation path from there?

or am I just wasting more of my time...

What modifications did you make? You should be able to add shadow credentials to ms01 

Some people seem to have had luck with Impacket-ntlmrelayx

[xxxbfacc]

modified the GoRelayServer.dll, webdav_server.go file.

in my current version I loop prompting for
targetDN, key and value instead of the original

But basically:

modify := ldap.NewModifyRequest(c.TargetDN, nil)
modify.Replace("msDS-AllowedToActOnBehalfOfOtherIdentity", []string{string(c.RBCDSecurityDescriptor[:])})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)

I've tried hardcoded like:

modify := ldap.NewModifyRequest("CN=MS01,DC=mist,DC=htb", nil)
modify.Add("msDS-KeyCredentialLink", []string{"key credential string from pywhisker"})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)

but I'm getting insufficient access rights error.

1711994396[/url]']
Ok. Someone posted and deleted a comment this morning related to Webdav->LDAP relaying using DavRelayUp.
I've managed to modify that a bit, and now have it providing an interactive ldap session authenticated to DC as MS01$, where I can try to update keys. Seems to work, for example I can see that an update I made to msDS-AllowedToActOnBehalfOfOtherIdentity to MS01$ is reflected when I access it from impacket-rbcd -action read from linux.

Anyone have thoughts on an exploitation path from there?

or am I just wasting more of my time...

What modifications did you make? You should be able to add shadow credentials to ms01 

Some people seem to have had luck with Impacket-ntlmrelayx