https://ioctl.lol/tags/kerberoasting/Recent content in Kerberoasting on ioctlHugoenioctlThu, 04 Apr 2024 00:00:00 +0000https://ioctl.lol/ctf/offsec/access/Thu, 04 Apr 2024 00:00:00 +0000https://ioctl.lol/ctf/offsec/access/<div class="box-info"> <table> <tr><th colspan="2">ターゲット // Access</th></tr> <tr><td>Platform</td><td>OffSec Proving Grounds</td></tr> <tr><td>OS</td><td>Windows</td></tr> <tr><td>Difficulty</td><td>Medium</td></tr> <tr><td>IP</td><td><code>192.168.x.x</code></td></tr> </table> </div> <style> .box-info table { max-width: 400px; margin: 1.5em 0; } .box-info th { text-align: center; font-size: 1.1em; letter-spacing: 0.08em; } </style> <hr> <h2 id="enumeration">Enumeration</h2> <h3 id="nmap">Nmap</h3> <details class="collapse-section"> <summary>▶ Nmap output</summary> <div class="collapse-content"> <pre tabindex="0"><code>PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Apache httpd 2.4.48 (XAMPP, PHP 8.0.7) 88/tcp open kerberos-sec Microsoft Windows Kerberos 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn 389/tcp open ldap AD LDAP (Domain: access.offsec) 445/tcp open microsoft-ds 464/tcp open kpasswd5 3268/tcp open ldap AD Global Catalog 5985/tcp open http WinRM (Microsoft HTTPAPI 2.0) 9389/tcp open mc-nmf .NET Message Framing (ADWS) </code></pre> </div> </details> <style> .collapse-section { border: 1px dashed var(--accent-alpha-20); padding: 0.5em 1em; margin: 1em 0; cursor: pointer; } .collapse-section[open] summary { margin-bottom: 0.8em; border-bottom: 1px dashed var(--accent-alpha-20); padding-bottom: 0.5em; } .collapse-section summary { font-weight: 700; color: var(--accent); outline: none; } .collapse-content { padding-top: 0.5em; } </style> <p>This is a domain controller (Kerberos, LDAP, DNS, ADWS) that also happens to run a XAMPP/Apache stack on port 80 — the classic &ldquo;web app pinned to a DC&rdquo; setup, which usually means the web foothold and the AD kill chain are the same box.</p>