Nagoya [soon]
Information Gathering
NMAP - Ports and Services
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Nagoya Industries - Nagoya
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-02-11 16:14:25Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ldapssl?
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com0., Site: Default-First-Site-Name)
3269/tcp open globalcatLDAPssl?
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-02-11T16:16:13+00:00; -2h35m20s from scanner time.
| ssl-cert: Subject: commonName=nagoya.nagoya-industries.com
| Not valid before: 2025-02-10T16:09:22
|_Not valid after: 2025-08-12T16:09:22
| rdp-ntlm-info:
| Target_Name: NAGOYA-IND
| NetBIOS_Domain_Name: NAGOYA-IND
| NetBIOS_Computer_Name: NAGOYA
| DNS_Domain_Name: nagoya-industries.com
| DNS_Computer_Name: nagoya.nagoya-industries.com
| DNS_Tree_Name: nagoya-industries.com
| Product_Version: 10.0.17763
|_ System_Time: 2025-02-11T16:15:29+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49668/tcp open msrpc Microsoft Windows RPC
49676/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49678/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49693/tcp open msrpc Microsoft Windows RPC
49708/tcp open msrpc Microsoft Windows RPC
49802/tcp open msrpc Microsoft Windows RPC
Service Info: Host: NAGOYA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2025-02-11T16:15:29
|_ start_date: N/A
|_clock-skew: mean: -2h35m23s, deviation: 2s, median: -2h35m25s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 125.21 seconds
Initial Access
80 - WEB
Manual Inspection
terdapat list team, isinya first name dan last name. mari kita save sebagai wordlist user enum, as-reproast dengan format
Kerbrute
AS-REPROAST
Brute Force
karena udah mentok akhirnya pake brute force
ada beberapa skenario:
di footer ada tahun 2023
nama perusahaannya Nagoya
mesinnya realise tanggal 16 juni 2023
musim realisenya adalah summer
untuk membuat wordlistnya bisa menggunakan wordlist generator
Priv Esc
Bloodhound
fiona.clark merupakan member dari employees group
Employees group memiliki degre object control terhadap 4 user dengan genericAll privilege
BETHAN.WEBSTER
IAIN.WHITE
JOANNA.WOOD
SVC_HELPDESK
selain itu terdapat 2 user dengan service principal
SVC_MSSQL
SVC_HELPDESK
selanjutnya saya akan melakukan kerberoasting
Sebetulnya bisa saja takeover setiap akun, karena dengan privilege GenericAll bisa melakukan forceChange password user, tetapi sangat disayangkan jika melakukan forceChangepassword yang dimana kita tidak bisa memperluas foodhold dengan spray password
selanjutnya crack dengan hashcat
creds : svc_mssql:Service1
karena ga bisa ngapa-ngapain jidi terpaksa change password user, disini user yang akan di change password adalah joanna.wood katena joana member dari Helpdesk group yg punya genericAll priv ke christopher.lewis yang dimana dia punya privilege CanPSRemote ke Nagoya.nagoya-industries.com (intinya biar bisa rce)
selanjutnya evil-winrm
Last updated