Pass the Ticket (PtT) from Linux

June 11, 2024

ssh david@inlanefreight.htb@10.129.234.123 -p 2222

Use this to get to root

As we can see the julio user is domain user and can attempt to get access to the domain shared folder via julio

Now we can impersonate the user via export command

As you can see we have julio as default principal

You have to be fast to authenticate to smbclient since the ticket is just temporary

You gotta find the file containing the credentials of Linux machines in Active Directory.

Or we could just use the keytab since we have permission so that we can impersonate the user linux01

Now for the next not required task

First we have to ssh to the machine

Get the linikatz.sh

This tool will find for kerberos tickets in the system

I made a visual graph about the network

Then for the next one we can try the chisel which is port forwarding tool

First we have to set the IPs in our attacker machine

But first we have to get the Julio's ccache file from the linux machine

`

Then we will change the permission so that we can copy it using scp

Then we are going to export the ccache file so that we can connect to the dc01 as julio

Then just use proxychains4 from the home directory to connect to dc01

PreviousPass the Ticket (PtT) from WindowsNextProtected Files

Last updated