PORT STATE SERVICE 53/tcp open domain 88/tcp open kerberos-sec 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 2049/tcp open nfs 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 4222/tcp open vrml-multi-use 5985/tcp open wsman 9389/tcp open adws 47001/tcp open winrm 49664/tcp open unknown 49665/tcp open unknown 49666/tcp open unknown 49667/tcp open unknown 49668/tcp open unknown 49873/tcp open unknown 56390/tcp open unknown 56391/tcp open unknown 56406/tcp open unknown 56414/tcp open unknown 56454/tcp open unknown 56457/tcp open unknown 60169/tcp open unknown
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-07-31 09:44:59Z) 111/tcp open rpcbind? 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE | Not valid before: 2025-07-04T19:58:41 |_Not valid after: 2105-07-04T19:58:41 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE | Not valid before: 2025-07-04T19:58:41 |_Not valid after: 2105-07-04T19:58:41 2049/tcp open mountd 1-3 (RPC #100005) 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE | Not valid before: 2025-07-04T19:58:41 |_Not valid after: 2105-07-04T19:58:41 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: mirage.htb0., Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc01.mirage.htb, DNS:mirage.htb, DNS:MIRAGE | Not valid before: 2025-07-04T19:58:41 |_Not valid after: 2105-07-04T19:58:41 |_ssl-date: TLS randomness does not represent time 4222/tcp open vrml-multi-use? | fingerprint-strings: | GenericLines: | INFO {"server_id":"NDRUPXNXNO2OFYD243VV353VBO5W233PASYTDT5SPNXHMPDFZ366EZE7","server_name":"NDRUPXNXNO2OFYD243VV353VBO5W233PASYTDT5SPNXHMPDFZ366EZE7","version":"2.11.3","proto":1,"git_commit":"a82cfda","go":"go1.24.2","host":"0.0.0.0","port":4222,"headers":true,"auth_required":true,"max_payload":1048576,"jetstream":true,"client_id":17,"client_ip":"10.10.16.186","xkey":"XDJ3OJKCK3LE5PSXDZJKGTKLKZW53OIYNLUYSJRG7NODZ3LSLVCHP3ZH"} | -ERR 'Authorization Violation'
...[snip]...
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49873/tcp open msrpc Microsoft Windows RPC 56390/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 56391/tcp open msrpc Microsoft Windows RPC 56406/tcp open msrpc Microsoft Windows RPC 56414/tcp open msrpc Microsoft Windows RPC 56454/tcp open msrpc Microsoft Windows RPC 56457/tcp open msrpc Microsoft Windows RPC 60169/tcp open msrpc Microsoft Windows RPC 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
...[snip]...
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
通过 query session 命令可知 mark.bbond 用户 session ID 为 1，利用 RemotePotato0.exe 尝试获取 mark.bbond 用户 Net NTLM V2，具体命令可查看工具说明。
执行过程中工具会发生错误，这是由于在 Windows Server 上的 COM 激活请求不会走网络连接本地地址（127.0.0.1 / localhost），而是优先使用内核级的本地调用机制（IPC / Named Pipe），这导致无法通过监听本地端口劫持 COM 请求。所以需要在 kali 使用 socat 将通过 kali 135 端口流量转发至靶机 9999 端口，其中 9999 端口是自定义的。由于当前仅获取 Net NTLM V2 所以不需要在 kali 中继 RogueOxidResolver 流量。
1 2 3 4 5 6
# kali sudo socat -v TCP-LISTEN:135,fork,reuseaddr TCP:10.129.232.163:9999
