Posts tagged with

NTLMv2

HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

S SH∆FIQ∆IM∆N
February 9, 2025
1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash
HackTheBox - Responder Writeup

Responder is a free starting-point machine. This machine teaches us how to use the responder utility to steal the password hash and crack it with hashcat. On top of that, this machine is also vulnerable to local file inclusion. Which we can exploit through log poisoning to gain remote code execution and get the reverse shell.

S SH∆FIQ∆IM∆N
April 9, 2022
1 min read

lfi rce log-poisoning responder.py NTLMv2 hashcat reverse-powershell php-webshell evil-winrm steal-NTLMv2