Posts tagged with

crackmapexec-smb

HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Timelapse Writeup

Timelapse is an easy Hack The Box Windows machine that begins with accessing an open SMB share containing a password-protected ZIP file. The ZIP and a contained .pfx file are cracked using John the Ripper, allowing extraction of a certificate and private key. These are used to authenticate via WinRM. Further enumeration reveals stored PowerShell history with credentials for the svc_deploy user, who is a member of the LAPS_Readers group. This group can retrieve local admin passwords managed by LAPS, which is leveraged to obtain the domain Administrator's credentials and gain full access to the machine.

S SH∆FIQ∆IM∆N
August 21, 2022
1 min read

crackmapexec-smb smbclient zip2john pfx-file pfx2john john evil-winrm powershell-history ldap ldapsearch laps_readers-group
HackTheBox - Archetype Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 20, 2021
1 min read

reverse-powershell legacy smb smbclient crackmapexec-smb impacket-mssqlclient mssql xp_cmdshell nishang modify-services windows-check-OS-architecture