Posts tagged with

evil-winrm

HackTheBox - EscapeTwo Writeup

EscapeTwo is an easy Windows machine focused on full domain compromise. Starting with low-privileged credentials, we extract more creds from a corrupted Excel file, gain MSSQL and WinRM access, and discover ADCS misconfigurations. Exploiting these flaws leads to the Administrator hash and full domain control.

S SH∆FIQ∆IM∆N
May 27, 2025
1 min read

smb smbmap smbclient-ng netexec-mssql impacket-mssqlclient mssql netexec-winrm evil-winrm xp_cmdshell bloodhound sharphound powerview.ps1 account-cert-publishers-group writeowner certipy-ad adcs-esc4 rubeus psexec-hash psexec.py impacket-psexec
HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

S SH∆FIQ∆IM∆N
February 9, 2025
1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash
HackTheBox - Forest Writeup

Forest is an easy Hack The Box Windows Domain Controller with Exchange Server installed. Anonymous LDAP binds allow domain enumeration, revealing a service account with Kerberos pre-authentication disabled. Cracking its hash grants a foothold. As a member of the Account Operators group, the user can add accounts to privileged Exchange groups. This access is leveraged to gain DCSync privileges and dump NTLM hashes, resulting in full domain compromise.

S SH∆FIQ∆IM∆N
February 27, 2024
1 min read

ldapsearch GetNPUsers.py rpcclient ASREPRoast evil-winrm bloodhound account-operators-group writedacl powerview.ps1 secretsdump.py DCSync-attack psexec.py psexec-hash hashcat kerberos sharphound ldap
HackTheBox - Timelapse Writeup

Timelapse is an easy Hack The Box Windows machine that begins with accessing an open SMB share containing a password-protected ZIP file. The ZIP and a contained .pfx file are cracked using John the Ripper, allowing extraction of a certificate and private key. These are used to authenticate via WinRM. Further enumeration reveals stored PowerShell history with credentials for the svc_deploy user, who is a member of the LAPS_Readers group. This group can retrieve local admin passwords managed by LAPS, which is leveraged to obtain the domain Administrator's credentials and gain full access to the machine.

S SH∆FIQ∆IM∆N
August 21, 2022
1 min read

crackmapexec-smb smbclient zip2john pfx-file pfx2john john evil-winrm powershell-history ldap ldapsearch laps_readers-group
HackTheBox - Netmon Writeup

Netmon is an easy Windows machine on Hack The Box featuring simple enumeration and exploitation. It runs PRTG Network Monitor alongside an FTP server with anonymous access, allowing retrieval of PRTG config files. A known RCE vulnerability in the PRTG version is exploited to gain a SYSTEM-level shell.

S SH∆FIQ∆IM∆N
May 28, 2022
1 min read

CVE-2018-9276 evil-winrm PRTG-netmon ftp paessler rce PRTG-netmon-default-creds
HackTheBox - Responder Writeup

Responder is a free starting-point machine. This machine teaches us how to use the responder utility to steal the password hash and crack it with hashcat. On top of that, this machine is also vulnerable to local file inclusion. Which we can exploit through log poisoning to gain remote code execution and get the reverse shell.

S SH∆FIQ∆IM∆N
April 9, 2022
1 min read

lfi rce log-poisoning responder.py NTLMv2 hashcat reverse-powershell php-webshell evil-winrm steal-NTLMv2
HackTheBox - Return Writeup

Return is an easy Windows machine on Hack The Box that involves exploiting a network printer admin panel to extract LDAP credentials via a malicious LDAP server. These credentials are then used to gain access through WinRM. Privilege escalation is achieved by abusing group membership, leading to full system compromise.

S SH∆FIQ∆IM∆N
April 2, 2022
1 min read

server-operators-group printer sc.exe evil-winrm
HackTheBox - Pathfinder Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

ldap ldapsearch ldapdomaindump kerberos ASREPRoast GetNPUsers.py DCSync-attack secretsdump.py john evil-winrm psexec.py