Posts tagged with

kerberos

HackTheBox - Active Writeup

Active is an easy Hack The Box Windows machine set in an Active Directory environment. Anonymous SMB access reveals a Groups.xml file with a GPP-encrypted password, leading to domain credentials and the user flag. Kerberoasting a user with an SPN yields a crackable TGS hash, granting Administrator access via PsExec and full system compromise.

S SH∆FIQ∆IM∆N
March 23, 2025
1 min read

smb smbmap smbclient-ng groups.xml group-policy-file gpp-decrypt ldap ldapsearch impacket-GetADUsers kerberoasting ldapsearch-SPN hashcat impacket-psexec kerberos
HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

S SH∆FIQ∆IM∆N
February 9, 2025
1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash
HackTheBox - Forest Writeup

Forest is an easy Hack The Box Windows Domain Controller with Exchange Server installed. Anonymous LDAP binds allow domain enumeration, revealing a service account with Kerberos pre-authentication disabled. Cracking its hash grants a foothold. As a member of the Account Operators group, the user can add accounts to privileged Exchange groups. This access is leveraged to gain DCSync privileges and dump NTLM hashes, resulting in full domain compromise.

S SH∆FIQ∆IM∆N
February 27, 2024
1 min read

ldapsearch GetNPUsers.py rpcclient ASREPRoast evil-winrm bloodhound account-operators-group writedacl powerview.ps1 secretsdump.py DCSync-attack psexec.py psexec-hash hashcat kerberos sharphound ldap
HackTheBox - Pathfinder Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

ldap ldapsearch ldapdomaindump kerberos ASREPRoast GetNPUsers.py DCSync-attack secretsdump.py john evil-winrm psexec.py