Posts tagged with

ldapsearch

HackTheBox - Active Writeup

Active is an easy Hack The Box Windows machine set in an Active Directory environment. Anonymous SMB access reveals a Groups.xml file with a GPP-encrypted password, leading to domain credentials and the user flag. Kerberoasting a user with an SPN yields a crackable TGS hash, granting Administrator access via PsExec and full system compromise.

S SH∆FIQ∆IM∆N
March 23, 2025
1 min read

smb smbmap smbclient-ng groups.xml group-policy-file gpp-decrypt ldap ldapsearch impacket-GetADUsers kerberoasting ldapsearch-SPN hashcat impacket-psexec kerberos
HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

S SH∆FIQ∆IM∆N
February 9, 2025
1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash
HackTheBox - Forest Writeup

Forest is an easy Hack The Box Windows Domain Controller with Exchange Server installed. Anonymous LDAP binds allow domain enumeration, revealing a service account with Kerberos pre-authentication disabled. Cracking its hash grants a foothold. As a member of the Account Operators group, the user can add accounts to privileged Exchange groups. This access is leveraged to gain DCSync privileges and dump NTLM hashes, resulting in full domain compromise.

S SH∆FIQ∆IM∆N
February 27, 2024
1 min read

ldapsearch GetNPUsers.py rpcclient ASREPRoast evil-winrm bloodhound account-operators-group writedacl powerview.ps1 secretsdump.py DCSync-attack psexec.py psexec-hash hashcat kerberos sharphound ldap
HackTheBox - Timelapse Writeup

Timelapse is an easy Hack The Box Windows machine that begins with accessing an open SMB share containing a password-protected ZIP file. The ZIP and a contained .pfx file are cracked using John the Ripper, allowing extraction of a certificate and private key. These are used to authenticate via WinRM. Further enumeration reveals stored PowerShell history with credentials for the svc_deploy user, who is a member of the LAPS_Readers group. This group can retrieve local admin passwords managed by LAPS, which is leveraged to obtain the domain Administrator's credentials and gain full access to the machine.

S SH∆FIQ∆IM∆N
August 21, 2022
1 min read

crackmapexec-smb smbclient zip2john pfx-file pfx2john john evil-winrm powershell-history ldap ldapsearch laps_readers-group
HackTheBox - Pathfinder Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

ldap ldapsearch ldapdomaindump kerberos ASREPRoast GetNPUsers.py DCSync-attack secretsdump.py john evil-winrm psexec.py