Posts tagged with

winpeas

HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Love Writeup

Love is an easy Windows machine featuring a vulnerable voting system web application. Initial enumeration reveals a service on port 5000, but direct access is denied. A secondary file scanner service is found to be vulnerable to SSRF, which is exploited to access an internal password manager. Credentials obtained from this allow authentication to the voting system, which is vulnerable to authenticated Remote Code Execution. This grants access as the phoebe user. Post-exploitation reveals AppLocker is enabled, but a misconfiguration allows privilege escalation by deploying a malicious .msi file, resulting in a shell as SYSTEM.

S SH∆FIQ∆IM∆N
August 25, 2021
1 min read

ssrf upload-vuln AlwaysInstallElevated winpeas msfvenom gobuster msi-file