Administrator Windows (Medium)

Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided.

This machine was given in a asume breach sceanrio the credentials were provided for the user Olivia

Olivia : ichliebedich

Nmap scan

PORT     STATE SERVICE       VERSION
21/tcp   open  ftp           Microsoft ftpd
| ftp-syst: 
|_  SYST: Windows_NT
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-01-07 14:58:55Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: administrator.htb0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-01-07T14:59:09
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
|_clock-skew: 7h00m00s

Since SMB was available i checked what were the available shares

These were almost the default shares so i checked if i can access through winrm

Ran a bloodhound enum

In the bloodhound we saw that olivia has genericall permissions for michael so we changes his password and got access

Then we saw that michael has ForceChangePassword over Benjamin

I tried to winrm i dint have access so since there was ftp running aswell in the beggining i checked if i could access that

Got a file tried to crack it through hashcat

With the cracked password i downloaded and installed safepass and opened the file where i was given a few passwords

I try all passwords and get a hit for emilys

I check how emily can priv esc and i saw she has GenericWrite over ethan

Im going to run a Kerberoast as emily and this is what i got

So new creds are

I can do a dcsync with ethan to get administrator so i run secrets dump and with that i can get the admin hash

Tester gained Administraive access via a Pass The Hash

PreviousRed Team BlogsNextPage 2

Last updated