Writeup by wook413

ReconNmapInitial AccessBrute-forcing usernamesSMB 139 445KerberoastingMSSQL 1433BloodhoundShell as molly.smithPrivilege EscalationShell as Administrator

Recon

Nmap

As per my standard methodology, I initiated the assessment with three Nmap scans: a comprehensive TCP port scan, a targeted service scan on identified ports, and a UDP scan of the top 10 common ports.

Initial Access

Brute-forcing usernames

Initial attempts at SMB and RPC Null Authentication, LDAP anonymous bind, as well as HTTP directory brute-forcing, yielded no significant leads. Lacking valid usernames, I performed user enumeration via Kerbrute , which successfully identified several accounts: info, administrator, discovery, and maintenance.

I compiled these identified usernames into a user.txt file.

I then conducted a password spraying attack using the users.txt list. NetExec confirmed that info:info are valid credentials.

Using the info account’s credentials, I enumerated the domain users utilizing NetExec’s --users flag.

I parsed the output to extract a clean list of usernames, saving them to users_clean.txt .

SMB 139 445

I mapped the available SMB shares using smbmap with the info user’s credentials.

Based on the file’s name and its contents, I identified a potential default password for new users: Start123! .

Having this new password, I performed another password spray. The results indicated that the discovery account was still using the default password.

Kerberoasting

I proceeded to Kerberoasting and identified two SPNs: discovery and maintenance . Since I already possessed the password for discovery , I focused my efforts on the maintenance user.

I confirmed the hash type as Kerberos (Hashcat mode 13100); however, attempts to crack it using the rockyou.txt wordlist were unsuccessful.

MSSQL 1433

Turning to MSSQL, I found that none of the compromised accounts had permissions to execute commands.

However, I discovered that I could impersonate the hrappdb-reader user.

After impersonating hrappdb-reader , I switched the database context from master to hrappdb .

Within the database, I found a table named sysauth containing the credentials hrapp-service:Untimed$Runny.

Bloodhound

Despite having new credentials, I was still unable to gain remote access. I shifted my analysis to Bloodhound , which revealed that the hrapp-service user holds GenericWrite privileges over the hazel.green account.

image-20260224191347202

image-20260224191354008

I executed a Targeted Kerberoasting attack as hrapp-service , successfully obtaining the Kerberos hash for hazel.green .

I successfully cracked the hash using Hashcat along with the wordlist rockyou.txt

After making hazel.green as compromised in Bloodhound , I analyzed the next steps. While hazel.green , molly.smith , and alexandra.little were part of the IT group, the immediate path forward wasn’t initially clear.

image-20260224191410722

I utilized bloodyAD to audit hazel.green ’s permissions, which revealed the ability to reset the password for molly.smith.

Using rpcclient , I manually updated Molly’s password to haze1988 (synchronizing it with Hazel’s password for convenience).

Shell as molly.smith

I confirmed that Molly is a member of the “Remote Management Users” group, allowing me to RDP into the target.

Once logged in, I launched an administrative Command Prompt to view all assigned privileges.

image-20260224191424045

Privilege Escalation

image-20260224191433516

Among several assigned privileges, SeBackupPrivilege was the most prominent, as it allows a user to bypass ACLs to access any file or directory on the system.

Leveraging SeBackUpPrivilege, I extracted SAM and SYSTEM registry hives and transferred them to my Kali machine.

image-20260224191445843

I then dumped the local hashes using impacket-secretsdump.

Shell as Administrator

Finally, I gained full system access by authenticating as the Administrator via a Pass-the-Hash using evil-winrm.

Found proof.txt