Active
Summary
Found anonymous SMB access and enumerated the
Replicationshare.Discovered a
GroupPolicyPreferencesfile (groups.xml) with GPP-encrypted credentials forSVC_TGS.Decrypted the password using
gpp-decrypt, then authenticated to SMB and retrieved the user.txt flag.Discovered the machine was vulnerable to Kerberoasting — used
GetUserSPNsto extract an Administrator ticket.Cracked the Kerberos TGS hash with John, recovered plaintext Administrator password.
Unable to login via WinRM or RPC, so accessed the
Usersshare again via SMB to extract the root.txt flag.
Enumeration
Discovered shares using enum4linux:
Initial Foothold
Anonymous SMB access on Replication share:
Found:
Decrypted using:
Result:
Credentials:
SMB Share Access (Authenticated)
Successfully accessed Users share and retrieved user.txt flag.
Privilege Escalation
Tried secretsdump (DCSync):
No luck. DCSync not permitted.
Tried BloodHound, but LDAP enumeration failed.
Kerberoasting Attack
Retrieved a service ticket for Administrator.
Cracked the TGS hash:
Recovered:
Tested access:
Success! Retrieved root.txt from Administrator’s directory via SMB share.
Last updated
Was this helpful?