evil-winrm Archives - Page 2 of 4

28 Jun, 2025

Hack The Box: Haze Machine Walkthrough – Hard Difficulty

Hard Machine Active Directory, Bloodhound, bloodyAD, Certipy, Challenges, CVE-2024-36991, evil-winrm, HackTheBox, Linux, Local File Inclusion (LFI), NetExec, Penetration Testing, pywhisker, Splunk, splunksecrets, SweetPotato

New Write-Up Published: Haze [Medium | Windows | Active Directory] – Hack The Box

Just released a walkthrough for Haze, a medium-difficulty Windows machine on Hack The Box. Initial access was obtained by exploiting CVE-2024-36991, a local file inclusion vulnerability in Splunk, to extract LDAP credentials. This enabled a Shadow Credentials attack using PyWhisker and Certipy, allowing lateral movement to a high-privileged domain user. For privilege escalation, I utilized Splunk admin access to deploy a reverse shell via a crafted app package. Upon gaining shell access, I escalated privileges to NT SYSTEM by abusing SeImpersonatePrivilege with SweetPotato. This box offers great insight into chained Active Directory abuse and Splunk misconfigurations.

#HackTheBox #RedTeam #ActiveDirectory #Splunk #CVE202436991 #ShadowCredentials #PrivilegeEscalation #SweetPotato #CTF #InfoSec #WriteUp #CyberSecurity …

Learn MoreHack The Box: Haze Machine Walkthrough – Hard Difficulty

14 Jun, 2025

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Insane Machine bitlocker, Bloodhound, BloodHoundCE, bloodyAD, BurpSuite, Certipy, Challenges, evil-winrm, HackTheBox, hashcat, impacket, john the ripper, kerbrute, Output Messenger, Penetration Testing, RDP, sqlite3, Windows, Wireshark

Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
…

Learn MoreHack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

26 Apr, 2025

Hack The Box: Vintage Machine Walkthrough – Hard Difficulty

Hard Machine BloodHoundCE, bloodyAD, Challenges, DPAPI, evil-winrm, HackTheBox, impacket, kerberos, ldapsearch, Penetration Testing, SMB & Kerberos Attacks, smbclient, Windows

Recently completed an Active Directory penetration test where I obtained both the user and root flags through a series of Kerberos and privilege escalation attacks. I first exploited a weak password on a legacy computer account (fs01$) to retrieve a Kerberos TGT and extract the gMSA password. After reactivating a disabled service account (svc_sql), making it ASREPRoastable, and cracking its hash, I gained credentials for another domain user and authenticated via Evil-WinRM to capture the user flag. For the root flag, I decrypted DPAPI-protected secrets to access a higher-privileged account (c.neri_adm), added a compromised service account to a privileged group, assigned an SPN, and performed a Kerberos delegation attack to impersonate a domain admin, ultimately achieving SYSTEM-level access and capturing the root flag. Great experience applying Kerberos exploitation techniques and privilege escalation strategies in a real-world scenario!

hashtag#ActiveDirectory hashtag#PenetrationTesting hashtag#Kerberos hashtag#OffensiveSecurity hashtag#RedTeam hashtag#CyberSecurity hashtag#ASREPRoasting hashtag#DPAPI hashtag#PrivilegeEscalation hashtag#HackTheBox hashtag#Infosec hashtag#HacktheBox …

Learn MoreHack The Box: Vintage Machine Walkthrough – Hard Difficulty

19 Apr, 2025

Hack The Box: Administrator Walkthrough Medium Difficulty

Medium Machine BloodHoundCE, Challenges, crackmapexec, evil-winrm, ftp, HackTheBox, hashcat, Penetration Testing, pwsafe, TargetedKerberoast, Windows

Chained privilege escalation on an AD environment via misconfigured permissions — no CVEs, just clever abuse of default rights. From Olivia to Emily to Ethan, we pivoted through user relationships using BloodHound, CrackMapExec, Kerberoasting, and WinRM access. Highlighting how overlooked configurations can lead to full domain compromise.

#ActiveDirectory #PrivilegeEscalation #BloodHound #Kerberoasting #HackTheBox #RedTeam #CyberSecurity #WindowsPentest …

Learn MoreHack The Box: Administrator Walkthrough Medium Difficulty

5 Apr, 2025

Hack The Box: Ghost Machine Walkthrough – Insane Difficulty

Insane Machine adfs abuse attack, ADFSDump, ADFSSpoof, Bloodhound, BloodHoundCE, BurpSuite, Challenges, command injection, docker, efspotatoo, evil-winrm, Gitea, HackTheBox, hashcat, JokerShell, kerberos, LFI, Linux, mimkatz, Penetration Testing, responder, rubeus.exe, SQL, ssh

The initial foothold was gained by exploiting command injection on intranet.ghost.htb:8008/api-dev/scan/, which provided a reverse shell inside a Docker container. From there, I enumerated the environment and discovered credentials that allowed SSH access as Florence Ramirez. By extracting and converting a Kerberos ticket, I authenticated as a legitimate user, escalating access within the system. With access to the Windows environment, I retrieved NTLM hashes for the adfs_gmsa account and leveraged evil-winrm for lateral movement. A reverse shell was established using JokerShell, and privileges were escalated by enabling xp_cmdshell through a debug interface. After uploading EfsPotato.cs and disabling antivirus, I used Mimikatz and Rubeus.exe to dump credentials, ultimately achieving SYSTEM access. This led to the extraction of domain admin credentials and the retrieval of the root flag. Another Insane box down! 💀💻

#HackTheBox #RedTeam #CyberSecurity #PenTesting #PrivilegeEscalation #EthicalHacking …

Learn MoreHack The Box: Ghost Machine Walkthrough – Insane Difficulty

15 Mar, 2025

Hack The Box: Certified Machine Walkthrough – Medium Difficulty

Medium Machine Active Directory Exploitation, Bloodhound, Certificate Services Exploitation, Certipy, Cybersecurity, evil-winrm, Hack The Box, Penetration Testing, Privilege Escalation, Red Teaming, SMB & Kerberos Attacks, Windows, Windows Security

Access is gained using Judith Mader’s credentials, allowing enumeration of network resources. CrackMapExec identifies key accounts like management_svc and ca_operator. Privilege escalation is performed using a Shadow Credentials attack with Certipy, taking control of management_svc. With valid credentials, Evil-WinRM establishes a remote session, leading to the user flag.

For root access, the attack exploits Active Directory Certificate Services by modifying ca_operator’s User Principal Name (UPN) to Administrator, enabling a privileged certificate request. A vulnerable ESC9 certificate is issued without linking back to ca_operator, effectively granting Administrator access. The UPN is restored to avoid detection, and authentication via Kerberos retrieves the NT hash of the Administrator account. Full system control is confirmed by obtaining the root flag.

#HackTheBox #Pentesting #ActiveDirectory #PrivilegeEscalation #CyberSecurity #EthicalHacking …

Learn MoreHack The Box: Certified Machine Walkthrough – Medium Difficulty

15 Feb, 2025

Hard Machine Account Recovery, Bloodhound, Challenges, command injection, cyberchef, evil-winrm, HackTheBox, HTTPUploadExfil, idor, Impacket script, OTP, Penetration Testing, python3, QRcode, Resource-Based Constrained Delegation, RunasCs, tcpdump, Windows

Threatninja.net

Threatninja.net

Hack The Box: Haze Machine Walkthrough – Hard Difficulty

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Hack The Box: Vintage Machine Walkthrough – Hard Difficulty

Hack The Box: Administrator Walkthrough Medium Difficulty

Hack The Box: Ghost Machine Walkthrough – Insane Difficulty

Hack The Box: Certified Machine Walkthrough – Medium Difficulty

Hack The Box: Cicada Machine Walkthrough – Easy Difficulty

Hack The Box: Compiled Machine Walkthrough – Medium Difficulty

Hack The Box: Axlle Machine Walkthrough – Hard Difficulty

Hack The Box: Freelancer Machine Walkthrough – Hard Difficulty

Threatninja.net

Threatninja.net

Tag Archives: evil-winrm