search

Hutch

Apparently I did not do the expected method of solving this box but it worked out in the end

LogoProving Grounds -Hutch (Intermediate) Windows Box -Walkthrough — A Journey to Offensive SecurityMediumchevron-right

hashtag
Nmap Scan

hashtag
Initial Access

hashtag
Enum4Linux

hashtag
Null Credentials

hashtag
Guest Credential

hashtag
Enumerating LDAP

So we will first enumerate LDAP using this command

There is something interesting here:

We can see that the user fmcsorley has the password CrabSharkJellyfish192.

When we try to enumerate the share folder, we get back no interesting results.

hashtag
Enumerating the Domain

The next step is to enumerate the domain using SharpHound. Since we cannot get a user shell, we will run SharpHound on linux to enumerate the domain.

After we import the data into bloodhound, we can see that the user we owned have the ReadLAPSPassword Privilege.

hashtag
Reading LAPS password

So the next step would be to try to get the LAPS Password so that we are able to login as the administrator directly

LogoGitHub - p0dalirius/pyLAPS: Python setter/getter for property ms-Mcs-AdmPwd used by LAPS.GitHubchevron-right

After following the instructions in the repo to get the password, we are able to get the LAPS password for HUTCHDC$.

Next we will test if the password works and sure enough it works.

Lastly, we will just use impacket-psexec to get the Administrator shell.

PreviousHeistNextInternal

Last updated