Sauna HTB writeup

Sauna was my very first windows box, so don't expect this writeup to be super technical or with a lot of knowledge of what's going. Even though, the box was easy to do.

Recon

First nmap scan showed the box was an AD with kerberos and a web site running on port 80.

FSmith user

Browsing the web site I've found a list of possible usernames at http://10.10.10.175/about.html

Then did a wordlist of possible usernames.

Next step is to try get TGTs from users who have 'Do not require Kerberos preauthentication' set on kerberos

This gave me an Kerberos 5 AS-REP hash from FSmith user.

Cracked the password with hashcat

As winrm was enabled on the server I could easily connect using evil-winrm using FSmith and just cracked credentials.

First thing I did was to run winPEAS.exe which gave me default credentials for svc_loanmgr user

With this user now I can dump secrets with impacket.

I've first had some errors about time not synced with the server, so first updated my local type with the box date.

Now got a ticket from kerberos as Adminstrator user using his NTLM hash

Set an environment variable with ticket file.

Now added sauna to etc/hosts and exec into the box

I have system rooted at this point.

This was my first windows box, I was a bit lost and not fully understand yet all the steps I did, need to learn more about how kerberos works.

Regards

PreviousOouch HTB writeupNextPython Vulnerabilities

Last updated

Was this helpful?