Today’s box is going to be really, really quick and easy. It will demonstrate how simple a compromise can be and will act as a gauge for HackSmarter content, as I want to start reviewing them. (No, this is not a sponsored blog post. I am not that cool.)

Preamble

Before we get into that, I wanted to give a quick update and apologize for such a late post, as this does not follow my normal rhythm. I have had a boatload of IRL items happen, which are all really great news but quite taxing on my time. Nevertheless, I do have something upcoming: possibly an exam to review that I was not expecting, and it should be fun.

The main focus at the moment is the good ole CAPE grind, which I want to attempt as soon as I am comfortable. I had a bit of burnout, which halted progress, but I am getting back on the “Grindset,” so I am genuinely excited for that.

With a little more than two months left in the year, I hope everyone is keeping up the momentum to the end. I know this is the time when things start to go wild and time starts to slip away, but you’ve got this! Don’t let the hard work of today be undone by a fleeting year.

Box time!

OS: Windows
Difficulty: Very Easy
Review: 2.8/5

An adult beverage company "Martini Bars" recently had a corporate breach and the compliance and risk team dictates they perform a penetration test at one of their branch offices. The Hack Smarter team has been authorized to perform an internal black box pentest.

Recon:

As always, start with RustScan.

rustscan -a $IP -n --ulimit 70000 -t 5000 -- -A -Pn
PORT     STATE SERVICE            REASON  VERSION
53/tcp   open  domain             syn-ack Simple DNS Plus
88/tcp   open  kerberos-sec       syn-ack Microsoft Windows Kerberos (server time: 2026-10-15 01:15:45Z)
135/tcp  open  msrpc              syn-ack Microsoft Windows RPC
139/tcp  open  netbios-ssn        syn-ack Microsoft Windows netbios-ssn
389/tcp  open  ldap               syn-ack Microsoft Windows Active Directory LDAP (Domain: DRY.MARTINI.BARS0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?      syn-ack
464/tcp  open  kpasswd5?          syn-ack
593/tcp  open  ncacn_http         syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped         syn-ack
3268/tcp open  ldap               syn-ack Microsoft Windows Active Directory LDAP (Domain: DRY.MARTINI.BARS0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped         syn-ack
3389/tcp open  ssl/ms-wbt-server? syn-ack
| rdp-ntlm-info:
|   Target_Name: DRY
|   NetBIOS_Domain_Name: DRY
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: DRY.MARTINI.BARS
|   DNS_Computer_Name: DC01.DRY.MARTINI.BARS
|   Product_Version: 10.0.26100
|_  System_Time: 2026-10-15T01:17:08+00:00
| ssl-cert: Subject: commonName=DC01.DRY.MARTINI.BARS
| Issuer: commonName=DC01.DRY.MARTINI.BARS
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-14T01:01:11
| Not valid after:  2027-04-15T01:01:11
| MD5:   6e199781810548d65582cb408df9fc5f
| SHA-1: fe3b392150a3a6089b22f0faa11e1f7400ea4ff3
| -----BEGIN CERTIFICATE-----
| MIIC7jCCAdagAwIBAgIQQ3V/oI3y76tMPwc7pzKkZjANBgkqhkiG9w0BAQsFADAg
| MR4wHAYDVQQDExVEQzAxLkRSWS5NQVJUSU5JLkJBUlMwHhcNMjYxMDE0MDEwMTEx
| WhcNMjcwNDE1MDEwMTExWjAgMR4wHAYDVQQDExVEQzAxLkRSWS5NQVJUSU5JLkJB
| UlMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDiqvUkbi4phV1+Rc8M
| 18jTaQIllD4W/LUqvPNmsbAU4Mykcjp/pLyeuQx0r8o42qwllTb++nMH+dDOrxG7
| s64UN+jlPj0e5yciHlzHrOedyHdBOQsO1EO60Rihon2uS/HWtlqOhrJlbly1n68V
| 264ckvzsp0uD7lBqSJZnNEcvtI8MfuJUK3AxlNH7ZfxDujyMZIexzpbzCn7xi92y
| LSDtMgNxf+7RKdSUD4Rt2Jzo0NxkaRZKA0tlopVUrogpwPb6OkK/miyQpV54ELAq
| cNmJ9zMhmX4Xto67KBgn0oQIFM5ffkOaq/dGCy03qzPInsgJYWY4f2ao1cQPMIKP
| G1IlAgMBAAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDAN
| BgkqhkiG9w0BAQsFAAOCAQEAM+vjjBdXK8c3pp4xvvdSS964c8cl/uPEPDy8HMGf
| mxdXlVCeFJgvrQSc0F45Y7MUDwcEawHbsNFlwIybu/XwxsJDU5Ge3XGYR5xVlFv8
| Bg4jI8IyvRsvQrRKIwRQvFLhXWV6Z/sLo1HqnMOcIcRpWK/cGJgVttkrx1BrXKYH
| U2bdfby/vJrOxiLuLC8TiRACPDlYvtFWQQCaDpn0T3hzdiE7oa8bIYB788pzRVSy
| EaAKhNx4Lby+OenC0D+9nqCuuO7xMk7y9Ng0jbJtkxwjFDJVpVXq5IwViZlwYGrQ
| +UhqM7IuRSYIRSWIMGlEJp0f8TIV3EOyQZj6oHqPyxqirQ==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
5985/tcp open  http               syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open  mc-nmf             syn-ack .NET Message Framing

Based on this output, this looks to be a domain controller, with the prime attack vector being an SMB share from my experience. However, we will run enumeration from the top.

Before we continue, we need to add the hostname and IP to our /etc/hosts file.

DNS:

Checked the DNS using DNSEnum and dig, which produced no results.

SMB:

With DNS checked, we can move on to SMB. Enum4linux-ng did not show too much, so I will forgo adding it. But we can use NetExec to enumerate, starting by checking whether Guest can access shares.

Seeing that Guest does have share access, before diving into that, we can get a list of users via RID brute forcing.

Now, with a list of users set aside, we can use smbclient.py to connect to the machine and enumerate the notes share, which does show a text file we can extract.

Reading the text file does show some cleartext credentials.

Credentialed enumeration:

LDAP:

With domain credentials found, we can break out one of my new favorite tools for enumerating LDAP: powerview.py. Using the credentials, we can connect to LDAP and use the local GUI to enumerate.

Once connected to the locally hosted GUI, we can see a kerberoastable service account and an admin with roughly the same name.

Kerberoasting:

Using NetExec, we can kerberoast this service account to obtain a ticket to crack offline:

Hashcracking:

Using hashcat and a GPU, we can obtain this password in 2 seconds.

Domain takeover:

Based on the naming, I thought this service account would share the same password as the admin account with the same name, which turned out to be correct. As such, we are domain admin now and the objective is completed.