Hacking Windows Active Directory using Bloodhound, and Cracking PasswordSafe password manager file
scan open port & running service using nmap. (ftp, smb, ldap (active directory), rpc are running.)
try to login via ftp. (failed).
use enum4linux to enumerate shares, user, etc. dont forget to enumerate using the provided creds.
enumerate read access to shares using netexec. (no read access to machine)
enumerate AD using bloodhound.
start from our default user, check what we own and what we can do. Olivia (our default user) has genericall privilege to michael, we can change michael password.
change michael password
try login as michael
back to bloodhound, check what michael can do. michael have forcechangepassword privilege to benjamin user
change benjamin password and test login via smb
remember the ftp that we found while scanning using nmap in the first step ? try using that now.
download Backup.psafe3 from ftp.
what is .psafe3 file ? google it, its a passwordsafe database file. passwordsafe is password manager and that file is containing password.
crack the file using hashcat.
open Backup.psafe3 file using Password Safe software (download here : https://pwsafe.org/). use the password that cracked earlier.
login as emily and grab user flag
back to bloodhound, check what emily can do.
targetedkerberoast to get ethan hash.
crack the hash using john
login as ethan
back to bloodhound, see what ethan can do.
dcsync attack using impacket-secretsdump to get admin hash
login as admin using admin hash and grab the root flag