infraPromedium

Потерянный (Lost)

hackerlab

Task: Windows AD domain controller with writable anonymous SMB share and bot browsing it. Solution: NTLM theft via .scf/.url files on writable share → NTLMv2 hash capture with Responder → crack password → WinRM access → Unattended.xml credential harvesting → PsExec as Enterprise Admin to SYSTEM.

$ ls tags/ techniques/
privilege_escalationwindowswinrmsmbactive_directoryntlm_theftunattended_xmlresponderntlmv2_crackingpsexecenterprise_admin
anonymous_smb_enumerationrid_cycling_user_enumerationntlm_theft_via_writable_sharentlmv2_hash_capturepassword_cracking_rockyouwinrm_remote_accessunattended_xml_credential_harvestingbase64_password_decodingpsexec_privilege_escalation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups