Active Directory

I started with a full port scan using my Nmap automation script. https://github.com/HutchSec/portScan The scan revealed several interesting services including SMB, MSSQL, WinRM, and HTTP. SMB Enumeration — RID Cycling Anonymous SMB access was enabled, which allowed RID cycling attacks using Impacket’s lookupsid.py. This exposed valid domain usernames. Password Spraying Read more

This lab came with Active Directory creds to simulate an assumed breach assessment. I started by checking the credentials with Netexec to confirm they worked. Next I ran Bloodhound-ce-python to collect Active Directory data for Bloodhound. Looking at the user “Olivia” that was provided, I noticed they had an outbound Read more

I started with an nmap scan for all TCP ports and the top UDP ports. This one looks like an Active Directory Domain Controller. Added target hostnames to /etc/hosts Looking through the SMB shares, I found one “support-tools” that is not default. Looking into the share with guest access, I Read more

I began by performing a full TCP and UDP port scan to enumerate available services. It looks like we are working with an Active Directory Domain Controller from the ports that are open. I was able to collect system information through an SMB null session misconfiguration, which allowed me to Read more

Today I am working on Sauna by Hackthebox. I start out with some port scans. This is a Domain Controller so I looked into some common items such as null sessions and smb share enumeration. I did not have luck so I started enumerating the web server on port 80. Read more

To start the assessment, I start with my nmap scans to check for open TCP and UDP ports. Looks like a domain controller with a SQL service. I use the tool smbclient to check for any smb share that look interesting. The share “Public” looks good so I connect to Read more

icked off the assessment with a thorough Nmap scan to discover open ports and fingerprint the services running on the Forest host. After identifying RPC on 135, I used rpcclient to connect anonymously and enumerate every domain user. I compiled the discovered usernames into a file and ran Impacket’s GetNPUsers.py Read more

I began this engagement by conducting an Nmap scan to identify open ports on the target. The results revealed several ports in use, including ports 88 (Kerberos), 135 (RPC), 389 (LDAP), and 445 (SMB), which strongly suggested the target was a Windows Domain Controller. Focusing on port 445, I started enumerating Read more