Post cover image

August 14, 2026

Fusion Corp (THM) Tryhackme Hard Challenge

Description : Fusion Corp said they got everything patched… did they?

By Lawvye

3 min read

Difficulty : Hard

Category : Boot2root

Note : All of the content and images are from https://tryhackme.com/

Room : https://tryhackme.com/room/fusioncorp

Enjoy.

Port Scanning :

PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-favicon: Unknown favicon MD5: FED84E16B6CCFE88EE7FFAAE5DFEFD3| http-methods:
| Supported Methods: OPTIONS TRACE GET HEAD POST
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
|_http-title: eBusiness Bootstrap Template
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-06-16 02:34:14Z)
35/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fusion.corp0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: fusion.corp0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: FUSION
| NetBIOS_Domain_Name: FUSION
| NetBIOS_Computer_Name: FUSION-DC
| DNS_Domain_Name: fusion.corp
| DNS_Computer_Name: Fusion-DC.fusion.corp
| Product_Version: 10.0.17763
|_ System_Time: 2021-06-16T02:35:05+00:00
| ssl-cert: Subject: commonName=Fusion-DC.fusion.corp
| Issuer: commonName=Fusion-DC.fusion.corp
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-03-02T19:26:49
| Not valid after: 2021-09-01T19:26:49
| MD5: b6f5 76b6 8a9e 6a30 ed3c 7d67 ebf3 797c
|_SHA-1: bdba d8ee c2ba d088 f1a0 7395 891c 50b1 0b6e 020d
|_ssl-date: 2021-06-16T02:35:44+00:00; +1s from scanner time.
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49675/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49676/tcp open msrpc Microsoft Windows RPC
49677/tcp open msrpc Microsoft Windows RPC
49703/tcp open msrpc Microsoft Windows RPC
49832/tcp open msrpc Microsoft Windows RPC
Service Info: Host: FUSION-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Task 1 Fusion Corp

Please give the VM 5–10 minutes to fully boot.

You had an engagement a while ago for Fusion Corp. They contacted you saying they've patched everything reported and you can start retesting.

Answer the questions below

Reconnaissance and Enumeration

  • Run an nmap scan on the target IP to find open ports like LDAP (389), SMB (139/445), and Kerberos (88).
  • Extract the domain name (fusion.corp) via LDAP queries or reading the IIS/SSL certificate common name.
  • Enumerate domain user accounts using tools from Impacket or enum4linux.

Gaining Initial Access (AS-REP Roasting)

  • Check for users with the "Do not require Kerberos preauthentication" property enabled using Impacket's GetNPUsers.py.
  • Target the vulnerable user account (lparker) to retrieve the AS-REP kerberos hash.
  • Crack the extracted hash offline with Hashcat (mode 18200) using rockyou.txt to reveal the plaintext password.
  • credentials [lparker:!!abbylvzsvs2k6!]

Enumeration with Initial Credentials

  • Verify WinRM access using the cracked credentials, as the user belongs to Remote Management Users.
  • Run BloodHound (bloodhound-ce-python) to map the domain, though privilege escalation relies on specific local user rights rather than complex ACL paths.

Privilege Escalation (SeBackupPrivilege)

  • Log into the system or check user privileges to discover SeBackupPrivilege assigned to your user context.
  • Leverage diskshadow or utility scripts to create a Volume Shadow Copy of the active directory database (ntds.dit) and dump the SYSTEM registry hive.
  • Transfer the extracted ntds.dit and SYSTEM files back to your attacking machine.
  • Extract all domain password hashes (including the Administrator) using secretsdump.py from the Impacket toolkit to complete the room and capture the final flags.

Q1.) User 1

*Evil-WinRM* PS C:\Users\lparker\Desktop> type flag.txt
THM{c105b6fb249741b89432fada8218f4ef}
*Evil-WinRM* PS C:\Users\lparker\Desktop>

Answer : THM{c105b6fb249741b89432fada8218f4ef}

Q2.) User 2

*Evil-WinRM* PS C:\Users\jmurphy\Desktop> type flag.txt
THM{b4aee2db2901514e28db4242e047612e}
*Evil-WinRM* PS C:\Users\jmurphy\Desktop>

Answer : THM{b4aee2db2901514e28db4242e047612e}

Q3.) User 3

THM{f72988e57bfc1deeebf2115e10464d15}

Answer : THM{f72988e57bfc1deeebf2115e10464d15}

None None

I hope you enjoyed reading this post as much as I enjoyed writing it. Thanks for reading my blog sir ;) Lawvye