> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-sauna.md). # HTB - Sauna ## Enumeration and Foothold ```bash PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-16 09:32:10Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) 9389/tcp open mc-nmf .NET Message Framing 49669/tcp open msrpc Microsoft Windows RPC 49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49674/tcp open msrpc Microsoft Windows RPC 49675/tcp open msrpc Microsoft Windows RPC 49688/tcp open msrpc Microsoft Windows RPC 49696/tcp open msrpc Microsoft Windows RPC Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows ``` ### SMB

Anonymous access successful but cant list shares. ### HTTP

There is a Apply now page and a contact page, tried to see if i can exploit xss but nothing to exciting. On about page, there is a list of team members working in the company.

What i am gonna do is extract them to a file and use username anarchy to generate a posisble usernames and validate them through kerbrute aganist the domain. ### Username-Anarchy

### Kerbrute

i dont have password for fsmith. i can try looking, if the fsmith doesnt have kerberos pre auth enabled. If so, i can perform Asreproast. ### Asreproast

I cna crack the hash using John or Hashcat.

`fsmith : Thestrokes23`

i can winrm using the creds, which means i have shell access. ## Shell as FSmith

To escalate privileges further i can use winpeas to automate the enumeration process.

Winpeas found autologon creds for `svc_loanmanager`.

nxc says access denied.

The users directory says there is a user called svc\_loanmgr

i can try running the password aganist this user on the box.

and the creds work. So we have a shell. ## Shell as svc\_loanmgr

there is nothing much i can do on the machine so have turned to bloodhound to see what rights the user have. ### Bloodhound

The user `SVC_LOANMGR@EGOTISTICAL-BANK.LOCAL` has: * **GetChanges** - Permission to request replication data from the domain controller * **GetChangesAll** - Permission to replicate **ALL** directory changes, including password hashes This means **you can perform a DCSync attack** to dump all domain password hashes without needing domain admin credentials! ### DCSync

i can use the administrator hash to get shell as administrator. ## Shell as Administrator

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-oscp-machines/htb-sauna.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.