Summary

1. using netexec to find we have PSRemote permissions on the box
2. run bloodhound via evil-winrm
3. abuse GenericAll permissions on Michael
4. abuse ForceChangePassword on Benjamin
5. Find pwsafe vault in FTP
6. crack the vault and find Emily’s password
7. Abuse Targeted Kerberoasting to get Ethan’s hash
8. Crack the hash of Ethan
9. perform the DCSync Attack

USER

Initial Enumeration

This machine is a bit different from other HTB Machines. we receive some info at the beginning and start the box with a username and password. olivia / ichliebedich are the valid credentials we start with. This looks like an Assume Breach Scenario. cool!