Below you will find pages that utilize the taxonomy term “Windows”
Administrator

Summary
- using
netexecto find we have PSRemote permissions on the box - run bloodhound via evil-winrm
- abuse
GenericAllpermissions on Michael - abuse
ForceChangePasswordon Benjamin - Find pwsafe vault in FTP
- crack the vault and find Emily’s password
- Abuse Targeted Kerberoasting to get Ethan’s hash
- Crack the hash of Ethan
- perform the DCSync Attack
USER
Initial Enumeration
This machine is a bit different from other HTB Machines. we receive some info at the beginning and start the box with a username and password. olivia / ichliebedich are the valid credentials we start with.
This looks like an Assume Breach Scenario. cool!
EscapeTwo

Note: Machine Information As is common in real life Windows pentests, you will start this box with credentials for the following account: rose / KxEPkKe6R8su
Summary
- found juicy file in SMB share
- extracted passwords from unzipped xlsx file
- reverse shell as sql_svc using mssql and xp_cmdshell
- password spray to find credential reuse
- writeowner abuse using impacket
- ADCS-ESC4 using certipy
Initial Enumeration
Port scanning
As always I start off with a port scan. first a full port scan followed by a detailed targetted port scan.
Certified

Note: As is common in Windows pentests, you will start the Certified box with credentials for the following account: Username: judith.mader Password: judith09
Summary
- AD Enumeration using
netexecandbloodhound - abuse
WriteOwnerpermissions to become member ofManagementGroup - ShadowCredential attack to get hash for
management_svc - Lateral Movement to
CA_Operatorby changing password - ADCS-ESC9 to become Administrator
Initial Enumeration
As usual I start with a simple full port scan followed by a more detailed targetted port scan
Cicada

Summary
- use anonymous sessions to find txt in HR share
- use RID-bruteforcing to find usernames
- password spray password on found user to find valid credentials
- read AD user info using rpcclient and find new password
- winrm into the box with new credentials (user)
- abuse SeBackupPrivilege to escalate to Administrator (root)
Initial Enumeration
As always I start with a port scan using nmap to find running services.
First I find all open ports using a simple port scan: