Sauna
Sauna
Sauna 229
Sauna
RETIRED MACHINE

Sauna

Sauna - Windows Windows
Sauna - Easy Easy

4.5

MACHINE RATING

16443

USER OWNS

15282

SYSTEM OWNS

15/02/2020

RELEASED
Created by egotisticalSW

Machine Synopsis

Sauna is an easy difficulty Windows machine that features Active Directory enumeration and exploitation. Possible usernames can be derived from employee full names listed on the website. With these usernames, an ASREPRoasting attack can be performed, which results in hash for an account that doesn't require Kerberos pre-authentication. This hash can be subjected to an offline brute force attack, in order to recover the plaintext password for a user that is able to WinRM to the box. Running WinPEAS reveals that another system user has been configured to automatically login and it identifies their password. This second user also has Windows remote management permissions. BloodHound reveals that this user has the *DS-Replication-Get-Changes-All* extended right, which allows them to dump password hashes from the Domain Controller in a DCSync attack. Executing this attack returns the hash of the primary domain administrator, which can be used with Impacket's psexec.py in order to gain a shell on the box as `NT_AUTHORITY\SYSTEM`.

Machine Matrix

Ready to start your
hacking journey?