Search
Search
Search 422
Search
RETIRED MACHINE

Search

Search - Windows Windows
Search - Hard Hard

4.7

MACHINE RATING

1911

USER OWNS

1729

SYSTEM OWNS

18/12/2021

RELEASED
Created by dmw0ng

Machine Synopsis

Search is a hard difficulty Windows machine that focuses on Active Directory enumeration and exploitation techniques. Foothold is obtained by finding exposed credentials in a web page, enumerating AD users, running a Kerberoast attack to obtain a crackable hash for a service account and spraying the password against a subset of the discovered accounts, obtaining access to a SMB share where a protected XLSX file containing user data is found. Unprotecting the file leads to a second set of credentials, which gives access to another share where PKCS#12 certificates can be downloaded. After importing the certificates into a web browser, Windows PowerShell Web Access can be used to obtain an interactive shell on the system. Due to misconfigured ACLs, the user can retrieve the password of a group managed service account which can change the password of an administrative user, resulting in high-privileged access to the system via `wmiexec` or `psexec`.

Machine Matrix

Ready to start your
hacking journey?