dreadnaught- Machine
- Reel2
- OS
- Windows
- Difficulty
- Hard
- Steps
- 6
- Added
- 23 Mar 2023
A wordlist from Wallstant posts sprays OWA for a mailbox; an email phish captures a second NetNTLM hash for WinRM, and a leaked JEA account reads the Administrator flag through a Check-File junction.
How it went
- 0nmap
An nmap scan shows OWA and WinRM on 443/5985 and a Wallstant social site on 8080.
- 1Wallstant wordlist
Wallstant post content builds a password wordlist, and usernames are expanded into Exchange formats like flast and first.last.
- 2OWA spray
Spraying OWA with the wordlist lands s.svensson:Summer2020 and mailbox access.
- 3email phish
A malicious HTML email sent to all users triggers an authentication callback; Responder captures k.svensson's NetNTLM hash, which hashcat cracks.
- 4k.svensson
k.svensson's password opens a WinRM shell; a Sticky Note .log in AppData leaks jea_test_account credentials and the user flag.
- 5junction
The test account's JEA role only allows Check-File inside ProgramData, so a directory junction maps the Administrator folder into it.
- 6Check-File
Logging in locally as the test account, Check-File reads the Administrator's flag through the junction.