Behind the Mask (Windows)
Hello Guest
Port scan:
ββ# nmap -sC -sV -v -Pn 54.255.213.169
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2021-06-24 02:10:15Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
445/tcp open microsoft-ds Windows Server 2016 Datacenter 14393 microsoft-ds (workgroup: GDC)
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
3389/tcp open ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: GDC
| NetBIOS_Domain_Name: GDC
| NetBIOS_Computer_Name: GDC-DC-J
| DNS_Domain_Name: gdc.local
| DNS_Computer_Name: GDC-DC-J.gdc.local
| DNS_Tree_Name: gdc.local
| Product_Version: 10.0.14393
|_ System_Time: 2021-06-24T02:10:15+00:00
| ssl-cert: Subject: commonName=GDC-DC-J.gdc.local
| Issuer: commonName=GDC-DC-J.gdc.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2021-06-16T15:44:01
| Not valid after: 2021-12-16T15:44:01
| MD5: 4af0 4092 e460 3e66 22e0 bfd2 201d ab7a
|_SHA-1: 7c57 5c74 5cc7 ea3e a9ee 0d19 159f 4638 6bcf b1ec
|_ssl-date: 2021-06-24T02:10:55+00:00; 0s from scanner time.
Service Info: Host: GDC-DC-J; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_clock-skew: mean: 0s, deviation: 1s, median: 0s
| smb-os-discovery:
| OS: Windows Server 2016 Datacenter 14393 (Windows Server 2016 Datacenter 6.3)
| Computer name: GDC-DC-J
| NetBIOS computer name: GDC-DC-J\x00
| Domain name: gdc.local
| Forest name: gdc.local
| FQDN: GDC-DC-J.gdc.local
|_ System time: 2021-06-24T02:10:18+00:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: required
| smb2-security-mode:
| 2.02:
|_ Message signing enabled and required
| smb2-time:
| date: 2021-06-24T02:10:19
|_ start_date: 2021-06-22T10:01:52SMB Shares
Connect to Backup share with no username.
CDDC21{0LLHE_Gue$T}
Old Memories
Credentials: alexander.p:v#X1nOLqPZ
Access Forensics1 using these credentials. There is an LSASS dump, which we can use Mimikatz to interpret. This gives us the credentials John:#johnIStheBEST!.
Accessing Forensics2 as John gives us the flag.
CDDC21{lsa$$_DUMP_password}
Register
We are given a registry dump. There is a PuTTy password stored in the registry.
The flag is CDDC21{iS_Putty_s3cure?!}
Last Note
Listing all the domain users, we find the flag in the description of henry.s.
The flag is CDDC21{We!!_D0NE}
Last updated
Was this helpful?