Summary
VulnNet Entertainment just deployed a new instance on their network with the newly-hired system administrators. Being a security-aware company, they as always hired you to perform a penetration test, and see how system administrators are performing. Started with nmap scan sudo nmap -sVC -p- -Pn -A 10.49.191.240 -T5 -oN nmap_scan.txt -v Nmap scan result PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-14 16:27:54Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |http-server-header: Microsoft-HTTPAPI/2.0 |http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49677/tcp open msrpc Microsoft Windows RPC 49713/tcp open msrpc Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2019 (97%) OS CPE: cpe:/o:microsoft:windows_server_2019 Aggressive OS guesses: Windows Server 2019 (97%) No exact OS matches for host (test conditions non-ideal). Network Distance: 3 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: WIN-2BO8M1OE1M1; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: | Message signing enabled and required | smb2-time: | date: 2026-03-14T16:29:00 | start_date: N/A |_clock-skew: -1s Added the ip and domain name into our /etc/hosts file. SMB Enumeration Found some shares but there wasn’t anything special in these. SMB rid bruteforcing Lets try to enumerate users/groups by RID Bruteforcing. lets save those usernames into clean notes. As rep roasting And we got hash of a t-skid user. lets try to crack it using hashcat by hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt we successfully cracked the password of t-skid user. List smb shares using new user Now we have read permission to NETLOGON with this t-skid user. Accessed NETLOGON share Got interesting file then after downloading it and reading it got some username and password : ) Got username a-whitehat and his password. Get Aniket Nayak’s stories in your inbox Join Medium for free to get updates from this writer. because winrm port 5985 was open so we tried evil-winrm to log in with these credentials. Successfully logged into a-whitehat and got shell. Retrieved user flag Lets check for root flag Here we can see the root flag in the Administrator’s Desktop directory but we do not have permission to read. lets check what privileges we have checked privileges using whoami /priv we have lots of privileges means there are different ways to escalate our privileges but here we will use SeTakeOwnershipPrivilege for that invoke the following command :- takeown /f ‘C:\Users\Administrator\Desktop\system.txt’ it means now the file is owned by the current user. now run icacls ‘C:\Users\Administrator\Desktop\system.txt’ /grant a-whitehat:F It means now the current user have full access. Now we can read the final root flag.