[chillywilly]

Got This hash, cant crack him dont know how to continue from this point
svc_web::MS01:1122334455667788:2a1beddd69c71ca052428592e5d3cbb9:010100000000000069fbc8c3c283da01fecd0ddc57a9967c0000000008003000300000000000000000000000003000005244af53b397216e69d27c37edb6b316715fda182a087e1bf2499435508a5ba60a00100000000000000000000000000000000000090000000000000000000000

how could you not crack this?
svc_web:MostSavagePasswordEver123

[sus11]

Got This hash, cant crack him dont know how to continue from this point
svc_web::MS01:1122334455667788:2a1beddd69c71ca052428592e5d3cbb9:010100000000000069fbc8c3c283da01fecd0ddc57a9967c0000000008003000300000000000000000000000003000005244af53b397216e69d27c37edb6b316715fda182a087e1bf2499435508a5ba60a00100000000000000000000000000000000000090000000000000000000000

how could you not crack this?
svc_web:MostSavagePasswordEver123

john --wordlist=/usr/share/wordlists/rockyou.txt hash.txt
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:04 DONE (2024-04-02 17:43) 0g/s 3032Kp/s 3032Kc/s 3032KC/s !SkicA!..*7¡Vamos!

[Test12349]

any hint for Administrator in DC01 ?

Not sure if it's a rabbit hole, but you can get ntlm hashes for svc_ca$ and svc_cabackup. Stuck here too

[cavour13]

trying exactling the same .. are you you using that tool for dumps pass dm if you can

[Test12349]

any hint for Administrator in DC01 ?

Not sure if it's a rabbit hole, but you can get ntlm hashes for svc_ca$ and svc_cabackup. Stuck here too

I got hash for svc_ca$. How did you get the hash for svc_cabackup?

https://github.com/ShutdownRepo/pywhisker.git

[lonelywolf1981]

For this machine you will need

Webdav coerce
https://gist.github.com/KINGSABRI/e20693...ce49d004ca

chisel

ntlmrelayx and patch https://github.com/fortra/impacket/pull/1402

PetitPotam https://github.com/topotam/PetitPotam

gettgtpkinit https://github.com/dirkjanm/PKINITtools

Thanks Akorexsecurity

User flag on the MS1 admin root flag on domain controller admin

[navdev]

Could you explain how you got get this idea?just want to know which files you looked into to this idea.

For brandon:
$source = "C:\Users\Brandon.Keywarp\AppData\links"
$destination = "C:\Common Applications"
$sourceFiles = Get-ChildItem -Path $source -Filter *.lnk

foreach ($file in $sourceFiles) {
    $sourceFile = $file.FullName
    $destFile = Join-Path -Path $destination -ChildPath $file.Name
    if (Test-Path -Path $destFile) {
    $sHash = (Get-FileHash -Path $sourceFile -Algorithm SHA256).Hash
    $dHash = (Get-FileHash -Path $destFile -Algorithm SHA256).Hash
    write-host $sHash
    write-host $dHash
        if ($sHash -ne $dHash) {
        Invoke-Item $destFile
        start-sleep -seconds 5
        }
    }
}

Means you can upload a crafted .lnk file(to the directory in the code above) to trigger a shell and  to get the shell as brandon.

[KillerWhale]

Does anyone have the problem when trying to connect to the machine? I can't connect to the machine today, even changed to other VPN server but it still can't connect.

[GWTW]

Does anyone have the problem when trying to connect to the machine? I can't connect to the machine today, even changed to other VPN server but it still can't connect.

Same here! Ping is working but not web service is.

[KillerWhale]

Does anyone have the problem when trying to connect to the machine? I can't connect to the machine today, even changed to other VPN server but it still can't connect.

Same here! Ping is working but not web service is.

This has been happened to me for 6 hours. Can't move on now.