Posts

GOAD (Game of Active Directory) NHA #3 - Bypassing Defender and Achieving SYSTEM on SQL Host

After achieving RCE on the SQL host I proceeded to check the user’s privileges. As this is a service account it has the SeImpersonatePrivilege privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries. Knowing the way I will get NT AUTHORITY\SYSTEM on the SQL host, I proceeded to check if Defender is active. I also confirmed I can access Kali from the Windows environment with an HTTP request: ...

GOAD (Game of Active Directory) NHA #2 - Initial Enumeration and First Code Execution

Initial enumeration The first thing I did after installation and connectivity were set up was run an Nmap scan with the --top-ports 100 option (default) to quickly identify open ports and up hosts, since some Windows hosts do not respond to ICMP. After that, I ran a full Nmap service scan on the discovered hosts with the common scripts and service version options. ┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40] └─$ cat hosts.txt 192.168.56.10 192.168.56.20 192.168.56.21 192.168.56.22 192.168.56.23 ┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40] └─$ sudo nmap -sS --open -iL hosts.txt -p- -n -Pn -sCV -v -T5 -oN ALL_ports.txt Nmap scan report for 192.168.56.10 PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack | Issuer: commonName=NINJA-CA | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T14:15:35 | Not valid after: 2026-09-02T14:15:35 | MD5: 66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c |_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=dc-vil.ninja.hack | Issuer: commonName=dc-vil.ninja.hack | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T12:29:13 | Not valid after: 2026-03-03T12:29:13 | MD5: 2f5b:ea35:1df1:d9a8:f7a5:a0ab:078b:1f05 |_SHA-1: 0ec2:e105:bb4e:a168:58ba:7e26:ff30:85aa:3a46:e89f 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T10:27:02 | Not valid after: 2028-08-30T10:27:02 | MD5: 70e6:540d:00ac:0a19:12ba:b2fd:ae3b:1509 |_SHA-1: 3365:8276:a074:3f12:0caa:04cf:1652:70cc:870c:d8a3 | tls-alpn: |_ http/1.1 |_http-server-header: Microsoft-HTTPAPI/2.0 |_ssl-date: 2025-09-06T17:12:05+00:00; 0s from scanner time. 9389/tcp open mc-nmf .NET Message Framing 49666/tcp open msrpc Microsoft Windows RPC 49668/tcp open msrpc Microsoft Windows RPC 49669/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49670/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49678/tcp open msrpc Microsoft Windows RPC 49683/tcp open msrpc Microsoft Windows RPC 49698/tcp open msrpc Microsoft Windows RPC 49708/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC-VIL; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-09-06T17:11:24 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | nbstat: NetBIOS name: DC-VIL, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:85:62:4b (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | DC-VIL<00> Flags: <unique><active> | NINJA<00> Flags: <group><active> | NINJA<1c> Flags: <group><active> | DC-VIL<20> Flags: <unique><active> |_ NINJA<1b> Flags: <unique><active> Nmap scan report for 192.168.56.20 Host is up (0.010s latency). Not shown: 65512 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | rdp-ntlm-info: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: DC-AC | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: dc-ac.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan | Product_Version: 10.0.17763 |_ System_Time: 2025-09-06T17:11:16+00:00 | ssl-cert: Subject: commonName=dc-ac.academy.ninja.lan | Issuer: commonName=dc-ac.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T12:27:27 | Not valid after: 2026-03-03T12:27:27 | MD5: 1dd8:cd11:f35c:b997:c745:3e33:6040:6d15 |_SHA-1: 539b:7091:f7c8:f413:bad2:af88:fd35:b931:5431:54b8 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_ssl-date: 2025-09-06T17:12:07+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T10:53:13 | Not valid after: 2028-08-30T10:53:13 | MD5: b8ec:0505:79e5:9847:59ae:efff:47c2:36d1 |_SHA-1: 8209:f610:07b1:979d:615f:5529:1b79:9b52:be21:5cf8 | tls-alpn: |_ http/1.1 |_http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49668/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49669/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49671/tcp open msrpc Microsoft Windows RPC 49672/tcp open msrpc Microsoft Windows RPC 49680/tcp open msrpc Microsoft Windows RPC 49696/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC-AC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled and required | nbstat: NetBIOS name: DC-AC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:7d:fa:ab (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | DC-AC<00> Flags: <unique><active> | ACADEMY<00> Flags: <group><active> | ACADEMY<1c> Flags: <group><active> | DC-AC<20> Flags: <unique><active> |_ ACADEMY<1b> Flags: <unique><active> | smb2-time: | date: 2025-09-06T17:11:21 |_ start_date: N/A Nmap scan report for 192.168.56.21 Host is up (0.0037s latency). Not shown: 65529 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: Home Page - NHA - Ninja Hacker Academy | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE |_http-favicon: Unknown favicon MD5: 4859E39AE6C0F1F428F2126A6BB32BD9 |_http-server-header: Microsoft-IIS/10.0 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=web.academy.ninja.lan | Issuer: commonName=web.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:03:46 | Not valid after: 2026-03-03T13:03:46 | MD5: b886:6da8:9d70:ff44:af9c:0f2f:f1d1:28f2 |_SHA-1: 6552:4c8a:9e73:40a0:b928:290f:5560:9d7f:d998:8919 |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found |_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:08:22 | Not valid after: 2028-08-30T11:08:22 | MD5: f674:b4b9:ec3c:aeae:ec4c:031a:6a77:5ac7 |_SHA-1: 5d7e:83bf:fdfe:365d:31b0:0da7:d554:4c0f:e318:82b6 | tls-alpn: |_ http/1.1 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-09-06T17:11:26 |_ start_date: N/A Nmap scan report for 192.168.56.22 Host is up (0.011s latency). Not shown: 65334 closed tcp ports (reset), 183 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 445/tcp open microsoft-ds? 1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM | ms-sql-ntlm-info: | 192.168.56.22:1433: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SQL | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: sql.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan |_ Product_Version: 10.0.17763 |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-06T16:47:04 | Not valid after: 2055-09-06T16:47:04 | MD5: 9f06:0296:450f:8427:f3a4:67bb:b200:07c4 |_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877 | ms-sql-info: | 192.168.56.22:1433: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 1433 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=sql.academy.ninja.lan | Issuer: commonName=sql.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:09:00 | Not valid after: 2026-03-03T13:09:00 | MD5: cc00:a47b:79ef:3cf2:d604:307b:7770:e64c |_SHA-1: 3f38:0daa:a896:74a6:dcd7:61f3:a1e5:a228:9f79:e1da |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. |_http-server-header: Microsoft-HTTPAPI/2.0 | tls-alpn: |_ http/1.1 |_http-title: Not Found | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:27:52 | Not valid after: 2028-08-30T11:27:52 | MD5: d8b4:8b63:171e:2808:50c0:8439:cbd5:7516 |_SHA-1: 7c7e:2eb0:22ee:7445:1143:93b2:1df5:a60c:7eb4:6098 47001/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc Microsoft Windows RPC 49665/tcp open msrpc Microsoft Windows RPC 49666/tcp open msrpc Microsoft Windows RPC 49667/tcp open msrpc Microsoft Windows RPC 49670/tcp open msrpc Microsoft Windows RPC 49687/tcp open msrpc Microsoft Windows RPC 49688/tcp open msrpc Microsoft Windows RPC 49703/tcp open msrpc Microsoft Windows RPC 49705/tcp open msrpc Microsoft Windows RPC 49771/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. | ms-sql-ntlm-info: | 192.168.56.22:49771: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SQL | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: sql.academy.ninja.lan | DNS_Tree_Name: academy.ninja.lan |_ Product_Version: 10.0.17763 | ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback | Issuer: commonName=SSL_Self_Signed_Fallback | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-06T16:47:04 | Not valid after: 2055-09-06T16:47:04 | MD5: 9f06:0296:450f:8427:f3a4:67bb:b200:07c4 |_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877 | ms-sql-info: | 192.168.56.22:49771: | Version: | name: Microsoft SQL Server 2019 RTM | number: 15.00.2000.00 | Product: Microsoft SQL Server 2019 | Service pack level: RTM | Post-SP patches applied: false |_ TCP port: 49771 Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required | smb2-time: | date: 2025-09-06T17:11:30 |_ start_date: N/A | nbstat: NetBIOS name: SQL, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:7c:38:c9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) | Names: | SQL<00> Flags: <unique><active> | ACADEMY<00> Flags: <group><active> |_ SQL<20> Flags: <unique><active> Nmap scan report for 192.168.56.23 Host is up (0.0064s latency). Not shown: 65529 filtered tcp ports (no-response) Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 135/tcp open msrpc Microsoft Windows RPC 445/tcp open microsoft-ds? 3389/tcp open ms-wbt-server Microsoft Terminal Services |_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time. | rdp-ntlm-info: | Target_Name: ACADEMY | NetBIOS_Domain_Name: ACADEMY | NetBIOS_Computer_Name: SHARE | DNS_Domain_Name: academy.ninja.lan | DNS_Computer_Name: share.academy.ninja.lan | Product_Version: 10.0.17763 |_ System_Time: 2025-09-06T17:11:22+00:00 | ssl-cert: Subject: commonName=share.academy.ninja.lan | Issuer: commonName=share.academy.ninja.lan | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-01T13:05:14 | Not valid after: 2026-03-03T13:05:14 | MD5: c93e:9ae7:ae75:d73e:8380:0544:ee9f:e974 |_SHA-1: 31b8:262d:c57f:b50f:9136:4875:998a:258d:4a6d:2aad 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 5986/tcp open ssl/http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time. |_http-title: Not Found | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=VAGRANT | Subject Alternative Name: DNS:VAGRANT, DNS:vagrant | Issuer: commonName=VAGRANT | Public Key type: rsa | Public Key bits: 4096 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-31T11:50:41 | Not valid after: 2028-08-30T11:50:41 | MD5: 9ff1:46c7:e77e:b62b:324e:1d13:295c:3854 |_SHA-1: 75b7:f10a:8e39:9888:611c:077a:efe1:4c31:53d7:6173 |_http-server-header: Microsoft-HTTPAPI/2.0 49690/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2025-09-06T17:11:33 |_ start_date: N/A | smb2-security-mode: | 3:1:1: |_ Message signing enabled but not required NSE: Script Post-scanning. Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Initiating NSE at 19:12 Completed NSE at 19:12, 0.00s elapsed Post-scan script results: | clock-skew: | 0s: | 192.168.56.20 | 192.168.56.21 | 192.168.56.10 | 192.168.56.22 |_ 192.168.56.23 Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 5 IP addresses (5 hosts up) scanned in 311.47 seconds Raw packets sent: 662919 (29.168MB) | Rcvd: 71100 (2.847MB) While the scan was running, I started Responder in the Ubuntu VM to see if any hashes were captured, but after a long time, nothing came up. I used a custom Docker image with Responder installed. The Dockerfile can be found here and at the end of this blog post as a GitHub Gist. ...

GOAD (Game of Active Directory) NHA #1 - Installation

Hi guys, in this post I will be installing GOAD on a nested virtualization Ubuntu server. This is not the recommended way to install it, but I don’t have enough RAM on my other computer and it’s still viable (I already tested it with GOAD Light a few months ago). If you have enough RAM, I recommend installing it on a bare metal machine, the performance will be much better and the process is exactly the same. This installation is only valid for Linux machines, but GOAD can also be installed on Windows. ...

How I Successfully Bypassed Wordfence to Exploit SQLi in a Client's WordPress

This is the journey of how I successfully bypassed Wordfence WAF to exploit a SQL Injection in an updated WordPress and Wordfence. The vulnerability was present in a custom plugin developed for my client by a 3rd party. In this post I will explain how I discovered the vulnerability and how I exploited it, successfully bypassing Wordfence SQLi security measures. All the code used in this post can be found at the end of the post. For obvious reasons I will not share the client’s website or vulnerable code, instead I developed a simple lab with Docker. ...