GOAD (Game of Active Directory) NHA #3 - Bypassing Defender and Achieving SYSTEM on SQL Host

Wed, 10 Sep 2025 16:22:03 +0200

After achieving RCE on the SQL host I proceeded to check the user’s privileges.

As this is a service account it has the SeImpersonatePrivilege privilege enabled. This is a direct pwn using the Potato or the PrintSpoofer binaries.

Knowing the way I will get NT AUTHORITY\SYSTEM on the SQL host, I proceeded to check if Defender is active.

I also confirmed I can access Kali from the Windows environment with an HTTP request:

GOAD (Game of Active Directory) NHA #2 - Initial Enumeration and First Code Execution

Sat, 06 Sep 2025 23:14:35 +0200

Initial enumeration

The first thing I did after installation and connectivity were set up was run an Nmap scan with the --top-ports 100 option (default) to quickly identify open ports and up hosts, since some Windows hosts do not respond to ICMP.

After that, I ran a full Nmap service scan on the discovered hosts with the common scripts and service version options.

┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40]
└─$ cat hosts.txt
192.168.56.10
192.168.56.20
192.168.56.21
192.168.56.22
192.168.56.23

┌──(kali㉿kali)-[~/…/GOAD NHA/Evidence/Scans/Service]-[2025-09-06 23:31:40]
└─$ sudo nmap -sS --open -iL hosts.txt -p- -n -Pn -sCV -v -T5 -oN ALL_ports.txt

Nmap scan report for 192.168.56.10
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-06T17:12:06+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=dc-vil.ninja.hack
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack
| Issuer: commonName=NINJA-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-02T14:15:35
| Not valid after:  2026-09-02T14:15:35
| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c
|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=dc-vil.ninja.hack
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack
| Issuer: commonName=NINJA-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-02T14:15:35
| Not valid after:  2026-09-02T14:15:35
| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c
|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=dc-vil.ninja.hack
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack
| Issuer: commonName=NINJA-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-02T14:15:35
| Not valid after:  2026-09-02T14:15:35
| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c
|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f
3269/tcp  open  ssl/ldap      Microsoft Windows Active Directory LDAP (Domain: ninja.hack0., Site: Default-First-Site-Name)
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=dc-vil.ninja.hack
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc-vil.ninja.hack
| Issuer: commonName=NINJA-CA
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-02T14:15:35
| Not valid after:  2026-09-02T14:15:35
| MD5:   66fe:7620:d7c3:d5b1:cda1:4d26:dcb4:1f6c
|_SHA-1: 6887:c456:112c:2ed8:94d3:0297:dd70:d59c:67aa:1a7f
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=dc-vil.ninja.hack
| Issuer: commonName=dc-vil.ninja.hack
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-01T12:29:13
| Not valid after:  2026-03-03T12:29:13
| MD5:   2f5b:ea35:1df1:d9a8:f7a5:a0ab:078b:1f05
|_SHA-1: 0ec2:e105:bb4e:a168:58ba:7e26:ff30:85aa:3a46:e89f
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
| ssl-cert: Subject: commonName=VAGRANT
| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant
| Issuer: commonName=VAGRANT
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-31T10:27:02
| Not valid after:  2028-08-30T10:27:02
| MD5:   70e6:540d:00ac:0a19:12ba:b2fd:ae3b:1509
|_SHA-1: 3365:8276:a074:3f12:0caa:04cf:1652:70cc:870c:d8a3
| tls-alpn: 
|_  http/1.1
|_http-server-header: Microsoft-HTTPAPI/2.0
|_ssl-date: 2025-09-06T17:12:05+00:00; 0s from scanner time.
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49669/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49670/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49678/tcp open  msrpc         Microsoft Windows RPC
49683/tcp open  msrpc         Microsoft Windows RPC
49698/tcp open  msrpc         Microsoft Windows RPC
49708/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC-VIL; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-09-06T17:11:24
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| nbstat: NetBIOS name: DC-VIL, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:85:62:4b (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| Names:
|   DC-VIL<00>           Flags: <unique><active>
|   NINJA<00>            Flags: <group><active>
|   NINJA<1c>            Flags: <group><active>
|   DC-VIL<20>           Flags: <unique><active>
|_  NINJA<1b>            Flags: <unique><active>

Nmap scan report for 192.168.56.20
Host is up (0.010s latency).
Not shown: 65512 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-09-06 17:10:15Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: academy.ninja.lan, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: ACADEMY
|   NetBIOS_Domain_Name: ACADEMY
|   NetBIOS_Computer_Name: DC-AC
|   DNS_Domain_Name: academy.ninja.lan
|   DNS_Computer_Name: dc-ac.academy.ninja.lan
|   DNS_Tree_Name: academy.ninja.lan
|   Product_Version: 10.0.17763
|_  System_Time: 2025-09-06T17:11:16+00:00
| ssl-cert: Subject: commonName=dc-ac.academy.ninja.lan
| Issuer: commonName=dc-ac.academy.ninja.lan
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-01T12:27:27
| Not valid after:  2026-03-03T12:27:27
| MD5:   1dd8:cd11:f35c:b997:c745:3e33:6040:6d15
|_SHA-1: 539b:7091:f7c8:f413:bad2:af88:fd35:b931:5431:54b8
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_ssl-date: 2025-09-06T17:12:07+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=VAGRANT
| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant
| Issuer: commonName=VAGRANT
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-31T10:53:13
| Not valid after:  2028-08-30T10:53:13
| MD5:   b8ec:0505:79e5:9847:59ae:efff:47c2:36d1
|_SHA-1: 8209:f610:07b1:979d:615f:5529:1b79:9b52:be21:5cf8
| tls-alpn: 
|_  http/1.1
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
49671/tcp open  msrpc         Microsoft Windows RPC
49672/tcp open  msrpc         Microsoft Windows RPC
49680/tcp open  msrpc         Microsoft Windows RPC
49696/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: DC-AC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| nbstat: NetBIOS name: DC-AC, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:7d:fa:ab (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| Names:
|   DC-AC<00>            Flags: <unique><active>
|   ACADEMY<00>          Flags: <group><active>
|   ACADEMY<1c>          Flags: <group><active>
|   DC-AC<20>            Flags: <unique><active>
|_  ACADEMY<1b>          Flags: <unique><active>
| smb2-time: 
|   date: 2025-09-06T17:11:21
|_  start_date: N/A

Nmap scan report for 192.168.56.21
Host is up (0.0037s latency).
Not shown: 65529 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
|_http-title: Home Page - NHA - Ninja Hacker Academy
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-favicon: Unknown favicon MD5: 4859E39AE6C0F1F428F2126A6BB32BD9
|_http-server-header: Microsoft-IIS/10.0
135/tcp  open  msrpc         Microsoft Windows RPC
445/tcp  open  microsoft-ds?
3389/tcp open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=web.academy.ninja.lan
| Issuer: commonName=web.academy.ninja.lan
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-01T13:03:46
| Not valid after:  2026-03-03T13:03:46
| MD5:   b886:6da8:9d70:ff44:af9c:0f2f:f1d1:28f2
|_SHA-1: 6552:4c8a:9e73:40a0:b928:290f:5560:9d7f:d998:8919
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
5986/tcp open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
|_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=VAGRANT
| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant
| Issuer: commonName=VAGRANT
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-31T11:08:22
| Not valid after:  2028-08-30T11:08:22
| MD5:   f674:b4b9:ec3c:aeae:ec4c:031a:6a77:5ac7
|_SHA-1: 5d7e:83bf:fdfe:365d:31b0:0da7:d554:4c0f:e318:82b6
| tls-alpn: 
|_  http/1.1
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-09-06T17:11:26
|_  start_date: N/A

Nmap scan report for 192.168.56.22
Host is up (0.011s latency).
Not shown: 65334 closed tcp ports (reset), 183 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
445/tcp   open  microsoft-ds?
1433/tcp  open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
| ms-sql-ntlm-info: 
|   192.168.56.22:1433: 
|     Target_Name: ACADEMY
|     NetBIOS_Domain_Name: ACADEMY
|     NetBIOS_Computer_Name: SQL
|     DNS_Domain_Name: academy.ninja.lan
|     DNS_Computer_Name: sql.academy.ninja.lan
|     DNS_Tree_Name: academy.ninja.lan
|_    Product_Version: 10.0.17763
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-06T16:47:04
| Not valid after:  2055-09-06T16:47:04
| MD5:   9f06:0296:450f:8427:f3a4:67bb:b200:07c4
|_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877
| ms-sql-info: 
|   192.168.56.22:1433: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 1433
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=sql.academy.ninja.lan
| Issuer: commonName=sql.academy.ninja.lan
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-01T13:09:00
| Not valid after:  2026-03-03T13:09:00
| MD5:   cc00:a47b:79ef:3cf2:d604:307b:7770:e64c
|_SHA-1: 3f38:0daa:a896:74a6:dcd7:61f3:a1e5:a228:9f79:e1da
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
|_http-server-header: Microsoft-HTTPAPI/2.0
| tls-alpn: 
|_  http/1.1
|_http-title: Not Found
| ssl-cert: Subject: commonName=VAGRANT
| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant
| Issuer: commonName=VAGRANT
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-31T11:27:52
| Not valid after:  2028-08-30T11:27:52
| MD5:   d8b4:8b63:171e:2808:50c0:8439:cbd5:7516
|_SHA-1: 7c7e:2eb0:22ee:7445:1143:93b2:1df5:a60c:7eb4:6098
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  msrpc         Microsoft Windows RPC
49687/tcp open  msrpc         Microsoft Windows RPC
49688/tcp open  msrpc         Microsoft Windows RPC
49703/tcp open  msrpc         Microsoft Windows RPC
49705/tcp open  msrpc         Microsoft Windows RPC
49771/tcp open  ms-sql-s      Microsoft SQL Server 2019 15.00.2000.00; RTM
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
| ms-sql-ntlm-info: 
|   192.168.56.22:49771: 
|     Target_Name: ACADEMY
|     NetBIOS_Domain_Name: ACADEMY
|     NetBIOS_Computer_Name: SQL
|     DNS_Domain_Name: academy.ninja.lan
|     DNS_Computer_Name: sql.academy.ninja.lan
|     DNS_Tree_Name: academy.ninja.lan
|_    Product_Version: 10.0.17763
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-06T16:47:04
| Not valid after:  2055-09-06T16:47:04
| MD5:   9f06:0296:450f:8427:f3a4:67bb:b200:07c4
|_SHA-1: 5093:43cb:c2fa:a3df:4f6e:a5e5:c08b:e336:9e2b:3877
| ms-sql-info: 
|   192.168.56.22:49771: 
|     Version: 
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 49771
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2025-09-06T17:11:30
|_  start_date: N/A
| nbstat: NetBIOS name: SQL, NetBIOS user: <unknown>, NetBIOS MAC: 08:00:27:7c:38:c9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
| Names:
|   SQL<00>              Flags: <unique><active>
|   ACADEMY<00>          Flags: <group><active>
|_  SQL<20>              Flags: <unique><active>

Nmap scan report for 192.168.56.23
Host is up (0.0064s latency).
Not shown: 65529 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT      STATE SERVICE       VERSION
135/tcp   open  msrpc         Microsoft Windows RPC
445/tcp   open  microsoft-ds?
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-09-06T17:12:06+00:00; +1s from scanner time.
| rdp-ntlm-info: 
|   Target_Name: ACADEMY
|   NetBIOS_Domain_Name: ACADEMY
|   NetBIOS_Computer_Name: SHARE
|   DNS_Domain_Name: academy.ninja.lan
|   DNS_Computer_Name: share.academy.ninja.lan
|   Product_Version: 10.0.17763
|_  System_Time: 2025-09-06T17:11:22+00:00
| ssl-cert: Subject: commonName=share.academy.ninja.lan
| Issuer: commonName=share.academy.ninja.lan
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-01T13:05:14
| Not valid after:  2026-03-03T13:05:14
| MD5:   c93e:9ae7:ae75:d73e:8380:0544:ee9f:e974
|_SHA-1: 31b8:262d:c57f:b50f:9136:4875:998a:258d:4a6d:2aad
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
5986/tcp  open  ssl/http      Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_ssl-date: 2025-09-06T17:12:06+00:00; 0s from scanner time.
|_http-title: Not Found
| tls-alpn: 
|_  http/1.1
| ssl-cert: Subject: commonName=VAGRANT
| Subject Alternative Name: DNS:VAGRANT, DNS:vagrant
| Issuer: commonName=VAGRANT
| Public Key type: rsa
| Public Key bits: 4096
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-08-31T11:50:41
| Not valid after:  2028-08-30T11:50:41
| MD5:   9ff1:46c7:e77e:b62b:324e:1d13:295c:3854
|_SHA-1: 75b7:f10a:8e39:9888:611c:077a:efe1:4c31:53d7:6173
|_http-server-header: Microsoft-HTTPAPI/2.0
49690/tcp open  msrpc         Microsoft Windows RPC
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2025-09-06T17:11:33
|_  start_date: N/A
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled but not required

NSE: Script Post-scanning.
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Initiating NSE at 19:12
Completed NSE at 19:12, 0.00s elapsed
Post-scan script results:
| clock-skew: 
|   0s: 
|     192.168.56.20
|     192.168.56.21
|     192.168.56.10
|     192.168.56.22
|_    192.168.56.23
Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 5 IP addresses (5 hosts up) scanned in 311.47 seconds
           Raw packets sent: 662919 (29.168MB) | Rcvd: 71100 (2.847MB)

While the scan was running, I started Responder in the Ubuntu VM to see if any hashes were captured, but after a long time, nothing came up. I used a custom Docker image with Responder installed. The Dockerfile can be found here and at the end of this blog post as a GitHub Gist.

GOAD (Game of Active Directory) NHA #1 - Installation

Fri, 29 Aug 2025 10:33:39 +0200

Hi guys, in this post I will be installing GOAD on a nested virtualization Ubuntu server. This is not the recommended way to install it, but I don’t have enough RAM on my other computer and it’s still viable (I already tested it with GOAD Light a few months ago). If you have enough RAM, I recommend installing it on a bare metal machine, the performance will be much better and the process is exactly the same. This installation is only valid for Linux machines, but GOAD can also be installed on Windows.

How I Successfully Bypassed Wordfence to Exploit SQLi in a Client's WordPress

Sun, 17 Aug 2025 11:37:48 +0200

This is the journey of how I successfully bypassed Wordfence WAF to exploit a SQL Injection in an updated WordPress and Wordfence. The vulnerability was present in a custom plugin developed for my client by a 3rd party. In this post I will explain how I discovered the vulnerability and how I exploited it, successfully bypassing Wordfence SQLi security measures. All the code used in this post can be found at the end of the post. For obvious reasons I will not share the client’s website or vulnerable code, instead I developed a simple lab with Docker.

Posts on emc2hf Blog

GOAD (Game of Active Directory) NHA #3 - Bypassing Defender and Achieving SYSTEM on SQL Host

GOAD (Game of Active Directory) NHA #2 - Initial Enumeration and First Code Execution

Initial enumeration

GOAD (Game of Active Directory) NHA #1 - Installation

How I Successfully Bypassed Wordfence to Exploit SQLi in a Client's WordPress