▚ tree ~/engagements/arcadia ×
.
├── creds/
│ ├── admin.ntlmv2 2.1K
│ └── svc_backup_id_rsa 1.7K
├── loot/
│ ├── kerb.txt 5.4K
│ ├── ntds/ 61M
│ └── svc_sql.nt 32B
├── scans/
│ ├── alltcp.nmap 4.0K
│ ├── detail.txt 2.8K
│ └── ffuf.json 18K
├── notes.md 3.1K
├── scope.txt 212B
└── tools/
├── linpeas.sh 840K
└── chisel 9.2M
▤ top - 23:14 ×
PIDUSER%CPU%MEMCOMMAND
▮ arc:0.0* zsh — 187x41
attached ×
≡ tcpdump -ni tun0 ×
≡ hashcat --status ×
Sessionhashcat
StatusCracked
Hash.Mode13100 (Kerberos 5, TGS-REP)
Recovered1/1 (100.00%)
Time.StartedTue Mar 11 22:36:57
Time.EstimatedTue Mar 11 22:41:09
Speed.#11004.1 kH/s
MSSQLSvc/sql01.arcadia.lan:1433
-> $krb5tgs$23$*svc_sql$ARCADIA.LAN$arcadia.lan/svc_sql~*$9b2f...
-> Summer2023!
▮ notes.md [+] ×
1# ARCADIA — internal penetration test
2window 2025-03-11 20:00 → 2025-03-15 06:00 EDT · taker k4n3
3
4## Findings
5| id | sev | title | host |
6|----|------|-----------------------------------------|-------------|
7| F1 | HIGH | backup archive exposed on :80/backup/ | 10.10.11.42 |
8| F2 | CRIT | credential reuse → svc_backup on AD | 10.10.11.50 |
9| F3 | CRIT | kerberoastable svc_sql ∈ Domain Admins | 10.10.11.50 |
10| F4 | CRIT | krbtgt hash recovered via DCSync | 10.10.11.50 |
11
12## Kill chain
13- perimeter 10.10.11.42 : 80/445 only
14- /backup/ dir+tar → mysql.conf.php → svc_backup:Arcadia!2024#db
15- ssh reuse → sudo rsync → root@web01 (GTFOBins)
16- /etc/hosts → dc01 10.10.11.50 → Pwn3d! → wmiexec
17- kerberoast svc_sql → Summer2023! → DA → DCSync
18
19## Remediation
20- remove /backup from docroot, rotate DB creds
21- drop NOPASSWD rsync, svc_sql out of Domain Admins
22- rotate krbtgt twice, reset all DA passwords
-- NORMAL --
notes.md22L, 1.9K
utf-8unix1,1All
≡ ss -antp ×
State Local Address:Port Peer Address:Port Process
LISTEN 127.0.0.1:1080 0.0.0.0:* ssh -D
LISTEN 127.0.0.1:4444 0.0.0.0:* sliver
LISTEN 0.0.0.0:9050 0.0.0.0:* tor
ESTAB 10.10.14.7:54322 10.10.11.42:22 ssh
ESTAB 10.10.14.7:54318 10.10.11.50:88 proxychains
ESTAB 10.10.14.7:54319 10.10.11.50:389 proxychains
ESTAB 10.10.14.7:54340 10.10.11.42:80 firefox
TIME_WAIT 10.10.14.7:54351 10.10.11.61:445