search
Linkedin

Skills Assessment - Password Attacks

hashtag
The Credential Theft Shuffle

The Credential Theft Shufflearrow-up-right, as coined by Sean Metcalf, is a systematic approach attackers use to compromise Active Directory environments by exploiting stolen credentials. The process begins with gaining initial access, often through phishing, followed by obtaining local administrator privileges on a machine. Attackers then extract credentials from memory using tools like Mimikatz and leverage these credentials to move laterally across the network. Techniques such as pass-the-hash (PtH) and tools like NetExec facilitate this lateral movement and further credential harvesting. The ultimate goal is to escalate privileges and gain control over the domain, often by compromising Domain Admin accounts or performing DCSync attacks. Sean emphasizes the importance of implementing security measures such as the Local Administrator Password Solution (LAPS), enforcing multi-factor authentication, and restricting administrative privileges to mitigate such attacks.

hashtag
Skills Assessment

Betty Jayde works at Nexura LLC. We know she uses the password Texas123!@# on multiple websites, and we believe she may reuse it at work. Infiltrate Nexura's network and gain command execution on the domain controller. The following hosts are in-scope for this assessment:

Host
IP Address

DMZ01

10.129.*.* (External), 172.16.119.13 (Internal)

JUMP01

172.16.119.7

FILE01

172.16.119.10

DC01

172.16.119.11

Pivoting Primer

The internal hosts (JUMP01, FILE01, DC01) reside on a private subnet that is not directly accessible from our attack host. The only externally reachable system is DMZ01, which has a second interface connected to the internal network. This segmentation reflects a classic DMZ setup, where public-facing services are isolated from internal infrastructure.

To access these internal systems, we must first gain a foothold on DMZ01. From there, we can pivot — that is, route our traffic through the compromised host into the private network. This enables our tools to communicate with internal hosts as if they were directly accessible. After compromising the DMZ, refer to the module cheatsheet for the necessary commands to set up the pivot and continue your assessment.

What is the NTLM hash of NEXURA\Administrator?

Scan DMZ01:

[Feb 06, 2026 - 13:41:26 (CET)] exegol-htb /workspace # TARGET=10.129.234.116
[Feb 06, 2026 - 13:41:32 (CET)] exegol-htb /workspace # nmap -sCV "$TARGET"  
Starting Nmap 7.93 ( https://nmap.org ) at 2026-02-06 13:41 CET
Nmap scan report for 10.129.234.116
Host is up (0.071s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 7108b0c4f3ca9757649770f9fec50c7b (RSA)
|   256 45c3b51463993d9eb32251e59776e150 (ECDSA)
|_  256 2ec2416646efb68195d5aa3523945538 (ED25519)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 4.13 seconds

We have an SSH potential acces. Use "Username Anarchy" to create a username list for Betty Jayde:

Try usernames generated with netexec:

We found a valid username, wo use it to connect via ssh:

We have access to DMZ01:

When we read the bash history of Betty, we found that:

So, we have news credentials for the user hwilliam.

Use chisel to get a proxy in the internal target network:

Scan DC01:

Scan FILE01:

Scan Jump01:

Enumerate SMB Shares on FILE01:

Access to HR:

Extract a specific password file:

Crack the .psafe3 file to get the password:

psafe3 is an extention from Password Safe, a database system for passwords.

Install it on our machine and add .pwsafe3 file and the password associate:

PreviousPassword ManagersNextInteracting with Common Services

Last updated