Whoami
  • Welcome
  • Home Lab: C2 Detection, Ransomware Defense & YARA Automation
    • SOC Lab – What is this Lab about ?
    • Part 1 - Setting Up the Environment
    • Part 2 - Detecting C2 Activity
    • Part 3 - Credential Dumping & Threat Detection
    • Part 4 - Blocking Ransomware
    • Part 5 - Reducing False Positives
    • Part 6 - Automated YARA Scanning
  • Automation Lab - Home Project
    • Sysmon Installation
    • Wazuh & TheHive: Installation, Configuration, and Optimization
    • Tracking Mimikatz Activity with Wazuh & Sysmon Logs
    • End-to-End Alert Automation: Wazuh → Shuffle → TheHive
  • Active Directory Attack Lab: Recon-to-Root
    • Reconnaissance Phase
      • 1. Full TCP Port Scan on Target Host
      • 2. Service and Version Detection
      • 3. Null Session SMB Enumeration
      • 4. LDAP Anonymous Bind Check
      • 5. Kerberos Username Enumeration
      • 6. Password Brute Force via SMB Login
    • Exploitation Phase
      • 7. Dump Domain Information via LDAP
      • 8. Perform Remote AD Recon with BloodHound
      • 9. Set Up Neo4j and Launch BloodHound GUI
      • 10. Abuse ForceChangePassword Right via RPC
      • 11. Validate New Credentials via WinRM
      • 12. Enumerate Local Privileges and AutoLogon
      • 13. Reuse Administrator Credentials
      • 14. Capture the User Flag
  • QRadar101 Lab Challenge
    • Scenario and Instructions
    • The Walkthrough
Powered by GitBook
On this page
  • Flag #1 :
  • Flag #2:
  1. Active Directory Attack Lab: Recon-to-Root
  2. Exploitation Phase

14. Capture the User Flag

Previous13. Reuse Administrator CredentialsNextQRadar101 Lab Challenge

Last updated 24 days ago

Flag #1 :

To read the flag from the sysadmin's desktop using evil-winrm, run this command after you're inside the WinRM session:

type C:\Users\sysadmin\Desktop\user.txt

Submit the contents of user.txt ⇒ 01c920617c6470cdf46ba5861ce701c2

Flag #2:

Read the final flag from administrator’s desktop indicating full system compromise.

type C:\Users\Administrator\Desktop\root.txt

Submit the contents of root.txt ⇒ 79bf6f60850f10211c290be19ccf8b95