Credentials Harvesting

Prompts and answers

• Using the "reg query" command, search for the value of the "flag" keyword in the Windows registry?
  7tyh4ckm3
• Enumerate the AD environment we provided. What is the password of the victim user found in the description section?
  Passw0rd!@#
• Follow the technique discussed in this task to dump the content of the SAM database file. What is the NTLM hash for the Administrator account?
  98d3a787a80d08385cea7fb4aa2a4261
• Is the LSA protection enabled? (Y|N)
  Y
• Apply the technique for extracting clear-text passwords from Windows Credential Manager. What is the password of the THMuser for internal-app.thm.red?
  E4syPassw0rd
• Use Mimikatz to memory dump the credentials for the 10.10.237.226 SMB share which is stored in the Windows Credential vault. What is the password?
  jfxKruLkkxoPjwe3
• Run cmd.exe under thm-local user via runas and read the flag in "c:\Users\thm-local\Saved Games\flag.txt". What is the flag?
  THM{RunA5S4veCr3ds}
• Apply the technique discussed in this task to dump the NTDS file locally and extract hashes. What is the target system bootkey value? Note: Use thm.red/thm as an Active Directory user since it has administrator privileges!
  0x36c8d26ec0df8b23ce63bcefa6e2d821
• What is the clear-text password for the bk-admin username?
  Passw0rd123
• Which group has ExtendedRightHolder and is able to read the LAPS password?
  LAPsReader
• Follow the technique discussed in this task to get the LAPS password. What is the LAPs Password for Creds-Harvestin computer?
  THMLAPSPassw0rd
• Which user is able to read LAPS passwords?
  bk-admin
• Enumerate for SPN users using the Impacket GetUserSPNs script. What is the Service Principal Name for the Domain Controller?
  svc-thm
• After finding the SPN account from the previous question, perform the Kerberoasting attack to grab the TGS ticket and crack it. What is the password?
  Passw0rd1