BOXS // AFTER ACTION REPORT
GHOST MATCHOPERATOR EYES ONLY
TARGET
SAUNA
TARGET IP
OPERATOR
@kevin
RECON
→
ENUM
→
FOOTHOLD
→
POST-EXPL
→
PRIVESC
→
PWNED
DATE — 19 OCT 2026SESSION — Sauna — HackTheBox AD3 PRIOR RUNS ON RECORDGHOST — 0xdf - SaunaPREVIEW-
01MISSION METRICS
4h 31m
TOTAL DURATION
16260s elapsed
2h 15m
USER.TXT
from session start
4h 10m
ROOT.TXT
from session start
3
LOOT EXFIL
via boxs loot
12
VIEWERS
total during stream
7
INTEL FILED
operator logs
1h 55m
PRIV ESC
user → root delta
58
COMMANDS FIRED
detected keystrokes
14
TOOLS DEPLOYED
unique binaries
5
PHASES HIT
kill chain stages
02PHASE INTELLIGENCEKILL CHAIN TIMELINE
ENUM
FOOTHOLD
POST-EXPL
PRIVESC
RECON14m 15s6cmd
ENUM1h 15m22cmd
FOOTHOLD45m 00s8cmd
POST-EXPL35m 00s9cmd
PRIVESC1h 20m11cmd
PWNED21m 00s2cmd
PHASE COMMAND MAP
VORONOI · AREA ∝ EXECUTION COUNT
03OPERATIONAL TEMPOCOMMAND CADENCE
COMMANDS / 5-MIN WINDOW
04TOOLS MANIFESTARSENAL DEPLOYED
NETWORK RECON
nmap×4
ping×3
WEB ENUM
curl×6
gobuster×5
ffuf×3
SMB / AD
smbclient×3
enum4linux×2
kerbrute×2
CREDS / CRACK
hashcat×3
EXPLOIT
nc×2
REMOTE ACCESS
evil-winrm×5
impacket×4
POST-EXPL
mimikatz×2
winpeas×1
05FIRST CONTACTKEY MOMENTS
FIRST SHOT
nmap -sC -sV -oA sauna 10.10.10.175
T+45s
FOOTHOLD
evil-winrm -i 10.10.10.175 -u fsmith -p Thestrokes23
T+2h 15m
LAST ROUND
ROOT.TXT
T+4h 10m
06OPERATIONAL EFFICIENCYACTIVE / IDLE ANALYSIS
3h 29m
ACTIVE TIME
keyboard active
1h 02m
IDLE TIME
gaps > 5 min
77%
ACTIVE RATIO
time on target
3.8
CMD / MIN
command rate
2h 15m
TIME TO FOOTHOLD
initial access
2h 15m
TIME TO USER FLAG
user owned
4h 10m
TIME TO ROOT FLAG
root owned
07PHASE ANALYSISDWELL & REGRESSION
RECON1×14m 15s
5%
ENUM2×1h 15m
28%
FOOTHOLD1×45m 00s
17%
POST-EXPL1×35m 00s
13%
PRIVESC1×1h 20m
30%
PWNED1×21m 00s
8%
1 REGRESSION DETECTED
08BURST ANALYSISACTIVITY PATTERNS
LONGEST BURST
34m 00s
18 cmds · T+30m 00s
LONGEST IDLE
28m 00s
T+3h 00m
IDLE GAPS4gaps> 5 min
09GHOST INTEL0xdf - SaunaTARGET
@kevin
0xdf - SaunaGHOST
4h 31m
DURATION
GHOST ►
2h 02m
2h 15m
USER.TXT
GHOST ►
48m 00s
4h 10m
ROOT.TXT
GHOST ►
1h 50m
MILESTONE RACE
0xdf - Sauna
USR
ROOT
2h 02m
@kevin
USR
ROOT
4h 31m
DURATION +2h 29m ↓USER.TXT +1h 27m ↓ROOT.TXT +2h 20m ↓
10FIELD BASELINE3 PRIOR RUNS
PROGRESSION
DURATION−51m 30s ↑
@kevin
4h 31m
AVG
5h 22m
USER.TXT−21m 00s ↑
@kevin
2h 15m
AVG
2h 36m
ROOT.TXT−35m 00s ↑
@kevin
4h 10m
AVG
4h 45m
PERSONAL BEST:DUR 4h 09mUSER 2h 05mROOT 3h 50m
11FINDINGS5 FINDINGS · 3 CRIT/HIGH · 4 OPEN
2CRIT
1HIGH
1MEDI
1LOW
criticalCredentials in plaintext — autologon registry key exposes svc_loanmgr password
SAUNA9.8CONFIRMED
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon contains DefaultUserName and DefaultPassword in plaintext for the svc_loanmgr service account.
IMPACTService account credentials accessible to any local user or attacker with foothold. svc_loanmgr has DCSync rights — full domain compromise.
FIXRemove autologon registry keys. Use gMSA (Group Managed Service Accounts) for service accounts. Rotate svc_loanmgr password immediately.
criticalDCSync rights granted to non-DC account — svc_loanmgr can replicate directory
EGOTISTICAL-BANK.LOCAL9.9CONFIRMED
svc_loanmgr has DS-Replication-Get-Changes-All ACE on the domain object, allowing it to perform DCSync and dump all domain hashes including krbtgt.
IMPACTComplete domain compromise. Golden Ticket possible. Pass-the-Hash against any domain account including Administrator.
FIXRemove DS-Replication-Get-Changes-All from svc_loanmgr. Audit all accounts with replication rights. Rotate krbtgt password twice.
highAS-REP Roasting — fsmith account does not require Kerberos pre-authentication
SAUNA7.5CONFIRMED
The fsmith domain account has UF_DONT_REQUIRE_PREAUTH set, allowing offline cracking of the AS-REP hash without valid credentials.
IMPACTValid domain user hash recoverable by unauthenticated attacker on the same network. Password cracked in under 5 minutes with hashcat.
FIXRequire Kerberos pre-authentication for all user accounts. Enable it via ADUC → Account tab → uncheck "Do not require Kerberos preauthentication".
mediumLDAP anonymous bind enabled — user enumeration without credentials
SAUNA5.3OPEN
The LDAP service on port 389 allows anonymous binds, enabling enumeration of all domain users, groups, and computer objects without authentication.
IMPACTAttacker can enumerate valid usernames prior to authentication attempts, supporting targeted AS-REP roasting and password spraying.
FIXDisable anonymous LDAP binds. Set dsHeuristics attribute to disable unauthenticated queries. Enforce authentication for all LDAP access.
lowWinRM accessible from non-admin workstations
SAUNA3.8MITIGATED
Port 5985 (WinRM/HTTP) is reachable from attacker network position. Used for lateral movement once fsmith credentials were obtained.
IMPACTEnables remote PowerShell execution and evil-winrm sessions with valid credentials. Expands attack surface.
FIXRestrict WinRM access to management subnets only. Enforce firewall rules to allow 5985/5986 from jump hosts only.
BOXS PLATFORM // END OF REPORTPREVIEW-