Dump Walkthrough

Challenge Statement#

Attachment: Dump.docx

Solution#

We are provided with a Local Security Authority Subsystem Service (LSASS) dump, which contains all the hashes of all the users.
We can do a nmap scan of the target, to see what services are running.

Now, we know that Windows Remote Management (WinRM) is running on port 5985.
We can use Evil-WinRM with the dump information to get a Reverse shell.

Now, we can just traverse through the system and obtain the flag.

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.