Logging Direct Writeup - Redacted

This is a redacted version of the direct solve path with target-specific and solver-specific identifiers removed.

Placeholders

• <TARGET_IP>: target host IP
• <ATTACKER_IP>: attacker VPN IP
• <WORKDIR>: local working directory
• <MSA_HEALTH_NT_HASH>: recovered NT hash for msa_health$

Target

• Domain: logging.htb
• Hostname: DC01.logging.htb
• Initial creds: wallace.everette / Welcome2026@

1. Validate the supplied access

netexec smb <TARGET_IP> -u wallace.everette -p 'Welcome2026@'
netexec ldap <TARGET_IP> -u wallace.everette -p 'Welcome2026@'
netexec winrm <TARGET_IP> -u wallace.everette -p 'Welcome2026@'

Result:

• SMB works
• LDAP works
• WinRM does not

Enumerate shares:

netexec smb <TARGET_IP> -u wallace.everette -p 'Welcome2026@' --shares
netexec smb <TARGET_IP> -u wallace.everette -p 'Welcome2026@' --share Logs --dir .

Readable shares included:

• Logs
• NETLOGON
• SYSVOL