Part 3: Hacking Lumon Industries (Active Directory)
Source: YouTube · Tyler Ramsbey - Hack Smarter · published Aug 20, 2026 · 17:59
BLUF:
This video demonstrates how to escalate privileges in the Lumen Industries Active Directory lab by exploiting an internal web application to steal service account hashes and achieve full user compromise 10:49. The attacker leverages command execution vulnerabilities and file share enumeration to crack the "Intranet SVC" password, opening new attack vectors 14:56.
Key Takeaways:
- BloodHound Analysis: After compromising the user "HarmonyC," the attacker used BloodHound to identify membership in the "Administration" group, suggesting potential lateral movement paths 2:30.
- Web Application Enumeration: Logging into the internal web portal as HarmonyC revealed new administrative features, specifically a "Terminal" and "Admin Panel," which were not visible to lower-privileged users 4:42.
- Command Execution Vulnerability: The attacker discovered that the "Ping Server" feature in the admin panel was vulnerable to command injection, allowing for remote code execution as the "Lumen Internet SVC" user 8:31.
- Hash Stealing via File Shares: By using the "Browse File Share" feature to point to the attacker's IP, the attacker triggered an authentication request that was captured by Responder, successfully stealing the NTLM hash of the Intranet SVC account 10:49.
- Credential Cracking: The stolen hash was quickly cracked using standard tools, revealing the password "services since 1979" for the service account 14:56.
Closing statement:
This phase highlights the critical importance of auditing internal web applications for insecure features like ping utilities and file share browsers. By combining these weaknesses, the attacker successfully pivoted from a standard user to a service account, significantly expanding the attack surface for future privilege escalation attempts.
Sources:
- 2:30 BloodHound analysis showing HarmonyC's group memberships.
- 4:42 Discovery of new admin panel and terminal access via HarmonyC credentials.
- 8:31 Exploitation of command injection in the ping tool.
- 10:49 Stealing the Intranet SVC hash using Responder and file share enumeration.
- 14:56 Cracking the service account hash to reveal the plaintext password.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What is up, everyone? Welcome back to another video. This video is going to be part three of working through the Lumen Industries Active Directory Multi-Machine AD Lab. That is a lot to say. On the Hack Smarter platform. Now, this is part three, so if this is the first video that you're watching, I would suggest rewinding back to part one and working your way through the series from the beginning. Also, you will learn a lot by watching me. You're going to learn even more by hacking alongside of me. So, if you haven't already, head over to hacksmater.org, sign up for a subscription, and launch the Lumen Industries lab. Hands on your keyboard, black hoodie on all of the stuff, so that we can hack all of the things together. All that being said, we're going to pick up right where we left off …