TryHackMe: Year of the Owl Walkthrough & Write-up

Introduction
"Year of the Owl" is an intermediate-level Windows machine available on TryHackMe. It presents a realistic pentesting scenario starting from reconnaissance, exploiting SNMP enumeration, password spraying via WinRM/SMB, recovering SAM and SYSTEM backup hives from the Recycle Bin, cracking password hashes with Impacket, and finally escalating privileges to Administrator.

In this write-up, we will walk through the complete enumeration and exploitation chain step-by-step.

---

Phase 1: Reconnaissance & Port Scanning

We start by running an initial Nmap scan to identify open ports and services on the target machine (10.67.173.83).

Further UDP SNMP enumeration reveals port 161/udp open/filtered. We can use Metasploit to enumerate users through SNMP.

Using the community string openview, the SNMP enumeration successfully discovers 5 user accounts on the system:

• Administrator
• DefaultAccount
• Guest
• Jareth
• WDAGUtilityAccount

---

Phase 2: Credential Stuffing & Password Spraying

With the discovered username jareth, we proceed to perform credential stuffing and password spraying against SMB (445) and WinRM (5985) using crackmapexec combined with the standard rockyou.txt wordlist.

After iterating through the wordlist, a valid match is found for user jareth:

• Password Found: sarah (marked as Pwn3d!)

---

Phase 3: Initial Access via WinRM

Now that we have valid credentials (jareth:sarah), we can establish an interactive remote shell using evil-winrm.

Once connected, we navigate to Jareth's desktop and retrieve the user flag (user.txt):

• User Flag: THM{Y2I0NDJjODY2YmI2Y2U4M2IwZT81}

---

Phase 4: Privilege Escalation & Hive Recovery

To escalate our privileges, we inspect system privileges and search for sensitive files or backups. While investigating the file system, we locate registry backup hives stored inside the Recycle Bin ($Recycle.bin).

We locate sam.bak and system.bak inside the Recycle Bin directory for the user SID. We copy these files locally to Jareth's directory and download them to our attacking machine using the built-in evil-winrm download command.

Back on our Kali Linux attacker machine, we use impacket-secretsdump to extract the NTLM password hashes from the offline SAM and SYSTEM backup hives.

The hash dump successfully reveals the NTLM password hashes for all local accounts, including the Administrator:

• Administrator Hash: aad3b435b51404eeaad3b435b51404e:6bc99e9edcfecf9662fb0c0ddcf7a7a

---

Phase 5: Gaining Administrator Access & Root Flag

Armed with the Administrator hash, we perform a Pass-the-Hash (PtH) attack via evil-winrm to connect directly as the Administrator.

Finally, we navigate to the Administrator's desktop, read admin.txt, and capture the final root flag:

• Root Flag: THM{YWFiZTM1MjFjMzRiODgyY1wyUwyZlZWM2}

---

Conclusion
"Year of the Owl" is an exceptionally well-designed lab that highlights the risks of:

1. Information leakage via SNMP.
2. Weak password policies and password spraying vulnerabilities over WinRM/SMB.
3. Leaving sensitive backup files (like SAM and SYSTEM hives) inside the Recycle Bin.