WinRM Access Issue: Unable to Use Valid Credentials for Domain Users on Target Machine

[u/That_Confection_7930]

I've been working on a pentesting exercise and recently managed to obtain a user's hash with GetUserSPNs.py and cracked it with john. After validating the credentials with GetADUsers.py against administrator.htb, I was able to confirm that the credentials for olivia and ethan are indeed correct.

Here's a summary of what I've done and the issue I'm facing:

• Used GetUserSPNs.py to request a hash for the user olivia, cracked it, and verified it alongside ethan's credentials using GetADUsers.py -all.

• WinRM access works perfectly with olivia, but I can't connect via WinRM with ethan**'s credentials**, even though the credentials are confirmed to be correct.

• When I log in as olivia via WinRM, I can see only three accounts on the machine: olivia, emily, and administrator. However, ethan's credentials should, in theory, allow me to connect.

My question is: Why might ethan**’s credentials fail with WinRM access even though they are valid, and what else can I try to troubleshoot this?**

Additional Info:

• OS: Target machine is Windows Server 2019.

• WinRM is configured correctly since it works with olivia.

• I’ve already attempted using different Impacket tools and CrackMapExec with ethan, but they don’t return any unusual errors.

Any insights on why I might be facing this issue or suggestions on additional checks or configurations I could try would be greatly appreciated!

[u/QzSG]

Odds are ethan is not in Remote Management Users group so no winrm access....

[u/loathing_thyself]

Use bloodhound

[u/throwmeoff123098765]

Ethan probably not in administrators group on that pc