> For the complete documentation index, see [llms.txt](https://abdulazim.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abdulazim.gitbook.io/write-up/hacksmarter-write-up/edge.md).
# Edge
Windows Box- Easy Rated. Simulate client want to do 'assumed breach' scenario.
Credential Provided:
```
Username: jmorris
Password: Fabricat!on2024
```
#### #Step 1 Nmap Scan Result
```zsh
# Nmap 7.99 scan initiated Tue Jun 2 02:10:24 2026 as: /usr/lib/nmap/nmap -sS -sV -sC -oN nmap_result.txt 10.0.27.83
Nmap scan report for 10.0.27.83
Host is up (0.30s latency).
Not shown: 996 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
135/tcp open msrpc Microsoft Windows RPC
445/tcp open microsoft-ds?
3389/tcp open ms-wbt-server
| rdp-ntlm-info:
| Target_Name: VANTARAOPS
| NetBIOS_Domain_Name: VANTARAOPS
| NetBIOS_Computer_Name: VANTARAOPS
| DNS_Domain_Name: VantaraOps
| DNS_Computer_Name: VantaraOps
| Product_Version: 10.0.26100
|_ System_Time: 2026-06-02T06:11:08+00:00
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=VantaraOps
| Not valid before: 2026-05-08T12:26:38
|_Not valid after: 2026-11-07T12:26:38
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3389-TCP:V=7.99%I=7%D=6/2%Time=6A1E73EE%P=x86_64-pc-linux-gnu%r(Ter
SF:minalServerCookie,13,"\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02/\x08\0\x02\0\
SF:0\0");
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb2-time:
| date: 2026-06-02T06:11:09
|_ start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jun 2 02:11:50 2026 -- 1 IP address (1 host up) scanned in 86.74 seconds
```
#### #Step 2 Enumerate SMB Shares Folder.
When enumerating the SMB Shares folder using provided credential nothing interesting.
#### #Step 3 Evil-WinRM
Try using Evil-WinRM tool with provided credentials. Get access. Try checking user privilege nothing interesting.
#### #Step 4 Checking Machine Process
Checking the machine process and found "msedge" which is Edge running in that machine.
After googling around probably we can try use EdgeSnapper.
{% embed url="" %}
#### #Step 5 Creating the EdgeSnapper.
Use that command to build the EdgeSnapper.
```zsh
// To compile on Linux:
x86_64-w64-mingw32-g++ edgeSnapper.cpp -o edgeSnapper.exe -static -static-libgcc -static-libstdc++ -ldbghelp -lpsapi
```
#### #Step 6 Uploading the EdgeSnapper
Uploding the EdgeSnapper using Evil-WinRM
#### Step 7 Running the EdgeSnapper
Running EdgeSnapper and found creds that stored in the edge. Attacker found another interesting account which is 'svc\_vdi'
#### Step 8 Authenticate the svc\_vdi account
Authenticate the svc\_vdi account using nxc against smb service. legit creds we have here.
#### Step 9 RDP with svc\_vdi account
Successful RDP with the new creds. Seems like kind of portal. Using that creds attacker can login to the portal.
#### Step 10 Download cmd.exe
In portal earlier, scroll down and will found support url. Need to click a few times until it pop up edge browser.
At the address bar we can enter something like:
> `C:\windows\system32\cmd.exe`
After that, open the cmd.exe and we will have terminal as svc\_vdi.
#### Step 11 Enumerate Inside svc\_vdi
Enumerating the svc\_vdi account. Can use command
```
tree /f
```
This command will list out all the directory and file inside an account.
Found interesting file called putty.conf. After check that file and found another creds.
#### Step 12 Authenticate the new creds
Authenticate the new creds using nxc. And surprisingly, we have admin account.
#### Step 13 Using Evil-WinRM with admin creds
Evil-WinRM using admin creds. Moving and enumerate to Adminstrator account. And got the flag.
