Sauna

Verified writeups for the Sauna machine of Hack The Box

Sauna

$ tldr AS-REP Roasting → autologon → DCSync

·	·
Operating system	Windows
Difficulty	Easy
Vector	Active Directory
IP	10.10.10.175
Retirement date	2020-02-15
Skills	Information Leakage Ldap Enumeration Kerberos User Enumeration - Kerbrute ASRepRoast Attack (GetNPUsers) Cracking Hashes System Enumeration - WinPEAS AutoLogon Credentials BloodHound - SharpHound.ps1 DCSync Attack - Secretsdump [Privilege Escalation] PassTheHash

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Information Leakage	HackTricks	Open
Cracking Hashes (hashcat / John)	HackTricks	Open
BloodHound	HackTricks	Open
BloodHound	BloodHound docs	Open
GetNPUsers (Impacket)	HackTricks	Open
AutoLogon credentials	HackTricks	Open
winPEAS	PEASS-ng	Open
DCSync	HackTricks	Open

Related skills worth mastering

Active Directory · Kerberoasting · Brute Force / Rate-Limit Bypass

If you liked this machine, try

• Forest — Windows, Easy
• Scrambled — Windows, Medium
• Acute — Windows, Hard
• APT — Windows, Insane
• StreamIO — Windows, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07