BlogTwitterLinkedIn

🔒Reset (AD)

This challenge simulates a cyber-attack scenario where you must exploit an Active Directory environment.

Enumeración de Red

Autoscan

Scan general de puertos y scan específico de servicios y versiones
autoscan 10.10.162.86

Resultado nmap

PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2025-08-06 14:57:09Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: thm.corp0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2025-08-06T14:58:37+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=HayStack.thm.corp
| Not valid before: 2025-08-05T14:52:19
|_Not valid after:  2026-02-04T14:52:19
| rdp-ntlm-info: 
|   Target_Name: THM
|   NetBIOS_Domain_Name: THM
|   NetBIOS_Computer_Name: HAYSTACK
|   DNS_Domain_Name: thm.corp
|   DNS_Computer_Name: HayStack.thm.corp
|   DNS_Tree_Name: thm.corp
|   Product_Version: 10.0.17763
|_  System_Time: 2025-08-06T14:57:58+00:00
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
7680/tcp  open  pando-pub?
9389/tcp  open  mc-nmf        .NET Message Framing
49669/tcp open  msrpc         Microsoft Windows RPC
49670/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49671/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49702/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: HAYSTACK; OS: Windows; CPE: cpe:/o:microsoft:windows

  • Windows - Active Directory

    • DNS_Domain_Name: thm.corp

    • DNS_Computer_Name: HayStack.thm.corp

Enumeración SMB (Null Session)

  • eypjvoeb.s0l.txt

Contraseña potencial: ResetMe123!

  • mvlufahr.2zf.pdf

Usuario potencial: LILY_ONEILL

  • Nada útil

Enumeración RPC (Null Session)

result was NT_STATUS_ACCESS_DENIED

Enumeración LDAP

Enumeración de Dominio

Enumeración de Usuarios - Kerbrute

LogoGitHub - ropnop/kerbrute: A tool to perform Kerberos pre-auth bruteforcingGitHub

0 valid

RID Bruteforce - Crackmapexec

Usuarios Potenciales

Password Spraying - Crackmapexec

Credenciales: LILY_ONEILL:ResetMe123!

Enumeración de Dominio - Enum4linux-ng

  • Sin información extra

Enumeración Autenticada SMB Shares

Session Error - No authenticated (?)

AS-REP Roasting - Impacket

3 Hashes: ERNESTO_SILVA, TABATHA_BRITT y LEANN_LONG

Hash Cracked: TABATHA_BRITT:marlboro(1985)

Enumeración Autenticada SMB Shares II

Enumeración Autenticada de Dominio - BloodHound

Recolección

Información Extraída

TABATHA_BRITT → (generic_all) → SHAWNA_BRAY & RAQUEL_BENSON

The GenericAll permission grants [email protected] the ability to change the password of the user without knowing their current password. This is equivalent to the ForceChangePassword edge in BloodHound.

Escalada de Privilegios: Explotando ForceChangePassword

BloodHound info: SHAWNA_BRAY → (ForceChangePassword) → CRUZ_HALL

BloodHound info: CRUZ_HALL → (ForceChangePassword) → DARLA_WINTERS

Información de BloodHound

  • DARLA_WINTERS → (allowedToDelegate) → Computer: HAYSTACK.THM.CORP

The user [email protected] has the constrained delegation permission to the computer HAYSTACK.THM.CORP

The constrained delegation primitive allows a principal to authenticate as any user to specific services on the target computer. That is, a node with this permission can impersonate any domain principal (including Domain Admins) to the specific service on the target host. The alternative sname "cifs" is substituted in to the final service ticket. This grants the attacker the ability to access the file system of PRIMARY.testlab.local as the "admin" user.

Escalada de Privilegios: Explotando AllowedToDelegate

Compromiso del Sistema

Shell: Administrador

Última actualización