ATTACKTIVE DIRECTORY
This report details the systematic exploitation of the Attacktive Directory machine on TryHackMe. The objective of this lab is to audit and exploit common vulnerabilities and misconfigurations within a Windows Active Directory (AD) environment.
1: Reconnaissance & Network Scanning
The assessment began with an aggressive infrastructure scan using nmap to discover open ports, active services, and operating system specifics on the target Domain Controller.
- Identified Domain Name (NetBIOS):
THM-AD - Identified Full Domain Name (FQDN):
spookysec.local(added to/etc/hostsfor proper domain routing during exploitation).
2: Installing Impacket:
First, you will need to clone the Impacket Github repo onto your box. The following command will clone Impacket into /opt/impacket:
git clone https://github.com/SecureAuthCorp/impacket.git /opt/impacket
After the repo is cloned, you will notice several install related files, requirements.txt, and setup.py. A commonly skipped file during the installation is setup.py, this actually installs Impacket onto your system so you can use it and not have to worry about any dependencies.
To install the Python requirements for Impacket:
pip3 install -r /opt/impacket/requirements.txt
Once the requirements have finished installing, we can then run the python setup install script:
cd /opt/impacket/ && python3 ./setup.py install
3: Enumeration
SMB & NetBIOS Enumeration
Using enum4linux to map out the exposed SMB architecture, initial unauthenticated NULL session configurations were verified.
User Enumeration via Kerberos
Because Kerberos responds differently to valid vs. invalid usernames (even without password authentication), kerbrute was deployed alongside a user list to passively harvest valid domain accounts.
4: Exploitation (Initial Access)
AS-REP Roasting Attack
With a verified list of valid usernames, the svc-admin account was audited for the "Do not require Kerberos preauthentication" misconfiguration. This allows an attacker to request a Kerberos ticket granting service (TGS) session for that user without providing a password.
Get Gourirajan’s stories in your inbox
Join Medium for free to get updates from this writer.
The hash was cracked using hashcat (Mode 18200) or john, revealing the plaintext password for svc-admin.
Enumerating SMB Shares (smbclient)
With the valid domain credentials recovered for the svc-admin account, the next step was to inspect the Server Message Block (SMB) shares to see if any sensitive directories were accessible to standard domain users.
5: Privilege Escalation & Domain Compromise
Secrets Dumping & Backup Misconfiguration
With structural domain access as svc-admin, further inspection of high-privilege operations revealed that the backup user account possessed elevated synchronization capabilities. Using the backup account context or direct structural flaws, an extraction of the main Active Directory database file (NTDS.dit) was targeted.
Impacket’s secretsdump.py was used against the domain controller to dump the NT password hashes of all users stored within the AD architecture:
6: FINDING THE FLAG
Pass-the-Hash Execution
Using the extracted Administrator NTLM hash, there was no need to crack the password. Authenticated access was gained directly via a Pass-the-Hash (PtH) attack using tools like psexec.py or evil-winrm:
