Attacktive Directory Walkthrough
Hello friendo welcome on my walkthough room on TryHackMe is designed to teach users how to exploit common vulnerabilities in a Active Directory environment. The walkthrough would likely cover topics such as:
- Enumeration: Discovering information about the network, users, groups, and services.
- Initial Access: Gaining a foothold on a machine.
- Privilege Escalation: Elevating privileges to gain control of the domain.
- Credential Harvesting: Stealing credentials.
- Lateral Movement: Moving from one compromised machine to another.
lesss go 🚒
first thing start with scanning with nmap
and we have found the following ports open:
it’s seems like the machine is a windows server we will .
ok lets use Enum4Linux to
Task 3 Welcome to Attacktive Directory
What tool will allow us to enumerate port 139/445?
Answer : enum4linux
What is the NetBIOS-Domain Name of the machine?
Answer : THM-AD
What invalid TLD do people commonly use for their Active Directory Domain?
Answer : .local
Task 4 Enumerating Users via Kerberos
We will use a tool that does enumerate :
kerbrute userenum --
dc IP -d THM-AD user.txtand we found
What command within Kerbrute will allow us to enumerate valid usernames ?
Answer : userenum
What notable account is discovered? (These should jump out at you)
i searched alot for this and i got ,svc = Service Account The Service Account has administrative privileges.
Answer : svc-admin
What is the other notable account is discovered? (These should jump out at you)
the backup driver is often The ability to read all files.
Get MarioThomas’s stories in your inbox
Join Medium for free to get updates from this writer.
Answer : backup
task 5 Abusing Kerberos
After the enumeration of user accounts is finished, we can attempt to abuse a feature within Kerberos with an attack method called ASREPRoasting. ASReproasting occurs when a user account has the privilege “Does not require Pre-Authentication” set. This means that the account does not need to provide valid identification before requesting a Kerberos Ticket on the specified user account.
impacket-GetNPUsers THM-AD/svc-admin -no-pass -dc-ip IP - no-pass login without password.
- -dc-pass Domain Controller IP Connect specifically to this Domain Controller.
and we got the tgt for svc-admin , we will put the TGT in the file called TGT.txt to crack it
We have two user accounts that we could potentially query a ticket from. Which user account can you query a ticket from with no password?
Answer : svc-admin
Looking at the Hashcat Examples Wiki page, what type of Kerberos hash did we retrieve from the KDC? (Specify the full name)
Answer : Kerberos 5 AS-REP etype 23
What mode is the hash?
on the hashcat examples page , we will find a table containing :
Kerberos 5, etype 23, AS-REP — — — → 18200
Answer : 18200
Now crack the hash with the modified password list provided, what is the user accounts password?
Ok lets crack it.
booom we got the password 🔥
Now crack the hash with the modified password list provided, what is the user accounts password?
Answer : management2005
task 6 Back to the Basics
What utility can we use to map remote SMB shares?
smbclient -L //IP -U 'svc-adminThis command displays the available shares on the server using the svc-admin user.
Answer : smbclient
Which option will list shares?
Answer : -L
How many remote shares is the server listing?
Answer : 6
There is one particular share that we have access to that contains a text file. Which share is it?
ok lets try to get access to backup file <3.
smbclient //IP/backup -U 'svc-admin'
smb:\> ls 
