> For the complete documentation index, see [llms.txt](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/hack-smarter-labs/past-active-directory.md). # Past - Active Directory Medium Rated Lab - Hack Smarter Labs ## Objective * You have been hired by Hack Smarter to perform a Penetration Test on Past Systems Inc. During your call with the client, they stated they are currently adding new machines to the network. The client has provided you with VPN access to their internal network, but no credentials. ## Initial Scan ### RustScan {% code overflow="wrap" expandable="true" %} ``` rustscan -a 10.1.59.204 -- -A -Pn > Past_scan.txt PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 126 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-06-12 13:10:52Z) 135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: past.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds syn-ack ttl 126 Windows Server 2016 Datacenter 14393 microsoft-ds (workgroup: PAST) 464/tcp open kpasswd5? syn-ack ttl 126 593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 126 3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: past.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 126 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services | ssl-cert: Subject: commonName=EC2AMAZ-A5O4OL8.past.local | Issuer: commonName=EC2AMAZ-A5O4OL8.past.local | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2026-01-22T21:35:11 | Not valid after: 2026-07-24T21:35:11 | MD5: 0e0c cec2 30ec 55af 7032 e682 473b 0bf7 | SHA-1: 164d 0236 41b1 d5a8 5733 20cf 9147 8aba d69b 8b7f | SHA-256: 9e51 39e4 678b 61ae c63f ae67 b3a4 f637 5352 0f03 fcf3 d6d5 386e 70c7 6b38 6ca4 | -----BEGIN CERTIFICATE----- | MIIC+DCCAeCgAwIBAgIQSyu7LEh/qqJO3cu7jKD8IjANBgkqhkiG9w0BAQsFADAl | MSMwIQYDVQQDExpFQzJBTUFaLUE1TzRPTDgucGFzdC5sb2NhbDAeFw0yNjAxMjIy | MTM1MTFaFw0yNjA3MjQyMTM1MTFaMCUxIzAhBgNVBAMTGkVDMkFNQVotQTVPNE9M | OC5wYXN0LmxvY2FsMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnlSg | RjG/env4rsB/g+JZM8j2HKiIynaCHL0nOZAwVVk8HZbm/1Wp6Q6vgQtTUxxsEYLt | JyYZZB+5lQXhFlLUt4ig5saPNmpycx9wlaH7kH9VgOUFCxsitFUr/LHC9AudFLms | KmBNpYZehkKOTrMBe7f4ez0M2dRE2kN4BQ5W9LHGbBD8K4IhAybOOW6x9IVz/tnm | hkGeWk7JoBJ2UhgOlk728QStCNc+3O+3K3BGpQR6dNYv29K4WGnJ1kaWiuPgBh58 | POT3usGHmuOcZtRV+Mq2nO1Ucxs71C0ZF3D5Dkv/gkd11MUB0q4lc2+8b+RV8Vwr | nzZe8+0qT/ha85dt8QIDAQABoyQwIjATBgNVHSUEDDAKBggrBgEFBQcDATALBgNV | HQ8EBAMCBDAwDQYJKoZIhvcNAQELBQADggEBAD8e5X21Svad3JpA8W2kbjAG2R2m | dgs0VqSiivBo27ARsL3hwbIAPyCBzkKVB4N+nVFTzmd8BSf9wNezDlD71stbEw7C | P1tlyNCu094XKQPQzwDshpSIvppqAyGc3pEDO4tJikEQkh/WcQt0cTdnkk2kc8Ai | Q0JbAGloB+YZtdVLuYvc5AQKeBlathm513EnZMRPHDfVjfULyX9EYWRBwhOhENGD | eklgT5CQNy4yk391S1lE87aXdW8y6233KifFiFLfhmfj1+x6t+jGmoKwQD3rp1SW | l/cdEydRLQMavIsxxagM7hGVejufQjLO6mOtXoBncekUERW/CIM8HYI5mVY= |_-----END CERTIFICATE----- |_ssl-date: 2026-06-12T13:12:35+00:00; -2s from scanner time. | rdp-ntlm-info: | Target_Name: PAST | NetBIOS_Domain_Name: PAST | NetBIOS_Computer_Name: EC2AMAZ-A5O4OL8 | DNS_Domain_Name: past.local | DNS_Computer_Name: EC2AMAZ-A5O4OL8.past.local | Product_Version: 10.0.14393 |_ System_Time: 2026-06-12T13:11:56+00:00 5985/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing 47001/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49668/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49673/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49674/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 49675/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49676/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49689/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49705/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 52885/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose Running (JUST GUESSING): Microsoft Windows 2016|2012 (87%) OS CPE: cpe:/o:microsoft:windows_server_2016 cpe:/o:microsoft:windows_server_2012:r2 OS fingerprint not ideal because: Missing a closed TCP port so results incomplete Aggressive OS guesses: Microsoft Windows Server 2016 (87%), Microsoft Windows Server 2012 R2 (85%) No exact OS matches for host (test conditions non-ideal). TCP/IP fingerprint: SCAN(V=7.98%E=4%D=6/12%OT=53%CT=%CU=%PV=Y%DS=3%DC=T%G=N%TM=6A2C05C6%P=x86_64-pc-linux-gnu) SEQ(SP=107%GCD=1%ISR=109%TI=I%TS=A) SEQ(SP=109%GCD=1%ISR=10B%TI=I%TS=A) OPS(O1=M510NW8ST11%O2=M510NW8ST11%O3=M510NW8NNT11%O4=M510NW8ST11%O5=M510NW8ST11%O6=M510ST11) WIN(W1=2000%W2=2000%W3=2000%W4=2000%W5=2000%W6=2000) ECN(R=Y%DF=Y%TG=80%W=2000%O=M510NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=N) Uptime guess: 0.006 days (since Fri Jun 12 09:03:56 2026) Network Distance: 3 hops TCP Sequence Prediction: Difficulty=263 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: EC2AMAZ-A5O4OL8; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb-os-discovery: | OS: Windows Server 2016 Datacenter 14393 (Windows Server 2016 Datacenter 6.3) | Computer name: EC2AMAZ-A5O4OL8 | NetBIOS computer name: EC2AMAZ-A5O4OL8\x00 | Domain name: past.local | Forest name: past.local | FQDN: EC2AMAZ-A5O4OL8.past.local |_ System time: 2026-06-12T13:11:57+00:00 |_clock-skew: mean: 0s, deviation: 1s, median: -1s | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 19539/tcp): CLEAN (Timeout) | Check 2 (port 19169/tcp): CLEAN (Timeout) | Check 3 (port 50929/udp): CLEAN (Timeout) | Check 4 (port 48870/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-time: | date: 2026-06-12T13:11:59 |_ start_date: 2026-06-12T13:04:25 | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb-security-mode: | account_used: guest | authentication_level: user | challenge_response: supported |_ message_signing: required ``` {% endcode %} ## Initial Enumeration ### SMB (445) * We do not have creds to start off with. I will start by seeing if I can establish a NULL smb session or if the guest user account is active. We will see that we have READ access on the 'Share' SMB share as the guest user:
* I will recursively scan the Share SMB share to see what is available: {% code overflow="wrap" expandable="true" %} ``` smbmap -H 10.1.59.204 -u 'guest' -p '' -r Share --depth 10 ``` {% endcode %}
* I will download this file now using the following command: {% code overflow="wrap" expandable="true" %} ``` smbmap -H 10.1.59.204 -u 'guest' -p '' -r Share --depth 10 --download 'Share\AD_machines.txt' ``` {% endcode %} * The file appears to be a list of hosts that are being added or have been added to the network:
* Conducting a rid-brute shows the following users, group, and computer accounts. I will take these name and create a wordlist:
## TimeRoasting Attack * We know that we do not have any credentials at this time. Conducting research from this matrix (in the no credentials section), I found TimeRoasting as an option. There is a Netexec module that allows this to take place . * TimeRoasting per this article is when "Domain-joined computers synchronize time using the well-known Network Time Protocol (NTP), where a Domain Controller acts as a time server. A problem with traditional NTP is that it is not authenticated, and that MitM attackers could spoof response packets and therefore mess with the client’s clock." * "When a system needs to synchronize its clock, it will include the RID of its computer account to an extension field in the NTP request. Then, the server will add a cryptographic Message Authentication Code (MAC) of the response that uses the NTLM hash (i.e. MD4 hash) of the computer account password as a key." * "Note that the client does not actually have to authenticate itself to the NTP server. It can just pick any RID and the server will look up the corresponding password and authenticate the response with it. This system does have the side-effect that an unauthenticated party can ask for what amounts to a salted password hash of every computer account in the domain" * So, what does this all mean? This means that, since this method is unauthenticated and we can choose any RID, we can attempt to get the salted password hash for any/every computer account and possibly gain access if we can crack the hash. We previously established the names of the computer accounts to their RIDs using Netexec. * We can attempt to gain access to these computer accounts passwords now. I will begin by running the Netexec timeroast module:
* We are able to gain access to the salted password hashes. Next, we can attempt to crack them. There is a Hashcat mode that we can use to crack this password. Now, we will simply compare to the hash to our list to find the correct machine account:
## LDAP/ACEs and Bloodhound Enumeration * Nice, we now have a computer account that we control and have the correct password. Now, we can conduct enumeration of LDAP and ACEs. We will see that the computer account we control has the following UAC:
* I will go ahead and grab Bloodhound output as well to have it. * Taking a look for any delegation permissions, I can see that there is RBCD on DEV01$ for the user tyler. This means that we can, if we control tyler, we can impersonate any user on DEV01$. Good to note down:
* I will go back and enumerate some more as the there is not much that I can really find after enumerating with the user that I have. Going back to the SMB shares, I see that I have READ access to the SYSVOL. This might be beneficial to look at again as there could possibly be a script-path exploit we can use to gain access. * Upon enumerating the scripts directory, I find the following file:
* Intriguing, there appears to be an initialization command prompt file. Think of this similar or related to batch scripts. Upon grabbing and reviewing the file, I find the following username 'tyler' and password:
## Gaining Access as User 'tyler' * Ok, we run into an issue and that is the fact that the user 'tyler' has account restrictions and is a member of the Protected Users group, so we do not have full access as this user:
* Let's see if we can possibly change our status as the user 'tyler' and gain more access with this user. To do this, we will request a Kerberos TGT to prove the user 'tyler' identity. This will allow me the ability to gain access to the users permissions. Since the user is part of the Protected Group, this affects/restricts how we authenticate to the host, which is why, when using the password, we were restricted:
* Now that we have this TGT, we will export it and attempt to auth using Kerberos:
* Perfect, we are able to gain access using the Kerberos TGT we obtained. ## Resource Based Constrained Delegation (RBCD) * Now, we can conduct RBCD against the DC. We will first start by setting a machine account that we control: {% code overflow="wrap" expandable="true" %} ``` ┌──(kali㉿kali)-[~/HackSmarterLabs/Past] └─$ impacket-addcomputer -method SAMR 'past.local/tyler' -k -no-pass -dc-host 'EC2AMAZ-A5O4OL8.past.local' -computer-name pwned$ -computer-pass 'pwned123!' Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Successfully added machine account pwned$ with password pwned123!. ``` {% endcode %} * Next, we need to allow for RBCD and allow our controlled computer permissions to impersonate users on the DC host:
* Finally, we will request the service ticket for the user 'administrator'. I will first verify that we have delegation right to the listed DC:
* Then I will request an ST for the user 'administrator': {% code overflow="wrap" expandable="true" %} ``` impacket-getST 'past.local/pwned$:pwned123!' -spn 'cifs/EC2AMAZ-A5O4OL8.past.local' -impersonate Administrator -dc-ip 10.1.59.204 ``` {% endcode %}
## Privilege Escalation * Now that we have the TGT for the administrator, we can dump the NTDS.dit:
## Pass the Hash (PtH) * Now, we can PtH to gain access via Evil-WinRM and gain access to the flag:
* We also can attempt to crack the passwords for the users. We need to gain access to the user 'ryan' password. At first, I attempted to crack the hash from the dump of the NTDS.dit, but it was not able to be cracked. * I then gained access to the host and started to enumerate. I like to start by seeing if there is anything in the PSReadLine ConsoleHost\_history.txt. We are able to find this users password as it was previously entered into PS:
{% hint style="info" %} This can be an easy win to see if we can enumerate any potential creds or other information from the ConsoleHost\_history.txt. It is a good way to potentially escalate privs quickly. {% endhint %} ## Resources ### TimeRoasting * * * ### RBCD *