AttacktiveDirectory#1 : Compromise & Remediation

Introduction

This is my first article documenting my journey as an aspiring Active Directory Security Analyst. My methodology focuses on attacking vulnerable Active Directory networks while proposing mitigation strategies that reflect real-world misconfigurations and their remediation.

For this inaugural post, I'm walking through the TryHackMe Proxy room (https://tryhackme.com/room/proxychallenge), which teaches a precise methodology for assessing Active Directory environments. The lab features a single machine acting as a domain controller that we must compromise and extract a flag from the Administrator's desktop. Beyond exploitation, I'll document each vulnerability in the attack chain and provide clear, actionable remediation steps.

Mapping Out The Surface

As with every assessment, we begin with a targeted Nmap scan to identify core services typical of a Domain Controller:

• Port 88 — Kerberos
• Port 135 — Microsoft Remote Procedure Calling (RPC)
• Port 389 — LDAP
• Port 445 — SMB
• Port 636 — LDAPS

The scan reveals:

• A domain controller with the domain name ctf.local and hostname DC01$
• Several targeted ports are open, enabling enumeration to proceed
• SMB message signing is enabled, confirming we're interacting with a Domain Controller

Expanding Enumeration via SMB

Since SMB is accessible, we'll attempt to enumerate file shares using anonymous sessions to gather intelligence.

Among the standard Windows shares, one stands out: IT-Shared, described as used by the IT department. Let's explore it using smbclient:

Excellent — we've gained anonymous access and extracted three files. Let's examine them:

File 1: Reveals disabled user accounts (former employees) with usernames and passwords.

File 2: Contains VPN onboarding instructions, but more interestingly, lists service accounts running on the domain controller:

• svc.mssql
• svc.scanner — processes file enumeration on the share

File 3: An IT staff dashboard HTML page containing additional usernames.

Critical Finding

The svc.scanner service automatically processes files on the share. This is a prime target for file-based coercion—we can place a malicious script that triggers an SMB callback to our attacking machine, capturing its NTLMv2 hash.

File-Based Coercion Attack

We craft a PowerShell script to trigger a callback from the svc.scanner service account and place it on the share (leveraging our anonymous write access):

Next, we set up an SMB server using Impacket's smbserver to listen for and capture the callback:

Perfect — we've captured the NTLMv2 hash. Now we'll crack it using Hashcat (module 5600):

Success. We've recovered the password for the svc.scanner account.

Lateral Movement: Kerberos Attacks

With authenticated credentials, we perform classic Kerberos attacks:

AS-REP Roasting: No vulnerable accounts found.

Kerberoasting: We successfully extract a TGS for the svc.mssql service account:

Unfortunately, this hash resists cracking. We proceed with the svc.scanner credentials.

Reconnaissance with BloodHound

Now possessing valid credentials, we use BloodHound (by SpecterOps) to map the AD environment's attack surface graphically.

Using BloodHound's Python collector, we retrieve the domain structure:

After importing the data into BloodHound CE, we visualize the domain topology and use the Pathfinding feature to discover attack paths from svc.scanner to the Administrator:

Critically, we observe that svc.scanner has constrained delegation permissions to the DC01 computer. This allows the account to request service tickets while impersonating any user to a specific target. However, the vulnerability lies in the Service Principal Name (SPN) not being protected in the ticket. An attacker can modify the target SPN to impersonate any principal and access any service.

Privilege Escalation via Constrained Delegation

To exploit this, we:

1. Request a service ticket to the cifs service while impersonating the Administrator
2. Export the ticket to memory
3. Authenticate to the DC using the forged ticket

Step 1 — Request Ticket:

Step 2 — Export Ticket:

Step 3— Authenticate as Administrator and retrieve the flag

We now have Administrator access and can retrieve the flag.

Post-Compromise: Domain Sync

With Administrator privileges, we perform a DCSync attack to dump all domain credentials, LSA secrets, and password hashes:

Remediation Strategy

We've successfully compromised the entire domain. Now we analyze each vulnerability and propose remediation.

1. Anonymous Share Access

Vulnerability: Unauthenticated users enumerated and accessed the IT-Shared share, extracting sensitive data and uploading a malicious script.

Mitigation:

• Disable null/anonymous sessions via Group Policy security options
• Enforce authenticated-only access to all shares
• Disable NTLM authentication domain-wide (enforce Kerberos/NTLMv2)
• Implement file integrity monitoring on sensitive shares

2. Weak Passwords

Vulnerability: The svc.scanner account's NTLMv2 hash was cracked quickly due to weak password construction (common words, predictable patterns).

Mitigation:

• Enforce strong password policies (minimum 14+ characters, complexity)
• Implement password history and aging requirements
• Use passphrases or consider passwordless authentication for service accounts
• Regular audits of password strength using tools like Zxcvbn or similar

3. Service Account Excessive Privileges

Vulnerability: The svc.scanner account held unconstrained constrained delegation permissions, enabling privilege escalation to Administrator.

Mitigation:

• Restrict AllowedToDelegate to only the absolute minimum required SPNs
• Avoid delegating to high-privilege targets (Domain Controllers, administrative services)
• Use resource-based constrained delegation for finer-grained control
• Regularly audit service account permissions using tools like BloodHound or PingCastle
• Consider Service Account Isolation (treating service accounts as principals requiring protection)

4. Anonymous File Processing (Bonus Vulnerability)

Vulnerability: The svc.scanner service automatically processes files on an anonymously-writable share, enabling arbitrary code execution.

Mitigation:

• Restrict write access on shares to authenticated, authorized users only
• Implement file validation and sandboxing for any automated processing
• Use Windows Defender Application Guard or similar for untrusted file execution
• Deploy behavioral monitoring on service account activities

Conclusion

The Proxy room demonstrates how a chain of common misconfigurations can lead to complete domain compromise. The attack chain — null session enumeration → weak password cracking → constrained delegation abuse — illustrates why defense-in-depth is critical. Each vulnerability alone might be manageable, but their combination creates a catastrophic risk.

Key takeaways for defenders:

• Assume breach: Design systems expecting compromise
• Minimize privileged accounts: Constrain service account permissions rigorously
• Monitor enumeration: Detect and alert on NTLM hash captures, Kerberos abuse, and unusual service behavior
• Enforce strong authentication: Phase out NTLM, require MFA for sensitive accounts

Tools Used

• nmap — network reconnaissance
• smbclient, impacket-smbserver — SMB enumeration and exploitation
• hashcat — password cracking
• GetUserSPNs.py, getST.py (impacket) — Kerberos exploitation
• bloodhound-python, BloodHound CE — AD reconnaissance
• PowerShell — script-based exploitation