Operation Endgame is an Active Directory–focused room on TryHackMe that simulates a real-world enterprise network environment. The objective is to perform a full penetration testing workflow, starting from initial enumeration and gaining a foothold, to privilege escalation and ultimately achieving domain dominance. The room emphasizes practical skills such as service enumeration, credential attacks, Active Directory abuse techniques, and attack path analysis using tools like BloodHound, providing a realistic red team experience.
Nmap Result
53/tcp open domain syn-ack ttl 126 Simple DNS Plus 80/tcp open http syn-ack ttl 126 Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows Server | http-methods: | Supported Methods: OPTIONS TRACE GET HEAD POST |_ Potentially risky methods: TRACE88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-04-05 04:34:09Z)135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn443/tcp open ssl/https? syn-ack ttl 126 |_ssl-date: 2026-04-05T04:36:21+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=thm-LABYRINTH-CA/domainComponent=thm | Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm445/tcp open microsoft-ds? syn-ack ttl 126 464/tcp open kpasswd5? syn-ack ttl 126 593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped syn-ack ttl 126 3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: thm.local, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped syn-ack ttl 126 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services |_ssl-date: 2026-04-05T04:36:21+00:00; -1s from scanner time. | ssl-cert: Subject: commonName=ad.thm.local | Issuer: commonName=ad.thm.local | rdp-ntlm-info: | Target_Name: THM | NetBIOS_Domain_Name: THM | NetBIOS_Computer_Name: AD | DNS_Domain_Name: thm.local | DNS_Computer_Name: ad.thm.local | Product_Version: 10.0.17763 |_ System_Time: 2026-04-05T04:35:14+00:00 7680/tcp open pando-pub? syn-ack ttl 126 9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing 47001/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49665/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49666/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49667/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49669/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49670/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 49671/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49675/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49676/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49681/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49685/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49712/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49718/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49725/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
SMB enumeration
Checked for any shares but nothing seems intresting.
So I have rid brute
nxc smb <IP> -u '' -p '' --rid-brute
By running the above command we can get the users list so we can try ASEP-Kerbestoing
Kerberoasting is an Active Directory attack technique where an attacker requests service tickets (TGS) for accounts with Service Principal Names (SPNs) and extracts them for offline password cracking. Since these tickets are encrypted using the service account’s password hash, weak passwords can be cracked to recover credentials, which can then be used for privilege escalation within the domain.
Join Medium for free to get updates from this writer.
Cody’s credentials are valid.
We got a valid password so we can try passwordspray attack to check whether the password is reused using kerbrute.
Password Spraying
Kerbrute is a tool used for enumerating valid usernames and performing password attacks against Active Directory using the Kerberos protocol. It works by sending authentication requests to the domain controller and analyzing the responses to identify valid users without triggering typical account lockout policies. Kerbrute is commonly used for user enumeration and password spraying during the initial stages of an Active Directory penetration test.
Press enter or click to view image in full size
Two users has same password.
Visualizing the attack vectors using bloodhound
We have generic write over Jerri_lancaster from Zachary so we can try Targeted kerberoasting.
![[THM] Kaboom — Writeup](https://miro.medium.com/v2/resize:fit:1358/format:webp/1*lCi9zk8eoN5IKWdgpyIcuQ.png)
