Acl-Abuse

TL;DR - An assumed-breach Active Directory box starting with Olivia:ichliebedich. BloodHound maps an ACL chain: Olivia has GenericAll over Michael, Michael can ForceChangePassword on Benjamin, and Benjamin (in Share Moderators) can reach an FTP backup. That backup is a Password Safe vault, cracked to reveal mid-chain users, one of whom (Emily) has GenericWrite over Ethan. A targeted Kerberoast against Ethan cracks his password, and Ethan holds DCSync rights, so secretsdump dumps every hash and a pass-the-hash as Administrator finishes the box. ...

TL;DR - A Windows domain controller that allows null-session enumeration over SMB/RPC, leaking the full list of domain users. One of them, svc-alfresco, has Kerberos pre-authentication disabled, so we AS-REP roast it, crack the hash to s3rvice, and log in over WinRM for user.txt. For root, BloodHound maps an ACL chain: svc-alfresco has GenericAll over the Exchange Windows Permissions group, that group holds WriteDACL over the domain object, so we add ourselves to the group, grant our user DCSync rights, dump the Administrator NT hash with secretsdump, and pass-the-hash in as Domain Admin. ...