Adcs

TL;DR — Port 8443 runs PWM, a self-service password portal, and SMB allows anonymous/guest access. That guest read on the Development share exposes Ansible automation whose PWM role holds ansible-vault encrypted secrets. Cracking the vault (ansible2john + john) and decrypting it gives the PWM admin svc_pwm:pWm_@dm!N_!23. Inside PWM I point the LDAP profile at a rogue server (plain ldap://389) and Responder captures svc_ldap:lDaP_1n_th3_cle4r! in cleartext — a WinRM user (user.txt). Finally, ADCS (the CorpVPN / ESC1 template) plus an LDAP shell adding my user to Domain Admins lands Administrator and root.txt. ...

TL;DR - Null-auth SMB on the member server exposes the WDS REMINST share, whose unattend XML leaks svc_deploy:D3pl0y!_AgileCorp (base64 with the classic trailing Password quirk). BloodHound shows svc_deploy has GenericWrite over the SRV-BASELINE GPO, so pyGPOAbuse drops an immediate scheduled task that gives SYSTEM / local admin on SRV. Looting SRV yields the SRV$ machine hash and an email revealing the DC pulls WSUS updates over HTTPS. I hijack the WSUS DNS record (insecure dynamic update) to point at SRV, mint a legitimate ADCS WebServer cert for the WSUS name, and stand up a rogue WSUS (pyWSUS + socat TLS + a Ligolo pivot) that serves a Microsoft-signed PsExec as a SYSTEM ‘update’ - landing local admin on the DC, then DCSync for full domain compromise." ...

TL;DR - An assumed-breach Active Directory box. Starting from henry, I chain ACLs through BloodHound: a targeted Kerberoast on alfred, abusing AddSelf + ReadGMSAPassword to read the ansible_dev$ gMSA password, then a trail of ForceChangePassword and WriteOwner abuses to pivot sam → john and land a WinRM shell. For root, john controls an OU holding a deleted cert_admin account, so I restore it from the AD Recycle Bin, reset its password, and abuse an ESC15 (CVE-2024-49019) vulnerable certificate template to impersonate the Administrator. ...