Kerberoasting

TL;DR - An assumed-breach, Kerberos-only box starting with ryan.naylor:HollowOct31Nyt. A share holds a password-protected Access_Review.xlsx, cracked with John, which leaks cleartext creds for svc_ldap and svc_iis. BloodHound shows svc_ldap has WriteSPN over svc_winrm, so I add an SPN and kerberoast it, crack the hash, and get a WinRM shell (user.txt). svc_ldap is in restore_users, so I restore the deleted user todd.wolfe from the AD Recycle Bin, decrypt his DPAPI-protected credentials to get jeremy.combs, use a leaked SSH key to log in as svc_backup, and from there grab ntds.dit + SYSTEM, dump the hashes, and pass-the-key as Administrator for root.txt. ...

TL;DR - A single forest with two domains in a parent-child trust (old.velocity.hacklu migrated into velocity.hacklu). A leftover svc_test (password = username) and a Kerberoasted svc_granite_sync:Granite00 give a foothold on the old DC. The parent has NTLM disabled, so I cross the within-forest trust with a Kerberos TGT, read the svc_backup_gmsa managed password, and use it to reach the Backup$ share holding an NTDS.dit export. secretsdump yields the old krbtgt, and a Golden Ticket forged with the AES key plus the parent’s Enterprise Admins SID in SID History (no SID filtering within a forest) escalates from Domain Admin on the child to Enterprise Admin across the entire forest. ...

TL;DR - A Domain Controller exposing a Replication share over anonymous SMB leaks a Groups.xml containing a GPP-encrypted password. Microsoft published the AES key for GPP, so it decrypts offline to the svc_tgs credentials, which open the Users share and user.txt. The Administrator account has an SPN registered, so a Kerberoast against it yields a TGS hash that cracks with rockyou, giving full domain compromise. Recon Starting with a full nmap scan on the host and saving the results to a file: ...

TL;DR - An assumed-breach Active Directory box. Starting from henry, I chain ACLs through BloodHound: a targeted Kerberoast on alfred, abusing AddSelf + ReadGMSAPassword to read the ansible_dev$ gMSA password, then a trail of ForceChangePassword and WriteOwner abuses to pivot sam → john and land a WinRM shell. For root, john controls an OU holding a deleted cert_admin account, so I restore it from the AD Recycle Bin, reset its password, and abuse an ESC15 (CVE-2024-49019) vulnerable certificate template to impersonate the Administrator. ...