HomeGitHubPortfolio Twitter/X Medium Cont@ct

AD: Basic Enumeration

https://tryhackme.com/room/adbasicenumeration

@TryHackMe

🔗 AD: Basic Enumeration

Task 1 - Deploy machine

Attacker Machine: 10.250.11.15

🎯 Target IP: 10.211.11.20 | 10.211.11.10

Download VPN

Go here to download correct network VPN (select networks and room name) server and not the classic VPN file for normal machines: https://tryhackme.com/access

Start VPN in a dedicated shell: sudo openvpn devangelist-Jr-Pentester-AD-v01.ovpn

Create a directory on the Desktop with the machine's name, and inside this directory, create another directory to store the materials and outputs needed to run the machine.

Task 2 - Mapping Out the Network

Host Discovery

Executing route or ip route commands we can see another subnet in our: 10.211.11.0/24

starting to send an ICMP requests to determine if a host is live or not, to do it we're using fping that permits to ping subnets:

in alternative we can do the same using sudo nmap -sn 10.211.11.0/24

Excluding the gateway 10.211.11.1 we can save others IP into a file called hosts.txt.

Once we've discovered live hosts, we must identify which one is the Domain Controller (DC) to determine which critical AD-related services are being used and can be exploited. These are some common Active Directory ports and protocols:

Port
Protocol
What it Means

88

Kerberos

Potential for Kerberos-based enumeration

135

MS-RPC

Potential for RPC enumeration (null sessions)

139

SMB/NetBIOS

Legacy SMB access

389

LDAP

LDAP queries to AD

445

SMB

Modern SMB access, critical for enumeration

464

Kerberos (kpasswd)

Password-related Kerberos service

We can run a service version scan with these specific ports to help identify the DC:

  • -sV: This enables version detection. Nmap will try to determine the version of the services running on the open ports.

  • -sC: Runs Nmap Scripting Engine (NSE) scripts in the default category.

  • -iL: This tells Nmap to read the list of target hosts from the file hosts.txt. Each line in this file should contain a single IP address or hostname.

  • -oN: This save result into a text file called port_scan.

It seems that 10.200.12.250 is the VPN server, so we can ignore it.

Go in depth checking services present on our target execute:

  • -sS: TCP SYN scan, which is stealthier than a full connect scan

  • -p-: Scans all 65,535 TCP ports.

  • -T3: Sets the timing template to "normal" to balance speed and stealth.

  • -iL hosts.txt: Inputs the list of live hosts from the previous nmap command.

  • -oN full_port_scan.txt: Outputs the results to a file.

2.1 - What is the domain name of our target?

Checking result of nmap first scan we can see the domain name:

tryhackme.loc

2.2 - What version of Windows Server is running on the DC?

as the previous task, we can see OS version running on our DC:

Windows Server 2019 Datacenter

Task 3 - Network Enumeration With SMB

We can start an nmap active scan, analyzing interesting ports:

Listing SMB Shares

Try to list SMB shares with anon login authentication:

and check theirs permissions using smbmap:

Running either of the above commands, we can notice that there are three non-standard shares that catch our attention: AnonShare, SharedFiles and UserBackups.

We can check others informations using nmap and its script smb-enum-shares:

Accessing SMB Shares

We can access to ShareFiles share using anonymous authentication and discover into a file called Mouse_and_Malware.txt:

3.1 - What is the flag hidden in one of the shares?

Searching in the others shared folders always with anonymous authentication mode, we can see that there're two interested file into UserBackup share, go there and download our flag:

🚩 Flag 1

THM{88_SMB_88}

Task 4 - Domain Enumeration

LDAP Enumeration (Anonymous Bind)

LDAP helps locate and organise resources within a network, including users, groups, devices, and organisational information, by providing a central directory that applications and users can query. Some LDAP servers allow anonymous users to perform read-only queries. This can expose user accounts and other directory information.

We can test if anonymous LDAP bind is enabled with ldapsearch:

If it is enabled, we should see lots of data, similar to the output below:

  • -x: Simple authentication, in our case, anonymous authentication.

  • -H: Specifies the LDAP server.

  • -s: Limits the query only to the base object and does not search subtrees or children.

We can then query user information with this command:

RPC Enumeration (Null Sessions)

Microsoft Remote Procedure Call (MSRPC) is a protocol that enables a program running on one computer to request services from a program on another computer, without needing to understand the underlying details of the network. RPC services can be accessed over the SMB protocol. When SMB is configured to allow null sessions that do not require authentication, an unauthenticated user can connect to the IPC$ share and enumerate users, groups, shares, and other sensitive information from the system or domain.

We can run the following command to verify null session access with:

  • -U: Used to specify the username, in our case, we are using an empty string for anonymous login.

  • -N: Tells RPC not to prompt us for a password.

and enumerate users with: enumdomusers

We can extract only the user using the following bash command: sed -n 's/^user:[(.)] rid:.$/\1/p' users.txtep -o 'user:[[^]]]' users.txt | sed 's/user:[(.)]/\1/'

Task 5 - Password Spraying

Password spraying is an attack technique where a small set of common passwords is tested across many accounts. Unlike brute-force attacks, password spraying avoids account lockouts by testing each account with only a few attempts, exploiting poor password practices common in many organisations. Password spraying is often effective because many organisations:

  • Require frequent password changes, leading users to pick predictable patterns (for example, Summer2025!).

  • Don't enforce their policies well.

  • Reuse common passwords across multiple accounts.

Password Policy

Before we can start our attack, it is essential to understand our target's password policy. This will allow us to retrieve information about the minimum password length, complexity, and the number of failed attempts that will lock out an account.

rpcclient

We can use rpcclient via a null session to query the DC for the password policy:

rpcclient -U "" 10.211.11.10 -N

And then we can run the getdompwinfo command:

5.1 - What is the minimum password length?

CrackMapExec

CrackMapExec is a well-known network service exploitation tool that we will use throughout this module. It allows us to perform enumeration, command execution, and post-exploitation attacks in Windows environments. It supports various network protocols, such as SMB, LDAP, RDP, and SSH. If anonymous access is permitted, we can retrieve the password policy without credentials with the following command: crackmapexec smb 10.211.11.10 --pass-pol

The minimum psw length is: 7 days.

5.2 - What is the locked account duration?

While the locked account duration is: 2 minutes.

Performing Password Spraying Attacks

We have gathered a solid user list from our user enumeration in the previous task; we now need to create a small list of common passwords. Through our password policy enumeration, we saw that the password complexity is equal to 1:

  • In rpcclient: password_properties: 0x00000001

  • With CrackMapExec: Password Complexity Flags: 000001

This means that at least three of the following four conditions need to be respected for a password to be created:

  1. Uppercase letters

  2. Lowercase letters

  3. Digits

  4. Special characters

5.3 - Perform password spraying using CrackMapExec. What valid credentials did you find? (format: username:password)

Based on the last output psw policy info, THM suggests us the following passwords:

  • Password!

  • Password1

  • Password1!

  • P@ssword

  • Pa55word1

We can use CrackMapExec to run our password spraying attack against the WRK computer:

Task 6 - Conclusion

In this room, we focused on various types of reconnaissance and enumeration activities that don’t require valid credentials. We covered mapping out the network, discovering and enumerating SMB shares, LDAP, RPC, and others. Finally, we explained password spraying and the various tools to carry out such attacks.

Active Directory remains a complex topic and you are encouraged to check other rooms to build and beef up your skills in Active Directory penetration testing. For more practice and going more in-depth, you can check the Breaking Windows and the Compromising Active Directory modules in addition to the next room.

PreviousActive Directory BasicsNextEnumerating Active Directory

Last updated