---
description: https://tryhackme.com/room/exploitingad
---

# Exploiting Active Directory





🔗 Exploiting Active Directory

## Task 1 - Deploy machine <a href="#task-0-deploy-machine" id="task-0-deploy-machine"></a>

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fldfei0Pqap1oTB2sxDMz%2Fimage.png?alt=media&#x26;token=9bc13017-d3e7-4853-849c-40ff8abdde8f" alt=""><figcaption></figcaption></figure>



Attacker Machine: `10.250.11.15`

🎯 Target IP: `10.211.11.20` | `10.211.11.10`

### Download VPN

Go here to download correct network VPN (select networks and room name) server and not the classic VPN file for normal machines: [https://tryhackme.com/access](https://tryhackme.com/access)

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2FGN87A7itYDuijIwyuIiW%2Fimage.png?alt=media&#x26;token=47887f9d-19a9-4929-a316-d5bc7c80ad6e" alt=""><figcaption></figcaption></figure>

Start VPN in a dedicated shell: `sudo openvpn devangelist-Jr-Pentester-AD-v01.ovpn`

Create a directory on the Desktop with the machine's name, and inside this directory, create another directory to store the materials and outputs needed to run the machine.

```bash
su
echo "10.211.11.10 ad.thm" >> /etc/hosts

mkdir -p thm/AD/AD_Enum
cd thm/AD/AD_Enum
mkdir {nmap,content,exploits,scripts}
# At the end of the room
# To clean up the last line from the /etc/hosts file
sed -i '$ d' /etc/hosts
```

## Task 2 -&#x20;

**Host Discovery**

Executing `route` or `ip route` commands we can see another subnet in our: `10.211.11.0/24`

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2Fn3XflNhWUDdS7uoK3MXr%2Fimage.png?alt=media&#x26;token=e8ddce01-21b4-4960-876b-b491dc13db24" alt=""><figcaption></figcaption></figure>

starting to send an ICMP requests to determine if a host is live or not, to do it we're using fping that permits to ping subnets:

```bash
fping -agq 10.211.11.0/24
# -a: shows systems that are alive.
# -g: generates a target list from a supplied IP netmask.
# -q: quiet mode, doesn't show per-probe results or ICMP error messages.
```

<figure><img src="https://677614291-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrRWtuMw6xkkeDjZfkcWC%2Fuploads%2F1KcFaC6zhud6qcZr92YE%2Fimage.png?alt=media&#x26;token=49453857-50bc-4519-9890-2363f734bcc9" alt=""><figcaption></figcaption></figure>

```bash
10.211.11.1
10.211.11.10
10.211.11.20
10.211.11.250
```

in alternative we can do the same using `sudo nmap -sn 10.211.11.0/24`

Excluding the gateway `10.211.11.1` we can save others IP into a file called `hosts.txt`.

Once we've discovered live hosts, we must identify which one is the Domain Controller (DC) to determine which critical AD-related services are being used and can be exploited. These are some common Active Directory ports and protocols:

| Port | Protocol           | What it Means                                 |
| ---- | ------------------ | --------------------------------------------- |
| 88   | Kerberos           | Potential for Kerberos-based enumeration      |
| 135  | MS-RPC             | Potential for RPC enumeration (null sessions) |
| 139  | SMB/NetBIOS        | Legacy SMB access                             |
| 389  | LDAP               | LDAP queries to AD                            |
| 445  | SMB                | Modern SMB access, critical for enumeration   |
| 464  | Kerberos (kpasswd) | Password-related Kerberos service             |

We can run a service version scan with these specific ports to help identify the DC:

```bash
sudo nmap -p 88,135,139,389,445 -sV -sC -iL hosts.txt -oN port_scan
```

* `-sV`: This enables version detection. Nmap will try to determine the version of the services running on the open ports.
* `-sC`: Runs Nmap Scripting Engine (NSE) scripts in the default category.
* `-iL`: This tells Nmap to read the list of target hosts from the file `hosts.txt`. Each line in this file should contain a single IP address or hostname.
* `-oN`: This save result into a text file called port\_scan.

```
```

### 2.1 -&#x20;









{% hint style="info" %}

{% endhint %}

### 2.2 -&#x20;







{% hint style="info" %}

{% endhint %}

## Task 3 -&#x20;











<details>

<summary>🚩 Flag 1</summary>



</details>

## Task 4 -&#x20;











## Task 5 -&#x20;



### 5.2 -&#x20;









### 5.3 -&#x20;





