139445---smb

Set up three vulnerable Windows machines and conducted a series of attacks against them using techniques like Kerberoasting, IPv6 Relay Attack, etc. Grasping these concepts was time intensive, but it ultimately increased my skills within Active Directory overall.

This was an Active Directory Windows machine, started by finding credentials in an image on the website, then dumped information with LDAP for the domain to find a kerberoastable user, then enumerating more shares with cme, find which accounts were active, and then get foothold. For root, we pfx2john, and find a GMSA exploit on powershell, to reset a higher privilege user's password so we can authenticate with our new credentials.

Funny box, met with a lot of memes which indicated I was getting closer or further from the objective, enumerating SMB & DNS, to then exploit LFI and privesc with python.

Interesting machine where we pivot from one piece of information to another, enumerating SMB and LDAP to eventually authenticate with ansible, and then privesc with certipy and PassTheCert.

Enumerated SMB shares to find a GPP encoded password, cracked it, and Kerberoasted to root. Very good machine to learn/practice Kerberoasting.