389636---ldap

Set up three vulnerable Windows machines and conducted a series of attacks against them using techniques like Kerberoasting, IPv6 Relay Attack, etc. Grasping these concepts was time intensive, but it ultimately increased my skills within Active Directory overall.

This was an Active Directory Windows machine, started by finding credentials in an image on the website, then dumped information with LDAP for the domain to find a kerberoastable user, then enumerating more shares with cme, find which accounts were active, and then get foothold. For root, we pfx2john, and find a GMSA exploit on powershell, to reset a higher privilege user's password so we can authenticate with our new credentials.

Interesting machine where we pivot from one piece of information to another, enumerating SMB and LDAP to eventually authenticate with ansible, and then privesc with certipy and PassTheCert.