Attacktive Directory


99% of Corporate networks run off of AD. But can you exploit a vulnerable Domain Controller?

Use nmap to find open ports in the machine.

Task 3  Enumeration Welcome to Attacktive Directory

What tool will allow us to enumerate port 139/445?


Enum4linux is a command-line tool used to gather information from Windows and Samba systems in the same network. It can enumerate user accounts, groups, shares, policies, and password hashes, among other things. It is commonly used by network administrators and security professionals to identify vulnerabilities, but it can also be misused by attackers.

What is the NetBIOS-Domain Name of the machine?
What invalid TLD do people commonly use for their Active Directory Domain?

Task 4  Enumeration Enumerating Users via Kerberos

Download Kerbrute from Github.

What command within Kerbrute will allow us to enumerate valid usernames?


What notable account is discovered? (These should jump out at you)
What is the other notable account is discovered? (These should jump out at you)


Task 5  Exploitation Abusing Kerberos

We have two user accounts that we could potentially query a ticket from. Which user account can you query a ticket from with no password?
Looking at the Hashcat Examples Wiki page, what type of Kerberos hash did we retrieve from the KDC? (Specify the full name)
What mode is the hash?


Now crack the hash with the modified password list provided, what is the user accounts password?


Task 6  Enumeration Back to the Basics

What utility can we use to map remote SMB shares?


Which option will list shares?


How many remote shares is the server listing?


There is one particular share that we have access to that contains a text file. Which share is it?


What is the content of the file?


Decoding the contents of the file, what is the full contents?


Task 7  Domain Privilege Escalation Elevating Privileges within the Domain

What method allowed us to dump NTDS.DIT?


What is the Administrators NTLM hash?


What method of attack could allow us to authenticate as the user without the password?

Pass The Hash

Using a tool called Evil-WinRM what option will allow us to use a hash?

Task 8  Flag Submission Flag Submission Panel

Use Winrm to enter the Administrator account

Check the desktop of the required users to find the flags.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Comments (



%d bloggers like this: