A real-world intrusion attempt that started with a Microsoft Teams call from "IT support" and ended with an encrypted, in-memory Python RAT. Full kill chain, C2 infrastructure, and IoCs.

Baby is an easy Windows machine. Anonymous LDAP enumeration reveals a hidden OU with an account flagged to change its password at next logon. Once in, that user turns out to be a Backup Operator, which we abuse with diskshadow and SeBackupPrivilege to copy NTDS.dit off the domain controller and dump every hash in the domain.

Certified is a medium Windows machine built entirely around Active Directory permission abuse and ADCS. Starting from low-privileged credentials, we take ownership of a group, run a shadow credential attack to steal a service account, force-change another account's password, and finish by exploiting ADCS ESC9 to authenticate as the domain Administrator.

Object is a hard Windows machine running Jenkins automation server. The automation server is found to have registration enabled and the registered user can create builds. Builds can be triggered remotely by configuring an api token. Foothold is obtained by decrypting the Jenkins secrets. The foothold user is found to have ForceChangePassword permissions on another user called smith. This privilege abuse allows us to gain access to smith. smith has GenericWrite permissions on maria. Abusing this privilege allows us to gain access to the server as this user. maria has WriteOwner permissions on Domain Admins group, whose privileges we exploit to get a SYSTEM shell.

Active is an easy to medium difficulty machine, which features two very prevalent techniques to gain privileges within an Active Directory environment.

Cascade is a medium Windows machine that starts with zero credentials. Anonymous LDAP enumeration leaks a base64 password, which opens SMB shares holding a reversible VNC password and an audit database. Decrypting the database recovers a service account that belongs to the AD Recycle Bin group, letting us read a deleted TempAdmin object whose password was reused for the domain Administrator.

TombWatcher is a medium Windows machine that strings together a long chain of Active Directory ACL abuses. Starting from a single set of credentials, we targeted-Kerberoast our way to the next user, add ourselves to a group to read a gMSA password, force-change passwords down the chain, recover a deleted certificate admin out of the AD Recycle Bin, and finish by abusing ADCS ESC15 (CVE-2024-49019) to forge a certificate for Administrator.

Sauna is an easy Windows machine that walks through a classic Active Directory kill chain. We build a username list from the company website, AS-REP roast an account that has Kerberos pre-authentication disabled, pivot via a password left in an autologon registry key, and finish with a DCSync to pull the Administrator hash.