ShadowGate
Author: Ross
Category: Active Directory
Difficulty: Easy
Sypnosis
ShadowGate is an Active Directory-focused lab centered on the shadow.gate domain, hosted on a single Domain Controller (DC01). The path begins with unauthenticated enumeration via SMB null sessions and LDAP, leading to a valid domain foothold through AS-REP Roasting. From there, an ACL misconfiguration (GenericWrite) is abused via a Shadow Credentials attack to compromise a second user. That user's group membership grants visibility into a vulnerable AD CS (Active Directory Certificate Services) configuration — specifically ESC8 (NTLM relay to HTTP certificate enrollment). By coercing the Domain Controller's machine account to authenticate via PetitPotam (MS-EFSRPC) and relaying that authentication to the CA's web enrollment endpoint with Certipy, a certificate is issued for the DC01$ machine account. This certificate is used to authenticate as the DC's computer account, which inherently holds Directory Replication rights — allowing a full DCSync attack to extract the krbtgt hash, completing full domain compromise.
Objectives
ShadowGate recently completed a corporate acquisition that significantly expanded its internal network, user base, and application footprint. Several business-critical systems were migrated and consolidated under tight operational deadlines to minimize downtime and maintain service continuity.
While functional validation was completed, the organization deferred a comprehensive security assessment due to delivery pressure and staffing constraints. Leadership has since requested an independent penetration test to validate the security posture of the newly created environment and identify any material risk before the next audit cycle.
The assessment will evaluate whether a motivated attacker with standard network access could compromise sensitive systems, escalate privileges, or move laterally within the enterprise environment.
The Hack Smarter team has been authorized to perform a black box internal penetration test against the ShadowGate environment.
Skills Required
- Basic Active Directory / Windows networking concepts
- Familiarity with SMB, LDAP, and Kerberos protocols
- Comfort with common offensive tooling (
nmap,enum4linux-ng,netexec,impacket,certipy,BloodHound)
Skills Learned
- Enumerating AD environments via unauthenticated SMB/LDAP sessions
- Performing AS-REP Roasting to obtain crackable Kerberos hashes
- Using BloodHound (Community Edition) to identify and visualize ACL-based attack paths
- Abusing
GenericWritevia the Shadow Credentials attack (msDS-KeyCredentialLink) - Identifying and exploiting AD CS misconfigurations (ESC8 — NTLM relay to HTTP enrollment)
- Coercing authentication using MS-EFSRPC (PetitPotam)
- Relaying coerced machine account authentication to issue certificates with Certipy
- Authenticating with PKINIT certificates to recover NT hashes
- Performing a DCSync attack to extract
krbtgtand complete domain compromise
Enumeration
Port Scanning
Initial reconnaissance was performed with rustscan piped into nmap for service/version detection:
Key findings:
| Port | Service | Notes |
|---|---|---|
| 53 | DNS | Simple DNS Plus |
| 88 | Kerberos | |
| 135/139/445 | RPC/SMB | SMB signing enabled but not required |
| 389/636/3268/3269 | LDAP/LDAPS/GC | Domain: shadow.gate |
| 3389 | RDP | DC01.shadow.gate, NetBIOS domain SHADOW |
| 5985 | WinRM | |
| 9389 | AD Web Services (.NET Message Framing) |
The LDAP/RDP TLS certificates confirmed the domain controller's identity:
- NetBIOS Domain:
SHADOW - DNS Domain:
shadow.gate - Computer Name:
DC01 - OS: Windows Server 2022 (Build 20348)
/etc/hosts was updated accordingly:
Unauthenticated SMB/LDAP Enumeration
enum4linux-ng confirmed null session (anonymous) access was permitted:
Key results:
- Null session (
''/'') allowed for RPC authentication - 12 domain users enumerated via
querydispinfo/enumdomusers - 49 groups enumerated (local, builtin, and domain)
- Domain password policy revealed: min length 8, no complexity requirement, lockout threshold of 10 attempts / 3-minute window
- Shares enumeration failed anonymously (0 shares returned)
This was cross-validated with NetExec:
Twelve local users were confirmed, including a notably different account control flag on jtrueblood (0x00010210) compared to the rest (0x00000210) — a strong indicator of the UF_DONT_REQUIRE_PREAUTH flag, i.e., AS-REP Roastable.
Initial Access
AS-REP Roasting
With the user list in hand, all accounts were tested for Kerberos pre-authentication requirements:
Result: jtrueblood returned a crackable AS-REP hash:
Cracking the Hash
The hash was cracked offline using hashcat mode 18200 against rockyou.txt:
Credentials recovered:
Validating Access
Confirmed valid domain credentials with read access to CertEnroll, NETLOGON, and SYSVOL shares — notably, the presence of a CertEnroll share hinted at an AD CS deployment worth investigating later.
Data Collection
The resulting .zip was imported into BloodHound Community Edition (Neo4j + BloodHound CE UI at localhost:8080).
Path Identification
With jtrueblood marked as Owned, pathfinding revealed a direct edge:
GenericWrite over another user object is a well-known privilege escalation primitive — it permits writing most attributes on the target, including servicePrincipalName (enabling Targeted Kerberoasting) or msDS-KeyCredentialLink (enabling Shadow Credentials).
Privilege Escalation
Shadow Credentials Attack
Rather than Targeted Kerberoasting (which requires offline cracking), the more deterministic Shadow Credentials technique was used, abusing GenericWrite to add an attacker-controlled certificate as an alternate authentication credential on bbrown:
Result:
This process:
- Generated a self-signed certificate and Key Credential
- Added the Key Credential to
bbrown'smsDS-KeyCredentialLinkattribute - Authenticated via PKINIT using the certificate to obtain a TGT
- Used the U2U (User-to-User) trick to retrieve
bbrown's NT hash - Restored the original Key Credentials to minimize footprint
Validating Access
Dead End: Direct DCSync Attempt
An initial DCSync attempt using bbrown's hash failed:
BloodHound confirmed bbrown had 0 Outbound Object Control — no further ACL-based path was available from this account directly. However, bbrown's group membership included ADCS-Reader, pointing toward AD CS as the next avenue.
AD CS Exploitation (ESC8)
Certificate Authority Enumeration
Initial enumeration as jtrueblood returned no visible certificate templates — later found to be a permissions/visibility artifact, not an absence of templates. Re-running as bbrown (member of ADCS-Reader) revealed the full picture:
Key finding — ESC8:
The CA (shadow-DC01-CA) accepts NTLM authentication over an unencrypted HTTP web enrollment endpoint (certsrv/certfnsh.asp), making it a viable NTLM relay target. Authenticated Users held Enroll rights on the CA.
Coercing Authentication (MS-EFSRPC / PetitPotam)
To obtain a certificate for the Domain Controller's own machine account (DC01$), the DC was coerced into authenticating back to an attacker-controlled listener using PetitPotam, which abuses the EfsRpcOpenFileRaw / EfsRpcEncryptFileSrv functions of MS-EFSRPC:
EfsRpcOpenFileRaw was patched and denied, but PetitPotam automatically fell back to the still-functional EfsRpcEncryptFileSrv, successfully triggering the coercion.
Relaying to ADCS Web Enrollment
In parallel, a Certipy relay listener was staged, targeting the CA's HTTP enrollment endpoint and requesting a DomainController template certificate for whatever identity authenticated:
Upon the PetitPotam coercion firing, DC01's machine account authenticated to the relay listener:
A valid PKI certificate for the DC01$ machine account was successfully obtained.
Domain Compromise
Authenticating with the Machine Certificate
The DC01$ NT hash was recovered via PKINIT + U2U.
DCSync — Extracting krbtgt
Domain Controller machine accounts inherently hold Replicating Directory Changes / Replicating Directory Changes All rights, enabling a full DCSync:
With the krbtgt hash and domain SID (S-1-5-21-243493930-1113464705-3012771586) in hand, full domain compromise is achieved — this credential enables forging Golden Tickets, granting persistent, ticket-based access to any resource in the domain as any user, independent of password changes.
Attack Path Summary
Remediation Recommendations
| Issue | Recommendation |
|---|---|
AS-REP Roastable account (jtrueblood) | Enforce Kerberos pre-authentication for all accounts; disable UF_DONT_REQUIRE_PREAUTH unless explicitly required |
| Weak/dictionary passwords | Enforce password complexity and length policies beyond the current minimum of 8 characters |
Excessive GenericWrite ACL grants | Audit and remove unnecessary write permissions on user objects; apply least privilege |
| AD CS Web Enrollment over HTTP (ESC8) | Disable HTTP web enrollment or enforce HTTPS with Extended Protection for Authentication (EPA); disable NTLM for enrollment where possible |
| Unpatched/partially patched MS-EFSRPC coercion | Apply latest security updates; disable unnecessary RPC/EFS services on domain controllers; restrict inbound SMB/RPC to trusted hosts |
| Null session / anonymous enumeration allowed | Restrict anonymous SAM/LSA enumeration via RestrictAnonymous policy settings |
| SMB signing not enforced | Require SMB signing domain-wide to mitigate NTLM relay attacks |