Exploiting Active Directory

Prompts and answers

• Which ACE would allow you to update any non-protected parameter of a target object?
  GenericWrite
• What is the value of the flag stored on the Desktop of the Administrator user on THMWRK1 (flag1.txt)?
  THM{Permission.Delegation.FTW!}
• Which Kerberos Delegation type allows for delegation of all services?
  Unconstrained Delegation
• Which Kerberos Delegation type allows the service to specify who is allowed to delegate to it?
  Resource-Based Constrained Delegation
• Which Constrained Delegation service allows access to the file system of the system via delegation?
  CIFS
• What is the value of the flag stored in the Desktop directory of the Administrator user on THMSERVER1 (flag2.txt)?
  THM{Constrained.Delegation.Can.Be.Very.Bad}
• How often (in days) are the passwords of Windows machine accounts rotated by default?
  30
• What should not be enforced if we want to relay an SMB authentication attempt?
  SMB Signing
• What is the value of the flag stored in the Desktop directory of the Administrator.ZA user on THMSERVER1 (flag3.txt)?
  THM{Printing.Some.Shellz}
• What application is used to open the kdbx credential database?
  Keepass
• What meterpreter command do we use to move from SYSTEM to user context?
  migrate
• What is the password of the credential database?
  Imreallysurenoonewillguessmypassword
• What is the value of the flag stored in the credential database?
  THM{AD.Users.Can.Give.Up.Good.Secrets}
• What object allows users to configure Windows policies?
  Group Policy Object
• What AD feature allows us to configure GPOs for the entire AD structure?
  Group Policy Management
• What is the name of the GPO that our compromised AD account owns?
  Management Server Pushes
• What is the value of the flag stored on THMSERVER2 in the Administrator's Desktop directory (flag4.txt)?
  THM{Exploiting.GPOs.For.Fun.And.Profit}
• What does the user create to ask the CA for a certificate?
  Certificate Signing Request
• What is the name of Microsoft's PKI implementation?
  Active Directory Certificate Services
• What is the value of the flag stored on THMDC in the Administrator's Desktop directory (flag5.txt)?
  THM{AD.Certs.Can.Get.You.DA}
• What domain trust relationship is by default configured between a parent and a child domain?
  Bidirectional Trust
• What is the name of the AD account used by the KDC to encrypt and sign TGTs?
  KRBTGT
• What is the name of the TGT that grants access to resources outside of our current domain?
  Inter-Realm TGT
• What is the value of the flag stored on THMROOTDC in the Administrator's Desktop folder (flag6.txt)?
  THM{Full.EA.Compromise}