# Nmap 7.94SVN scan initiated Thu Apr 3 20:49:16 2025 as: nmap -sS -p- -A --open -T5 -Pn -n -oN ext_baby2_tcp_allports -vvv 10.10.68.84
53/tcp open domain syn-ack ttl 127 Simple DNS Plus
88/tcp open kerberos-sec syn-ack ttl 127 Microsoft Windows Kerberos (server time: 2025-04-04 00:54:42Z)
135/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
139/tcp open netbios-ssn syn-ack ttl 127 Microsoft Windows netbios-ssn
389/tcp open ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
445/tcp open microsoft-ds? syn-ack ttl 127
464/tcp open kpasswd5? syn-ack ttl 127
593/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
636/tcp open ssl/ldap syn-ack ttl 127 Microsoft Windows Active Directory LDAP (Domain: baby2.vl0., Site: Default-First-Site-Name)
3389/tcp open ms-wbt-server syn-ack ttl 127 Microsoft Terminal Services
49668/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
49674/tcp open ncacn_http syn-ack ttl 127 Microsoft Windows RPC over HTTP 1.0
49676/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
51163/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
51168/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
51183/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
51198/tcp open msrpc syn-ack ttl 127 Microsoft Windows RPC
Service Enumeration
DNS
Not vulnerable to DNS Zone Transfer
SMB
Server allows null session
Server allows guest user access
Read,Write access homes directory.
Username as password brute forcing revealed Carl.Moore and office as valid credentials
Can read and write in apps, docs, home
LDAP
Allows userenumeration via rid-bruteforcing
Not kerberoasting user
Not asreproasting user
Not information withing the users' description field
Initial enumeration
During the assessment, the tester discovered that the domain user carl.moore has read and write access to the following SMB shares:
\\DC\apps
\\DC\docs
\\DC\homes
In addition, the user has read-only access at the SMB share level to the NETLOGON and SYSVOL shares:
nxc smb 10.10.68.84 -u Carl.Moore -p 'Carl.Moore' --shares
SMB 10.10.68.84 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:baby2.vl) (signing:True) (SMBv1:False)
SMB 10.10.68.84 445 DC [+] baby2.vl\Carl.Moore:Carl.Moore
SMB 10.10.68.84 445 DC [*] Enumerated shares
SMB 10.10.68.84 445 DC Share Permissions Remark
SMB 10.10.68.84 445 DC ----- ----------- ------
SMB 10.10.68.84 445 DC ADMIN$ Remote Admin
SMB 10.10.68.84 445 DC apps READ,WRITE
SMB 10.10.68.84 445 DC C$ Default share
SMB 10.10.68.84 445 DC docs READ,WRITE
SMB 10.10.68.84 445 DC homes READ,WRITE
SMB 10.10.68.84 445 DC IPC$ READ Remote IPC
SMB 10.10.68.84 445 DC NETLOGON READ Logon server share
SMB 10.10.68.84 445 DC SYSVOL READ Logon server share
However, further enumeration revealed that the user has write access at the NTFS level to the following file:
\\baby2.vl\SYSVOL\baby2.vl\scripts\login.vbs
This file is executed by domain users during the logon process (as confirmed via BloodHound enumeration or logon script analysis). This creates a high-impact attack vector where an unprivileged domain user can modify the login.vbs file to execute arbitrary code in the context of other domain users, potentially including privileged accounts such as domain administrators.
Reverse Shell via GPO Script
To exploit this misconfiguration, the tester appended the next lines to the script:
Finally, uploaded the file by rewriting original file and wait for the reverse shell.
smb: \baby2.vl\scripts\> put login.vbs
putting file login.vbs as \baby2.vl\scripts\login.vbs (4.7 kb/s) (average 4.7 kb/s)
Lateral movement from Amelia to gpoadmin
During post-compromise enumeration, the tester identified that the user Amelia.Griffiths had the ability to modify gpoadm via the following Active Directory permissions: WriteOwnerWriteDACL These permissions allowed the tester to fully take over the gpoadm account and reset its password, thereby achieving lateral movement.
As a stealthier option, instead of resetting the password, the tester could have injected a custom msDS-KeyCredentialLink attribute using whisker.exe to retrieve the NT hash of the gpoadm account without altering the password. This method is particularly effective in environments using Windows Hello for Business.
Compromise Domain Controller
Finally the tester compromised an user with possess administration privilege over the GPO in the entire Domain controller that means Compromise domain.
The tester leveraged GPO capabilities to escalate privileges by adding a domain user to the Administrators group on the Domain Controller using pygpoabuse.py.
