Attacktive Directory: TryHackMe Walkthrough-Part 1
By: Sudeepa Shiranthaka
Tags: Windows, Tryhackme, Writing, Learning, Infosec

Hello guys, I am Sudeepa Shiranthaka. Today, we are going to talk about the Attacktive Directory room on TryHackMe. So, this is a Windows Active Directory-based room. Here we should exploit and get access to the vulnerable Domain Controller. In this room, we have 8 tasks to complete. In this article, we are going to complete the first 4 tasks and part 2 will cover the others.

Task 01: Deploy The Machine

Task 02: Setup

Task 03: Welcome to Attacktive Directory

Task 04: Enumerating Users via Kerberos

Task 05: Abusing Kerberos

Task 06: Back to the Basics

Task 07: Elevating Privileges within the Domain

Task 08: Flag Submission Panel

Before going into the task list let’s see the term AD(Active Directory).

What is AD(Active Directory)?

Active Directory supports a variety of functions like authentication, group and user management, policy administration, and much more.

AD can utilize both Kerberos and LDAP for authentication, making it the most commonly-used directory service today. Single-sign-on (SSO) is provided by AD and works especially effectively when used over VPN. One of the main reasons firms are choosing to install authentication management software is that AD and Kerberos are not cross-platform, which means they have to manage logins from a multitude of different devices and platforms in a single location. AD can still be a component of your entire access management strategy because it supports LDAP.

Task 01: Deploy The Machine

In task 01 we have to connect to the TryHackMe via OpenVPN and deploy the machine. If you want to how to connect via OpenVPN, you can refer to the below room on TryHackMe.

Task 02: Setup

In task 02 we should install some tools which are help full to conducting Active Directory enumeration.

When installing these tools make sure your Linux box is up to date and upgraded. If not, you may come up with some repository errors. So, always good to use the following command before installing the following tools.

The first tool we are going to install is “Impacket”. Sometimes impact can be installed in your Linux box already then you don’t want to install it again.

Installing Impacket:

We are going to clone the following directory to our /opt directory. All the necessary steps are mentioned in our task 02. So, I am not going to repeat those things here. Simply, you can give the following command to install the impacket.

Installing Bloodhound and Neo4j:

Bloodhound is another tool that we’ll be utilizing while attacking Attacktive Directory. We’ll cover specifcs of the tool later, but for now, we need to install two packages with Apt, those being bloodhound and neo4j. You can install it with the following command:

Task 03: Welcome to Attacktive Directory

Before start, the box makes sure your target host is running and up.

Our host is running and up perfectly and it gives a TTL value of 127😉. TTL=128 = Windows host and again if the TTL is 127 then the hop is 1 and its a Windows box.

We start our initial enumeration with nmap scan. If you want to know about nmap, you can refer to the following TryHackMe room.

-sV for enabling the version detection

-sC for running with the default NSE scripts

-A for enabling Aggressive mode(enables OS detection, version detection, traceroute, script scanning)

-T4 for setting the scanning speed to mode 4

-oN for saving the output

So we have open ports for 139/tcp and 445/tcp, those are the default SMB ports.

Port 139 : SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network.

: SMB originally ran on top of NetBIOS using port 139. NetBIOS is an older transport layer that allows Windows computers to talk to each other on the same network. Port 445: Later versions of SMB (after Windows 2000) began to use port 445 on top of a TCP stack. Using TCP allows SMB to work over the internet.

And also we have LDAP on 389/tcp and 3268/tcp.

Lightweight Directory Access Protocol (LDAP)

LDAP (also known as Lightweight Directory Access Technology) is an open and cross-platform protocol for directory services authentication.

LDAP is the primary means of communication between directory services and applications. When it comes to user accounts, directory services maintain information such as names, passwords, and computer accounts, and provide that information to other network entities.

Move on to task 03, we have three questions to answer.

What tool will allow us to enumerate port 139/445?

For this question, we can use google for the help🤗. Because Google is the number one Open-source intelligence tool and it’s totally free.

Answer: enum4linux

Enum4linux is a tool for enumerating information from Windows and Samba systems.

By using this tool we can identify share information, users and user group information, DNS information, Identifying the remote operating system, RID cycling, Password policy retrieval, NetBIOS information, etc. To install the tool, you can use below Github repository.

After installing the tool you can simply run the python script.

What is the NetBIOS-Domain Name of the machine?

enu4linux output gives the answer to this question.

Answer: THM-AD

What invalid TLD do people commonly use for their Active Directory Domain?

A simple search on Google will give the answer to our question.

Answer: .local

Task 04: Enumerating Users via Kerberos

Introduction:

A whole host of other services are running, including Kerberos. Kerberos is a key authentication service within Active Directory. With this port open, we can use a tool called Kerbrute (by Ronnie Flathers @ropnop) to brute force discovery of users, passwords and even password spray!

Note: Several users have informed me that the latest version of Kerbrute does not contain the UserEnum flag in Kerbrute, if that is the case with the version you have selected, try a older version!

In this part, we are going to enumerate the Kerberos. For this, we use the Kerbrute tool to bruteforce the usernames and passwords.

But install and running this tool from the above Git repo didn’t give the output for me. Then I search about myself on the internet after I come up with another Git repo for that. You can download the tool and also the user list, password list for the bruteforce attack.

After downloading the kerbrute tool we should give the executable permission for the script.

Here I have used 777 which means I am giving the highest privileges(All read, write, execute) to any user group.

What command within Kerbrute will allow us to enumerate valid usernames?

For this, we run the kerbrute by giving the ./kerbrute command in the installed directory.

Answer: userenum

What notable account is discovered? (These should jump out at you)

In here we suppose to run kerbrute and find the usernames. Before doing that I am going to add the target domain to my /etc/hosts it will be easy for me to conduct the enumeration. You can use the following command for that. In here you should have your target IP address instead of mine.

Now I am going to run the script with userlist.txt. You can use the following command for that. I have already added the target domain to my hosts then I can use the domain name instead of typing IP address.

— dc to giving the location of the Domain Controller (KDC) target

-d to give the full domain

This will give the output of some valid user accounts.

Answer: svc-admin

What is the other notable account is discovered? (These should jump out at you)

Answer: backup

So, I think this is enough for today. We have completed task 1 to task 4 of Attacktive Directory on TryHackMe and we’ll meet with part 2 of this article. So until next, Stay safe and Bye👋.

You can find me on😊:

Linkedin: www.linkedin.com/in/sudeepashiranthaka

Medium: https://sudeepashiranthaka97.medium.com/

Twitter: https://twitter.com/sudeepashiran97