Chaining CVE-2025-33073 (NTLM reflection with MIC bypass) and RBCD self-delegation to reach Domain Admin when every classic SMB/LDAP relay path is blocked by the client signing flag.
Posts for: #Active-Directory
PG: Access
| ターゲット // Access | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.x.x |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Apache httpd 2.4.48 (XAMPP, PHP 8.0.7)
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn
389/tcp open ldap AD LDAP (Domain: access.offsec)
445/tcp open microsoft-ds
464/tcp open kpasswd5
3268/tcp open ldap AD Global Catalog
5985/tcp open http WinRM (Microsoft HTTPAPI 2.0)
9389/tcp open mc-nmf .NET Message Framing (ADWS)
This is a domain controller (Kerberos, LDAP, DNS, ADWS) that also happens to run a XAMPP/Apache stack on port 80 — the classic “web app pinned to a DC” setup, which usually means the web foothold and the AD kill chain are the same box.
HTB: Reel
| ターゲット // Reel | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Hard |
| IP | 10.129.50.115 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
593/tcp open http-rpc-epmap
FTP + SMTP on a Windows AD box – this screams phishing.
HTB: Resolute
| ターゲット // Resolute | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Medium |
| IP | 10.129.96.155 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
Domain: megabank.local, Windows Server 2016.
HTB: Blackfield
| ターゲット // Blackfield | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Hard |
| IP | 10.129.229.17 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
389/tcp open ldap
445/tcp open microsoft-ds
593/tcp open ncacn_http
3268/tcp open ldap
5985/tcp open http
Domain: blackfield.local, DC01.
HTB: Sauna
| ターゲット // Sauna | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Easy |
| IP | 10.129.93.188 |
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE
53/tcp open domain
80/tcp open http
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
Classic AD box – Kerberos, LDAP, SMB, WinRM all present. Domain: EGOTISTICAL-BANK.LOCAL.
HTB: Forest
| ターゲット // Forest | |
|---|---|
| Platform | HTB |
| OS | Windows |
| Difficulty | Easy |
| IP | 10.129.157.109 |
Recon
Standard AD box – DNS, Kerberos, LDAP, SMB all present. Domain: htb.local.
Enumeration
Nmap
▶ Nmap output
PORT STATE SERVICE
53/tcp open domain
88/tcp open kerberos-sec
135/tcp open msrpc
139/tcp open netbios-ssn
389/tcp open ldap
445/tcp open microsoft-ds
464/tcp open kpasswd5
593/tcp open http-rpc-epmap
636/tcp open ldapssl
3268/tcp open globalcatLDAP
3269/tcp open globalcatLDAPssl
5985/tcp open wsman
9389/tcp open adws
47001/tcp open winrm
OS: Windows Server 2016 Standard 14393 x64
PG: Hutch
| ターゲット // Hutch | |
|---|---|
| Platform | OffSec Proving Grounds |
| OS | Windows |
| Difficulty | Medium |
| IP | 192.168.160.122 |
Enumeration
Nmap
▶ Full nmap output
PORT STATE SERVICE VERSION
53/tcp open domain Simple DNS Plus
80/tcp open http Microsoft IIS httpd 10.0
88/tcp open kerberos-sec Microsoft Windows Kerberos
135/tcp open msrpc Microsoft Windows RPC
139/tcp open netbios-ssn Microsoft Windows netbios-ssn
389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hutch.offsec.)
445/tcp open microsoft-ds?
464/tcp open kpasswd5?
593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0
636/tcp open tcpwrapped
3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: hutch.offsec.)
3269/tcp open tcpwrapped
This is a Windows Server 2019 domain controller (hutch.offsec).