ターゲット // Access
PlatformOffSec Proving Grounds
OSWindows
DifficultyMedium
IP192.168.x.x

Enumeration

Nmap

▶ Nmap output
PORT     STATE SERVICE      VERSION
53/tcp   open  domain       Simple DNS Plus
80/tcp   open  http         Apache httpd 2.4.48 (XAMPP, PHP 8.0.7)
88/tcp   open  kerberos-sec Microsoft Windows Kerberos
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn
389/tcp  open  ldap         AD LDAP (Domain: access.offsec)
445/tcp  open  microsoft-ds
464/tcp  open  kpasswd5
3268/tcp open  ldap         AD Global Catalog
5985/tcp open  http         WinRM (Microsoft HTTPAPI 2.0)
9389/tcp open  mc-nmf       .NET Message Framing (ADWS)

This is a domain controller (Kerberos, LDAP, DNS, ADWS) that also happens to run a XAMPP/Apache stack on port 80 — the classic “web app pinned to a DC” setup, which usually means the web foothold and the AD kill chain are the same box.