Active Directory Pentesting - Vulnerable

Machine
Instagram: h4cker_fawad
 II

Table of Content

Active Directory Pentesting - Vulnerable Machine ____________________________ I

Introduction _________________________________________________________ II
Objectives ___________________________________________________________ II
Reconnaissance ______________________________________________________ III
Nmap Scan ______________________________________________________ III
Services Enumeration ______________________________________________IV
Enumerating Users _____________________________________________ V
Enumerating Groups ____________________________________________V
Additional Service Enumeration (LDAP, RPC, and Global Catalog) ________ VI
Discovery & Exploitation of GPP cpassword via Anonymous SMB Backups _______ VII
Post-GPP Credential Discovery Activities & Kerberos Abuse Attempts ____________X
Kerberoasting / S4U2Self / SPN Enumeration Attempt ____________________ X
What was done: _______________________________________________ X
Finding: ______________________________________________________XI
Domain SID Extraction _____________________________________________ XI
What was done: _______________________________________________ XI
Finding: ______________________________________________________XI
Attempting a Forged Kerberos Ticket (Silver Ticket) ______________________XII
What was done: ______________________________________________ XII
Finding: _____________________________________________________ XII
Conclusion _________________________________________________________ XIII
 II

Introduction
This report documents the results of an automated penetration test performed
against the [Link] Active Directory environment. The objective of the
engagement was to simulate realistic attacker activity within a controlled lab
environment and evaluate the security posture, resilience, and misconfigurations
present inside the domain. All testing was conducted using standard offensive
tooling available in Kali Linux and reputable, open-source GitHub repositories such
as Impacket.

The assessment was designed to be non-destructive and strictly limited to

enumeration, authentication testing, privilege escalation analysis, and post-
exploitation verification. No data was intentionally modified or corrupted. This
report summarizes the discovered weaknesses, the exploitation paths validated, and
concrete defensive recommendations to improve the security of the Active Directory
infrastructure.

Objectives
The objective of this penetration test was to assess the security posture of the
[Link] Active Directory environment by performing controlled, non-
destructive testing. This included enumerating AD components, identifying exposed
or weak credentials, evaluating opportunities for lateral movement and privilege
escalation, reviewing post-exploitation access to domain resources, and
documenting security weaknesses with actionable remediation recommendations.
 III

Reconnaissance
Nmap Scan
Nmap scans all TCP ports on the host [Link]. The host responded quickly
and returned a small set of open ports typically associated with Active Directory:
DNS (53), Kerberos (88), RPC (135), NetBIOS/SMB (139/445), LDAP (389/636), Global
Catalog (3268/3269), Kerberos password change (464), WinRM/ADWS
(5985/47001/9389) plus a block of high ephemeral ports (49152–49186).

The result shows the machine is a Windows domain controller (or AD-enabled server)
inside a virtual environment (VMware MAC). The presence of many AD-related
services indicates the box is an AD domain controller and a high-value target for
further AD enumeration.

Figure 1: Nmap Scan output

 IV

Services Enumeration
This targeted scan probed the important AD service ports using version detection
and common NSE scripts. Results confirm the host is running Windows Server 2012
R2 (evaluation) with Active Directory for domain [Link] and the certificate
CN [Link] on LDAPS/GC SSL ports. Nmap detected SMB message-
signing is enabled and required and reported account_used: guest for some probes
(indicating anonymous attempts were limited).

HTTP endpoints on WinRM/ADWS replied but returned generic “Not Found” titles.
Overall the scan verifies this host is an AD domain controller (FQDN Group-
[Link]) with LDAP/Kerberos/SMB/WinRM available — but with some
common protections in place (e.g., LDAP requires bind for detailed queries and SMB
enforces signing).

Figure 2: Service Enumeration

 V

Enumerating Users

I attempted an LDAP query to enumerate all users in the [Link] domain,

requesting attributes such as sAMAccountName, displayName, userAccountControl,
whenCreated, and adminCount. However, the query failed with an Operations error
indicating that anonymous binds are not allowed, meaning the LDAP server requires
authentication before you can retrieve user or group information.

Key finding: No unauthenticated LDAP access is allowed on this domain controller,

so user enumeration via LDAP without credentials is not possible.

Figure 3: Enumerating Users

Enumerating Groups

Then I tried to list all groups in the domain and their members. Like the previous
command, it returned an Operations error, showing that the LDAP server does not
allow anonymous binds for group enumeration either.

Key finding: Group enumeration via LDAP without credentials is blocked, which
prevents gathering domain group structures anonymously.

Figure 4: Enumerating Groups

 VI

Additional Service Enumeration (LDAP, RPC, and Global Catalog)

Further enumeration was conducted on ports 389 (LDAP), 593 (RPC over HTTP), 3268
(Global Catalog LDAP), and 3269 (LDAPS). LDAP and Global Catalog services were
accessible, revealing domain naming contexts such as DC=GROUPP,DC=local and
confirming a fully functional domain environment. RPC over HTTP (port 593) was
open but did not expose any vulnerabilities. LDAPS on port 3269 responded with a
self-signed certificate (CN=[Link]) using TLSv1.2 encryption,
indicating secure directory communications are enabled.

Figure 5: Additional Enumeration

Figure 6: Additional Enumeration

 VII

Discovery & Exploitation of GPP cpassword

via Anonymous SMB Backups
Opened an anonymous SMB session to the Backups share on the domain controller.
The -N flag uses a null (no- password) login. This allowed passive browsing of backup
folders without authenticating, revealing several GUID- named backup directories
that likely contain system and AD backup data.

Figure 7: Anonymous SMB

Listed the top- level contents of the Backups share. The output showed multiple
GUID directories (e.g. {31B2F340-...}, {A59B26ED-...}) which are typical names for
Windows/NTBackup or VSS backup containers and often map to SYSVOL, NTDS, or
machine backups.

Figure 8: Backup Shares

 VIII

Navigated the backup tree to Machine\Preferences\Groups, the path where Group

Policy Preferences (GPP) stores user/group preference XML. The Groups folder
contained [Link], the file that holds GPP entries including the cpassword
attribute.

Downloaded the [Link] file from the backup share to my attacker machine.
This file contained a cpassword value for [Link]\vulfilip, which is an
encrypted GPP password that can be decrypted offline because GPP used a known,
static AES key.
 IX

Displaying the contents of the downloaded [Link]. The file confirmed the
presence of a cpassword attribute for user [Link]\vulfilip with the base64
ciphertext YCR5u...C85+Vt, showing exactly which account and encrypted value to
target.

Figure 9: Content of [Link] file

Ran a local GPP decryption utility (Downloaded From Github) against the
downloaded XML. The tool parsed the file, decrypted the cpassword using the
known GPP key, and returned the plaintext Credential:
[Link]\vulfilip : !!ImpossibleToCrack@ThisWasntThatHardWasIt?1

Figure 10: Decrypted cpassword

 X

Post-GPP Credential Discovery Activities &

Kerberos Abuse Attempts
After recovering the plaintext credentials from the Group Policy Preferences (GPP)
XML file
([Link]\vulfilip : !!ImpossibleToCrack@ThisWasntThatHardWasIt?1),
several follow-up Active Directory attack paths were tested to determine the
potential impact.

Kerberoasting / S4U2Self / SPN Enumeration Attempt

Tool Used: [Link] (Impacket)
Command:

python3 [Link]
[Link]/vulfilip:'!!ImpossibleToCrack@ThisWasntThatHardWasIt?1' -dc-ip
[Link] -request

Figure 11: extracted a TGS-REPUsing [Link]

What was done:

 Queried the DC for Service Principal Names (SPNs)

 Requested Kerberos service tickets for accounts with SPNs
 Extracted a TGS hash for the Administrator account (CIFS SPN), which can be
cracked offline
 XI

Finding:

 A valid Kerberoastable service was identified

 Successfully retrieved a TGS-REP hash for the Administrator account

Domain SID Extraction

Tool Used: [Link] (Impacket)
Command:

python3 [Link]
[Link]/vulfilip:'!!ImpossibleToCrack@ThisWasntThatHardWasIt?1'@192.168.
198.140

Figure 12: SID extraction using [Link]

What was done:

 Enumerated domain SIDs and RID ranges

 Extracted the Domain SID

Finding:

 The Domain SID was successfully retrieved:

S-1-5-21-2901460279-4064123921-971425325

This SID is required for crafting forged Kerberos tickets.

 XII

Attempting a Forged Kerberos Ticket (Silver Ticket)

Tool Used: [Link]
Command:

python3 [Link] -nthash f0c9b0a8c7f8bc4eb0241a75d8bf336 \

-domain [Link] \
-domain-sid S-1-5-21-2901460279-4064123921-971425325 \
-spn CIFS/[Link] \
-user Administrator

Figure 13: Creating silver Ticket

What was done:

 Used the obtained NTLM hash of the Administrator’s TGS ticket

 Crafted a forged Kerberos ticket targeting the CIFS service of the domain
controller
 Saved output ticket as [Link]
 Intended for use with tools like, [Link], smbclient, etc.

Finding:

 The forged Kerberos ticket was successfully generated, meaning the NT hash
was valid and Impacket accepted all required domain metadata.
 This indicates potential for privilege escalation depending on service-level
validation controls.
 XIII

Conclusion
The assessment confirmed that the target host was a fully functional Active Directory
Domain Controller (Windows Server 2012 R2) hosting critical services such as LDAP,
Kerberos, SMB, Global Catalog, and WinRM. Initial enumeration revealed strong
baseline hardening measures including enforced SMB signing and disabled
anonymous LDAP binds, preventing unauthenticated enumeration of users and
groups.

Despite these protections, a significant security misconfiguration was discovered:

anonymous read access to the “Backups“ SMB share, which exposed Group Policy
Preferences (GPP) configuration data. This allowed retrieval and offline decryption of
a GPP cpassword, resulting in valid domain credentials for the account
[Link]\vulfilip. This was the most impactful finding of the assessment,
confirming that sensitive backup data was not properly secured.

With the recovered credentials, multiple post-exploitation techniques were tested.

SPN enumeration and Kerberoasting successfully extracted a TGS-REP hash for the
Administrator account, indicating the presence of Kerberoastable services that could
be cracked offline to gain privileged access. Domain SID enumeration also succeeded,
and a forged Silver Ticket for the CIFS service was generated using extracted
metadata and the Administrator’s TGS hash, confirming the theoretical feasibility of
privilege escalation.

However, no authenticated access to SMB, WinRM, or RPC services was achieved,

despite using the forged Kerberos ticket. This indicates that the environment has
implemented additional verification mechanisms (e.g., PAC validation, service-level
authentication checks, or disabled services) that prevented full exploitation and
domain compromise at this stage.

Overall, the assessment revealed serious weaknesses (GPP credential exposure,

Kerberoastable services) that could lead to domain compromise if combined with
password cracking or extended offline attack time. While full access was not
obtained during testing, the identified vulnerabilities significantly reduce the
security posture of the domain and represent clear escalation paths for an attacker.
Immediate remediation is recommended to prevent future compromise.