Intro to AD Breaching | TryHackMe | practical challenge

Explore AD breaching including username enumeration, password spraying, coercion, and mitigations.

In an Active Directory (AD) environment, everything starts with that first set of valid credentials. Without them, you can’t enumerate, you can’t move laterally, and you certainly can’t escalate privileges. The process of obtaining those initial credentials is what we call breaching.

In this room, we will explore several common techniques attackers use to gain that initial foothold. Starting with nothing more than network access, we will work through a natural attack progression, from reconnaissance and credential hunting through to password spraying and authentication coercion, to obtain valid AD credentials.

Learning Objectives

In this room, you will learn:

• The principle and methodology for breaching AD environments
• Enumerating valid usernames with Kerbrute and performing password spraying attacks
• An introduction in to the world of authentication coercion and coercion-based breaches
• Common mitigations to protect against these breaching techniques

🛠️ Type: Walkthrough

👤 Role: Pentest

💪 Difficulty: Medium

🔗Link : https://tryhackme.com/room/introductiontoactivedirectorybreaching

On the AttackBox, and if you’d rather not change your DNS configuration, you can add the entries manually:

user@attackbox:~$ sudo nano /etc/hosts

Add the following:

192.168.12.100    thm.loc
192.168.12.71     git.thm.loc ci.thm.loc printer.thm.loc
192.168.12.51     SERVER1.thm.loc

This works for all the practical exercises.

What is the first phase of any AD attack chain?

Breaching

What service, running on TCP port 88, can be abused to validate whether usernames exist in the domain?

Kerberos

How many valid usernames did Kerbrute discover?

42

What is the organisation’s username format?

first.last

What is the password for the svc.jenkins account found in the Git commit history?

What default password was leaked in the Jenkins build logs?

How many accounts were cracked using the brute force attack?

2

Which is the first user account (alphabetically) that uses the default onboarding password?

What is the Bind DN of the service account captured during the LDAP passback attack?

What is the plaintext password captured from the LDAP passback?

What is the cracked password for sarah.jones obtained through file-based coercion?

What Group Policy setting can be configured to enforce NTLMv2 and refuse older LM and NTLM responses?

Network Security: LAN Manager authentication level

What port should be used instead of port 389 to ensure LDAP traffic is encrypted?

636

Well done! You’ve gone from zero credentials to multiple valid domain accounts and you did it through several different avenues. That’s the reality of AD breaching: it’s rarely a single technique that gets you in. It’s a combination of reconnaissance, opportunistic discovery, and creative coercion that opens the door.

Let’s recap what we covered in this room:

• OSINT and reconnaissance: We gathered potential usernames from public sources and validated them against the domain using Kerbrute, exploiting Kerberos pre-authentication behaviour to confirm which accounts exist without triggering lockouts.
• Credential discovery: We hunted for secrets in commonly exposed services. Git repositories with credentials buried in commit history and Jenkins instances leaking sensitive data through build logs.
• Password spraying: We took a single password and sprayed it across our validated username list using NetExec, staying below the lockout threshold while identifying accounts with weak or default passwords.
• LDAP passback: We exploited a misconfigured network printer by redirecting its LDAP authentication to our listener, capturing the stored service account credentials in plaintext.
• File-based coercion: We planted a malicious .url file on a writable share, forcing a user's machine to send its NTLMv2 hash to our Responder listener. We then cracked the hash offline with Hashcat to recover the plaintext password.

Each of these techniques gave us a different way in, and in a real engagement, you would use whichever combination the environment presents to you.