Blackfield

Summary

#

Blackfield is an Active Directory box that rewards patience with SMB. Anonymous access to a share leaks a user list; one of those users has Kerberos pre-authentication disabled, which means an AS-REP roast and an offline crack. That foothold can force a password reset on a second account, which can read a memory dump of LSASS left on a backup share — and the hash inside it opens a door with SeBackupPrivilege, enough to walk out with the entire domain database.

Recon

#

nmap -p- --min-rate 2000 -oA nmap/blackfield 10.10.10.192
nmap -sC -sV -p 53,88,135,389,445,593 -oA nmap/blackfield-svc 10.10.10.192

Ports 88 and 389 make the box’s nature obvious immediately: this is a domain controller.

Enumeration

#

Anonymous SMB is the whole opening move.

smbclient -N -L //10.10.10.192/
# ... profiles$ share, readable

The profiles$ share holds a directory per user. No files worth reading — but the directory names are a ready-made user list, which is all the next step needs.

AS-REP roasting

#

With the user list, ask the KDC which accounts do not require Kerberos pre-authentication. Any that don’t will hand back an encrypted blob crackable offline.

GetNPUsers.py blackfield.local/ -usersfile users.txt -dc-ip 10.10.10.192 -no-pass

One account comes back. hashcat -m 18200 against a wordlist recovers the password within minutes — the whole reason pre-auth exists is to prevent exactly this, and it was switched off.

Foothold and pivot

#

That first account can’t log in interactively, but it can reset the password of a second, more useful account over RPC. From there, a share holds a lsass.DMP — a memory dump of the process that caches credentials.

pypykatz lsa minidump lsass.DMP

Out of the dump comes an NTLM hash for an account in the Backup Operators group.

Privilege escalation

#

Backup Operators carries SeBackupPrivilege — the right to read any file on the system regardless of its ACL, because a backup program has to. That includes the two files that are the domain: the NTDS.dit database and the SYSTEM hive.

# via a diskshadow script + robocopy with the backup flag
robocopy /b ...
secretsdump.py -ntds ntds.dit -system system LOCAL

secretsdump reconstructs every hash in the domain, Administrator included, and a pass-the-hash finishes it.

Lessons

#

Two switched-off protections chained into a full domain compromise, and neither is exotic. Pre-authentication disabled on a single account gave the first password; a debugging artifact — an LSASS dump nobody cleaned up — gave the second. The privilege escalation wasn’t a bug at all, just a legitimate backup right used exactly as designed against a box that handed out the group too freely. The takeaway I keep: an “Easy” and a “Hard” box often differ only in how many of these small misconfigurations you have to chain, not in how hard any one of them is.