Corporate Ladder: Four Steps to Domain Admin

You've compromised a workstation in ACME Corp's domain (acme.local) and dumped local credentials. The security team rotates passwords weekly, but you've discovered several lateral movement opportunities through careful enumeration.

HOST-WS01 (your entry point): Local SAM dump yielded: alice_martin::ACME:aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c Alice is a standard user. Enumerating shares on HOST-SRV02, you find an open backup share.

HOST-SRV02 (file server): In \\HOST-SRV02\Backups$\IT\ you discover notes.txt containing: "Reminder: ServiceDesk account password is the SHA256 hash of our main office location (city only, lowercase) truncated to first 12 chars. Account: svc_helpdesk" ACME's main office is publicly listed as Austin, Texas. The svc_helpdesk account has GenericAll rights on the IT-ADMINS group.

HOST-APP01 (application server): After adding your compromised user to IT-ADMINS via ACL abuse, you gain RDP access to HOST-APP01. Running mimikatz reveals a cached TGT for backup_admin with NTLM hash: e19ccf75ee54e06b06a5907af13cef42. This account has Replicating Directory Changes permissions but lacks Replicating Directory Changes All.

HOST-DC01 (domain controller): You discover that backup_admin is a member of the Backup Operators group, which has been granted DS-Replication-Get-Changes-All via AdminSDHolder inheritance (misconfiguration from 2019 compliance audit). You can now perform a DCSync attack.

After DCSync, the Administrator NTLM hash is: 579da618cfbfa85247acf1f800a280a4

The flag is the cleartext password of the domain Administrator account (the hash cracks to a 16-character password consisting of: ACME's stock ticker symbol + current year when this config was set + a common IT exclamation). The company trades on NASDAQ as ACME. The AdminSDHolder misconfiguration timestamp in the notes was '2019-compliance-audit'.