Active Directory: DCSync to Golden Ticket

ad-internal · expert · +200 XP

Scenario

You've reached an account with DS-Replication-Get-Changes on the domain — enough to pull secrets straight from the DC and mint tickets that never expire.

Attack path

secretsdump.py -just-dc-user krbtgt (or mimikatz lsadump::dcsync) to grab the krbtgt NTLM hash.
Forge a golden ticket: kerberos::golden with the domain SID and krbtgt hash.
Use it to read a protected share holding the encoded flag.

Recover the flag

The share's file is hex-encoded, then XOR'd with the account whose hash makes golden tickets possible. Reverse in order: From Hex → XOR (key = that account name).

// graded hints — spend XP when stuck

// captured payload · multi

5d4a544750165d43544055105d46544750475c4b541151475916544351125d11544051415d17501050405d4b544751165d47554055105841514454455e14514d544c584551455146584b514654445d415447514558465510

Apply each step IN REVERSE ORDER: 1. XOR the bytes against the key `krbtgt` (UTF-8, repeating). 2. Hex-decode the blob to recover the flag (each pair of hex chars = 1 byte).

// this payload is unique to your account — decode it, then submit the recovered hc{...} flag below

// submit flag

// no solves yet

Active Directory: Kerberoasting a Service Account

// end of ad

12 of 12 · ad

// go deeper

// install app

Install hacking.community for fast access, offline reading, and push notifications. No app store needed.