> For the complete documentation index, see [llms.txt](https://abdulazim.gitbook.io/write-up/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://abdulazim.gitbook.io/write-up/hacksmarter-write-up/martiniad.md). # MartiniAD Active Directory Penetration Testing-Easy Rate #### Step 1- Nmap Reconnaisance

#### Step 2- SMB share file enumeration

Found share file that have "read, write" permissions.

Connecting to smb shared file specific notes folder. the "notes.txt" file can be download and view also.

Found credential. #### Step 3 Validate credential and kerberoasting

Here, we can validate the creds is valid.

Run kerberoasting attack via ldap return one valid account called ATHENA\_SVC. Saved the krbtgt hash inside kerb.hash file. #### Step 4 cracked krtbgt hash using Hashcat

Hashcat successful crack the kerb hash. #### Step 5 Enumerate other user and expanding access.

Can brute force rid to enumerate other user. also can use command "--users-export user.txt" List below is the other user inside the domain. ``` Administrator Guest Krbtgt mprice athena.t0 ATHENA_SVC DC01$ ``` #### Step 6 Adding domain dns and dns computer name inside hosts.

This is the outcome after running this command: ``` nxc smb 10.1.16.162 -u ""-p '' --generate-hosts-file hosts ``` or can manually add it at /etc/hosts #### Step 7 Spray Attack

using the other user that we found and cracked kerb hash, found Domain Admin account. #### Step 8 Dump the NTDS database and krbtgt hash

Successfully dump the NTDS and krbtgt. With this hash we can forge golden ticket even the password for this user is already change.