ADRTS · ACTIVE DIRECTORY RED TEAM · LAB WALKTHROUGH
telecore.ad Domain Compromise
AS-REP ROASTING MSSQL xp_cmdshell GODPOTATO ADCS ESC1 CERTIPY DPAPI VIEWSTATE RCE EXCHANGE EWS

A full Active Directory red team lab against telecore.ad, walked end to end along two separate adversary paths. Path 1 starts from a bare VPN handshake — no credentials — and climbs to Domain Admin through AS-REP roasting, MSSQL command execution, token abuse, ADCS ESC1, and an ESXi hypervisor. Path 2 takes an authenticated web foothold and rides an LFI → ViewState → DPAPI → Exchange chain to a mailbox dump. 24 / 24 flags.

VIEW THE PATHS ↓
ENGAGEMENT
Objective
Full compromise of the telecore.ad forest
Starting Position
VPN access only · zero credentials
In-Scope Subnet
10.5.2.0/24 — six live hosts
Key Hosts
DC01, PKI-SRV, EX-SRV, SQL-SRV, ESXI-VD, Web-Srv
Adversary Paths
Unauthenticated (14 steps) + Authenticated (9 steps)
Result
Full domain compromise · 24 / 24 flags
HOW THE PIECES CONNECT
Path 01 — Unauthenticated Adversary
VPN only → Domain Admin → ESXi
01
Recon
Subnet Service Sweep
An nmap service scan of 10.5.2.0/24 maps six hosts — DC, PKI, Exchange, SQL, ESXi, and an IIS web server — and the ports that define the whole engagement.
02
Credential Harvest
AS-REP Roasting Without Auth
tel_support01 has Kerberos pre-auth disabled, so GetNPUsers pulls an AS-REP hash with no credentials — cracked offline against rockyou.
03
Code Execution
MSSQL → xp_cmdshell
The recovered password logs into SQL-SRV; enabling xp_cmdshell turns a database session into OS command execution.
04
Privilege Escalation
GodPotato + SeImpersonate
The service account holds SeImpersonatePrivilege — GodPotato abuses it to escalate from the SQL service to NT AUTHORITY\SYSTEM.
05
Credential Access
LSASS Dump → pypykatz
A SYSTEM-level LSASS dump is exfiltrated over SMB and compressed, then pypykatz extracts cached domain credentials offline.
06
ADCS Abuse
ESC1 Template → DA Certificate
Enumeration finds a vulnerable ESC1 certificate template; a request with a spoofed Domain Admin SID mints a certificate as that account.
07
Domain Admin
Certipy Auth → Hash → Crack
Certipy authenticates with the certificate to recover the DA NT hash, which john then cracks to a cleartext Domain Admin password.
✓
Virtualization Pivot
ESXi via pyVmomi → VaultVM RCE
DA access to the ESXi host exposes credentials stashed in a VM annotation; a mkfifo reverse shell into VaultVM captures the final path-1 flag.
Path 02 — Authenticated Adversary
IIS foothold → DC filesystem → Exchange
01
Web Recon
IIS 10 / ASP.NET Enumeration
The Web-Srv IIS application is mapped for entry points, endpoints, and framework tells that shape the rest of the path.
02
Local File Inclusion
LFI → web.config Extraction
An LFI reads web.config, leaking the machine keys and the machine name needed to forge trusted ASP.NET payloads.
03
Deserialization RCE
ysoserial.net → ViewState Injection
With the leaked keys, ysoserial.net forges a valid __VIEWSTATE payload that deserializes into a shell as the IIS worker.
04
Credential Access
Registry → DPAPI Blob
A DPAPI-protected blob found in the registry is decrypted after several failed methods — the working one unlocks stored secrets.
05
Lateral Movement
DC Filesystem via SQL Pivot
A SQL pivot reaches the DC filesystem, surfacing a scheduled-task script that widens access into the domain core.
✓
Objective
Exchange EWS → Mailbox Dump
Exchange Web Services access dumps target mailboxes — the authenticated path's objective and the last of the 24 flags.
WALKTHROUGH
ADRTS Lab Walkthrough — telecore.ad (Full Report)
The complete two-path report, reconstructed step by step: every scan, payload, credential, and the reasoning that links each technique to the next — with the full 24-flag summary and every failed method shown alongside the fix that finally worked.
DOWNLOAD WALKTHROUGH ↓