CRTA · CERTIFIED RED TEAM ANALYST · EXAM WALKTHROUGH
ENT.CORP Domain Compromise
SSRF → LFI HOST DISK MOUNT GTFOBINS SOCKS PIVOT DCSYNC PASS-THE-HASH

One VPN handshake to Domain Admin. An SSRF, a mounted host disk, a forgetful sudo rule, and a sync account that knew too much. The complete path from a single in-scope host to full domain compromise on CyberWarfare Labs' Certified Red Team Analyst exam — reconstructed exactly as it was walked. 17 / 17 flags.

VIEW THE CHAIN ↓
ENGAGEMENT
Objective
Retrieve secret.xml from the Domain Controller
Scope
172.26.10.0/24 · one in-scope host
Entry Point
172.26.10.11 — app-server (Ubuntu)
Internal Net
10.10.10.0/24 (discovered via pivot)
Domain
ent.corp · DC 10.10.10.100 (ENT-DC)
Result
Full domain compromise · 17 / 17 flags
HOW THE PIECES CONNECT
01
Recon
Full TCP Sweep
A full-port scan of the lone in-scope host exposes two high-port web apps that a top-1000 scan would have missed entirely.
02
SSRF → Host File Read
Flask /fetch + Bind-Mounted Disk
The Flask /fetch endpoint reads file:// URLs; a bind-mounted host disk turns that into a full read of the host's /etc/passwd, leaking the app-admin password.
03
Initial Access
Credential Reuse over SSH
The leaked password authenticates over SSH — password reuse converts a file read into an interactive foothold.
04
Privilege Escalation
sudo vi → GTFOBins Escape
A sudo vi entitlement is a one-line GTFOBins escape to root on the app-server.
05
Pivot
SSH Dynamic SOCKS Tunnel
Logs betray an internal host; an SSH dynamic SOCKS tunnel opens the hidden 10.10.10.0/24 segment for onward attack.
06
Credential Leak
elFinder Plaintext Note
An exposed elFinder file manager serves a plaintext note holding the sync_user domain credentials.
07
DCSync → Pass-the-Hash
Replication Rights to Domain Admin
sync_user holds replication rights — secretsdump lifts the krbtgt and Administrator hashes, and PtH walks straight into the DC to collect secret.xml.
✓
Reading of the Box
Chaining, Not Exotic Bugs
No single flaw here is exotic. The exam tests chaining: a container's convenience mount, a comment field in /etc/passwd, a leftover file manager, and an over-scoped sync account are not five isolated findings but one continuous path.
WALKTHROUGH
CRTA Exam Walkthrough — ENT.CORP (Full Report)
The complete path, reconstructed exactly as it was walked: every scan, every payload, every credential, and the reasoning that connected each step to the next — mission briefing, chained flaws, and full domain compromise across two networks and three owned hosts.
DOWNLOAD WALKTHROUGH ↓