From 0 to Domain Admin
During these last two days of my internship I ran an internal pentest mission at a company, where I mainly focused on Active Directory. What started as plain reconnaissance turned into the single easiest box I’ve ever pwned, it took basically one step. A leaked password found through a Telegram bot handed us a Domain Admin session, and from there the whole domain fell in minutes. No exploits, no fancy escalation, no rabbit holes. Here’s the whole chain.
1. Enumeration, the usual Windows Server album
Kicking off with an nmap scan against the target, you get the classic picture of a Windows Server / AD machine: SMB, LDAP, Kerberos, RDP, HTTP, the works. Nothing exotic at first glance, the kind of output every AD box in the lab gives you.
Two things immediately jumped out though:
- SMB (
445) and WinRM (5985) were open, the second one is a golden ticket for shell access later. - Service banners and the AD naming leaked a handful of usernames.
2. SMB anonymous access, open, but empty
smbclient with anonymous login came back successful, so I poked around for shares across the workgroup. The login was accepted, but there was essentially nothing to see, no juicy shares hanging out for guest. A dry lead, but it confirmed SMB was wide open for user enumeration.
Meanwhile HTTP was up, but it was just the stock IIS landing page, nothing interesting there either.
3. The username file and a failed brute force
From the services that leaked user accounts, I assembled the usernames into a file and fired up netexec to brute-force passwords for any valid credential. Nothing hit on straight brute force, no weak password in the lot.
Brute force dead. Time for a different angle.
4. The Telegram leak, the whole engagement turned here
My teammate suggested a well-known Telegram bot that surfaces credential leaks for given usernames. We threw the candidates at it one by one, and for one specific user it came back with a hit, real leaked credentials tied to that account.
I plugged those creds into netexec to validate them against the domain… and they worked. Valid password, valid user, user pwned. That single leaked reuse was the entire domino.
Lesson #1: users reuse passwords. A credential leak from some unrelated breach can become the front door to the corporate domain.
5. Initial access, WinRM shell as the user
Since WinRM was enabled on the DC, moving from a valid credential to a shell was one step. I connected with evil-winrm as the leaked user and got an interactive PowerShell session.
6. The surprise, this user is Domain Admin
Before anything fancy, I checked the user’s privileges. And there it was: the account we popped with a password leak was already a member of Domain Admins. The domain was effectively owned before I had even tried a single escalation technique.
Absolutely the easiest pwn, the hardest part of the mission was the osint-of-a-telegram-bot, not any exploit.
Lesson #2: a Domain Admin account with a leaked/reused password is a single point of total compromise. Group membership review and password rotation for privileged accounts matter.
7. Owning the Administrator account properly
Even though the domain was already ours through that DA user, we wanted the Administrator account outright. I used secretsdump to dump the NTDS hashes for the whole domain, and from the dump we recovered the Administrator’s password directly.
8. Listing the shares, administrator view
With the Administrator shell, the shares that anonymous access couldn’t show us were finally visible. netexec listing the share inventory under the admin context:
And dipping into the ADMIN$ share to confirm full access:
9. Pass-the-hash, the cherry on top
To round things out, we demonstrated Pass-the-Hash (PtH): instead of a password, we authenticated with an NTLM hash alone. Using the smannai user’s hash, netexec gave us a valid session without ever knowing the plaintext password.
That’s the full predicate of AD compromise, with one dumped hash you can move laterally across the entire domain.
The takeaway
A complete Active Directory kill chain, from anonymous SMB to Domain Admin + Administrator + Pass-the-Hash, resolved without writing a single exploit. The root cause was never a missing patch or an exotic CVE, it was simple credential exposure — and that’s exactly what made it so easy.