A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
November 2022. Manufacturing client, 4,000 users. I'd been stuck for two days. Kerberoasting yielded nothing crackable. Password spraying hit zero accounts. LLMNR poisoning got me a standard user with no interesting rights. Then I ran BloodHound's Transitive Object Control query on that standard user and found an 11-hop path to a DCSync-capable account. Eleven hops. But each hop was a single command.
The chain I'll walk through here is shorter. Four hops. But the technique is identical. You chain permissions until you reach an account with replication rights, then DCSync the domain. Every step is reversible. Every step is logged in your notes. And every step gets cleaned up before you submit the report.
Help Desk Level 1 is nested inside Information Technology. Through nested group membership, damundsen now inherits all rights granted to Information Technology. And Information Technology has GenericAll over the user adunn.
Crack that hash offline. You now have adunn's password. And adunn has DS-Replication-Get-Changes and DS-Replication-Get-Changes-All over the domain object. DCSync rights. Full domain compromise.
Order matters. Remove the SPN FIRST while you still have GenericAll rights (via group membership). Remove group membership SECOND. If you reverse the order, you lose the permissions needed to clear the SPN. Also: you cannot restore damundsen's original password unless you knew it beforehand. Coordinate with the client to have them reset it.
You've chained four ACL misconfigurations into full domain compromise. The client's report now includes a critical finding with a clear remediation path: remove the excessive ACEs, audit nested group membership, and implement regular BloodHound scans. The next step is actually performing the DCSync with adunn's credentials.
Finish the lesson once you have worked through the material. This awards ★ 50 XP.