Constrained-Delegation

Overview Pirate is a Windows Active Directory box built around delegation abuse. The domain controller, DC01, doubles as a Hyper-V host: a second web server, WEB01, runs as a guest VM on an internal virtual switch (192.168.100.0/24) that is not directly reachable from the VPN. The only externally reachable host is DC01 itself. The captured chain starts with two Group Managed Service Account NTLM hashes (gMSA_ADCS_prod$ and gMSA_ADFS_prod$). Because gMSA managed-password blobs are stored in LDAP and readable by authorized principals, their NTLM hashes can be derived without ever cracking a password, and both accounts are allowed to log in over WinRM. That gives a foothold on DC01, from which a chisel reverse SOCKS tunnel opens the internal 192.168.100.0/24 segment and WEB01. ...

Overview Redelegate is a Windows Active Directory Domain Controller that layers a chain of small misconfigurations into a full domain compromise. The box exposes anonymous FTP alongside the usual DC services and a Microsoft SQL Server instance. The FTP share leaks a shared KeePass database and a couple of “audit” documents, one of which conveniently hints at the exact weak password pattern in use on the domain (SeasonYear!). That hint cracks the KeePass passphrase, which in turn yields a set of stored credentials. ...