I85PREP
⌘ K
eJPT study materials
eJPT study resources

Domain Admin Without Stopping the Production Line

eJPT · Put your knowledge to work in context.

All case studies

Domain Admin Without Stopping the Production Line

You have a foothold on 10.10.20.77, a Windows 10 workstation belonging to a plant maintenance team, obtained by cracking an NTLMv2 challenge with the password 'Maintenance1'. It is 03:10 local time; the plant runs three shifts and the SCADA-adjacent production line is live. A ping sweep and net view show a flat /24. Nmap -sV reports: 10.10.20.10, the domain controller and PDC emulator for 400 users, where the smb-vuln-ms17-010 script returns VULNERABLE and SMB signing is not required; 10.10.20.45, a file server with SMB signing not required and a backups$ share readable by Domain Users; 10.10.20.60, a human-machine interface workstation running VNC with no authentication on the production VLAN. Your objective from the client is 'domain admin, and demonstrate impact on production without affecting availability'.

1. Rank your escalation paths and justify the ordering for tonight.

Read the worked answer

Cheapest, lowest-blast-radius first:

  1. backups$ on 10.10.20.45 (start here). Read-only, no exploit, no service restart. Backup shares routinely contain unattend.xml, scheduled-task exports, web.config and service-account scripts. Highest expected yield per unit of risk in the entire network.
  2. GPP / SYSVOL and credential material reached with whatever those backups give you. Still read-only.
  3. NTLM relay to 10.10.20.45, because signing is not required. Plan B: it needs a coercion primitive, and coercion means touching a live host.
  4. MS17-010 on the DC: validate, do not exploit. The nmap script is a check, not proof, and it false-positives. More importantly, kernel memory-corruption exploits against a PDC during a live shift risk a bugcheck that takes authentication down for the whole plant. Blast radius is 400 users and a production line. That trade is not yours to make at 03:10 with no approval.
  5. 10.10.20.60 VNC. Do not connect. It is on the production VLAN and interactive access to an HMI during a live shift violates the stated availability objective. Report it from scan evidence.

Report note: 'MS17-010 reported VULNERABLE by nmap; not exploited - availability risk on a PDC during production hours; recommend out-of-band validation in a maintenance window.'

2. You want to use the disabled SMB signing. What are the preconditions, and what would make you abandon it?

Read the worked answer

Relay is not a single finding - it is a chain, and every link has to hold.

Preconditions:

  • SMB signing not required on the target (10.10.20.45 qualifies). Note signing on the DC does not help you relay to a member server, and you cannot relay a host to itself.
  • A coercible authentication: a machine or user account you can make authenticate to you. That means a coercion primitive (printer/EFSRPC-style) or a lure - a shortcut or library file in a share someone opens at logon.
  • NTLM not blocked end-to-end, and SMB reachable from your position (it is, flat /24).
  • The relayed identity must actually have rights on the target.

Abandon if: the only viable coercion primitive sits on a production host, the lure requires modifying a share that other teams depend on during shift hours, or the client's EDR is already alerting on the workstation you are on. Write the finding up as relay-susceptible, exploitation not attempted with the exact conditions - that is still a remediation item, and it is honest.

3. How do you satisfy 'demonstrate impact on production' without touching the production VLAN?

Read the worked answer

Demonstrate capability, not consequences.

Once you hold domain admin via the backup-share path:

  • Read (do not modify) the backup share as a domain admin and show the scope of what is readable - file count, categories, presence of credential material. Redact content in the report.
  • Show that you can read a GPO linked to an OU that contains a production-adjacent server, and that you can write to SYSVOL. Then demonstrate the write on a non-production OU only: deploy a benign marker file or a login banner to a single IT test workstation and screenshot it applying.
  • Show delegated rights and the group nesting path from your foothold user to Domain Admins, with the exact commands and the timestamp of each hop.

What you explicitly do not do: log into 10.10.20.60, push a GPO anywhere near the HMI OU, restart a service, or leave a scheduled task behind. Availability is the client's stated red line; a report that says 'we could have, here is the proof of access, we did not' is a stronger deliverable than a stopped line.