HTB CAPE: Initial Access and Foothold in AD Environments

What this domain tests

Initial Access and Foothold tests how you turn enumeration into a first valid credential or shell inside AD. Common paths are password spraying, AS-REP roasting, Kerberoasting, NTLM relay, and abusing exposed services such as MSSQL or WinRM.

Core rules and concepts

• Always read password policy and lockout threshold; spray one password across many users, never many passwords across one user.
• AS-REP roasting requires DONT_REQ_PREAUTH; Kerberoasting requires an SPN and a crackable service account password.
• NTLM relay needs a host without SMB signing or LDAP signing. mitm6 can coerce WPAD or proxy authentication over IPv6.
• Validate credentials with netexec across SMB, WinRM, LDAP, and MSSQL because access is protocol-specific.

Worked example

Enumeration finds user jdoe with DONT_REQ_PREAUTH. Request the AS-REP with impacket-GetNPUsers domain/ -usersfile users.txt -format hashcat -outputfile asrep.txt, then crack with hashcat mode 18200. The recovered password works on SMB but not WinRM. Reasoning: a valid credential is not a shell; test each protocol and record which one grants access. If SMB works, enumerate shares for scripts containing credentials before attempting a noisy service exploit.

Traps that cost marks

• Spraying without checking the lockout threshold and locking out the account you need.
• Relaying NTLM to a host that enforces SMB signing or LDAP signing.
• Kerberoasting a honey account or a service account with an uncrackable password.
• Ignoring IPv6 and mitm6 when IPv4 relay paths are blocked.
• Assuming one protocol proves access everywhere; validate separately.