Samba Active Directory: no credentials to Domain Admin

Context

A throwaway Samba AD domain (lab.local) was built in an isolated Docker network for this exercise: one domain controller and one attacker host. The attacker starts with a network position and nothing else.

What the skills did

• Anonymous enumeration. Null-session SMB and RPC queries returned the domain user list with no credentials.
• Password spraying. A small, lockout-safe candidate list, tried once per account, found two valid accounts on the first pass.
• Privilege escalation through an ACL. One service account held an over-broad right to reset the built-in Administrator's password. The reset needed no knowledge of the old one.
• Domain Admin. Access as Administrator was confirmed by creating a proof-of-concept account and checking it independently. That account was then deleted.

What went wrong, and why it stays in

• AS-REP Roasting, Kerberoasting, and DCSync all failed. The causes were interoperability gaps between Samba's KDC and DRSUAPI and the impacket tooling, not hardening. The report records each failure and says the techniques need re-validating against a real Windows domain controller.
• About seven of the roughly fourteen minutes went to these dead ends. Leaving them out would make the run look cleaner and less useful to someone repeating it.

What it shows

• Planted findings are labelled. Two critical findings were added mid-engagement, with the owner's approval, so a complete chain could be shown. The reports mark them as lab-injected in the executive summary, in each affected finding, and in the stakeholder note.
• Methodology over exploit reliability. A two-host lab has no Windows enterprise features, so lateral movement and LSASS theft could not be tested. The run shows the skill can drive the whole method and produce usable output. It does not show the Windows-specific techniques are reliable.
• Cleanup is part of the job. The proof-of-concept account was removed. The report notes that the Administrator password was left changed and must be reset before the lab is reused.

Lessons

• Document dead ends with their causes. A future tester will hit the same interop gaps.
• Label every planted finding, so a reader can tell discovered from added.
• Say what the target cannot prove. A two-host lab cannot stand in for a forest.

Generated files

Three PDFs, rendered from Markdown by the skill's render script.