One credential in. Every host in Ninja Hacker Academy out.

The seeded credential was validated against 47 services across all five hosts through twelve lanes. Forty-six rejected it — sa is a local SQL Server principal, so it had no business succeeding anywhere else. The one acceptance was enough to own the tier.

1. 01
   Assumed breach

   saattached to the subnet root as a graph entity
2. Validated across 47 services in 12 lanes
3. 02
   One acceptance

   192.168.57.22:1433SQL\SQLEXPRESS
4. Server principal and configuration enumeration
5. 03
   Authorization mapped

   7 sysadmin loginsincl. academy\frank and SQL\vagrant
6. xp_cmdshell enabled on the instance
7. 04
   Execution proven

   sqlOS command execution in the service context

   Code execution
8. 05
   Machine context

   SQL$the computer account's directory rights

• What it gave up
• academy\frank — a domain user holding sysadmin, learned without touching a DC
• SQL\vagrant — a provisioning account left with database administrator rights
• xp_cmdshell enabled — OS command execution in the SQL service context

NHA's designed entry point is the IIS application here. PCE never needed it. web entered the engagement as a machine account inside a container that SQL$ controlled — a different door into the same building, and one no application patch would have closed.

1. 01
   Container control

   SQL$GenericAll on CN=Computers,DC=academy
2. Write msDS-AllowedToActOnBehalfOfOtherIdentity
3. 02
   RBCD configured

   webimpersonate arbitrary users to its services
4. Authenticated host access
5. 03
   Local escalation

   writable scheduled-task command pathservice running as SYSTEM
6. Path overwritten, task executes
7. 04
   SYSTEM on WEB

   web192.168.57.21

   SYSTEM

• What it gave up
• Resource-based delegation write on the machine object
• SYSTEM execution via a writable scheduled-task path

The starting credential had no privileged access to share. frank's delegation configuration did. Protocol transition makes this a full impersonation primitive rather than a restricted forwarding rule, and the service class on the second hop is not enforced.

1. 01
   Delegation collected

   academy\franktrusted to authenticate for delegation
2. Ticket obtained on behalf of any user
3. 02
   Allowed target

   eventlog/share.academy.ninja.lanservice class unenforced on the second hop
4. Service class swapped, access widened
5. 03
   Privileged on SHARE

   share192.168.57.23

   Privileged access
6. Local privilege-escalation enumeration
7. 04
   SYSTEM on SHARE

   writable scheduled-task command pathshare data recovered

• What it gave up
• A privileged service ticket to a host the starting credential had no rights on
• SYSTEM execution via a writable scheduled-task path
• Share contents recovered
• The authorized-host position for the gmsaNFS managed service account

With host footholds established, PCE collected the academy directory and worked the authorization model rather than looking for an exploit. Dangerous ACLs, delegation attributes and the trust configuration all came from ordinary authenticated reads.

1. 01
   Directory collected

   dc-acusers, groups, containers, ACL graph
2. ACL, delegation and trust enumeration
3. 02
   Dangerous ACLs

   GenericAll · WriteDacl · WriteOwnerincl. rights over AdminSDHolder
4. Abuse paths walked, not just listed
5. 03
   Delegation surface

   constrained · unconstrained · RBCDall three classes present
6. Trust configuration read from both sides
7. 04
   ACL abuse proven

   academy.ninja.landirectory-level control paths established

   ACL abuse

• What it gave up
• Dangerous ACL graph across the academy domain, with abuse paths walked
• AdminSDHolder rights — persistence that reapplies itself after cleanup
• Bidirectional trust to ninja.hack, enumerated from both domain controllers

The bidirectional trust carried the engagement out of academy and into the second forest. PCE reached dc-vil, collected the ninja directory, and enumerated the certificate authority's full object set — the root CA, the enterprise CA, the NT auth store and the published templates.

1. 01
   Trust traversed

   academy.ninja.lan ⇄ ninja.hackbidirectional, both directions enumerated
2. Cross-forest authentication
3. 02
   Second forest reached

   dc-vil192.168.57.10
4. Certificate-services enumeration
5. 03
   CA object set collected

   NINJA-CAroot CA · enterprise CA · templates · NT auth store

   CA mapped

• What it gave up
• Bidirectional forest trust confirmed from both domain controllers
• NINJA-CA certificate authority object set collected
• The certificate template every ninja-side escalation runs through