Sendai

🎯 Executive Summary

Sendai is a medium-difficulty Windows Server 2022 Active Directory machine on VulnLab. The attack path starts with Guest-accessible SMB services, proceeds through domain-user enumeration and abuse of an account required to change its password, and continues through Active Directory access-control weaknesses. The final escalation involves modifying an AD CS certificate template through ESC4, making it vulnerable to ESC1 and enabling impersonation of a privileged account.

This English companion covers the full attack chain and defensive lessons. The Italian write-up contains the original command-by-command walkthrough, screenshots, and detailed tool output.

Reconnaissance

Network and SMB discovery

Initial enumeration identified a Windows domain environment exposing standard Active Directory services. SMB access as Guest was particularly important: it provided a way to discover domain resources without starting with valid domain-user credentials.

User enumeration (RID cycling)

The permissive SMB configuration allowed domain identities to be enumerated. This reduced the search space for subsequent account and permission analysis.

Forced password change

A discovered account was configured with the UserMustChangePassword condition. The lab’s access and account configuration made a password-change path relevant to obtaining an initial authenticated foothold. The important lesson is that password lifecycle settings and delegated reset rights must be considered together: an account’s nominal privilege level alone does not describe the available attack paths.

Active Directory enumeration

BloodHound and ACL relationships

After obtaining domain access, graph-based enumeration exposed relationships between users, groups and service identities. These relationships were central to the attack: a chain of delegated permissions can yield substantially more access than any single group membership suggests.

Lateral movement through gMSA permissions

A service account configured as a group Managed Service Account (gMSA) became an escalation opportunity because access-control relationships allowed its managed password to be retrieved. In the lab, the Support group had GenericAll over AdmSvc, and the resulting permission chain enabled access to the mgtsvc$ service-account secret.

gMSAs automate password management, but they do not eliminate the need to tightly restrict which principals can retrieve their passwords.

AD CS exploitation

ESC4: Certificate template control

The next step relied on excessive rights over an Active Directory Certificate Services certificate template. ESC4 describes a situation in which an attacker can modify a template’s security-relevant configuration.

Converting ESC4 into ESC1

The template configuration could be changed to introduce ESC1-style certificate enrollment conditions. In practical terms, this meant that the template could be made to accept an attacker-supplied identity for certificate issuance, provided the relevant enrollment and authentication conditions were met.

Certificate authentication and domain compromise

With the modified template, the lab attack chain proceeded to certificate-based impersonation of Administrator and ultimately domain-level compromise. This illustrates why AD CS permissions are part of the Active Directory privilege boundary, rather than a separate administrative concern.

🛡️ Remediation & Defense

• Restrict anonymous and Guest SMB access. Review share permissions and domain enumeration exposure.
• Audit account reset and password-change delegation. Remove unnecessary reset rights and investigate accounts left in transitional password states.
• Review Active Directory ACL attack paths. Pay special attention to GenericAll, WriteDACL, WriteOwner and other delegated rights over security-sensitive groups and identities.
• Protect gMSA password retrieval. Limit principals allowed to read managed passwords and monitor changes to those permissions.
• Harden AD CS templates. Restrict template modification and enrollment rights, prevent arbitrary subject identity injection where inappropriate, and audit changes to certificate-template configuration.
• Monitor certificate-based authentication. Correlate unusual certificate issuance with privileged-account logons.

Original technical walkthrough

For the complete evidence trail, terminal commands, and screenshots, see the original Italian Sendai write-up.