# Initial Compromise of Active Directory
## Summary
Since both machines are accessible, we can select one to continue our progress within the network. Upon logging into the **WRK2** machine, we begin by inspecting the user profile to identify any available methods for privilege escalation. Notably, we find a **netcat** executable within the **Downloads** folder.
## Privilege Escalation
We use the command:
```bash
schtasks /query /fo csv /v | findstr "SYSTEM" > tasks.csv
```
to create a CSV file that lists tasks running with administrative privileges (the \`/fo csv\` option outputs the data in CSV format).
Reviewing the file, we see that most tasks are located in the `Windows` directory, indicating they are likely well-configured. However, a closer look at the CSV file shows one specific task running from `C:\SYNC\sync.bat`.
To verify the permissions of the file, we use the command:
```bash
icacls C:\SYNC\sync.bat
```
This confirms that our user has `(F) Full Access` to the file.
With this information, we can set up a listener using the previously found **`netcat`** executable. We then modify the task to connect back to our listener using **netcat** with administrative privileges, allowing us to receive an elevated reverse shell.
After a few minutes (no more than 5), we should receive our administrative reverse shell. Alternatively, we can trigger the task immediately by using the following command:
```bash
schtasks /run /tn FULLSYNC
```
This forces the reverse shell to initiate instantly.
## Flag 4
{% hint style="info" %}
**NOTE**: We are now able to obtain the following flags by following the instructions on the e-citizen platform:
* **Flag 4**: Administrative access to Corporate Division Tier 2 Infrastructure
{% endhint %}
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://bunring.gitbook.io/ctf-writeups/red-team-capstone-challenge-tryhackme/initial-compromise-of-active-directory.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
